fix(tunnel): honor cancellation at opening boundaries

docs/DEPLOYMENT.md

@@ -284,6 +284,13 @@ shutdown semantics or TCP CONNECT handling, and is not included in v1.0.1.
 Cancellation requires context-aware resolvers/dialers; custom implementations
 that ignore cancellation cannot be forcibly interrupted by the proxy.
 
+Source builds reject late destination TCP dial results across native QUIC/TLS
+and web H2/H3: a connection returned after the configured outbound dial deadline
+is closed even if a custom dialer reports success. Rejection retains the
+existing sanitized native dial-failure or authenticated web 502 response and
+does not close the shared dialer. Established healthy streams still outlive
+their temporary dial context. This change is not included in v1.0.1.
+
 Source builds also cancel an HTTP connection's request contexts when that
 tracked connection is closed. This lets forced shutdown cancel a pending
 upstream request even when HTTP/1.1 pipelining has stopped the background

docs/WEB_COVER.md

@@ -408,6 +408,21 @@ does not change authentication, wire profiles, timeout defaults or sibling
 stream ownership, and is not a general connection-speed or browser-equivalence
 claim. The published v1.0.1 binary does not contain this change.
 
+Source builds also recheck a queued H3 caller's cancellation before physical
+connection selection and authentication reservation. A canceled caller must
+not initiate a new shared handshake or claim an otherwise Fresh session.
+`web-auto` rejects and closes a logical CONNECT-UDP result returned after its
+caller cancellation or primary opening budget; this never triggers H2 UDP
+fallback or resets the TCP cooldown. Successful established packets remain
+detached from the caller's temporary opening context.
+
+Both web TCP handlers reject and close a destination connection returned after
+the configured destination dial deadline, even if a custom dialer reports
+success. The existing authenticated 502 response and connection-bound session
+are retained, so a later healthy request can reuse that session. This does not
+change authentication, wire profiles, or timeout defaults and is not included
+in the published v1.0.1 binary.
+
 After a failed H3 attempt, new TCP streams avoid repeating the UDP timeout.
 `--fallback-cooldown` is a base duration; each failure independently selects a
 retry point within +/-20% so clients do not probe in a fixed synchronized

internal/tunnel/common.go

@@ -217,6 +217,11 @@ func (s *serverCore) handleStream(
 
 	dialCtx, cancel := context.WithTimeout(ctx, s.dialTimeout)
 	upstream, err := s.dialer.DialContext(dialCtx, req.Network.String(), req.Address)
+	// Reject a successful late result before our own context cleanup. This
+	// bounds establishment without binding a healthy stream to its dial timer.
+	if err == nil {
+		err = contextError(dialCtx)
+	}
 	cancel()
 	if err != nil || upstream == nil {
 		// A custom dialer may return an owned connection even on failure.