Hold request B's upload while request A tells Caesium to close the origin connection. A should receive 502. Finishing B then exercises Tungsten's 523 / REFUSED_STREAM path for a request that has not reached the origin.
Open this page through Tungsten on an inspected, allowed HTTPS host with upload content inspection disabled. Use the H2 port: 8443 locally or 443 in GKE. The browser must support streaming fetch uploads, such as Chrome or Edge.
Ready.
Each run prints a probe ID to find both requests in Tungsten's logs.
With 3 or more held uploads, each B becomes an unsent request (523) on the same tunnel. Every one must settle within milliseconds of its release (PXY-6950). A B that is still open at the deadline was never answered by Tungsten; the run then cancels it, and the request log shows it as 487 with the wait as its latency.
The browser cannot report GOAWAY or REFUSED_STREAM to JavaScript, and it chooses
connection reuse and retries. A network error on B is consistent with a refusal, but does not prove
523. Confirm /upload?probe=… has status 523 in Tungsten's request log.
For exact frame checks, use caesium/scripts/h2_close_probe.py.
Bodies are 128 bytes, below Tungsten's DLP upload threshold, so upload
inspection does not reconnect to the origin. A policy that requires upload inspection still
does; the log then shows req.ci and conn.origin.retry_local.
This runner keeps B below the 4 KiB body preview limit with small chunks, then finishes it after A's 502. The run stops after 10 seconds. Browser streaming uploads have no Content-Length; the small chunks keep Tungsten's normal preview wait active. Streaming fetch requirements.