socketduct 0.1.25 → 0.1.27

package/test/integration/stream-compression.test.js

@@ -1,10 +1,9 @@
-import assert from "node:assert/strict"
+import {createFakeTimers, describe, expect, it, withTestCleanup} from "@velocious/testing"
 import {randomBytes} from "node:crypto"
 import {mkdtemp, rm} from "node:fs/promises"
 import {createConnection, createServer} from "node:net"
 import {tmpdir} from "node:os"
 import {join} from "node:path"
-import test from "node:test"
 import zlib from "node:zlib"
 
 import {InMemoryUserStore, login, TokenStore} from "../../src/auth/user-store.js"
@@ -330,142 +329,179 @@ function holdNextZstdDecompression() {
   }
 }
 
-test("closeActiveTunnel waits for queued relay frame lifecycle settlement", {skip: !zstdAvailable()}, async () => {
-  const fixture = await startFixture()
-  const client = await framedClient(fixture.relayPort)
-  const payload = compressibleChunk(16_384)
-  const encoded = await encodeStreamPayload(payload, "zstd")
-  assert.equal(encoded.encoding, "zstd")
-  const held = holdNextZstdDecompression()
-  /** @type {Promise<void> | undefined} */
-  let closing
-  /** @type {Promise<void> | undefined} */
-  let joiningClose
-  let released = false
-
-  try {
-    client.send({
-      type: "session.create",
-      token: fixture.token,
-      name: "queued-close-settlement",
-      target: {host: "127.0.0.1", port: fixture.targetPort},
-      compression: ["zstd"]
-    })
-    const created = await client.next()
-    assert.equal(created.header.type, "session.created")
-    assert.equal(created.header.compression, "zstd")
-
-    client.send({
-      type: "stream.data",
-      direction: "client-to-target",
-      sequence: payload.length,
-      encoding: "zstd",
-      dataLength: payload.length
-    }, encoded.payload)
-    await held.entered
-
-    let closeResolved = false
-    closing = fixture.relay.closeActiveTunnel().then(() => { closeResolved = true })
-    await client.closed()
-    let joiningCloseResolved = false
-    joiningClose = fixture.relay.closeActiveTunnel().then(() => { joiningCloseResolved = true })
-    await new Promise((resolve) => setImmediate(resolve))
-    assert.equal(closeResolved, false, "closeActiveTunnel must await queued frame lifecycle work")
-    assert.equal(joiningCloseResolved, false, "a concurrent close must join queued frame lifecycle work")
-
-    held.release()
-    released = true
-    await Promise.all([closing, joiningClose])
-    assert.equal(fixture.relay.status().attachedSessions, 0)
-  } finally {
-    if (!released) held.release()
-    held.restore()
-    await closing
-    await joiningClose
-    client.close()
-    await fixture.close()
-  }
-})
-
-test("client negotiates compact v2, receives uncompressed data, and returns a compact ACK", async () => {
-  const tempDir = await mkdtemp(join(tmpdir(), "socketduct-client-compact-v2-"))
-  const payload = Buffer.from("compact-v2-client-data")
-  const stub = await relayStub({
-    framing: 2,
-    onReady: (socket) => socket.write(encodeCompactData({sequence: payload.length, payload}))
-  })
+/**
+ * @param {{port: number}} stub - Relay stub.
+ * @param {string} tempDir - Spool directory.
+ * @returns {Promise<Error>} - The error the client failed closed with.
+ */
+async function expectClientError(stub, tempDir) {
   const socket = connectSocketduct({
     relay: {host: "127.0.0.1", port: stub.port, token: "stub-token"},
-    sessionName: "compact v2 client",
+    sessionName: "stub session",
     target: {host: "127.0.0.1", port: 1},
     spoolDirectory: tempDir,
+    // Do not reconnect: a fail-closed receive path must surface, not retry forever.
     reconnect: {initialDelayMs: 60_000}
   })
-  const received = collect(socket)
-  await received.waitFor(payload.length)
-  assert.deepEqual(received.bytes(), payload)
-  for (let attempt = 0; attempt < 100 && !stub.received.some((frame) => frame.header.compact === true && frame.header.type === "stream.ack"); attempt += 1) {
-    await new Promise((resolve) => setTimeout(resolve, 5))
-  }
-  const ack = stub.received.find((frame) => frame.header.compact === true && frame.header.type === "stream.ack")
-  assert.equal(ack?.header.ackSequence, payload.length)
+
+  const error = await new Promise((resolve) => {
+    socket.once("error", (err) => resolve(err))
+  })
   socket.destroy()
-  await stub.close()
-  await rm(tempDir, {recursive: true, force: true})
-})
+  return error
+}
 
