[cppla]

Summary

• Resolve native QUIC relay addresses before allocating the library-owned UDP socket, preserving mapped IPv6/zone handling and existing verified TLS identity.
• Join unreturned TCP/TLS/protocol setup and concurrent native TLS client Close calls.
• Keep application-closing TLS streams registered until their real socket Close completes, so client closure joins that cleanup.
• Add bounded resource/lifecycle regressions and document ownership and callback limits. No protocol, dependency, configuration default or release/version change.

Validation

• Full make check and make race pass with Go 1.27.1 on macOS; 49 release-contract Python tests pass.
• Ten selected tunnel top-level tests plus 18 resolver subcases pass 10 consecutive race-enabled rounds (280 inclusive RUN/PASS nodes, zero failures/skips).
• Real isolated Linux/arm64 Go 1.25.13 container execution passes three rounds of seven selected top-level tests (75 inclusive RUN/PASS nodes). Source, inputs and binary unchanged; owned container cleaned up.
• Same final regressions reject exact previous production: 32 failed default QUIC dials retain 32 UDP descriptors until GC; old TLS client closure returns before joined setup/application closure.
• Initial fixture failures were investigated and retained. Aborted setup is checked by real TCP EOF rather than requiring graceful TLS decoding after canceled writes; the corrected final fixture still rejects the old lifecycle behavior.

Boundaries

No remote-machine, traffic-equivalence, browser-comparison or throughput claim. Operations ignoring cancellation can delay Close; a TLS setup callback must not synchronously Close its own client. Windows runtime coverage remains the existing CI-selected cases, not a new resource-test claim.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.