socketduct 0.1.15

package/test/integration/tcp-forwarding.test.js

@@ -0,0 +1,2878 @@
+import assert from "node:assert/strict"
+import {mkdtemp, rm} from "node:fs/promises"
+import {tmpdir} from "node:os"
+import {join} from "node:path"
+import {createConnection, createServer} from "node:net"
+import zlib from "node:zlib"
+import test from "node:test"
+
+import {InMemoryUserStore, login, TokenStore} from "../../src/auth/user-store.js"
+import {connectSocketduct} from "../../src/client/socketduct-socket.js"
+import {startTcpEdge} from "../../src/edge/tcp-edge.js"
+import {encodeCompactAck, encodeCompactData, encodeFrame as encodeEnvelope, FrameDecoder} from "../../src/protocol/frame.js"
+import {zstdAvailable} from "../../src/protocol/compression.js"
+import {startTcpRelay} from "../../src/proxy/tcp-relay.js"
+import {SessionStore} from "../../src/sessions/session.js"
+import {SessionSpool} from "../../src/spool/spool-file.js"
+
+/**
+ * Encode controls as envelopes and post-handshake stream records as compact V2.
+ * @param {import('../../src/protocol/frame.js').FrameHeader} header - Frame metadata.
+ * @param {Buffer} [payload] - Frame payload.
+ * @returns {Buffer} Encoded wire bytes.
+ */
+function encodeFrame(header, payload = Buffer.alloc(0)) {
+  if (header.type === "stream.data") {
+    return encodeCompactData({
+      sequence: /** @type {number} */ (header.sequence),
+      payload,
+      ...(header.encoding === "zstd" ? {dataLength: /** @type {number} */ (header.dataLength)} : {})
+    })
+  }
+  if (header.type === "stream.ack") return encodeCompactAck(/** @type {number} */ (header.ackSequence))
+  const framedHeader = header.type === "session.create" || header.type === "session.resume"
+    ? {...header, framing: header.framing ?? [2]}
+    : header
+  return encodeEnvelope(framedHeader, payload)
+}
+
+/**
+ * @param {import('node:net').Server} server - Server to bind.
+ * @returns {Promise<number>} - Bound port.
+ */
+async function listen(server) {
+  await new Promise((resolve, reject) => {
+    server.once("error", reject)
+    server.listen(0, "127.0.0.1", () => {
+      server.off("error", reject)
+      resolve(undefined)
+    })
+  })
+  const address = server.address()
+  if (address === null || typeof address === "string") {
+    throw new Error("Server did not bind to a TCP port")
+  }
+  return /** @type {import('node:net').AddressInfo} */ (address).port
+}
+
+/**
+ * @param {import('node:net').Socket} socket - Socket to read from.
+ * @returns {Promise<Buffer>} - Next data chunk.
+ */
+async function readOnce(socket) {
+  return new Promise((resolve) => {
+    socket.once("data", (chunk) => resolve(chunk))
+  })
+}
+
+/**
+ * @param {import('node:net').Socket} socket
+ * @param {number} [timeoutMs]
+ * @returns {Promise<Buffer>} Next socket data.
+ */
+async function readOnceWithin(socket, timeoutMs = 1_000) {
+  return await new Promise((resolve, reject) => {
+    /** @param {Buffer} chunk */
+    const onData = (chunk) => {
+      clearTimeout(timer)
+      resolve(chunk)
+    }
+    const timer = setTimeout(() => {
+      socket.off("data", onData)
+      reject(new Error("timed out waiting for socket data"))
+    }, timeoutMs)
+    socket.once("data", onData)
+  })
+}
+
+/**
+ * @param {import('node:net').Socket} socket - Socket to wait on.
+ * @returns {Promise<void>} - Resolves after connection.
+ */
+async function waitConnect(socket) {
+  await new Promise((resolve, reject) => {
+    socket.once("error", reject)
+    socket.once("connect", () => {
+      socket.off("error", reject)
+      resolve(undefined)
+    })
+  })
+}
+
+/**
+ * @param {import('node:net').Socket} socket - Socket to wait on.
+ * @returns {Promise<void>} - Resolves when closed.
+ */
+async function waitClose(socket) {
+  if (socket.destroyed) {
+    return
+  }
+  await new Promise((resolve) => {
+    socket.once("close", () => resolve(undefined))
+  })
+}
+
+/**
+ * @param {() => boolean} predicate - Condition to await.
+ * @param {number} [timeoutMs] - Maximum wait.
+ * @returns {Promise<void>} Resolves when the condition is true.
+ */
+async function waitUntil(predicate, timeoutMs = 1_000) {
+  const deadline = Date.now() + timeoutMs
+  while (!predicate()) {
+    if (Date.now() >= deadline) throw new Error("timed out waiting for condition")
+    await new Promise((resolve) => setTimeout(resolve, 5))
+  }
+}
+
+test("TCP edge relays traffic and replays spooled client data after relay reconnect", async () => {
+  const tempDir = await mkdtemp(join(tmpdir(), "socketduct-forwarding-test-"))
+  const echoServer = createServer((socket) => {
+    socket.on("data", (chunk) => socket.write(chunk))
+  })
+  const targetPort = await listen(echoServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions: new SessionStore({now: () => 1000})
+  })
+  const edge = await startTcpEdge({
+    relayHost: "127.0.0.1",
+    relayPort: relay.port,
+    token: token.value,
+    sessionName: "integration session",
+    spool: new SessionSpool({rootDir: tempDir}),
+    reconnectDelayMs: 10,
+    target: {host: "127.0.0.1", port: targetPort}
+  })
+
+  const appSocket = createConnection({host: "127.0.0.1", port: edge.port})
+  await waitConnect(appSocket)
+  appSocket.write("first")
+  assert.equal((await readOnce(appSocket)).toString("utf8"), "first")
+
+  await relay.closeActiveTunnel()
+  appSocket.write("second")
+  assert.equal((await readOnce(appSocket)).toString("utf8"), "second")
+
+  appSocket.destroy()
+  await edge.close()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    echoServer.close((error) => {
+      if (error) {
+        reject(error)
+        return
+      }
+      resolve(undefined)
+    })
+  })
+  await rm(tempDir, {recursive: true, force: true})
+})
+
+test("TCP edge includes the requested target in session create and relay connects to it", async () => {
+  const tempDir = await mkdtemp(join(tmpdir(), "socketduct-target-create-test-"))
+  let targetConnections = 0
+  const targetServer = createServer((socket) => {
+    targetConnections += 1
+    socket.on("data", (chunk) => socket.write(chunk))
+  })
+  const targetPort = await listen(targetServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+  const sessions = new SessionStore({now: () => 1000})
+  /** @type {Array<{host: string, port: number}>} */
+  const authorizedTargets = []
+
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => {
+      authorizedTargets.push(target)
+      return target.host === "127.0.0.1" && target.port === targetPort
+    },
+    tokens,
+    sessions
+  })
+  const edge = await startTcpEdge({
+    relayHost: "127.0.0.1",
+    relayPort: relay.port,
+    token: token.value,
+    sessionName: "target create session",
+    target: {host: "127.0.0.1", port: targetPort},
+    spool: new SessionSpool({rootDir: tempDir}),
+    reconnectDelayMs: 10
+  })
+
+  const appSocket = createConnection({host: "127.0.0.1", port: edge.port})
+  await waitConnect(appSocket)
+  appSocket.write("target-ok")
+  assert.equal((await readOnce(appSocket)).toString("utf8"), "target-ok")
+
+  assert.deepEqual(authorizedTargets, [{host: "127.0.0.1", port: targetPort}])
+  assert.equal(targetConnections, 1)
+
+  appSocket.destroy()
+  await edge.close()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    targetServer.close((error) => {
+      if (error) {
+        reject(error)
+        return
+      }
+      resolve(undefined)
+    })
+  })
+  await rm(tempDir, {recursive: true, force: true})
+})
+
+test("TCP relay rejects unauthorized targets during session create", async () => {
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+  const relay = await startTcpRelay({
+    authorizeTarget: () => false,
+    tokens,
+    sessions: new SessionStore({now: () => 1000})
+  })
+
+  const socket = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(socket)
+  socket.write(encodeFrame({
+    type: "session.create",
+    token: token.value,
+    name: "blocked",
+    target: {host: "127.0.0.1", port: 9}
+  }))
+  const [frame] = decoder.push(await readOnce(socket))
+  assert.equal(frame?.header.type, "error")
+  assert.equal(frame?.header.code, "TARGET_UNAUTHORIZED")
+
+  socket.destroy()
+  await relay.close()
+})
+
+test("TCP relay keeps target socket alive across tunnel reconnect", async () => {
+  let targetConnections = 0
+  const targetServer = createServer((socket) => {
+    targetConnections += 1
+    socket.on("data", (chunk) => socket.write(chunk))
+  })
+  const targetPort = await listen(targetServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions: new SessionStore({now: () => 1000}),
+    resumeWindowMs: 1_000
+  })
+
+  const firstTunnel = createConnection({host: "127.0.0.1", port: relay.port})
+  const firstDecoder = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(firstTunnel)
+  firstTunnel.write(encodeFrame({
+    type: "session.create",
+    token: token.value,
+    name: "retention-test",
+    identifier: "session-retained-target",
+    target: {host: "127.0.0.1", port: targetPort}
+  }))
+  firstDecoder.push(await readOnce(firstTunnel))
+  firstTunnel.write(encodeFrame({type: "stream.data", direction: "client-to-target", sequence: 5}, Buffer.from("first")))
+  await readOnce(firstTunnel)
+  assert.equal(targetConnections, 1)
+
+  relay.closeActiveTunnel()
+  await waitClose(firstTunnel)
+
+  const secondTunnel = createConnection({host: "127.0.0.1", port: relay.port})
+  const secondDecoder = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(secondTunnel)
+  secondTunnel.write(encodeFrame({type: "session.resume", token: token.value, identifier: "session-retained-target"}))
+  secondDecoder.push(await readOnce(secondTunnel))
+  secondTunnel.write(encodeFrame({type: "stream.data", direction: "client-to-target", sequence: 11}, Buffer.from("second")))
+
+  let echoed
+  while (echoed === undefined) {
+    for (const frame of secondDecoder.push(await readOnce(secondTunnel))) {
+      if (frame.header.type === "stream.data") {
+        echoed = frame.payload.toString("utf8")
+      }
+    }
+  }
+
+  assert.equal(echoed, "second")
+  assert.equal(targetConnections, 1)
+
+  secondTunnel.destroy()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    targetServer.close((error) => {
+      if (error) {
+        reject(error)
+        return
+      }
+      resolve(undefined)
+    })
+  })
+})
+
+test("TCP relay rejects stream data before session authentication", async () => {
+  const echoServer = createServer((socket) => {
+    socket.on("data", (chunk) => socket.write(chunk))
+  })
+  const targetPort = await listen(echoServer)
+
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens: new TokenStore(),
+    sessions: new SessionStore()
+  })
+
+  const socket = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(socket)
+  socket.write(encodeFrame({
+    type: "stream.data",
+    direction: "client-to-target",
+    sequence: 1
+  }, Buffer.from("blocked")))
+
+  const frames = decoder.push(await readOnce(socket))
+  const [frame] = frames
+  if (frame === undefined) {
+    throw new Error("Relay did not return an error frame")
+  }
+  assert.equal(frame.header.type, "error")
+  assert.equal(frame.header.code, "AUTH_REQUIRED")
+
+  socket.destroy()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    echoServer.close((error) => {
+      if (error) {
+        reject(error)
+        return
+      }
+      resolve(undefined)
+    })
+  })
+})
+
+test("TCP relay closes malformed frames without crashing the server", async () => {
+  const echoServer = createServer((socket) => {
+    socket.on("data", (chunk) => socket.write(chunk))
+  })
+  const targetPort = await listen(echoServer)
+
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens: new TokenStore(),
