[nick2781]

Redis TLS already has protocol-peer regressions, but the public plugin lacked opt-in acceptance against a real TLS-enabled Redis service.

Extend the permanent C++ DSO runner with authenticated command/pipeline, unrelated-CA rejection and hostname-mismatch modes. Preserve owning native results and errors, owner-thread coroutine completion and natural managed-task drain. Add bilingual reproduction instructions and update the service acceptance record and roadmap.

Validation:

• Each of the three modes passed once against an isolated, password-protected Redis 7.4.2 TLS-only instance, using the real plugin DSO and exact CI arknet dependency pin.
• Server PING/ECHO counters corroborated the positive operations and remained unchanged during both rejection windows. This is limited counter evidence, not a claim that no RESP command reached the server.
• The owned Redis process was stopped and independently confirmed absent; private data, credentials and keys were removed.
• Database regressions, formatting, Nimbus and affected article/Markdown checks passed.

Real services remain opt-in; CI compiles these modes without starting a shared service. This does not establish mutual TLS, certificate rotation, TLS fault recovery, physical DSO unmapping or deployment capacity. Raw evidence stays local.