[cppla]

Summary

Preserve initially declared, safe request trailers for nonempty streamed cover uploads. Both cloning boundaries now publish into their owned trailer maps before successful body EOF, including HTTP/3 replacement maps, without buffering the complete upload.

• Select trailer-capable HTTP/1.1 chunked upstream framing for positive-length HTTP/2 and HTTP/3 uploads; disable unbridged automatic body replay.
• Filter credential, invalid, hop-by-hop and connection-nominated trailers initially and at EOF; public-origin mode also filters untrusted forwarding trailers.
• Retain original and late nomination policy across nested clones, consolidate ASCII case aliases without duplicating values, and copy fields in a single scan.
• Keep Close as a direct delegate so it can interrupt a blocked Read; preserve read/close results and caller metadata ownership.

Validation

• Frozen fixture on unchanged main b92b22a: all 12 real cover exchange leaves returned 422 with missing upload trailers, while the identical owned direct HTTP/1.1 controls returned 200. Each origin received the first 64 KiB before client EOF was released. The same fixture passes after the fix.
• Final source: Go 1.25.13 focused race x5; Go 1.27.1 focused race x3; isolated Linux ARM64 Docker x3. Eight top tests, 32 terminal leaves, 47 group-inclusive nodes per repetition; no failures or skips.
• Actual incoming HTTP/1.1, HTTP/2 and HTTP/3; actual verified-TLS upstream HTTP/1.1 and HTTP/2 controls. Owned fixed-address origins only; no tunnel dialing or UDP resolution.
• Full make check and make race passed; 15 test-bearing Go packages and 49 release-recipe Python checks. The first full static check identified a test lostcancel diagnostic; adding explicit deferred cancellation fixed it, and all final-source gates were repeated. Earlier attempts are retained locally.

Scope

This is website upload/checksum compatibility, not a traffic-identification result or a claim that dropping HTTP trailers is universally invalid. Only initially declared safe fields are covered; empty-content exchanges, late unannounced values, and custom transports that deep-clone requests again are outside this guarantee. Custom bodies must finalize trailers before Read returns EOF, not mutate them concurrently from Close.

No dependency pins, default protocol selection, tunnel authentication, published version, release, registry, remote deployment or canceled formal capture campaign changed.

CI observation

The first PR attempt passed 12 jobs, but macOS job 111109993429 failed in the existing HTTP/3 metadata final-response leaf with a 2.00-second QUIC idle timeout. No upload-trailer assertion or cleanup failure was reported; the actual cause remains unattributed. The original failure log is retained. No timeout was relaxed and no test was skipped.

On unchanged source, the same shuffle seed (1790995285104986000) passed the whole metadata top 20 times with race detection and then the full tunnel package without race detection (37.085 seconds). These local observations do not reproduce the CI host/load or prove why it failed. A single bounded re-run of only the failed macOS job on the same PR head passed (job 111111165743, full tunnel package 35.572 seconds); CI attempt 2 completed successfully. The other ten CI jobs carry their attempt-1 execution timestamps rather than representing ten new executions; CodeQL and netem passed independently on attempt 1. This retry does not identify the cause of the original timeout.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.