+    sessions: new SessionStore()
+  })
+
+  const malformed = createConnection({host: "127.0.0.1", port: relay.port})
+  await waitConnect(malformed)
+  malformed.write(Buffer.alloc(4))
+  await new Promise((resolve) => { setTimeout(resolve, 20) })
+  malformed.destroy()
+
+  const healthy = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(healthy)
+  healthy.write(encodeFrame({type: "stream.data", direction: "client-to-target", sequence: 1}, Buffer.from("blocked")))
+  const [frame] = decoder.push(await readOnce(healthy))
+  if (frame === undefined) {
+    throw new Error("Relay did not return an error frame after malformed input")
+  }
+  assert.equal(frame.header.type, "error")
+  assert.equal(frame.header.code, "AUTH_REQUIRED")
+
+  healthy.destroy()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    echoServer.close((error) => {
+      if (error) {
+        reject(error)
+        return
+      }
+      resolve(undefined)
+    })
+  })
+})
+
+test("TCP relay persists committed client sequence before acknowledging writes", async () => {
+  const echoServer = createServer((socket) => {
+    socket.resume()
+  })
+  const targetPort = await listen(echoServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+  const sessions = new SessionStore({now: () => 1000})
+
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions
+  })
+
+  const socket = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(socket)
+  socket.write(encodeFrame({type: "session.create", token: token.value, name: "seq-test", identifier: "session-seq", target: {host: "127.0.0.1", port: targetPort}}))
+  decoder.push(await readOnce(socket))
+  socket.write(encodeFrame({type: "stream.data", direction: "client-to-target", session: "session-seq", sequence: 5}, Buffer.from("hello")))
+
+  let acked = false
+  while (!acked) {
+    for (const frame of decoder.push(await readOnce(socket))) {
+      if (frame.header.type === "stream.ack" && frame.header.direction === "client-to-target") {
+        acked = true
+      }
+    }
+  }
+
+  assert.equal(sessions.get("session-seq")?.clientSequence, 5)
+
+  socket.destroy()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    echoServer.close((error) => {
+      if (error) {
+        reject(error)
+        return
+      }
+      resolve(undefined)
+    })
+  })
+})
+
+test("TCP relay buffers target bytes while a resumable tunnel is down", async () => {
+  /** @type {import('node:net').Socket | undefined} */
+  let targetSocket
+  const targetServer = createServer((socket) => {
+    targetSocket = socket
+    socket.resume()
+  })
+  const targetPort = await listen(targetServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+  const sessions = new SessionStore({now: () => 1000})
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions,
+    resumeWindowMs: 1_000
+  })
+
+  const firstTunnel = createConnection({host: "127.0.0.1", port: relay.port})
+  const firstDecoder = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(firstTunnel)
+  firstTunnel.write(encodeFrame({type: "session.create", token: token.value, name: "buffer-test", identifier: "session-buffer", target: {host: "127.0.0.1", port: targetPort}}))
+  firstDecoder.push(await readOnce(firstTunnel))
+
+  relay.closeActiveTunnel()
+  await waitClose(firstTunnel)
+  targetSocket?.write("during-drop")
+
+  const secondTunnel = createConnection({host: "127.0.0.1", port: relay.port})
+  const secondDecoder = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(secondTunnel)
+  secondTunnel.write(encodeFrame({type: "session.resume", token: token.value, identifier: "session-buffer"}))
+
+  let received
+  while (received === undefined) {
+    for (const frame of secondDecoder.push(await readOnce(secondTunnel))) {
+      if (frame.header.type === "stream.data") {
+        received = frame.payload.toString("utf8")
+      }
+    }
+  }
+
+  assert.equal(received, "during-drop")
+  assert.equal(sessions.get("session-buffer")?.relaySequence, "during-drop".length)
+
+  secondTunnel.destroy()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    targetServer.close((error) => {
+      if (error) {
+        reject(error)
+        return
+      }
+      resolve(undefined)
+    })
+  })
+})
+
+test("TCP relay ignores stale tunnel data after session resume", async () => {
+  /** @type {string[]} */
+  const targetWrites = []
+  const targetServer = createServer((socket) => {
+    socket.on("data", (chunk) => {
+      targetWrites.push(chunk.toString("utf8"))
+      socket.write(chunk)
+    })
+  })
+  const targetPort = await listen(targetServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+  const sessions = new SessionStore({now: () => 1000})
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions,
+    resumeWindowMs: 1_000
+  })
+
+  const tunnelA = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoderA = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(tunnelA)
+  tunnelA.write(encodeFrame({
+    type: "session.create",
+    token: token.value,
+    name: "authority-test",
+    identifier: "session-authority",
+    target: {host: "127.0.0.1", port: targetPort}
+  }))
+  decoderA.push(await readOnce(tunnelA))
+  tunnelA.write(encodeFrame({type: "stream.data", direction: "client-to-target", sequence: 5}, Buffer.from("first")))
+  let firstEcho
+  while (firstEcho === undefined) {
+    for (const frame of decoderA.push(await readOnce(tunnelA))) {
+      if (frame.header.type === "stream.data") {
+        firstEcho = frame.payload.toString("utf8")
+      }
+    }
+  }
+  assert.equal(firstEcho, "first")
+
+  const tunnelB = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoderB = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(tunnelB)
+  tunnelB.write(encodeFrame({type: "session.resume", token: token.value, identifier: "session-authority"}))
+  decoderB.push(await readOnce(tunnelB))
+
+  tunnelA.write(encodeFrame({type: "stream.data", direction: "client-to-target", sequence: 999}, Buffer.from("stale")))
+
+  const staleResponse = await Promise.race([
+    readOnce(tunnelA).then(() => "data"),
+    new Promise((resolve) => setTimeout(() => resolve("timeout"), 200))
+  ])
+  assert.equal(staleResponse, "timeout", "stale tunnel must not receive ack")
+
+  tunnelB.write(encodeFrame({type: "stream.data", direction: "client-to-target", sequence: 10}, Buffer.from("legit")))
+  let legitEcho
+  while (legitEcho === undefined) {
+    for (const frame of decoderB.push(await readOnce(tunnelB))) {
+      if (frame.header.type === "stream.data") {
+        legitEcho = frame.payload.toString("utf8")
+      }
+    }
+  }
+  assert.equal(legitEcho, "legit")
+
+  assert.deepEqual(targetWrites, ["first", "legit"])
+  assert.equal(sessions.get("session-authority")?.clientSequence, 10)
+
+  tunnelA.destroy()
+  tunnelB.write(encodeFrame({type: "stream.data", direction: "client-to-target", sequence: 21}, Buffer.from("after-close")))
+  let afterCloseEcho
+  while (afterCloseEcho === undefined) {
+    for (const frame of decoderB.push(await readOnce(tunnelB))) {
+      if (frame.header.type === "stream.data") {
+        afterCloseEcho = frame.payload.toString("utf8")
+      }
+    }
+  }
+  assert.equal(afterCloseEcho, "after-close")
+  assert.deepEqual(targetWrites, ["first", "legit", "after-close"])
+
+  tunnelB.destroy()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    targetServer.close((error) => {
+      if (error) {
+        reject(error)
+        return
+      }
+      resolve(undefined)
+    })
+  })
+})
+
+test("TCP relay ignores stale tunnel target-to-client ACK after session resume", async () => {
+  const echoServer = createServer((socket) => {
+    socket.on("data", (chunk) => socket.write(chunk))
+  })
+  const targetPort = await listen(echoServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+  const sessions = new SessionStore({now: () => 1000})
+
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions,
+    resumeWindowMs: 2_000
+  })
+
+  const tunnel1 = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder1 = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(tunnel1)
+  tunnel1.write(encodeFrame({
+    type: "session.create",
+    token: token.value,
+    name: "stale-ack-test",
+    identifier: "session-stale-ack",
+    target: {host: "127.0.0.1", port: targetPort}
+  }))
+  decoder1.push(await readOnce(tunnel1))
+
+  tunnel1.write(encodeFrame({type: "stream.data", direction: "client-to-target", sequence: 5}, Buffer.from("alpha")))
+  /** @type {string[]} */
+  const tunnel1Chunks = []
+  while (tunnel1Chunks.length < 1) {
+    for (const frame of decoder1.push(await readOnce(tunnel1))) {
+      if (frame.header.type === "stream.data" && frame.header.direction === "target-to-client") {
+        tunnel1Chunks.push(frame.payload.toString("utf8"))
+      }
+    }
+  }
+
+  tunnel1.write(encodeFrame({type: "stream.data", direction: "client-to-target", sequence: 10}, Buffer.from("bravo")))
+  while (tunnel1Chunks.length < 2) {
+    for (const frame of decoder1.push(await readOnce(tunnel1))) {
+      if (frame.header.type === "stream.data" && frame.header.direction === "target-to-client") {
+        tunnel1Chunks.push(frame.payload.toString("utf8"))
+      }
+    }
+  }
+
+  const tunnel2 = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder2 = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(tunnel2)
+  tunnel2.write(encodeFrame({type: "session.resume", token: token.value, identifier: "session-stale-ack"}))
+
+  let resumed2 = false
+  const replayed2 = []
+  while (!resumed2 || replayed2.length < 2) {
+    for (const frame of decoder2.push(await readOnce(tunnel2))) {
+      if (frame.header.type === "session.resumed") {
+        resumed2 = true
+      }
+      if (frame.header.type === "stream.data" && frame.header.direction === "target-to-client") {
+        replayed2.push(frame.payload.toString("utf8"))
+      }
+    }
+  }
+  assert.deepEqual(replayed2, ["alpha", "bravo"])
+
+  const bravoRelaySeq = sessions.get("session-stale-ack")?.relaySequence ?? 0
+  assert.ok(bravoRelaySeq > 0, "relaySequence must be > 0 after two echoed chunks")
+
+  tunnel1.write(encodeFrame({type: "stream.ack", direction: "target-to-client", ackSequence: bravoRelaySeq}))
+
+  await new Promise((resolve) => { setTimeout(resolve, 100) })
+
+  tunnel2.destroy()
+  await waitClose(tunnel2)
+
+  const tunnel3 = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder3 = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(tunnel3)
+  tunnel3.write(encodeFrame({type: "session.resume", token: token.value, identifier: "session-stale-ack"}))
+
+  let resumed3 = false
+  const replayed3 = []
+  while (!resumed3 || replayed3.length < 2) {
+    for (const frame of decoder3.push(await readOnce(tunnel3))) {
+      if (frame.header.type === "session.resumed") {
+        resumed3 = true
+      }
+      if (frame.header.type === "stream.data" && frame.header.direction === "target-to-client") {
+        replayed3.push(frame.payload.toString("utf8"))
+      }
+    }
+  }
+  assert.deepEqual(replayed3, ["alpha", "bravo"])
+
+  tunnel1.destroy()
+  tunnel3.destroy()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    echoServer.close((error) => {
+      if (error) {
+        reject(error)
+        return
+      }
+      resolve(undefined)
+    })
+  })
+})
+
+test("TCP edge closes the app socket when relay rejects the session", async () => {
+  const echoServer = createServer((socket) => {
+    socket.on("data", (chunk) => socket.write(chunk))
+  })
+  const targetPort = await listen(echoServer)
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens: new TokenStore(),
+    sessions: new SessionStore()
+  })