-test("client ignores a queued compact v2 frame from a stale relay while reconnect framing is reset", {skip: !zstdAvailable()}, async () => {
-  const tempDir = await mkdtemp(join(tmpdir(), "socketduct-client-stale-compact-v2-"))
-  const initial = Buffer.from("initial-current-relay-data")
-  const delayed = compressibleChunk(4_096)
-  const queuedStale = Buffer.from("queued-stale-relay-data")
-  const fresh = Buffer.from("fresh-reconnected-relay-data")
-  const encodedDelayed = await encodeStreamPayload(delayed, "zstd")
-  assert.equal(encodedDelayed.encoding, "zstd")
-
-  /** @type {import('node:net').Socket[]} */
-  const peers = []
-  /** @type {import('node:net').Socket | undefined} */
-  let firstPeer
-  /** @type {import('node:net').Socket | undefined} */
-  let resumedPeer
-  /** @type {() => void} */
-  let firstNegotiatedResolve = () => {}
-  const firstNegotiated = new Promise((resolve) => { firstNegotiatedResolve = () => resolve(undefined) })
-  /** @type {() => void} */
-  let resumeRequestedResolve = () => {}
-  const resumeRequested = new Promise((resolve) => { resumeRequestedResolve = () => resolve(undefined) })
-  const server = createServer((peer) => {
-    peers.push(peer)
-    peer.on("error", () => {})
-    const decoder = new FrameDecoder({compactDirection: "client-to-target"})
-    peer.on("data", (chunk) => {
-      for (const frame of decoder.push(chunk)) {
-        if (frame.header.type === "session.create") {
-          firstPeer = peer
-          peer.write(encodeFrame({type: "session.created", identifier: "stale-compact-v2", compression: "zstd", framing: 2}))
-          firstNegotiatedResolve()
-        } else if (frame.header.type === "session.resume") {
-          resumedPeer = peer
-          resumeRequestedResolve()
+describe("stream compression", () => {
+  it("closeActiveTunnel waits for queued relay frame lifecycle settlement", {skip: !zstdAvailable()}, async () => withTestCleanup(async (after) => {
+    const fixture = await startFixture()
+    const client = await framedClient(fixture.relayPort)
+    after(async () => {
+      client.close()
+      await fixture.close()
+    })
+    const payload = compressibleChunk(16_384)
+    const encoded = await encodeStreamPayload(payload, "zstd")
+    expect(encoded.encoding).toBe("zstd")
+    const held = holdNextZstdDecompression()
+    after(held.restore)
+    /** @type {Promise<void> | undefined} */
+    let closing
+    /** @type {Promise<void> | undefined} */
+    let joiningClose
+    let released = false
+
+    try {
+      client.send({
+        type: "session.create",
+        token: fixture.token,
+        name: "queued-close-settlement",
+        target: {host: "127.0.0.1", port: fixture.targetPort},
+        compression: ["zstd"]
+      })
+      const created = await client.next()
+      expect(created.header.type).toBe("session.created")
+      expect(created.header.compression).toBe("zstd")
+
+      client.send({
+        type: "stream.data",
+        direction: "client-to-target",
+        sequence: payload.length,
+        encoding: "zstd",
+        dataLength: payload.length
+      }, encoded.payload)
+      await held.entered
+
+      let closeResolved = false
+      closing = fixture.relay.closeActiveTunnel().then(() => { closeResolved = true })
+      await client.closed()
+      let joiningCloseResolved = false
+      joiningClose = fixture.relay.closeActiveTunnel().then(() => { joiningCloseResolved = true })
+      await new Promise((resolve) => setImmediate(resolve))
+      // closeActiveTunnel must await queued frame lifecycle work
+      expect(closeResolved).toBe(false)
+      // a concurrent close must join queued frame lifecycle work
+      expect(joiningCloseResolved).toBe(false)
+
+      held.release()
+      released = true
+      await Promise.all([closing, joiningClose])
+      expect(fixture.relay.status().attachedSessions).toBe(0)
+    } finally {
+      if (!released) held.release()
+      await closing
+      await joiningClose
+    }
+  }))
+
+  it("client negotiates compact v2, receives uncompressed data, and returns a compact ACK", async () => withTestCleanup(async (after) => {
+    const tempDir = await mkdtemp(join(tmpdir(), "socketduct-client-compact-v2-"))
+    after(() => rm(tempDir, {recursive: true, force: true}))
+    const payload = Buffer.from("compact-v2-client-data")
+    const stub = await relayStub({
+      framing: 2,
+      onReady: (socket) => socket.write(encodeCompactData({sequence: payload.length, payload}))
+    })
