socketduct 0.1.15

package/test/integration/initial-target-recovery.test.js

@@ -0,0 +1,518 @@
+import assert from "node:assert/strict"
+import {createConnection, createServer} from "node:net"
+import test from "node:test"
+
+import {InMemoryUserStore, login, TokenStore} from "../../src/auth/user-store.js"
+import {connectSocketduct} from "../../src/client/socketduct-socket.js"
+import {encodeCompactData, encodeFrame, FrameDecoder} from "../../src/protocol/frame.js"
+import {startTcpRelay} from "../../src/proxy/tcp-relay.js"
+import {SessionStore} from "../../src/sessions/session.js"
+import {mkdtemp, rm} from "node:fs/promises"
+import {tmpdir} from "node:os"
+import {join} from "node:path"
+import {EventEmitter} from "node:events"
+
+/** @typedef {ReturnType<FrameDecoder["push"]>[number]} DecodedFrame */
+
+/**
+ * @param {import('node:net').Server} server - Server to bind.
+ * @param {number} [port] - Requested port.
+ * @returns {Promise<number>} Bound port.
+ */
+async function listen(server, port = 0) {
+  await new Promise((resolve, reject) => {
+    server.once("error", reject)
+    server.listen(port, "127.0.0.1", () => {
+      server.off("error", reject)
+      resolve(undefined)
+    })
+  })
+  const address = server.address()
+  if (address === null || typeof address === "string") throw new Error("server did not bind")
+  return address.port
+}
+
+/**
+ * @param {import('node:net').Server} server - Server to close.
+ * @returns {Promise<void>}
+ */
+async function closeServer(server) {
+  if (!server.listening) return
+  await new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve(undefined)))
+}
+
+/** @returns {Promise<number>} An unused loopback port. */
+async function reservePort() {
+  const server = createServer()
+  const port = await listen(server)
+  await closeServer(server)
+  return port
+}
+
+/**
+ * @param {() => boolean} predicate - Completion predicate.
+ * @param {number} [timeoutMs] - Maximum wait.
+ * @returns {Promise<void>}
+ */
+async function waitUntil(predicate, timeoutMs = 1_000) {
+  const deadline = Date.now() + timeoutMs
+  while (!predicate()) {
+    if (Date.now() >= deadline) throw new Error("timed out waiting for condition")
+    await new Promise((resolve) => setTimeout(resolve, 2))
+  }
+}
+
+/**
+ * @param {import('node:net').Socket} socket - Socket to await.
+ * @returns {Promise<void>}
+ */
+async function waitConnect(socket) {
+  await new Promise((resolve, reject) => {
+    socket.once("error", reject)
+    socket.once("connect", () => {
+      socket.off("error", reject)
+      resolve(undefined)
+    })
+  })
+}
+
+/**
+ * @param {import('node:net').Socket} socket - Socket to await.
+ * @returns {Promise<void>}
+ */
+async function waitClose(socket) {
+  if (socket.destroyed) return
+  await new Promise((resolve) => socket.once("close", resolve))
+}
+
+/** @returns {Promise<{sessions: SessionStore, token: import('../../src/auth/user-store.js').AuthToken, tokens: TokenStore}>} Authenticated stores. */
+async function authenticatedStores() {
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1_000, tokenTtlMs: 60_000})
+  await users.createUser({username: "retry-user", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "retry-user", password: "correct horse battery staple"})
+  return {sessions: new SessionStore({now: () => 1_000}), token, tokens}
+}
+
+/**
+ * @param {import('node:net').Socket} socket
+ * @param {FrameDecoder} decoder
+ * @returns {{frames: DecodedFrame[], waitFor: (predicate: (frame: DecodedFrame) => boolean) => Promise<DecodedFrame>}} Frame collector.
