A TCP stream proxy still passes traffic and client IP allowlists fail

Connections survive, yet source identity parsing breaks because the sender and receiver no longer agree on protocol version.