socketduct 0.1.15

package/test/integration/reverse-gateway.test.js

@@ -0,0 +1,1293 @@
+/* eslint-disable jsdoc/escape-inline-tags, jsdoc/require-param, jsdoc/require-returns */
+import assert from "node:assert/strict"
+import {mkdtemp, rm} from "node:fs/promises"
+import {connect as connectTcp, createServer} from "node:net"
+import {tmpdir} from "node:os"
+import {join} from "node:path"
+import {Duplex} from "node:stream"
+import test from "node:test"
+import {connect as connectTls} from "node:tls"
+
+import {StaticTokenStore} from "../../src/auth/static-token-store.js"
+import {MultiplexedSocketductTransportSet} from "../../src/client/multiplexed-transport-set.js"
+import {encodeV3Control, encodeV3Frame, V3FrameType} from "../../src/protocol/v3-frame.js"
+import {OutboundReverseGateway, ReverseGatewayConnection, startReverseGatewayHub} from "../../src/reverse/index.js"
+import {generateTestCertificates} from "../helpers/tls-certificates.js"
+
+/** @param {import('node:net').Server} server - Server. */
+async function listen(server) {
+  await new Promise((resolve, reject) => {
+    server.once("error", reject)
+    server.listen(0, "127.0.0.1", () => { server.off("error", reject); resolve(undefined) })
+  })
+  const address = server.address()
+  assert(address !== null && typeof address !== "string")
+  return address.port
+}
+
+/** @param {import('node:events').EventEmitter} emitter - Emitter. @param {string} event - Event. */
+async function onceEvent(emitter, event) {
+  await new Promise((resolve, reject) => {
+    emitter.once("error", reject)
+    emitter.once(event, () => { emitter.off("error", reject); resolve(undefined) })
+  })
+}
+
+/** @param {import('node:stream').Duplex} socket - Socket. @param {number} bytes - Expected bytes. */
+async function readBytes(socket, bytes) {
+  return await new Promise((resolve, reject) => {
+    /** @type {Buffer[]} */
+    const chunks = []
+    let length = 0
+    const cleanup = () => { socket.off("data", onData); socket.off("error", onError) }
+    /** @param {Error} error - Stream failure. */
+    const onError = (error) => { cleanup(); reject(error) }
+    /** @param {Buffer} chunk - Stream bytes. */
+    const onData = (chunk) => {
+      chunks.push(chunk)
+      length += chunk.length
+      if (length < bytes) return
+      cleanup()
+      resolve(Buffer.concat(chunks))
+    }
+    socket.on("data", onData)
+    socket.on("error", onError)
+  })
+}
+
+/** @param {import('node:stream').Duplex} socket - Stream. @returns {Promise<Buffer>} All bytes through EOF. */
+async function readToEnd(socket) {
+  return await new Promise((resolve, reject) => {
+    /** @type {Buffer[]} */
+    const chunks = []
+    socket.on("data", (chunk) => chunks.push(chunk))
+    socket.once("end", () => resolve(Buffer.concat(chunks)))
+    socket.once("error", reject)
+  })
+}
+
+/** @param {Promise<unknown>} promise - Work. @param {string} label - Timeout label. */
+async function withTimeout(promise, label) {
+  let timer
+  try {
+    return await Promise.race([
+      promise,
+      new Promise((_, reject) => { timer = setTimeout(() => reject(new Error(`Timed out: ${label}`)), 2_000) })
+    ])
+  } finally {
+    if (timer !== undefined) clearTimeout(timer)
+  }
+}
+
+/** @param {import('node:stream').Duplex} socket - Stream. @returns {Promise<Error & {code?: string}>} Next stream error. */
+async function nextError(socket) {
+  return await new Promise((resolve) => socket.once("error", (error) => resolve(/** @type {Error & {code?: string}} */ (error))))
+}
+
+/** @param {() => boolean} predicate - Completion predicate. @param {string} label - Failure label. */
+async function waitUntil(predicate, label) {
+  const deadline = Date.now() + 4_000
+  while (!predicate()) {
+    if (Date.now() >= deadline) throw new Error(`Timed out: ${label}`)
+    await new Promise((resolve) => setTimeout(resolve, 10))
+  }
+}
+
+/**
+ * @param {{connect(): Promise<void>}} connection - Terminal reverse connection.
+ * @param {string} label - Failure context.
+ * @param {(error: Error & {code?: string}) => boolean} predicate - Expected error.
+ */
+async function assertRepeatedConnectRejection(connection, label, predicate) {
+  /** @type {Error & {code?: string} | undefined} */
+  let firstError
+  await assert.rejects(withTimeout(connection.connect(), label), (error) => {
+    firstError = /** @type {Error & {code?: string}} */ (error)
+    return predicate(firstError)
+  })
+  /** @type {Error | undefined} */
+  let repeatedError
+  void connection.connect().catch((error) => { repeatedError = error })
+  await new Promise((resolve) => setImmediate(resolve))
+  assert.strictEqual(repeatedError, firstError, `${label} was not preserved for a repeated connect`)
+}
+
+class HeldWriteTarget extends Duplex {
+  /** @type {Buffer[]} */
+  chunks = []
+  /** @type {(() => void) | undefined} */
+  releaseFirstWrite
+  /** @type {Promise<void>} */
+  firstWrite
+  /** @type {() => void} */
+  #resolveFirstWrite = () => {}
+  /** @type {boolean} */
+  #held = false
+
+  constructor() {
+    super()
+    this.firstWrite = new Promise((resolve) => { this.#resolveFirstWrite = resolve })
+    setImmediate(() => this.emit("connect"))
+  }
+
+  /** @override */
+  _read() {}
+
+  /** @param {Buffer} chunk - Written bytes. @param {BufferEncoding} _encoding - Ignored encoding. @param {(error?: Error | null) => void} callback - Completion. @override */
+  _write(chunk, _encoding, callback) {
+    this.chunks.push(Buffer.from(chunk))
+    if (this.#held) { callback(); return }
+    this.#held = true
+    this.releaseFirstWrite = callback
+    this.#resolveFirstWrite()
+  }
+
+  release() {
+    const release = this.releaseFirstWrite
+    this.releaseFirstWrite = undefined
+    release?.()
+  }
+}
+
+class ObservedMemoryBudget {
+  /** @type {number} */ bytes = 0
+  /** @type {number} */ peakBytes = 0
+
+  /** @param {number} maxBytes - Hard reservation ceiling. */
+  constructor(maxBytes) {
+    this.maxBytes = maxBytes
+  }
+
+  /** @param {number} bytes - Reverse-stream bytes to retain. */
+  reserveMemory(bytes) {
+    assert(this.bytes + bytes <= this.maxBytes, "reverse client exceeded the aggregate retained-byte ceiling")
+    this.bytes += bytes
+    this.peakBytes = Math.max(this.peakBytes, this.bytes)
+  }
+
+  /** @param {number} bytes - Reverse-stream bytes to release. */
+  releaseMemory(bytes) {
+    assert(bytes <= this.bytes, "reverse client released more aggregate bytes than it reserved")
+    this.bytes -= bytes
+  }
+
+  reserveData() { assert.fail("reverse client must reserve non-durable bytes as memory") }
+  releaseSpool() { assert.fail("reverse client must not reserve spool bytes") }
+  reserveControl() {}
+  releaseControl() {}
+}
+
+/**
+ * @param {import('node:test').TestContext} t - Test context.
+ * @param {string} suffix - Stable fixture identity suffix.
+ * @param {{hubWindowBytes?: number, hubFrameBytes?: number, gatewayWindowBytes?: number, gatewayFrameBytes?: number, maxStreamBufferBytes?: number, maxConnectionBufferBytes?: number}} [options] - Flow-control fixture overrides.
+ */
+async function createBackpressuredFixture(t, suffix, options = {}) {
+  const root = await mkdtemp(join(tmpdir(), `socketduct-reverse-client-${suffix}-`))
+  t.after(() => rm(root, {recursive: true, force: true}))
+  const certificates = generateTestCertificates(root)
+  const tokens = new StaticTokenStore([{username: "home", token: "gateway-token"}, {username: "app", token: "client-token"}])
+  const hub = await startReverseGatewayHub({tokens, tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile}, authorizeGateway: () => true, authorizeClientGateway: () => true, authorizeOpen: () => true, initialWindowBytes: options.hubWindowBytes ?? 32, maxFrameBytes: options.hubFrameBytes ?? 16})
+  t.after(() => hub.close())
+  const tls = {caFile: certificates.caCertFile, servername: "localhost"}
+  /** @type {HeldWriteTarget[]} */
+  const targets = []
+  const gateway = new OutboundReverseGateway({gatewayId: "o2", connectionId: `${suffix}_gateway`, hub: {host: "127.0.0.1", port: hub.port, token: "gateway-token"}, tls, authorizeTarget: () => true, initialWindowBytes: options.gatewayWindowBytes ?? 32, maxFrameBytes: options.gatewayFrameBytes ?? 16, createTargetConnection: () => {
+    const target = new HeldWriteTarget()
+    targets.push(target)
+    return /** @type {import('node:net').Socket} */ (/** @type {unknown} */ (target))
+  }})
+  t.after(() => gateway.close())
+  await gateway.start()
+  const maxConnectionBufferBytes = options.maxConnectionBufferBytes ?? 32
+  const budget = new ObservedMemoryBudget(maxConnectionBufferBytes)
+  const client = new ReverseGatewayConnection({gatewayId: "o2", connectionId: `${suffix}_client`, hub: {host: "127.0.0.1", port: hub.port, token: "client-token"}, tls, initialWindowBytes: 32, maxFrameBytes: 16, maxStreamBufferBytes: options.maxStreamBufferBytes ?? 32, maxConnectionBufferBytes, aggregateBudget: budget})
+  t.after(() => client.close())
+  t.after(() => { for (const target of targets) target.release() })
+  await client.connect()
+  return {budget, client, targets}
+}
+
+/**
+ * @param {import('node:test').TestContext} t - Test context.