+    after(async () => {
+      await stub.close()
+    })
+    const socket = connectSocketduct({
+      relay: {host: "127.0.0.1", port: stub.port, token: "stub-token"},
+      sessionName: "compact v2 client",
+      target: {host: "127.0.0.1", port: 1},
+      spoolDirectory: tempDir,
+      reconnect: {initialDelayMs: 60_000}
+    })
+    after(() => { socket.destroy() })
+    const received = collect(socket)
+    await received.waitFor(payload.length)
+    expect(received.bytes()).toEqual(payload)
+    for (let attempt = 0; attempt < 100 && !stub.received.some((frame) => frame.header.compact === true && frame.header.type === "stream.ack"); attempt += 1) {
+      await new Promise((resolve) => setTimeout(resolve, 5))
+    }
+    const ack = stub.received.find((frame) => frame.header.compact === true && frame.header.type === "stream.ack")
+    expect(ack?.header.ackSequence).toBe(payload.length)
+  }))
+
+  it("client ignores a queued compact v2 frame from a stale relay while reconnect framing is reset", {skip: !zstdAvailable()}, async () => withTestCleanup(async (after) => {
+    const tempDir = await mkdtemp(join(tmpdir(), "socketduct-client-stale-compact-v2-"))
+    after(() => rm(tempDir, {recursive: true, force: true}))
+    const initial = Buffer.from("initial-current-relay-data")
+    const delayed = compressibleChunk(4_096)
+    const queuedStale = Buffer.from("queued-stale-relay-data")
+    const fresh = Buffer.from("fresh-reconnected-relay-data")
+    const encodedDelayed = await encodeStreamPayload(delayed, "zstd")
+    expect(encodedDelayed.encoding).toBe("zstd")
+
+    /** @type {import('node:net').Socket[]} */
+    const peers = []
+    /** @type {import('node:net').Socket | undefined} */
+    let firstPeer
+    /** @type {import('node:net').Socket | undefined} */
+    let resumedPeer
+    /** @type {() => void} */
+    let firstNegotiatedResolve = () => {}
+    const firstNegotiated = new Promise((resolve) => { firstNegotiatedResolve = () => resolve(undefined) })
+    /** @type {() => void} */
+    let resumeRequestedResolve = () => {}
+    const resumeRequested = new Promise((resolve) => { resumeRequestedResolve = () => resolve(undefined) })
+    const server = createServer((peer) => {
+      peers.push(peer)
+      peer.on("error", () => {})
+      const decoder = new FrameDecoder({compactDirection: "client-to-target"})
+      peer.on("data", (chunk) => {
+        for (const frame of decoder.push(chunk)) {
+          if (frame.header.type === "session.create") {
+            firstPeer = peer
+            peer.write(encodeFrame({type: "session.created", identifier: "stale-compact-v2", compression: "zstd", framing: 2}))
+            firstNegotiatedResolve()
+          } else if (frame.header.type === "session.resume") {
+            resumedPeer = peer
+            resumeRequestedResolve()
+          }
         }
+      })
+    })
+    const port = await listen(server)
+    const socket = connectSocketduct({
+      relay: {host: "127.0.0.1", port, token: "stub-token"},
+      sessionName: "stale compact v2 client",
+      target: {host: "127.0.0.1", port: 1},
+      spoolDirectory: tempDir,
+      reconnect: {initialDelayMs: 10}
+    })
+    after(async () => {
+      socket.destroy()
+      for (const peer of peers) {
+        peer.destroy()
       }
+      await new Promise((resolve) => server.close(() => resolve(undefined)))
     })
-  })
-  const port = await listen(server)
-  const socket = connectSocketduct({
-    relay: {host: "127.0.0.1", port, token: "stub-token"},
-    sessionName: "stale compact v2 client",
-    target: {host: "127.0.0.1", port: 1},
-    spoolDirectory: tempDir,
-    reconnect: {initialDelayMs: 10}
-  })
-  /** @type {Error[]} */
-  const errors = []
-  socket.on("error", (error) => errors.push(error))
-  const received = collect(socket)
-  const held = holdNextZstdDecompression()
-  try {
+    /** @type {Error[]} */
+    const errors = []
+    socket.on("error", (error) => errors.push(error))
+    const received = collect(socket)
+    const held = holdNextZstdDecompression()
+    after(held.restore)
     await firstNegotiated
     firstPeer?.write(encodeCompactData({sequence: initial.length, payload: initial}))
     await received.waitFor(initial.length)
@@ -485,88 +521,93 @@ test("client ignores a queued compact v2 frame from a stale relay while reconnec
     resumedPeer?.write(encodeCompactData({sequence: initial.length + fresh.length, payload: fresh}))
     await received.waitFor(initial.length + fresh.length)
 
