Bound each observed remote IP to eight connections, sixteen control streams, eight bulk transfers, and one Stream Install provider. Drop-owned leases release on normal completion or unwind, and per-origin saturation cannot consume another resource class. Test Plan: - just test - focused port rotation, distinct-origin, drop/unwind, class isolation, and provider saturation tests - git diff --check