socketduct 0.1.25 → 0.1.26

package/test/integration/reverse-resume-continuity.test.js

@@ -1,11 +1,10 @@
 /* eslint-disable jsdoc/escape-inline-tags, jsdoc/require-param, jsdoc/require-returns */
-import assert from "node:assert/strict"
+import {describe, expect, it, withTestCleanup} from "@velocious/testing"
 import {mkdtemp, rm} from "node:fs/promises"
 import {connect as connectTcp, createServer} from "node:net"
 import {tmpdir} from "node:os"
 import {join} from "node:path"
 import {Duplex} from "node:stream"
-import test from "node:test"
 
 import {StaticTokenStore} from "../../src/auth/static-token-store.js"
 import {OutboundReverseGateway, ReverseGatewayConnection, startReverseGatewayHub} from "../../src/reverse/index.js"
@@ -18,7 +17,7 @@ async function listen(server) {
     server.listen(0, "127.0.0.1", () => { server.off("error", reject); resolve(undefined) })
   })
   const address = server.address()
-  assert(address !== null && typeof address !== "string")
+  if (!address || typeof address === "string") throw new Error("expected AddressInfo")
   return address.port
 }
 
@@ -102,232 +101,234 @@ class RecordingInterruptibleTarget extends Duplex {
   flood(payload) { this.emit("data", payload) }
 }
 
-test("a paired resume completes when the first counterpart return lands just past the original resume window", async (t) => {
-  const root = await mkdtemp(join(tmpdir(), "socketduct-reverse-resume-extension-"))
-  t.after(() => rm(root, {recursive: true, force: true}))
-  const certificates = generateTestCertificates(root)
-  let targetAccepts = 0
-  const targetSockets = new Set()
-  const target = createServer((socket) => {
-    targetAccepts += 1
-    targetSockets.add(socket)
-    socket.once("close", () => targetSockets.delete(socket))
-    socket.on("data", (chunk) => socket.write(Buffer.concat([Buffer.from("target:"), chunk])))
-  })
-  const targetPort = await listen(target)
-  t.after(() => { for (const socket of targetSockets) socket.destroy(); return new Promise((resolve) => target.close(() => resolve(undefined))) })
-  const tokens = new StaticTokenStore([{username: "home", token: "gateway-token"}, {username: "app", token: "client-token"}])
-  const hub = await startReverseGatewayHub({tokens, tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile}, authorizeGateway: () => true, authorizeClientGateway: () => true, authorizeOpen: () => true, resumeWindowMs: 250})
-  t.after(() => hub.close())
-  const tls = {caFile: certificates.caCertFile, servername: "localhost"}
-  const gateway = new OutboundReverseGateway({gatewayId: "o2", connectionId: "extension_gateway_01", hub: {host: "127.0.0.1", port: hub.port, token: "gateway-token"}, tls, spoolDirectory: join(root, "gateway-spool"), authorizeTarget: () => true, reconnectDelayMs: 350, maxReconnectDelayMs: 350})
-  t.after(() => gateway.close())
-  await gateway.start()
-  const client = new ReverseGatewayConnection({gatewayId: "o2", connectionId: "extension_client_01", hub: {host: "127.0.0.1", port: hub.port, token: "client-token"}, tls, spoolDirectory: join(root, "client-spool"), reconnectDelayMs: 10, maxReconnectDelayMs: 20})
-  t.after(() => client.close())
-  await client.connect()
-  const socket = client.createConnection({identifier: "extension_stream_01", sessionName: "extension-stream", host: "127.0.0.1", port: targetPort})
-  await onceEvent(socket, "connect")
-  socket.write("before|")
-  const preResponse = readBytes(socket, 14)
-  assert.equal((await withTimeout(preResponse, "pre-resume target echo")).toString(), "target:before|")
+describe("reverse resume continuity", () => {
+  it("a paired resume completes when the first counterpart return lands just past the original resume window", async () => withTestCleanup(async (after) => {
+    const root = await mkdtemp(join(tmpdir(), "socketduct-reverse-resume-extension-"))
+    after(() => rm(root, {recursive: true, force: true}))
+    const certificates = generateTestCertificates(root)
+    let targetAccepts = 0
+    const targetSockets = new Set()
+    const target = createServer((socket) => {
+      targetAccepts += 1
+      targetSockets.add(socket)
+      socket.once("close", () => targetSockets.delete(socket))
+      socket.on("data", (chunk) => socket.write(Buffer.concat([Buffer.from("target:"), chunk])))
+    })
+    const targetPort = await listen(target)
+    after(() => { for (const socket of targetSockets) socket.destroy(); return new Promise((resolve) => target.close(() => resolve(undefined))) })
+    const tokens = new StaticTokenStore([{username: "home", token: "gateway-token"}, {username: "app", token: "client-token"}])
+    const hub = await startReverseGatewayHub({tokens, tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile}, authorizeGateway: () => true, authorizeClientGateway: () => true, authorizeOpen: () => true, resumeWindowMs: 250})
+    after(() => hub.close())
+    const tls = {caFile: certificates.caCertFile, servername: "localhost"}
+    const gateway = new OutboundReverseGateway({gatewayId: "o2", connectionId: "extension_gateway_01", hub: {host: "127.0.0.1", port: hub.port, token: "gateway-token"}, tls, spoolDirectory: join(root, "gateway-spool"), authorizeTarget: () => true, reconnectDelayMs: 350, maxReconnectDelayMs: 350})
+    after(() => gateway.close())
+    await gateway.start()
+    const client = new ReverseGatewayConnection({gatewayId: "o2", connectionId: "extension_client_01", hub: {host: "127.0.0.1", port: hub.port, token: "client-token"}, tls, spoolDirectory: join(root, "client-spool"), reconnectDelayMs: 10, maxReconnectDelayMs: 20})
+    after(() => client.close())
+    await client.connect()
+    const socket = client.createConnection({identifier: "extension_stream_01", sessionName: "extension-stream", host: "127.0.0.1", port: targetPort})
+    await onceEvent(socket, "connect")
+    socket.write("before|")
+    const preResponse = readBytes(socket, 14)
+    expect((await withTimeout(preResponse, "pre-resume target echo")).toString()).toBe("target:before|")
 
