feat(leveva)!: per-connection SendQ accounting + Max-SendQ backpressure kill
The per-connection mailbox was an unbounded `mpsc`, so a client that stops
reading its socket (TCP backpressure blocks its serve loop's `write_all`)
let every other connection's fan-out pile onto its queue without limit — a
write-side memory DoS, the twin of the slice-118 recvq cap. `STATS l`'s
`<sendq>` was hardcoded to 0 for the same reason.
Account the live queue depth on the slice-145 shared `ConnStats`: the
registry's four client-delivery sites add a frame's `wire_len` on enqueue,
`serve_client` drains it on dequeue. `sendq_admit(len, max)` kills a
connection whose depth overruns its ceiling — it latches dead (one
terminal `ERROR :Closing Link: <host> (Max SendQ exceeded)` eject, the
rest dropped, bounding memory even under a wedged socket). KILL ejects and
collision SAVEs bypass the cap (control plane, always delivered).
The ceiling is the connection class's `sendq`, or `DEFAULT_SENDQ` (1 MiB)
when the class sets none — a local client always has a ceiling (a SendQ
limit is a safety mechanism, never truly unbounded, like the oracle's
MAXSENDQ). Remote-user / test claims (`try_claim`, no serve loop draining
them) pass `sendq_max = 0`: accounted but never killed. `STATS l` now
renders the live depth (canonicalizer already masks the 211 tail).
Test fixtures carried a cosmetic `sendq 1000` (meaningless when it was
unenforced; 1000 bytes can't hold a handful of lines). Now that it is
load-bearing, bump every fixture to the shipped example's realistic
`512000`, and refresh the one `STATS Y` golden that snapshots it.
Unit-tested (connstats admit/overflow/drain/latch + registry eject/bypass/
depth, with inverse round-trips); the kill path is timing-dependent over a
real socket so it is fuzzed/unit-tested rather than boot-golden'd.
feat(leveva)!: per-connection SendQ accounting + Max-SendQ backpressure kill
The per-connection mailbox was an unbounded `mpsc`, so a client that stops
reading its socket (TCP backpressure blocks its serve loop's `write_all`)
let every other connection's fan-out pile onto its queue without limit — a
write-side memory DoS, the twin of the slice-118 recvq cap. `STATS l`'s
`<sendq>` was hardcoded to 0 for the same reason.
Account the live queue depth on the slice-145 shared `ConnStats`: the
registry's four client-delivery sites add a frame's `wire_len` on enqueue,
`serve_client` drains it on dequeue. `sendq_admit(len, max)` kills a
connection whose depth overruns its ceiling — it latches dead (one
terminal `ERROR :Closing Link: <host> (Max SendQ exceeded)` eject, the
rest dropped, bounding memory even under a wedged socket). KILL ejects and
collision SAVEs bypass the cap (control plane, always delivered).
The ceiling is the connection class's `sendq`, or `DEFAULT_SENDQ` (1 MiB)
when the class sets none — a local client always has a ceiling (a SendQ
limit is a safety mechanism, never truly unbounded, like the oracle's
MAXSENDQ). Remote-user / test claims (`try_claim`, no serve loop draining
them) pass `sendq_max = 0`: accounted but never killed. `STATS l` now
renders the live depth (canonicalizer already masks the 211 tail).
Test fixtures carried a cosmetic `sendq 1000` (meaningless when it was
unenforced; 1000 bytes can't hold a handful of lines). Now that it is
load-bearing, bump every fixture to the shipped example's realistic
`512000`, and refresh the one `STATS Y` golden that snapshots it.
Unit-tested (connstats admit/overflow/drain/latch + registry eject/bypass/
depth, with inverse round-trips); the kill path is timing-dependent over a
real socket so it is fuzzed/unit-tested rather than boot-golden'd.
feat(leveva)!: per-connection SendQ accounting + Max-SendQ backpressure kill
The per-connection mailbox was an unbounded `mpsc`, so a client that stops
reading its socket (TCP backpressure blocks its serve loop's `write_all`)
let every other connection's fan-out pile onto its queue without limit — a
write-side memory DoS, the twin of the slice-118 recvq cap. `STATS l`'s
`<sendq>` was hardcoded to 0 for the same reason.
