socketduct 0.1.25 → 0.1.27

package/test/integration/multiplexed-transport.test.js

@@ -1,7 +1,6 @@
 /* eslint-disable jsdoc/escape-inline-tags, jsdoc/require-param-type, jsdoc/require-returns */
-import assert from "node:assert/strict"
+import {describe, expect, it, withTestCleanup} from "@velocious/testing"
 import {createServer} from "node:net"
-import test from "node:test"
 
 import {StaticTokenStore} from "../../src/auth/static-token-store.js"
 import {MultiplexedSocketductConnection} from "../../src/client/multiplexed-connection.js"
@@ -17,7 +16,7 @@ async function listen(server) {
     })
   })
   const address = server.address()
-  assert(address !== null && typeof address !== "string")
+  if (!address || typeof address === "string") throw new Error("expected AddressInfo")
   return address.port
 }
 
@@ -50,7 +49,7 @@ async function readExactly(socket, expected) {
       if (value.length < expected.length) return
       cleanup()
       try {
-        assert.equal(value, expected)
+        expect(value).toBe(expected)
         resolve(undefined)
       } catch (error) {
         reject(error)
@@ -65,144 +64,146 @@ async function readExactly(socket, expected) {
   })
 }
 
-test("two virtual sockets use one authenticated physical transport", async (t) => {
-  let targetAccepts = 0
-  const target = createServer((socket) => {
-    targetAccepts += 1
-    socket.on("data", (chunk) => socket.write(chunk))
-  })
-  const targetPort = await listen(target)
-  t.after(() => new Promise((resolve) => target.close(() => resolve(undefined))))
-
-  const relay = await startMultiplexedTcpRelay({
-    tokens: new StaticTokenStore([{username: "edge", token: "valid-token"}]),
-    authorizeTarget: ({target: requested}) => requested.host === "127.0.0.1" && requested.port === targetPort
-  })
-  t.after(() => relay.close())
+describe("multiplexed transport", () => {
+  it("two virtual sockets use one authenticated physical transport", async () => withTestCleanup(async (after) => {
+    let targetAccepts = 0
+    const target = createServer((socket) => {
+      targetAccepts += 1
+      socket.on("data", (chunk) => socket.write(chunk))
+    })
+    const targetPort = await listen(target)
+    after(() => new Promise((resolve) => target.close(() => resolve(undefined))))
 
-  const connection = new MultiplexedSocketductConnection({
-    relay: {host: "127.0.0.1", port: relay.port, token: "valid-token"}
-  })
-  t.after(() => connection.close())
+    const relay = await startMultiplexedTcpRelay({
+      tokens: new StaticTokenStore([{username: "edge", token: "valid-token"}]),
+      authorizeTarget: ({target: requested}) => requested.host === "127.0.0.1" && requested.port === targetPort
+    })
+    after(() => relay.close())
 
-  const first = connection.createConnection({host: "127.0.0.1", port: targetPort, sessionName: "first"})
-  const second = connection.createConnection({host: "127.0.0.1", port: targetPort, sessionName: "second"})
-  await Promise.all([onceEvent(first, "connect"), onceEvent(second, "connect")])
+    const connection = new MultiplexedSocketductConnection({
+      relay: {host: "127.0.0.1", port: relay.port, token: "valid-token"}
+    })
+    after(() => connection.close())
 
-  first.write("one")
-  second.write("two")
-  await Promise.all([readExactly(first, "one"), readExactly(second, "two")])
+    const first = connection.createConnection({host: "127.0.0.1", port: targetPort, sessionName: "first"})
+    const second = connection.createConnection({host: "127.0.0.1", port: targetPort, sessionName: "second"})
+    await Promise.all([onceEvent(first, "connect"), onceEvent(second, "connect")])
 
-  assert.equal(relay.status().physicalAccepts, 1)
-  assert.equal(relay.status().authenticatedConnections, 1)
-  assert.equal(targetAccepts, 2)
-  assert.equal(connection.status().virtualStreams, 2)
+    first.write("one")
+    second.write("two")
+    await Promise.all([readExactly(first, "one"), readExactly(second, "two")])
 
-  first.destroy()
-  assert.equal(second.destroyed, false)
-  second.destroy()
-})
+    expect(relay.status().physicalAccepts).toBe(1)
+    expect(relay.status().authenticatedConnections).toBe(1)
+    expect(targetAccepts).toBe(2)
+    expect(connection.status().virtualStreams).toBe(2)
 
