GFW-Knocker client running but SOCKS5 port never opens (QUIC connection fails)

[zitanix-max]

Environment
paqctl version: v1.0.0
Backend: gfw-knocker
Client: Iran VPS (Ubuntu)
Server: Turkey VPS (Ubuntu)
Configuration

Client status:

Backend: gfw-knocker
Role: client
Server IP: 37.221.x.x
VIO port: 45000
QUIC port: 25000
Mappings: 14000:443
Proxy: SOCKS5 127.0.0.1:14000
Problem

The service starts successfully and health check reports that GFW-Knocker is running, but the SOCKS5 port is never created:

✗ SOCKS5 port 14000 not listening

Checking locally:

ss -lntp | grep 14000

returns no output.

Logs

Client logs repeatedly show:

Attempting to connect to QUIC server...
Quic FAILED to connect
QUIC connection lost. exit
client is dead. restarting ...
Server-side verification

QUIC UDP port is listening:

ss -lunp | grep 25000

Output:

UNCONN 0 0 0.0.0.0:25000 0.0.0.0:* users:(("python",pid=25220,fd=6))
Questions
What conditions must be met before the local SOCKS5 port (14000) is created?
Does Quic FAILED to connect usually indicate:
certificate mismatch?
key mismatch?
VIO port configuration issue?
firewall/network issue?
Is there a debug mode that provides more detailed QUIC handshake errors?
Are there additional server-side ports that must be listening besides UDP 25000 and VIO 45000?

Any guidance on how to troubleshoot the failed QUIC handshake would be appreciated.