+ * @param {string} suffix - Stable fixture identity suffix.
+ * @param {{hubWindowBytes?: number, hubFrameBytes?: number, gatewayWindowBytes?: number, gatewayFrameBytes?: number, maxStreamBufferBytes?: number, maxConnectionBufferBytes?: number}} [options] - Flow-control fixture overrides.
+ */
+async function createBackpressuredClient(t, suffix, options = {}) {
+  const {budget, client, targets} = await createBackpressuredFixture(t, suffix, options)
+  const socket = client.createConnection({host: "docker-server", port: 2375})
+  await onceEvent(socket, "connect")
+  const target = targets[0]
+  assert(target !== undefined)
+  return {budget, client, socket, target}
+}
+
+class AuthWriteSocket extends Duplex {
+  /** @override */
+  _read() {}
+
+  /** @param {Buffer} _chunk - Ignored bytes. @param {BufferEncoding} _encoding - Ignored encoding. @param {(error?: Error | null) => void} callback - Completion. @override */
+  _write(_chunk, _encoding, callback) { callback() }
+
+  setKeepAlive() {}
+
+  setNoDelay() {}
+}
+
+test("reverse client contains a TLS AUTH write race inside the transport", async (t) => {
+  /** @type {AuthWriteSocket | undefined} */
+  let physical
+  const client = new ReverseGatewayConnection({
+    gatewayId: "o2",
+    connectionId: "auth_write_race_client",
+    hub: {host: "127.0.0.1", port: 3100, token: "client-token"},
+    tls: {servername: "localhost"},
+    createPhysicalSocket: () => {
+      physical = new AuthWriteSocket()
+      physical.write = /** @type {typeof physical.write} */ (() => { throw new Error("simulated AUTH write race") })
+      return /** @type {import('node:tls').TLSSocket} */ (/** @type {unknown} */ (physical))
+    }
+  })
+  const connecting = client.connect()
+  void connecting.catch(() => {})
+  t.after(() => client.close())
+
+  physical?.emit("secureConnect")
+  await new Promise((resolve) => setImmediate(resolve))
+
+  assert.equal(physical?.destroyed, true)
+  await client.close()
+  await assert.rejects(connecting, /closed/i)
+})
+
+class DataThenErrorTarget extends Duplex {
+  /** @param {Buffer} payload - Bytes observed before the terminal target error. */
+  constructor(payload) {
+    super()
+    setImmediate(() => {
+      this.emit("connect")
+      this.emit("data", payload)
+      this.emit("error", new Error("target failed after data"))
+    })
+  }
+
+  /** @override */
+  _read() {}
+
+  /** @param {Buffer} _chunk - Ignored bytes. @param {BufferEncoding} _encoding - Ignored encoding. @param {(error?: Error | null) => void} callback - Completion. @override */
+  _write(_chunk, _encoding, callback) { callback() }
+}
+
+class HalfCloseTarget extends Duplex {
+  constructor() {
+    super()
+    setImmediate(() => {
+      this.emit("connect")
+      this.emit("end")
+    })
+  }
+
+  /** @override */
+  _read() {}
+
+  /** @param {Buffer} _chunk - Ignored bytes. @param {BufferEncoding} _encoding - Ignored encoding. @param {(error?: Error | null) => void} callback - Completion. @override */
+  _write(_chunk, _encoding, callback) { callback() }
+
+  closeTarget() { this.emit("close") }
+}
+
+class CloseDuringFirstWriteTarget extends Duplex {
+  /** @type {Buffer[]} */ chunks = []
+  /** @type {((error?: Error | null) => void) | undefined} */ #releaseWrite
+
+  constructor() {
+    super()
+    setImmediate(() => this.emit("connect"))
+  }
+
+  /** @override */
+  _read() {}
+
+  /** @param {Buffer} chunk - Request bytes. @param {BufferEncoding} _encoding - Ignored encoding. @param {(error?: Error | null) => void} callback - Completion. @override */
+  _write(chunk, _encoding, callback) {
+    this.chunks.push(Buffer.from(chunk))
+    this.#releaseWrite = callback
+    this.emit("end")
+    this.emit("close")
+  }
+
+  release() {
+    const callback = this.#releaseWrite
+    this.#releaseWrite = undefined
+    callback?.()
+  }
+}
+
+class DataThenLocalCloseTarget extends Duplex {
+  /** @param {Buffer} payload - Target data sent before the controlled local close. */
+  constructor(payload) {
+    super()
+    setImmediate(() => {
+      if (this.destroyed) return
+      this.emit("connect")
+      this.emit("data", payload)
+    })
+  }
+
+  /** @override */
+  _read() {}
+
+  /** @param {Buffer} _chunk - Ignored bytes. @param {BufferEncoding} _encoding - Ignored encoding. @param {(error?: Error | null) => void} callback - Completion. @override */
+  _write(_chunk, _encoding, callback) { callback() }
+
+  closeLocally() {
+    this.emit("end")
+    this.emit("close")
+  }
+}
+
+test("reverse gateway registers outbound over TLS and multiplexes compressed streams", async (t) => {
+  /** @type {Array<{event: string} & Record<string, unknown>>} */
+  const gatewayLifecycle = []
+  /** @type {Array<{event: string} & Record<string, unknown>>} */
+  const clientLifecycle = []
+  const root = await mkdtemp(join(tmpdir(), "socketduct-reverse-"))
+  t.after(() => rm(root, {recursive: true, force: true}))
+  const certificates = generateTestCertificates(root)
+  let targetAccepts = 0
+  const targetSockets = new Set()
+  const target = createServer((socket) => {
+    targetAccepts += 1
+    targetSockets.add(socket)
+    socket.once("close", () => targetSockets.delete(socket))
+    socket.on("data", (chunk) => socket.write(chunk))
+  })
+  const targetPort = await listen(target)
+  t.after(() => {
+    for (const socket of targetSockets) socket.destroy()
+    return new Promise((resolve) => target.close(() => resolve(undefined)))
+  })
+
+  const tokens = new StaticTokenStore([
+    {username: "home-o2", token: "gateway-test-token"},
+    {username: "tensorbuzz", token: "client-test-token"}
+  ])
+  const hub = await startReverseGatewayHub({
+    tokens,
+    tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile},
+    authorizeGateway: (/** @type {{principal: {username: string}, gatewayId: string}} */ {principal, gatewayId}) => principal.username === "home-o2" && gatewayId === "o2",
+    authorizeClientGateway: (/** @type {{principal: {username: string}, gatewayId: string}} */ {principal, gatewayId}) => principal.username === "tensorbuzz" && gatewayId === "o2",
+    authorizeOpen: (/** @type {{principal: {username: string}, gatewayId: string, target: {host: string, port: number}}} */ {principal, gatewayId, target: requested}) => principal.username === "tensorbuzz" && gatewayId === "o2" && requested.host === "127.0.0.1" && requested.port === targetPort
+  })
+  t.after(() => hub.close())
+
+  const gateway = new OutboundReverseGateway({
+    gatewayId: "o2",
+    connectionId: "home_o2_gateway_01",
+    hub: {host: "127.0.0.1", port: hub.port, token: "gateway-test-token"},
+    tls: {caFile: certificates.caCertFile, servername: "localhost"},
+    authorizeTarget: (requested) => requested.host === "127.0.0.1" && requested.port === targetPort,
+    reconnectDelayMs: 10,
+    logger: {log: (/** @type {string} */ event, /** @type {Record<string, unknown>} */ fields = {}) => gatewayLifecycle.push({event, ...fields})}
+  })
+  t.after(() => gateway.close())
+  await withTimeout(gateway.start(), "gateway registration")
+
+  const client = new ReverseGatewayConnection({
+    gatewayId: "o2",
+    connectionId: "tensorbuzz_member_o2_01",
+    hub: {host: "127.0.0.1", port: hub.port, token: "client-test-token"},
+    tls: {caFile: certificates.caCertFile, servername: "localhost"},
+    logger: {log: (/** @type {string} */ event, /** @type {Record<string, unknown>} */ fields = {}) => clientLifecycle.push({event, ...fields})}
+  })
+  t.after(() => client.close())
+  await withTimeout(client.connect(), "client authentication")
+
+  const first = client.createConnection({host: "127.0.0.1", port: targetPort, sessionName: "docker-version"})
+  const second = client.createConnection({host: "127.0.0.1", port: targetPort, sessionName: "docker-events"})
+  await withTimeout(Promise.all([onceEvent(first, "connect"), onceEvent(second, "connect")]), "reverse stream opens")
+
+  const payload = Buffer.from("docker-api-payload-".repeat(20_000))
+  const firstRead = readBytes(first, payload.length)
+  const secondRead = readBytes(second, payload.length)
+  first.write(payload)
+  second.write(payload)
+  assert.deepEqual(await withTimeout(firstRead, "first echo"), payload)
+  assert.deepEqual(await withTimeout(secondRead, "second echo"), payload)
+
+  assert.equal(targetAccepts, 2)
+  assert.equal(hub.status().registeredGateways, 1)
+  assert.equal(hub.status().gatewayPhysicalConnections, 1)
+  assert.equal(gateway.status().compression, "zstd")
+  assert(gateway.status().compressionBytesSaved > 0)
+
+  const firstClosed = onceEvent(first, "close")
+  first.end()
+  await withTimeout(firstClosed, "clean reverse stream close")
+  await waitUntil(() => hub.status().virtualStreams === 1, "clean stream bridge cleanup")
+  assert.equal(gatewayLifecycle.filter(({event}) => event === "reverse_gateway.target_opened").length, 2)
+  assert(gatewayLifecycle.some(({event}) => event === "reverse_gateway.target_closed"))
+  assert(clientLifecycle.some(({event}) => event === "transport.connected"))
+  assert(clientLifecycle.some(({event}) => event === "virtual_stream.opened"))
+  assert(clientLifecycle.some(({event}) => event === "virtual_stream.closed"))
+  assert.doesNotMatch(JSON.stringify([gatewayLifecycle, clientLifecycle]), /gateway-test-token|client-test-token|docker-version|docker-events|127\.0\.0\.1/)
+})
+
+test("reverse client sends END after flow-controlled DATA", async (t) => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-reverse-end-order-"))
+  t.after(() => rm(root, {recursive: true, force: true}))
