[Deep-Sixed]

What this is

The same unread-body reset race that #39 and #40 fixed in Client in src/system/tests/test_web_surface.py, at the call sites ops/tools/verify_wheel.py owns through its own ask() helper. #40's AST pass over "all 112 client call sites" covered the test client; this file has a second one.

The failure

Seen once on verify (windows-latest, 3.14) for 79d2864 — nondeterministic, not a hard break:

File "...\careersignal-wheel-k33nc9zr\web_check.py", line 288, in <module>
    assert ask(
        "/api/v1/intake/eml", method="POST", body=WHEEL_MESSAGE, media="application/json",
        headers=DECLARED,
    )[0] == 415
ConnectionAbortedError: [WinError 10053] An established connection was aborted by the
software in your host machine

Handler._ingest_eml refuses a wrong media type on the envelope, before the body is read — its docstring says so and that ordering is the property the check is about. So the sent body stays unread in the receive buffer, closing on unread bytes is a reset rather than a clean shutdown on Windows, and whether the 415 or the reset reaches the client first is a race. urlopen has no tolerance for it, unlike Client.unread.

What changed

ask() speaks http.client rather than urllib, because urlopen cannot declare a body and withhold it. It gains the two controls Client.send already holds, for the same reason and with that written down beside them:

• transmit=False — send the headers and none of the body.
• length — declare something other than the truth, the only way to reach the size ceiling without writing at it.

The 415 was not the only one. Eleven call sites were sending a body to a refusal the surface settles before reading:

where	refusal	settled by
status, decision, draft, reconcile (6 calls)	403 / 401	_command, before a byte is read
both intake addresses on a launch with no evaluation profile	409	_ingest_eml / _ingest_gmail, launch capability first
intake with no declared source, and with a blank one	400	declared_namespace, before _material
intake as application/json	415	the media check — the reported failure

Each now declares its body and sends none. The 413 check, already declaring rather than sending, drops its placeholder byte and declares MAX_MESSAGE_BYTES + 1 against the real message.

Verification

Checked mechanically rather than by reading, since reading is what missed it last time. With Handler.do_POST instrumented to record whether each request read its body, every POST the verifier makes falls into one of three shapes:

• no body, nothing unread;
• body sent and read;
• body declared, withheld, never read.

Nothing lands in the fourth shape — body sent, never read — which is the one that resets. The instrumentation is scratch-only and not part of this diff. It also rules out the opposite mistake: withholding a body an address does read hangs to the timeout rather than passing quietly, so the run completing is itself the check.

Gates, all locally on Linux:

uv run pytest -q                        1686 passed
uv run ruff check .                     All checks passed!
uv run ruff format --check .            77 files already formatted
uv run python ops/tools/verify_tree.py  PASS
uv run python ops/tools/verify_secrets.py  PASS
uv run python ops/tools/verify_wheel.py    PASS

The Windows race is not reproducible here by construction; what this PR establishes locally is that no request sends a body the surface will not read, which is the condition the reset needs.

🤖 Generated with Claude Code

https://claude.ai/code/session_01SZrRh6P6mTsdapYFzsGF5a

---

Generated by Claude Code