-test("one transport drop has one reconnect owner and resumes sibling streams without gaps", async (t) => {
-  /** @type {Array<{event: string} & Record<string, unknown>>} */
-  const lifecycle = []
-  const logger = {log: (/** @type {string} */ event, /** @type {Record<string, unknown>} */ fields = {}) => lifecycle.push({event, ...fields})}
-  const target = createServer((socket) => socket.on("data", (chunk) => socket.write(chunk)))
-  const targetPort = await listen(target)
-  t.after(() => new Promise((resolve) => target.close(() => resolve(undefined))))
-  const relay = await startMultiplexedTcpRelay({
-    tokens: new StaticTokenStore([{username: "edge", token: "valid-token"}]),
-    authorizeTarget: ({target: requested}) => requested.host === "127.0.0.1" && requested.port === targetPort
-  })
-  t.after(() => relay.close())
-  const connection = new MultiplexedSocketductConnection({
-    relay: {host: "127.0.0.1", port: relay.port, token: "valid-token"},
-    reconnectDelayMs: 10,
-    logger
-  })
-  t.after(() => connection.close())
-  const first = connection.createConnection({host: "127.0.0.1", port: targetPort, sessionName: "resume-a"})
-  const second = connection.createConnection({host: "127.0.0.1", port: targetPort, sessionName: "resume-b"})
-  await Promise.all([onceEvent(first, "connect"), onceEvent(second, "connect")])
-  first.write("before-a")
-  second.write("before-b")
-  await Promise.all([readExactly(first, "before-a"), readExactly(second, "before-b")])
-
-  const ready = Promise.all([onceEvent(first, "ready"), onceEvent(second, "ready")])
-  await relay.closeActiveTransport()
-  first.write("after-a")
-  second.write("after-b")
-  await ready
-  await Promise.all([readExactly(first, "after-a"), readExactly(second, "after-b")])
-
-  assert.equal(relay.status().physicalAccepts, 2)
-  assert.equal(connection.status().reconnectAttempts, 1)
-  assert.equal(connection.status().reconnectSuccesses, 1)
-  assert.equal(relay.status().resumeSuccesses, 2)
-  const closed = Promise.all([onceEvent(first, "close"), onceEvent(second, "close")])
-  first.destroy()
-  second.destroy()
-  await closed
-  for (const event of [
-    "transport.connecting",
-    "transport.connected",
-    "transport.disconnected",
-    "transport.reconnect_scheduled",
-    "transport.reconnect_succeeded",
-    "virtual_stream.opening",
-    "virtual_stream.opened",
-    "virtual_stream.closed"
-  ]) assert(lifecycle.some((entry) => entry.event === event), `missing ${event}`)
-  assert.doesNotMatch(JSON.stringify(lifecycle), /valid-token|resume-a|resume-b|127\.0\.0\.1/)
-})
+    first.destroy()
+    expect(second.destroyed).toBe(false)
+    second.destroy()
+  }))
 