+  const tempDir = await mkdtemp(join(tmpdir(), "socketduct-invalid-token-test-"))
+  const edge = await startTcpEdge({
+    relayHost: "127.0.0.1",
+    relayPort: relay.port,
+    token: "invalid-token",
+    sessionName: "invalid session",
+    spool: new SessionSpool({rootDir: tempDir}),
+    reconnectDelayMs: 10,
+    target: {host: "127.0.0.1", port: targetPort}
+  })
+
+  const appSocket = createConnection({host: "127.0.0.1", port: edge.port})
+  await waitConnect(appSocket)
+  appSocket.write("blocked")
+  await waitClose(appSocket)
+
+  await edge.close()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    echoServer.close((error) => {
+      if (error) {
+        reject(error)
+        return
+      }
+      resolve(undefined)
+    })
+  })
+  await rm(tempDir, {recursive: true, force: true})
+})
+
+test("TCP relay replays target-to-client data not acknowledged before tunnel disconnect", async () => {
+  const echoServer = createServer((socket) => {
+    socket.on("data", (chunk) => socket.write(chunk))
+  })
+  const targetPort = await listen(echoServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+  const sessions = new SessionStore({now: () => 1000})
+
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions,
+    resumeWindowMs: 2_000
+  })
+
+  const tunnel1 = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder1 = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(tunnel1)
+  tunnel1.write(encodeFrame({
+    type: "session.create",
+    token: token.value,
+    name: "replay-test",
+    identifier: "session-replay",
+    target: {host: "127.0.0.1", port: targetPort}
+  }))
+  decoder1.push(await readOnce(tunnel1))
+
+  tunnel1.write(encodeFrame({type: "stream.data", direction: "client-to-target", sequence: 5}, Buffer.from("alpha")))
+  let alphaEcho
+  while (alphaEcho === undefined) {
+    for (const frame of decoder1.push(await readOnce(tunnel1))) {
+      if (frame.header.type === "stream.data" && frame.header.direction === "target-to-client") {
+        alphaEcho = frame.payload.toString("utf8")
+      }
+    }
+  }
+  assert.equal(alphaEcho, "alpha")
+
+  tunnel1.write(encodeFrame({type: "stream.data", direction: "client-to-target", sequence: 10}, Buffer.from("bravo")))
+  let bravoEcho
+  while (bravoEcho === undefined) {
+    for (const frame of decoder1.push(await readOnce(tunnel1))) {
+      if (frame.header.type === "stream.data" && frame.header.direction === "target-to-client") {
+        bravoEcho = frame.payload.toString("utf8")
+      }
+    }
+  }
+  assert.equal(bravoEcho, "bravo")
+
+  tunnel1.destroy()
+  await waitClose(tunnel1)
+
+  const tunnel2 = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder2 = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(tunnel2)
+  tunnel2.write(encodeFrame({type: "session.resume", token: token.value, identifier: "session-replay"}))
+
+  let resumed
+  /** @type {string[]} */
+  const replayedChunks = []
+  while (resumed === undefined || replayedChunks.length < 2) {
+    for (const frame of decoder2.push(await readOnce(tunnel2))) {
+      if (frame.header.type === "session.resumed") {
+        resumed = true
+      }
+      if (frame.header.type === "stream.data" && frame.header.direction === "target-to-client") {
+        replayedChunks.push(frame.payload.toString("utf8"))
+      }
+    }
+  }
+
+  assert.deepEqual(replayedChunks, ["alpha", "bravo"])
+  assert.equal(sessions.get("session-replay")?.relaySequence, 10)
+
+  tunnel2.destroy()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    echoServer.close((error) => {
+      if (error) {
+        reject(error)
+        return
+      }
+      resolve(undefined)
+    })
+  })
+})
+
+test("TCP relay delivers buffered data then session.close when target closes while tunnel is detached", async () => {
+  let targetConnectionCount = 0
+  /** @type {import('node:net').Socket | undefined} */
+  let heldTargetSocket
+  const targetServer = createServer((socket) => {
+    targetConnectionCount += 1
+    heldTargetSocket = socket
+    socket.on("data", (chunk) => socket.write(chunk))
+  })
+  const targetPort = await listen(targetServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+  const sessions = new SessionStore({now: () => 1000})
+
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions,
+    resumeWindowMs: 2_000
+  })
+
+  const tunnel1 = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder1 = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(tunnel1)
+  tunnel1.write(encodeFrame({
+    type: "session.create",
+    token: token.value,
+    name: "eof-test",
+    identifier: "session-eof",
+    target: {host: "127.0.0.1", port: targetPort}
+  }))
+  decoder1.push(await readOnce(tunnel1))
+  tunnel1.write(encodeFrame({type: "stream.data", direction: "client-to-target", sequence: 4}, Buffer.from("ping")))
+  let pingEcho
+  while (pingEcho === undefined) {
+    for (const frame of decoder1.push(await readOnce(tunnel1))) {
+      if (frame.header.type === "stream.data" && frame.header.direction === "target-to-client") {
+        pingEcho = frame.payload.toString("utf8")
+      }
+    }
+  }
+  assert.equal(pingEcho, "ping")
+  assert.equal(targetConnectionCount, 1)
+
+  relay.closeActiveTunnel()
+  await waitClose(tunnel1)
+
+  if (heldTargetSocket !== undefined) {
+    heldTargetSocket.write("final")
+    heldTargetSocket.end()
+    await waitClose(heldTargetSocket)
+  }
+
+  const tunnel2 = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder2 = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(tunnel2)
+  tunnel2.write(encodeFrame({type: "session.resume", token: token.value, identifier: "session-eof", targetToClientAck: 0}))
+
+  let resumed = false
+  /** @type {string[]} */
+  const targetChunks = []
+  let gotClose = false
+  while (!resumed || !gotClose) {
+    for (const frame of decoder2.push(await readOnce(tunnel2))) {
+      if (frame.header.type === "session.resumed") {
+        resumed = true
+      }
+      if (frame.header.type === "stream.data" && frame.header.direction === "target-to-client") {
+        targetChunks.push(frame.payload.toString("utf8"))
+      }
+      if (frame.header.type === "session.close") {
+        gotClose = true
+      }
+    }
+  }
+
+  assert.deepEqual(targetChunks, ["ping", "final"])
+  assert.equal(gotClose, true)
+  assert.equal(targetConnectionCount, 1)
+
+  await new Promise((resolve) => { setTimeout(resolve, 200) })
+  assert.equal(targetConnectionCount, 1)
+
+  tunnel2.destroy()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    targetServer.close((error) => {
+      if (error) {
+        reject(error)
+        return
+      }
+      resolve(undefined)
+    })
+  })
+})
+
+test("TCP relay replays buffered target-to-client data within the per-session byte limit after reconnect", async () => {
+  /** @type {import('node:net').Socket | undefined} */
+  let targetSocket
+  const targetServer = createServer((socket) => {
+    targetSocket = socket
+    socket.resume()
+  })
+  const targetPort = await listen(targetServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+  const sessions = new SessionStore({now: () => 1000})
+
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions,
+    resumeWindowMs: 2_000,
+    maxTargetBufferBytes: 100
+  })
+
+  const tunnel1 = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder1 = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(tunnel1)
+  tunnel1.write(encodeFrame({
+    type: "session.create",
+    token: token.value,
+    name: "buffer-limit-test",
+    identifier: "session-buf-limit",
+    target: {host: "127.0.0.1", port: targetPort}
+  }))
+  decoder1.push(await readOnce(tunnel1))
+
+  relay.closeActiveTunnel()
+  await waitClose(tunnel1)
+
+  const withinLimitPayload = Buffer.alloc(80, 0x41)
+  targetSocket?.write(withinLimitPayload)
+
+  const tunnel2 = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder2 = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(tunnel2)
+  tunnel2.write(encodeFrame({
+    type: "session.resume",
+    token: token.value,
+    identifier: "session-buf-limit"
+  }))
+
+  let resumed = false
+  /** @type {Buffer[]} */
+  const receivedChunks = []
+  while (!resumed || receivedChunks.length < 1) {
+    for (const frame of decoder2.push(await readOnce(tunnel2))) {
+      if (frame.header.type === "session.resumed") {
+        resumed = true
+      }
+      if (frame.header.type === "stream.data" && frame.header.direction === "target-to-client") {
+        receivedChunks.push(frame.payload)
+      }
+    }
+  }
+
+  assert.equal(receivedChunks.length, 1)
+  const firstChunk = /** @type {Buffer} */ (receivedChunks[0])
+  assert.equal(firstChunk.length, 80)
+  assert.deepEqual(firstChunk, withinLimitPayload)
+
+  tunnel2.destroy()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    targetServer.close((error) => {
+      if (error) {
+        reject(error)
+        return
+      }
+      resolve(undefined)
+    })
+  })
+})
+
+test("TCP relay terminates session with nonretryable TARGET_BUFFER_OVERFLOW when per-session buffer limit is exceeded", async () => {
+  /** @type {import('node:net').Socket | undefined} */
+  let targetSocket
+  const targetServer = createServer((socket) => {
+    targetSocket = socket
+    socket.resume()
+  })
+  const targetPort = await listen(targetServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+  const sessions = new SessionStore({now: () => 1000})
+
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions,
+    resumeWindowMs: 2_000,
+    maxTargetBufferBytes: 10
+  })
+
+  const tunnel1 = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder1 = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(tunnel1)
+  tunnel1.write(encodeFrame({
+    type: "session.create",
+    token: token.value,
+    name: "overflow-test",
+    identifier: "session-overflow",
+    target: {host: "127.0.0.1", port: targetPort}
+  }))
+  decoder1.push(await readOnce(tunnel1))
+
+  relay.closeActiveTunnel()
+  await waitClose(tunnel1)
+
+  const overflowPayload = Buffer.alloc(128, 0x42)
+  targetSocket?.write(overflowPayload)
+
+  await new Promise((resolve) => { setTimeout(resolve, 100) })
+
+  const tunnel2 = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder2 = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(tunnel2)
+  tunnel2.write(encodeFrame({
+    type: "session.resume",
+    token: token.value,
+    identifier: "session-overflow"
+  }))
+
+  let resumed = false
+  /** @type {Array<{type: string, code?: string, retryable?: boolean}>} */
+  const receivedFrames = []
+  while (!resumed) {
+    for (const frame of decoder2.push(await readOnce(tunnel2))) {
+      receivedFrames.push(frame.header)
+      if (frame.header.type === "session.resumed") {
+        resumed = true
+      }
+    }
+  }
+
+  const errorFrame = receivedFrames.find((f) => f.type === "error")
+  assert.ok(errorFrame !== undefined, "expected an error frame after reconnect for overflow session")
+  assert.equal(errorFrame?.code, "TARGET_BUFFER_OVERFLOW")
+  assert.equal(errorFrame?.retryable, false)
+
+  tunnel2.destroy()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    targetServer.close((error) => {
+      if (error) {
+        reject(error)
+        return
+      }
+      resolve(undefined)
+    })
+  })
+})
+
+test("TCP relay enforces process-wide total buffer limit across two detached sessions: first resumes, second gets TARGET_BUFFER_OVERFLOW", async () => {
+  /** @type {import('node:net').Socket | undefined} */
+  let targetSocket1
+  const targetServer1 = createServer((socket) => {
+    targetSocket1 = socket
+    socket.resume()
+  })
+  const targetPort1 = await listen(targetServer1)
+
+  /** @type {import('node:net').Socket | undefined} */