-  await hub.closeActiveGateway("o2")
-  await waitUntil(() => gateway.status().physicalState === "reconnecting", "gateway interruption")
-  socket.write("after|")
-  const postResponse = readBytes(socket, 13)
-  // The gateway's first return (~350ms) lands after the original 250ms window;
-  // the bounded paired-resume extension must keep both deadlines open for it.
-  await waitUntil(() => gateway.status().physicalConnects >= 2 && gateway.status().physicalState === "ready", "gateway return just past the original window")
-  assert.equal((await withTimeout(postResponse, "post-resume target echo")).toString(), "target:after|")
-  assert.equal(targetAccepts, 1, "resume must keep the original logical target socket")
-  assert.equal(hub.status().virtualStreams, 1)
+    await hub.closeActiveGateway("o2")
+    await waitUntil(() => gateway.status().physicalState === "reconnecting", "gateway interruption")
+    socket.write("after|")
+    const postResponse = readBytes(socket, 13)
+    // The gateway's first return (~350ms) lands after the original 250ms window;
+    // the bounded paired-resume extension must keep both deadlines open for it.
+    await waitUntil(() => gateway.status().physicalConnects >= 2 && gateway.status().physicalState === "ready", "gateway return just past the original window")
+    expect((await withTimeout(postResponse, "post-resume target echo")).toString()).toBe("target:after|")
+    expect(targetAccepts).toBe(1) // resume must keep the original logical target socket
+    expect(hub.status().virtualStreams).toBe(1)
 
-  const closed = onceEvent(socket, "close")
-  socket.end()
-  await withTimeout(closed, "post-resume cleanup close")
-  await waitUntil(() => hub.status().virtualStreams === 0 && client.status().virtualStreams === 0 && gateway.status().virtualStreams === 0 && targetSockets.size === 0, "post-resume ownership cleanup")
-})
+    const closed = onceEvent(socket, "close")
+    socket.end()
+    await withTimeout(closed, "post-resume cleanup close")
+    await waitUntil(() => hub.status().virtualStreams === 0 && client.status().virtualStreams === 0 && gateway.status().virtualStreams === 0 && targetSockets.size === 0, "post-resume ownership cleanup")
+  }))
 
