fix(api): prevent slow-drip bypass of loopback receive deadline #756

Defect and accepted boundary

A same-host client can keep the serialized TEPP loopback receiver busy by sending each header/body fragment faster than the one-second socket inactivity timeout. The existing public constant is described as a deadline, but the whole-request allowance is reset by partial progress. Related to #174 and approved PRD v0.4 §17; this issue concerns the current bounded transport contract, not production tenancy or scientific estimators.

Actual reproduction

The existing tepp-loopback binary remained unanswered after 2.424 seconds of header bytes every0.4 seconds, returning400 only when the sender closed. A valid trickled request also succeeded after about2.420 seconds. Prompt valid200 and idle~1second413 controls distinguish this from generic framing failure.

The permanent cargo test --locked -p tepp_api --test live_request_deadline regression reproduces the shared cause in all four Naruon/Analysis header/body combinations. Before repair all4 failed400instead413; new private borrowed-socket reader applies one monotonic deadline across each partial read/read_exact phase. It checks positive remaining time before read and checks expiration after success, retaining error mapping and socket ownership.

Acceptance

• all four real-socket slow-header/body regressions pass; immediate authorized positives remain green;
• exhausted-budget and partial-read ownership private tests pass;
• independent full eight-path source verdict, formatter/docstrings, actual standalone API178 outcomes and strictClippy pass;
• API authored lines1818/1818 and branches814/814 pass with unchanged verifier on fresh source-bound build targets; earlier reused-target814/970 and1802/1822 failures retained separately;
• fresh exact-head hosted evidence and qualifying approvals before protected-main integration; fix(coverage): reconcile contradictory LCOV opener counts #538/fix(actions): align hourly quality contract with central admission (#647) #648 baseline dependency/admission prerequisites retained;
• response writing, accept waiting, model processing, arbitrary generic Read preemption, durability, production authentication and GPU/scientific acceptance explicitly out of scope.

The initial scope is a receive-budget repair only. Do not normalize the defect by increasing the time allowance, lowering coverage or ignoring native regressions. The CI account billing lock remains an independent execution blocker; skipped reviews and runner0/steps[] are not approval or test success.