- src/client_accept.rs: the assembly-mutable acceptor registry
(per-type fixed slots under `tunnel`; refuse-never-replace install;
payload = the `TunnelChannel` duplex + the open's echo/originator
fields — the harness `ForwardedAcceptor` vocabulary grown), the
reverse-listen rows (bound-port surfaced; the listen/cancel forms;
the runtime-Unix gate at the listen), and the accepted-opens'
spawned handoff tasks.
- src/client_handler.rs: the `forwarded-tcpip` /
`forwarded-streamlocal` hooks route through the registry at
arrival time — registered + admitted → accept + handoff;
unregistered/unfeatured/cap-exhausted → the clean
`AdministrativelyProhibited` decline (never accept-and-drop);
pre-install arrivals decline, never buffered.
- src/client.rs: the dial wires the empty registry into the handler
+ the connection (`SshConnection::acceptors`, the late-install
accessor) + the listener budget's dedicated counter.
- src/error.rs: `OpError::NoAcceptor` / `ListenRefused` /
`ListenCapExceeded`; `RequestDenied` → `ListenRefused` (the
listen/cancel forms' wire decline class; the port-0 mint rides
alone at this pin — an explicit port's bound *is* the requested
one, surfaced).
- tests/common/sshd_double.rs: the fake `sshd`'s `-R` half — the
listen/cancel hooks bind real sockets (the out-param mint is the
real bound port), the accept loops open the server-initiated
forwarded channels + pump per accepted connection, cancels match
by the raw wire strings and tear the listener down.
- tests/client_reverse_listen.rs: the contract rows (listen + data
leg, the mint, the pre-wire gates, the declines, late-install
on/off, the cancels, the ceiling, the unix twins).
- tests/tunnel_mapping.rs: the full-circle client ↔ server-direction
smoke (both `-R` legs through the alkcall fabric double); real-
`sshd` `-R` stays wave-5 e2e (recorded).
- client.md: the acceptor's landing record (shape, cap relation,
gates, unix-gate placement, port-0 parity).
- fix(w4-op-rows, test cfg): the test mod's `family_exit_code`
import gated to the exit-consuming builds (`--features tunnel`
did not compile its tests before).
Verification: cargo test (default / each feature / --all-features)
green; cargo clippy --all-targets -- -D warnings (none +
--all-features) clean; cargo fmt --check clean; cargo doc --no-deps
clean (default build; all-features carries only the pre-existing
client_ops private-link warnings).
glm-5.3-flash
7e5989f574