-test("a retained terminal outcome answers a reconnecting peer with the causal code instead of RESUME_SESSION_LOST", async (t) => {
-  const root = await mkdtemp(join(tmpdir(), "socketduct-reverse-retained-outcome-"))
-  t.after(() => rm(root, {recursive: true, force: true}))
-  const certificates = generateTestCertificates(root)
-  let acceptsA = 0
-  const targetSocketsA = new Set()
-  const targetA = createServer((socket) => {
-    acceptsA += 1
-    targetSocketsA.add(socket)
-    socket.once("close", () => targetSocketsA.delete(socket))
-    socket.on("data", (chunk) => socket.write(Buffer.concat([Buffer.from("a:"), chunk])))
-  })
-  const portA = await listen(targetA)
-  t.after(() => { for (const socket of targetSocketsA) socket.destroy(); return new Promise((resolve) => targetA.close(() => resolve(undefined))) })
-  const tokens = new StaticTokenStore([{username: "home", token: "gateway-token"}, {username: "app", token: "client-token"}])
-  const hub = await startReverseGatewayHub({tokens, tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile}, authorizeGateway: () => true, authorizeClientGateway: () => true, authorizeOpen: () => true, resumeWindowMs: 2_000})
-  t.after(() => hub.close())
-  const tls = {caFile: certificates.caCertFile, servername: "localhost"}
-  /** @type {RecordingInterruptibleTarget | undefined} */
-  let targetB
-  let targetBCreates = 0
-  const gateway = new OutboundReverseGateway({
-    gatewayId: "o2",
-    connectionId: "outcome_gateway_01",
-    hub: {host: "127.0.0.1", port: hub.port, token: "gateway-token"},
-    tls,
-    spoolDirectory: join(root, "gateway-spool"),
-    authorizeTarget: () => true,
-    reconnectDelayMs: 300,
-    maxReconnectDelayMs: 300,
-    maxStreamBufferBytes: 32,
-    createTargetConnection: (target) => {
-      if (target.port === 2376) {
-        targetBCreates += 1
-        targetB = new RecordingInterruptibleTarget()
-        return /** @type {import('node:net').Socket} */ (/** @type {unknown} */ (targetB))
+  it("a retained terminal outcome answers a reconnecting peer with the causal code instead of RESUME_SESSION_LOST", async () => withTestCleanup(async (after) => {
+    const root = await mkdtemp(join(tmpdir(), "socketduct-reverse-retained-outcome-"))
+    after(() => rm(root, {recursive: true, force: true}))
+    const certificates = generateTestCertificates(root)
+    let acceptsA = 0
+    const targetSocketsA = new Set()
+    const targetA = createServer((socket) => {
+      acceptsA += 1
+      targetSocketsA.add(socket)
+      socket.once("close", () => targetSocketsA.delete(socket))
+      socket.on("data", (chunk) => socket.write(Buffer.concat([Buffer.from("a:"), chunk])))
+    })
+    const portA = await listen(targetA)
+    after(() => { for (const socket of targetSocketsA) socket.destroy(); return new Promise((resolve) => targetA.close(() => resolve(undefined))) })
+    const tokens = new StaticTokenStore([{username: "home", token: "gateway-token"}, {username: "app", token: "client-token"}])
+    const hub = await startReverseGatewayHub({tokens, tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile}, authorizeGateway: () => true, authorizeClientGateway: () => true, authorizeOpen: () => true, resumeWindowMs: 2_000})
+    after(() => hub.close())
+    const tls = {caFile: certificates.caCertFile, servername: "localhost"}
+    /** @type {RecordingInterruptibleTarget | undefined} */
+    let targetB
+    let targetBCreates = 0
+    const gateway = new OutboundReverseGateway({
+      gatewayId: "o2",
+      connectionId: "outcome_gateway_01",
+      hub: {host: "127.0.0.1", port: hub.port, token: "gateway-token"},
+      tls,
+      spoolDirectory: join(root, "gateway-spool"),
+      authorizeTarget: () => true,
+      reconnectDelayMs: 300,
+      maxReconnectDelayMs: 300,
+      maxStreamBufferBytes: 32,
+      createTargetConnection: (target) => {
+        if (target.port === 2376) {
+          targetBCreates += 1
+          targetB = new RecordingInterruptibleTarget()
+          return /** @type {import('node:net').Socket} */ (/** @type {unknown} */ (targetB))
+        }
+        return connectTcp(target)
       }
-      return connectTcp(target)
-    }
-  })
-  t.after(() => gateway.close())
-  await gateway.start()
-  const client = new ReverseGatewayConnection({gatewayId: "o2", connectionId: "outcome_client_01", hub: {host: "127.0.0.1", port: hub.port, token: "client-token"}, tls, spoolDirectory: join(root, "client-spool"), reconnectDelayMs: 500, maxReconnectDelayMs: 500})
-  t.after(() => client.close())
-  await client.connect()
-  const socketA = client.createConnection({identifier: "outcome_stream_a", sessionName: "outcome-a", host: "127.0.0.1", port: portA})
-  const socketB = client.createConnection({identifier: "outcome_stream_b", sessionName: "outcome-b", host: "target-b", port: 2376})
-  await Promise.all([onceEvent(socketA, "connect"), onceEvent(socketB, "connect")])
-  socketA.write("one|")
-  const preA = readBytes(socketA, 6)
-  assert.equal((await withTimeout(preA, "stream A pre-interruption echo")).toString(), "a:one|")
-  socketB.write("two|")
-  await waitUntil(() => targetB !== undefined && Buffer.concat(targetB.chunks).toString() === "two|", "stream B bytes reached its target")
-  const terminalB = nextError(socketB)
+    })
+    after(() => gateway.close())
+    await gateway.start()
+    const client = new ReverseGatewayConnection({gatewayId: "o2", connectionId: "outcome_client_01", hub: {host: "127.0.0.1", port: hub.port, token: "client-token"}, tls, spoolDirectory: join(root, "client-spool"), reconnectDelayMs: 500, maxReconnectDelayMs: 500})
+    after(() => client.close())
+    await client.connect()
+    const socketA = client.createConnection({identifier: "outcome_stream_a", sessionName: "outcome-a", host: "127.0.0.1", port: portA})
+    const socketB = client.createConnection({identifier: "outcome_stream_b", sessionName: "outcome-b", host: "target-b", port: 2376})
+    await Promise.all([onceEvent(socketA, "connect"), onceEvent(socketB, "connect")])
+    socketA.write("one|")
+    const preA = readBytes(socketA, 6)
+    expect((await withTimeout(preA, "stream A pre-interruption echo")).toString()).toBe("a:one|")
+    socketB.write("two|")
+    await waitUntil(() => targetB !== undefined && Buffer.concat(targetB.chunks).toString() === "two|", "stream B bytes reached its target")
+    const terminalB = nextError(socketB)
 
