fix(notify): 修复传输生命周期竞态，完善背压与协议边界

- 完善 stream/bulk DataID 分配、预留和双向命名空间，修复并发打开及 dedicated/shared 回退时的 ID 冲突
- 将收发、回复、恢复任务和 sidecar 绑定原始会话与物理连接，防止重连后的旧消息误操作新连接
- 加强 close/reset 身份校验及实例移除检查，修复 dedicated attach 失败、通道引用和资源回收竞态
- 收紧批量发送器停止准入，确保在途入队完成后统一清理请求、缓冲区和等待者
- 修复 record 满队列死锁、取消时序号消耗及关闭竞态，确保关闭有界并返回真实错误
- 增加协商式 record 逻辑半关闭，保留反向 ACK；通过 reset 传递 RecordFailure，避免背压掩盖原始失败原因
- 补齐帧长度、批次数量、序号溢出和未确认窗口校验，提前拒绝超限数据并按字节预算拆批
- 为入站分发增加全局及单连接的条数、字节预算和阻塞背压，关闭时唤醒等待者，消除正常断连日志噪音
- 完善 bulk 窗口释放失败处理与传输诊断，补充并发、重连、背压、协议边界及真实 TCP 回归覆盖

stream_shared_batch.go

@@ -47,11 +47,30 @@ func streamFastBatchPlainLen(frames []streamFastDataFrame) int {
 	return total
 }
 
-func encodeStreamFastBatchPlain(frames []streamFastDataFrame) ([]byte, error) {
-	if len(frames) == 0 {
-		return nil, errStreamFastPayloadInvalid
+func streamFastBatchPlainLenChecked(frames []streamFastDataFrame) (int, error) {
+	if len(frames) == 0 || len(frames) > streamFastBatchMaxItems {
+		return 0, errStreamFastPayloadInvalid
 	}
-	buf := make([]byte, streamFastBatchPlainLen(frames))
+	total := streamFastBatchHeaderLen
+	for _, frame := range frames {
+		itemLen := streamFastBatchFrameLen(frame)
+		if itemLen < streamFastBatchItemHeaderLen || itemLen > streamFastBatchMaxPlainBytes {
+			return 0, errStreamFastPayloadInvalid
+		}
+		if total > streamFastBatchMaxPlainBytes-itemLen {
+			return 0, errStreamFastPayloadInvalid
+		}
+		total += itemLen
+	}
+	return total, nil
+}
+
+func encodeStreamFastBatchPlain(frames []streamFastDataFrame) ([]byte, error) {
+	plainLen, err := streamFastBatchPlainLenChecked(frames)
+	if err != nil {
+		return nil, err
+	}
+	buf := make([]byte, plainLen)
 	if err := writeStreamFastBatchPlain(buf, frames); err != nil {
 		return nil, err
 	}
@@ -62,14 +81,21 @@ func encodeStreamFastBatchPayloadFast(encode transportFastPlainEncoder, secretKe
 	if encode == nil {
 		return nil, errTransportPayloadEncryptFailed
 	}
-	plainLen := streamFastBatchPlainLen(frames)
+	plainLen, err := streamFastBatchPlainLenChecked(frames)
+	if err != nil {
+		return nil, err
+	}
 	return encode(secretKey, plainLen, func(dst []byte) error {
 		return writeStreamFastBatchPlain(dst, frames)
 	})
 }
 
 func writeStreamFastBatchPlain(dst []byte, frames []streamFastDataFrame) error {
-	if len(frames) == 0 || len(dst) != streamFastBatchPlainLen(frames) {
+	plainLen, err := streamFastBatchPlainLenChecked(frames)
+	if err != nil {
+		return err
+	}
+	if len(dst) != plainLen {
 		return errStreamFastPayloadInvalid
 	}
 	copy(dst[:4], streamFastBatchMagic)
@@ -101,10 +127,11 @@ func walkStreamFastBatchPlain(payload []byte, fn func(streamFastDataFrame) error
 	if payload[4] != streamFastBatchVersion {
 		return true, errStreamFastPayloadInvalid
 	}
-	count := int(binary.BigEndian.Uint32(payload[8:12]))
-	if count <= 0 {
+	wireCount := binary.BigEndian.Uint32(payload[8:12])
+	if wireCount == 0 || wireCount > streamFastBatchMaxItems {
 		return true, errStreamFastPayloadInvalid
 	}
+	count := int(wireCount)
 	offset := streamFastBatchHeaderLen
 	for index := 0; index < count; index++ {
 		if len(payload)-offset < streamFastBatchItemHeaderLen {
@@ -113,11 +140,12 @@ func walkStreamFastBatchPlain(payload []byte, fn func(streamFastDataFrame) error
 		flags := payload[offset]
 		dataID := binary.BigEndian.Uint64(payload[offset+4 : offset+12])
 		seq := binary.BigEndian.Uint64(payload[offset+12 : offset+20])
-		payloadLen := int(binary.BigEndian.Uint32(payload[offset+20 : offset+24]))
+		wirePayloadLen := binary.BigEndian.Uint32(payload[offset+20 : offset+24])
 		offset += streamFastBatchItemHeaderLen
-		if dataID == 0 || payloadLen < 0 || len(payload)-offset < payloadLen {
+		if dataID == 0 || uint64(wirePayloadLen) > uint64(len(payload)-offset) {
 			return true, errStreamFastPayloadInvalid
 		}
+		payloadLen := int(wirePayloadLen)
 		if fn != nil {
 			if err := fn(streamFastDataFrame{
 				Flags:   flags,