diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md
index 8e62792..e660239 100644
--- a/.claude/CLAUDE.md
+++ b/.claude/CLAUDE.md
@@ -10,7 +10,7 @@ federated control between mesh participants.
 
 `context/interfaces/` contains one interface contract per Rust source file. Map
 source paths mechanically: `src/foo.rs` -> `context/interfaces/src/foo.md`, and
-`src/foo/bar.rs` -> `context/interfaces/src/foo/bar.md`.
+`src/foo/mod.rs` -> `context/interfaces/src/foo/mod.md`.
 
 - Read only the per-module interface docs relevant to the task.
 - Update the relevant `context/interfaces/**/*.md` file when public API,
diff --git a/context/interfaces/src/dsl.md b/context/interfaces/src/dsl/mod.md
similarity index 98%
rename from context/interfaces/src/dsl.md
rename to context/interfaces/src/dsl/mod.md
index 5611d88..6ef2c09 100644
--- a/context/interfaces/src/dsl.md
+++ b/context/interfaces/src/dsl/mod.md
@@ -1,4 +1,4 @@
-# `src/dsl.rs`
+# `src/dsl/mod.rs`
 
 
 ## Responsible for
diff --git a/context/interfaces/src/endor.md b/context/interfaces/src/endor/mod.md
similarity index 87%
rename from context/interfaces/src/endor.md
rename to context/interfaces/src/endor/mod.md
index c9d6065..d87dbf3 100644
--- a/context/interfaces/src/endor.md
+++ b/context/interfaces/src/endor/mod.md
@@ -1,4 +1,4 @@
-# `src/endor.rs`
+# `src/endor/mod.rs`
 
 
 ## Responsible for
diff --git a/context/interfaces/src/gossip.md b/context/interfaces/src/gossip/mod.md
similarity index 98%
rename from context/interfaces/src/gossip.md
rename to context/interfaces/src/gossip/mod.md
index c1b2a98..5ae3d10 100644
--- a/context/interfaces/src/gossip.md
+++ b/context/interfaces/src/gossip/mod.md
@@ -1,4 +1,4 @@
-# `src/gossip.rs`
+# `src/gossip/mod.rs`
 
 
 ## Responsible for
diff --git a/context/interfaces/src/modules/adhoc.md b/context/interfaces/src/modules/adhoc/mod.md
similarity index 98%
rename from context/interfaces/src/modules/adhoc.md
rename to context/interfaces/src/modules/adhoc/mod.md
index 719fd61..652d0df 100644
--- a/context/interfaces/src/modules/adhoc.md
+++ b/context/interfaces/src/modules/adhoc/mod.md
@@ -1,4 +1,4 @@
-# `src/modules/adhoc.rs`
+# `src/modules/adhoc/mod.rs`
 
 
 ## Responsible for
diff --git a/context/interfaces/src/modules.md b/context/interfaces/src/modules/mod.md
similarity index 82%
rename from context/interfaces/src/modules.md
rename to context/interfaces/src/modules/mod.md
index e1dd219..418c28f 100644
--- a/context/interfaces/src/modules.md
+++ b/context/interfaces/src/modules/mod.md
@@ -1,4 +1,4 @@
-# `src/modules.rs`
+# `src/modules/mod.rs`
 
 
 ## Responsible for
diff --git a/context/interfaces/src/proxy.md b/context/interfaces/src/proxy/mod.md
similarity index 96%
rename from context/interfaces/src/proxy.md
rename to context/interfaces/src/proxy/mod.md
index bfc9815..2958fcd 100644
--- a/context/interfaces/src/proxy.md
+++ b/context/interfaces/src/proxy/mod.md
@@ -1,4 +1,4 @@
-# `src/proxy.rs`
+# `src/proxy/mod.rs`
 
 
 ## Responsible for
diff --git a/context/interfaces/src/revocation.md b/context/interfaces/src/revocation/mod.md
similarity index 97%
rename from context/interfaces/src/revocation.md
rename to context/interfaces/src/revocation/mod.md
index 6eab6a0..6c33b40 100644
--- a/context/interfaces/src/revocation.md
+++ b/context/interfaces/src/revocation/mod.md
@@ -1,4 +1,4 @@
-# `src/revocation.rs`
+# `src/revocation/mod.rs`
 
 
 ## Responsible for
diff --git a/context/interfaces/src/state.md b/context/interfaces/src/state/mod.md
similarity index 99%
rename from context/interfaces/src/state.md
rename to context/interfaces/src/state/mod.md
index 28311e0..048554c 100644
--- a/context/interfaces/src/state.md
+++ b/context/interfaces/src/state/mod.md
@@ -1,4 +1,4 @@
-# `src/state.rs`
+# `src/state/mod.rs`
 
 
 ## Responsible for
diff --git a/src/dsl.rs b/src/dsl/mod.rs
similarity index 100%
rename from src/dsl.rs
rename to src/dsl/mod.rs
diff --git a/src/endor.rs b/src/endor/mod.rs
similarity index 100%
rename from src/endor.rs
rename to src/endor/mod.rs
diff --git a/src/gossip.rs b/src/gossip/mod.rs
similarity index 100%
rename from src/gossip.rs
rename to src/gossip/mod.rs
diff --git a/src/modules/adhoc.rs b/src/modules/adhoc/mod.rs
similarity index 100%
rename from src/modules/adhoc.rs
rename to src/modules/adhoc/mod.rs
diff --git a/src/modules.rs b/src/modules/mod.rs
similarity index 100%
rename from src/modules.rs
rename to src/modules/mod.rs
diff --git a/src/proxy.rs b/src/proxy/mod.rs
similarity index 97%
rename from src/proxy.rs
rename to src/proxy/mod.rs
index 9a4950c..8fb21c9 100644
--- a/src/proxy.rs
+++ b/src/proxy/mod.rs
@@ -101,7 +101,7 @@ impl Handle {
         defer!(nftables_clean());
 
         // DNS handler
-        tokio::spawn({
+        let dns_handle = tokio::spawn({
             let cancel = cancel.clone();
             let proxy = self.clone();
             async move {
@@ -110,7 +110,7 @@ impl Handle {
         });
 
         // Local acceptor
-        tokio::spawn({
+        let local_handle = tokio::spawn({
             let cancel = cancel.clone();
             let proxy = self.clone();
             async move {
@@ -119,7 +119,12 @@ impl Handle {
         });
 
         // External acceptor for incoming mTLS from remote peers
-        self.run_external_acceptor(ext_sock, cancel).await;
+        self.run_external_acceptor(ext_sock, cancel.clone()).await;
+
+        // Cancel spawned tasks and join them before returning, so that
+        // nftables_clean() only fires after all handlers have stopped.
+        cancel.cancel();
+        let _ = tokio::join!(dns_handle, local_handle);
         Ok(())
     }
 
diff --git a/src/revocation.rs b/src/revocation/mod.rs
similarity index 100%
rename from src/revocation.rs
rename to src/revocation/mod.rs
diff --git a/src/state.rs b/src/state/mod.rs
similarity index 100%
rename from src/state.rs
rename to src/state/mod.rs
diff --git a/src/trust_engine_bench.rs b/src/trust_engine_bench/mod.rs
similarity index 100%
rename from src/trust_engine_bench.rs
rename to src/trust_engine_bench/mod.rs