Account the live queue depth on the slice-145 shared `ConnStats`: the
registry's four client-delivery sites add a frame's `wire_len` on enqueue,
`serve_client` drains it on dequeue. `sendq_admit(len, max)` kills a
connection whose depth overruns its ceiling — it latches dead (one
terminal `ERROR :Closing Link: <host> (Max SendQ exceeded)` eject, the
rest dropped, bounding memory even under a wedged socket). KILL ejects and
collision SAVEs bypass the cap (control plane, always delivered).
The ceiling is the connection class's `sendq`, or `DEFAULT_SENDQ` (1 MiB)
when the class sets none — a local client always has a ceiling (a SendQ
limit is a safety mechanism, never truly unbounded, like the oracle's
MAXSENDQ). Remote-user / test claims (`try_claim`, no serve loop draining
them) pass `sendq_max = 0`: accounted but never killed. `STATS l` now
renders the live depth (canonicalizer already masks the 211 tail).
Test fixtures carried a cosmetic `sendq 1000` (meaningless when it was
unenforced; 1000 bytes can't hold a handful of lines). Now that it is
load-bearing, bump every fixture to the shipped example's realistic
`512000`, and refresh the one `STATS Y` golden that snapshots it.
Unit-tested (connstats admit/overflow/drain/latch + registry eject/bypass/
depth, with inverse round-trips); the kill path is timing-dependent over a
real socket so it is fuzzed/unit-tested rather than boot-golden'd.
feat(leveva)!: per-connection SendQ accounting + Max-SendQ backpressure kill
The per-connection mailbox was an unbounded `mpsc`, so a client that stops
reading its socket (TCP backpressure blocks its serve loop's `write_all`)
let every other connection's fan-out pile onto its queue without limit — a
write-side memory DoS, the twin of the slice-118 recvq cap. `STATS l`'s
`<sendq>` was hardcoded to 0 for the same reason.
Account the live queue depth on the slice-145 shared `ConnStats`: the
registry's four client-delivery sites add a frame's `wire_len` on enqueue,
`serve_client` drains it on dequeue. `sendq_admit(len, max)` kills a
connection whose depth overruns its ceiling — it latches dead (one
terminal `ERROR :Closing Link: <host> (Max SendQ exceeded)` eject, the
rest dropped, bounding memory even under a wedged socket). KILL ejects and
collision SAVEs bypass the cap (control plane, always delivered).
The ceiling is the connection class's `sendq`, or `DEFAULT_SENDQ` (1 MiB)
when the class sets none — a local client always has a ceiling (a SendQ
limit is a safety mechanism, never truly unbounded, like the oracle's
MAXSENDQ). Remote-user / test claims (`try_claim`, no serve loop draining
them) pass `sendq_max = 0`: accounted but never killed. `STATS l` now
renders the live depth (canonicalizer already masks the 211 tail).
Test fixtures carried a cosmetic `sendq 1000` (meaningless when it was
unenforced; 1000 bytes can't hold a handful of lines). Now that it is
load-bearing, bump every fixture to the shipped example's realistic
`512000`, and refresh the one `STATS Y` golden that snapshots it.
Unit-tested (connstats admit/overflow/drain/latch + registry eject/bypass/
depth, with inverse round-trips); the kill path is timing-dependent over a
real socket so it is fuzzed/unit-tested rather than boot-golden'd.
feat(leveva)!: per-connection SendQ accounting + Max-SendQ backpressure kill
The per-connection mailbox was an unbounded `mpsc`, so a client that stops
reading its socket (TCP backpressure blocks its serve loop's `write_all`)
let every other connection's fan-out pile onto its queue without limit — a
write-side memory DoS, the twin of the slice-118 recvq cap. `STATS l`'s
`<sendq>` was hardcoded to 0 for the same reason.
Account the live queue depth on the slice-145 shared `ConnStats`: the
registry's four client-delivery sites add a frame's `wire_len` on enqueue,
`serve_client` drains it on dequeue. `sendq_admit(len, max)` kills a
connection whose depth overruns its ceiling — it latches dead (one
terminal `ERROR :Closing Link: <host> (Max SendQ exceeded)` eject, the
rest dropped, bounding memory even under a wedged socket). KILL ejects and
collision SAVEs bypass the cap (control plane, always delivered).
The ceiling is the connection class's `sendq`, or `DEFAULT_SENDQ` (1 MiB)
when the class sets none — a local client always has a ceiling (a SendQ
limit is a safety mechanism, never truly unbounded, like the oracle's
MAXSENDQ). Remote-user / test claims (`try_claim`, no serve loop draining
them) pass `sendq_max = 0`: accounted but never killed. `STATS l` now
renders the live depth (canonicalizer already masks the 211 tail).