-  // The gateway physical dies and the client peer is kicked into a slow (500ms)
-  // reconnect. While both are apart, target B overflows the gateway stream
-  // buffer: the gateway resets and destroys B in memory, but its RESET cannot
-  // reach the hub, so the hub still owns B when the gateway re-registers.
-  await hub.closeActiveGateway("o2")
-  await waitUntil(() => gateway.status().physicalState === "reconnecting", "gateway interruption")
-  await new Promise((resolve) => setTimeout(resolve, 100))
-  assert.equal(client.status().physicalState, "reconnecting", "the client peer must still be mid-reconnect when target B overflows")
-  targetB?.flood(Buffer.alloc(64, 0x42))
-  await waitUntil(() => hub.status().gatewayPhysicalConnections >= 1, "gateway re-registration before the peer returns")
-  assert.equal(targetB?.destroyed, true, "the overflowed stream target must be released in memory")
+    // The gateway physical dies and the client peer is kicked into a slow (500ms)
+    // reconnect. While both are apart, target B overflows the gateway stream
+    // buffer: the gateway resets and destroys B in memory, but its RESET cannot
+    // reach the hub, so the hub still owns B when the gateway re-registers.
+    await hub.closeActiveGateway("o2")
+    await waitUntil(() => gateway.status().physicalState === "reconnecting", "gateway interruption")
+    await new Promise((resolve) => setTimeout(resolve, 100))
+    expect(client.status().physicalState).toBe("reconnecting") // the client peer must still be mid-reconnect when target B overflows
+    targetB?.flood(Buffer.alloc(64, 0x42))
+    await waitUntil(() => hub.status().gatewayPhysicalConnections >= 1, "gateway re-registration before the peer returns")
+    expect(targetB?.destroyed).toBe(true) // the overflowed stream target must be released in memory
 
