fix(h3): share failed dials and join client shutdown

[cppla]

Change

• Share one immutable cold H3 dial result with callers already waiting on it. A failed attempt no longer makes joined callers serialize replacement UDP handshakes; a later invocation can retry.
• Keep the physical dial client-owned and bounded by the existing configured timeout. Canceling one caller preserves its exact cause without canceling surviving callers.
• Join owned dial/session-cleanup workers before closing the HTTP/3 transport. Concurrent/idempotent Close callers wait for the same cleanup completion.
• Use the existing contextError helper at caller entry and result/error arbitration, including an elapsed deadline whose timer has not yet published cancellation. Published custom causes still take precedence.
• Document source-build semantics and bounded continuation after all waiters abandon an attempt.

Final candidate verification

• Go 1.25.13: full make check and shuffled full make race passed. New H3 race tests repeated 5 times: 6 tops / 10 terminal cases, 60 group-inclusive PASS, 0 FAIL/SKIP.
• Go 1.27.1: new tests plus 5 auth/retirement/sibling-cancellation neighbors under race repeated 3 times: 33 top executions, 57 group-inclusive PASS, 0 FAIL/SKIP.
• Isolated local Linux/arm64 Docker: the same 11 tops repeated 3 times, 57 group-inclusive PASS, 0 FAIL/SKIP; exact selected names matched, source/binary unchanged, owned container removed.
• An original old-production baseline reproduced excess failed physical dials and cancellation/Close defects with healthy real authenticated H3 survivor/H2 fallback controls. Two isolated Close mutations on the earlier sharing candidate each failed the intended early-return assertion.
• Review found the elapsed-deadline boundary before merging. A separate once-only baseline on initial PR head 3c6ebbd failed all three added deadline cases for the intended reasons; the corrected final candidate passed them. The fixed-deadline unpublished-timer Context model is synthetic, not a naturally observed timing race.
• Independent follow-up review found no remaining must-fix. Earlier head CI success is not reused for the corrected head.

Boundaries

No authentication/wire-profile/default-timeout/native-QUIC change, deployment, release or tag; published v1.0.1 is unchanged. This fixes coordination/resource ownership, not general speed or browser equivalence. Close-completion and earlier late-valid-session audits use synthetic scheduling barriers. The earlier late-session fixture's initial repeated-server-shutdown failure is retained; a one-line fixture-only allowance passed once. attempt.done proves result publication, not worker termination; Client.Close separately joins workers. The closed-client deadline case checks entry precedence, not isolation of the client-cancellation select branch. Local raw evidence is ignored, outside this four-file PR.

Corrected-head GitHub verification

Final head e660b1df6f4015c36c8c06a9bf4a342454f552db passed all 13 workflow jobs (attempt 1): CI, CodeQL, Linux netem. Actual PR merge checkout b974784c1b7fd1d7ec04db57947d2e7aea7e9870 has the exact candidate tree c9eb596a6b47d51fa81fe19be3d16ac57f6463f3; key race/coverage/container logs were inspected. The elapsed-deadline thread is fixed and resolved. Merged-main checks were verified independently on 556f9948d48ab64b28529ae5eb81d26abf737792 (same candidate tree, attempt 1, all 13 workflow jobs successful): main CI, main CodeQL, main Linux netem. Actual key logs check out the merged commit itself; local main is fast-forwarded, source hashes match and the tracked worktree is clean.

[Copilot]

Copilot review overview

🟡 Changes recommended

Deadline checks can violate the caller context contract before timer cancellation is published.

Review effort: Balanced
Findings: 1

Open (1)

• Use contextError before starting shared dials · New

What changed in this PR

This PR improves HTTP/3 connection coordination and shutdown behavior.

Changes:

• Shares cold H3 dial results while isolating caller cancellation.
• Joins dial and session-cleanup workers during concurrent client shutdown.
• Adds extensive lifecycle tests and documents the semantics.

File	Description
internal/​tunnel/​web_h3_client.go	Implements shared dials and joined shutdown.
internal/​tunnel/​web_h3_dial_sharing_test.go	Tests sharing, cancellation, retry, and fallback.
internal/​tunnel/​web_h3_close_join_test.go	Tests cleanup completion and concurrent Close calls.
docs/​WEB_COVER.md	Documents the new H3 behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.