-test("100 concurrent build-like streams create zero extra physical accepts", async (t) => {
-  let targetAccepts = 0
-  const target = createServer((socket) => {
-    targetAccepts += 1
-    socket.on("data", (chunk) => {
-      const split = Math.max(1, Math.floor(chunk.length / 2))
-      socket.write(chunk.subarray(0, split))
-      socket.write(chunk.subarray(split))
+  it("one transport drop has one reconnect owner and resumes sibling streams without gaps", async () => withTestCleanup(async (after) => {
+    /** @type {Array<{event: string} & Record<string, unknown>>} */
+    const lifecycle = []
+    const logger = {log: (/** @type {string} */ event, /** @type {Record<string, unknown>} */ fields = {}) => lifecycle.push({event, ...fields})}
+    const target = createServer((socket) => socket.on("data", (chunk) => socket.write(chunk)))
+    const targetPort = await listen(target)
+    after(() => new Promise((resolve) => target.close(() => resolve(undefined))))
+    const relay = await startMultiplexedTcpRelay({
+      tokens: new StaticTokenStore([{username: "edge", token: "valid-token"}]),
+      authorizeTarget: ({target: requested}) => requested.host === "127.0.0.1" && requested.port === targetPort
     })
-  })
-  const targetPort = await listen(target)
-  t.after(() => new Promise((resolve) => target.close(() => resolve(undefined))))
-  const relay = await startMultiplexedTcpRelay({
-    tokens: new StaticTokenStore([{username: "edge", token: "valid-token"}]),
-    authorizeTarget: ({target: requested}) => requested.host === "127.0.0.1" && requested.port === targetPort,
-    maxStreams: 128
-  })
-  t.after(() => relay.close())
-  const connection = new MultiplexedSocketductConnection({
-    relay: {host: "127.0.0.1", port: relay.port, token: "valid-token"},
-    maxStreams: 128
-  })
-  t.after(() => connection.close())
+    after(() => relay.close())
+    const connection = new MultiplexedSocketductConnection({
+      relay: {host: "127.0.0.1", port: relay.port, token: "valid-token"},
+      reconnectDelayMs: 10,
+      logger
+    })
+    after(() => connection.close())
+    const first = connection.createConnection({host: "127.0.0.1", port: targetPort, sessionName: "resume-a"})
+    const second = connection.createConnection({host: "127.0.0.1", port: targetPort, sessionName: "resume-b"})
+    await Promise.all([onceEvent(first, "connect"), onceEvent(second, "connect")])
+    first.write("before-a")
+    second.write("before-b")
+    await Promise.all([readExactly(first, "before-a"), readExactly(second, "before-b")])
+
+    const ready = Promise.all([onceEvent(first, "ready"), onceEvent(second, "ready")])
+    await relay.closeActiveTransport()
+    first.write("after-a")
+    second.write("after-b")
+    await ready
+    await Promise.all([readExactly(first, "after-a"), readExactly(second, "after-b")])
+
+    expect(relay.status().physicalAccepts).toBe(2)
+    expect(connection.status().reconnectAttempts).toBe(1)
+    expect(connection.status().reconnectSuccesses).toBe(1)
+    expect(relay.status().resumeSuccesses).toBe(2)
+    const closed = Promise.all([onceEvent(first, "close"), onceEvent(second, "close")])
+    first.destroy()
+    second.destroy()
+    await closed
+    for (const event of [
+      "transport.connecting",
+      "transport.connected",
+      "transport.disconnected",
+      "transport.reconnect_scheduled",
+      "transport.reconnect_succeeded",
+      "virtual_stream.opening",
+      "virtual_stream.opened",
+      "virtual_stream.closed"
+    ]) expect(lifecycle.some((entry) => entry.event === event)).toBeTruthy() // missing ${event}
+    expect(JSON.stringify(lifecycle)).not.toMatch(/valid-token|resume-a|resume-b|127\.0\.0\.1/)
+  }))
 
-  const sockets = Array.from({length: 100}, (_, index) => connection.createConnection({
-    host: "127.0.0.1",
-    port: targetPort,
-    sessionName: `build-flow-${index + 1}`
+  it("100 concurrent build-like streams create zero extra physical accepts", async () => withTestCleanup(async (after) => {
+    let targetAccepts = 0
+    const target = createServer((socket) => {
+      targetAccepts += 1
+      socket.on("data", (chunk) => {
+        const split = Math.max(1, Math.floor(chunk.length / 2))
+        socket.write(chunk.subarray(0, split))
+        socket.write(chunk.subarray(split))
+      })
+    })
+    const targetPort = await listen(target)
+    after(() => new Promise((resolve) => target.close(() => resolve(undefined))))
+    const relay = await startMultiplexedTcpRelay({
+      tokens: new StaticTokenStore([{username: "edge", token: "valid-token"}]),
+      authorizeTarget: ({target: requested}) => requested.host === "127.0.0.1" && requested.port === targetPort,
+      maxStreams: 128
+    })
+    after(() => relay.close())
+    const connection = new MultiplexedSocketductConnection({
+      relay: {host: "127.0.0.1", port: relay.port, token: "valid-token"},
+      maxStreams: 128
+    })
+    after(() => connection.close())
+
+    const sockets = Array.from({length: 100}, (_, index) => connection.createConnection({
+      host: "127.0.0.1",
+      port: targetPort,
+      sessionName: `build-flow-${index + 1}`
+    }))
+    await Promise.all(sockets.map((socket) => onceEvent(socket, "connect")))
+    const reads = sockets.map((socket, index) => readExactly(socket, `flow-${index + 1}:${"x".repeat(1024)}`))
+    sockets.forEach((socket, index) => socket.write(`flow-${index + 1}:${"x".repeat(1024)}`))
+    await Promise.all(reads)
+
+    expect(relay.status().physicalAccepts).toBe(1)
+    expect(relay.status().physicalConnections).toBe(1)
+    expect(targetAccepts).toBe(100)
+    expect(connection.status().virtualStreams).toBe(100)
+
+    const resumed = Promise.all(sockets.map((socket) => onceEvent(socket, "ready")))
+    await relay.closeActiveTransport()
+    await resumed
+    const resumedReads = sockets.map((socket, index) => readExactly(socket, `resumed-${index + 1}`))
+    sockets.forEach((socket, index) => socket.write(`resumed-${index + 1}`))
+    await Promise.all(resumedReads)
+    expect(relay.status().physicalAccepts).toBe(2)
+    expect(relay.status().resumeSuccesses).toBe(100)
+    expect(connection.status().reconnectAttempts).toBe(1)
+    sockets.forEach((socket) => socket.destroy())
   }))
-  await Promise.all(sockets.map((socket) => onceEvent(socket, "connect")))
-  const reads = sockets.map((socket, index) => readExactly(socket, `flow-${index + 1}:${"x".repeat(1024)}`))
-  sockets.forEach((socket, index) => socket.write(`flow-${index + 1}:${"x".repeat(1024)}`))
-  await Promise.all(reads)
-
-  assert.equal(relay.status().physicalAccepts, 1)
-  assert.equal(relay.status().physicalConnections, 1)
-  assert.equal(targetAccepts, 100)
-  assert.equal(connection.status().virtualStreams, 100)
-
-  const resumed = Promise.all(sockets.map((socket) => onceEvent(socket, "ready")))
-  await relay.closeActiveTransport()
-  await resumed
-  const resumedReads = sockets.map((socket, index) => readExactly(socket, `resumed-${index + 1}`))
-  sockets.forEach((socket, index) => socket.write(`resumed-${index + 1}`))
-  await Promise.all(resumedReads)
-  assert.equal(relay.status().physicalAccepts, 2)
-  assert.equal(relay.status().resumeSuccesses, 100)
-  assert.equal(connection.status().reconnectAttempts, 1)
-  sockets.forEach((socket) => socket.destroy())
 })