-  const error = /** @type {Error & Record<string, unknown>} */ (await withTimeout(terminalB, "stream B terminal outcome after peer return"))
-  assert.equal(error.code, "RESUME_STREAM_OMITTED", "the reconnecting peer must receive the retained causal code")
-  assert.match(String(error.disconnectIncidentId ?? ""), /^[A-Za-z0-9_-]{22}$/, "the retained outcome must carry the incident attribution")
+    const error = /** @type {Error & Record<string, unknown>} */ (await withTimeout(terminalB, "stream B terminal outcome after peer return"))
+    expect(error.code).toBe("RESUME_STREAM_OMITTED") // the reconnecting peer must receive the retained causal code
+    expect(String(error.disconnectIncidentId ?? "")).toMatch(/^[A-Za-z0-9_-]{22}$/) // the retained outcome must carry the incident attribution
 
-  const postA = readBytes(socketA, 12)
-  socketA.write("one-after|")
-  assert.equal((await withTimeout(postA, "stream A post-resume echo")).toString(), "a:one-after|")
-  assert.equal(acceptsA, 1, "the surviving stream must resume on its original target")
-  assert.equal(targetBCreates, 1, "the terminal stream must never reopen its target")
-  assert.equal(targetB?.destroyed, true, "the terminal stream target must be released exactly once")
+    const postA = readBytes(socketA, 12)
+    socketA.write("one-after|")
+    expect((await withTimeout(postA, "stream A post-resume echo")).toString()).toBe("a:one-after|")
+    expect(acceptsA).toBe(1) // the surviving stream must resume on its original target
+    expect(targetBCreates).toBe(1) // the terminal stream must never reopen its target
+    expect(targetB?.destroyed).toBe(true) // the terminal stream target must be released exactly once
 
-  const closedA = onceEvent(socketA, "close")
-  socketA.end()
-  await withTimeout(closedA, "stream A cleanup close")
-  await waitUntil(() => hub.status().virtualStreams === 0 && client.status().virtualStreams === 0 && gateway.status().virtualStreams === 0 && targetSocketsA.size === 0, "retained-outcome ownership cleanup")
-})
+    const closedA = onceEvent(socketA, "close")
+    socketA.end()
+    await withTimeout(closedA, "stream A cleanup close")
+    await waitUntil(() => hub.status().virtualStreams === 0 && client.status().virtualStreams === 0 && gateway.status().virtualStreams === 0 && targetSocketsA.size === 0, "retained-outcome ownership cleanup")
+  }))
 
