[cppla]

Problem

An H2 CONNECT that already received an authenticated error (or loses the caller during handoff) can synchronously block in response Body.Close. With unread DATA, Go's HTTP/2 transport needs the shared write lock to return flow-control credit before checking cancellation. A stalled SETTINGS ACK can therefore extend a failed caller's wait to the physical write timeout.

Fix

• Cancel failed requests immediately, then transfer their existing opening reservation to client-owned response cleanup instead of blocking the caller or retiring a usable session.
• Keep the continuation authentication slot until cleanup completes, retaining per-connection replay-window backpressure on pending cleanup.
• Register opening ownership under the existing closed gate; client Close shuts down raw sockets and joins outstanding cleanup. No worker is newly registered after closure.
• For ambiguous authentication, retire the physical session before closing the unread response.
• Document the distinction between caller return and physical cleanup.

Validation

Tested head f38bce5b3e0d794ed3c72e75359f611c94704564, tree 36bae0bb1eaf8713d39138319533ecdace0cf05a, Go 1.27.2:

• Deterministic original-source failure: an authenticated 502 waits behind a witnessed SETTINGS ACK write; explicit fixture release then permits the same physical connection's short-ticket echo control.
• New real TLS/H2 regression: 3 profiles × 4 scenarios (authenticated error, canceled handoff, client Close, valid bootstrap losing selection); race repeated 10 times, 120 cases passed.
• make check and all-package go test -race -shuffle=on -count=1 -timeout=5m ./... passed.
• Independent lifecycle/auth-window review plus existing retirement, Close, handoff and sharing race regressions passed.
• Identical Linux ARM64 binary passed 7 top-level groups × 3 repetitions (21/21, no failures/skips), independently in isolated local Docker and on the authorized ARM64 Linux host.
• Binary SHA-256: 0d371d8aeadb55d9c5b4d7f199857b179a5e2cbf6be3a7014bbb63bd62cf6222.

The new fixture uses real TLS verification, H2 frames and response proofs over a bounded net.Pipe peer. Its subsequent healthy stream is a same-connection continuation control, not a new simultaneous-sibling or invalid-MAC test. Existing sibling and authentication tests remain in the full suite. No fingerprint profile, dependency, on-wire authentication format, release tag or comparative traffic claim is changed.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.