[cppla]

Summary

• Reject a custom TCP dialer's owned successful socket when the frontend setup context has already expired or been canceled. Preserve the dialer's own error and close-error precedence; timely sockets retain their relay and HTTP pool lifetime.
• Join registered native QUIC physical dial workers and late successful connection cleanup before client Close returns. Concurrent Close calls share a completion barrier; per-caller cancellation still does not cancel the shared dial.
• Route one ordinary loopback ephemeral test fixture through the existing typed, bounded UDP-port-collision retry. No website guard or rollback assertion changes.
• Document the precise setup and physical-dial ownership guarantees. No protocol, authentication, dependency or default-configuration changes.

Verification

• Same final regression tests fail on the original production implementation and pass on the fix: actual late TCP results across SOCKS CONNECT, HTTP CONNECT and HTTP forwarding; real trusted-TLS QUIC handshake held before physical-result publication.
• Go 1.27.1: final make check and full make race pass; frontend/ownership/reuse/half-close focused race regression repeated 10 times (270 inclusive RUN/PASS nodes).
• Go 1.25.13: five native ownership/reconnect/caller-cancellation/health/UDP-close tests repeated 10 times under race (50 RUN/PASS).
• Guard and ephemeral-fixture policy regressions repeated 10 times under race.
• Fresh offline Linux/arm64 Docker execution of native close, authenticated reconnect and caller-only cancellation controls, three repetitions (9 RUN/PASS); source/binary/input and owned-container cleanup guards pass.
• The initial full race gate's actual ephemeral UDP bind collision is retained as a failure; after the fixture correction the final full gates were rerun successfully.

Scope limits

The late-return gates are explicit scheduling fault injection on owned real loopback sockets, not natural failure-frequency measurements. Native Close newly joins physical dialing/late-result cleanup, not every dependency background thread or TLS setup. The second concurrent Close is observed as launched/noncompleted, without an internal blocked-stack witness. No release or comparative traffic-recognition claim.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.