+  const certificates = generateTestCertificates(root)
+  const targetSockets = new Set()
+  /** @type {(value: Buffer) => void} */
+  let resolveTargetData
+  const targetData = new Promise((resolve) => { resolveTargetData = resolve })
+  const target = createServer((socket) => {
+    targetSockets.add(socket)
+    socket.once("close", () => targetSockets.delete(socket))
+    /** @type {Buffer[]} */
+    const chunks = []
+    socket.on("data", (chunk) => chunks.push(chunk))
+    socket.once("end", () => resolveTargetData(Buffer.concat(chunks)))
+  })
+  const targetPort = await listen(target)
+  t.after(() => {
+    for (const socket of targetSockets) socket.destroy()
+    return new Promise((resolve) => target.close(() => resolve(undefined)))
+  })
+  const tokens = new StaticTokenStore([{username: "home", token: "gateway-token"}, {username: "app", token: "client-token"}])
+  const hub = await startReverseGatewayHub({tokens, tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile}, authorizeGateway: () => true, authorizeClientGateway: () => true, authorizeOpen: () => true, initialWindowBytes: 8192, maxFrameBytes: 4096})
+  t.after(() => hub.close())
+  const tls = {caFile: certificates.caCertFile, servername: "localhost"}
+  const gateway = new OutboundReverseGateway({gatewayId: "o2", connectionId: "end_order_gateway", hub: {host: "127.0.0.1", port: hub.port, token: "gateway-token"}, tls, authorizeTarget: () => true, initialWindowBytes: 8192, maxFrameBytes: 4096})
+  t.after(() => gateway.close())
+  await gateway.start()
+  const client = new ReverseGatewayConnection({gatewayId: "o2", connectionId: "end_order_client", hub: {host: "127.0.0.1", port: hub.port, token: "client-token"}, tls, initialWindowBytes: 8192, maxFrameBytes: 4096})
+  t.after(() => client.close())
+  await client.connect()
+  const socket = client.createConnection({host: "127.0.0.1", port: targetPort})
+  await onceEvent(socket, "connect")
+  const payload = Buffer.alloc(20_000, 0x5a)
+  socket.end(payload)
+  assert.deepEqual(await withTimeout(targetData, "flow-controlled DATA before END"), payload)
+  socket.destroy()
+})
+
+test("reverse client CLOSE acknowledges only flow-controlled DATA transmitted before target close", async (t) => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-reverse-close-position-"))
+  t.after(() => rm(root, {recursive: true, force: true}))
+  const certificates = generateTestCertificates(root)
+  const siblingSockets = new Set()
+  const siblingTarget = createServer((socket) => {
+    siblingSockets.add(socket)
+    socket.once("close", () => siblingSockets.delete(socket))
+    socket.on("data", (chunk) => socket.write(chunk))
+  })
+  const siblingPort = await listen(siblingTarget)
+  t.after(() => { for (const socket of siblingSockets) socket.destroy(); return new Promise((resolve) => siblingTarget.close(() => resolve(undefined))) })
+  const tokens = new StaticTokenStore([{username: "home", token: "gateway-token"}, {username: "app", token: "client-token"}])
+  const hub = await startReverseGatewayHub({tokens, tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile}, authorizeGateway: () => true, authorizeClientGateway: () => true, authorizeOpen: () => true, initialWindowBytes: 4096, maxFrameBytes: 4096})
+  t.after(() => hub.close())
+  const tls = {caFile: certificates.caCertFile, servername: "localhost"}
+  /** @type {CloseDuringFirstWriteTarget | undefined} */
+  let closingTarget
+  const gateway = new OutboundReverseGateway({gatewayId: "o2", connectionId: "close_position_gateway", hub: {host: "127.0.0.1", port: hub.port, token: "gateway-token"}, tls, authorizeTarget: () => true, initialWindowBytes: 4096, maxFrameBytes: 4096, createTargetConnection: (target) => {
+    if (target.host !== "closing-target") return connectTcp(target)
+    closingTarget = new CloseDuringFirstWriteTarget()
+    return /** @type {import('node:net').Socket} */ (/** @type {unknown} */ (closingTarget))
+  }})
+  t.after(() => { closingTarget?.release(); return gateway.close() })
+  await gateway.start()
+  /** @type {() => void} */
+  let releaseClientData = () => {}
+  /** @type {() => void} */
+  let markClientDataBackpressured = () => {}
+  /** @type {Promise<void>} */
+  const clientDataBackpressured = new Promise((resolve) => { markClientDataBackpressured = () => resolve() })
+  const client = new ReverseGatewayConnection({gatewayId: "o2", connectionId: "close_position_client", hub: {host: "127.0.0.1", port: hub.port, token: "client-token"}, tls, initialWindowBytes: 4096, maxFrameBytes: 4096, createPhysicalSocket: (options) => {
+    const physical = connectTls({host: options.host, port: options.port, ...options.tls})
+    const originalWrite = physical.write.bind(physical)
+    let heldData = false
+    physical.write = /** @type {typeof physical.write} */ ((chunk, ...args) => {
+      const accepted = Reflect.apply(originalWrite, physical, [chunk, ...args])
+      if (heldData || !Buffer.isBuffer(chunk) || chunk[5] !== V3FrameType.DATA) return accepted
+      heldData = true
+      releaseClientData = () => physical.emit("drain")
+      markClientDataBackpressured()
+      return false
+    })
+    return physical
+  }})
+  t.after(() => { releaseClientData(); return client.close() })
+  await client.connect()
+  const sibling = client.createConnection({host: "127.0.0.1", port: siblingPort})
+  const closing = client.createConnection({host: "closing-target", port: 2375})
+  await withTimeout(Promise.all([onceEvent(sibling, "connect"), onceEvent(closing, "connect")]), "reverse streams before early target close")
+  const closed = readToEnd(closing)
+  closing.write(Buffer.alloc(20_000, 0x63))
+  await clientDataBackpressured
+  assert.equal((await withTimeout(closed, "early target CLOSE")).length, 0)
+  await waitUntil(() => hub.status().virtualStreams !== 2, "early target bridge cleanup")
+  assert.equal(hub.status().virtualStreams, 1)
+  assert.equal(Buffer.concat(closingTarget?.chunks ?? []).length, 4096)
+  closingTarget?.release()
+  const echoed = readBytes(sibling, 13)
+  sibling.write("sibling-alive")
+  assert.equal((await withTimeout(echoed, "sibling after early target CLOSE")).toString(), "sibling-alive")
+  assert.equal(client.status().physicalConnects, 1)
+  sibling.destroy()
+})
+
+test("reverse hub keeps sibling streams alive when ACK and WINDOW arrive after a gateway-local close", async (t) => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-reverse-close-race-"))
+  t.after(() => rm(root, {recursive: true, force: true}))
+  const certificates = generateTestCertificates(root)
+  const siblingSockets = new Set()
+  const siblingTarget = createServer((socket) => {
+    siblingSockets.add(socket)
+    socket.once("close", () => siblingSockets.delete(socket))
+    socket.on("data", (chunk) => socket.write(chunk))
+    socket.once("end", () => socket.end())
+  })
+  const siblingPort = await listen(siblingTarget)
+  t.after(() => { for (const socket of siblingSockets) socket.destroy(); return new Promise((resolve) => siblingTarget.close(() => resolve(undefined))) })
+  const tokens = new StaticTokenStore([{username: "home", token: "gateway-token"}, {username: "app", token: "client-token"}])
+  const hub = await startReverseGatewayHub({tokens, tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile}, authorizeGateway: () => true, authorizeClientGateway: () => true, authorizeOpen: () => true, initialWindowBytes: 4096, maxFrameBytes: 4096})
+  t.after(() => hub.close())
+  const tls = {caFile: certificates.caCertFile, servername: "localhost"}
+  const closingPayload = Buffer.from("response-before-local-close")
+  /** @type {DataThenLocalCloseTarget | undefined} */
+  let closingTarget
+  const gateway = new OutboundReverseGateway({gatewayId: "o2", connectionId: "close_race_gateway", hub: {host: "127.0.0.1", port: hub.port, token: "gateway-token"}, tls, authorizeTarget: () => true, initialWindowBytes: 4096, maxFrameBytes: 4096, createTargetConnection: (target) => {
+    if (target.host !== "closing-target") return connectTcp(target)
+    closingTarget = new DataThenLocalCloseTarget(closingPayload)
+    return /** @type {import('node:net').Socket} */ (/** @type {unknown} */ (closingTarget))
+  }})
+  t.after(() => gateway.close())
+  await gateway.start()
+  /** @type {number | undefined} */
+  let closingStreamId
+  /** @type {Buffer | undefined} */
+  let delayedAck
+  /** @type {() => void} */
+  let markAckDelayed = () => {}
+  /** @type {Promise<void>} */
+  const ackDelayed = new Promise((resolve) => { markAckDelayed = () => resolve() })
+  /** @type {() => void} */
+  let markLateControlsSent = () => {}
+  /** @type {Promise<void>} */
+  const lateControlsSent = new Promise((resolve) => { markLateControlsSent = () => resolve() })
+  const client = new ReverseGatewayConnection({gatewayId: "o2", connectionId: "close_race_client", hub: {host: "127.0.0.1", port: hub.port, token: "client-token"}, tls, initialWindowBytes: 4096, maxFrameBytes: 4096, reconnectDelayMs: 10_000, createPhysicalSocket: (options) => {
+    const physical = connectTls({host: options.host, port: options.port, ...options.tls})
+    const originalWrite = physical.write.bind(physical)
+    physical.write = /** @type {typeof physical.write} */ ((chunk, ...args) => {
+      if (Buffer.isBuffer(chunk) && chunk[5] === V3FrameType.ACK && chunk.readUInt32BE(8) === closingStreamId && delayedAck === undefined) {
+        delayedAck = Buffer.from(chunk)
+        markAckDelayed()
+        return true
+      }
+      if (Buffer.isBuffer(chunk) && chunk[5] === V3FrameType.CLOSE && chunk.readUInt32BE(8) === closingStreamId && delayedAck !== undefined) {