+  let targetSocket2
+  const targetServer2 = createServer((socket) => {
+    targetSocket2 = socket
+    socket.resume()
+  })
+  const targetPort2 = await listen(targetServer2)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+  const sessions = new SessionStore({now: () => 1000})
+
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) =>
+      target.host === "127.0.0.1" && (target.port === targetPort1 || target.port === targetPort2),
+    tokens,
+    sessions,
+    resumeWindowMs: 2_000,
+    maxTargetBufferBytes: 100,
+    maxTotalBufferBytes: 150
+  })
+
+  const tunnel1 = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder1 = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(tunnel1)
+  tunnel1.write(encodeFrame({
+    type: "session.create",
+    token: token.value,
+    name: "proc-limit-s1",
+    identifier: "proc-limit-s1",
+    target: {host: "127.0.0.1", port: targetPort1}
+  }))
+  decoder1.push(await readOnce(tunnel1))
+
+  const tunnel2 = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder2 = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(tunnel2)
+  tunnel2.write(encodeFrame({
+    type: "session.create",
+    token: token.value,
+    name: "proc-limit-s2",
+    identifier: "proc-limit-s2",
+    target: {host: "127.0.0.1", port: targetPort2}
+  }))
+  decoder2.push(await readOnce(tunnel2))
+
+  relay.closeActiveTunnel()
+  await waitClose(tunnel1)
+  await waitClose(tunnel2)
+
+  const s1Payload = Buffer.alloc(80, 0x41)
+  const s2Payload = Buffer.alloc(80, 0x42)
+  targetSocket1?.write(s1Payload)
+  await new Promise((resolve) => { setTimeout(resolve, 50) })
+  targetSocket2?.write(s2Payload)
+  await new Promise((resolve) => { setTimeout(resolve, 50) })
+
+  const tunnel3 = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder3 = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(tunnel3)
+  tunnel3.write(encodeFrame({type: "session.resume", token: token.value, identifier: "proc-limit-s1"}))
+
+  let resumed1 = false
+  const s1Received = []
+  while (!resumed1 || s1Received.length < 1) {
+    for (const frame of decoder3.push(await readOnce(tunnel3))) {
+      if (frame.header.type === "session.resumed") {
+        resumed1 = true
+      }
+      if (frame.header.type === "stream.data" && frame.header.direction === "target-to-client") {
+        s1Received.push(frame.payload)
+      }
+    }
+  }
+
+  assert.equal(s1Received.length, 1)
+  const s1Chunk = /** @type {Buffer} */ (s1Received[0])
+  assert.equal(s1Chunk.length, 80)
+  assert.deepEqual(s1Chunk, s1Payload)
+
+  tunnel3.destroy()
+
+  const tunnel4 = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder4 = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(tunnel4)
+  tunnel4.write(encodeFrame({type: "session.resume", token: token.value, identifier: "proc-limit-s2"}))
+
+  let resumed2 = false
+  /** @type {Array<{type: string, code?: string, retryable?: boolean, message?: string, direction?: string}>} */
+  const s2Headers = []
+  while (!resumed2) {
+    for (const frame of decoder4.push(await readOnce(tunnel4))) {
+      s2Headers.push(frame.header)
+      if (frame.header.type === "session.resumed") {
+        resumed2 = true
+      }
+    }
+  }
+
+  const errorHeader = s2Headers.find((h) => h.type === "error")
+  assert.ok(errorHeader !== undefined, "expected error frame after resume for overflowed session")
+  assert.equal(errorHeader?.code, "TARGET_BUFFER_OVERFLOW")
+  assert.equal(errorHeader?.retryable, false)
+  assert.ok(
+    typeof errorHeader?.message === "string" && errorHeader.message.includes("Process-wide"),
+    `message should reference Process-wide limit, got: ${errorHeader?.message}`
+  )
+
+  const s2DataHeaders = s2Headers.filter((h) => h.type === "stream.data" && h.direction === "target-to-client")
+  assert.equal(s2DataHeaders.length, 0, "overflowed session must not receive stream.data from a replacement target")
+
+  tunnel4.destroy()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    targetServer1.close((error) => {
+      if (error) { reject(error); return }
+      resolve(undefined)
+    })
+  })
+  await new Promise((resolve, reject) => {
+    targetServer2.close((error) => {
+      if (error) { reject(error); return }
+      resolve(undefined)
+    })
+  })
+})
+
+test("TCP relay rejects a spoofed compact marker on a length-prefixed stream.data after a v2 handshake", async () => {
+  const echoServer = createServer((socket) => {
+    socket.on("data", (chunk) => socket.write(chunk))
+  })
+  const targetPort = await listen(echoServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+  const sessions = new SessionStore({now: () => 1000})
+
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions
+  })
+
+  const socket = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(socket)
+  socket.write(encodeFrame({
+    type: "session.create",
+    token: token.value,
+    name: "neg-seq-test",
+    identifier: "session-neg-seq",
+    target: {host: "127.0.0.1", port: targetPort}
+  }))
+  decoder.push(await readOnce(socket))
+
+  socket.write(encodeEnvelope({
+    type: "stream.data",
+    direction: "client-to-target",
+    sequence: -5,
+    compact: true
+  }, Buffer.from("negdata")))
+
+  let errorFrame
+  while (errorFrame === undefined) {
+    for (const frame of decoder.push(await readOnce(socket))) {
+      if (frame.header.type === "error") {
+        errorFrame = frame.header
+      }
+    }
+  }
+  assert.equal(errorFrame?.code, "PROTOCOL_VIOLATION")
+  assert.ok(
+    typeof errorFrame?.message === "string" && errorFrame.message.includes("Length-prefixed stream.data"),
+    `unexpected message: ${errorFrame?.message}`
+  )
+
+  assert.equal(sessions.get("session-neg-seq")?.clientSequence, 0)
+
+  socket.destroy()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    echoServer.close((error) => {
+      if (error) { reject(error); return }
+      resolve(undefined)
+    })
+  })
+})
+
+test("TCP relay rejects length-prefixed stream.ack after a v2 handshake", async () => {
+  const echoServer = createServer((socket) => {
+    socket.on("data", (chunk) => socket.write(chunk))
+  })
+  const targetPort = await listen(echoServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+  const sessions = new SessionStore({now: () => 1000})
+
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions
+  })
+
+  const socket = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(socket)
+  socket.write(encodeFrame({
+    type: "session.create",
+    token: token.value,
+    name: "nan-seq-test",
+    identifier: "session-nan-seq",
+    target: {host: "127.0.0.1", port: targetPort}
+  }))
+  decoder.push(await readOnce(socket))
+
+  socket.write(encodeEnvelope({
+    type: "stream.ack",
+    direction: "target-to-client",
+    ackSequence: 0,
+    compact: true
+  }))
+
+  let errorFrame
+  while (errorFrame === undefined) {
+    for (const frame of decoder.push(await readOnceWithin(socket))) {
+      if (frame.header.type === "error") {
+        errorFrame = frame.header
+      }
+    }
+  }
+  assert.equal(errorFrame?.code, "PROTOCOL_VIOLATION")
+  assert.match(String(errorFrame?.message), /Length-prefixed stream\.ack/)
+  assert.equal(sessions.get("session-nan-seq")?.clientSequence, 0)
+
+  socket.destroy()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    echoServer.close((error) => {
+      if (error) { reject(error); return }
+      resolve(undefined)
+    })
+  })
+})
+
+test("TCP relay rejects a length-prefixed stream.data regardless of envelope sequence metadata", async () => {
+  const echoServer = createServer((socket) => {
+    socket.on("data", (chunk) => socket.write(chunk))
+  })
+  const targetPort = await listen(echoServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+  const sessions = new SessionStore({now: () => 1000})
+
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions
+  })
+
+  const socket = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(socket)
+  socket.write(encodeFrame({
+    type: "session.create",
+    token: token.value,
+    name: "unsafe-seq-test",
+    identifier: "session-unsafe-seq",
+    target: {host: "127.0.0.1", port: targetPort}
+  }))
+  decoder.push(await readOnce(socket))
+
+  socket.write(encodeEnvelope({
+    type: "stream.data",
+    direction: "client-to-target",
+    sequence: Number.MAX_SAFE_INTEGER + 1
+  }, Buffer.from("toobig")))
+
+  let errorFrame
+  while (errorFrame === undefined) {
+    for (const frame of decoder.push(await readOnce(socket))) {
+      if (frame.header.type === "error") {
+        errorFrame = frame.header
+      }
+    }
+  }
+  assert.equal(errorFrame?.code, "PROTOCOL_VIOLATION")
+  assert.equal(sessions.get("session-unsafe-seq")?.clientSequence, 0)
+
+  socket.destroy()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    echoServer.close((error) => {
+      if (error) { reject(error); return }
+      resolve(undefined)
+    })
+  })
+})
+
+test("TCP relay rejects stream.data with a gapped client-to-target sequence and does not write the target", async () => {
+  /** @type {string[]} */
+  const targetWrites = []
+  const targetServer = createServer((socket) => {
+    socket.on("data", (chunk) => {
+      targetWrites.push(chunk.toString("utf8"))
+      socket.write(chunk)
+    })
+  })
+  const targetPort = await listen(targetServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+  const sessions = new SessionStore({now: () => 1000})
+
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions
+  })
+
+  const socket = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(socket)
+  socket.write(encodeFrame({
+    type: "session.create",
+    token: token.value,
+    name: "gap-test",
+    identifier: "session-gap",
+    target: {host: "127.0.0.1", port: targetPort}
+  }))
+  decoder.push(await readOnce(socket))
+
+  socket.write(encodeFrame({
+    type: "stream.data",
+    direction: "client-to-target",
+    sequence: 12
+  }, Buffer.from("gapped")))
+
+  let errorFrame
+  while (errorFrame === undefined) {
+    for (const frame of decoder.push(await readOnce(socket))) {
+      if (frame.header.type === "error") {
+        errorFrame = frame.header
+      }
+    }
+  }
+  assert.equal(errorFrame?.code, "PROTOCOL_VIOLATION")
+  assert.ok(
+    typeof errorFrame?.message === "string" && errorFrame.message.includes("gap"),
+    `unexpected message: ${errorFrame?.message}`
+  )
+
+  assert.deepEqual(targetWrites, [])
+  assert.equal(sessions.get("session-gap")?.clientSequence, 0)
+
+  socket.destroy()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    targetServer.close((error) => {
+      if (error) { reject(error); return }
+      resolve(undefined)
+    })
+  })
+})
+
+test("TCP relay rejects stream.data with an overlapping client-to-target sequence and does not mutate state", async () => {
+  /** @type {string[]} */
+  const targetWrites = []
+  const targetServer = createServer((socket) => {
+    socket.on("data", (chunk) => {
+      targetWrites.push(chunk.toString("utf8"))
+      socket.write(chunk)
+    })
+  })
+  const targetPort = await listen(targetServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+  const sessions = new SessionStore({now: () => 1000})
+
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions
+  })
+
+  const socket = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(socket)
+  socket.write(encodeFrame({
+    type: "session.create",
+    token: token.value,
+    name: "overlap-test",
+    identifier: "session-overlap",
+    target: {host: "127.0.0.1", port: targetPort}
+  }))
+  decoder.push(await readOnce(socket))
+
+  socket.write(encodeFrame({
+    type: "stream.data",
+    direction: "client-to-target",
+    sequence: 10
