Function pipe_control_passthrough 

async fn pipe_control_passthrough(
    recv: PeekedRecv,
    send: SendStream,
    side: ProxySide,
    key: StreamKey,
    requests: Receiver<StreamCommand>,
    ctx: &ForwardCtx,
) -> Result<(), ProxyError>

Forward-first control stream pipe.

Bytes are forwarded to the peer the instant they arrive; the parser runs on a cloned copy purely to drive observer events. No hook can rewrite frames on this path because the bytes are already in flight.

What it tracks even with nothing observing

Two things, and each only because nothing else on this path could.

A ControlFrameWalker, which counts message lengths so a control-plane injection can be placed between two messages rather than inside one. It decodes no message, buffers no message and allocates nothing — one varint read per message and a running byte count — so the “pure byte pump” claim survives it in every sense a counter can see. It is not a ControlStreamParser and does not touch control_parsers_created.

And the SETUP peek that settles the session’s draft, on the moq-00 cohort where the ALPN does not. It is deliberately not behind observer_enabled: the draft is what the object framer frames with, what a datagram header decodes as, what the walker above measures with, and what the capability table each hook site is shown answers for. A session carrying a shaping profile with no observer and no interests needs every one of those and would, behind that gate, have detected nothing at all — so the profile would have been judged against the guess, armed against the guess, and reported success. The peek costs one varint read per chunk until it answers, and it answers on the chunk carrying the first SETUP.