-    assert.equal(socket.destroyed, false)
-    assert.deepEqual(errors, [])
-    assert.deepEqual(received.bytes(), Buffer.concat([initial, fresh]))
-  } finally {
-    held.restore()
-    socket.destroy()
-    for (const peer of peers) peer.destroy()
-    await new Promise((resolve) => server.close(() => resolve(undefined)))
-    await rm(tempDir, {recursive: true, force: true})
-  }
-})
-
-test("client writev emits one compact v2 data record for corked writes", async () => {
-  const tempDir = await mkdtemp(join(tmpdir(), "socketduct-client-writev-"))
-  const stub = await relayStub({framing: 2, onReady: () => {}})
-  const socket = connectSocketduct({
-    relay: {host: "127.0.0.1", port: stub.port, token: "stub-token"},
-    sessionName: "writev client",
-    target: {host: "127.0.0.1", port: 1},
-    spoolDirectory: tempDir,
-    reconnect: {initialDelayMs: 60_000}
-  })
-  await new Promise((resolve) => socket.once("connect", resolve))
-  socket.cork()
-  socket.write("writev-")
-  socket.write("merged")
-  socket.uncork()
-  for (let attempt = 0; attempt < 100 && !stub.received.some((frame) => frame.header.type === "stream.data"); attempt += 1) {
-    await new Promise((resolve) => setTimeout(resolve, 5))
-  }
-  const dataFrames = stub.received.filter((frame) => frame.header.type === "stream.data")
-  assert.equal(dataFrames.length, 1)
-  assert.equal(dataFrames[0]?.header.compact, true)
-  assert.deepEqual(dataFrames[0]?.payload, Buffer.from("writev-merged"))
-  socket.destroy()
-  await stub.close()
-  await rm(tempDir, {recursive: true, force: true})
-})
-
-test("client writev splits an oversized write into bounded compact data records", async () => {
-  const tempDir = await mkdtemp(join(tmpdir(), "socketduct-client-writev-limit-"))
-  const stub = await relayStub({framing: 2, onReady: () => {}})
-  const socket = connectSocketduct({
-    relay: {host: "127.0.0.1", port: stub.port, token: "stub-token"},
-    sessionName: "bounded writev client",
-    target: {host: "127.0.0.1", port: 1},
-    spoolDirectory: tempDir,
-    compressionLimits: {maxDecompressedBytes: 8},
-    reconnect: {initialDelayMs: 60_000}
-  })
-  await new Promise((resolve) => socket.once("connect", resolve))
-  const payload = Buffer.from("abcdefghijklmnopqrst")
-  socket.cork()
-  socket.write(payload)
-  socket.write("uv")
-  socket.uncork()
-  for (let attempt = 0; attempt < 100 && stub.received.filter((frame) => frame.header.type === "stream.data").length < 3; attempt += 1) {
-    await new Promise((resolve) => setTimeout(resolve, 5))
-  }
-  const dataFrames = stub.received.filter((frame) => frame.header.type === "stream.data")
-  assert.deepEqual(dataFrames.map((frame) => frame.payload.length), [8, 8, 6])
-  assert.deepEqual(dataFrames.map((frame) => frame.header.sequence), [8, 16, 22])
-  assert.deepEqual(Buffer.concat(dataFrames.map((frame) => frame.payload)), Buffer.concat([payload, Buffer.from("uv")]))
-  socket.destroy()
-  await stub.close()
-  await rm(tempDir, {recursive: true, force: true})
-})
+    expect(socket.destroyed).toBe(false)
+    expect(errors).toEqual([])
+    expect(received.bytes()).toEqual(Buffer.concat([initial, fresh]))
+  }))
+
+  it("client writev emits one compact v2 data record for corked writes", async () => withTestCleanup(async (after) => {
+    const tempDir = await mkdtemp(join(tmpdir(), "socketduct-client-writev-"))
+    after(() => rm(tempDir, {recursive: true, force: true}))
+    const stub = await relayStub({framing: 2, onReady: () => {}})
+    after(async () => {
+      await stub.close()
+    })
+    const socket = connectSocketduct({
+      relay: {host: "127.0.0.1", port: stub.port, token: "stub-token"},
+      sessionName: "writev client",
+      target: {host: "127.0.0.1", port: 1},
+      spoolDirectory: tempDir,
+      reconnect: {initialDelayMs: 60_000}
+    })
+    after(() => { socket.destroy() })
+    await new Promise((resolve) => socket.once("connect", resolve))
+    socket.cork()
+    socket.write("writev-")
+    socket.write("merged")
+    socket.uncork()
+    for (let attempt = 0; attempt < 100 && !stub.received.some((frame) => frame.header.type === "stream.data"); attempt += 1) {
+      await new Promise((resolve) => setTimeout(resolve, 5))
+    }
+    const dataFrames = stub.received.filter((frame) => frame.header.type === "stream.data")
+    expect(dataFrames.length).toBe(1)
+    expect(dataFrames[0]?.header.compact).toBe(true)
+    expect(dataFrames[0]?.payload).toEqual(Buffer.from("writev-merged"))
+  }))
+
+  it("client writev splits an oversized write into bounded compact data records", async () => withTestCleanup(async (after) => {
+    const tempDir = await mkdtemp(join(tmpdir(), "socketduct-client-writev-limit-"))
+    after(() => rm(tempDir, {recursive: true, force: true}))
+    const stub = await relayStub({framing: 2, onReady: () => {}})
+    after(async () => {
+      await stub.close()
+    })
+    const socket = connectSocketduct({
+      relay: {host: "127.0.0.1", port: stub.port, token: "stub-token"},
+      sessionName: "bounded writev client",
+      target: {host: "127.0.0.1", port: 1},
+      spoolDirectory: tempDir,
+      compressionLimits: {maxDecompressedBytes: 8},
+      reconnect: {initialDelayMs: 60_000}
+    })
+    after(() => { socket.destroy() })
+    await new Promise((resolve) => socket.once("connect", resolve))
+    const payload = Buffer.from("abcdefghijklmnopqrst")
+    socket.cork()
+    socket.write(payload)
+    socket.write("uv")
+    socket.uncork()
+    for (let attempt = 0; attempt < 100 && stub.received.filter((frame) => frame.header.type === "stream.data").length < 3; attempt += 1) {
+      await new Promise((resolve) => setTimeout(resolve, 5))
+    }
+    const dataFrames = stub.received.filter((frame) => frame.header.type === "stream.data")
+    expect(dataFrames.map((frame) => frame.payload.length)).toEqual([8, 8, 6])
+    expect(dataFrames.map((frame) => frame.header.sequence)).toEqual([8, 16, 22])
+    expect(Buffer.concat(dataFrames.map((frame) => frame.payload))).toEqual(Buffer.concat([payload, Buffer.from("uv")]))
+  }))
+
+  it("client writev resets the idle timeout when queued writes become active", {skip: typeof zlib.zstdCompress !== "function"}, async () => withTestCleanup(async (after) => {
+    const tempDir = await mkdtemp(join(tmpdir(), "socketduct-client-writev-timeout-"))
+    after(() => rm(tempDir, {recursive: true, force: true}))
+    const stub = await relayStub({compression: "zstd", framing: 2, onReady: () => {}})
+    after(async () => {
+      await stub.close()
+    })
+    const socket = connectSocketduct({
+      relay: {host: "127.0.0.1", port: stub.port, token: "stub-token"},
+      sessionName: "writev timeout client",
+      target: {host: "127.0.0.1", port: 1},
+      spoolDirectory: tempDir,
+      reconnect: {initialDelayMs: 60_000}
+    })
+    after(() => { socket.destroy() })
+    const held = holdNextZstdCompression()
+    after(held.restore)
+    const fakeTimers = createFakeTimers()
+    fakeTimers.install()
+    after(() => fakeTimers.restore())
 
