[cppla]

Changes

• Isolate native UDP forwarding by requested target, with a lazy fixed worker pool, same-key FIFO and bounded active-plus-waiting packet, payload/address byte and target budgets.
• Opt H3 CONNECT-UDP into safe concurrent SOCKS sends. Propagate the capability and actual target canonicalization through wrappers; legacy or limit-0/1 packet connections remain serial.
• Preserve per-packet resolver/policy checks, authenticated bootstrap, source filtering, terminal/recoverable error scope and no-retry behavior.
• Stop admission, interrupt I/O and join send/receive work before releasing association/session ownership. Initialize native session work before publication to avoid a concurrent shutdown race.
• Document overload and cancellation contracts; add queue, wrapper, SOCKS and actual authenticated wire regressions.

Evidence

• Unchanged main baseline 766d090 with the frozen four-test wire fixture: direct concurrent H3 passed; native, H3-through-SOCKS and auto-H3-through-SOCKS failed warm-target progress while another target's resolver was held. Recovery and cleanup controls completed.
• Same frozen fixture after the fix: all four pass, including progress before releasing the slow resolver and joined shutdown with zero final leases.
• Focused race gates: 17 top-level tests / 37 terminal leaves, Go 1.25.13 x5 and Go 1.27.1 x3; no failures or skips.
• Full make check: 16 test-bearing Go packages and 49 release-helper Python tests, plus formatting/module/boundary/notice/vet gates.
• Full make race: all 16 test-bearing Go packages passed.
• Actual offline Linux/ARM64 Docker execution: same focused selection x3, 138 RUN/PASS nodes, no failures or skips. Non-race (CGO=0); source/binary hashes unchanged and owned container cleaned up.

Boundaries

Native UDPReceiveQueue now counts active plus waiting packets (previously waiting plus one active). Per-target half-budget caps intentionally shed overload; this is not universal fairness, reliable UDP delivery or ordering across different keys/DNS aliases. Custom concurrent packet providers must honor cancellation/Close.

No protocol, authentication, dependency, default transport, version or release changes. No browser-equivalence or traffic-identification claim; no canceled large corpus or old remote machine was reused.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.