fix: calibrate startup pacing and join canceled sync stores

[rldyourmnd]

BBRv3 application-limited startup retained pacing derived from a placeholder 1ms RTT. Calibrate its first pacing rate from the first actual packet timing sample; deterministic engine regressions fail before the fix and pass afterward. Preserve congestion windows, gains, loss model and existing transport policy.

The controlled three-baseline/three-fixed cohort retains every 601-probe result and documents ordered control-stream recovery in one worst sample. Aggregate distributions overlap, so this does not establish an end-user latency improvement or close the original CI tail failure. Passive impairment/tick diagnostics expose scheduler contributions without changing the workload or 400ms limit. The independent rate calibration now defaults to 4MiB because the former 32MiB/10Mbps payload was physically impossible inside its 15-second budget; ordinary transfers retain 32MiB.

PR qualification exposed a separate receive-store cancellation race: a terminal control branch could return while a detached running journal worker retained the destination lock. Keep that writer in the parent receive owner, stop and join it before exposing completion, and preserve the primary transfer error if bounded cleanup cannot complete. A deterministic held-worker regression verifies that the lock cannot be reopened until actual work ends and can then be reopened immediately.

Validation: complete vendored protocol suite (433 tests), registered C1 recovery qualification (1,265 passed executions), registered W1 supervision qualification (1,084 passed executions, zero failures, 400 journal samples and 29 intact receipts), strict targeted/workspace Clippy and Linux/macOS PR CI at 04ce32d. Failed calibration, original latency, Ubuntu cancellation and local stale-CMake attempts remain documented; the CMake repair only regenerated the preserved Cargo-local output tree. Reports, source provenance and owning contracts are included. Runtime fleet convergence and physical power-loss/latency acceptance remain separate deployment gates.