package/test/integration/reverse-gateway-stream-id-reset.test.js

@@ -1,9 +1,8 @@
-import assert from "node:assert/strict"
+import {describe, expect, it, withTestCleanup} from "@velocious/testing"
 import {mkdtemp, rm} from "node:fs/promises"
 import {createServer} from "node:net"
 import {tmpdir} from "node:os"
 import {join} from "node:path"
-import test from "node:test"
 
 import {StaticTokenStore} from "../../src/auth/static-token-store.js"
 import {withTimeout, waitUntil} from "awaitery"
@@ -11,99 +10,101 @@ import {OutboundReverseGateway, ReverseGatewayConnection, startReverseGatewayHub
 import {generateTestCertificates} from "../helpers/tls-certificates.js"
 import {listen, onceEvent} from "../helpers/test-async.js"
 
-test("gateway resets its reverse stream high-water on fresh registration after a hub restart", async (t) => {
-  const root = await mkdtemp(join(tmpdir(), "socketduct-reverse-streamid-"))
-  t.after(() => rm(root, {recursive: true, force: true}))
-  const certificates = generateTestCertificates(root)
+describe("reverse gateway stream id reset", () => {
+  it("gateway resets its reverse stream high-water on fresh registration after a hub restart", async () => withTestCleanup(async (after) => {
+    const root = await mkdtemp(join(tmpdir(), "socketduct-reverse-streamid-"))
+    after(() => rm(root, {recursive: true, force: true}))
+    const certificates = generateTestCertificates(root)
 
-  let targetAccepts = 0
-  const targetSockets = new Set()
-  const target = createServer((socket) => {
-    targetAccepts += 1
-    targetSockets.add(socket)
-    socket.once("close", () => targetSockets.delete(socket))
-    socket.on("data", (chunk) => socket.write(chunk))
-  })
-  const targetPort = await listen(target)
-  t.after(() => {
-    for (const socket of targetSockets) socket.destroy()
-    return new Promise((resolve) => target.close(() => resolve(undefined)))
-  })
+    let targetAccepts = 0
+    const targetSockets = new Set()
+    const target = createServer((socket) => {
+      targetAccepts += 1
+      targetSockets.add(socket)
+      socket.once("close", () => targetSockets.delete(socket))
+      socket.on("data", (chunk) => socket.write(chunk))
+    })
+    const targetPort = await listen(target)
+    after(() => {
+      for (const socket of targetSockets) socket.destroy()
+      return new Promise((resolve) => target.close(() => resolve(undefined)))
+    })
 
