[emilymattlin-mcrsft]

Summary

Harden the existing native HTTP/2 implementation for buffered HTTPS capture and editing; this builds on #117 rather than introducing HTTP/2 for the first time.

• Remove headers explicitly named by Connection when forwarding intercepted HTTPS requests and responses, including content headers after script callbacks. Captured model headers are retained.
• Fix an upstream HTTP/2 flow-control stall when an origin responds while reading a larger upload. Use known-length buffered custom content so HttpClient can read and write concurrently instead of waiting for the upload before draining the response. XMAT still captures complete bodies before scripts and buffers the complete response before returning it to the device.
• Add 27 regression cases across the original hardening work and this follow-up, and document the support boundary and manual acceptance checklist.
• Integrate current main, including the already-merged chunked capture-metadata correction from Release saved .xmatcap files and drop stale chunked headers from HTTPS captures #148.

Coverage

• A 16-case real TLS/CONNECT proxy matrix: HTTP/1.1 or HTTP/2 client, HTTP/1.1-only or HTTP/2-only origin, known/unknown body length, and actual compiled scripts enabled/disabled. Verify binary bodies, edits, regenerated lengths, end-to-end headers, stripped Connection-nominated headers, and capture correlation.
• Multiplexing with both requests held active before either response completes; verify shared connections, distinct stream/request IDs, and exact body correlation.
• Cancel one stream while keeping another active and verify later requests remain usable on the same client connection.
• Graceful origin connection retirement/replacement, stream resets before headers and during a response, timeout recovery, canceled incomplete uploads, and early rejection of a larger upload.
• Three batches of eight concurrent 1,048,577-byte request/response transfers on reused connections, with exact client and captured body comparisons. The origin responds while reading, exercising upstream flow control. This regression reproducibly stalled before the transport fix and passes afterward.
• The original Connection-header unit regressions also failed before their forwarding fix.

Validation

Follow-up review commit 27c5dfe passes all 71 HTTP/2 tests in both Debug and Release. All GitHub checks on this latest commit are green, including Debug/Release builds and tests, CodeQL, dependency review, and CLA. All three review threads have been addressed and resolved.

GitHub checks are green on commit 56f6c3f: Debug/Release builds and tests, CodeQL analyses, dependency review, and CLA.

• Debug x64 solution build: 0 warnings/errors; full suite 1,341 passed, 0 failed/skipped.
• Release x64 solution build: 0 warnings/errors; full suite 1,341 passed, 0 failed/skipped.
• git diff --check passes.
• Applied the header-token LINQ projection requested by the existing code-quality review.

Acceptance still outstanding

The tests use synthetic loopback traffic. They do not establish live Xbox/device, GUI, or long-session acceptance. The README contains the manual procedure and evidence to record:

• Representative Windows PC and Xbox development-console traffic, both protocol legs, body preservation, and script editing.
• At least 30 minutes of representative traffic with responsiveness and memory/retained-capture measurements.
• Device/origin disconnection recovery and repeated capture stop/restart with active traffic.
• Save, reload, and analyze representative captures with body fidelity and correlation checks.

Ready for code review. The buffered HTTP/2 implementation and automated validation are complete; the manual acceptance checks above remain required before release sign-off. No live-device, GUI, or long-session acceptance was performed in this work.

Separate follow-ups

Trailer preservation (including the status trailers required for correct unary gRPC), long-lived streaming/streaming gRPC, h2c, and HTTP/3/QUIC are not delivered. HTTP/2 WebSocket extended CONNECT is outside this matrix. The plain-HTTP forwarding path is unchanged. This is not a claim of complete HTTP/2 feature coverage or complete parity with another debugging proxy.