[takeokunn]

Summary

• Add an SBCL HTTP/3 server listener with Retry, strict h3 ALPN negotiation, handshake and request deadlines, resource limits, GOAWAY draining, and QUIC close reasons limited to 256 characters with control characters replaced.
• Bound active request workers server-wide and limit each connection to four active unidirectional-stream workers. Excess unidirectional streams wait in a FIFO queue. With the default 128-connection limit, unidirectional-stream workers are capped at 512; the transport advertises credit for 16 incoming unidirectional streams for control, QPACK, and GREASE or unknown stream traffic.
• Account for request-body copies when enforcing the aggregate buffered-body budget.
• Enforce HTTP/3 control and QPACK stream rules and reject reserved HTTP/2 frame types on request streams.
• Correct coverage normalization so candidates inside an unexecuted lambda remain uncovered.
• Add a test-only raw QUIC peer fixture, HTTP/3 listener tests, and API documentation. The fixture's pinned Go 1.26.5 toolchain and known standard-library vulnerabilities are documented in its README.
• Update the HTTP/3 ASDF dependencies to cl-quic-kit 0.2.7 and cl-http-kit/tls.

Validation

• paredit inspect check passed for the changed Lisp and ASDF files, and gitleaks dir found no leaks.
• Local runtime tests were not run because ASDF dependency resolution stalled on this machine. The Nix CI checks for the current head are pending.