[cppla]

Summary

• Upgrade the exactly pinned Web H3 QUIC dependency to v0.63.1-0.20261004180939-a10df75c260c; retain official upstream for native QUIC.
• Introduce the fixed chrome-2026-10 profile. Explicit chrome-2026-08 configurations fail before networking with migration guidance instead of silently changing their wire image. New web init bundles pin the profile; native bundles are unchanged.
• Add H3 request parsing, TCP/UDP connection-authentication, and malformed-header regressions; update deployment and research provenance documentation without relabeling historical captures.

Validation

• GOFLAGS=-p=1 make check: passed on Go 1.26.8.
• New H3 parser/auth regressions: passed, including a 20-repeat race run. GOFLAGS=-p=1 make race: passed for the whole project.
• Local isolated Docker: three-round active-probe and UDP-blackhole transition smoke passed on the exact head, with clean/unchanged source.
• Dedicated native ARM Linux: 72 targeted H3/UDP tests passed. Local Docker and ARM packet captures confirm H3 ClientHello includes trust_anchors (0xca34) and zero-length source CID.
• govulncheck: no reachable findings. Renamed-fork advisory coverage still requires separate upstream patch review.

Migration and limits

Old explicit profile names must be changed in the configuration file to chrome-2026-10 or native; a CLI override does not hide a stale invalid JSON entry. Omitted profile settings select the new default. This is a deliberate client-profile migration, not an unchanged August image. Server-only configuration does not require a profile change.

The Chrome profile still does not support TLS resumption; 0-RTT remains disabled. These are bounded functional/wire checks, not a passive browser-similarity or comparative advantage claim. No full corpus was collected.

An initial concurrent host test hit the existing TCP/UDP ephemeral-port allocation collision; its failure was retained and the serialized full check passed. An initial packet capture was empty due to buffering; it was retained and repeated with immediate capture mode. No product assertions were relaxed.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.