-test("a paired resume extension is bounded by one window and genuine expiry still releases state", async (t) => {
-  const root = await mkdtemp(join(tmpdir(), "socketduct-reverse-resume-bounded-"))
-  t.after(() => rm(root, {recursive: true, force: true}))
-  const certificates = generateTestCertificates(root)
-  let targetAccepts = 0
-  const targetSockets = new Set()
-  const target = createServer((socket) => {
-    targetAccepts += 1
-    targetSockets.add(socket)
-    socket.once("close", () => targetSockets.delete(socket))
-  })
-  const targetPort = await listen(target)
-  t.after(() => { for (const socket of targetSockets) socket.destroy(); return new Promise((resolve) => target.close(() => resolve(undefined))) })
-  const tokens = new StaticTokenStore([{username: "home", token: "gateway-token"}, {username: "app", token: "client-token"}])
-  const hub = await startReverseGatewayHub({tokens, tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile}, authorizeGateway: () => true, authorizeClientGateway: () => true, authorizeOpen: () => true, resumeWindowMs: 250})
-  t.after(() => hub.close())
-  const tls = {caFile: certificates.caCertFile, servername: "localhost"}
-  const gateway = new OutboundReverseGateway({gatewayId: "o2", connectionId: "bounded_expiry_gateway", hub: {host: "127.0.0.1", port: hub.port, token: "gateway-token"}, tls, spoolDirectory: join(root, "gateway-spool"), authorizeTarget: () => true, reconnectDelayMs: 1_000, maxReconnectDelayMs: 1_000})
-  t.after(() => gateway.close())
-  await gateway.start()
-  const client = new ReverseGatewayConnection({gatewayId: "o2", connectionId: "bounded_expiry_client", hub: {host: "127.0.0.1", port: hub.port, token: "client-token"}, tls, spoolDirectory: join(root, "client-spool"), reconnectDelayMs: 10, maxReconnectDelayMs: 20})
-  t.after(() => client.close())
-  await client.connect()
-  const socket = client.createConnection({identifier: "bounded_stream_01", sessionName: "bounded-stream", host: "127.0.0.1", port: targetPort})
-  const terminal = nextError(socket)
-  await onceEvent(socket, "connect")
+  it("a paired resume extension is bounded by one window and genuine expiry still releases state", async () => withTestCleanup(async (after) => {
+    const root = await mkdtemp(join(tmpdir(), "socketduct-reverse-resume-bounded-"))
+    after(() => rm(root, {recursive: true, force: true}))
+    const certificates = generateTestCertificates(root)
+    let targetAccepts = 0
+    const targetSockets = new Set()
+    const target = createServer((socket) => {
+      targetAccepts += 1
+      targetSockets.add(socket)
+      socket.once("close", () => targetSockets.delete(socket))
+    })
+    const targetPort = await listen(target)
+    after(() => { for (const socket of targetSockets) socket.destroy(); return new Promise((resolve) => target.close(() => resolve(undefined))) })
+    const tokens = new StaticTokenStore([{username: "home", token: "gateway-token"}, {username: "app", token: "client-token"}])
+    const hub = await startReverseGatewayHub({tokens, tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile}, authorizeGateway: () => true, authorizeClientGateway: () => true, authorizeOpen: () => true, resumeWindowMs: 250})
+    after(() => hub.close())
+    const tls = {caFile: certificates.caCertFile, servername: "localhost"}
+    const gateway = new OutboundReverseGateway({gatewayId: "o2", connectionId: "bounded_expiry_gateway", hub: {host: "127.0.0.1", port: hub.port, token: "gateway-token"}, tls, spoolDirectory: join(root, "gateway-spool"), authorizeTarget: () => true, reconnectDelayMs: 1_000, maxReconnectDelayMs: 1_000})
+    after(() => gateway.close())
+    await gateway.start()
+    const client = new ReverseGatewayConnection({gatewayId: "o2", connectionId: "bounded_expiry_client", hub: {host: "127.0.0.1", port: hub.port, token: "client-token"}, tls, spoolDirectory: join(root, "client-spool"), reconnectDelayMs: 10, maxReconnectDelayMs: 20})
+    after(() => client.close())
+    await client.connect()
+    const socket = client.createConnection({identifier: "bounded_stream_01", sessionName: "bounded-stream", host: "127.0.0.1", port: targetPort})
+    const terminal = nextError(socket)
+    await onceEvent(socket, "connect")
 
-  await hub.closeActiveGateway("o2")
-  await waitUntil(() => gateway.status().physicalState === "reconnecting", "gateway interruption")
-  // The gateway returns at ~1000ms, far beyond the one bounded extension
-  // (original 250ms window extended once to 500ms), so the pair must expire.
-  const error = /** @type {Error & {code?: string}} */ (await withTimeout(terminal, "bounded expired resume"))
-  assert.equal(error.code, "RESUME_WINDOW_EXPIRED")
-  await waitUntil(() => hub.status().virtualStreams === 0 && client.status().virtualStreams === 0 && gateway.status().virtualStreams === 0 && targetSockets.size === 0, "bounded expiry releases all retained state")
-  assert.equal(targetAccepts, 1, "the expired stream must not reopen its target")
-})
+    await hub.closeActiveGateway("o2")
+    await waitUntil(() => gateway.status().physicalState === "reconnecting", "gateway interruption")
+    // The gateway returns at ~1000ms, far beyond the one bounded extension
+    // (original 250ms window extended once to 500ms), so the pair must expire.
+    const error = /** @type {Error & {code?: string}} */ (await withTimeout(terminal, "bounded expired resume"))
+    expect(error.code).toBe("RESUME_WINDOW_EXPIRED")
+    await waitUntil(() => hub.status().virtualStreams === 0 && client.status().virtualStreams === 0 && gateway.status().virtualStreams === 0 && targetSockets.size === 0, "bounded expiry releases all retained state")
+    expect(targetAccepts).toBe(1) // the expired stream must not reopen its target
+  }))
 
