fix(probes): Bound responses with a ten-byte compatibility ceiling

[korya]

Problem

Misconfigured probe endpoints can consume arbitrary response bodies while reporting valid latency samples and charging only a fixed traffic estimate.

An endpoint returning 1 MiB is currently drained as a successful probe despite a 5000-byte foreign or 1000-byte self estimate. Empty responses also count as measurements.

Solution

Accept only complete probe bodies of 1–10 bytes, discard invalid samples, and report bounded warnings while retaining valid measurements and continuing load.

Ten bytes preserves Cloudflare's deployed endpoint alongside the draft's one-byte response. The ceiling is fixed, with no caller override; the compatibility change is called out under Changed in the changelog. LAT-11 and the README record the deviation. Dated config and bounded-GET checks confirm Apple returned one byte and Cloudflare ten on 2026-09-10; these observations are not vendor guarantees.

Response	Handling
Complete, nonempty, 1–10 bytes	Accept latency sample
Declared length above 10	Reject before reading payload
Unknown length	Read at most 11 bytes to detect overflow
Ten bytes without completion	Wait for the existing deadline; no premature success
Empty, truncated, read failure, or oversize	Discard sample and close its response body

Closing a rejected self-probe body preserves the shared HTTP/2 load stream. Size warnings are limited to one for idle and one per foreign/self kind in each direction; an idle timeout and size failure share one diagnostic. Parent cancellation retains precedence. Load continues within the configured budgets even if all probes fail, retaining capacity measurements with absent loaded latency and zero RPM. Failed loaded attempts still charge their fixed estimates, which remain separate from throughput. LIM-2 and LIM-10 explicitly describe transport buffering and the absence of an exact wire-byte cap.

Validation: go test -race -count=3 ./... passed, including soak tests; the added byte-cap regression also passed with three race-enabled repetitions. Build, vet, formatting and golangci-lint passed. Real HTTP/1.1 and HTTP/2 tests cover known/unknown sizes, stalls, truncation, status precedence, multiplexed load survival, partial results, warning deduplication, accounting and CLI JSON/human/events output. Result schema and algorithm cost fixtures remain unchanged. The CLI byte-cap output case now uses a one-byte accounting cap and a separate five-second watchdog, removing its previous 1 MB / 300 ms transfer-rate assumption. That case passed 30 race-enabled repetitions; the complete CLI package passed three repetitions.

The built CLI was exercised against the same local fixture before and after: one valid one-byte response followed by two eleven-byte responses. The new build keeps one idle sample, warns, and completes download with exit 0. Screenshots render the captured CLI transcript.

Before	After

Known pre-existing CLI limitation found during end-to-end validation: when a throughput lower-bound window exists without any completed loaded probes, human output can print <= 0 RPM as an upper bound; JSON omits the unavailable bound. This formatter issue remains a separate follow-up.

Related:

• Closes Bound small probe responses before they bypass byte accounting #40
• LAT-11, LIM-2, LIM-10, RES-6, INV-3, INV-4, INV-6