{"record":{"id":"992e7edc28523b75","repo":"gastownhall/beads","slug":"authenticated-proxy-data-port-d-is-not-accepting","errorCode":null,"errorMessage":"authenticated proxy data port %d is not accepting connections","messagePattern":"authenticated proxy data port (.+?) is not accepting connections","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"internal/storage/dbproxy/proxy/endpoint.go","lineNumber":640,"sourceCode":"\t\treply.RootID != pf.RootID ||\n\t\treply.PID != pf.Pid ||\n\t\treply.Birth != pf.Birth ||\n\t\treply.DataPort != pf.Port ||\n\t\treply.ControlPort != pf.ControlPort ||\n\t\treply.UpstreamID != pf.UpstreamID {\n\t\treturn adoptionResult{\n\t\t\tstatus:  adoptionIdentityMismatch,\n\t\t\tpidfile: pf,\n\t\t\terr:     errors.New(\"authenticated proxy identity does not match its pidfile or workspace\"),\n\t\t}\n\t}\n\n\tep := Endpoint{Host: \"127.0.0.1\", Port: pf.Port}\n\tif !probePort(ep, identityProbeTimeout) {\n\t\treturn adoptionResult{\n\t\t\tstatus:  adoptionIdentityMismatch,\n\t\t\tpidfile: pf,\n\t\t\terr:     fmt.Errorf(\"authenticated proxy data port %d is not accepting connections\", pf.Port),\n\t\t}\n\t}\n\treturn adoptionResult{status: adoptionAdopted, endpoint: ep, pidfile: pf}\n}\n\nfunc probePort(ep Endpoint, timeout time.Duration) bool {\n\tconn, err := net.DialTimeout(\"tcp\", ep.Address(), timeout)\n\tif err != nil {\n\t\treturn false\n\t}\n\t_ = conn.Close()\n\treturn true\n}\n\nfunc isMalformedPIDFileError(err error) bool {\n\tvar syntaxErr *json.SyntaxError\n\tvar typeErr *json.UnmarshalTypeError\n\treturn errors.As(err, &syntaxErr) || errors.As(err, &typeErr)","sourceCodeStart":622,"sourceCodeEnd":658,"githubUrl":"https://github.com/gastownhall/beads/blob/71377f276968b452ee607177637970a4ff888584/internal/storage/dbproxy/proxy/endpoint.go#L622-L658","documentation":"readAndDial raises this when the pidfile identity is fully authenticated (the proxy answered its authenticated control-port Identify handshake and all fields matched) but its recorded data port refuses TCP connections within identityProbeTimeout. The proxy is logically the right one but is not actually serving, so it is classified adoptionIdentityMismatch rather than adopted.","triggerScenarios":"After a successful identity.Identify on the control port, probePort({127.0.0.1, pf.Port}) fails — net.DialTimeout cannot connect to the proxy's data port within the probe timeout.","commonSituations":"Proxy is mid-shutdown (control handler alive, listener already closed); firewall/VPN blocking the data port but not the control port; port hijacked by another process that answered control? — no, here control matched so most likely the data listener just closed or is momentarily saturated; very short timeouts under heavy load.","solutions":["Retry after a moment — a proxy in graceful shutdown will be replaced by a fresh spawn on the next bd command","Verify the data port is bound: ss -ltnp | grep <port> or netstat -ano on Windows","Check local firewall/VPN rules for loopback TCP on that port","If persistent, kill the stale proxy process (pid from pidfile) and let bd quarantine the record and spawn a new proxy"],"exampleFix":"// before\nif !probePort(ep, identityProbeTimeout) {\n    return adoptionResult{status: adoptionIdentityMismatch, err: fmt.Errorf(\"authenticated proxy data port %d is not accepting connections\", pf.Port)}\n}\n// after (caller retries once before treating as mismatch)\nif !probePort(ep, identityProbeTimeout) {\n    time.Sleep(200 * time.Millisecond)\n    if !probePort(ep, identityProbeTimeout) {\n        return adoptionResult{status: adoptionIdentityMismatch, err: fmt.Errorf(\"authenticated proxy data port %d is not accepting connections\", pf.Port)}\n    }\n}","handlingStrategy":"retry","validationCode":"// before relying on an adopted endpoint\nep := Endpoint{Host: \"127.0.0.1\", Port: pf.Port}\nif !probePort(ep, 500*time.Millisecond) {\n    return errors.New(\"proxy data port not accepting; refusing to adopt\")\n}","typeGuard":null,"tryCatchPattern":"discovery := readAndDial(root)\nif discovery.status == adoptionIdentityMismatch {\n    if pe, ok := discovery.err.(*portProbeError); ok && pe.retryable() {\n        time.Sleep(250 * time.Millisecond)\n        discovery = readAndDial(root)\n    }\n}","preventionTips":["Keep proxy idle-exit windows in mind: a shutdown proxy answers control but drops the data listener","Don't block loopback TCP ports with VPN/firewall rules","Use a generous but bounded probe timeout on loaded machines","Kill a wedged proxy and let bd spawn a fresh one instead of retrying indefinitely"],"tags":["network","tcp","connection-refused","port"],"backgroundTag":"connection-refused","analyzedSha":"71377f276968b452ee607177637970a4ff888584","analyzedAt":"2026-08-30T18:55:39.744Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}