-test("client writev resets the idle timeout when queued writes become active", {skip: typeof zlib.zstdCompress !== "function"}, async (t) => {
-  const tempDir = await mkdtemp(join(tmpdir(), "socketduct-client-writev-timeout-"))
-  const stub = await relayStub({compression: "zstd", framing: 2, onReady: () => {}})
-  const socket = connectSocketduct({
-    relay: {host: "127.0.0.1", port: stub.port, token: "stub-token"},
-    sessionName: "writev timeout client",
-    target: {host: "127.0.0.1", port: 1},
-    spoolDirectory: tempDir,
-    reconnect: {initialDelayMs: 60_000}
-  })
-  const held = holdNextZstdCompression()
-  try {
     await new Promise((resolve) => socket.once("connect", resolve))
-    t.mock.timers.enable({apis: ["setTimeout"]})
     socket.setTimeout(50)
     let timedOut = false
     socket.once("timeout", () => { timedOut = true })
@@ -578,690 +619,687 @@ test("client writev resets the idle timeout when queued writes become active", {
     const writevCompleted = new Promise((resolve) => socket.write("writev", resolve))
     socket.uncork()
 
-    t.mock.timers.tick(35)
+    fakeTimers.advanceBy(35)
     held.release()
     await writevCompleted
 
-    t.mock.timers.tick(15)
-    assert.equal(timedOut, false, "queued _writev activity must replace the first write's deadline")
-    t.mock.timers.tick(34)
-    assert.equal(timedOut, false, "replacement deadline must start when _writev becomes active")
-    t.mock.timers.tick(1)
-    assert.equal(timedOut, true, "replacement deadline must remain armed")
-  } finally {
-    held.restore()
-    socket.setTimeout(0)
-    t.mock.timers.reset()
-    socket.destroy()
-    await stub.close()
-    await rm(tempDir, {recursive: true, force: true})
-  }
-})
-
-/**
- * @param {{port: number}} stub - Relay stub.
- * @param {string} tempDir - Spool directory.
- * @returns {Promise<Error>} - The error the client failed closed with.
- */
-async function expectClientError(stub, tempDir) {
-  const socket = connectSocketduct({
-    relay: {host: "127.0.0.1", port: stub.port, token: "stub-token"},
-    sessionName: "stub session",
-    target: {host: "127.0.0.1", port: 1},
-    spoolDirectory: tempDir,
-    // Do not reconnect: a fail-closed receive path must surface, not retry forever.
-    reconnect: {initialDelayMs: 60_000}
-  })
-
-  const error = await new Promise((resolve) => {
-    socket.once("error", (err) => resolve(err))
-  })
-  socket.destroy()
-  return error
-}
-
-test("client rejects length-prefixed stream.data after a v2 handshake", async () => {
-  const tempDir = await mkdtemp(join(tmpdir(), "socketduct-client-envelope-data-"))
-  const stub = await relayStub({
-    onReady: (socket) => {
-      socket.write(encodeEnvelope({type: "stream.data", direction: "target-to-client", sequence: 5}, Buffer.from("first")))
-    }
-  })
-
-  const socket = connectSocketduct({
-    relay: {host: "127.0.0.1", port: stub.port, token: "stub-token"},
-    sessionName: "envelope data rejection",
-    target: {host: "127.0.0.1", port: 1},
-    spoolDirectory: tempDir,
-    reconnect: {initialDelayMs: 60_000}
-  })
-  const error = await new Promise((resolve) => socket.once("error", resolve))
-  assert.match(String(error), /length-prefixed stream\.data/)
-
-  socket.destroy()
-  await stub.close()
-  await rm(tempDir, {recursive: true, force: true})
-})
-
-test("client rejects length-prefixed stream.ack after a v2 handshake", async () => {
-  const tempDir = await mkdtemp(join(tmpdir(), "socketduct-client-envelope-ack-"))
-  const stub = await relayStub({
-    onReady: (socket) => {
-      socket.write(encodeEnvelope({type: "stream.ack", direction: "client-to-target", ackSequence: 0}))
-    }
-  })
+    fakeTimers.advanceBy(15)
+    // queued _writev activity must replace the first write's deadline
+    expect(timedOut).toBe(false)
+    fakeTimers.advanceBy(34)
+    // replacement deadline must start when _writev becomes active
+    expect(timedOut).toBe(false)
+    fakeTimers.advanceBy(1)
+    // replacement deadline must remain armed
+    expect(timedOut).toBe(true)
+
+    // Restore real timers before the per-test teardown runs so the socket
+    // cleanup clears real handles; the after() safety net is then a no-op.
+    fakeTimers.restore()
+  }))
+
+  it("client rejects length-prefixed stream.data after a v2 handshake", async () => withTestCleanup(async (after) => {
+    const tempDir = await mkdtemp(join(tmpdir(), "socketduct-client-envelope-data-"))
+    after(() => rm(tempDir, {recursive: true, force: true}))
+    const stub = await relayStub({
+      onReady: (socket) => {
+        socket.write(encodeEnvelope({type: "stream.data", direction: "target-to-client", sequence: 5}, Buffer.from("first")))
+      }
+    })
+    after(async () => {
+      await stub.close()
+    })
 
-  const error = await expectClientError(stub, tempDir)
-  assert.match(error.message, /length-prefixed stream\.ack/)
+    const socket = connectSocketduct({
+      relay: {host: "127.0.0.1", port: stub.port, token: "stub-token"},
+      sessionName: "envelope data rejection",
+      target: {host: "127.0.0.1", port: 1},
+      spoolDirectory: tempDir,
+      reconnect: {initialDelayMs: 60_000}
+    })
+    after(() => { socket.destroy() })
+    const error = await new Promise((resolve) => socket.once("error", resolve))
+    expect(String(error)).toMatch(/length-prefixed stream\.data/)
+  }))
+
+  it("client rejects length-prefixed stream.ack after a v2 handshake", async () => withTestCleanup(async (after) => {
+    const tempDir = await mkdtemp(join(tmpdir(), "socketduct-client-envelope-ack-"))
+    after(() => rm(tempDir, {recursive: true, force: true}))
+    const stub = await relayStub({
+      onReady: (socket) => {
+        socket.write(encodeEnvelope({type: "stream.ack", direction: "client-to-target", ackSequence: 0}))
+      }
+    })
+    after(async () => {
+      await stub.close()
+    })
 
-  await stub.close()
-  await rm(tempDir, {recursive: true, force: true})
-})
+    const error = await expectClientError(stub, tempDir)
+    expect(error.message).toMatch(/length-prefixed stream\.ack/)
+  }))
 
-test("relay target-to-client delivery queue preserves uncompressed sequence order across multiple encoded frames", {skip: !zstdAvailable()}, async () => {
-  const fixture = await startFixture()
-  const client = await framedClient(fixture.relayPort)
+  it("relay target-to-client delivery queue preserves uncompressed sequence order across multiple encoded frames", {skip: !zstdAvailable()}, async () => withTestCleanup(async (after) => {
+    const fixture = await startFixture()
+    const client = await framedClient(fixture.relayPort)
+    after(async () => {
+      client.close()
+      await fixture.close()
+    })
 
