- ProducerDoor (feature local, src/local/producer_door.rs): a real
TcpListener accept loop handing each accepted connection to the
landed Socks5Producer::serve_socks5_over — the NoAuth in-stream RFC
conversation with the local seam providers dialing/egressing/accepting;
no new protocol-layer code.
- The accept path owns ADR-014's two knobs: the idle-first-byte peek
(non-consuming) and the max-concurrent-sessions cap (try_acquire —
an accept beyond the bound is refused door-side).
- ProducerDoorGuard: the listener's lifetime is the caller's — graceful
close() awaits the loop's end; Drop aborts best-effort (the
alktunnels TunnelListener teardown posture). In-flight sessions are
never force-closed.
- Per-connection failures are logged + isolated (the loop continues).
- The BIND gate on this path is the builder's bind_policy (no open-op
identity here; the pump handler's identity-derived gate does not
apply) — pinned by the 0x02-refusal test.
- tests/local-backend-producer.rs (9): vanilla CONNECT round-trip on
real sockets, faithful-RFC BIND (real reply#1/reply#2 addresses),
UDP ASSOCIATE through the real egress, domain resolution at the
seam, idle timeout, session cap, failure isolation, bind_policy(false).
Verification: cargo test + --all-features green; clippy clean (default,
all-features, wasm32 targets); cargo fmt --check clean; wasm checks
green (backend is local-gated).
glm-5.3-flash
29569d9afd