Native HTTP/2: validate response header names and isolate verification host sessions

Latest HTTP/2 verification

2c5df8cce is pushed on codex/runtime-port as Chris Breuer without coauthors; not merged to main. The request-compression implementation in #531 now brings the complete unchanged HTTP/2 client file to 60/60 / 197 assertions, matching pinned Bun. The earlier two client failures below are historical. The response-validation and verification-host isolation paths retain complete adversarial 15/15 / 33 and lifetime 7/7 / 21, including the original 200-request workloads. All 60 regression commands, including the native HTTP/2 fixture, pass.

#535 repairs the separate CONNECT failures. TLS context work remains #532; intermittent HTTP/3 failures are #539. This issue remains open for platform/integration verification, and #66 is not complete. Final evidence is in zig-out/compress-publication.json, compress-matrix-final5.json, compress-regression2s.json, and the native runtime documentation.

Earlier HTTP/2 implementation checkpoint

Published implementation

Published HTTP/2 checkpoint: fd239c3ac, pushed on codex/runtime-port as Chris Breuer without coauthors, not merged to main. #533 now preserves the idle-session Host hash and rejects invalid response-name tokens while consuming complete HPACK blocks. Complete unchanged HTTP/2 adversarial 15/15 / 33 assertions (parent 13 pass / 2 fail); lifetime 7/7 / 21 assertions with original 200-request workloads. Full body-stream 9,086/9,086 / 135,984 assertions. Build 17/17, units 1,825 pass / 19 skips / 0 fail (19/19 steps), sequential regressions 59/59 including 28 native files. HTTP/2 client remains 58 pass / 2 fail / 2 errors; HTTP/3 client 50 pass / 2 fail, both compression #531. HTTP/3 adversarial retains 27/27. Newly exercised CONNECT-proxy crashes reproduce in both parent and candidate; pinned Bun passes both files, tracked separately in #535. TLS context work remains #532. Forty measured test/harness/fixture sources and six consulted implementations match the pin. Darwin only; platform/integration, skips/TODOs and full source ownership remain unverified. Whole-suite parity is incomplete.

Parent: #66. Related: #530 transport recovery, #531 request compression, #532 TLS contexts, #535 CONNECT request state. This issue remains open for branch integration and platform verification; its two original Darwin behavior failures are now repaired.

• Preserve ClientSession.host_header_hash when returning a session to the idle pool. Active and pending matching already included the discriminator; maybeRelease incorrectly stored zero.
• Require nonempty lowercase HTTP token names and reject connection-specific fields before exposing response metadata. Finish decoding the entire HPACK block before stream rejection.
• Run all 15 unchanged adversarial tests and all seven lifetime scenarios against both Home and pinned Bun.
• Native regression: pending/active/idle isolation, case/port normalization and reuse, ten malformed names, RST_STREAM, dynamic-table entries introduced after rejection, separate empty-name decoder error, natural exit and VM-destruction/exception checks. The final native fixture fails the published parent at idle-session isolation and passes the pinned Bun control with only identity/import adaptations.
• Unit coverage for every byte value in a response name; complete runtime units and 59 regression commands pass.
• Verify Linux/Windows and integrate the published runtime branch.

Evidence: zig-out/h2-build2-binary.json, h2-unit1.{json,log}, h2-regression1s.json, h2-matrix-{parent3,final3,release3}.json, h2-body-stream-final4.json, h2-native-{parent,final4,destruction4,control3}.json, h2-source-integrity.json and h2-source-snapshot.json. Original workloads, assertions and deadlines are unchanged. Early fixture expectation failures and an invalid runner cleanup attempt are retained; complete final reruns are reported, not those attempts. Final executable SHA-256: bb9767dfbc0b6a729b92b7693a288e79c28c6910c370c5c73a770ca472aacd97. Pinned C/C++/JSC dependencies remain, with no Rust archive linked.

Published fd239c3ac on codex/runtime-port, as Chris Breuer without coauthors; not merged to main.

#533 now preserves the idle HTTP/2 session's verification-host hash and validates response-name tokens without desynchronizing HPACK. Complete adversarial 15/15, lifetime 7/7, body-stream 9,086/9,086 / 135,984 assertions. Units 1,825 pass / 19 skip / 0 fail, and 59/59 sequential runtime regression commands pass (28 native files). Original upstream assertions, workloads and deadlines are unchanged.

Request compression still fails in the HTTP/2 and HTTP/3 client suites (#531). Two CONNECT-proxy crashes reproduce in both this checkpoint and the published parent; pinned Bun passes them, tracked in #535. TLS context work remains #532. #66's stale checked HTTP/2-completion row is corrected to match current strict-native results. Platform/integration checks and the full port remain incomplete. Detailed evidence and failed attempts are retained in the updated issue bodies and docs/docs/NATIVE_RUNTIME_BINDINGS.md.

Source b2ad7e9cb and verified evidence are on main. Home owns 112 explicit registry modules plus the internal test adapter, adding the complete 22-module HTTP/HTTPS/HTTP2/TLS graph from the pin. Native NodeHTTP and NodeTLS ownership is wired into the selected translation unit with exact header comparisons. Generation supports verified named-export namespaces and scoped Zig factories.

The original 10 MiB subprocess/HTTP/stdout pipeline exposed premature exit before queued nextTick stream work ran. The post-poll drain fixes it without a listener/timer workaround; the unchanged fixture validates the full payload. Real expose_gc aliasing, per-stream async context, stream byte accounting and write-completion ordering clear original parser-GC, async-local-storage, buffer-size and writable/drain failures.

Publication-source checks pass: 18 native groups; 81 ABI tests / 1,332 assertions; Debug 34/34 (5,660 MB peak under 8,192 MB); complete Bun HTTP2 file 287 pass / zero fail / six original skips. Pickier, scoped formatting/whitespace and documentation portability checks pass.

Full-scope verification remains incomplete: the latest combined audit of 893 unchanged original entries reports 709 registered passes + 752 process checks, two registered failures and 69 failing files. 13 skips, 20 TODOs and 22 skipped files receive no passing credit. Remaining internal HTTP2/core/util/Undici modules, binding controls and wire/state behavior are tracked in #867; TLS delivery/CA failures remain open in #532. #868 records mutually exclusive original range-error assertions for the same invalid close operation; Bun's existing message is preserved without filename-sensitive behavior or test edits. Paired pinned Bun and Node return the current bun.sh certificate without an OCSP URI, so that original live-certificate expectation is not credited or fabricated.

The unchanged single-buffer fixture allocates 4 GiB and documents substantial cloning. Its direct pinned Bun control passes at 12,288 MB, and the separate Home corpus coordinator passes at 12,303 MB under an isolated 12,800 MB ceiling with host-pressure protection retained. Ordinary files remain under 3,840 MB. Allocation, assertions and original case deadlines are unchanged. Lower-bound guard stops, disk refusals, incomplete journals, cache-rebuild failures and seven pre-existing fixture differences are retained.

All 11,376 committed archives verify; all 893 authoritative reports restore with their recorded validator outcomes, including failures. Source bytes remain unchanged across main integration. Full-suite and remaining ownership/pending/Release/ASAN/platform parity stay open under #66/#532/#533/#867/#868.