-  client.send({
-    type: "session.create",
-    token: fixture.token,
-    name: "delivery order",
-    target: {host: "127.0.0.1", port: fixture.targetPort},
-    compression: ["zstd"]
-  })
-  const created = await client.next()
-  assert.equal(created.header.compression, "zstd")
-
-  const chunkSizes = [8_192, 4_096, 16_384, 1_024, 8_192]
-  const rawChunks = /** @type {Buffer[]} */ ([])
-  let sequence = 0
-  for (const size of chunkSizes) {
-    const chunk = compressibleChunk(size)
-    rawChunks.push(chunk)
-    sequence += size
-    const encoded = await encodeStreamPayload(chunk, "zstd")
     client.send({
-      type: "stream.data",
-      direction: "client-to-target",
-      sequence,
-      encoding: encoded.encoding,
-      dataLength: encoded.dataLength
-    }, encoded.payload)
-  }
-
-  /** @type {{sequence: number, data: Buffer}[]} */
-  const dataFrames = []
-  let receivedBytes = 0
-  const totalBytes = chunkSizes.reduce((sum, s) => sum + s, 0)
-
-  while (receivedBytes < totalBytes) {
-    const frame = await client.next()
-    if (frame.header.type !== "stream.data" || frame.header.direction !== "target-to-client") {
-      continue
+      type: "session.create",
+      token: fixture.token,
+      name: "delivery order",
+      target: {host: "127.0.0.1", port: fixture.targetPort},
+      compression: ["zstd"]
+    })
+    const created = await client.next()
+    expect(created.header.compression).toBe("zstd")
+
+    const chunkSizes = [8_192, 4_096, 16_384, 1_024, 8_192]
+    const rawChunks = /** @type {Buffer[]} */ ([])
+    let sequence = 0
+    for (const size of chunkSizes) {
+      const chunk = compressibleChunk(size)
+      rawChunks.push(chunk)
+      sequence += size
+      const encoded = await encodeStreamPayload(chunk, "zstd")
+      client.send({
+        type: "stream.data",
+        direction: "client-to-target",
+        sequence,
+        encoding: encoded.encoding,
+        dataLength: encoded.dataLength
+      }, encoded.payload)
     }
-    const decoded = await decodeStreamPayload(frame.header, frame.payload, "zstd")
-    dataFrames.push({sequence: /** @type {number} */ (frame.header.sequence), data: decoded})
-    receivedBytes += decoded.length
-  }
-
-  // Every frame carries the correct uncompressed cumulative sequence offset.
-  let expectedSeq = 0
-  for (const frame of dataFrames) {
-    expectedSeq += frame.data.length
-    assert.equal(frame.sequence, expectedSeq,
-      `Expected sequence ${expectedSeq} but got ${frame.sequence} (uncompressed length ${frame.data.length})`)
-  }
-  // Combined echoed data matches the raw payloads that were sent.
-  assert.deepEqual(Buffer.concat(dataFrames.map((f) => f.data)), Buffer.concat(rawChunks))
-
-  client.close()
-  await fixture.close()
-})
-
-test("relay tunnel frame queue preserves client-to-target processing order and ACK state", {skip: !zstdAvailable()}, async () => {
-  const fixture = await startFixture()
-  const client = await framedClient(fixture.relayPort)
-
-  client.send({
-    type: "session.create",
-    token: fixture.token,
-    name: "ack order",
-    target: {host: "127.0.0.1", port: fixture.targetPort},
-    compression: ["zstd"]
-  })
-  const created = await client.next()
-  assert.equal(created.header.compression, "zstd")
-
-  const chunkSizes = [4_096, 8_192, 2_048, 16_384, 32_768]
-  let sequence = 0
-  for (const size of chunkSizes) {
-    const chunk = compressibleChunk(size)
-    sequence += size
-    const encoded = await encodeStreamPayload(chunk, "zstd")
-    client.send({
-      type: "stream.data",
-      direction: "client-to-target",
-      sequence,
-      encoding: encoded.encoding,
-      dataLength: encoded.dataLength
-    }, encoded.payload)
-  }
 
-  /** @type {number[]} */
-  const acks = []
-  let receivedBytes = 0
-  const totalBytes = chunkSizes.reduce((sum, s) => sum + s, 0)
+    /** @type {{sequence: number, data: Buffer}[]} */
+    const dataFrames = []
+    let receivedBytes = 0
+    const totalBytes = chunkSizes.reduce((sum, s) => sum + s, 0)
 
-  while (receivedBytes < totalBytes) {
-    const frame = await client.next()
-    if (frame.header.type === "stream.ack" && frame.header.direction === "client-to-target") {
-      acks.push(/** @type {number} */ (frame.header.ackSequence))
-    }
-    if (frame.header.type === "stream.data" && frame.header.direction === "target-to-client") {
+    while (receivedBytes < totalBytes) {
+      const frame = await client.next()
+      if (frame.header.type !== "stream.data" || frame.header.direction !== "target-to-client") {
+        continue
+      }
       const decoded = await decodeStreamPayload(frame.header, frame.payload, "zstd")
+      dataFrames.push({sequence: /** @type {number} */ (frame.header.sequence), data: decoded})
       receivedBytes += decoded.length
     }
-  }
-
-  assert.ok(acks.length > 0, "Expected at least one client-to-target ACK")
 
-  // ACKs arrive in monotonically non-decreasing order.
-  for (let index = 1; index < acks.length; index += 1) {
-    const previousAck = acks[index - 1]
-    const currentAck = acks[index]
-    if (previousAck === undefined || currentAck === undefined) {
-      throw new Error("Expected contiguous ACK entries")
+    // Every frame carries the correct uncompressed cumulative sequence offset.
+    let expectedSeq = 0
+    for (const frame of dataFrames) {
+      expectedSeq += frame.data.length
+      // Expected sequence ${expectedSeq} but got ${frame.sequence} (uncompressed length ${frame.data.length})
+      expect(frame.sequence).toBe(expectedSeq)
     }
-    assert.ok(currentAck >= previousAck,
-      `ACK ${currentAck} must be >= ${previousAck}`)
-  }
-  // The final ACK acknowledges the full uncompressed byte total.
-  const finalAck = acks.at(-1)
-  assert.equal(finalAck, totalBytes)
+    // Combined echoed data matches the raw payloads that were sent.
+    expect(Buffer.concat(dataFrames.map((f) => f.data))).toEqual(Buffer.concat(rawChunks))
+  }))
+
+  it("relay tunnel frame queue preserves client-to-target processing order and ACK state", {skip: !zstdAvailable()}, async () => withTestCleanup(async (after) => {
+    const fixture = await startFixture()
+    const client = await framedClient(fixture.relayPort)
+    after(async () => {
+      client.close()
+      await fixture.close()
+    })
 
-  client.close()
-  await fixture.close()
-})
+    client.send({
+      type: "session.create",
+      token: fixture.token,
+      name: "ack order",
+      target: {host: "127.0.0.1", port: fixture.targetPort},
+      compression: ["zstd"]
+    })
+    const created = await client.next()
+    expect(created.header.compression).toBe("zstd")
+
+    const chunkSizes = [4_096, 8_192, 2_048, 16_384, 32_768]
+    let sequence = 0
+    for (const size of chunkSizes) {
+      const chunk = compressibleChunk(size)
+      sequence += size
+      const encoded = await encodeStreamPayload(chunk, "zstd")
+      client.send({
+        type: "stream.data",
+        direction: "client-to-target",
+        sequence,
+        encoding: encoded.encoding,
+        dataLength: encoded.dataLength
+      }, encoded.payload)
+    }
 
