fix: bound adaptive capacity recovery probes

[cppla]

Summary

Fix a bounded adaptive-pacing recovery failure: after real receiver backpressure lowered the learned capacity, persistent RTT penalties could prevent higher delivery observations even after the receiver became fast again.

• Add a separate recovery admission phase for balanced/aggressive profiles. Three consecutive loss-free pacing-limited observations over at least one controller-clock second are required; rising RTT resets qualification.
• Probe above learned capacity, at most 1.25x/1.50x respectively, also capped by 2x the steady rate and configured maximum. Connection-wide allowance is at most 1 MiB; deadline at most 2 seconds. Unusable oversized/too-slow probe configurations are skipped.
• Never synthesize capacity, refill tokens on entry, or refund probe quota on cancellation. Only real wire observations update the estimator. Steady target telemetry excludes temporary admission rates.
• End on new loss, materially rising RTT, or transport backpressure. Split token refill at deadline even without another Observe; allow bounded post-admission feedback and exponential failure backoff.
• Preserve conservative, fixed-rate and bypass behavior, normal RTT/loss factors and underlying transport congestion control. Document limits.

Validation

• make check and make race: passed locally.
• go test -race ./internal/accel -run '^TestCapacityProbeSafety' -count=20: passed.
• Deterministic 32/64 KiB fast/slow/fast phases with unchanged 4x RTT penalty learn higher actual samples, then accept a renewed capacity decrease; conservative stays unchanged.
• Real QUIC small-window recovery test: normal and race runs passed with byte-verified forward/reverse traffic. In the normal sample, slow steady target 183,033 B/s rose across four recovery windows to 582,733 B/s.
• Negative control used the exact old main f6a931b pacer, same real QUIC regression, payload and assertions. All 3.5 MiB completed within the same deadline, but target stayed at 178,824 B/s; both final recovery windows failed the intended progress/target assertions. No simulated RTT or packet counters.
• Independent review caught and verified the qualification-period rising-RTT fix. Scope/secrets checks passed.

These are bounded synthetic and loopback recovery observations, not claims about Internet throughput, fairness, browser similarity or general superiority. Large bandwidth-delay products/custom bursts and delayed feedback can exceed this mechanism's limits. No full corpus, release, or historical test-server access.

Exact head 3e2cf90bca05dccda9ee53d5944305aa84951b35 passed CI (35806573075, all 10 jobs), CodeQL (35806573022), and Linux netem (35806573085). Container integration, OCI index build and namespace/netem suite each completed successfully. No unresolved review threads at merge check. Post-merge main 1740df22857cb97406e98e0740e46701f5f901d6 also passed CI (35806830314, all 10 jobs including container integration and OCI build), CodeQL (35806830336), and Linux netem (35806830311, suite plus diagnostics upload). Main tree f3437c5bd5969391496e3b26cd99c3953e0f07ac equals the tested PR tree. Local main is synchronized and clean; no release created.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Address the qualification reset and pending-probe feedback-grace issues.

Review effort: Lite
Findings: None

What changed in this PR

Adds bounded adaptive recovery probes to restore learned capacity after receiver backpressure while preserving conservative and fixed-rate behavior.

Changes:

• Adds bounded probe admission, deadlines, feedback handling, and backoff.
• Adds deterministic safety tests and real QUIC recovery coverage.
• Documents probe limits and operational caveats.

File	Summary
internal/​tunnel/​pacing_recovery_integration_test.go	Adds real QUIC recovery validation.
internal/​accel/​pacer.go	Integrates probe pacing, refill, and lifecycle handling; pending probes may be aborted prematurely.
internal/​accel/​capacity_probe.go	Implements recovery probes; RTT-reset observations can incorrectly count toward qualification.
internal/​accel/​capacity_probe_test.go	Tests recovery under persistent RTT penalties.
internal/​accel/​capacity_probe_safety_test.go	Tests probe bounds, cancellation, expiry, and congestion handling.
docs/​ACCELERATION.md	Documents probe behavior and limitations.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.