+ */
+function collectFrames(socket, decoder) {
+  /** @type {DecodedFrame[]} */
+  const frames = []
+  /** @type {Set<() => void>} */
+  const changes = new Set()
+  socket.on("data", (chunk) => {
+    frames.push(...decoder.push(chunk))
+    for (const change of changes) change()
+  })
+  return {
+    frames,
+    waitFor: async (predicate) => {
+      const deadline = Date.now() + 1_000
+      while (true) {
+        const frame = frames.find(predicate)
+        if (frame !== undefined) return frame
+        const remaining = deadline - Date.now()
+        if (remaining <= 0) throw new Error("timed out waiting for frame")
+        await new Promise((resolve, reject) => {
+          const changed = () => {
+            clearTimeout(timer)
+            changes.delete(changed)
+            resolve(undefined)
+          }
+          const timer = setTimeout(() => {
+            changes.delete(changed)
+            reject(new Error("timed out waiting for frame"))
+          }, remaining)
+          changes.add(changed)
+        })
+      }
+    }
+  }
+}
+
+class HangingTargetSocket extends EventEmitter {
+  constructor() {
+    super()
+    this.destroyed = false
+    this.destroyCount = 0
+  }
+
+  destroy() {
+    this.destroyed = true
+    this.destroyCount += 1
+    return this
+  }
+}
+
+test("authenticated create stays pending without an error and the same request succeeds when the target starts", async () => {
+  const targetPort = await reservePort()
+  const {sessions, token, tokens} = await authenticatedStores()
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    handshakeTimeoutMs: 10,
+    initialTargetRetryDelayMs: 30,
+    initialTargetRetryMaxDelayMs: 30,
+    sessions,
+    tokens
+  })
+  const tunnel = createConnection({host: "127.0.0.1", port: relay.port})
+  const collector = collectFrames(tunnel, new FrameDecoder({compactDirection: "target-to-client"}))
+  const targetServer = createServer((socket) => socket.on("data", (chunk) => socket.write(chunk)))
+  try {
+    await waitConnect(tunnel)
+    tunnel.write(encodeFrame({
+      type: "session.create", token: token.value, name: "pending-create", identifier: "pending-create",
+      target: {host: "127.0.0.1", port: targetPort}, framing: [2]
+    }))
+
+    await waitUntil(() => sessions.get("pending-create") !== undefined)
+    assert.equal(sessions.get("pending-create")?.state, "creating")
+    await waitUntil(() => relay.status().targetRetryTimers === 1)
+    assert.equal(collector.frames.length, 0, "initial refusal must not announce or emit an error")
+
+    // Deliberately cross the shorter authentication deadline while a retry is pending.
+    await new Promise((resolve) => setTimeout(resolve, 15))
+    assert.equal(collector.frames.some((frame) => frame.header.code === "HANDSHAKE_TIMEOUT"), false)
+
+    await listen(targetServer, targetPort)
+    const created = await collector.waitFor((frame) => frame.header.type === "session.created")
+    assert.equal(created.header.identifier, "pending-create")
+    assert.equal(created.header.state, "active")
+    assert.equal(sessions.get("pending-create")?.state, "active")
+    assert.equal(collector.frames.filter((frame) => frame.header.type === "session.created").length, 1)
+  } finally {
+    tunnel.destroy()
+    await relay.close()
+    await closeServer(targetServer)
+  }
+})
+
+test("SocketductSocket does not deliver queued application bytes before readiness", async () => {
+  const targetPort = await reservePort()
+  const spoolDirectory = await mkdtemp(join(tmpdir(), "socketduct-initial-readiness-"))
+  const {sessions, token, tokens} = await authenticatedStores()
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    initialTargetRetryDelayMs: 10,
+    initialTargetRetryMaxDelayMs: 20,
+    sessions,
+    tokens
+  })
+  let clientConnected = false
+  let bytesBeforeConnect = 0
+  const targetServer = createServer((socket) => {
+    socket.on("data", (chunk) => {
+      if (!clientConnected) bytesBeforeConnect += chunk.length
+      socket.write(chunk)
+    })
+  })
+  const client = connectSocketduct({
+    relay: {host: "127.0.0.1", port: relay.port, token: token.value},