-test("client relay frame queue preserves ordering and ACK tracking across batched target-to-client frames", {skip: !zstdAvailable()}, async () => {
-  const tempDir = await mkdtemp(join(tmpdir(), "socketduct-client-frameq-"))
-
-  const rawChunks = [
-    compressibleChunk(4_096),
-    compressibleChunk(8_192),
-    compressibleChunk(16_384),
-    compressibleChunk(2_048)
-  ]
-  // Pre-encode all frames so the stub delivers valid zstd payloads.
-  /** @type {{encoding?: string, dataLength?: number, payload: Buffer}[]} */
-  const encodedFrames = []
-  for (const chunk of rawChunks) {
-    const encoded = await encodeStreamPayload(chunk, "zstd")
-    encodedFrames.push(encoded)
-  }
+    /** @type {number[]} */
+    const acks = []
+    let receivedBytes = 0
+    const totalBytes = chunkSizes.reduce((sum, s) => sum + s, 0)
 
-  const stub = await relayStub({
-    compression: "zstd",
-    onReady: (socket) => {
-      let cumulativeSequence = 0
-      const wireFrames = []
-      for (let index = 0; index < encodedFrames.length; index += 1) {
-        const rawChunk = rawChunks[index]
-        const encoded = encodedFrames[index]
-        if (rawChunk === undefined || encoded === undefined) {
-          throw new Error("Expected matching encoded and uncompressed chunk")
-        }
-        cumulativeSequence += rawChunk.length
-        wireFrames.push(encodeFrame({
-          type: "stream.data",
-          direction: "target-to-client",
-          sequence: cumulativeSequence,
-          encoding: encoded.encoding,
-          dataLength: encoded.dataLength
-        }, encoded.payload))
+    while (receivedBytes < totalBytes) {
+      const frame = await client.next()
+      if (frame.header.type === "stream.ack" && frame.header.direction === "client-to-target") {
+        acks.push(/** @type {number} */ (frame.header.ackSequence))
+      }
+      if (frame.header.type === "stream.data" && frame.header.direction === "target-to-client") {
+        const decoded = await decodeStreamPayload(frame.header, frame.payload, "zstd")
+        receivedBytes += decoded.length
       }
-      // Deliver every frame in a single TCP write so the relay frame queue
-      // must deserialize them one-by-one across async zstd decode calls.
-      socket.write(Buffer.concat(wireFrames))
     }
-  })
-
-  const socket = connectSocketduct({
-    relay: {host: "127.0.0.1", port: stub.port, token: "stub-token"},
-    sessionName: "client frame queue",
-    target: {host: "127.0.0.1", port: 1},
-    spoolDirectory: tempDir,
-    reconnect: {initialDelayMs: 60_000}
-  })
 
-  const received = collect(socket)
-  const totalExpected = rawChunks.reduce((sum, c) => sum + c.length, 0)
-  await received.waitFor(totalExpected)
-
-  // Data reaches the stream consumer intact and in the correct order.
-  assert.deepEqual(received.bytes(), Buffer.concat(rawChunks))
-
-  // The client must acknowledge every frame-level sequence advancement.
-  // Poll briefly since ACKs are serialised through a separate send queue.
-  /** @type {number[]} */
-  let acks = []
-  for (let attempt = 0; attempt < 30; attempt += 1) {
-    acks = stub.received.flatMap((frame) => (
-      frame.header.type === "stream.ack" &&
-      frame.header.direction === "target-to-client" &&
-      typeof frame.header.ackSequence === "number"
-        ? [frame.header.ackSequence]
-        : []
-    ))
-    if ((acks.at(-1) ?? 0) >= totalExpected) break
-    await new Promise((resolve) => setTimeout(resolve, 10))
-  }
+    // Expected at least one client-to-target ACK
+    expect(acks.length > 0).toBeTruthy()
 
-  assert.ok(acks.length >= rawChunks.length,
-    `Expected at least ${rawChunks.length} ACKs, got ${acks.length}`)
-  for (let index = 1; index < acks.length; index += 1) {
-    const previousAck = acks[index - 1]
-    const currentAck = acks[index]
-    if (previousAck === undefined || currentAck === undefined) {
-      throw new Error("Expected contiguous ACK entries")
+    // ACKs arrive in monotonically non-decreasing order.
+    for (let index = 1; index < acks.length; index += 1) {
+      const previousAck = acks[index - 1]
+      const currentAck = acks[index]
+      if (previousAck === undefined || currentAck === undefined) {
+        throw new Error("Expected contiguous ACK entries")
+      }
+      // ACK ${currentAck} must be >= ${previousAck}
+      expect(currentAck >= previousAck).toBeTruthy()
     }
-    assert.ok(currentAck >= previousAck,
-      `ACK ${currentAck} must be >= ${previousAck}`)
-  }
-  assert.equal(acks.at(-1), totalExpected)
-
-  socket.destroy()
-  await stub.close()
-  await rm(tempDir, {recursive: true, force: true})
-})
-
-test("client fails closed on a compressed frame when no codec was negotiated", async () => {
-  const tempDir = await mkdtemp(join(tmpdir(), "socketduct-client-unnegotiated-"))
-  const stub = await relayStub({
-    onReady: (socket) => {
-      socket.write(encodeFrame({
-        type: "stream.data",
-        direction: "target-to-client",
-        sequence: 64,
-        encoding: "zstd",
-        dataLength: 64
-      }, Buffer.from("not really compressed")))
+    // The final ACK acknowledges the full uncompressed byte total.
+    const finalAck = acks.at(-1)
+    expect(finalAck).toBe(totalBytes)
+  }))
+
+  it("client relay frame queue preserves ordering and ACK tracking across batched target-to-client frames", {skip: !zstdAvailable()}, async () => withTestCleanup(async (after) => {
+    const tempDir = await mkdtemp(join(tmpdir(), "socketduct-client-frameq-"))
+    after(() => rm(tempDir, {recursive: true, force: true}))
+
+    const rawChunks = [
+      compressibleChunk(4_096),
+      compressibleChunk(8_192),
+      compressibleChunk(16_384),
+      compressibleChunk(2_048)
+    ]
+    // Pre-encode all frames so the stub delivers valid zstd payloads.
+    /** @type {{encoding?: string, dataLength?: number, payload: Buffer}[]} */
+    const encodedFrames = []
+    for (const chunk of rawChunks) {
+      const encoded = await encodeStreamPayload(chunk, "zstd")
+      encodedFrames.push(encoded)
     }
-  })
-
-  const error = await expectClientError(stub, tempDir)
-  assert.match(error.message, /was not negotiated/)
-  // Nothing was acknowledged.
-  assert.equal(stub.received.some((frame) => frame.header.type === "stream.ack"), false)
 