+  }, Buffer.from("1234567890")))
+
+  let acked = false
+  while (!acked) {
+    for (const frame of decoder.push(await readOnce(socket))) {
+      if (frame.header.type === "stream.ack" && frame.header.direction === "client-to-target") {
+        acked = true
+      }
+    }
+  }
+  assert.deepEqual(targetWrites, ["1234567890"])
+  assert.equal(sessions.get("session-overlap")?.clientSequence, 10)
+
+  socket.write(encodeFrame({
+    type: "stream.data",
+    direction: "client-to-target",
+    sequence: 13
+  }, Buffer.from("abcdef")))
+
+  let errorFrame
+  while (errorFrame === undefined) {
+    for (const frame of decoder.push(await readOnce(socket))) {
+      if (frame.header.type === "error") {
+        errorFrame = frame.header
+      }
+    }
+  }
+  assert.equal(errorFrame?.code, "PROTOCOL_VIOLATION")
+  assert.ok(
+    typeof errorFrame?.message === "string" && errorFrame.message.includes("overlap"),
+    `unexpected message: ${errorFrame?.message}`
+  )
+  assert.equal(sessions.get("session-overlap")?.clientSequence, 10)
+
+  socket.destroy()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    targetServer.close((error) => {
+      if (error) { reject(error); return }
+      resolve(undefined)
+    })
+  })
+})
+
+test("TCP relay acks an already-committed duplicate client-to-target sequence without writing the target", async () => {
+  /** @type {string[]} */
+  const targetWrites = []
+  const targetServer = createServer((socket) => {
+    socket.on("data", (chunk) => {
+      targetWrites.push(chunk.toString("utf8"))
+      socket.write(chunk)
+    })
+  })
+  const targetPort = await listen(targetServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+  const sessions = new SessionStore({now: () => 1000})
+
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions
+  })
+
+  const socket = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(socket)
+  socket.write(encodeFrame({
+    type: "session.create",
+    token: token.value,
+    name: "dup-test",
+    identifier: "session-dup",
+    target: {host: "127.0.0.1", port: targetPort}
+  }))
+  decoder.push(await readOnce(socket))
+
+  socket.write(encodeFrame({
+    type: "stream.data",
+    direction: "client-to-target",
+    sequence: 5
+  }, Buffer.from("hello")))
+
+  let acked = false
+  while (!acked) {
+    for (const frame of decoder.push(await readOnce(socket))) {
+      if (frame.header.type === "stream.ack" && frame.header.direction === "client-to-target") {
+        acked = true
+      }
+    }
+  }
+  assert.deepEqual(targetWrites, ["hello"])
+  assert.equal(sessions.get("session-dup")?.clientSequence, 5)
+
+  socket.write(encodeFrame({
+    type: "stream.data",
+    direction: "client-to-target",
+    sequence: 5
+  }, Buffer.from("hello")))
+
+  let dupAck = false
+  let dupError = false
+  while (!dupAck && !dupError) {
+    for (const frame of decoder.push(await readOnce(socket))) {
+      if (frame.header.type === "stream.ack" && frame.header.direction === "client-to-target" && frame.header.ackSequence === 5) {
+        dupAck = true
+      }
+      if (frame.header.type === "error") {
+        dupError = true
+      }
+    }
+  }
+  assert.ok(dupAck, "duplicate frame must receive ack")
+  assert.equal(dupError, false, "duplicate frame must not receive an error")
+  assert.deepEqual(targetWrites, ["hello"])
+  assert.equal(sessions.get("session-dup")?.clientSequence, 5)
+
+  socket.destroy()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    targetServer.close((error) => {
+      if (error) { reject(error); return }
+      resolve(undefined)
+    })
+  })
+})
+
+test("TCP relay accepts consecutive contiguous stream.data frames decoded in one TCP chunk while the first target write is still pending", async () => {
+  /** @type {string[]} */
+  const targetWrites = []
+  const targetServer = createServer((socket) => {
+    socket.on("data", (chunk) => {
+      targetWrites.push(chunk.toString("utf8"))
+      socket.write(chunk)
+    })
+  })
+  const targetPort = await listen(targetServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+  const sessions = new SessionStore({now: () => 1000})
+
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions
+  })
+
+  const socket = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(socket)
+  socket.write(encodeFrame({
+    type: "session.create",
+    token: token.value,
+    name: "contiguous-one-chunk",
+    identifier: "session-contig",
+    target: {host: "127.0.0.1", port: targetPort}
+  }))
+  decoder.push(await readOnce(socket))
+
+  const frame1 = encodeFrame({
+    type: "stream.data",
+    direction: "client-to-target",
+    sequence: 10
+  }, Buffer.from("1234567890"))
+
+  const frame2 = encodeFrame({
+    type: "stream.data",
+    direction: "client-to-target",
+    sequence: 20
+  }, Buffer.from("abcdefghij"))
+
+  const combined = Buffer.concat([frame1, frame2])
+  socket.write(combined)
+
+  let ackCount = 0
+  let errorCount = 0
+  while (ackCount < 2 && errorCount === 0) {
+    for (const frame of decoder.push(await readOnce(socket))) {
+      if (frame.header.type === "stream.ack" && frame.header.direction === "client-to-target") {
+        ackCount++
+      }
+      if (frame.header.type === "error") {
+        errorCount++
+      }
+    }
+  }
+
+  assert.equal(errorCount, 0, "no protocol violation for contiguous frames in one chunk")
+  assert.equal(ackCount, 2, "both frames must receive an ack")
+  const receivedData = targetWrites.join("")
+  assert.equal(receivedData, "1234567890abcdefghij")
+  assert.equal(sessions.get("session-contig")?.clientSequence, 20)
+
+  socket.destroy()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    targetServer.close((error) => {
+      if (error) { reject(error); return }
+      resolve(undefined)
+    })
+  })
+})
+
+test("TCP relay replays unacknowledged target-to-client data exactly once after reconnect and does not replay acknowledged chunks", async () => {
+  const echoServer = createServer((socket) => {
+    socket.on("data", (chunk) => socket.write(chunk))
+  })
+  const targetPort = await listen(echoServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+  const sessions = new SessionStore({now: () => 1000})
+
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions,
+    resumeWindowMs: 2_000
+  })
+
+  const tunnel1 = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder1 = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(tunnel1)
+  tunnel1.write(encodeFrame({
+    type: "session.create",
+    token: token.value,
+    name: "replay-once-test",
+    identifier: "session-replay-once",
+    target: {host: "127.0.0.1", port: targetPort}
+  }))
+  decoder1.push(await readOnce(tunnel1))
+
+  tunnel1.write(encodeFrame({type: "stream.data", direction: "client-to-target", sequence: 5}, Buffer.from("alpha")))
+  let alphaRelaySeq = 0
+  while (alphaRelaySeq === 0) {
+    for (const frame of decoder1.push(await readOnce(tunnel1))) {
+      if (frame.header.type === "stream.data" && frame.header.direction === "target-to-client") {
+        alphaRelaySeq = /** @type {number} */ (frame.header.sequence ?? 0)
+      }
+    }
+  }
+  assert.ok(alphaRelaySeq > 0, "alpha must be echoed with a target-to-client sequence")
+
+  tunnel1.write(encodeFrame({type: "stream.data", direction: "client-to-target", sequence: 11}, Buffer.from("bravo6")))
+  let bravoRelaySeq = 0
+  while (bravoRelaySeq === 0) {
+    for (const frame of decoder1.push(await readOnce(tunnel1))) {
+      if (frame.header.type === "stream.data" && frame.header.direction === "target-to-client" && frame.payload.toString("utf8") === "bravo6") {
+        bravoRelaySeq = /** @type {number} */ (frame.header.sequence ?? 0)
+      }
+    }
+  }
+
+  tunnel1.write(encodeFrame({type: "stream.ack", direction: "target-to-client", ackSequence: alphaRelaySeq}))
+
+  tunnel1.destroy()
+  await waitClose(tunnel1)
+
+  const tunnel2 = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder2 = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(tunnel2)
+  tunnel2.write(encodeFrame({type: "session.resume", token: token.value, identifier: "session-replay-once", targetToClientAck: alphaRelaySeq}))
+
+  let resumed = false
+  /** @type {string[]} */
+  const replayedChunks = []
+  while (!resumed || replayedChunks.length < 1) {
+    for (const frame of decoder2.push(await readOnce(tunnel2))) {
+      if (frame.header.type === "session.resumed") {
+        resumed = true
+      }
+      if (frame.header.type === "stream.data" && frame.header.direction === "target-to-client") {
+        replayedChunks.push(frame.payload.toString("utf8"))
+      }
+    }
+  }
+
+  assert.deepEqual(replayedChunks, ["bravo6"], "only unacknowledged bytes must be replayed")
+
+  tunnel2.destroy()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    echoServer.close((error) => {
+      if (error) { reject(error); return }
+      resolve(undefined)
+    })
+  })
+})
+
+test("TCP relay handshake timeout sends HANDSHAKE_TIMEOUT before auth, not after", async () => {
+  const relay = await startTcpRelay({
+    authorizeTarget: () => false,
+    tokens: new TokenStore(),
+    sessions: new SessionStore(),
+    handshakeTimeoutMs: 50
+  })
+
+  const unauthed = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(unauthed)
+
+  const handshakeTimeout = new Promise((resolve, reject) => {
+    unauthed.on("close", () => reject(new Error("socket closed without error frame")))
+    unauthed.on("data", (chunk) => {
+      for (const frame of decoder.push(chunk)) {
+        if (frame.header.type === "error") {
+          resolve(frame.header)
+        }
+      }
+    })
+  })
+
+  const errorHeader = await Promise.race([
+    handshakeTimeout,
+    new Promise((_, reject) => setTimeout(() => reject(new Error("test timed out waiting for error frame")), 1000))
+  ])
+
+  assert.equal(errorHeader.type, "error")
+  assert.equal(errorHeader.code, "HANDSHAKE_TIMEOUT")
+
+  const users = new InMemoryUserStore()
+  const authedTokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, authedTokens, {username: "kasper", password: "correct horse battery staple"})
+
+  const authed = createConnection({host: "127.0.0.1", port: relay.port})
+  const authedDecoder = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(authed)
+  authed.write(encodeFrame({
+    type: "session.create",
+    token: token.value,
+    name: "timeout-do-not-fire",
+    identifier: "session-timeout-ok",
+    target: {host: "127.0.0.1", port: 9}
+  }))
+
+  const authData = await Promise.race([
+    new Promise((resolve) => authed.once("data", (chunk) => { authedDecoder.push(chunk); resolve(undefined) })),
+    new Promise((_, reject) => setTimeout(() => reject(new Error("authenticated connection timed out")), 500))
+  ])
+  assert.notEqual(authData, "timeout", "authenticated connection must receive a response")
+
+  for (const frame of authedDecoder.push(Buffer.alloc(0))) {
+    assert.notEqual(frame.header.code, "HANDSHAKE_TIMEOUT", "authenticated connection must not receive handshake timeout")
+  }
+
+  authed.destroy()
+  await relay.close()
+})
+
+test("TCP relay enforces maxInputBytesPerConnection before auth and lifts it after auth", async () => {
+  const echoServer = createServer((socket) => {
+    socket.on("data", (chunk) => socket.write(chunk))
+  })
+  const targetPort = await listen(echoServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions: new SessionStore({now: () => 1000}),
+    maxInputBytesPerConnection: 256,
+    handshakeTimeoutMs: 5000
+  })
+
+  const errorHeader = await new Promise((resolve, reject) => {
+    const preAuth = createConnection({host: "127.0.0.1", port: relay.port})
+    const decoder = new FrameDecoder({compactDirection: "target-to-client"})