+        const streamId = chunk.readUInt32BE(8)
+        const window = encodeV3Frame({type: V3FrameType.WINDOW, streamId, sequence: 4096}, encodeV3Control({}))
+        const controlsAndClose = Buffer.concat([delayedAck, window, chunk])
+        delayedAck = undefined
+        const accepted = Reflect.apply(originalWrite, physical, [controlsAndClose, ...args])
+        markLateControlsSent()
+        return accepted
+      }
+      return Reflect.apply(originalWrite, physical, [chunk, ...args])
+    })
+    return physical
+  }})
+  t.after(() => client.close())
+  await client.connect()
+  const closing = client.createConnection({host: "closing-target", port: 2375, allowHalfOpen: true})
+  closingStreamId = closing.streamId
+  const closingRead = readToEnd(closing)
+  const sibling = client.createConnection({host: "127.0.0.1", port: siblingPort})
+  await withTimeout(Promise.all([onceEvent(closing, "connect"), onceEvent(sibling, "connect")]), "reverse streams before local close race")
+  await withTimeout(ackDelayed, "ACK queued before local close")
+  assert(closingTarget !== undefined)
+  closingTarget.closeLocally()
+  await withTimeout(lateControlsSent, "late ACK and WINDOW release")
+  assert.deepEqual(await withTimeout(closingRead, "gateway-local close"), closingPayload)
+  await waitUntil(() => hub.status().virtualStreams === 1, "locally closed bridge cleanup")
+  const siblingRead = readToEnd(sibling)
+  sibling.end("sibling-completes")
+  assert.equal((await withTimeout(siblingRead, "sibling completion after close race")).toString(), "sibling-completes")
+  assert.equal(client.status().physicalState, "ready")
+  assert.equal(client.status().physicalConnects, 1)
+})
+
+test("reverse gateway sends target END after payload received with FIN", async (t) => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-reverse-target-end-order-"))
+  t.after(() => rm(root, {recursive: true, force: true}))
+  const certificates = generateTestCertificates(root)
+  const payload = Buffer.from("final-target-payload-".repeat(512))
+  const targetSockets = new Set()
+  const target = createServer((socket) => {
+    targetSockets.add(socket)
+    socket.once("close", () => targetSockets.delete(socket))
+    socket.end(payload)
+  })
+  const targetPort = await listen(target)
+  t.after(() => { for (const socket of targetSockets) socket.destroy(); return new Promise((resolve) => target.close(() => resolve(undefined))) })
+  const tokens = new StaticTokenStore([{username: "home", token: "gateway-token"}, {username: "app", token: "client-token"}])
+  const hub = await startReverseGatewayHub({tokens, tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile}, authorizeGateway: () => true, authorizeClientGateway: () => true, authorizeOpen: () => true})
+  t.after(() => hub.close())
+  const tls = {caFile: certificates.caCertFile, servername: "localhost"}
+  const gateway = new OutboundReverseGateway({gatewayId: "o2", connectionId: "target_end_order_gateway", hub: {host: "127.0.0.1", port: hub.port, token: "gateway-token"}, tls, authorizeTarget: () => true})
+  t.after(() => gateway.close())
+  await gateway.start()
+  const client = new ReverseGatewayConnection({gatewayId: "o2", connectionId: "target_end_order_client", hub: {host: "127.0.0.1", port: hub.port, token: "client-token"}, tls})
+  t.after(() => client.close())
+  await client.connect()
+  const socket = client.createConnection({host: "127.0.0.1", port: targetPort})
+  assert.deepEqual(await withTimeout(readToEnd(socket), "target payload before FIN"), payload)
+})
+
+test("reverse gateway sends target DATA observed before a terminal target error", async (t) => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-reverse-target-error-order-"))
+  t.after(() => rm(root, {recursive: true, force: true}))
+  const certificates = generateTestCertificates(root)
+  const payload = Buffer.from("data-before-target-error-".repeat(512))
+  const tokens = new StaticTokenStore([{username: "home", token: "gateway-token"}, {username: "app", token: "client-token"}])
+  const hub = await startReverseGatewayHub({tokens, tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile}, authorizeGateway: () => true, authorizeClientGateway: () => true, authorizeOpen: () => true})
+  t.after(() => hub.close())
+  const tls = {caFile: certificates.caCertFile, servername: "localhost"}
+  const gateway = new OutboundReverseGateway({gatewayId: "o2", connectionId: "target_error_order_gateway", hub: {host: "127.0.0.1", port: hub.port, token: "gateway-token"}, tls, authorizeTarget: () => true, createTargetConnection: () => /** @type {import('node:net').Socket} */ (/** @type {unknown} */ (new DataThenErrorTarget(payload)))})
+  t.after(() => gateway.close())
+  await gateway.start()
+  const client = new ReverseGatewayConnection({gatewayId: "o2", connectionId: "target_error_order_client", hub: {host: "127.0.0.1", port: hub.port, token: "client-token"}, tls})
+  t.after(() => client.close())
+  await client.connect()
+  const socket = client.createConnection({host: "docker-server", port: 2375})
+  /** @type {Buffer[]} */
+  const received = []
+  socket.on("data", (chunk) => received.push(chunk))
+  const error = nextError(socket)
+  await onceEvent(socket, "connect")
+  assert.equal((await withTimeout(error, "terminal target error")).code, "TARGET_CLOSED")
+  assert.deepEqual(Buffer.concat(received), payload)
+  assert.equal(gateway.status().virtualStreams, 0)
+})
+
+test("reverse client retires terminal CLOSE streams with allowHalfOpen", async (t) => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-reverse-terminal-close-"))
+  t.after(() => rm(root, {recursive: true, force: true}))
+  const certificates = generateTestCertificates(root)
+  const tokens = new StaticTokenStore([{username: "home", token: "gateway-token"}, {username: "app", token: "client-token"}])
+  const hub = await startReverseGatewayHub({tokens, tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile}, authorizeGateway: () => true, authorizeClientGateway: () => true, authorizeOpen: () => true})
+  t.after(() => hub.close())
+  const tls = {caFile: certificates.caCertFile, servername: "localhost"}
+  /** @type {HalfCloseTarget[]} */
+  const targets = []
+  const gateway = new OutboundReverseGateway({gatewayId: "o2", connectionId: "terminal_close_gateway", hub: {host: "127.0.0.1", port: hub.port, token: "gateway-token"}, tls, authorizeTarget: () => true, createTargetConnection: () => {
+    const target = new HalfCloseTarget()
+    targets.push(target)
+    return /** @type {import('node:net').Socket} */ (/** @type {unknown} */ (target))
+  }})
+  t.after(() => gateway.close())
+  await gateway.start()
+  const client = new ReverseGatewayConnection({gatewayId: "o2", connectionId: "terminal_close_client", hub: {host: "127.0.0.1", port: hub.port, token: "client-token"}, tls, maxStreams: 1})
+  t.after(() => client.close())
+  await client.connect()
+  const first = client.createConnection({host: "docker-server", port: 2375, allowHalfOpen: true})
+  assert.equal((await withTimeout(readToEnd(first), "first terminal response")).length, 0)
+  assert.equal(first.writable, true)
+  assert.equal(client.status().virtualStreams, 1)
+  assert.equal(targets.length, 1)
+  const firstTarget = targets[0]
+  assert(firstTarget !== undefined)
+  firstTarget.closeTarget()
+  await waitUntil(() => hub.status().virtualStreams === 0, "first terminal CLOSE handshake")
+  await waitUntil(() => !first.writable && client.status().virtualStreams === 0, "terminal client stream retirement")
+  assert.equal(first.destroyed, true)
+  assert.equal(client.status().virtualStreams, 0)
+  const second = client.createConnection({host: "docker-server", port: 2375, allowHalfOpen: true})
+  await onceEvent(second, "connect")
+  second.destroy()
+})
+
+test("reverse client DATA respects a decompression limit below maxFrameBytes", async (t) => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-reverse-client-chunks-"))
+  t.after(() => rm(root, {recursive: true, force: true}))
+  const certificates = generateTestCertificates(root)
+  const payload = Buffer.alloc(4096, 0x61)
+  /** @type {(value: Buffer) => void} */
+  let resolveTargetData
+  const targetData = new Promise((resolve) => { resolveTargetData = resolve })
+  const targetSockets = new Set()
+  const target = createServer((socket) => {
+    targetSockets.add(socket)
+    socket.once("close", () => targetSockets.delete(socket))
+    /** @type {Buffer[]} */
+    const chunks = []
+    let length = 0
+    socket.on("data", (chunk) => {
+      chunks.push(chunk)
+      length += chunk.length
+      if (length >= payload.length) resolveTargetData(Buffer.concat(chunks))
+    })
+  })
+  const targetPort = await listen(target)
+  t.after(() => { for (const socket of targetSockets) socket.destroy(); return new Promise((resolve) => target.close(() => resolve(undefined))) })
+  const compressionLimits = {maxDecompressedBytes: 1024}
+  const tokens = new StaticTokenStore([{username: "home", token: "gateway-token"}, {username: "app", token: "client-token"}])
+  const hub = await startReverseGatewayHub({tokens, tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile}, authorizeGateway: () => true, authorizeClientGateway: () => true, authorizeOpen: () => true, maxFrameBytes: 4096, compressionLimits})
+  t.after(() => hub.close())
+  const tls = {caFile: certificates.caCertFile, servername: "localhost"}
+  const gateway = new OutboundReverseGateway({gatewayId: "o2", connectionId: "client_chunks_gateway", hub: {host: "127.0.0.1", port: hub.port, token: "gateway-token"}, tls, authorizeTarget: () => true, maxFrameBytes: 4096, compressionLimits})