+    sessionName: "queued-before-ready",
+    spoolDirectory,
+    target: {host: "127.0.0.1", port: targetPort}
+  })
+  client.on("error", () => {})
+  client.once("connect", () => { clientConnected = true })
+  client.write("queued-application-bytes")
+  try {
+    await waitUntil(() => relay.status().targetRetryTimers === 1)
+    assert.equal(client.connecting, true)
+    assert.equal(bytesBeforeConnect, 0)
+    await listen(targetServer, targetPort)
+    const echoed = await new Promise((resolve, reject) => {
+      const timer = setTimeout(() => reject(new Error("timed out waiting for queued echo")), 1_000)
+      client.once("data", (chunk) => {
+        clearTimeout(timer)
+        resolve(chunk.toString("utf8"))
+      })
+    })
+    assert.equal(echoed, "queued-application-bytes")
+    assert.equal(bytesBeforeConnect, 0)
+  } finally {
+    client.destroy()
+    await relay.close()
+    await closeServer(targetServer)
+    await rm(spoolDirectory, {recursive: true, force: true})
+  }
+})
+
+test("relay rejects stream frames while an authenticated create is not ready", async () => {
+  const targetPort = await reservePort()
+  const {sessions, token, tokens} = await authenticatedStores()
+  const relay = await startTcpRelay({
+    authorizeTarget: () => true,
+    initialTargetRetryDelayMs: 50,
+    initialTargetRetryMaxDelayMs: 50,
+    sessions,
+    tokens
+  })
+  const tunnel = createConnection({host: "127.0.0.1", port: relay.port})
+  const collector = collectFrames(tunnel, new FrameDecoder({compactDirection: "target-to-client"}))
+  try {
+    await waitConnect(tunnel)
+    tunnel.write(encodeFrame({
+      type: "session.create", token: token.value, name: "premature-data", identifier: "premature-data",
+      target: {host: "127.0.0.1", port: targetPort}, framing: [2]
+    }))
+    await waitUntil(() => sessions.get("premature-data") !== undefined)
+    tunnel.write(encodeCompactData({sequence: 4, payload: Buffer.from("nope")}))
+    const violation = await collector.waitFor((frame) => frame.header.type === "error")
+    assert.equal(violation.header.code, "PROTOCOL_VIOLATION")
+    assert.equal(violation.header.retryable, false)
+    await waitUntil(() => sessions.get("premature-data") === undefined)
+  } finally {
+    tunnel.destroy()
+    await relay.close()
+  }
+})
+
+test("closing an unannounced tunnel deletes it and stale work cannot activate a reused identifier", async () => {
+  const targetPort = await reservePort()
+  const {sessions, token, tokens} = await authenticatedStores()
+  const relay = await startTcpRelay({
+    authorizeTarget: () => true,
+    initialTargetRetryDelayMs: 50,
+    initialTargetRetryMaxDelayMs: 50,
+    sessions,
+    tokens
+  })
+  const tunnel = createConnection({host: "127.0.0.1", port: relay.port})
+  let targetConnections = 0
+  const targetServer = createServer(() => { targetConnections += 1 })
+  await waitConnect(tunnel)
+  tunnel.write(encodeFrame({
+    type: "session.create", token: token.value, name: "cancel-pending", identifier: "cancel-pending",
+    target: {host: "127.0.0.1", port: targetPort}, framing: [2]
+  }))
+  await waitUntil(() => relay.status().targetRetryTimers === 1)
+  tunnel.destroy()
+  await waitClose(tunnel)
+  await waitUntil(() => relay.status().sessions === 0)
+  assert.equal(sessions.get("cancel-pending"), undefined)
+  assert.deepEqual(relay.status(), {
+    activeTunnels: 0, activeTargets: 0, sessions: 0, attachedSessions: 0,
+    detachedSessions: 0, bufferedTargetBytes: 0, targetConnectionAttempts: 0, targetRetryTimers: 0
+  })
+
+  const replacementTunnel = createConnection({host: "127.0.0.1", port: relay.port})
+  const replacementCollector = collectFrames(replacementTunnel, new FrameDecoder({compactDirection: "target-to-client"}))
+  try {
+    await listen(targetServer, targetPort)
+    await waitConnect(replacementTunnel)
+    replacementTunnel.write(encodeFrame({
+      type: "session.create", token: token.value, name: "replacement", identifier: "cancel-pending",
+      target: {host: "127.0.0.1", port: targetPort}, framing: [2]
+    }))
+    await replacementCollector.waitFor((frame) => frame.header.type === "session.created")