Test fixtures carried a cosmetic `sendq 1000` (meaningless when it was
unenforced; 1000 bytes can't hold a handful of lines). Now that it is
load-bearing, bump every fixture to the shipped example's realistic
`512000`, and refresh the one `STATS Y` golden that snapshots it.
Unit-tested (connstats admit/overflow/drain/latch + registry eject/bypass/
depth, with inverse round-trips); the kill path is timing-dependent over a
real socket so it is fuzzed/unit-tested rather than boot-golden'd.
feat(leveva)!: per-connection SendQ accounting + Max-SendQ backpressure kill
The per-connection mailbox was an unbounded `mpsc`, so a client that stops
reading its socket (TCP backpressure blocks its serve loop's `write_all`)
let every other connection's fan-out pile onto its queue without limit — a
write-side memory DoS, the twin of the slice-118 recvq cap. `STATS l`'s
`<sendq>` was hardcoded to 0 for the same reason.
Account the live queue depth on the slice-145 shared `ConnStats`: the
registry's four client-delivery sites add a frame's `wire_len` on enqueue,
`serve_client` drains it on dequeue. `sendq_admit(len, max)` kills a
connection whose depth overruns its ceiling — it latches dead (one
terminal `ERROR :Closing Link: <host> (Max SendQ exceeded)` eject, the
rest dropped, bounding memory even under a wedged socket). KILL ejects and
collision SAVEs bypass the cap (control plane, always delivered).
The ceiling is the connection class's `sendq`, or `DEFAULT_SENDQ` (1 MiB)
when the class sets none — a local client always has a ceiling (a SendQ
limit is a safety mechanism, never truly unbounded, like the oracle's
MAXSENDQ). Remote-user / test claims (`try_claim`, no serve loop draining
them) pass `sendq_max = 0`: accounted but never killed. `STATS l` now
renders the live depth (canonicalizer already masks the 211 tail).
Test fixtures carried a cosmetic `sendq 1000` (meaningless when it was
unenforced; 1000 bytes can't hold a handful of lines). Now that it is
load-bearing, bump every fixture to the shipped example's realistic
`512000`, and refresh the one `STATS Y` golden that snapshots it.
Unit-tested (connstats admit/overflow/drain/latch + registry eject/bypass/
depth, with inverse round-trips); the kill path is timing-dependent over a
real socket so it is fuzzed/unit-tested rather than boot-golden'd.
feat(leveva)!: per-connection SendQ accounting + Max-SendQ backpressure kill
The per-connection mailbox was an unbounded `mpsc`, so a client that stops
reading its socket (TCP backpressure blocks its serve loop's `write_all`)
let every other connection's fan-out pile onto its queue without limit — a
write-side memory DoS, the twin of the slice-118 recvq cap. `STATS l`'s
`<sendq>` was hardcoded to 0 for the same reason.
Account the live queue depth on the slice-145 shared `ConnStats`: the
registry's four client-delivery sites add a frame's `wire_len` on enqueue,
`serve_client` drains it on dequeue. `sendq_admit(len, max)` kills a
connection whose depth overruns its ceiling — it latches dead (one
terminal `ERROR :Closing Link: <host> (Max SendQ exceeded)` eject, the
rest dropped, bounding memory even under a wedged socket). KILL ejects and
collision SAVEs bypass the cap (control plane, always delivered).
The ceiling is the connection class's `sendq`, or `DEFAULT_SENDQ` (1 MiB)
when the class sets none — a local client always has a ceiling (a SendQ
limit is a safety mechanism, never truly unbounded, like the oracle's
MAXSENDQ). Remote-user / test claims (`try_claim`, no serve loop draining
them) pass `sendq_max = 0`: accounted but never killed. `STATS l` now
renders the live depth (canonicalizer already masks the 211 tail).
Test fixtures carried a cosmetic `sendq 1000` (meaningless when it was
unenforced; 1000 bytes can't hold a handful of lines). Now that it is
load-bearing, bump every fixture to the shipped example's realistic
`512000`, and refresh the one `STATS Y` golden that snapshots it.
