fix: guard reserved sessions and bounded response state

recognization/code/transport.py

@@ -104,7 +104,10 @@ class BodyLimit:
 
     A handler that checks Content-Length, or reads request.body(), runs after
     the server has already buffered the stream. This counts bytes at receive
-    and returns 413 without handing the rest to the app. WebSocket frames are
+    and returns 413 without handing the rest to the app. Content-Length is
+    not trusted: the stream is what counts, and reading stops at the cap.
+    If the app already started the response, the connection is aborted
+    instead of sending a second http.response.start. WebSocket frames are
     not HTTP bodies and are left alone.
     """
 
@@ -116,10 +119,13 @@ class BodyLimit:
         if scope.get("type") != "http":
             await self.app(scope, receive, send)
             return
+
         class TooLarge(Exception):
             pass
 
         seen = 0
+        started = False
+
         async def limited() -> Dict[str, Any]:
             nonlocal seen
             message = await receive()
@@ -128,12 +134,24 @@ class BodyLimit:
             body = message.get("body") or b""
             seen += len(body)
             if seen > self.max_bytes:
+                # The app must not see this chunk or any later one.
                 raise TooLarge
             return message
 
+        async def tracked(message: Dict[str, Any]) -> None:
+            nonlocal started
+            if message.get("type") == "http.response.start":
+                started = True
+            await send(message)
+
         try:
-            await self.app(scope, limited, send)
+            await self.app(scope, limited, tracked)
         except TooLarge:
+            if started:
+                # The status line is already on the wire. Returning leaves the
+                # response unfinished so the server closes the connection
+                # instead of accepting a second http.response.start.
+                return
             await send(
                 {
                     "type": "http.response.start",