+  t.after(() => gateway.close())
+  await gateway.start()
+  const client = new ReverseGatewayConnection({gatewayId: "o2", connectionId: "client_chunks_client", hub: {host: "127.0.0.1", port: hub.port, token: "client-token"}, tls, maxFrameBytes: 4096, compressionLimits})
+  t.after(() => client.close())
+  await client.connect()
+  const socket = client.createConnection({host: "127.0.0.1", port: targetPort})
+  await onceEvent(socket, "connect")
+  socket.write(payload)
+  assert.deepEqual(await withTimeout(targetData, "bounded client DATA"), payload)
+  socket.destroy()
+})
+
+test("reverse gateway DATA respects a decompression limit below maxFrameBytes", async (t) => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-reverse-gateway-chunks-"))
+  t.after(() => rm(root, {recursive: true, force: true}))
+  const certificates = generateTestCertificates(root)
+  const payload = Buffer.alloc(4096, 0x62)
+  const targetSockets = new Set()
+  const target = createServer((socket) => {
+    targetSockets.add(socket)
+    socket.once("close", () => targetSockets.delete(socket))
+    socket.write(payload)
+  })
+  const targetPort = await listen(target)
+  t.after(() => { for (const socket of targetSockets) socket.destroy(); return new Promise((resolve) => target.close(() => resolve(undefined))) })
+  const compressionLimits = {maxDecompressedBytes: 1024}
+  const tokens = new StaticTokenStore([{username: "home", token: "gateway-token"}, {username: "app", token: "client-token"}])
+  const hub = await startReverseGatewayHub({tokens, tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile}, authorizeGateway: () => true, authorizeClientGateway: () => true, authorizeOpen: () => true, maxFrameBytes: 4096, compressionLimits})
+  t.after(() => hub.close())
+  const tls = {caFile: certificates.caCertFile, servername: "localhost"}
+  const gateway = new OutboundReverseGateway({gatewayId: "o2", connectionId: "gateway_chunks_gateway", hub: {host: "127.0.0.1", port: hub.port, token: "gateway-token"}, tls, authorizeTarget: () => true, maxFrameBytes: 4096, compressionLimits})
+  t.after(() => gateway.close())
+  await gateway.start()
+  const client = new ReverseGatewayConnection({gatewayId: "o2", connectionId: "gateway_chunks_client", hub: {host: "127.0.0.1", port: hub.port, token: "client-token"}, tls, maxFrameBytes: 4096, compressionLimits})
+  t.after(() => client.close())
+  await client.connect()
+  const socket = client.createConnection({host: "127.0.0.1", port: targetPort})
+  assert.deepEqual(await withTimeout(readBytes(socket, payload.length), "bounded gateway DATA"), payload)
+  socket.destroy()
+})
+
+test("reverse client honors the smaller hub receive window", async (t) => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-reverse-client-window-"))
+  t.after(() => rm(root, {recursive: true, force: true}))
+  const certificates = generateTestCertificates(root)
+  const tokens = new StaticTokenStore([{username: "home", token: "gateway-token"}, {username: "app", token: "client-token"}])
+  const hub = await startReverseGatewayHub({tokens, tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile}, authorizeGateway: () => true, authorizeClientGateway: () => true, authorizeOpen: () => true, initialWindowBytes: 8192, maxFrameBytes: 4096})
+  t.after(() => hub.close())
+  const tls = {caFile: certificates.caCertFile, servername: "localhost"}
+  /** @type {HeldWriteTarget | undefined} */
+  let target
+  const gateway = new OutboundReverseGateway({gatewayId: "o2", connectionId: "client_window_gateway", hub: {host: "127.0.0.1", port: hub.port, token: "gateway-token"}, tls, authorizeTarget: () => true, initialWindowBytes: 20_000, maxFrameBytes: 4096, createTargetConnection: () => {
+    target = new HeldWriteTarget()
+    return /** @type {import('node:net').Socket} */ (/** @type {unknown} */ (target))
+  }})
+  t.after(() => gateway.close())
+  await gateway.start()
+  const client = new ReverseGatewayConnection({gatewayId: "o2", connectionId: "client_window_client", hub: {host: "127.0.0.1", port: hub.port, token: "client-token"}, tls, initialWindowBytes: 20_000, maxFrameBytes: 4096})
+  t.after(() => client.close())
+  await client.connect()
+  const socket = client.createConnection({host: "docker-server", port: 2375})
+  await onceEvent(socket, "connect")
+  const payload = Buffer.alloc(20_000, 0x63)
+  await new Promise((resolve, reject) => socket.write(payload, (error) => error ? reject(error) : resolve(undefined)))
+  assert(target !== undefined)
+  const targetStream = target
+  await targetStream.firstWrite
+  await waitUntil(() => hub.status().rawDataBytes >= 8192, "initial client window")
+  await new Promise((resolve) => setImmediate(resolve))
+  assert.equal(hub.status().rawDataBytes, 8192)
+  targetStream.release()
+  await waitUntil(() => Buffer.concat(targetStream.chunks).length === payload.length, "remaining client DATA after window credit")
+  assert.deepEqual(Buffer.concat(targetStream.chunks), payload)
+  socket.destroy()
+})
+
+test("reverse client backpressures a write larger than its retained-byte limit", async (t) => {
+  const {budget, client, socket, target} = await createBackpressuredClient(t, "large_write")
+  /** @type {Error | undefined} */
+  let emittedError
+  socket.on("error", (error) => { emittedError = error })
+  const payload = Buffer.from(Array.from({length: 96}, (_value, index) => index))
+  let callbacks = 0
+  const writing = new Promise((resolve, reject) => socket.write(payload, (error) => {
+    callbacks += 1
+    if (error) reject(error)
+    else resolve(undefined)
+  }))
+  await withTimeout(Promise.race([target.firstWrite, writing]), "first chunk of backpressured large write")
+  assert.equal(client.status().queuedBytes, 32)
+  assert.equal(budget.peakBytes, 32)
+  target.release()
+  await withTimeout(writing, "backpressured large write callback")
+  await waitUntil(() => Buffer.concat(target.chunks).length === payload.length, "complete backpressured large write")
+  await waitUntil(() => client.status().queuedBytes === 0, "large write acknowledgements")
+  assert.deepEqual(Buffer.concat(target.chunks), payload)
+  assert.equal(budget.bytes, 0)
+  assert.equal(budget.peakBytes, 32)
+  assert.equal(callbacks, 1)
+  assert.equal(emittedError, undefined)
+  socket.destroy()
+})
+
+test("reverse client chunks a large write to the negotiated stream window", async (t) => {
+  const {budget, client, socket, target} = await createBackpressuredClient(t, "negotiated_window", {
+    hubWindowBytes: 8,
+    hubFrameBytes: 8,
+    gatewayWindowBytes: 8,
+    gatewayFrameBytes: 8,
+    maxStreamBufferBytes: 16,
+    maxConnectionBufferBytes: 16
+  })
+  const payload = Buffer.from(Array.from({length: 48}, (_value, index) => index))
+  const writing = new Promise((resolve, reject) => socket.write(payload, (error) => error ? reject(error) : resolve(undefined)))
+  void writing.catch(() => {})
+  await withTimeout(target.firstWrite, "first large-write chunk within negotiated stream window")
+  assert.equal(client.status().queuedBytes, 16)
+  assert.equal(budget.peakBytes, 16)
+  target.release()
+  await withTimeout(writing, "negotiated-window large-write callback")
+  await waitUntil(() => Buffer.concat(target.chunks).length === payload.length, "complete negotiated-window large write")
+  await waitUntil(() => client.status().queuedBytes === 0, "negotiated-window acknowledgements")
+  assert(target.chunks.every((chunk) => chunk.length <= 8))
+  assert.deepEqual(Buffer.concat(target.chunks), payload)
+  assert.equal(budget.bytes, 0)
+  socket.destroy()
+})
+
+test("reverse client shares released connection capacity among pending streams", async (t) => {
+  const {budget, client, targets} = await createBackpressuredFixture(t, "fair_pending_writes", {
+    maxStreamBufferBytes: 32,
+    maxConnectionBufferBytes: 16
+  })
+  const firstSocket = client.createConnection({host: "docker-server", port: 2375})
+  const secondSocket = client.createConnection({host: "docker-server", port: 2375})
+  await Promise.all([onceEvent(firstSocket, "connect"), onceEvent(secondSocket, "connect")])
+  const firstTarget = targets[0]
+  const secondTarget = targets[1]
+  assert(firstTarget !== undefined)
+  assert(secondTarget !== undefined)
+  const firstPayload = Buffer.from(Array.from({length: 64}, (_value, index) => index))
+  const firstWriting = new Promise((resolve, reject) => firstSocket.write(firstPayload, (error) => error ? reject(error) : resolve("first")))
+  void firstWriting.catch(() => {})
+  await withTimeout(firstTarget.firstWrite, "first stream connection-pressure chunk")
+  assert.equal(client.status().queuedBytes, 16)
+
+  const secondPayload = Buffer.alloc(16, 0xa5)
+  const secondWriting = new Promise((resolve, reject) => secondSocket.write(secondPayload, (error) => error ? reject(error) : resolve(undefined)))
+  void secondWriting.catch(() => {})
+  firstTarget.release()
+  assert.equal(await withTimeout(Promise.race([secondTarget.firstWrite.then(() => "second"), firstWriting]), "fair pending-stream progression"), "second")
+  assert.equal(budget.peakBytes, 16)
+
+  secondTarget.release()
+  await withTimeout(Promise.all([firstWriting, secondWriting]), "complete fairly scheduled writes")
+  await waitUntil(() => Buffer.concat(firstTarget.chunks).length === firstPayload.length, "complete first fairly scheduled write")
+  await waitUntil(() => Buffer.concat(secondTarget.chunks).length === secondPayload.length, "complete second fairly scheduled write")
