[cppla]

The recovery test compared aggregate raw QUIC Write time with aggregate pacing Wait time to prove receiver backpressure. That guard could reject a real blocked connection after correct capacity adaptation increased later token waits, before recovery was evaluated.

Use a fixture-only in-memory observer of received STREAM_DATA_BLOCKED frames for the actual primary stream. Require an offset strictly beyond completed warmup plus the same first raw Write still pending before allowing the first slow-phase read. Old or retransmitted warmup frames cannot qualify. Add a real wide-window negative control and observer/witness unit tests.

The fixed 16 KiB window, original 15-second fixture deadline, payloads/read delays, capacity-decline bound, four recovery windows, and sustained throughput/target bounds are unchanged. Wait/Write timings remain diagnostic logs. Production pacing, dependencies, and releases are untouched.

Validation: full local make check and shuffled make race; targeted race ×3 (27 top-level passes); independent review and existing shared-stream control; isolated Linux arm64 Docker recovery ×3 plus 10 controls, source/module hashes unchanged, containers cleaned up. Every positive run observes a fresh blocked offset before the first read; the wide-window control rejects without timeout and still verifies all bytes and reverse data.

Exact-head 5613ba1da3731dcc295116e19290e5d8714bc41b: CI passed all 11 jobs, CodeQL passed, and Linux netem passed, all on attempt 1. Actual container integration/OCI export and netem success logs were verified. Independent reviews found no blocking issue; no inline review findings remain.

Merged as 44ae9eb969a5f8878c45f8f6fc5fa2000f7b0e40; local main and origin/main are synchronized with the identical tested tree. Main push CI passed all 11 jobs, CodeQL and Linux netem passed, all on attempt 1. Actual main container/netem logs were checked. All seven observer/gate unit tests also passed under race ten times on merged main. No runtime pacing, release, or tag change.

[Copilot]

Copilot review overview

🟢 Approval recommended

The test-only changes provide concurrency-safe, directly observed backpressure evidence with appropriate positive and negative coverage.

Review effort: Balanced
Findings: None

What changed in this PR

Replaces timing-based QUIC backpressure detection with direct STREAM_DATA_BLOCKED observation.

Changes:

• Adds a thread-safe qlog backpressure observer and tests.
• Gates recovery reads on a fresh blocked offset and pending first write.
• Adds a wide-window negative control.

File	Description
internal/​tunnel/​pacing_recovery_witness_test.go	Adds witness gating and negative control.
internal/​tunnel/​pacing_recovery_integration_test.go	Uses witnessed backpressure in recovery testing.
internal/​tunnel/​pacing_feedback_integration_test.go	Adds tracing and first-write instrumentation.
internal/​tunnel/​pacing_backpressure_witness_test.go	Implements and tests the qlog observer.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.