Unit-tested (connstats admit/overflow/drain/latch + registry eject/bypass/
depth, with inverse round-trips); the kill path is timing-dependent over a
real socket so it is fuzzed/unit-tested rather than boot-golden'd.
feat(leveva)!: per-connection SendQ accounting + Max-SendQ backpressure kill
The per-connection mailbox was an unbounded `mpsc`, so a client that stops
reading its socket (TCP backpressure blocks its serve loop's `write_all`)
let every other connection's fan-out pile onto its queue without limit — a
write-side memory DoS, the twin of the slice-118 recvq cap. `STATS l`'s
`<sendq>` was hardcoded to 0 for the same reason.
Account the live queue depth on the slice-145 shared `ConnStats`: the
registry's four client-delivery sites add a frame's `wire_len` on enqueue,
`serve_client` drains it on dequeue. `sendq_admit(len, max)` kills a
connection whose depth overruns its ceiling — it latches dead (one
terminal `ERROR :Closing Link: <host> (Max SendQ exceeded)` eject, the
rest dropped, bounding memory even under a wedged socket). KILL ejects and
collision SAVEs bypass the cap (control plane, always delivered).
The ceiling is the connection class's `sendq`, or `DEFAULT_SENDQ` (1 MiB)
when the class sets none — a local client always has a ceiling (a SendQ
limit is a safety mechanism, never truly unbounded, like the oracle's
MAXSENDQ). Remote-user / test claims (`try_claim`, no serve loop draining
them) pass `sendq_max = 0`: accounted but never killed. `STATS l` now
renders the live depth (canonicalizer already masks the 211 tail).
Test fixtures carried a cosmetic `sendq 1000` (meaningless when it was
unenforced; 1000 bytes can't hold a handful of lines). Now that it is
load-bearing, bump every fixture to the shipped example's realistic
`512000`, and refresh the one `STATS Y` golden that snapshots it.
Unit-tested (connstats admit/overflow/drain/latch + registry eject/bypass/
depth, with inverse round-trips); the kill path is timing-dependent over a
real socket so it is fuzzed/unit-tested rather than boot-golden'd.
feat(leveva)!: per-connection SendQ accounting + Max-SendQ backpressure kill
The per-connection mailbox was an unbounded `mpsc`, so a client that stops
reading its socket (TCP backpressure blocks its serve loop's `write_all`)
let every other connection's fan-out pile onto its queue without limit — a
write-side memory DoS, the twin of the slice-118 recvq cap. `STATS l`'s
`<sendq>` was hardcoded to 0 for the same reason.
Account the live queue depth on the slice-145 shared `ConnStats`: the
registry's four client-delivery sites add a frame's `wire_len` on enqueue,
`serve_client` drains it on dequeue. `sendq_admit(len, max)` kills a
connection whose depth overruns its ceiling — it latches dead (one
terminal `ERROR :Closing Link: <host> (Max SendQ exceeded)` eject, the
rest dropped, bounding memory even under a wedged socket). KILL ejects and
collision SAVEs bypass the cap (control plane, always delivered).
The ceiling is the connection class's `sendq`, or `DEFAULT_SENDQ` (1 MiB)
when the class sets none — a local client always has a ceiling (a SendQ
limit is a safety mechanism, never truly unbounded, like the oracle's
MAXSENDQ). Remote-user / test claims (`try_claim`, no serve loop draining
them) pass `sendq_max = 0`: accounted but never killed. `STATS l` now
renders the live depth (canonicalizer already masks the 211 tail).
Test fixtures carried a cosmetic `sendq 1000` (meaningless when it was
unenforced; 1000 bytes can't hold a handful of lines). Now that it is
load-bearing, bump every fixture to the shipped example's realistic
`512000`, and refresh the one `STATS Y` golden that snapshots it.
Unit-tested (connstats admit/overflow/drain/latch + registry eject/bypass/
depth, with inverse round-trips); the kill path is timing-dependent over a
real socket so it is fuzzed/unit-tested rather than boot-golden'd.
feat(leveva)!: per-connection SendQ accounting + Max-SendQ backpressure kill
The per-connection mailbox was an unbounded `mpsc`, so a client that stops
reading its socket (TCP backpressure blocks its serve loop's `write_all`)
let every other connection's fan-out pile onto its queue without limit — a
write-side memory DoS, the twin of the slice-118 recvq cap. `STATS l`'s
`<sendq>` was hardcoded to 0 for the same reason.
