[Proxicon]

Why

The beta.11 laptop campaign found that a valid 30,000,001-byte Content-Length initialize request resets both MCP route aliases when the client sends its body before reading the response. Completing the 413 before consuming that upload starts server/proxy draining too early. The existing HttpClient tests can observe an early response and do not exercise the owner's sequential-send behavior.

The same campaign left 59 operations unpassed and only partially mapped its domain/history evidence. Basic chat and direct-mail readiness did not expose missing advanced fixtures. The beta.11 NOT_READY receipt remains unchanged.

Changes

• For ordinary declared oversized bodies, consume at most the decoded limit plus one byte using a pooled discard buffer, then return the existing structured 413. Keep immediate Expect/Continue and beyond-wire rejection, finite budgets, cancellation, smaller limits and existing malformed/chunked validation.
• Add a paced real-socket upload through an outer YARP proxy, direct MCP and Web gateway, both route aliases, and tests for bounded reads, no buffering, early EOF and cancellation.
• Add a separate beta.12 campaign adapter and exact 59-operation / 12-fixture-lane preflight. Preserve 390 operations, 103 domain cases, 86 historical obligations and nine cleanup assertions.
• Add a read-only mapping planner for validated fresh evidence, independent effective transport configuration capture, and local-laptop instructions. Keep the existing catalog revision because tool contracts are unchanged.
• Keep transport evidence when a response omits or malforms Content-Type; classify the probe as failed and continue the matrix.
• Set the centrally owned product suffix to beta.12 and add release notes.

Validation and review

• Fresh .NET 10.0.403 build under the repository's roll-forward policy; focused transport suite: 22 passed, zero failed/skipped.
• Offline HTTP MCP campaign suite: 51 passed.
• Documentation validation: 79 Markdown files / 470 local links.
• Public-disclosure gate, 10 release-tag helper tests, git diff check and strict Slopwatch scan: passed.
• Independent source review completed. One missing-header harness defect was found during review and corrected with regression coverage.

Required PR/main CI and hosted release validation remain mandatory. Local source tests do not establish deployed beta.12 acceptance. Arbitrarily larger/incomplete uploads retain finite drain behavior; this repair does not add an unbounded drain.

Delivery: #270. Fresh owner-deployed laptop acceptance remains #219. This PR does not close that acceptance tracker or change stable latest.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-27T04:16:41.512436Z	61da89c	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.