[hatoo]

The client advertises zero server bidirectional streams and three server unidirectional streams for HTTP/3, but STREAM and RESET_STREAM previously accepted IDs outside those limits. Retain the advertised uni count and reject the direction/index before lookup, registration, payload buffering or receive accounting, returning transport STREAM_LIMIT_ERROR (4). Sparse IDs and RESET-first streams obey the same cumulative limit; client response streams keep their existing path.

Eight new Rust regressions cover count boundaries, maximum IDs, gaps, reordering, duplicates, RESET-first delivery and authentication. Nine new aioquic cases run in required CI and verify the encrypted close code plus exact request/error/status/latency accounting. The baseline fails the new limit assertions.

Validation: 543 unit and 63 integration tests pass in both debug and release (two inherited ignored); strict all-target Clippy and formatting pass. All 21 receive-limit, 41 status and 12 send-accounting aioquic cases pass.

The actual-source allocation probe reduces invalid 64 KiB STREAM handling from 66,048 allocated bytes to one 64-byte error allocation, with zero peer entries or payload storage. Invalid RESET drops from 512 to 64 bytes. Valid controls allocate identically; Connection grows by eight bytes. These are component measurements, not a throughput claim.

Fixed-hfast guards completed 27,131,904 successful requests with zero unexpected errors across three alternating and three reversed-order pairs. Median serial RPS changed -0.241%/+0.025%; multiplexed RPS -1.812%/+0.216%, client CPU/request +2.703%/0.000%, and p99.9 +5.874%/+8.675%. WSL uncertainty and observed tail costs are documented in benchmarks/quic-stream-limits.md. This PR repairs correctness/resource bounds; it claims neither an ordinary speedup nor performance equivalence.