+    assert.equal(sessions.get("cancel-pending")?.state, "active")
+    assert.equal(targetConnections, 1)
+  } finally {
+    replacementTunnel.destroy()
+    await relay.close()
+    await closeServer(targetServer)
+  }
+})
+
+test("relay close cancels all pending target attempts, retry timers, and creating sessions", async () => {
+  const targetPort = await reservePort()
+  const {sessions, token, tokens} = await authenticatedStores()
+  const relay = await startTcpRelay({
+    authorizeTarget: () => true,
+    initialTargetRetryDelayMs: 100,
+    initialTargetRetryMaxDelayMs: 100,
+    sessions,
+    tokens
+  })
+  const tunnels = Array.from({length: 3}, (_, index) => {
+    const tunnel = createConnection({host: "127.0.0.1", port: relay.port})
+    tunnel.once("connect", () => tunnel.write(encodeFrame({
+      type: "session.create", token: token.value, name: `relay-close-${index}`, identifier: `relay-close-${index}`,
+      target: {host: "127.0.0.1", port: targetPort}, framing: [2]
+    })))
+    tunnel.on("error", () => {})
+    return tunnel
+  })
+  await waitUntil(() => relay.status().targetRetryTimers === tunnels.length)
+  await relay.close()
+  assert.equal(relay.status().targetRetryTimers, 0)
+  assert.equal(relay.status().targetConnectionAttempts, 0)
+  assert.equal(relay.status().sessions, 0)
+  for (let index = 0; index < tunnels.length; index += 1) {
+    assert.equal(sessions.get(`relay-close-${index}`), undefined)
+  }
+})
+
+test("target closure after announcement is terminal and never starts target recovery", async () => {
+  let targetConnections = 0
+  /** @type {import('node:net').Socket | undefined} */
+  let targetSocket
+  const targetServer = createServer((socket) => {
+    targetConnections += 1
+    targetSocket = socket
+    socket.on("error", () => {})
+  })
+  const targetPort = await listen(targetServer)
+  const {sessions, token, tokens} = await authenticatedStores()
+  const relay = await startTcpRelay({
+    authorizeTarget: () => true,
+    initialTargetRetryDelayMs: 10,
+    initialTargetRetryMaxDelayMs: 20,
+    sessions,
+    tokens
+  })
+  const tunnel = createConnection({host: "127.0.0.1", port: relay.port})
+  const collector = collectFrames(tunnel, new FrameDecoder({compactDirection: "target-to-client"}))
+  try {
+    await waitConnect(tunnel)
+    tunnel.write(encodeFrame({
+      type: "session.create", token: token.value, name: "terminal-target", identifier: "terminal-target",
+      target: {host: "127.0.0.1", port: targetPort}, framing: [2]
+    }))
+    await collector.waitFor((frame) => frame.header.type === "session.created")
+    assert.ok(targetSocket !== undefined)
+    targetSocket.destroy()
+    await collector.waitFor((frame) => frame.header.type === "session.close" || frame.header.code === "TARGET_CLOSED")
+    assert.equal(relay.status().targetRetryTimers, 0)
+    assert.equal(targetConnections, 1)
+    await new Promise((resolve) => setTimeout(resolve, 50))
+    assert.equal(targetConnections, 1, "an announced target must never reconnect")
+  } finally {
+    tunnel.destroy()
+    await relay.close()
+    await closeServer(targetServer)
+  }
+})
+
+test("repeated pending creates and aborts return to a zero-resource baseline", async () => {
+  const targetPort = await reservePort()
+  const {sessions, token, tokens} = await authenticatedStores()
+  const relay = await startTcpRelay({
+    authorizeTarget: () => true,
+    initialTargetRetryDelayMs: 20,
+    initialTargetRetryMaxDelayMs: 20,
+    sessions,
+    tokens
+  })
+  try {
+    for (let index = 0; index < 5; index += 1) {
+      const identifier = `bounded-pending-${index}`
+      const tunnel = createConnection({host: "127.0.0.1", port: relay.port})
+      tunnel.on("error", () => {})
+      await waitConnect(tunnel)
+      tunnel.write(encodeFrame({
+        type: "session.create", token: token.value, name: identifier, identifier,
+        target: {host: "127.0.0.1", port: targetPort}, framing: [2]
+      }))
+      await waitUntil(() => relay.status().targetRetryTimers === 1)
+      tunnel.destroy()
+      await waitClose(tunnel)
+      await waitUntil(() => relay.status().sessions === 0)