+
+    preAuth.on("connect", () => {
+      const hugePayload = Buffer.alloc(300, 0x41)
+      const hugeFrame = encodeFrame({
+        type: "stream.data",
+        direction: "client-to-target",
+        sequence: 1
+      }, hugePayload)
+
+      const half = Math.floor(hugeFrame.length / 2)
+      preAuth.write(hugeFrame.subarray(0, half))
+      preAuth.write(hugeFrame.subarray(half))
+    })
+
+    preAuth.on("data", (chunk) => {
+      for (const frame of decoder.push(chunk)) {
+        if (frame.header.type === "error") {
+          resolve(frame.header)
+        }
+      }
+    })
+
+    preAuth.on("close", () => reject(new Error("socket closed without error frame")))
+
+    setTimeout(() => reject(new Error("timed out waiting for error frame")), 1000)
+  })
+
+  assert.equal(errorHeader.type, "error")
+  assert.equal(errorHeader.code, "PROTOCOL_VIOLATION")
+
+  const createdHeader = await new Promise((resolve, reject) => {
+    const authed = createConnection({host: "127.0.0.1", port: relay.port})
+    const decoder = new FrameDecoder({compactDirection: "target-to-client"})
+
+    authed.on("connect", () => {
+      authed.write(encodeFrame({
+        type: "session.create",
+        token: token.value,
+        name: "budget-lift-test",
+        identifier: "session-budget-lift",
+        target: {host: "127.0.0.1", port: targetPort}
+      }))
+    })
+
+    authed.on("data", (chunk) => {
+      for (const frame of decoder.push(chunk)) {
+        if (frame.header.type === "session.created") {
+          resolve(frame.header)
+        }
+      }
+    })
+
+    authed.on("close", () => reject(new Error("authed socket closed without session.created")))
+
+    setTimeout(() => reject(new Error("timed out waiting for session.created")), 1000)
+  })
+
+  assert.equal(createdHeader.type, "session.created")
+
+  const largePayload = Buffer.alloc(256, 0x42)
+
+  const echoed = await new Promise((resolve, reject) => {
+    const authed2 = createConnection({host: "127.0.0.1", port: relay.port})
+    const decoder = new FrameDecoder({compactDirection: "target-to-client"})
+
+    authed2.on("connect", () => {
+      authed2.write(encodeFrame({
+        type: "session.create",
+        token: token.value,
+        name: "budget-lift-large",
+        identifier: "session-budget-large",
+        target: {host: "127.0.0.1", port: targetPort}
+      }))
+    })
+
+    authed2.on("data", (chunk) => {
+      for (const frame of decoder.push(chunk)) {
+        if (frame.header.type === "session.created") {
+          authed2.write(encodeFrame({
+            type: "stream.data",
+            direction: "client-to-target",
+            sequence: largePayload.length
+          }, largePayload))
+        }
+        if (frame.header.type === "stream.data" && frame.header.direction === "target-to-client") {
+          resolve(frame.payload)
+        }
+      }
+    })
+
+    authed2.on("close", () => reject(new Error("authed2 socket closed without echo")))
+
+    setTimeout(() => reject(new Error("timed out waiting for echo")), 1000)
+  })
+
+  assert.ok(Buffer.isBuffer(echoed))
+  assert.equal(echoed.length, largePayload.length)
+  assert.deepEqual(echoed, largePayload)
+
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    echoServer.close((error) => {
+      if (error) { reject(error); return }
+      resolve(undefined)
+    })
+  })
+})
+
+test("TCP relay terminal clean-up on SocketductSocket.end() terminates target and rejects resume despite long resume window", async () => {
+  const tempDir = await mkdtemp(join(tmpdir(), "socketduct-terminal-close-test-"))
+  const echoServer = createServer((socket) => {
+    socket.on("data", (chunk) => socket.write(chunk))
+  })
+  const targetPort = await listen(echoServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+  const sessions = new SessionStore({now: () => 1000})
+
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions,
+    resumeWindowMs: 10_000
+  })
+
+  const client = connectSocketduct({
+    relay: {host: "127.0.0.1", port: relay.port, token: token.value},
+    sessionName: "terminal-close-socket",
+    target: {host: "127.0.0.1", port: targetPort},
+    spoolDirectory: tempDir
+  })
+  await new Promise((resolve) => client.once("connect", resolve))
+
+  client.write("alpha")
+  const echo = await new Promise((resolve) => {
+    client.once("data", (data) => resolve(data.toString("utf8")))
+  })
+  assert.equal(echo, "alpha")
+
+  const sessionId = client.sessionIdentifier
+  assert.ok(typeof sessionId === "string", "session identifier must be assigned")
+
+  const sessionBeforeClose = sessions.get(sessionId)
+  assert.ok(sessionBeforeClose !== undefined, "session must exist before close")
+
+  const closePromise = new Promise((resolve) => client.once("close", resolve))
+  client.end()
+  await closePromise
+
+  const sessionAfterClose = sessions.get(sessionId)
+  assert.ok(sessionAfterClose === undefined, "session must be removed after terminal close")
+
+  const tunnel2 = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder2 = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(tunnel2)
+  tunnel2.write(encodeFrame({type: "session.resume", token: token.value, identifier: sessionId}))
+
+  let resumeResponse
+  while (resumeResponse === undefined) {
+    for (const frame of decoder2.push(await readOnce(tunnel2))) {
+      resumeResponse = frame.header
+    }
+  }
+  assert.equal(resumeResponse.type, "error")
+  assert.ok(resumeResponse.code === "SESSION_NOT_FOUND" || resumeResponse.code === "SESSION_EXPIRED", "session must not be resumable after terminal close")
+
+  tunnel2.destroy()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    echoServer.close((error) => {
+      if (error) { reject(error); return }
+      resolve(undefined)
+    })
+  })
+  await rm(tempDir, {recursive: true, force: true})
+})
+
+test("TCP relay retains resumable session after unexpected tunnel close via closeActiveTunnel", async () => {
+  const echoServer = createServer((socket) => {
+    socket.on("data", (chunk) => socket.write(chunk))
+  })
+  const targetPort = await listen(echoServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+  const sessions = new SessionStore({now: () => 1000})
+
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions,
+    resumeWindowMs: 5_000
+  })
+
+  const tunnel1 = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder1 = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(tunnel1)
+  tunnel1.write(encodeFrame({
+    type: "session.create",
+    token: token.value,
+    name: "force-close-resumable",
+    identifier: "session-force-close-resumable",
+    target: {host: "127.0.0.1", port: targetPort}
+  }))
+  decoder1.push(await readOnce(tunnel1))
+
+  tunnel1.write(encodeFrame({type: "stream.data", direction: "client-to-target", sequence: 5}, Buffer.from("first")))
+  let firstEcho
+  while (firstEcho === undefined) {
+    for (const frame of decoder1.push(await readOnce(tunnel1))) {
+      if (frame.header.type === "stream.data" && frame.header.direction === "target-to-client") {
+        firstEcho = frame.payload.toString("utf8")
+      }
+    }
+  }
+  assert.equal(firstEcho, "first")
+
+  relay.closeActiveTunnel()
+  await waitClose(tunnel1)
+
+  const sessionBeforeResume = sessions.get("session-force-close-resumable")
+  assert.ok(sessionBeforeResume !== undefined, "session must still exist after unexpected tunnel close")
+  assert.ok(sessionBeforeResume.state === "interrupted" || sessionBeforeResume.state === "resuming" || sessionBeforeResume.state === "active", "session must be resumable after unexpected tunnel close")
+
+  const tunnel2 = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder2 = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(tunnel2)
+  tunnel2.write(encodeFrame({type: "session.resume", token: token.value, identifier: "session-force-close-resumable"}))
+
+  let resumed = false
+  let gotReplay = false
+  while (!resumed || !gotReplay) {
+    for (const frame of decoder2.push(await readOnce(tunnel2))) {
+      if (frame.header.type === "session.resumed") {
+        resumed = true
+      }
+      if (frame.header.type === "stream.data" && frame.header.direction === "target-to-client") {
+        gotReplay = true
+      }
+    }
+  }
+  assert.ok(resumed, "session must be resumable after unexpected tunnel drop")
+  assert.ok(gotReplay, "unacknowledged target-to-client data must be replayed on resume")
+
+  tunnel2.destroy()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    echoServer.close((error) => {
+      if (error) { reject(error); return }
+      resolve(undefined)
+    })
+  })
+})
+
+test("TCP relay rejects resume after resume window expires", async () => {
+  const echoServer = createServer((socket) => {
+    socket.on("data", (chunk) => socket.write(chunk))
+  })
+  const targetPort = await listen(echoServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+  const sessions = new SessionStore({now: () => 1000})
+
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions,
+    resumeWindowMs: 100
+  })
+
+  const tunnel1 = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder1 = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(tunnel1)
+  tunnel1.write(encodeFrame({
+    type: "session.create",
+    token: token.value,
+    name: "expiry-test",
+    identifier: "session-expiry-test",
+    target: {host: "127.0.0.1", port: targetPort}
+  }))
+  decoder1.push(await readOnce(tunnel1))
+
+  tunnel1.write(encodeFrame({type: "stream.data", direction: "client-to-target", sequence: 4}, Buffer.from("ping")))
+  let echo
+  while (echo === undefined) {
+    for (const frame of decoder1.push(await readOnce(tunnel1))) {
+      if (frame.header.type === "stream.data" && frame.header.direction === "target-to-client") {
+        echo = frame.payload.toString("utf8")
+      }
+    }
+  }
+  assert.equal(echo, "ping")
+
+  tunnel1.destroy()
+  await waitClose(tunnel1)
+
+  const sessionBeforeExpiry = sessions.get("session-expiry-test")
+  assert.ok(sessionBeforeExpiry !== undefined, "session must exist before expiry")
+
+  await new Promise((resolve) => setTimeout(resolve, 200))
+
+  const sessionAfterExpiry = sessions.get("session-expiry-test")
+  assert.ok(sessionAfterExpiry === undefined, "session must be removed after resume window expires")
+
+  const tunnel2 = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder2 = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(tunnel2)
+  tunnel2.write(encodeFrame({type: "session.resume", token: token.value, identifier: "session-expiry-test"}))
+
+  let resumeResponse
+  while (resumeResponse === undefined) {
+    for (const frame of decoder2.push(await readOnce(tunnel2))) {
+      resumeResponse = frame.header
+    }
+  }
+  assert.equal(resumeResponse.type, "error")
+  assert.ok(resumeResponse.code === "SESSION_NOT_FOUND" || resumeResponse.code === "SESSION_EXPIRED", "session must not be resumable after expiry")
+
+  tunnel2.destroy()
+  await relay.close()
+  await new Promise((resolve, reject) => {
+    echoServer.close((error) => {
+      if (error) { reject(error); return }
+      resolve(undefined)
+    })
+  })
+})
+
+/**
+ * @param {number} size - Uncompressed byte length to produce.
+ * @returns {Buffer} - Highly compressible text payload.
+ */
+function compressibleChunk(size) {
+  const unit = "GET /api/v1/users?page=2 HTTP/1.1\r\nHost: example.com\r\nAccept: application/json\r\n\r\n"
+  return Buffer.from(unit.repeat(Math.ceil(size / unit.length))).subarray(0, size)
+}
+
+/**
+ * Holds the next asynchronous Zstd completion callback.
+ * @returns {{entered: Promise<unknown>, release: () => void, restore: () => void}} Test controller.