+  await waitUntil(() => client.status().queuedBytes === 0, "fair pending-stream acknowledgements")
+  assert.deepEqual(Buffer.concat(firstTarget.chunks), firstPayload)
+  assert.deepEqual(Buffer.concat(secondTarget.chunks), secondPayload)
+  assert.equal(budget.bytes, 0)
+  firstSocket.destroy()
+  secondSocket.destroy()
+})
+
+test("reverse client close fails a backpressured write and releases retained bytes", async (t) => {
+  const {budget, client, socket, target} = await createBackpressuredClient(t, "close_large_write")
+  const payload = Buffer.alloc(96, 0x72)
+  let callbacks = 0
+  const writing = new Promise((resolve, reject) => socket.write(payload, (error) => {
+    callbacks += 1
+    if (error) reject(error)
+    else resolve(undefined)
+  }))
+  await withTimeout(Promise.race([target.firstWrite, writing]), "first chunk before reverse client close")
+  assert.equal(client.status().queuedBytes, 32)
+  await client.close()
+  await assert.rejects(withTimeout(writing, "backpressured write close callback"), (error) => /** @type {{code?: string}} */ (error).code === "ERR_STREAM_DESTROYED")
+  assert.equal(callbacks, 1)
+  assert.equal(socket.destroyed, true)
+  assert.equal(client.status().queuedBytes, 0)
+  assert.equal(budget.bytes, 0)
+  target.release()
+})
+
+test("reverse gateway honors the smaller hub receive window", async (t) => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-reverse-gateway-window-"))
+  t.after(() => rm(root, {recursive: true, force: true}))
+  const certificates = generateTestCertificates(root)
+  const payload = Buffer.alloc(20_000, 0x64)
+  const targetSockets = new Set()
+  const target = createServer((socket) => {
+    targetSockets.add(socket)
+    socket.once("close", () => targetSockets.delete(socket))
+    socket.write(payload)
+  })
+  const targetPort = await listen(target)
+  t.after(() => { for (const socket of targetSockets) socket.destroy(); return new Promise((resolve) => target.close(() => resolve(undefined))) })
+  const tokens = new StaticTokenStore([{username: "home", token: "gateway-token"}, {username: "app", token: "client-token"}])
+  const hub = await startReverseGatewayHub({tokens, tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile}, authorizeGateway: () => true, authorizeClientGateway: () => true, authorizeOpen: () => true, initialWindowBytes: 8192, maxFrameBytes: 4096})
+  t.after(() => hub.close())
+  const tls = {caFile: certificates.caCertFile, servername: "localhost"}
+  const gateway = new OutboundReverseGateway({gatewayId: "o2", connectionId: "gateway_window_gateway", hub: {host: "127.0.0.1", port: hub.port, token: "gateway-token"}, tls, authorizeTarget: () => true, initialWindowBytes: 20_000, maxFrameBytes: 4096})
+  t.after(() => gateway.close())
+  await gateway.start()
+  const client = new ReverseGatewayConnection({gatewayId: "o2", connectionId: "gateway_window_client", hub: {host: "127.0.0.1", port: hub.port, token: "client-token"}, tls, initialWindowBytes: 8192, maxFrameBytes: 4096})
+  t.after(() => client.close())
+  await client.connect()
+  const socket = client.createConnection({host: "127.0.0.1", port: targetPort, readableHighWaterMark: 1})
+  await onceEvent(socket, "connect")
+  await waitUntil(() => gateway.status().rawDataBytes >= 8192, "initial gateway window")
+  await new Promise((resolve) => setImmediate(resolve))
+  assert.equal(gateway.status().rawDataBytes, 8192)
+  assert.deepEqual(await withTimeout(readBytes(socket, payload.length), "remaining gateway DATA after window credit"), payload)
+  socket.destroy()
+})
+
+test("reverse peers reconnect after graceful hub shutdown", async (t) => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-reverse-hub-restart-"))
+  t.after(() => rm(root, {recursive: true, force: true}))
+  const certificates = generateTestCertificates(root)
+  const tokens = new StaticTokenStore([{username: "home", token: "gateway-token"}, {username: "app", token: "client-token"}])
+  const hubOptions = {tokens, tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile}, knownGatewayIds: ["o2"], authorizeGateway: () => true, authorizeClientGateway: () => true, authorizeOpen: () => false}
+  let hub = await startReverseGatewayHub(hubOptions)
+  const hubSockets = new Set()
+  hub.server.on("secureConnection", (socket) => { hubSockets.add(socket); socket.once("close", () => hubSockets.delete(socket)) })
+  const port = hub.port
+  const tls = {caFile: certificates.caCertFile, servername: "localhost"}
+  const gateway = new OutboundReverseGateway({gatewayId: "o2", connectionId: "hub_restart_gateway", hub: {host: "127.0.0.1", port, token: "gateway-token"}, tls, authorizeTarget: () => false, reconnectDelayMs: 10, maxReconnectDelayMs: 20})
+  const client = new ReverseGatewayConnection({gatewayId: "o2", connectionId: "hub_restart_client", hub: {host: "127.0.0.1", port, token: "client-token"}, tls, reconnectDelayMs: 10, maxReconnectDelayMs: 20})
+  t.after(async () => { await client.close(); await gateway.close(); await hub.close() })
+  await gateway.start()
+  await client.connect()
+  assert.equal(hubSockets.size, 2)
+  const shutdown = encodeV3Frame({type: V3FrameType.GOAWAY, streamId: 0, sequence: 0}, encodeV3Control({code: "HUB_SHUTDOWN"}))
+  await Promise.all([...hubSockets].map((socket) => new Promise((resolve, reject) => socket.write(shutdown, (/** @type {Error | null | undefined} */ error) => error ? reject(error) : resolve(undefined)))))
+  await withTimeout(hub.close(), "graceful hub shutdown")
+  hub = await startReverseGatewayHub({...hubOptions, port})
+  await waitUntil(() => gateway.status().physicalState === "ready" && client.status().physicalState === "ready" && gateway.status().physicalConnects >= 2 && client.status().physicalConnects >= 2, "reverse peers after hub restart")
+})
+
+test("reverse hub bounds and times out TCP sockets stalled before TLS", async (t) => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-reverse-pre-tls-"))
+  t.after(() => rm(root, {recursive: true, force: true}))
+  const certificates = generateTestCertificates(root)
+  const hub = await startReverseGatewayHub({
+    tokens: new StaticTokenStore([]),
+    tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile},
+    authorizeGateway: () => false,
+    authorizeClientGateway: () => false,
+    authorizeOpen: () => false,
+    maxPhysicalConnections: 1,
+    handshakeTimeoutMs: 50
+  })
+  /** @type {import('node:net').Socket | undefined} */
+  let first
+  /** @type {import('node:net').Socket | undefined} */
+  let second
+  t.after(async () => { first?.destroy(); second?.destroy(); await hub.close() })
+  first = connectTcp({host: "127.0.0.1", port: hub.port})
+  const firstClosed = onceEvent(first, "close")
+  await onceEvent(first, "connect")
+  await waitUntil(() => hub.status().physicalConnections === 1, "pre-TLS socket admission")
+  second = connectTcp({host: "127.0.0.1", port: hub.port})
+  const secondClosed = onceEvent(second, "close")
+  await onceEvent(second, "connect")
+  await withTimeout(secondClosed, "excess pre-TLS socket rejection")
+  await withTimeout(firstClosed, "pre-TLS handshake timeout")
+  await waitUntil(() => hub.status().physicalConnections === 0, "pre-TLS socket cleanup")
+})
+
+test("reverse hub evicts disconnected client identities at its bound", async (t) => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-reverse-identities-"))
+  t.after(() => rm(root, {recursive: true, force: true}))
+  const certificates = generateTestCertificates(root)
+  const tokens = new StaticTokenStore([{username: "home", token: "gateway-token"}, {username: "app", token: "client-token"}])
+  const hub = await startReverseGatewayHub({tokens, tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile}, knownGatewayIds: ["o2"], authorizeGateway: () => true, authorizeClientGateway: () => true, authorizeOpen: () => false, maxConnectionIdentities: 1})
+  t.after(() => hub.close())
+  const tls = {caFile: certificates.caCertFile, servername: "localhost"}
+  const gateway = new OutboundReverseGateway({gatewayId: "o2", connectionId: "bounded_identity_gateway", hub: {host: "127.0.0.1", port: hub.port, token: "gateway-token"}, tls, authorizeTarget: () => false})
+  t.after(() => gateway.close())
+  await gateway.start()
+  const first = new ReverseGatewayConnection({gatewayId: "o2", connectionId: "bounded_identity_one", hub: {host: "127.0.0.1", port: hub.port, token: "client-token"}, tls, continuousReconnect: false})
+  await first.connect()
+  await first.close()
+  await waitUntil(() => hub.status().clientPhysicalConnections === 0, "first identity disconnect")
+  const second = new ReverseGatewayConnection({gatewayId: "o2", connectionId: "bounded_identity_two", hub: {host: "127.0.0.1", port: hub.port, token: "client-token"}, tls, continuousReconnect: false})
+  t.after(() => second.close())
+  await second.connect()
+  assert.equal(second.status().physicalState, "ready")
+  assert.equal(hub.status().retainedClientIdentities, 1)
+  const third = new ReverseGatewayConnection({gatewayId: "o2", connectionId: "bounded_identity_three", hub: {host: "127.0.0.1", port: hub.port, token: "client-token"}, tls, continuousReconnect: false})
+  t.after(() => third.close())
+  await assert.rejects(third.connect(), (error) => /** @type {{code?: string}} */ (error).code === "IDENTITY_LIMIT")
+  assert.equal(second.status().physicalState, "ready")
+})
+
+test("reverse hub rejects bad credentials, unknown gateways, duplicate owners, and stale generations", async (t) => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-reverse-auth-"))
