[mpettibone]

(Claude helped with test cases)

Small one. When the HTTP/2 connection process hits an error while handling a message from one of its streams, the handler already does everything you'd want: it rescues the error, sends the client a GOAWAY, and logs what happened. The only thing off is the return value at the end, {:stop, :normal}. GenServer callbacks stop with a three element tuple, {:stop, reason, new_state}, so it reads the two element version as a bad return value and the process exits with {:bad_return_value, {:stop, :normal}} rather than stopping cleanly.

This is what any GenServer logs in that situation:

[error] GenServer #PID<0.100.0> terminating
** (stop) bad return value: {:stop, :normal}
Last message: :go
State: {:socket, %{connection: ...}}

The reason I think it's worth fixing, even though the client is unaffected (it already has its GOAWAY), comes down to what that log line carries and where it goes. For this handler the State: is the whole connection: every open stream, both HPACK tables, the settings, the queue of pending sends. So a connection Bandit closed on purpose, after dealing with a client's protocol error, is recorded as an error level crash report with a sizeable state dump, which is easy to misread as a server fault when reading production logs. Thousand Island's terminate/2 also sees the {:bad_return_value, _} reason and takes its error path, so the connection's stop telemetry event gets error: {:bad_return_value, ...}, and anyone graphing or alerting on connection errors counts a routine close as a failure.

Seven rescue clauses across handle_call and handle_info share this helper, covering a stream's send, its headers, window updates, RST_STREAM, consumed-message accounting and stream exits, so any ConnectionError raised while processing one of those ends up here. It's a rare path, which is probably why it hasn't come up before. The clause that handles the :close_connection message already stops with a proper three element tuple, so this just brings the rescue path in line with it.

The change is to return {:stop, {:shutdown, :local_closed}, {socket, state}}. That is the same reason Thousand Island uses when a handler returns {:close, state} from handle_data/3, so the connection ends the way every other local close does: handle_close/2 runs, the socket is closed, no crash report, no error key in the stop event. I did consider {:stop, :normal, {socket, state}}, which GenServer would also accept, but Thousand Island routes :normal through its error clause and tags the telemetry with error: :normal, so matching the local close reason seemed the cleaner fit. Happy to switch if you'd prefer otherwise.

There wasn't a unit test file for the HTTP/2 handler yet, so I added a small one. It calls handle_info/2 and handle_call/3 with a nil connection, which makes the Connection functions raise and stands in for the errors these clauses rescue in practice, then asserts the stop tuple and that the error was logged. Both tests fail on main with the match seeing {:stop, :normal}. Suite, format, credo and dialyzer are clean.