Description of problem: The credit logic allows the number of prefetched messages to exceed the receiver capacity. This was first noticed due to an extremely intermittent failure in ReceiverTest.testCapacity. New capacity tests have been added that show this more frequently. How reproducible: ~1% with old testCapacity, and ~80-90% with new variants of testCapacity Steps to Reproduce: Run qpid-python-test *.testCapacity* Actual results: Test frequently fails. Expected results: Test should always pass.