-test("multiple concurrent streams share one physical interruption and resume together on their original targets", async (t) => {
-  const root = await mkdtemp(join(tmpdir(), "socketduct-reverse-multi-stream-resume-"))
-  t.after(() => rm(root, {recursive: true, force: true}))
-  const certificates = generateTestCertificates(root)
-  let targetAccepts = 0
-  const targetSockets = new Set()
-  const target = createServer((socket) => {
-    targetAccepts += 1
-    targetSockets.add(socket)
-    socket.once("close", () => targetSockets.delete(socket))
-    socket.on("data", (chunk) => socket.write(Buffer.concat([Buffer.from("t:"), chunk])))
-  })
-  const targetPort = await listen(target)
-  t.after(() => { for (const socket of targetSockets) socket.destroy(); return new Promise((resolve) => target.close(() => resolve(undefined))) })
-  const tokens = new StaticTokenStore([{username: "home", token: "gateway-token"}, {username: "app", token: "client-token"}])
-  const hub = await startReverseGatewayHub({tokens, tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile}, authorizeGateway: () => true, authorizeClientGateway: () => true, authorizeOpen: () => true, resumeWindowMs: 2_000})
-  t.after(() => hub.close())
-  const tls = {caFile: certificates.caCertFile, servername: "localhost"}
-  const gateway = new OutboundReverseGateway({gatewayId: "o2", connectionId: "multi_resume_gateway", hub: {host: "127.0.0.1", port: hub.port, token: "gateway-token"}, tls, spoolDirectory: join(root, "gateway-spool"), authorizeTarget: () => true, reconnectDelayMs: 30, maxReconnectDelayMs: 30})
-  t.after(() => gateway.close())
-  await gateway.start()
-  const client = new ReverseGatewayConnection({gatewayId: "o2", connectionId: "multi_resume_client", hub: {host: "127.0.0.1", port: hub.port, token: "client-token"}, tls, spoolDirectory: join(root, "client-spool"), reconnectDelayMs: 10, maxReconnectDelayMs: 20})
-  t.after(() => client.close())
-  await client.connect()
-  /** @type {import('node:stream').Duplex[]} */
-  const sockets = []
-  /** @type {Promise<string>[]} */
-  const echoes = []
-  for (let index = 1; index <= 3; index += 1) {
-    const socket = client.createConnection({identifier: `multi_stream_${index}`, sessionName: `multi-stream-${index}`, host: "127.0.0.1", port: targetPort})
-    sockets.push(socket)
-    await onceEvent(socket, "connect")
-  }
-  let echoIndex = 1
-  for (const socket of sockets) {
-    socket.write(`pre${echoIndex}|`)
-    echoes.push(readBytes(socket, 2 + 3 + String(echoIndex).length + 1).then((bytes) => bytes.toString()))
-    echoIndex += 1
-  }
-  const preEchoes = await Promise.all(echoes.map((promise) => withTimeout(promise, "pre-resume echo")))
-  assert.deepEqual(preEchoes, ["t:pre1|", "t:pre2|", "t:pre3|"])
-  assert.equal(targetAccepts, 3)
+  it("multiple concurrent streams share one physical interruption and resume together on their original targets", async () => withTestCleanup(async (after) => {
+    const root = await mkdtemp(join(tmpdir(), "socketduct-reverse-multi-stream-resume-"))
+    after(() => rm(root, {recursive: true, force: true}))
+    const certificates = generateTestCertificates(root)
+    let targetAccepts = 0
+    const targetSockets = new Set()
+    const target = createServer((socket) => {
+      targetAccepts += 1
+      targetSockets.add(socket)
+      socket.once("close", () => targetSockets.delete(socket))
+      socket.on("data", (chunk) => socket.write(Buffer.concat([Buffer.from("t:"), chunk])))
+    })
+    const targetPort = await listen(target)
+    after(() => { for (const socket of targetSockets) socket.destroy(); return new Promise((resolve) => target.close(() => resolve(undefined))) })
+    const tokens = new StaticTokenStore([{username: "home", token: "gateway-token"}, {username: "app", token: "client-token"}])
+    const hub = await startReverseGatewayHub({tokens, tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile}, authorizeGateway: () => true, authorizeClientGateway: () => true, authorizeOpen: () => true, resumeWindowMs: 2_000})
+    after(() => hub.close())
+    const tls = {caFile: certificates.caCertFile, servername: "localhost"}
+    const gateway = new OutboundReverseGateway({gatewayId: "o2", connectionId: "multi_resume_gateway", hub: {host: "127.0.0.1", port: hub.port, token: "gateway-token"}, tls, spoolDirectory: join(root, "gateway-spool"), authorizeTarget: () => true, reconnectDelayMs: 30, maxReconnectDelayMs: 30})
+    after(() => gateway.close())
+    await gateway.start()
+    const client = new ReverseGatewayConnection({gatewayId: "o2", connectionId: "multi_resume_client", hub: {host: "127.0.0.1", port: hub.port, token: "client-token"}, tls, spoolDirectory: join(root, "client-spool"), reconnectDelayMs: 10, maxReconnectDelayMs: 20})
+    after(() => client.close())
+    await client.connect()
+    /** @type {import('node:stream').Duplex[]} */
+    const sockets = []
+    /** @type {Promise<string>[]} */
+    const echoes = []
+    for (let index = 1; index <= 3; index += 1) {
+      const socket = client.createConnection({identifier: `multi_stream_${index}`, sessionName: `multi-stream-${index}`, host: "127.0.0.1", port: targetPort})
+      sockets.push(socket)
+      await onceEvent(socket, "connect")
+    }
+    let echoIndex = 1
+    for (const socket of sockets) {
+      socket.write(`pre${echoIndex}|`)
+      echoes.push(readBytes(socket, 2 + 3 + String(echoIndex).length + 1).then((bytes) => bytes.toString()))
+      echoIndex += 1
+    }
+    const preEchoes = await Promise.all(echoes.map((promise) => withTimeout(promise, "pre-resume echo")))
+    expect(preEchoes).toEqual(["t:pre1|", "t:pre2|", "t:pre3|"])
+    expect(targetAccepts).toBe(3)
 