+ */
+function holdNextZstdCompression() {
+  const originalCompress = /** @type {NonNullable<typeof zlib.zstdCompress>} */ (zlib.zstdCompress)
+  /** @type {import('node:zlib').CompressCallback | undefined} */
+  let heldCallback
+  /** @type {Buffer | undefined} */
+  let heldInput
+  /** @type {import('node:zlib').ZstdOptions | undefined} */
+  let heldOptions
+  /** @type {() => void} */
+  let enteredResolve = () => {}
+  const entered = new Promise((resolve) => { enteredResolve = () => resolve(undefined) })
+  /** @type {(input: import('node:zlib').InputType, options: import('node:zlib').ZstdOptions, callback: import('node:zlib').CompressCallback) => void} */
+  const patchedCompress = (input, options, callback) => {
+    if (heldCallback === undefined) {
+      heldCallback = callback
+      heldInput = /** @type {Buffer} */ (/** @type {unknown} */ (input))
+      heldOptions = options
+      enteredResolve()
+      return
+    }
+    originalCompress(input, options, callback)
+  }
+  // @ts-expect-error - TS lib __promisify__ required on typeof zstdCompress vs runtime
+  zlib.zstdCompress = patchedCompress
+  return {
+    entered,
+    release() {
+      zlib.zstdCompress = originalCompress
+      if (heldCallback !== undefined && heldInput !== undefined && heldOptions !== undefined) {
+        originalCompress(heldInput, heldOptions, heldCallback)
+      }
+    },
+    restore() {
+      zlib.zstdCompress = originalCompress
+    }
+  }
+}
+
+test("TCP relay retains a queued target close across disconnect and resumes it after data", {skip: !zstdAvailable()}, async () => {
+  /** @type {import('node:net').Socket | undefined} */
+  let targetSocket
+  const targetServer = createServer((socket) => {
+    targetSocket = socket
+    socket.resume()
+  })
+  const targetPort = await listen(targetServer)
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions: new SessionStore({now: () => 1000}),
+    resumeWindowMs: 2_000
+  })
+  const tunnel1 = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder1 = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(tunnel1)
+  tunnel1.write(encodeFrame({
+    type: "session.create", token: token.value, name: "queued-terminal",
+    identifier: "session-queued-terminal", target: {host: "127.0.0.1", port: targetPort}, compression: ["zstd"]
+  }))
+  let created = false
+  while (!created) {
+    for (const frame of decoder1.push(await readOnceWithin(tunnel1))) {
+      if (frame.header.type === "session.created") created = true
+    }
+  }
+  while (targetSocket === undefined) await new Promise((resolve) => setTimeout(resolve, 1))
+
+  const held = holdNextZstdCompression()
+  const payload = compressibleChunk(16_384)
+  try {
+    targetSocket.write(payload)
+    await held.entered
+    targetSocket.end()
+    await waitClose(targetSocket)
+    await relay.closeActiveTunnel()
+    await waitClose(tunnel1)
+    held.release()
+
+    const tunnel2 = createConnection({host: "127.0.0.1", port: relay.port})
+    const decoder2 = new FrameDecoder({compactDirection: "target-to-client"})
+    await waitConnect(tunnel2)
+    tunnel2.write(encodeFrame({
+      type: "session.resume", token: token.value, identifier: "session-queued-terminal",
+      targetToClientAck: 0, compression: ["zstd"]
+    }))
+    /** @type {string[]} */
+    const ordered = []
+    while (!ordered.includes("close")) {
+      for (const frame of decoder2.push(await readOnceWithin(tunnel2))) {
+        if (frame.header.type === "stream.data") ordered.push("data")
+        if (frame.header.type === "session.close") ordered.push("close")
+      }
+    }
+    assert.deepEqual(ordered, ["data", "close"])
+    tunnel2.destroy()
+  } finally {
+    held.restore()
+    tunnel1.destroy()
+    await relay.close()
+    await new Promise((resolve) => targetServer.close(() => resolve(undefined)))
+  }
+})
+
+test("TCP relay orders a target close created during resume after queued target data", {skip: !zstdAvailable()}, async () => {
+  /** @type {import('node:net').Socket | undefined} */
+  let targetSocket
+  let targetConnections = 0
+  const targetServer = createServer((socket) => {
+    targetConnections += 1
+    targetSocket = socket
+    socket.resume()
+  })
+  const targetPort = await listen(targetServer)
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions: new SessionStore({now: () => 1000}),
+    resumeWindowMs: 2_000
+  })
+  const tunnel1 = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder1 = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(tunnel1)
+  tunnel1.write(encodeFrame({
+    type: "session.create", token: token.value, name: "resume-terminal-order",
+    identifier: "session-resume-terminal-order", target: {host: "127.0.0.1", port: targetPort}, compression: ["zstd"]
+  }))
+  let created = false
+  while (!created) {
+    for (const frame of decoder1.push(await readOnceWithin(tunnel1))) {
+      if (frame.header.type === "session.created") created = true
+    }
+  }
+  while (targetSocket === undefined) await new Promise((resolve) => setImmediate(resolve))
+
+  const replayPayload = compressibleChunk(16_384)
+  targetSocket.write(replayPayload)
+  let receivedReplay = false
+  while (!receivedReplay) {
+    for (const frame of decoder1.push(await readOnceWithin(tunnel1))) {
+      if (frame.header.type === "stream.data") receivedReplay = true
+    }
+  }
+  await relay.closeActiveTunnel()
+  await waitClose(tunnel1)
+
+  const held = holdNextZstdCompression()
+  /** @type {import('node:net').Socket | undefined} */
+  let tunnel2
+  try {
+    tunnel2 = createConnection({host: "127.0.0.1", port: relay.port})
+    const decoder2 = new FrameDecoder({compactDirection: "target-to-client"})
+    /** @type {string[]} */
+    const ordered = []
+    let resumed = false
+    tunnel2.on("data", (chunk) => {
+      for (const frame of decoder2.push(chunk)) {
+        if (frame.header.type === "session.resumed") resumed = true
+        if (frame.header.type === "stream.data") ordered.push("data")
+        if (frame.header.type === "session.close") ordered.push("close")
+      }
+    })
+    await waitConnect(tunnel2)
+    tunnel2.write(encodeFrame({
+      type: "session.resume", token: token.value, identifier: "session-resume-terminal-order",
+      targetToClientAck: 0, compression: ["zstd"]
+    }))
+    await held.entered
+    await waitUntil(() => resumed)
+
+    targetSocket.end(Buffer.from("final-target-record"))
+    await waitClose(targetSocket)
+    held.release()
+
+    await waitUntil(() => ordered.includes("close"))
+    assert.deepEqual(ordered, ["data", "data", "close"])
+    assert.equal(targetConnections, 1)
+  } finally {
+    held.restore()
+    tunnel2?.destroy()
+    tunnel1.destroy()
+    await relay.close()
+    await new Promise((resolve) => targetServer.close(() => resolve(undefined)))
+  }
+})
+
+test("TCP relay preserves send queue across tunnel close when zstd compression callback is delayed past resume", {skip: !zstdAvailable()}, async () => {
+  /** @type {import('node:net').Socket | undefined} */
+  let targetSocket
+  const targetServer = createServer((socket) => {
+    targetSocket = socket
+    socket.on("data", (chunk) => socket.write(chunk))
+  })
+  const targetPort = await listen(targetServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+  const sessions = new SessionStore({now: () => 1000})
+
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions,
+    resumeWindowMs: 2_000,
+    maxTargetBufferBytes: 8_192
+  })
+
+  const tunnel1 = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder1 = new FrameDecoder({compactDirection: "target-to-client"})
+  await waitConnect(tunnel1)
+  tunnel1.write(encodeFrame({
+    type: "session.create",
+    token: token.value,
+    name: "zstd-queue-race",
+    identifier: "session-zstd-queue-race",
+    target: {host: "127.0.0.1", port: targetPort},
+    compression: ["zstd"]
+  }))
+
+  const createdFrames = decoder1.push(await readOnce(tunnel1))
+  const created = createdFrames[0]
+  if (created === undefined) throw new Error("session.created expected")
+  assert.equal(created.header.compression, "zstd")
+
+  const chunk1 = compressibleChunk(8192)
+  tunnel1.write(encodeFrame({
+    type: "stream.data",
+    direction: "client-to-target",
+    sequence: chunk1.length
+  }, chunk1))
+
+  let echo1Received = false
+  while (!echo1Received) {
+    for (const frame of decoder1.push(await readOnce(tunnel1))) {
+      if (frame.header.type === "stream.data" && frame.header.direction === "target-to-client") {
+        echo1Received = true
+      }
+    }
+  }
+
+  const originalCompress = /** @type {NonNullable<typeof zlib.zstdCompress>} */ (zlib.zstdCompress)
+  /** @type {import('node:zlib').CompressCallback | undefined} */
+  let heldCallback
+  /** @type {Buffer | undefined} */
+  let heldInput
+  /** @type {object | undefined} */
+  let heldOptions
+  /** @type {(() => void) | undefined} */
+  let resolveCompressorEntered
+
+  const compressorEntered = new Promise((resolve) => {
+    resolveCompressorEntered = () => resolve(undefined)
+  })
+
+  // Test-only monkey-patch: holds the next zstd compression callback to
+  // reproduce a send-queue race where async encode outlives a tunnel close.
+  /**
+   * @param {import('node:zlib').InputType} input
+   * @param {import('node:zlib').ZstdOptions} options
+   * @param {import('node:zlib').CompressCallback} callback
+   * @returns {void}
+   */
+  const patchedCompress = (input, options, callback) => {
+    if (heldCallback === undefined) {
+      heldCallback = callback
+      heldInput = /** @type {Buffer} */ (/** @type {unknown} */ (input))
+      heldOptions = options
+      if (resolveCompressorEntered) resolveCompressorEntered()
+      return
+    }
+    originalCompress(input, options, callback)
+  }
+  // @ts-expect-error - TS lib __promisify__ required on typeof zstdCompress vs runtime
+  zlib.zstdCompress = patchedCompress
+
+  try {
+    const chunk2 = compressibleChunk(16384)
+    targetSocket?.write(chunk2)
+    await compressorEntered
+
+    // Awaiting this relay helper means its server-side close handler has removed
+    // the sender, so the next target write is definitely detached.
+    await relay.closeActiveTunnel()
+    await waitClose(tunnel1)
+
+    const chunk3 = Buffer.from("detached-after-delayed-send")
+    targetSocket?.write(chunk3)
+
+    const tunnel2 = createConnection({host: "127.0.0.1", port: relay.port})
+    const decoder2 = new FrameDecoder({compactDirection: "target-to-client"})
+    await waitConnect(tunnel2)
+    tunnel2.write(encodeFrame({
+      type: "session.resume",
+      token: token.value,
+      identifier: "session-zstd-queue-race",
+      compression: ["zstd"]
+    }))
+
+    let resumed = false
+    while (!resumed) {
+      for (const frame of decoder2.push(await readOnceWithin(tunnel2))) {
+        if (frame.header.type === "session.resumed") {
+          resumed = true
+        }
+      }
+    }
+
+    // Disconnect again while the first send still owns the queue. The queued
+    // flush must leave chunk3 buffered for the next resume.
+    // Ensure the queued resume flush sees its sender removed before completion.
