[cppla]

Summary

• Add explicit doctor --probe udp-dns --target IP:port --dns-name name with one classic A/IN query, no EDNS/retries/TCP fallback, and a whole-exchange timeout. Existing default TCP probe remains unchanged.
• Require a matching, complete <=512-byte NOERROR response before reporting transport/DNS metadata; redact probe inputs, answers and raw causes. Reject unsupported TLS/H2 locally. NOERROR/NODATA proves an exchange, not resolution, DNSSEC or general DNS compatibility.
• Reject canceled/late successful custom UDP resolution before native UDP delivery or H3 target admission while preserving resolver errors and healthy association reuse.
• Document source-build-only availability; no protocol/default, dependency pin, version, release or deployment changes.

Validation

• Frozen old-source race controls reproduced late payload delivery on both real loopback native QUIC/H3 paths; later healthy same-association replies completed. Separately confirmed new CLI flags were previously absent.
• Independently reproduced/fixed mapped-zone normalization rejection during review.
• Final focused Go1.25.13 race x5, Go1.27.1 race x3, isolated Linux ARM64 Docker x3: all 10 tops / 201 terminal leaves per repetition passed, no skips. Includes real authenticated DNS, strict framing/compression controls, canceled blocked Send/Receive joins, privacy, config/CLI precedence and unchanged TCP behavior.
• Full make check and make race: 15 test-bearing Go packages each; 49 Python release recipe tests passed. Built CLI help and unsupported-mode exit checked.
• Docker source/binary hashes stayed fixed and only the owned test container was removed. No remote-machine validation or formal traffic comparison is claimed.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.