+      assert.equal(sessions.get(identifier), undefined)
+      assert.equal(relay.status().targetRetryTimers, 0)
+      assert.equal(relay.status().targetConnectionAttempts, 0)
+    }
+  } finally {
+    await relay.close()
+  }
+})
+
+test("a hanging initial target attempt times out, is destroyed, and enters normal backoff", async () => {
+  const {sessions, token, tokens} = await authenticatedStores()
+  /** @type {HangingTargetSocket[]} */
+  const attempts = []
+  const relay = await startTcpRelay({
+    authorizeTarget: () => true,
+    createTargetConnection: () => {
+      const attempt = new HangingTargetSocket()
+      attempts.push(attempt)
+      return /** @type {import('node:net').Socket} */ (/** @type {unknown} */ (attempt))
+    },
+    initialTargetConnectTimeoutMs: 10,
+    initialTargetRetryDelayMs: 10,
+    initialTargetRetryMaxDelayMs: 10,
+    sessions,
+    tokens
+  })
+  const tunnel = createConnection({host: "127.0.0.1", port: relay.port})
+  try {
+    await waitConnect(tunnel)
+    tunnel.write(encodeFrame({
+      type: "session.create", token: token.value, name: "hanging-target", identifier: "hanging-target",
+      target: {host: "fixed-target.invalid", port: 2375}, framing: [2]
+    }))
+    await waitUntil(() => attempts.length === 2)
+    assert.equal(attempts[0]?.destroyCount, 1)
+    assert.equal(attempts[0]?.listenerCount("connect"), 0)
+    assert.equal(attempts[0]?.listenerCount("error"), 0)
+    assert.equal(attempts[0]?.listenerCount("close"), 0)
+    assert.equal(relay.status().targetConnectionAttempts, 1)
+    assert.equal(sessions.get("hanging-target")?.state, "creating")
+
+    tunnel.destroy()
+    await relay.closeActiveTunnel()
+    await waitUntil(() => relay.status().sessions === 0)
+    assert.equal(attempts[1]?.destroyCount, 1)
+    assert.equal(attempts[1]?.listenerCount("connect"), 0)
+    assert.equal(attempts[1]?.listenerCount("error"), 0)
+    assert.equal(attempts[1]?.listenerCount("close"), 0)
+    assert.deepEqual(relay.status(), {
+      activeTunnels: 0, activeTargets: 0, sessions: 0, attachedSessions: 0,
+      detachedSessions: 0, bufferedTargetBytes: 0, targetConnectionAttempts: 0, targetRetryTimers: 0
+    })
+  } finally {
+    tunnel.destroy()
+    await relay.close()
+  }
+})
+
+test("relay validates the initial target connect timeout before opening resources", async () => {
+  const {sessions, tokens} = await authenticatedStores()
+  await assert.rejects(
+    () => startTcpRelay({
+      authorizeTarget: () => true,
+      initialTargetConnectTimeoutMs: 0,
+      sessions,
+      tokens
+    }),
+    /initialTargetConnectTimeoutMs must be a positive integer/
+  )
+})
+
+test("relay close cancels a hanging target attempt and its connect timeout", async () => {
+  const {sessions, token, tokens} = await authenticatedStores()
+  /** @type {HangingTargetSocket[]} */
+  const attempts = []
+  const relay = await startTcpRelay({
+    authorizeTarget: () => true,
+    createTargetConnection: () => {
+      const attempt = new HangingTargetSocket()
+      attempts.push(attempt)
+      return /** @type {import('node:net').Socket} */ (/** @type {unknown} */ (attempt))
+    },
+    initialTargetConnectTimeoutMs: 60_000,
+    sessions,
+    tokens
+  })
+  const tunnel = createConnection({host: "127.0.0.1", port: relay.port})
+  tunnel.on("error", () => {})
+  await waitConnect(tunnel)
+  tunnel.write(encodeFrame({
+    type: "session.create", token: token.value, name: "relay-close-hanging", identifier: "relay-close-hanging",
+    target: {host: "fixed-target.invalid", port: 2375}, framing: [2]
+  }))
+  await waitUntil(() => attempts.length === 1)
+
+  await relay.close()
+  assert.equal(attempts[0]?.destroyCount, 1)
+  assert.equal(attempts[0]?.listenerCount("connect"), 0)
+  assert.equal(attempts[0]?.listenerCount("error"), 0)
+  assert.equal(attempts[0]?.listenerCount("close"), 0)
+  assert.equal(relay.status().targetConnectionAttempts, 0)
+  assert.equal(relay.status().targetRetryTimers, 0)
+  assert.equal(relay.status().sessions, 0)
+})

package/test/integration/logging-recovery.test.js

@@ -0,0 +1,163 @@