+    const closingTunnel2 = relay.closeActiveTunnel()
+    await waitClose(tunnel2)
+
+    zlib.zstdCompress = originalCompress
+
+    if (heldCallback !== undefined && heldInput !== undefined && heldOptions !== undefined) {
+      originalCompress(heldInput, heldOptions, heldCallback)
+    }
+    await closingTunnel2
+
+    const tunnel3 = createConnection({host: "127.0.0.1", port: relay.port})
+    const decoder3 = new FrameDecoder({compactDirection: "target-to-client"})
+    await waitConnect(tunnel3)
+    tunnel3.write(encodeFrame({
+      type: "session.resume",
+      token: token.value,
+      identifier: "session-zstd-queue-race",
+      compression: ["zstd"]
+    }))
+
+    /** @type {Array<{sequence: number, chunk: Buffer}>} */
+    const received = []
+    let resumedAgain = false
+    let done = false
+    while (!done || !resumedAgain) {
+      const nextFrameBytes = await readOnceWithin(tunnel3)
+      for (const frame of decoder3.push(nextFrameBytes)) {
+        if (frame.header.type === "session.resumed") resumedAgain = true
+        if (frame.header.type === "stream.data" && frame.header.direction === "target-to-client") {
+          received.push({
+            sequence: /** @type {number} */ (frame.header.sequence),
+            chunk: Buffer.from(frame.payload)
+          })
+          if (received.length >= 3) {
+            done = true
+          }
+        }
+      }
+    }
+
+    assert.equal(received.length, 3, "must receive exactly three target-to-client frames — no drops, no duplicates")
+    const frame1 = /** @type {NonNullable<typeof received[0]>} */ (received[0])
+    const frame2 = /** @type {NonNullable<typeof received[1]>} */ (received[1])
+    const frame3 = /** @type {NonNullable<typeof received[2]>} */ (received[2])
+    assert.ok(frame1.sequence < frame2.sequence && frame2.sequence < frame3.sequence, "sequences must be in ascending order")
+    assert.equal(frame1.sequence, chunk1.length, "first frame sequence must equal chunk1 size")
+    assert.equal(frame2.sequence, chunk1.length + chunk2.length, "second frame sequence must equal cumulative size")
+    assert.equal(frame3.sequence, chunk1.length + chunk2.length + chunk3.length, "detached frame must follow the delayed pre-close frame")
+    assert.ok(frame1.chunk.length < chunk1.length, "wire frame for chunk1 must be compressed")
+    assert.ok(frame2.chunk.length < chunk2.length, "wire frame for chunk2 must be compressed")
+    assert.deepEqual(frame3.chunk, chunk3)
+
+    tunnel3.destroy()
+  } finally {
+    zlib.zstdCompress = originalCompress
+    await relay.close()
+    await new Promise((resolve, reject) => {
+      targetServer.close((error) => {
+        if (error) { reject(error); return }
+        resolve(undefined)
+      })
+    })
+  }
+})
+
+test("TCP relay enforces detached buffer overflow while an earlier zstd send is stalled", {skip: !zstdAvailable()}, async () => {
+  /** @type {import('node:net').Socket | undefined} */
+  let targetSocket
+  const targetServer = createServer((socket) => {
+    targetSocket = socket
+    socket.resume()
+  })
+  const targetPort = await listen(targetServer)
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "buffer-race", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "buffer-race", password: "correct horse battery staple"})
+  const sessions = new SessionStore({now: () => 1000})
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions,
+    resumeWindowMs: 2_000,
+    maxTargetBufferBytes: 16
+  })
+  const tunnel1 = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder1 = new FrameDecoder({compactDirection: "target-to-client"})
+  let hold
+  try {
+    await waitConnect(tunnel1)
+    tunnel1.write(encodeFrame({
+      type: "session.create", token: token.value, name: "buffer-race", identifier: "buffer-race",
+      target: {host: "127.0.0.1", port: targetPort}, compression: ["zstd"]
+    }))
+    decoder1.push(await readOnceWithin(tunnel1))
+    await waitUntil(() => targetSocket !== undefined)
+
+    const prime = compressibleChunk(8_192)
+    targetSocket?.write(prime)
+    decoder1.push(await readOnceWithin(tunnel1))
+
+    hold = holdNextZstdCompression()
+    targetSocket?.write(compressibleChunk(16_384))
+    await Promise.race([hold.entered, new Promise((resolve, reject) => setTimeout(() => reject(new Error("compressor did not stall")), 1_000))])
+    // Await relay-side detachment before testing detached-buffer admission.
+    await relay.closeActiveTunnel()
+    await waitClose(tunnel1)
+
+    const targetClosed = targetSocket === undefined ? Promise.reject(new Error("target socket missing")) : waitClose(targetSocket)
+    targetSocket?.write(Buffer.alloc(32, 0x42))
+    await Promise.race([targetClosed, new Promise((resolve, reject) => setTimeout(() => reject(new Error("overflow did not close target immediately")), 1_000))])
+
+    const tunnel2 = createConnection({host: "127.0.0.1", port: relay.port})
+    const decoder2 = new FrameDecoder({compactDirection: "target-to-client"})
+    await waitConnect(tunnel2)
+    tunnel2.write(encodeFrame({type: "session.resume", token: token.value, identifier: "buffer-race", compression: ["zstd"]}))
+    hold.release()
+    let overflow
+    while (overflow === undefined) {
+      for (const frame of decoder2.push(await readOnceWithin(tunnel2))) {
+        if (frame.header.code === "TARGET_BUFFER_OVERFLOW") overflow = frame.header
+      }
+    }
+    assert.equal(overflow.retryable, false)
+    tunnel2.destroy()
+  } finally {
+    hold?.restore()
+    tunnel1.destroy()
+    await relay.close()
+    await new Promise((resolve) => targetServer.close(() => resolve(undefined)))
+  }
+})
+
+test("TCP relay ignores delayed send completion after expiry and identifier reuse", {skip: !zstdAvailable()}, async () => {
+  /** @type {import('node:net').Socket[]} */
+  const targetSockets = []
+  const targetServer = createServer((socket) => {
+    targetSockets.push(socket)
+    socket.resume()
+  })
+  const targetPort = await listen(targetServer)
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "expiry-race", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "expiry-race", password: "correct horse battery staple"})
+  const sessions = new SessionStore({now: () => 1000})
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions,
+    resumeWindowMs: 50
+  })
+  const tunnel1 = createConnection({host: "127.0.0.1", port: relay.port})
+  let tunnel2
+  let hold
+  try {
+    await waitConnect(tunnel1)
+    const decoder1 = new FrameDecoder({compactDirection: "target-to-client"})
+    tunnel1.write(encodeFrame({
+      type: "session.create", token: token.value, name: "old lifecycle", identifier: "reused-lifecycle",
+      target: {host: "127.0.0.1", port: targetPort}, compression: ["zstd"]
+    }))
+    decoder1.push(await readOnceWithin(tunnel1))
+    await waitUntil(() => targetSockets.length === 1)
+    const oldTarget = targetSockets[0]
+    assert.ok(oldTarget !== undefined)
+    oldTarget.write(compressibleChunk(8_192))
+    decoder1.push(await readOnceWithin(tunnel1))
+
+    hold = holdNextZstdCompression()
+    const staleChunk = compressibleChunk(16_384)
+    oldTarget.write(staleChunk)
+    await Promise.race([hold.entered, new Promise((resolve, reject) => setTimeout(() => reject(new Error("compressor did not stall")), 1_000))])
+    tunnel1.destroy()
+    await waitClose(tunnel1)
+
+    await new Promise((resolve) => setTimeout(resolve, 100))
+    assert.equal(sessions.get("reused-lifecycle"), undefined)
+
+    tunnel2 = createConnection({host: "127.0.0.1", port: relay.port})
+    const decoder2 = new FrameDecoder({compactDirection: "target-to-client"})
+    await waitConnect(tunnel2)
+    tunnel2.write(encodeFrame({
+      type: "session.create", token: token.value, name: "new lifecycle", identifier: "reused-lifecycle",
+      target: {host: "127.0.0.1", port: targetPort}
+    }))
+    const created = decoder2.push(await readOnceWithin(tunnel2))
+    assert.equal(created[0]?.header.type, "session.created")
+    await waitUntil(() => targetSockets.length === 2)
+    hold.release()
+    await new Promise((resolve) => setTimeout(resolve, 50))
+
+    const newTarget = targetSockets[1]
+    assert.ok(newTarget !== undefined)
+    const freshChunk = Buffer.from("fresh-lifecycle-data")
+    newTarget.write(freshChunk)
+    let freshFrame
+    while (freshFrame === undefined) {
+      for (const frame of decoder2.push(await readOnceWithin(tunnel2))) {
+        if (frame.header.type === "stream.data") freshFrame = frame
+      }
+    }
+    assert.equal(freshFrame.header.sequence, freshChunk.length, "stale completion must not advance the reused session")
+    assert.deepEqual(freshFrame.payload, freshChunk)
+  } finally {
+    hold?.restore()
+    tunnel1.destroy()
+    tunnel2?.destroy()
+    await relay.close()
+    await new Promise((resolve) => targetServer.close(() => resolve(undefined)))
+  }
+})
+
+test("compact v2 relay coalesces only target chunks naturally queued behind async compression", {skip: !zstdAvailable()}, async () => {
+  /** @type {import('node:net').Socket | undefined} */
+  let targetSocket
+  const targetServer = createServer((socket) => {
+    targetSocket = socket
+    socket.setNoDelay(true)
+  })
+  const targetPort = await listen(targetServer)
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "compact-coalesce", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "compact-coalesce", password: "correct horse battery staple"})
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions: new SessionStore({now: () => 1000})
+  })
+  const tunnel = createConnection({host: "127.0.0.1", port: relay.port})
+  const decoder = new FrameDecoder({compactDirection: "target-to-client"})
+  let hold
+  try {
+    await waitConnect(tunnel)
+    tunnel.write(encodeFrame({
+      type: "session.create", token: token.value, name: "compact coalescing",
+      target: {host: "127.0.0.1", port: targetPort}, compression: ["zstd"], framing: [2]
+    }))
+    const created = decoder.push(await readOnceWithin(tunnel))[0]
+    assert.equal(created?.header.framing, 2)
+    assert.equal(created?.header.compression, "zstd")
+    await waitUntil(() => targetSocket !== undefined)
+
+    hold = holdNextZstdCompression()
+    const first = compressibleChunk(16_384)
+    const second = compressibleChunk(4_096)
+    const third = compressibleChunk(2_048)
+    targetSocket?.write(first)
+    await Promise.race([hold.entered, new Promise((resolve, reject) => setTimeout(() => reject(new Error("compressor did not stall")), 1_000))])
+    targetSocket?.write(second)
+    await new Promise((resolve) => setTimeout(resolve, 10))
+    targetSocket?.write(third)
+    await new Promise((resolve) => setTimeout(resolve, 10))
+    hold.release()
+
+    const dataFrames = []
+    while (dataFrames.length < 2) {
+      for (const frame of decoder.push(await readOnceWithin(tunnel))) {
+        if (frame.header.type === "stream.data") dataFrames.push(frame)
+      }
+    }
+    assert.equal(dataFrames.length, 2, "the first chunk is isolated and only already-queued adjacent chunks merge")
+    assert.equal(dataFrames[0]?.header.sequence, first.length)
+    assert.equal(dataFrames[1]?.header.sequence, first.length + second.length + third.length)
+    assert.equal(dataFrames[1]?.header.dataLength, second.length + third.length)
+  } finally {
+    hold?.restore()
+    tunnel.destroy()
+    await relay.close()
+    await new Promise((resolve) => targetServer.close(() => resolve(undefined)))
+  }
+})