-  const tokens = new StaticTokenStore([
-    {username: "home-o2", token: "gateway-token"},
-    {username: "tensorbuzz", token: "client-token"}
-  ])
-  const hubOptions = {
-    tokens,
-    tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile},
-    knownGatewayIds: ["o2"],
-    authorizeGateway: (/** @type {{principal: {username: string}, gatewayId: string}} */ {principal, gatewayId}) => principal.username === "home-o2" && gatewayId === "o2",
-    authorizeClientGateway: (/** @type {{principal: {username: string}, gatewayId: string}} */ {principal, gatewayId}) => principal.username === "tensorbuzz" && gatewayId === "o2",
-    authorizeOpen: (/** @type {{principal: {username: string}, gatewayId: string, target: {host: string, port: number}}} */ {principal, gatewayId, target: requested}) => principal.username === "tensorbuzz" && gatewayId === "o2" && requested.host === "127.0.0.1" && requested.port === targetPort
-  }
-  let hub = await startReverseGatewayHub(hubOptions)
-  t.after(() => hub.close())
+    const tokens = new StaticTokenStore([
+      {username: "home-o2", token: "gateway-token"},
+      {username: "tensorbuzz", token: "client-token"}
+    ])
+    const hubOptions = {
+      tokens,
+      tls: {certFile: certificates.serverCertFile, keyFile: certificates.serverKeyFile},
+      knownGatewayIds: ["o2"],
+      authorizeGateway: (/** @type {{principal: {username: string}, gatewayId: string}} */ {principal, gatewayId}) => principal.username === "home-o2" && gatewayId === "o2",
+      authorizeClientGateway: (/** @type {{principal: {username: string}, gatewayId: string}} */ {principal, gatewayId}) => principal.username === "tensorbuzz" && gatewayId === "o2",
+      authorizeOpen: (/** @type {{principal: {username: string}, gatewayId: string, target: {host: string, port: number}}} */ {principal, gatewayId, target: requested}) => principal.username === "tensorbuzz" && gatewayId === "o2" && requested.host === "127.0.0.1" && requested.port === targetPort
+    }
+    let hub = await startReverseGatewayHub(hubOptions)
+    after(() => hub.close())
 
-  const gateway = new OutboundReverseGateway({
-    gatewayId: "o2",
-    connectionId: "streamid_gateway",
-    hub: {host: "127.0.0.1", port: hub.port, token: "gateway-token"},
-    tls: {caFile: certificates.caCertFile, servername: "localhost"},
-    authorizeTarget: (requested) => requested.host === "127.0.0.1" && requested.port === targetPort,
-    reconnectDelayMs: 10,
-    maxReconnectDelayMs: 20
-  })
-  t.after(() => gateway.close())
-  await withTimeout(gateway.start(), "gateway registration")
+    const gateway = new OutboundReverseGateway({
+      gatewayId: "o2",
+      connectionId: "streamid_gateway",
+      hub: {host: "127.0.0.1", port: hub.port, token: "gateway-token"},
+      tls: {caFile: certificates.caCertFile, servername: "localhost"},
+      authorizeTarget: (requested) => requested.host === "127.0.0.1" && requested.port === targetPort,
+      reconnectDelayMs: 10,
+      maxReconnectDelayMs: 20
+    })
+    after(() => gateway.close())
+    await withTimeout(gateway.start(), "gateway registration")
 
-  const client = new ReverseGatewayConnection({
-    gatewayId: "o2",
-    connectionId: "streamid_client",
-    hub: {host: "127.0.0.1", port: hub.port, token: "client-token"},
-    tls: {caFile: certificates.caCertFile, servername: "localhost"},
-    reconnectDelayMs: 10,
-    maxReconnectDelayMs: 20
-  })
-  t.after(() => client.close())
-  await withTimeout(client.connect(), "client authentication")
+    const client = new ReverseGatewayConnection({
+      gatewayId: "o2",
+      connectionId: "streamid_client",
+      hub: {host: "127.0.0.1", port: hub.port, token: "client-token"},
+      tls: {caFile: certificates.caCertFile, servername: "localhost"},
+      reconnectDelayMs: 10,
+      maxReconnectDelayMs: 20
+    })
+    after(() => client.close())
+    await withTimeout(client.connect(), "client authentication")
 
