Problem
The egress rate limiter currently panics if its process-local rate state mutex is poisoned. This can turn a prior panic while holding the lock into repeated production panics on future egress checks.
Expected behavior
If the limiter state is poisoned, egress should fail closed and return false rather than panic or bypass the configured rate limit.
Scope
- Replace the panicking lock acquisition in core::egress::check_rate.
- Add a regression test for poisoned state handling.
- Keep the change limited to the egress limiter path.
Problem
The egress rate limiter currently panics if its process-local rate state mutex is poisoned. This can turn a prior panic while holding the lock into repeated production panics on future egress checks.
Expected behavior
If the limiter state is poisoned, egress should fail closed and return false rather than panic or bypass the configured rate limit.
Scope