Account the live queue depth on the slice-145 shared `ConnStats`: the
registry's four client-delivery sites add a frame's `wire_len` on enqueue,
`serve_client` drains it on dequeue. `sendq_admit(len, max)` kills a
connection whose depth overruns its ceiling — it latches dead (one
terminal `ERROR :Closing Link: <host> (Max SendQ exceeded)` eject, the
rest dropped, bounding memory even under a wedged socket). KILL ejects and
collision SAVEs bypass the cap (control plane, always delivered).
The ceiling is the connection class's `sendq`, or `DEFAULT_SENDQ` (1 MiB)
when the class sets none — a local client always has a ceiling (a SendQ
limit is a safety mechanism, never truly unbounded, like the oracle's
MAXSENDQ). Remote-user / test claims (`try_claim`, no serve loop draining
them) pass `sendq_max = 0`: accounted but never killed. `STATS l` now
renders the live depth (canonicalizer already masks the 211 tail).
Test fixtures carried a cosmetic `sendq 1000` (meaningless when it was
unenforced; 1000 bytes can't hold a handful of lines). Now that it is
load-bearing, bump every fixture to the shipped example's realistic
`512000`, and refresh the one `STATS Y` golden that snapshots it.
Unit-tested (connstats admit/overflow/drain/latch + registry eject/bypass/
depth, with inverse round-trips); the kill path is timing-dependent over a
real socket so it is fuzzed/unit-tested rather than boot-golden'd.
feat(leveva)!: per-connection SendQ accounting + Max-SendQ backpressure kill
The per-connection mailbox was an unbounded `mpsc`, so a client that stops
reading its socket (TCP backpressure blocks its serve loop's `write_all`)
let every other connection's fan-out pile onto its queue without limit — a
write-side memory DoS, the twin of the slice-118 recvq cap. `STATS l`'s
`<sendq>` was hardcoded to 0 for the same reason.
Account the live queue depth on the slice-145 shared `ConnStats`: the
registry's four client-delivery sites add a frame's `wire_len` on enqueue,
`serve_client` drains it on dequeue. `sendq_admit(len, max)` kills a
connection whose depth overruns its ceiling — it latches dead (one
terminal `ERROR :Closing Link: <host> (Max SendQ exceeded)` eject, the
rest dropped, bounding memory even under a wedged socket). KILL ejects and
collision SAVEs bypass the cap (control plane, always delivered).
The ceiling is the connection class's `sendq`, or `DEFAULT_SENDQ` (1 MiB)
when the class sets none — a local client always has a ceiling (a SendQ
limit is a safety mechanism, never truly unbounded, like the oracle's
MAXSENDQ). Remote-user / test claims (`try_claim`, no serve loop draining
them) pass `sendq_max = 0`: accounted but never killed. `STATS l` now
renders the live depth (canonicalizer already masks the 211 tail).
Test fixtures carried a cosmetic `sendq 1000` (meaningless when it was
unenforced; 1000 bytes can't hold a handful of lines). Now that it is
load-bearing, bump every fixture to the shipped example's realistic
`512000`, and refresh the one `STATS Y` golden that snapshots it.
Unit-tested (connstats admit/overflow/drain/latch + registry eject/bypass/
depth, with inverse round-trips); the kill path is timing-dependent over a
real socket so it is fuzzed/unit-tested rather than boot-golden'd.
feat(leveva)!: per-connection SendQ accounting + Max-SendQ backpressure kill
The per-connection mailbox was an unbounded `mpsc`, so a client that stops
reading its socket (TCP backpressure blocks its serve loop's `write_all`)
let every other connection's fan-out pile onto its queue without limit — a
write-side memory DoS, the twin of the slice-118 recvq cap. `STATS l`'s
`<sendq>` was hardcoded to 0 for the same reason.
Account the live queue depth on the slice-145 shared `ConnStats`: the
registry's four client-delivery sites add a frame's `wire_len` on enqueue,
`serve_client` drains it on dequeue. `sendq_admit(len, max)` kills a
connection whose depth overruns its ceiling — it latches dead (one
terminal `ERROR :Closing Link: <host> (Max SendQ exceeded)` eject, the
rest dropped, bounding memory even under a wedged socket). KILL ejects and
collision SAVEs bypass the cap (control plane, always delivered).
The ceiling is the connection class's `sendq`, or `DEFAULT_SENDQ` (1 MiB)
when the class sets none — a local client always has a ceiling (a SendQ
limit is a safety mechanism, never truly unbounded, like the oracle's
MAXSENDQ). Remote-user / test claims (`try_claim`, no serve loop draining
them) pass `sendq_max = 0`: accounted but never killed. `STATS l` now
renders the live depth (canonicalizer already masks the 211 tail).