-  // Open the first stream: this raises the gateway's process-lifetime
-  // #lastStreamId high-water mark above the fresh registration's start.
-  const first = client.createConnection({host: "127.0.0.1", port: targetPort, sessionName: "before-restart"})
-  await withTimeout(onceEvent(first, "connect"), "first reverse stream opens")
-  first.write("first")
-  await new Promise((resolve, reject) => {
-    first.once("data", (/** @type {Buffer} */ chunk) => { assert.equal(chunk.toString(), "first"); resolve(undefined) })
-    first.once("error", reject)
-  })
-  const firstClosed = onceEvent(first, "close")
-  first.end()
-  await withTimeout(firstClosed, "first stream close")
-  // Fully retire the first stream on every peer before the hub restarts so
-  // the only effect of the restart is the fresh (non-resumed) registration.
-  await waitUntil(() => client.status().virtualStreams === 0 && gateway.status().virtualStreams === 0 && hub.status().virtualStreams === 0, "first stream retired")
+    // Open the first stream: this raises the gateway's process-lifetime
+    // #lastStreamId high-water mark above the fresh registration's start.
+    const first = client.createConnection({host: "127.0.0.1", port: targetPort, sessionName: "before-restart"})
+    await withTimeout(onceEvent(first, "connect"), "first reverse stream opens")
+    first.write("first")
+    await new Promise((resolve, reject) => {
+      first.once("data", (/** @type {Buffer} */ chunk) => { expect(chunk.toString()).toBe("first"); resolve(undefined) })
+      first.once("error", reject)
+    })
+    const firstClosed = onceEvent(first, "close")
+    first.end()
+    await withTimeout(firstClosed, "first stream close")
+    // Fully retire the first stream on every peer before the hub restarts so
+    // the only effect of the restart is the fresh (non-resumed) registration.
+    await waitUntil(() => client.status().virtualStreams === 0 && gateway.status().virtualStreams === 0 && hub.status().virtualStreams === 0, "first stream retired")
 
-  // Restart the hub so the gateway reconnects with a fresh (non-resumed)
-  // registration whose stream ids restart from the low end.
-  const port = hub.port
-  await withTimeout(hub.close(), "hub close")
-  hub = await startReverseGatewayHub({...hubOptions, port})
-  t.after(() => hub.close())
-  await waitUntil(() => gateway.status().physicalState === "ready" && client.status().physicalState === "ready" && gateway.status().physicalConnects >= 2 && client.status().physicalConnects >= 2, "peers after hub restart")
+    // Restart the hub so the gateway reconnects with a fresh (non-resumed)
+    // registration whose stream ids restart from the low end.
+    const port = hub.port
+    await withTimeout(hub.close(), "hub close")
+    hub = await startReverseGatewayHub({...hubOptions, port})
+    after(() => hub.close())
+    await waitUntil(() => gateway.status().physicalState === "ready" && client.status().physicalState === "ready" && gateway.status().physicalConnects >= 2 && client.status().physicalConnects >= 2, "peers after hub restart")
 
-  // Without the high-water reset, this OPEN is rejected as
-  // "Invalid reverse gateway stream ID" and the gateway wedges.
-  const second = client.createConnection({host: "127.0.0.1", port: targetPort, sessionName: "after-restart"})
-  await withTimeout(onceEvent(second, "connect"), "second reverse stream opens after hub restart")
-  second.write("second")
-  await new Promise((resolve, reject) => {
-    second.once("data", (/** @type {Buffer} */ chunk) => { assert.equal(chunk.toString(), "second"); resolve(undefined) })
-    second.once("error", reject)
-  })
-  const secondClosed = onceEvent(second, "close")
-  second.end()
-  await withTimeout(secondClosed, "second stream close")
+    // Without the high-water reset, this OPEN is rejected as
+    // "Invalid reverse gateway stream ID" and the gateway wedges.
+    const second = client.createConnection({host: "127.0.0.1", port: targetPort, sessionName: "after-restart"})
+    await withTimeout(onceEvent(second, "connect"), "second reverse stream opens after hub restart")
+    second.write("second")
+    await new Promise((resolve, reject) => {
+      second.once("data", (/** @type {Buffer} */ chunk) => { expect(chunk.toString()).toBe("second"); resolve(undefined) })
+      second.once("error", reject)
+    })
+    const secondClosed = onceEvent(second, "close")
+    second.end()
+    await withTimeout(secondClosed, "second stream close")
 
-  assert.ok(targetAccepts >= 2, `expected at least two target connections, got ${targetAccepts}`)
+    expect(targetAccepts).toBeGreaterThanOrEqual(2) // expected at least two target connections, got ${targetAccepts}
+  }))
 })