-  await hub.closeActiveGateway("o2")
-  let postIndex = 1
-  for (const socket of sockets) {
-    socket.write(`post${postIndex}|`)
-    postIndex += 1
-  }
-  /** @type {Promise<string>[]} */
-  const postEchoes = sockets.map((socket, index) => readBytes(socket, 2 + 4 + String(index + 1).length + 1).then((bytes) => bytes.toString()))
-  await waitUntil(() => gateway.status().physicalConnects >= 2 && gateway.status().physicalState === "ready", "shared gateway re-registration")
-  const postEchoesReceived = await Promise.all(postEchoes.map((promise) => withTimeout(promise, "post-resume echo")))
-  assert.deepEqual(postEchoesReceived, ["t:post1|", "t:post2|", "t:post3|"], "every stream must resume on its original target without cross-stream loss")
-  assert.equal(targetAccepts, 3, "the shared interruption must not create replacement targets")
-  assert.equal(hub.status().virtualStreams, 3)
+    await hub.closeActiveGateway("o2")
+    let postIndex = 1
+    for (const socket of sockets) {
+      socket.write(`post${postIndex}|`)
+      postIndex += 1
+    }
+    /** @type {Promise<string>[]} */
+    const postEchoes = sockets.map((socket, index) => readBytes(socket, 2 + 4 + String(index + 1).length + 1).then((bytes) => bytes.toString()))
+    await waitUntil(() => gateway.status().physicalConnects >= 2 && gateway.status().physicalState === "ready", "shared gateway re-registration")
+    const postEchoesReceived = await Promise.all(postEchoes.map((promise) => withTimeout(promise, "post-resume echo")))
+    expect(postEchoesReceived).toEqual(["t:post1|", "t:post2|", "t:post3|"]) // every stream must resume on its original target without cross-stream loss
+    expect(targetAccepts).toBe(3) // the shared interruption must not create replacement targets
+    expect(hub.status().virtualStreams).toBe(3)
 
-  const closes = sockets.map((socket) => { socket.end(); return onceEvent(socket, "close") })
-  await Promise.all(closes.map((promise) => withTimeout(promise, "multi-stream cleanup close")))
-  await waitUntil(() => hub.status().virtualStreams === 0 && client.status().virtualStreams === 0 && gateway.status().virtualStreams === 0 && targetSockets.size === 0, "multi-stream ownership cleanup")
+    const closes = sockets.map((socket) => { socket.end(); return onceEvent(socket, "close") })
+    await Promise.all(closes.map((promise) => withTimeout(promise, "multi-stream cleanup close")))
+    await waitUntil(() => hub.status().virtualStreams === 0 && client.status().virtualStreams === 0 && gateway.status().virtualStreams === 0 && targetSockets.size === 0, "multi-stream ownership cleanup")
+  }))
 })