[cppla]

Summary

• Reject and close late web-auto CONNECT-UDP results after caller cancellation or the primary opening deadline, preserving caller causes and detached successful packets.
• Recheck H3 caller cancellation under the connection-selection and authentication-reservation locks, before new physical setup or claiming a Fresh session.
• Reject late successful destination TCP results across native QUIC/TLS and web H2/H3, retaining sanitized native failures, authenticated web 502 responses, and reusable shared sessions.
• Document the source-build behavior; published v1.0.1 binaries are unchanged.

Verification

After correcting test-fixture compilation, unchanged production failed all eight newly added terminal cases in once-only scoped causal baselines. The same frozen tests pass on the repair, including real loopback payload/FIN/EOF, late-result ownership, admission release, detached healthy UDP, physical-session reuse, and full/short authentication controls.

• Go 1.25.13 focused race ×5: 25 top executions / 40 terminal cases, zero failures or skips.
• Go 1.27.1 focused race ×3: 15 top executions / 24 terminal cases, zero failures or skips.
• Isolated offline Linux ARM64 Docker ×3: 15 top executions / 24 terminal cases, zero failures or skips.
• Full make check and make race: passed; 49 Python release-contract tests passed.
• Independent scoped reviews found no must-fix.

The finer H3 connection-return-to-reservation window is a source-order defense, not separately injected scheduling evidence. Deterministic cancellation/late-return scheduling is not a natural-latency or performance experiment. No dependency, wire profile, authentication format, timeout default, release, external deployment, formal corpus, or browser-comparison change is included. Fresh PR-head CI, CodeQL, and native Linux netem completed successfully on cf48987. CI's first macOS attempt failed at the existing H3 static fixture's QUIC handshake (before HTTP assertions); the unchanged exact-shuffle local tunnel diagnostic passed, and one scoped failed-job rerun passed. The original failure is preserved and its root cause remains unconfirmed; no assertion or timeout was relaxed, and successful jobs were carried forward rather than rerun.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.