#40360 node:http2: emit the SETTINGS ACK before DATA the new settings unblocked

• Repro: the issue's self-contained script (raw TCP HTTP/2 server, no dependencies). On bun 1.4.0 the client sent 458753 bytes in 29 DATA frames between the SETTINGS and the ACK. Node 20 and 26 send the ACK first.
• The unfixed client also ACKs the server's initial SETTINGS late, after the first 65535 bytes of DATA. The test therefore matches ACKs by count (the raise is the second ACK) instead of a flag set by the first ACK seen.
• The test replaces the repro's 500ms stall timer with an exact trigger: the server raises the window when the received DATA total reaches 65535, the point where the client cannot send another byte. Any DATA between that SETTINGS and the second ACK used the unacknowledged window.
• The test is a standalone file because it needs a raw net server that drives Bun's client, and no existing http2 test file has that harness (h2-conformance.test.ts is the inverse: a raw client against Bun's server). The directory already has per-fix files, for example node-http2-invalid-padding.test.ts.
• The too-many-settings regression mechanism, from debug logs: the engine stops mid-batch after the first SETTINGS, the socket closes, and the remaining frames drain post-close. The old code corked the ACK and dispatched the GOAWAY before the cork drained, so the GOAWAY error won. The reorder plus unconditional flush pushed the ACK through the dead transport first, and the EBADF won. Flushing only when a window grew restores the old timing for that path. Verified deterministic: 20/20 fail before the gate, 20/20 pass after.
• note_outbound_ack (the outbound control-frame flood check) now runs before the sink callback. If it trips, the session is torn down and the callback is skipped, which matches the other teardown paths in handle_settings.
• grpc-js suite: 5 DNS tests, one outlier-detection timeout, and the tonic test fail in this environment without the change too (public DNS and external tooling), all other grpc tests pass. test-server-deadlines.test.ts passes 5/5 locally.
• The issue also reports a secondary bug: write() callbacks report success for bytes that never reached the socket after the stream died. That is a separate defect and is not addressed here.

ASAN without fix: 1 FAILED
$ BUN_DEBUG_QUIET_LOGS=1 bun scripts/build.ts --profile=debug --quiet test "--reporter=junit" "--reporter-outfile=/tmp/mechgate.xml" "test/js/node/http2/node-http2-settings-ack-ordering.test.ts"
bun test v1.4.1 (4448a2e21)

test/js/node/http2/node-http2-settings-ack-ordering.test.ts:
121 |     req.on("error", failed);
122 |     req.write(Buffer.alloc(BODY, 0x61));
123 | 
124 |     await done;
125 | 
126 |     expect({ dataBeforeAck, framesBeforeAck }).toEqual({ dataBeforeAck: 0, framesBeforeAck: 0 });
                                                     ^
error: expect(received).toEqual(expected)

  {
-   "dataBeforeAck": 0,
-   "framesBeforeAck": 0,
+   "dataBeforeAck": 196609,
+   "framesBeforeAck": 13,
  }

- Expected  - 2
+ Received  + 2

      at <anonymous> (/workspace/bun/test/js/node/http2/node-http2-settings-ack-ordering.test.ts:126:48)
(fail) client sends the SETTINGS ACK before DATA unblocked by a larger INITIAL_WINDOW_SIZE [1069.73ms]

 0 pass
 1 fail
 1 expect() calls
Ran 1 test across 1 file. [5.60s]
error: script "bd" exited with code 1
__F:1:S:0

release without fix: all passed
bun test v1.4.1-canary.1 (048e73692)

test/js/node/http2/node-http2-settings-ack-ordering.test.ts:
(pass) client sends the SETTINGS ACK before DATA unblocked by a larger INITIAL_WINDOW_SIZE [20.05ms]

 1 pass
 0 fail
 2 expect() calls
Ran 1 test across 1 file. [150.00ms]
__F:0:S:0

ASAN with fix: all passed
$ BUN_DEBUG_QUIET_LOGS=1 bun scripts/build.ts --profile=debug --quiet test "--reporter=junit" "--reporter-outfile=/tmp/mechgate.xml" "test/js/node/http2/node-http2-settings-ack-ordering.test.ts"
bun test v1.4.1 (4448a2e21)

test/js/node/http2/node-http2-settings-ack-ordering.test.ts:
(pass) client sends the SETTINGS ACK before DATA unblocked by a larger INITIAL_WINDOW_SIZE [769.30ms]

 1 pass
 0 fail
 2 expect() calls
Ran 1 test across 1 file. [3.89s]
__F:0:S:0

release with fix: all passed
$ bun scripts/build.ts --profile=release
[configured] bun-profile → bun (stripped) in 764ms (unchanged)
ninja: Entering directory `/workspace/bun/build/release'
[1/126] gen JSBuffer.lut.h
Generating /workspace/bun/build/release/codegen/JSBuffer.lut.h from /workspace/bun/src/jsc/bindings/JSBuffer.cpp
[2/126] gen generated_host_exports.rs
generated_host_exports.rs: 120 exports (host=5, lazy=10, generic=105, rust=0); 244 extern-C blocks audited
[3/126] gen cpp.rs (cppbind)
[4/126] gen JS modules (bundle-modules)
Preprocess modules (13342ms)
Bundle modules (61ms)
Postprocesss modules (168ms)
Bundle Functions (669ms)
Generate Code (57ms)

[14.30s] Bundled "src/js" for production
  2594 kb
  197 internal modules
  13 native modules
  50 internal functions across 16 files
[4/125] cargo bun_runtime → libbun_runtime.a (--target x86_64-unknown-linux-gnu)

  nightly-2026-07-20-x86_64-unknown-linux-gnu unchanged - rustc 1.99.0-nightly (9f36de775 2026-07-19)

   Compiling bun_runtime v0.0.0 (/workspace/bun/src/runtime)
    Finished `release` profile [optimized + debuginfo] target(s) in 4m 46s
[121/125] cxx obj/codegen/GeneratedFakeTimersConfig.cpp.o
... (truncated)

src/runtime/api/bun/h2/connection.rs               |   6 +-
 src/runtime/api/bun/h2_frame_parser.rs             |   9 +-
 .../http2/node-http2-settings-ack-ordering.test.ts | 132 +++++++++++++++++++++
 3 files changed, 143 insertions(+), 4 deletions(-)

file                                                      reads  edits  tests
src/runtime/api/bun/h2/connection.rs                          2      3      0
src/runtime/api/bun/h2_frame_parser.rs                        4      5      0
…/js/node/http2/node-http2-settings-ack-ordering.test.ts      2      7      0