[cppla]

Changes

• Bind HTTP/SOCKS CONNECT lifetime to the accepted connection, preserving upload half-close and delayed responses while releasing the destination on forced shutdown. Join any started cancellation close callback; install HTTP ownership before buffered-prefix replay.
• Recheck caller cancellation under the final H2 stream ownership lock without retiring the reusable authenticated physical session.
• Keep a late successful CONNECT-UDP opening pending until stream, session reservation and admission slot cleanup completes.
• Document ownership boundaries and add actual loopback TCP/TLS/H2/H3 regressions with healthy transfer controls.

Verification

• Full local make check and make race on Go1.27.1; 49 Python release regression tests.
• Go1.25.13 shuffled selected race regression, 10 iterations: 140 exact RUN/PASS nodes.
• Actual Linux/arm64 Docker test-binary execution, three iterations: proxy 15 and tunnel 27 exact RUN/PASS nodes. CGO=0, non-race, isolated owned loopback only; source/binary guards and owned container cleanup passed.
• Original-source and single-point omitted-join negative controls fail at the intended witnesses; repaired variants and independent cleanup joins pass.

No dependency/default/wire-format changes, release publication or external-host deployment. These are lifecycle/resource-ownership results, not browser-equivalence or traffic-recognition claims.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.