+  t.after(() => rm(root, {recursive: true, force: true}))
+  const certificates = generateTestCertificates(root)
+  const tokens = new StaticTokenStore([
+    {username: "home-o2", token: "gateway-valid-token"},
+    {username: "tensorbuzz", token: "client-valid-token"},
+    {username: "untrusted", token: "untrusted-client-token"}
+  ])
+  const hub = await startReverseGatewayHub({
+    tokens,
+    tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile},
+    knownGatewayIds: ["o2"],
+    authorizeGateway: (/** @type {{principal: {username: string}, gatewayId: string}} */ {principal, gatewayId}) => principal.username === "home-o2" && gatewayId === "o2",
+    authorizeClientGateway: (/** @type {{principal: {username: string}}} */ {principal}) => principal.username === "tensorbuzz",
+    authorizeOpen: () => false
+  })
+  t.after(() => hub.close())
+  const tls = {caFile: certificates.caCertFile, servername: "localhost"}
+
+  const badGateway = new OutboundReverseGateway({gatewayId: "o2", connectionId: "bad_gateway_identity", hub: {host: "127.0.0.1", port: hub.port, token: "wrong-token"}, tls, authorizeTarget: () => false})
+  t.after(() => badGateway.close())
+  await assert.rejects(withTimeout(badGateway.start(), "bad gateway auth"), (error) => /** @type {{code?: string}} */ (error).code === "AUTH_REQUIRED")
+
+  const badClient = new ReverseGatewayConnection({gatewayId: "o2", connectionId: "bad_client_identity", hub: {host: "127.0.0.1", port: hub.port, token: "wrong-token"}, tls})
+  t.after(() => badClient.close())
+  await assertRepeatedConnectRejection(badClient, "bad client auth", (error) => error.code === "AUTH_REQUIRED")
+
+  const unknown = new ReverseGatewayConnection({gatewayId: "missing", connectionId: "unknown_gateway_client", hub: {host: "127.0.0.1", port: hub.port, token: "client-valid-token"}, tls})
+  t.after(() => unknown.close())
+  await assertRepeatedConnectRejection(unknown, "unknown gateway", (error) => error.code === "UNKNOWN_GATEWAY_ID")
+
+  const primary = new OutboundReverseGateway({gatewayId: "o2", connectionId: "stable_gateway_owner", hub: {host: "127.0.0.1", port: hub.port, token: "gateway-valid-token"}, tls, authorizeTarget: () => false})
+  t.after(() => primary.close())
+  await withTimeout(primary.start(), "primary gateway")
+
+  const untrusted = new ReverseGatewayConnection({gatewayId: "o2", connectionId: "untrusted_client_identity", hub: {host: "127.0.0.1", port: hub.port, token: "untrusted-client-token"}, tls})
+  t.after(() => untrusted.close())
+  await assertRepeatedConnectRejection(untrusted, "unauthorized gateway selection", (error) => error.code === "GATEWAY_UNAUTHORIZED")
+
+  const duplicate = new OutboundReverseGateway({gatewayId: "o2", connectionId: "different_gateway_owner", hub: {host: "127.0.0.1", port: hub.port, token: "gateway-valid-token"}, tls, authorizeTarget: () => false})
+  t.after(() => duplicate.close())
+  await assert.rejects(withTimeout(duplicate.start(), "duplicate gateway"), (error) => /** @type {{code?: string}} */ (error).code === "DUPLICATE_GATEWAY")
+
+  const stale = new OutboundReverseGateway({gatewayId: "o2", connectionId: "stable_gateway_owner", initialGeneration: 1, hub: {host: "127.0.0.1", port: hub.port, token: "gateway-valid-token"}, tls, authorizeTarget: () => false})
+  t.after(() => stale.close())
+  await assert.rejects(withTimeout(stale.start(), "stale gateway generation"), (error) => /** @type {{code?: string}} */ (error).code === "STALE_GENERATION")
+  assert.equal(hub.status().healthyGateways, 1)
+  assert.equal(hub.status().rejectedRegistrations, 2)
+
+  const replacement = new OutboundReverseGateway({gatewayId: "o2", connectionId: "stable_gateway_owner", initialGeneration: primary.status().connectionGeneration + 100, hub: {host: "127.0.0.1", port: hub.port, token: "gateway-valid-token"}, tls, authorizeTarget: () => false})
+  t.after(() => replacement.close())
+  await replacement.start()
+  await waitUntil(() => primary.status().physicalState === "closed", "newer generation fences prior owner")
+  assert.equal(hub.status().healthyGateways, 1)
+})
+
+test("hub and gateway both enforce target policy without opening a proxy", async (t) => {
+  /** @type {Array<{event: string} & Record<string, unknown>>} */
+  const gatewayLifecycle = []
+  const root = await mkdtemp(join(tmpdir(), "socketduct-reverse-policy-"))
+  t.after(() => rm(root, {recursive: true, force: true}))
+  const certificates = generateTestCertificates(root)
+  let targetAccepts = 0
+  const targetSockets = new Set()
+  const target = createServer((socket) => {
+    targetAccepts += 1
+    targetSockets.add(socket)
+    socket.once("close", () => targetSockets.delete(socket))
+  })
+  const targetPort = await listen(target)
+  t.after(() => {
+    for (const socket of targetSockets) socket.destroy()
+    return new Promise((resolve) => target.close(() => resolve(undefined)))
+  })
+  const tokens = new StaticTokenStore([{username: "home", token: "gateway-token"}, {username: "app", token: "client-token"}])
+  let hubAllows = false
+  const hub = await startReverseGatewayHub({
+    tokens,
+    tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile},
+    authorizeGateway: () => true,
+    authorizeClientGateway: () => true,
+    authorizeOpen: () => hubAllows
+  })
+  t.after(() => hub.close())
+  let gatewayAllows = false
+  const gateway = new OutboundReverseGateway({
+    gatewayId: "o2",
+    connectionId: "policy_gateway_01",
+    hub: {host: "127.0.0.1", port: hub.port, token: "gateway-token"},
+    tls: {caFile: certificates.caCertFile, servername: "localhost"},
+    authorizeTarget: () => gatewayAllows,
+    logger: {log: (/** @type {string} */ event, /** @type {Record<string, unknown>} */ fields = {}) => gatewayLifecycle.push({event, ...fields})}
+  })
+  t.after(() => gateway.close())
+  await gateway.start()
+  const client = new ReverseGatewayConnection({
+    gatewayId: "o2",
+    connectionId: "policy_client_01",
+    hub: {host: "127.0.0.1", port: hub.port, token: "client-token"},
+    tls: {caFile: certificates.caCertFile, servername: "localhost"}
+  })
+  t.after(() => client.close())
+  await client.connect()
+
+  const hubDenied = client.createConnection({host: "127.0.0.1", port: targetPort})
+  assert.equal((await nextError(hubDenied)).code, "TARGET_UNAUTHORIZED")
+  hubAllows = true
+  const gatewayDenied = client.createConnection({host: "127.0.0.1", port: targetPort})
+  assert.equal((await nextError(gatewayDenied)).code, "TARGET_UNAUTHORIZED")
+  assert.equal(targetAccepts, 0)
+
+  gatewayAllows = true
+  const allowed = client.createConnection({host: "127.0.0.1", port: targetPort})
+  await onceEvent(allowed, "connect")
+  assert.equal(targetAccepts, 1)
+  assert(gatewayLifecycle.some(({event, errorCode}) => event === "reverse_gateway.target_open_failed" && errorCode === "TARGET_UNAUTHORIZED"))
+  assert(gatewayLifecycle.some(({event}) => event === "reverse_gateway.target_opened"))
+  allowed.destroy()
+})
+
+test("gateway loss terminates uncertain streams, reconnects one owner, and accepts clean new work", async (t) => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-reverse-reconnect-"))
+  t.after(() => rm(root, {recursive: true, force: true}))
+  const certificates = generateTestCertificates(root)
+  const targetSockets = new Set()
+  const target = createServer((socket) => {
+    targetSockets.add(socket)
+    socket.once("close", () => targetSockets.delete(socket))
+    socket.on("data", (chunk) => socket.write(chunk))
+  })
+  const targetPort = await listen(target)
+  t.after(() => {
+    for (const socket of targetSockets) socket.destroy()
+    return new Promise((resolve) => target.close(() => resolve(undefined)))
+  })
+  const tokens = new StaticTokenStore([{username: "home", token: "gateway-token"}, {username: "app", token: "client-token"}])
+  const hub = await startReverseGatewayHub({tokens, tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile}, authorizeGateway: () => true, authorizeClientGateway: () => true, authorizeOpen: () => true})
+  t.after(() => hub.close())
+  const tls = {caFile: certificates.caCertFile, servername: "localhost"}
+  const gateway = new OutboundReverseGateway({gatewayId: "o2", connectionId: "reconnecting_gateway", hub: {host: "127.0.0.1", port: hub.port, token: "gateway-token"}, tls, authorizeTarget: () => true, reconnectDelayMs: 10, maxReconnectDelayMs: 20})
+  t.after(() => gateway.close())
+  await gateway.start()
+  const client = new ReverseGatewayConnection({gatewayId: "o2", connectionId: "reconnecting_client", hub: {host: "127.0.0.1", port: hub.port, token: "client-token"}, tls, reconnectDelayMs: 10, maxReconnectDelayMs: 20})
+  t.after(() => client.close())
+  await client.connect()
+  const uncertain = client.createConnection({host: "127.0.0.1", port: targetPort})
+  await onceEvent(uncertain, "connect")
+  const lost = nextError(uncertain)
+  await hub.closeActiveGateway("o2")
+  assert.equal((await lost).code, "GATEWAY_DISCONNECTED")
+  await waitUntil(() => gateway.status().physicalConnects >= 2 && client.status().physicalConnects >= 2 && gateway.status().physicalState === "ready" && client.status().physicalState === "ready", "gateway and selected member reconnect")
+  await waitUntil(() => targetSockets.size === 0, "uncertain target cleanup")
+  assert.equal(hub.status().virtualStreams, 0)
+  assert.equal(targetSockets.size, 0)
+
+  const clean = client.createConnection({host: "127.0.0.1", port: targetPort})
+  await onceEvent(clean, "connect")
+  const echoed = readBytes(clean, 12)
+  clean.write("clean-retry!")
