The pure core's fuzzers (4d401daf) cover the state machine; nothing exercised the Eio adapter that forks a timer fiber, races the candidate connections as sibling fibers, and cancels the losers as soon as one connects. That cancellation is the class of path a connection pool's mutex-poison-on-cancel bug lives in, so drive it hard.

The harness runs the real Happy_eyeballs_eio over an adversarial Eio_net_chaos.Net: per-connect refuse / timeout / slow faults over a base network whose connect suspends on the mock clock for a per-address latency, so a fast candidate wins while a slow sibling is still in flight -- the loser-cancellation path. Multi-address results reach the core through the injectable getaddrinfo (connect_host) or directly (connect_ip); some callers are cancelled mid-race. Every scenario runs under Eio_mock.Backend, whose deadlock detector is the liveness oracle: a leaked or hung attempt fiber empties the run queue with the scenario unfinished and trips Deadlock_detected. run_full's auto-advancing clock drives the timer where racing needs it; a frozen Eio_mock.Clock covers the instant failure-chain that needs no timer.

Oracles: LIVENESS -- every request reaches a winner or clean exhaustion, and a winner cancels its losing siblings with no leaked fiber, no hang, and no exception escaping the cancel; SAFETY -- a winning connection reaches one of that request's own target addresses, never a sibling's; NO-LEAK -- the adapter's waiter map and per-attempt cancel state return to (0, 0) once every attempt fiber has drained. The last is read through a new Happy_eyeballs_eio.outstanding, a small introspection the oracle needs (also useful for metrics).

Teeth, each restored before commit: not cancelling the losers leaves a hung attempt fiber that deadlocks the switch (Deadlock_detected); letting the cancel branch raise surfaces as an escaping failure across the racing fuzz and both teeth tests; leaving the winner's attempts registered trips the no-leak oracle at outstanding <> (0, 0). No adapter bug is demonstrable in the harness.

Also splits act_connect's success and failure branches into on_attempt_connected / on_attempt_failed (behaviour-preserving) so the file the fuzz work touches stays under the merlint length threshold.

The I/O-free Happy_eyeballs core (RFC 8305) races several connection attempts per request across resolutions and timers, but nothing covered the interleavings that racing produces. Drive the deterministic state machine the way the effectful layer does -- ids minted from a Waiter_map, time fed explicitly -- through fuzzed orders of connect starts, successes, failures, resolutions and timer expiries, checking the concurrency invariants on every step.

racing: no action ever names an already-completed request (a winning Connected and a terminal Connect_failed remove it for good) and every action's id correlates, through the Waiter_map, back to the request that minted it; the request then drains to a terminal outcome within a bounded step budget (no livelock) and the timer returns to an empty baseline (no leaked attempts).

cancellation: a winning Connected emits no action and orphans its siblings -- the pure-core form of cancelling the losers, which the Eio backend performs with Eio.Fiber.first -- and every late event for an orphan is inert.

independence: two requests to the same host share one resolution but are separate races under separate ids; completing one never touches the other's attempts. scale: admitting and completing many requests returns the Waiter_map and the per-request maps to empty. Waiter_map: register hands out fresh, non-colliding ids that all resolve back to their value, and find_and_remove returns the map to empty. progress: an unresolved request and a stuck connect are each abandoned by the timer alone.

Every fuzzer proves teeth: keeping a completed id in on_connected, dropping the whole host instead of the id, a find_and_remove that forgets to remove, a register that reuses its id, and disabling either timeout terminal each make the matching fuzzer fail; all restored before commit. No bug in the core -- the maps drain to their empty baseline, validated at N = 1_000_000 (4.4s); CI keeps N small.

The four mutable fields of the adapter -- the pure core cell, the
waiter and cancel maps, and the injectable resolver -- are
read-modify-written from three fiber classes: the timer fiber, the
forked action fibers and the caller fibers. They are safe today only
because no transition straddles a suspension point; a yield introduced
later inside one (an instrumented resolver, an async core call) would
silently lose updates, dropping waiters or rewinding the state
machine. Follow the bluetooth adapter's shape: one mutex owns the four
fields, every pure core/map transition runs under it, and resolver
calls, socket connects and promise resolutions stay outside.

Registering a waiter and admitting its connection into the core is now
one atomic transition, and the empty-list caller errors raise before
the critical section so they cannot poison the lock; the new test pins
that a rejected connect_ip leaves the instance usable.

Drop the private to_eio_ip and the inline of_octets for Eio_addr.

Add the copyright header the fork inherited -- the upstream holder(s) from
LICENSE.md and the matching SPDX identifier -- to every source file that
lacked one, so the attribution is per-file, not only at the package level.
Machine-generated code (EverParse C) is left untouched.