http.js:845:3E-848 returns to the poll loop for more body bytes with no deadline:
only the oversize case is refused. A client that opens a POST and never
finishes the body leaves done === false and the fd held for the life of the
server — a trivial resource exhaustion for an exposed bee http. Found in
the 2026-08-21 review.
An idle/read deadline on request assembly: a connection that has not progressed in N seconds is refused and closed. Repro with a trickle client.