[Factory Experiment] fix(proxy): join spawned tasks before cleanup to prevent orphaning

.claude/CLAUDE.md

@@ -10,7 +10,7 @@ federated control between mesh participants.
 
 `context/interfaces/` contains one interface contract per Rust source file. Map
 source paths mechanically: `src/foo.rs` -> `context/interfaces/src/foo.md`, and
-`src/foo/bar.rs` -> `context/interfaces/src/foo/bar.md`.
+`src/foo/mod.rs` -> `context/interfaces/src/foo/mod.md`.
 
 - Read only the per-module interface docs relevant to the task.
 - Update the relevant `context/interfaces/**/*.md` file when public API,

context/interfaces/src/dsl.md → context/interfaces/src/dsl/mod.md

@@ -1,4 +1,4 @@
-# `src/dsl.rs`
+# `src/dsl/mod.rs`
 
 
 ## Responsible for

context/interfaces/src/endor.md → context/interfaces/src/endor/mod.md

@@ -1,4 +1,4 @@
-# `src/endor.rs`
+# `src/endor/mod.rs`
 
 
 ## Responsible for

context/interfaces/src/gossip.md → context/interfaces/src/gossip/mod.md

@@ -1,4 +1,4 @@
-# `src/gossip.rs`
+# `src/gossip/mod.rs`
 
 
 ## Responsible for

context/interfaces/src/modules/adhoc.md → context/interfaces/src/modules/adhoc/mod.md

@@ -1,4 +1,4 @@
-# `src/modules/adhoc.rs`
+# `src/modules/adhoc/mod.rs`
 
 
 ## Responsible for

context/interfaces/src/modules.md → context/interfaces/src/modules/mod.md

@@ -1,4 +1,4 @@
-# `src/modules.rs`
+# `src/modules/mod.rs`
 
 
 ## Responsible for

context/interfaces/src/proxy.md → context/interfaces/src/proxy/mod.md

@@ -1,4 +1,4 @@
-# `src/proxy.rs`
+# `src/proxy/mod.rs`
 
 
 ## Responsible for

context/interfaces/src/revocation.md → context/interfaces/src/revocation/mod.md

@@ -1,4 +1,4 @@
-# `src/revocation.rs`
+# `src/revocation/mod.rs`
 
 
 ## Responsible for

context/interfaces/src/state.md → context/interfaces/src/state/mod.md

@@ -1,4 +1,4 @@
-# `src/state.rs`
+# `src/state/mod.rs`
 
 
 ## Responsible for

src/proxy.rs → src/proxy/mod.rs

@@ -101,7 +101,7 @@ impl Handle {
         defer!(nftables_clean());
 
         // DNS handler
-        tokio::spawn({
+        let dns_handle = tokio::spawn({
             let cancel = cancel.clone();
             let proxy = self.clone();
             async move {
@@ -110,7 +110,7 @@ impl Handle {
         });
 
         // Local acceptor
-        tokio::spawn({
+        let local_handle = tokio::spawn({
             let cancel = cancel.clone();
             let proxy = self.clone();
             async move {
@@ -119,7 +119,12 @@ impl Handle {
         });
 
         // External acceptor for incoming mTLS from remote peers
-        self.run_external_acceptor(ext_sock, cancel).await;
+        self.run_external_acceptor(ext_sock, cancel.clone()).await;
+
+        // Cancel spawned tasks and join them before returning, so that
+        // nftables_clean() only fires after all handlers have stopped.
+        cancel.cancel();
+        let _ = tokio::join!(dns_handle, local_handle);
         Ok(())
     }