+  assert.equal((await echoed).toString(), "clean-retry!")
+  assert(gateway.status().physicalConnects >= 2)
+  assert(client.status().physicalConnects >= 2)
+  clean.destroy()
+})
+
+test("reverse mode enforces verified TLS and stream resource bounds", async (t) => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-reverse-limits-"))
+  const wrongRoot = await mkdtemp(join(tmpdir(), "socketduct-reverse-wrong-ca-"))
+  t.after(() => Promise.all([rm(root, {recursive: true, force: true}), rm(wrongRoot, {recursive: true, force: true})]))
+  const certificates = generateTestCertificates(root)
+  const wrongCertificates = generateTestCertificates(wrongRoot)
+  const targetSockets = new Set()
+  const target = createServer((socket) => { targetSockets.add(socket); socket.once("close", () => targetSockets.delete(socket)); socket.on("data", (chunk) => socket.write(chunk)) })
+  const targetPort = await listen(target)
+  t.after(() => { for (const socket of targetSockets) socket.destroy(); return new Promise((resolve) => target.close(() => resolve(undefined))) })
+  const tokens = new StaticTokenStore([{username: "home", token: "gateway-token"}, {username: "app", token: "client-token"}])
+  const hub = await startReverseGatewayHub({tokens, tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile}, authorizeGateway: () => true, authorizeClientGateway: () => true, authorizeOpen: () => true})
+  t.after(() => hub.close())
+
+  assert.throws(() => new ReverseGatewayConnection({
+    gatewayId: "o2",
+    connectionId: "insecure_tls_client",
+    hub: {host: "127.0.0.1", port: hub.port, token: "client-token"},
+    tls: /** @type {{caFile: string, rejectUnauthorized: boolean}} */ ({caFile: certificates.caCertFile, rejectUnauthorized: false})
+  }), /Unsupported reverse-gateway TLS option/)
+
+  const wrongCa = new ReverseGatewayConnection({gatewayId: "o2", connectionId: "wrong_ca_client_01", hub: {host: "127.0.0.1", port: hub.port, token: "client-token"}, tls: {caFile: wrongCertificates.caCertFile, servername: "localhost"}})
+  t.after(() => wrongCa.close())
+  await assertRepeatedConnectRejection(wrongCa, "wrong CA rejection", (error) => /certificate|issuer|verify/i.test(error.message))
+
+  const tls = {caFile: certificates.caCertFile, servername: "localhost"}
+  const gateway = new OutboundReverseGateway({gatewayId: "o2", connectionId: "bounded_gateway_01", hub: {host: "127.0.0.1", port: hub.port, token: "gateway-token"}, tls, authorizeTarget: () => true, maxStreams: 1, initialWindowBytes: 8192, maxFrameBytes: 4096})
+  t.after(() => gateway.close())
+  await gateway.start()
+  const client = new ReverseGatewayConnection({gatewayId: "o2", connectionId: "bounded_client_01", hub: {host: "127.0.0.1", port: hub.port, token: "client-token"}, tls, initialWindowBytes: 8192, maxFrameBytes: 4096, maxStreamBufferBytes: 16})
+  t.after(() => client.close())
+  await client.connect()
+  const first = client.createConnection({host: "127.0.0.1", port: targetPort})
+  await onceEvent(first, "connect")
+  const second = client.createConnection({host: "127.0.0.1", port: targetPort})
+  assert.equal((await nextError(second)).code, "GATEWAY_STREAM_LIMIT")
+  assert.equal(client.status().physicalState, "ready")
+  first.destroy()
+})
+
+test("existing health-aware transport set distributes equally across three reverse members", async (t) => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-reverse-set-"))
+  t.after(() => rm(root, {recursive: true, force: true}))
+  const certificates = generateTestCertificates(root)
+  const targetSockets = new Set()
+  const target = createServer((socket) => { targetSockets.add(socket); socket.once("close", () => targetSockets.delete(socket)); socket.on("data", (chunk) => socket.write(chunk)) })
+  const targetPort = await listen(target)
+  t.after(() => { for (const socket of targetSockets) socket.destroy(); return new Promise((resolve) => target.close(() => resolve(undefined))) })
+  const gatewayIds = ["o2", "zyxel", "starlink"]
+  const tokens = new StaticTokenStore([
+    ...gatewayIds.map((gatewayId) => ({username: `home-${gatewayId}`, token: `token-${gatewayId}`})),
+    {username: "tensorbuzz", token: "tensorbuzz-token"}
+  ])
+  const hub = await startReverseGatewayHub({
+    tokens,
+    tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile},
+    knownGatewayIds: gatewayIds,
+    authorizeGateway: (/** @type {{principal: {username: string}, gatewayId: string}} */ {principal, gatewayId}) => principal.username === `home-${gatewayId}`,
+    authorizeClientGateway: (/** @type {{principal: {username: string}}} */ {principal}) => principal.username === "tensorbuzz",
+    authorizeOpen: (/** @type {{principal: {username: string}, target: {host: string, port: number}}} */ {principal, target: requested}) => principal.username === "tensorbuzz" && requested.host === "127.0.0.1" && requested.port === targetPort
+  })
+  t.after(() => hub.close())
+  const tls = {caFile: certificates.caCertFile, servername: "localhost"}
+  const gateways = gatewayIds.map((gatewayId) => new OutboundReverseGateway({
+    gatewayId,
+    connectionId: `home_${gatewayId}_member_01`,
+    hub: {host: "127.0.0.1", port: hub.port, token: `token-${gatewayId}`},
+    tls,
+    authorizeTarget: (requested) => requested.host === "127.0.0.1" && requested.port === targetPort
+  }))
+  t.after(() => Promise.all(gateways.map((gateway) => gateway.close())))
+  await Promise.all(gateways.map((gateway) => gateway.start()))
+
+  const set = new MultiplexedSocketductTransportSet({
+    connectionId: "tensorbuzz_reverse_set_01",
+    minimumReadyMembers: 3,
+    gateways: gatewayIds.map((gatewayId) => ({
+      gatewayId,
+      endpoint: {reverseHub: {host: "127.0.0.1", port: hub.port, token: "tensorbuzz-token"}, tls}
+    }))
+  })
+  t.after(() => set.close())
+  await set.start()
+  const sockets = Array.from({length: 6}, () => set.createConnection({host: "127.0.0.1", port: targetPort}))
+  await Promise.all(sockets.map((socket) => onceEvent(socket, "connect")))
+  assert.deepEqual(sockets.map((socket) => socket.gatewayId), ["o2", "zyxel", "starlink", "o2", "zyxel", "starlink"])
+  assert.deepEqual(set.status().members.map((member) => [member.gatewayId, member.assignments]), [["o2", 2], ["zyxel", 2], ["starlink", 2]])
+  assert.equal(hub.status().gatewayPhysicalConnections, 3)
+  assert.equal(hub.status().clientPhysicalConnections, 3)
+  sockets.forEach((socket) => socket.destroy())
+})