From 6aea8a35b5f86d281404e93078c6920fd0d613c8 Mon Sep 17 00:00:00 2001
From: MemRelay <memrelay@gmail.com>
Date: Wed, 30 Sep 2026 15:09:07 +0800
Subject: [PATCH] create: Checkpoint 2026-09-30 07:08:58 UTC [51a2506ee5]

MemRelay-Operation: checkpoint-save:chk-listener-l01-l07-20260930
MemRelay-Resource: a04c8be3-9dd8-4e67-9211-269093d351bc
---
 ...nt 2026-09-30 07-08-58 UTC [51a2506ee5].md | 48 +++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100644 projects/25464650-ed5d-440e-b362-190f2852d451/Checkpoint 2026-09-30 07-08-58 UTC [51a2506ee5].md

diff --git a/projects/25464650-ed5d-440e-b362-190f2852d451/Checkpoint 2026-09-30 07-08-58 UTC [51a2506ee5].md b/projects/25464650-ed5d-440e-b362-190f2852d451/Checkpoint 2026-09-30 07-08-58 UTC [51a2506ee5].md
new file mode 100644
index 0000000..efbfa47
--- /dev/null
+++ b/projects/25464650-ed5d-440e-b362-190f2852d451/Checkpoint 2026-09-30 07-08-58 UTC [51a2506ee5].md	
@@ -0,0 +1,48 @@
+---
+title: Checkpoint 2026-09-30 07:08:58 UTC [51a2506ee5]
+type: checkpoint
+permalink: main/projects/25464650-ed5d-440e-b362-190f2852d451/checkpoint-2026-09-30-07-08-58-utc-51a2506ee5
+stable_id: a04c8be3-9dd8-4e67-9211-269093d351bc
+scope: project
+memory_type: checkpoint
+project_id: 25464650-ed5d-440e-b362-190f2852d451
+usage_profile_id: 0c9feb46-d06e-43cd-9ef0-c5813c84a998
+status: active
+revision: 1
+request_id: chk-listener-l01-l07-20260930
+created_at: '2026-09-30T07:09:01.355508+00:00'
+updated_at: '2026-09-30T07:09:01.355508+00:00'
+tags:
+- listener
+- review-fix
+---
+
+## 监听线复审修复 L-02/L-01/L-04–L-07 已完成并推送（未做 L-03，未 merge main）
+
+- **工作树**：`E:\code\NixMsg-wt\r2-l`
+- **分支**：`feat/fix-listener-l01-l07`（已普通推送到 origin，非 force）
+- **基于**：`origin/main` @ `4059a15`
+- **提交**：
+  - `67a33ba` fix: 修复监听 accept 退避与握手前超时上限（L-02 #21、L-01 #20）
+  - `9e3769f` fix: 修复 TLS ConnectionState、SPA 回退、健康检查与监听小问题（L-04 #23、L-05 #24、L-06 #25、L-07 #26）
+
+## 做了什么
+- L-02：accept 非 closed 错误 5ms–1s 退避重试
+- L-01：TLS 握手/CONNECT 预读 10s；剩余长度 >64KiB 关闭；HTTP IdleTimeout 120s、MaxHeaderBytes 64KiB；握手前信号量 1024；ws.go AttachWS 前读超时
+- L-04：`tlsBufferedConn.ConnectionState()`，明文不加该方法；不靠 SecureCookies 打补丁
+- L-05：`httpx.SPA`；`serve.go` 只改 `staticFileHandler`
+- L-06：配证书且关明文时 healthcheck 走 https + InsecureSkipVerify（仅 127.0.0.1 探测）；`deploy/config.docker.yaml` `allow_plaintext: false`
+- L-07：XFF 合并多行、无法解析则停；tls.Config 复用、证书检查 2 分钟；metrics SHA-256 + ConstantTimeCompare；serve 只 New 一次；WS 调 httpx.ClientIP
+
+## 未做
+- **L-03 (#22) 按指令未修**（停机怼装依赖 B-08/D-02/C-01）
+- 未 merge main；未加 HSTS；未设 SecureCookies；metrics 失败未计入 LockAdminIP；未加 embeddist Playwright e2e
+
+## 验证
+`go test ./internal/listener/ ./internal/httpx/ ./cmd/nixmsg/ -count=1` 全绿（listener ~11s，httpx、cmd/nixmsg 通过）。
+
+## 下一步
+总控审阅后 ff-merge；L-03 等 B-08/D-02/C-01。不要删 `E:\code\NixMsg-wt\fix3`。
+
+## 给下个会话
+复用工作树 `E:\code\NixMsg-wt\r2-l` 与分支 `feat/fix-listener-l01-l07`；不要在本分支做 L-03；serve.go 只动过 staticFileHandler 与 listener 装配段。
\ No newline at end of file