[cppla]

Scope

Test-oracle correction, witness helpers and architecture documentation; production pacing code and defaults are unchanged.

The first post-merge main CI failure 37096880419 is preserved and was not rerun. In a separate predeclared, instrumented 12 ms warmup condition, 4 of 10 terminal-target assertions failed despite actual acceptance of eight lower-capacity samples, followed by permitted higher pacing-limited delivery samples. This demonstrates an endpoint-oracle gap, not the exact cause of the original CI failure or a production pacing defect.

Changes

• Require two stream-specific, actual peer-received fresh blocking offsets and the prescribed pending first raw writes.
• Move measurement from the arbitrary terminal target to a fixed round-10 checkpoint: the second FIFO receipt from the two prescribed successful 11th production-wait returns, with ten completed raw writes each. The receipt is a live target read, not an atomic individual Observe result; no minimum or first passing target is selected.
• Confirm both prescribed 11th writes remain blocked with fresh offsets, then drain the remaining six rounds and verify same-connection recovery.
• Keep the strict 36% assertion, all 16 × 120 ms rounds, 16 KiB receive windows, 15-second fixture budget, complete payload checks and actual token-sleep overlap.

Validation

• Go 1.25.13 non-race, fixed CI shuffle seed, 20 repeats: 540 matching RUN/PASS nodes.
• Go 1.27.1 race, 10 repeats: 270 matching RUN/PASS nodes.
• Same controlled 12 ms warmup with the new fixture and no Observe diagnostic overlay: 10 PASS.
• Capacity-learning-disabled overlay: expected strict checkpoint assertion failure; production source remained unchanged.
• Go 1.27.1 make check and make race: passed; 16 test-bearing Go packages, plus 49 Python release-helper tests in make check.
• Fresh Linux/arm64 CGO=0 selected loopback execution: 7 top-level tests, 29 nodes × 3 = 87 RUN/PASS; source/input/compiler/binary guards matched and the owned container was removed. One nonfatal UDP buffer warning is retained.

Local commands overlapped and are correctness checks, not performance measurements. No remote SSH, browser/corpus comparison, release, tag or registry publication. Fresh PR and subsequent main checks are still required.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.