feat(datagram): expose safe payload bounds

[lemone112]

Contract

Expose the current safe QUIC DATAGRAM payload bound without widening the Connection interface, reset the MTU-derived bound on path migration, and enforce explicit inbound admission before retaining packet-backed data.

The implementation keeps these invariants:

• the outgoing queue owns enforcement of the peer DATAGRAM frame limit;
• limit downgrade removes only frames that became invalid;
• blocked Add wakes and revalidates under the queue lock;
• publication order is queue policy → peer transport parameters → public atomic capability;
• oversized inbound DATAGRAMs are dropped non-terminally;
• a full receive queue rejects before allocation or copy;
• accepted packet-backed payloads are copied before the packet buffer can be released;
• ConnectionState.MaxDatagramPayloadSize is dynamic and callers must reread it.

Evidence for 385c2903d0b8327ec9c01ba6e7d75a8fbb904b6b

• focused DATAGRAM race tests: PASS;
• go test -race ./...: PASS;
• go vet ./...: PASS;
• go build ./...: PASS;
• git diff --check: PASS;
• full-queue zero-allocation regression and packet-buffer mutation regression under race: PASS.

go test ./... was executed once, but the local wrapper failed to retain its exit status. It is intentionally not represented as a green local claim; exact-head remote CI remains mandatory.

Independent review

• protocol concurrency / publication / ownership: PASS;
• hostile-input and allocation amplification: PASS after remediation;
• future evolution and simpler-boundary review: PASS for this fork slice.

CodeRabbit's previous result was only a rate-limit notice, not substantive review.

Downstream boundary

This fork-specific capability is an adapter-only bridge, not an Ametyst domain or enterprise API. Downstream must expose a carrier-neutral capability, treat the bound as a changing hint, and keep SendDatagram as the authoritative admission check. The bridge should be removed when upstream provides equivalent dynamic bounds and safe downgrade behavior.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your current included review allowance is based on your included PR review attempts over the past 7 days.

Next review available in: 49 minutes

Limit details: You’ve used the included review currently available. Your 92 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 3d1beb6d-b7b8-4e35-994c-20acb013380d

📥 Commits

Reviewing files that changed from the base of the PR and between 41ded75 and 385c290.

📒 Files selected for processing (16)

• config.go
• config_test.go
• connection.go
• connection_test.go
• datagram_contract_test.go
• datagram_queue.go
• datagram_queue_test.go
• integrationtests/self/datagram_test.go
• integrationtests/self/mtu_test.go
• interface.go
• internal/wire/datagram_frame.go
• internal/wire/datagram_frame_test.go
• packet_packer_test.go
• server.go
• server_test.go
• u_connection.go

---

_{Comment @coderabbitai help to get the list of available commands.}

[lemone112]

Independent exact-head review artifact (2026-08-20): PASS, findings=[] for 385c290 versus e156888. Reviewed dynamic DATAGRAM bounds, receive-queue behavior, hostile input, races, downgrade/0-RTT interactions and resource exhaustion. Executed focused tests, 0-RTT DATAGRAM/rejection integration, go test -race ./..., go vet ./..., git diff --check. Post-merge readback at 8d4d73a: go test -race -count=1 ./... PASS. Squash merge tree matches the reviewed exact head.