Fixes #10874. After an abnormal client death the dead connection kept its admission slot until the QUIC idle timeout, so the same identity's redial was refused "connection_capacity" or "connection_identity_capacity" for the 2-9 minutes the timer needed. Two mechanisms, both driven by state the server already owns: 1. Identity-scoped preemption. A TLS-authenticated peer may always run one replacement admission against its own connections: the replacement reservation in registerEstablished no longer requires a never-usable predecessor or a per-identity bound above 1, and markAdmitted admits one connection over the bound when the same identity's predecessors are all usable (a dead peer's session stays "usable" until the transport notices). The predecessor is retired only by markUsable, after the replacement proves itself end to end, so a live session is never torn down for an unproven redial. 2. Transport-signal release. Every active connection gets a close watcher on connection.waitUntilClosed() (the driver's own terminal signal: peer close, transport error, or its timeout). The slot is released and the handler cancelled the moment the signal fires, instead of when the parked handler unwinds. Anti-DoS bounds are preserved: the global pending cap and the one-pending-admission-per-identity cap are unchanged, a replacement reservation exists only while no other admission from that identity is pending, the transient overshoot is at most one connection per identity that already holds a slot, and an identity with no connection of its own can never preempt anyone (pinned by the new differentIdentityCannotPreemptAnotherIdentitysSlot test). fullServerRejectsReconnectCandidateWithoutDisruptingActiveConnection asserted the defect (same-identity reconnect refused at full capacity); it now asserts the replacement semantics and keeps its stranger-refusal half.

Commits

Commits on Aug 25, 2026

Commits on Aug 26, 2026

Commits on Aug 27, 2026