glm-5.3-flash
cb4d58a2bf
POC #5 run 2026-09-15 (alksocks-bind-poc, standalone, 9 tests) — OQ-SK-08 POC-validated; the POC register (OQ-SK-07) is closed. - The BIND phase model extends end to end on one channel: request → reply#1 (BND.ADDR) → quiet wait → one inbound accept → reply#2 (peer) → pump_bidi pass-through (0 B overhead, like CONNECT) - Both accept variants implemented: local (real TcpListener, faithful RFC) + composed (alktunnels listen-tunnel — per-listener ACL for free, hub-relayable) - The address-first-vs-accept-first deadlock resolved in shape: reply#1 first, the tunnel open rides the accept future - The socks5:bind scope gate distinguishes ingress from egress (RFC-faithful ConnectionNotAllowed refusal; CONNECT unaffected) - Vanilla front door re-validated for the BIND conversation (raw pipe, zero translation); CONNECT + ASSOCIATE regression-guarded on the same registration — the RFC 1928 command surface is complete - fast-socks5: zero BIND ask (typestate-driven; reply_success carries reply#1); courtesy ask: publish the private new_reply encoder - alktunnels ask ledger pinned at two items for the one-version bump: (1) listen-addr inspection without consuming an accept, (2) accepted handles carrying peer metadata — both POC-evidenced, both additive Verification: cargo test (9/9), clippy --all-targets -D warnings, fmt --check clean in alksocks-bind-poc.