[cppla]

Summary

• Recheck caller cancellation after stopping the H3 opening watcher and again under the final handoff lock. Return the original cancellation cause, reset only the rejected request stream, and release its reservation.
• Preserve CONNECT-UDP cancellation/deadline causes across request-stream open, header send and response-read failures. Ambiguous bootstrap failures still invalidate authentication; a successfully proven Ready session remains reusable.
• Document the source-build-only contract. No wire format, fingerprint, default timeout/configuration, dependencies, version, release or registry changes.

Evidence

Four new terminal regression scenarios first failed against unchanged main production under Go 1.25.13 race, with the intended failures and healthy controls continuing: TCP/UDP returned live streams after post-proof cancellation; UDP response waits lost private cancellation and deadline causes. Frozen fixtures then passed:

• Go 1.25.13 focused race x5: 15 top invocations / 20 terminal leaves / 25 nodes, no skips.
• Go 1.27.1 focused race x3: 9 tops / 12 leaves / 15 nodes, no skips.
• Isolated Linux/arm64 Docker x3: same 9/12/15, cached image, no external network, read-only/no capabilities, owned container removed.
• One full make check and one full make race (Go 1.25.13); exact process results and source guards retained locally.
  Independent source/fixture reviews found no must-fix.

Tests exercise real verified TLS/H3 proof, request cleanup, an existing TCP sibling, subsequent complete TCP/UDP echoes on the same physical connection with one full credential, and cancellation detached after successful handoff.

Limits

The final-lock recheck is source-order defense, not a separately reproduced lock-wait race. UDP stream-open/header-send error paths are reviewed but not individually fault-injected. Send has no per-call context; its lazy UDP opening uses an internal association-owned budget. No remote host, formal corpus/browser comparison or passive-equivalence claim. Published v1.0.1 binaries are unchanged.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.