#32423 fix(next): the remote-localhost proxy's trust scan runs one at a time off the cooperative pool

What

The remote-localhost proxy decides whether a connection on a machine's listener comes from this app or one of its Chromium helpers by scanning the process table: proc_pidinfo(PROC_PIDLISTFDS) plus one proc_pidfdinfo per socket of the app and of every child. That scan ran as plain blocking code inside the connection's task, once per connection, with up to 256 connections allowed. A busy app with thousands of fds, plus a local process opening connections to the listener port, could hold cooperative-pool threads in those calls and stall unrelated async work.

PeerScan (owned by the proxy) now runs the scan on its own serial queue: one scan at a time, none on the cooperative pool. At most 32 scans are queued or running; past that a caller is untrusted at once. The queue's label is listed in plans/cmux-next/threading-model.md with an owner row. The connection awaits it. The trust decision and its order against the credential check are unchanged.

Tests

PeerProcessScanTests (6 tests): scans never overlap (peak 1 across 32 callers), a canary task on the cooperative pool finishes while 64 scans are pending, a stalled scan does not hold the callers behind it (they answer false at the timeout and their scans are skipped), a cancelled caller answers at once and its scan is skipped, callers past the pending limit answer at once, and a peer that is not this process is not trusted.

No capture: no visible change; the check's result is the same.

Risk

Small, in CmuxNextRemoteLocalhost. A connection's trust check can now wait behind earlier scans (each a few milliseconds). The wait is bounded at 2 s and cancellation-aware: a timed-out or cancelled caller answers "not trusted" at once and its queued scan is skipped, so a stalled scan cannot hold connection slots. The 10 s head deadline stays armed through the wait. No new timer or observer: the queue is a single static serial queue with no loop.

🤖 Generated with Claude Code

Agent session: agent session

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes the remote-localhost proxy's trust scan so it no longer runs on the cooperative pool, where a flood of local connections could stall unrelated async work.

• Runs each scan on a dedicated serial queue, one at a time, with the proxy owning its PeerScan instance.
• Bounds the wait at 2 s and the pending scans at 32; a timed-out, cancelled, or refused caller answers "not trusted" at once and its queued scan is skipped, settled in one critical section so it cannot race the scan finishing.
• The trust decision and its order against the credential check are unchanged; the 10 s head deadline stays armed through the wait.
• Adds PeerProcessScanTests covering non-overlapping scans, cooperative-pool liveness, stalled-scan timeouts, cancellations, the pending limit, and untrusted peers.