writeTimeout is applied — Server.Builder.writeTimeout(Duration) was accepted and never read (chappe#13). It now bounds each blocking write of an HTTP/1.1 response: when the client stops reading and the socket refuses the bytes for longer than the timeout (30 s by default), Chappe closes the connection and the client gets a truncated body, where the connection’s virtual thread used to stay blocked with no bound. It is not an inactivity bound: a Server-Sent Events stream that stays silent for minutes between events is not affected. If a client of yours legitimately stalls reading for longer than 30 s, raise the value. Reference — timeouts, Migration — upgrading from 0.3.0.

The last response survives the close — when an HTTP/1.1 connection ends after a response (a 431, a 400, or Connection: close) while request bytes are still unread, Chappe used to close at once; the TCP stack then answered with a reset, and the reset destroyed the response before the client read it ("Connection reset"). Chappe now closes in stages, as RFC 9112 §9.6 describes: it half-closes, drains what the client still sends for at most 2 s or 1 MiB, then closes, so the response ends with a FIN (chappe#19). Over TLS it sends close_notify first and drains the ciphertext without decrypting it (chappe#21). A lost connection, a client that closed first, the idle timeout and a WebSocket takeover still close at once. Internals — threading model, HTTP capabilities.

A failed request body read closes gracefully — when reading a request body failed (bad chunked framing, a body cut short), the connection used to close at once, so a client still uploading could get a reset that destroyed the response. It now gets the same staged close: the response, close_notify over TLS, a half-close, then a bounded drain. Chappe still never parses another request from such a connection (CHAPPE-013, CHAPPE-014). Internals — threading model.

Response headers are validated — a header name must be an RFC 9110 token, and a value may hold only visible ASCII, obs-text (U+0080–U+00FF), space and tab. Response.builder(), Filter.addHeader*, the WebSocketUpgrade subprotocol and GrpcCall.addHeader / addTrailer now throw IllegalArgumentException for anything else. A custom Response that bypasses them gets a 500 over HTTP/1.1 and HTTP/2. Until now, the HTTP/1.1 writer truncated a char above U+00FF to its low byte, so U+010D U+010A became CR LF and injected a header line, and HTTP/2 sent such a char as ? (CHAPPE-008). If you set header values from user input, encode them first (RFC 8187, percent-encoding). Concepts — header and trailer validation.