[teamleaderleo]

Flake fix for a red seen in full cargo test -p acpmux --lib runs: linux_sandbox::proxy::tests::allowed_but_unreachable_returns_502 failed at proxy.rs:546 (reply not 502) once in 20 runs. The tree was base plus a test-only change elsewhere. Never blocked.

The cause

The test binds a listener, drops it, and expects the proxy's connect to that port to be refused. A process another test is spawning holds a copy of the listener from its fork until its exec. A forked test child that never execs holds it for its whole life. The socket keeps listening until that copy closes, so the connect succeeded and the proxy did not answer 502. This is the same listener-copy problem as #27423 and #27434.

Reproduced deterministically: with a copy of the listener held across the drop, as a spawned child does, the old test fails 5 of 5 (run).

The fix

Test only. The test now keeps a socket that is bound and never listens. Connects to it are refused whatever copies exist, and no other test can take its port while it is held. The assertion is unchanged: the proxy answers 502 for an allowed but unreachable target.

Evidence (Linux, cmux-ci test, 32 vCPU)

run	tree	result
5x the old test, with a held copy of the listener	base 13531e3	failed 5/5 (run)
10x linux_sandbox::proxy tests, 8 threads spawning and parking 5 ms between fork and exec	this head	passed 10/10 (run)
20x full cargo test -p acpmux --lib	this head	this test passed 20/20 (run)
cargo clippy -p acpmux --all-targets -- -D warnings, cargo fmt --check	this head	clean (clippy, fmt)

Other reds in the 20x run come from causes already fixed on feat-cmux-next since this branch was cut: the protocol IR (#27438), the consent flock (#27435), ETXTBSY (#27441) and the WireGuard rebind (#27434).

Risk: low, test-only, one test.

Agent session: agent session

🤖 Generated with Claude Code

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review b0fd0da: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr27447 -f ref=fix/acpmux-proxy-unreachable-flake -f platform=macos -f backend_mode=local

red: cmux-next checks (god files, concurrency, crash safety, l10n); NEW: green on the base 5f448b1; do not merge until green; see lane-rules

[teamleaderleo]

Owned by an agent session · session

[blacksmith-sh]

Found 8 test failures on Blacksmith runners:

Failures

Test	View Logs
/tmp/tmp2rnwvg2q/summary-missing.json (live):/summary-missing.json (live):	View Logs
/tmp/tmpljenwltb/summary-fail.json (live):/summary-fail.json (live):	View Logs
[new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows/ [new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows	View Logs
[new_workspaces] the window draws no frames/[new_workspaces] the window draws no frames	View Logs
[tabs] debug.tab_switch timed 0 of 40 switches/ [tabs] debug.tab_switch timed 0 of 40 switches	View Logs
[tabs] the window draws no frames/[tabs] the window draws no frames	View Logs
test_live_raw_v12_layout_and_history_contracts_are_exact (test_ir.IrTests.test_live_raw _v12_layout_and_history_contracts_are_exact) (command='new-pane-right')/ test_live_raw_v12_layout_and_history_contracts_are_exact (test_ir.IrTests.test_live_raw _v12_layout_and_history_contracts_are_exact) (command='new-pane-right')	View Logs
test_live_raw_v12_layout_and_history_contracts_are_exact (test_ir.IrTests.test_live_raw _v12_layout_and_history_contracts_are_exact) (command='new-pane-right')/ test_live_raw_v12_layout_and_history_contracts_are_exact (test_ir.IrTests.test_live_raw _v12_layout_and_history_contracts_are_exact) (command='new-pane-right')	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Bead cx-tniznm created for this PR by the cmux coordinator.

[teamleaderleo]

Review (gpt-6-astra, high, fast; independent Codex reviewer): SHIP at b0fd0da

No correctness blockers:

• Linux refuses connections to a bound TCP socket that is not listening, with RST/ECONNREFUSED, and forked copies keep it not listening.
• TcpSocket::new_v4() leaves address reuse off, so no other test can bind that endpoint, and ephemeral binds cannot take it.
• A refused connect to a permitted address still takes the proxy's 502 path.
• The 502 assertion is unchanged, and no clippy issue is introduced.

Reds at this head, all base reds that fail the same way on feat-cmux-next, none this PR's:

• cmux-tui SDKs / protocol contract and cmux-tui spec inventory / inventory: test_ir test_live_raw_v12_layout_and_history_contracts_are_exact, command new-pane-right.
• cmux-next checks: No new SwiftUI.

[github-actions]

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4090194435201 (7d713b7de1)
• cmux NEXT nightly 1.0.0-nightly.4090568854201 (8232b611fe)

[github-actions]

The feat-cmux-next push run https://github.com/manaflow-ai/cmux/actions/runs/40895243022 at 25e72b6 failed: cmux-next checks (god files, concurrency, crash safety, l10n).
Those jobs last passed at 72902c8. This pull request is one of 5 merged since: #27429, #27443, #26969, #27447, #27192.
If the failure is in your change, fix forward on feat-cmux-next. Pull requests run only the tiers their paths reach (docs/ci/cmux-next-tiers.md); label a batch PR full-ci to run them all before merging.