+import {describe, expect, it, withTestCleanup} from "@velocious/testing"
+import {execFile} from "node:child_process"
+import {once} from "node:events"
+import {chmod, mkdtemp, readFile, readdir, rm, stat, writeFile} from "node:fs/promises"
+import {createServer} from "node:net"
+import {homedir, tmpdir} from "node:os"
+import {join} from "node:path"
+import {fileURLToPath} from "node:url"
+import {promisify} from "node:util"
+
+import {StaticTokenStore} from "../../src/auth/static-token-store.js"
+import {MultiplexedSocketductConnection} from "../../src/client/multiplexed-connection.js"
+import {createJsonlFileLogger} from "../../src/logging/structured-logger.js"
+import {startMultiplexedTcpRelay} from "../../src/proxy/multiplexed-relay.js"
+
+const runProcess = promisify(execFile)
+const writerPath = fileURLToPath(new URL("../fixtures/logging/process-writer.mjs", import.meta.url))
+
+describe("logging recovery", {timeoutMs: 15000}, () => {
+  describe("fresh processes reuse a persistent home-bind log family without changing torn bytes", {timeoutMs: 15_000}, () => {
+    for (const maxFiles of [1, 2, 5]) {
+      it(`maxFiles=${maxFiles}`, async () => withTestCleanup(async (after) => {
+        const root = await mkdtemp(join(homedir(), ".socketduct-jsonl-restart-"))
+        after(() => rm(root, {recursive: true, force: true}))
+        const active = join(root, "reverse-gateway-1.jsonl")
+        const first = await runProcess(process.execPath, [writerPath, root, String(maxFiles), "1024"])
+        expect(first.stderr).toBe("")
+        expect(JSON.parse(first.stdout).reports).toEqual([])
+        await writeFile(active, '{"timestamp":"interrupted', {flag: "a"})
+        const torn = await readFile(active)
+        const original = await stat(active)
+
+        const second = await runProcess(process.execPath, [writerPath, root, String(maxFiles), "1024"])
+        expect(second.stderr).toBe("")
+        const evidencePath = maxFiles === 1 ? active : `${active}.1`
+        expect((await readFile(evidencePath)).equals(torn)).toBeTruthy()
+        expect((await stat(evidencePath)).ino).toBe(original.ino)
+        expect((await stat(evidencePath)).dev).toBe(original.dev)
+        if (maxFiles === 1) {
+          expect(JSON.parse(second.stdout).reports).toEqual(["Socketduct logger failure (LOGGER_IO_ERROR)\n"])
+        } else {
+          expect(JSON.parse(second.stdout).reports).toEqual([])
+          const contents = await readFile(active, "utf8")
+          expect(contents.endsWith("\n")).toBeTruthy()
+          expect(contents.trimEnd().split("\n").map((line) => JSON.parse(line).event)).toEqual(["process.started", "runtime.status"])
+        }
+        const third = await runProcess(process.execPath, [writerPath, root, String(maxFiles), "1024"])
+        expect(third.stderr).toBe("")
+        expect((await readFile(evidencePath)).equals(torn)).toBeTruthy()
+        expect((await readdir(root)).length <= maxFiles).toBeTruthy()
+        for (const file of await readdir(root)) {
+          const stats = await stat(join(root, file))
+          expect(stats.size <= 1024).toBeTruthy()
+          expect(stats.mode & 0o777).toBe(0o600)
+        }
+        expect((await stat(root)).mode & 0o777).toBe(0o700)
+      }))
+    }
+  })
+
+  it("real live and unprobeable PID families survive another process startup", {timeoutMs: 10_000}, async () => withTestCleanup(async (after) => {
+    const root = await mkdtemp(join(tmpdir(), "socketduct-jsonl-real-pids-"))
+    after(() => rm(root, {recursive: true, force: true}))
+    const evidence = Buffer.from('{}\n{"timestamp":"interrupted')
+    const files = []
+    for (const processId of [process.pid, 2 ** 40]) {
+      for (const suffix of ["", ".1", ".2"]) {
+        const path = join(root, `reverse-gateway-${processId}.jsonl${suffix}`)
+        files.push(path)
+        await writeFile(path, evidence, {mode: 0o600})
+      }
+    }
+    expect(process.kill(process.pid, 0)).toBe(true)
+    await expect(Promise.resolve().then(() => process.kill(2 ** 40, 0))).rejects.toMatchObject({code: "ERR_INVALID_ARG_TYPE"})
+    const result = await runProcess(process.execPath, [writerPath, root, "1", "1024"])
