net.quic: prune dead_request_streams once the peer's stream is drained

fail_request_stream() marked a failed stream dead forever with no pruning,
unlike the two sibling maps (request_streams/request_decoders) it already
prunes in the same function -- unbounded on a long-lived pooled HTTP/3
connection. Flagged by JalonSolov's review on PR #28129.

Adds prune_terminal_dead_streams(), called once per drive() cycle, which
drops an entry once QuicConn.stream_recv_status confirms the underlying
stream's receive side has itself reached a terminal state (reset or fin
received) -- at that point RFC 9000 guarantees no further frames for that
ID can ever arrive, so the bookkeeping is no longer needed. Entries for
streams the peer hasn't finished draining yet are left in place, since it
may still legally keep sending (this module has no STOP_SENDING API yet).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: Richard Wheeler

vlib/net/quic/h3_conn.v

@@ -262,6 +262,7 @@ fn (mut h H3Conn) drive(qc_result PollResult) !H3PollResult {
 		h.open_own_streams_if_ready()!
 		h.drain_known_peer_streams(mut result)!
 	}
+	h.prune_terminal_dead_streams()
 	return result
 }
 
@@ -761,16 +762,53 @@ fn (mut h H3Conn) fail_request_stream(stream_id u64, error_code u64, reason stri
 	// number of requests ever opened on a long-lived pooled connection, not
 	// the number currently in flight -- see the identical pruning (and this
 	// same reasoning) in finalize_request_stream_if_done's success path.
-	// dead_request_streams is deliberately left alone: it is a tiny,
-	// permanent bool marker (unlike these two, which hold buffered decoder
-	// state), and drain_known_peer_streams/retry_blocked_sections both
-	// still check membership in it as a defense-in-depth guard even though,
-	// after this deletion, `stream_id` no longer appears in request_
-	// streams.keys() for drain_known_peer_streams to iterate at all.
+	// dead_request_streams itself is NOT deleted here (unlike these two):
+	// the peer may still legally send more STREAM frames for `stream_id`
+	// after this call (this module has no per-stream RST_STREAM/
+	// STOP_SENDING send API yet, see this function's own doc comment), and
+	// drain_known_peer_streams/retry_blocked_sections/finalize_request_
+	// stream_if_done all rely on membership here to keep ignoring those --
+	// deleting it now would let a same-poll-cycle re-entry into
+	// finalize_request_stream_if_done (from dispatch_request_stream_frames
+	// falling through after this call, e.g. via decode_or_queue_headers)
+	// double-fail this same stream. prune_terminal_dead_streams() removes
+	// the entry once the QUIC layer confirms no further frames can ever
+	// arrive for it, bounding this map instead of leaving it permanent.
 	h.request_streams.delete(stream_id)
 	h.request_decoders.delete(stream_id)
 }
 
+// prune_terminal_dead_streams drops any dead_request_streams entry whose
+// underlying QUIC receive side has itself reached a terminal state
+// (reset_recvd/reset_read or size_known/data_recvd/data_read): once that
+// has happened, the transport guarantees no further STREAM frames for that
+// ID can ever arrive (RFC 9000 -- a stream ID is never reused within a
+// connection), so this layer no longer needs to remember it was locally
+// failed. Runs once per drive() cycle, strictly after drain_known_peer_
+// streams/retry_blocked_sections have both finished processing this
+// cycle's frames -- never mid-dispatch, so it cannot retire an ID out from
+// under fail_request_stream's own same-poll-cycle reentrancy guard in
+// finalize_request_stream_if_done. Bounds dead_request_streams to the
+// number of failed streams the peer hasn't finished draining yet, instead
+// of the total ever failed over the connection's lifetime (see fail_
+// request_stream's own doc comment for why the entry can't just be
+// deleted immediately on failure). If the QUIC layer has no record of the
+// ID at all (stream_recv_status returns none), the entry is left alone
+// rather than guessed at -- a rare, harmless conservative miss, not a
+// correctness risk.
+fn (mut h H3Conn) prune_terminal_dead_streams() {
+	mut terminal := []u64{}
+	for stream_id, _ in h.dead_request_streams {
+		status := h.qc.stream_recv_status(stream_id) or { continue }
+		if status.state == .reset_received || status.state == .fin_received {
+			terminal << stream_id
+		}
+	}
+	for stream_id in terminal {
+		h.dead_request_streams.delete(stream_id)
+	}
+}
+
 // has_blocked_section_for reports whether any queued blocked field
 // section still belongs to `stream_id`.
 fn (h &H3Conn) has_blocked_section_for(stream_id u64) bool {

vlib/net/quic/h3_conn_test.v

@@ -613,6 +613,47 @@ fn test_h3_conn_prunes_request_stream_state_on_failure_too() {
 	assert stream_id in h.dead_request_streams
 }
 
+// test_h3_conn_prunes_dead_request_stream_once_peer_side_fully_terminal is a
+// regression test for the third sibling of the SAME unbounded-growth bug
+// class the two tests above already cover: dead_request_streams itself was
+// never pruned (a repo-review miss caught externally, PR #28129 review
+// comment 2026-08-21 -- see code-review-misses.md), unlike request_streams/
+// request_decoders right next to it, on which fail_request_stream already
+// prunes above. Reproduces the growth first (the entry must still be
+// present immediately after failure, since the peer may legally keep
+// sending on that stream ID -- fail_request_stream's own doc comment),
+// then drives the underlying QUIC stream to ITS OWN terminal receive state
+// (an empty FIN-carrying continuation frame here; a RESET_STREAM would
+// work identically) and asserts the entry is gone on the next poll(), once
+// the transport itself guarantees no further frames can ever arrive.
+fn test_h3_conn_prunes_dead_request_stream_once_peer_side_fully_terminal() {
+	mut c, mut h, _, now := h3_test_conn()!
+	defer {
+		c.handshake.free()
+	}
+	stream_id := h.open_request_stream()!
+	h.poll(none, now)!
+	assert stream_id in h.request_streams
+
+	// Same framing error as the sibling test above: fails the stream at the
+	// H3 layer while leaving the underlying QUIC stream open (no FIN yet).
+	data_frame := encode_data_frame([u8(1), 2, 3])!
+	req_stream_frame := encode_stream_frame(stream_id, 0, data_frame, false, true)!
+	req_datagram := build_fake_one_rtt_packet(c.scid, 0, req_stream_frame, read_keys(mut c), false)!
+	fail_result := h.poll(req_datagram.bytes, now)!
+	assert fail_result.events.any(it.kind == .request_error)
+	assert stream_id in h.dead_request_streams, 'must still be tracked immediately after failure -- the peer may legally keep sending on this ID'
+
+	// The peer now finishes sending on the same stream -- its receive side
+	// reaches a terminal QUIC-layer state, so no further frames for this ID
+	// can ever legally arrive.
+	fin_frame := encode_stream_frame(stream_id, u64(data_frame.len), []u8{}, true, true)!
+	fin_datagram := build_fake_one_rtt_packet(c.scid, 1, fin_frame, read_keys(mut c), false)!
+	h.poll(fin_datagram.bytes, now)!
+
+	assert stream_id !in h.dead_request_streams, 'dead_request_streams must not grow unboundedly for the lifetime of a long-lived pooled connection -- once the QUIC layer confirms the peer can never send more on this stream ID, this bookkeeping entry must be pruned too'
+}
+
 // test_h3_conn_blocked_headers_retry_after_delayed_encoder_instruction is
 // the standout new-integration-behavior case (no direct Phase 10/11 test
 // precedent): a HEADERS frame referencing a dynamic-table entry arrives