[cppla]

Summary

Reclaim a non-nil TCP connection returned with a custom destination Dialer's setup error. Cover native QUIC/TLS and authenticated WebH2/WebH3 exits.

• Close the failed owned endpoint before the existing failure response; ignore cleanup errors rather than expose private dial/cleanup details.
• Reject custom (nil, nil) results before a success reply or invalid destination wrapper.
• Keep sanitized native StatusDialFailed and verified web HTTP 502 responses.
• Preserve authentication/admission ordering, shared Dialer/physical session ownership, destination write bounds and healthy half-close.

Validation on 351b3755a2372899a71aae862915033a5d2b7c92

• make check and make race: full repository, terminal exit 0; no existing test or budget relaxed.
• Identical frozen ownership tests with only the two prior production files overlaid: expected failure, exit 1 (1.541s). All four actual authenticated public transports fail with Close=0 and real peer timeout, while typed responses and handler/admission/cleanup controls pass.
• Candidate ownership suite: race ×3, exit 0 (1.497s). Twelve actual transport subcases verify exactly one Close and peer EOF before any shared-client/server/fixture cleanup, even when Close returns a different private error.
• Candidate nil-result/preservation suite: race ×3, exit 0 (2.075s). Four transports safely reject nil success; H2/H3 retry uses the same ready physical session and auth state, with all 8,704 upload bytes + EOF and 143,360 reverse bytes + EOF, without closing the configured shared Dialer.
• Root ten existing cancellation/auth/admission/write/half-close/shared-native controls: race ×3, exit 0 (3.124s).
• Linux/arm64 existing isolated Docker image: three new top-level tests ×3 plus eleven existing controls, 20 actual top-level passes across 14 tests. Both containers exit 0 and are removed. All 98 proxy/tunnel Go files, modules and five candidate files including docs match before build, after build and after run. Cached Go 1.25.13, CGO=0; binary SHA-256 d340950ec944d0565e14c4707a3808d4946eb28d732e552e0ecf6d3d81ffb2c9. Pull never, network none, read-only, no capabilities, resource bounds, Go/container/host 50/55/60-second ceilings.
• Independent production/docs reviews: no blocker.

Exact-head GitHub verification

All workflows completed on attempt 1 against 351b3755a2372899a71aae862915033a5d2b7c92:

• CI 37035600461: all 11 jobs passed, including Go 1.25.13/1.27, macOS, Windows UDP continuity, full race, reachable-vulnerability scan, four platform builds and multi-platform container integration/OCI export. Actual container job 110932911996 includes integration and OCI-export markers.
• CodeQL 37035600304: passed.
• Linux netem 37035600468: passed; actual job 110932913071 includes netem integration passed.
• Automated review reported no findings; zero inline review threads. Public PR state is clean and mergeable with unchanged head/base; local/remote base and the five-file scope match.

No failed job rerun or gate relaxation.

Post-merge main verification

PR #37 is squash-merged as cf8f97ca179098fd6ddf85b7245a0d946f654796. Local main, origin/main and the live remote main ref match. Tree df0d5b86648392fb024e8a341f4f4a0025348e70 is identical to tested PR head 351b3755a2372899a71aae862915033a5d2b7c92; the five frozen file hashes also match the Linux inventory. Independent local audit confirms clean status, the exact five-file scope and unchanged local tags/release configuration.

• Main focused three-test suite: race, shuffle, count 3, terminal exit 0 (2.471s); nine actual top-level executions.
• Main CI 37036193005: all 11 jobs passed on attempt 1. Actual container job 110934882751 includes integration and OCI-export markers.
• Main CodeQL 37036192892: passed on attempt 1.
• Main Linux netem 37036192869: passed on attempt 1. Actual job 110934881191 includes netem integration passed.
• All three main workflows are push events on the exact merge SHA. No rerun, gate relaxation or new release/tag.

The separate deterministic HTTP idle Shutdown duplicate-close finding remains the next iteration; it is not changed here.

Scope and evidence limits

Only configured/custom Dialers were demonstrated to return a live owned connection alongside an error; no built-in Dialer is claimed to do so, and no indefinite descriptor leak is claimed. The earlier diagnostic covered QUIC/H2 only; the four-transport coverage above comes from actual executed public-client tests.

Nil-result real-Serve tests run only on guarded production; no unsafe old-production goroutine panic baseline was attempted. A shell redirection failed before the initial root baseline test started because its new evidence directory was missing; the actual rerun completed and is retained separately.

This is source-build behavior, not part of v1.0.1. No dependency, default budget, new release/tag, remote host, Docker image/daemon mutation or large capture campaign is changed. No traffic-equivalence or comparative-performance claim is made. The separately diagnosed HTTP duplicate-listener-close Shutdown return is not fixed by this destination patch.

[Copilot]

Copilot review overview

🟢 Approval recommended

The ownership fix is consistent across transports and comprehensively validated without exposing private errors.

Review effort: Balanced
Findings: None

What changed in this PR

Ensures failed relay destination dials reclaim owned connections while preserving sanitized responses.

Changes:

• Close non-nil connections returned with dial errors.
• Reject successful dials returning nil connections.
• Add four-transport ownership, session-preservation, and half-close tests.

File	Description
internal/​tunnel/​common.go	Handles failed native destination results safely.
internal/​tunnel/​web_handler.go	Handles failed H2/H3 destination results safely.
internal/​tunnel/​destination_dial_error_ownership_test.go	Tests ownership across authenticated transports.
internal/​tunnel/​destination_dial_result_preserve_test.go	Tests nil results and healthy session preservation.
docs/​DEPLOYMENT.md	Documents relay dial ownership behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.