+    expect(JSON.parse(result.stdout).reports).toEqual([])
+    for (const path of files) expect((await readFile(path)).equals(evidence)).toBeTruthy()
+  }))
+
+  it("authenticated local payload traffic continues during file logger failure and recovery", {timeoutMs: 15_000}, async () => withTestCleanup(async (after) => {
+    const root = await mkdtemp(join(tmpdir(), "socketduct-jsonl-traffic-"))
+    const active = join(root, "embedded-client-1.jsonl")
+    const torn = Buffer.from('{}\n{"timestamp":"interrupted')
+    await writeFile(active, torn, {mode: 0o600})
+    await chmod(root, 0o500)
+    /** @type {string[]} */
+    const reports = []
+    const logger = createJsonlFileLogger({
+      directory: root, role: "embedded-client", processId: 1,
+      stderr: {write: (/** @type {string} */ message) => reports.push(message)}
+    })
+    const target = createServer((socket) => socket.on("data", (chunk) => socket.write(chunk)))
+    target.listen(0, "127.0.0.1")
+    await once(target, "listening")
+    const address = target.address()
+    if (address === null || typeof address === "string") throw new Error("Expected a bound TCP address")
+    const token = "private-fixture-token-not-for-logging"
+    const relay = await startMultiplexedTcpRelay({
+      tokens: new StaticTokenStore([{username: "fixture", token}]),
+      authorizeTarget: ({target: requested}) => requested.host === "127.0.0.1" && requested.port === address.port
+    })
+    const connection = new MultiplexedSocketductConnection({
+      relay: {host: "127.0.0.1", port: relay.port, token}, logger
+    })
+    after(async () => {
+      await connection.close()
+      await relay.close()
+      await new Promise((resolve) => target.close(resolve))
+      await chmod(root, 0o700)
+      await rm(root, {recursive: true, force: true})
+    })
+    const stream = connection.createConnection({host: "127.0.0.1", port: address.port, sessionName: "private-fixture-session"})
+    await once(stream, "connect")
+    expect(relay.status().authenticatedConnections).toBe(1)
+    expect(relay.status().physicalAccepts).toBe(1)
+    const payload = Buffer.from("private-fixture-payload\0\xff", "utf8")
+    const firstEcho = readPayload(stream, payload.length)
+    stream.write(payload)
+    expect((await firstEcho).equals(payload)).toBeTrue()
+    expect((await readFile(active)).equals(torn)).toBeTruthy()
+    expect(reports).toEqual(["Socketduct logger failure (LOGGER_IO_ERROR)\n"])
+
+    await chmod(root, 0o700)
+    const second = connection.createConnection({host: "127.0.0.1", port: address.port, sessionName: "private-fixture-session-two"})
+    await once(second, "connect")
+    const secondEcho = readPayload(second, payload.length)
+    second.write(payload)
+    expect((await secondEcho).equals(payload)).toBeTrue()
+    expect(relay.status().authenticatedConnections).toBe(1)
+    expect(relay.status().physicalAccepts).toBe(1)
+    expect((await readFile(`${active}.1`)).equals(torn)).toBeTruthy()
+    const contents = await readFile(active, "utf8")
+    expect(contents.endsWith("\n")).toBeTruthy()
+    const entries = contents.trimEnd().split("\n").map((line) => JSON.parse(line))
+    expect(entries.some(({event}) => event === "virtual_stream.opened")).toBeTruthy()
+    expect(contents).not.toMatch(/private-fixture|127\.0\.0\.1/)
+    expect(reports).toEqual(["Socketduct logger failure (LOGGER_IO_ERROR)\n"])
+  }))
+})
+
+/**
+ * @param {import('node:stream').Duplex} stream - Authenticated stream.
+ * @param {number} length - Expected payload length.
+ * @returns {Promise<Buffer>} Complete echoed payload.
+ */
+async function readPayload(stream, length) {
+  return await new Promise((resolve, reject) => {
+    /** @type {Buffer[]} */
+    const chunks = []
+    let received = 0
+    /** @param {Buffer} chunk - Stream data. */
+    const onData = (chunk) => {
+      chunks.push(chunk)
+      received += chunk.length
+      if (received < length) return
+      stream.off("data", onData)
+      stream.off("error", reject)
+      resolve(Buffer.concat(chunks))
+    }
+    stream.on("data", onData)
+    stream.once("error", reject)
+  })
+}