Test fixtures carried a cosmetic `sendq 1000` (meaningless when it was
unenforced; 1000 bytes can't hold a handful of lines). Now that it is
load-bearing, bump every fixture to the shipped example's realistic
`512000`, and refresh the one `STATS Y` golden that snapshots it.
Unit-tested (connstats admit/overflow/drain/latch + registry eject/bypass/
depth, with inverse round-trips); the kill path is timing-dependent over a
real socket so it is fuzzed/unit-tested rather than boot-golden'd.
feat(leveva)!: per-connection SendQ accounting + Max-SendQ backpressure kill
The per-connection mailbox was an unbounded `mpsc`, so a client that stops
reading its socket (TCP backpressure blocks its serve loop's `write_all`)
let every other connection's fan-out pile onto its queue without limit — a
write-side memory DoS, the twin of the slice-118 recvq cap. `STATS l`'s
`<sendq>` was hardcoded to 0 for the same reason.
Account the live queue depth on the slice-145 shared `ConnStats`: the
registry's four client-delivery sites add a frame's `wire_len` on enqueue,
`serve_client` drains it on dequeue. `sendq_admit(len, max)` kills a
connection whose depth overruns its ceiling — it latches dead (one
terminal `ERROR :Closing Link: <host> (Max SendQ exceeded)` eject, the
rest dropped, bounding memory even under a wedged socket). KILL ejects and
collision SAVEs bypass the cap (control plane, always delivered).
The ceiling is the connection class's `sendq`, or `DEFAULT_SENDQ` (1 MiB)
when the class sets none — a local client always has a ceiling (a SendQ
limit is a safety mechanism, never truly unbounded, like the oracle's
MAXSENDQ). Remote-user / test claims (`try_claim`, no serve loop draining
them) pass `sendq_max = 0`: accounted but never killed. `STATS l` now
renders the live depth (canonicalizer already masks the 211 tail).
Test fixtures carried a cosmetic `sendq 1000` (meaningless when it was
unenforced; 1000 bytes can't hold a handful of lines). Now that it is
load-bearing, bump every fixture to the shipped example's realistic
`512000`, and refresh the one `STATS Y` golden that snapshots it.
Unit-tested (connstats admit/overflow/drain/latch + registry eject/bypass/
depth, with inverse round-trips); the kill path is timing-dependent over a
real socket so it is fuzzed/unit-tested rather than boot-golden'd.
feat(leveva)!: per-connection SendQ accounting + Max-SendQ backpressure kill
The per-connection mailbox was an unbounded `mpsc`, so a client that stops
reading its socket (TCP backpressure blocks its serve loop's `write_all`)
let every other connection's fan-out pile onto its queue without limit — a
write-side memory DoS, the twin of the slice-118 recvq cap. `STATS l`'s
`<sendq>` was hardcoded to 0 for the same reason.
Account the live queue depth on the slice-145 shared `ConnStats`: the
registry's four client-delivery sites add a frame's `wire_len` on enqueue,
`serve_client` drains it on dequeue. `sendq_admit(len, max)` kills a
connection whose depth overruns its ceiling — it latches dead (one
terminal `ERROR :Closing Link: <host> (Max SendQ exceeded)` eject, the
rest dropped, bounding memory even under a wedged socket). KILL ejects and
collision SAVEs bypass the cap (control plane, always delivered).
The ceiling is the connection class's `sendq`, or `DEFAULT_SENDQ` (1 MiB)
when the class sets none — a local client always has a ceiling (a SendQ
limit is a safety mechanism, never truly unbounded, like the oracle's
MAXSENDQ). Remote-user / test claims (`try_claim`, no serve loop draining
them) pass `sendq_max = 0`: accounted but never killed. `STATS l` now
renders the live depth (canonicalizer already masks the 211 tail).
Test fixtures carried a cosmetic `sendq 1000` (meaningless when it was
unenforced; 1000 bytes can't hold a handful of lines). Now that it is
load-bearing, bump every fixture to the shipped example's realistic
`512000`, and refresh the one `STATS Y` golden that snapshots it.
Unit-tested (connstats admit/overflow/drain/latch + registry eject/bypass/
depth, with inverse round-trips); the kill path is timing-dependent over a
real socket so it is fuzzed/unit-tested rather than boot-golden'd.