fix(http2): never write RST_STREAM ahead of the stream's still-queued HEADERS

[mosuem]

Note

This PR was generated by an AI coding agent (Jetski) on behalf of @mosuem.

Summary

StreamHandler._terminateStream (what TransportStream.terminate() ends up in) wrote the RST_STREAM(CANCEL) straight to the FrameWriter, bypassing ConnectionMessageQueueOut. If the stream's opening HEADERS were still sitting in that queue — because the socket was applying backpressure, or because the queue was head-of-line blocked behind flow-controlled DATA of another stream — the peer received RST_STREAM for a stream it had never seen, which is a connection error (RFC 9113 Section 6.4: "RST_STREAM frames MUST NOT be sent for a stream in the "idle" state. If a RST_STREAM frame identifying an idle stream is received, the recipient MUST treat this as a connection error of type PROTOCOL_ERROR"). A client cancelling a request shortly after starting it could thus take down the whole connection.

Changes

• lib/src/flowcontrol/connection_queues.dart: Add ConnectionMessageQueueOut.cancelStreamMessages(streamId), which drops the stream's queued DataMessages (they would be discarded by the peer anyway) and reports whether a HeadersMessage for the stream is still queued.
• lib/src/streams/stream_handler.dart: In _terminateStream, enqueue a ResetStreamMessage behind the queued HEADERS when there are any; otherwise write the RST_STREAM directly as before.

Test Verification (Fails Before $\rightarrow$ Passes After)

Added rst-stream-is-sent-after-queued-headers-of-the-stream in test/client_test.dart. The test keeps the client's FrameWriter in its "would buffer" state (the server's StreamIterator pauses the frame stream after each frame, and that pause propagates synchronously into the client's BufferedSink), opens a stream and cancels it immediately, then checks the wire order.

Before fix:

00:00 +0 -1: client-tests client-errors rst-stream-is-sent-after-queued-headers-of-the-stream [E]
  Expected: <Instance of 'HeadersFrame'> with `streamId`: <3>
    Actual: <Instance of 'RstStreamFrame'>
     Which: is not an instance of 'HeadersFrame'

After fix:

00:00 +1: All tests passed!

[github-actions]

PR Health

Coverage ✔️

File	Coverage
pkgs/http2/lib/src/flowcontrol/connection_queues.dart	💚 94 % ⬆️ 0 %
pkgs/http2/lib/src/streams/stream_handler.dart	💚 91 % ⬆️ 0 %

This check for test coverage is informational (issues shown here will not fail the PR).

This check can be disabled by tagging the PR with skip-coverage-check.

License Headers ✔️

// Copyright (c) 2026, the Dart project authors. Please see the AUTHORS file
// for details. All rights reserved. Use of this source code is governed by a
// BSD-style license that can be found in the LICENSE file.

Files
no missing headers

All source files should start with a license header.

Unrelated files missing license headers

Files
pkgs/http_multi_server/test/cert.dart

This check can be disabled by tagging the PR with skip-license-check.

Breaking changes ✔️

Package	Change	Current Version	New Version	Needed Version	Looking good?
http2	Non-Breaking	3.1.0	3.2.0-wip	3.2.0-wip	✔️

This check can be disabled by tagging the PR with skip-breaking-check.

Unused Dependencies ✔️

Package	Status
http2	✔️ All dependencies utilized correctly.

For details on how to fix these, see dependency_validator.

This check can be disabled by tagging the PR with skip-unused-dependencies-check.

API leaks ✔️

The following packages contain symbols visible in the public API, but not exported by the library. Export these symbols or remove them from your publicly visible API.

Package	Leaked API symbol	Leaking sources

This check can be disabled by tagging the PR with skip-leaking-check.

Changelog Entry ✔️

Package	Changed Files

Changes to files need to be accounted for in their respective changelogs.

This check can be disabled by tagging the PR with skip-changelog-check.