If I read section 3, "Use of ALPS in HTTP", correctly, it does not specify how many SETTINGS frames can be sent in ALPS, nor does it say anything about what the order of SETTINGS frame(s) has to be with request to potential other frames explicitly allowed by other extensions. I think we should consider spelling these out explicitly. I suggest to ban more than one SETTINGS frame. I'm fine with arbitrary frame order, although requiring that if there is a SETTINGS frame then it MUST be the first frame is also a reasonable option.
If I read section 3, "Use of ALPS in HTTP", correctly, it does not specify how many SETTINGS frames can be sent in ALPS, nor does it say anything about what the order of SETTINGS frame(s) has to be with request to potential other frames explicitly allowed by other extensions. I think we should consider spelling these out explicitly. I suggest to ban more than one SETTINGS frame. I'm fine with arbitrary frame order, although requiring that if there is a SETTINGS frame then it MUST be the first frame is also a reasonable option.