-  await stub.close()
-  await rm(tempDir, {recursive: true, force: true})
-})
+    const stub = await relayStub({
+      compression: "zstd",
+      onReady: (socket) => {
+        let cumulativeSequence = 0
+        const wireFrames = []
+        for (let index = 0; index < encodedFrames.length; index += 1) {
+          const rawChunk = rawChunks[index]
+          const encoded = encodedFrames[index]
+          if (rawChunk === undefined || encoded === undefined) {
+            throw new Error("Expected matching encoded and uncompressed chunk")
+          }
+          cumulativeSequence += rawChunk.length
+          wireFrames.push(encodeFrame({
+            type: "stream.data",
+            direction: "target-to-client",
+            sequence: cumulativeSequence,
+            encoding: encoded.encoding,
+            dataLength: encoded.dataLength
+          }, encoded.payload))
+        }
+        // Deliver every frame in a single TCP write so the relay frame queue
+        // must deserialize them one-by-one across async zstd decode calls.
+        socket.write(Buffer.concat(wireFrames))
+      }
+    })
+    after(async () => {
+      await stub.close()
+    })
 
-test("client fails closed on a corrupt compressed frame", {skip: !zstdAvailable()}, async () => {
-  const tempDir = await mkdtemp(join(tmpdir(), "socketduct-client-corrupt-"))
-  const payload = compressibleChunk(4096)
-  const encoded = await encodeStreamPayload(payload, "zstd")
-  const corrupted = Buffer.from(encoded.payload)
-  corrupted.writeUInt8(corrupted.readUInt8(corrupted.length - 1) ^ 0xff, corrupted.length - 1)
-  corrupted.writeUInt8(corrupted.readUInt8(8) ^ 0xff, 8)
-
-  const stub = await relayStub({
-    compression: "zstd",
-    onReady: (socket) => {
-      socket.write(encodeFrame({
-        type: "stream.data",
-        direction: "target-to-client",
-        sequence: payload.length,
-        encoding: "zstd",
-        dataLength: payload.length
-      }, corrupted))
+    const socket = connectSocketduct({
+      relay: {host: "127.0.0.1", port: stub.port, token: "stub-token"},
+      sessionName: "client frame queue",
+      target: {host: "127.0.0.1", port: 1},
+      spoolDirectory: tempDir,
+      reconnect: {initialDelayMs: 60_000}
+    })
+    after(() => { socket.destroy() })
+
+    const received = collect(socket)
+    const totalExpected = rawChunks.reduce((sum, c) => sum + c.length, 0)
+    await received.waitFor(totalExpected)
+
+    // Data reaches the stream consumer intact and in the correct order.
+    expect(received.bytes()).toEqual(Buffer.concat(rawChunks))
+
+    // The client must acknowledge every frame-level sequence advancement.
+    // Poll briefly since ACKs are serialised through a separate send queue.
+    /** @type {number[]} */
+    let acks = []
+    for (let attempt = 0; attempt < 30; attempt += 1) {
+      acks = stub.received.flatMap((frame) => (
+        frame.header.type === "stream.ack" &&
+        frame.header.direction === "target-to-client" &&
+        typeof frame.header.ackSequence === "number"
+          ? [frame.header.ackSequence]
+          : []
+      ))
+      if ((acks.at(-1) ?? 0) >= totalExpected) break
+      await new Promise((resolve) => setTimeout(resolve, 10))
     }
-  })
-
-  const error = await expectClientError(stub, tempDir)
-  assert.match(error.message, /failed to decompress/)
-  assert.equal(stub.received.some((frame) => frame.header.type === "stream.ack"), false)
-
-  await stub.close()
-  await rm(tempDir, {recursive: true, force: true})
-})
 
-test("client fails closed on a target-to-client sequence gap without acknowledging it", async () => {
-  const tempDir = await mkdtemp(join(tmpdir(), "socketduct-client-gap-"))
-  const stub = await relayStub({
-    onReady: (socket) => {
-      // 8 payload bytes but a sequence claiming offset 100: a 92-byte hole.
-      socket.write(encodeFrame({
-        type: "stream.data",
-        direction: "target-to-client",
-        sequence: 100
-      }, Buffer.from("12345678")))
+    // Expected at least ${rawChunks.length} ACKs, got ${acks.length}
+    expect(acks.length >= rawChunks.length).toBeTruthy()
+    for (let index = 1; index < acks.length; index += 1) {
+      const previousAck = acks[index - 1]
+      const currentAck = acks[index]
+      if (previousAck === undefined || currentAck === undefined) {
+        throw new Error("Expected contiguous ACK entries")
+      }
+      // ACK ${currentAck} must be >= ${previousAck}
+      expect(currentAck >= previousAck).toBeTruthy()
     }
-  })
-
-  const error = await expectClientError(stub, tempDir)
-  assert.match(error.message, /gap \(expected contiguous offset 8\)/)
-  assert.equal(stub.received.some((frame) => frame.header.type === "stream.ack"), false)
-
-  await stub.close()
-  await rm(tempDir, {recursive: true, force: true})
-})
+    expect(acks.at(-1)).toBe(totalExpected)
+  }))
+
+  it("client fails closed on a compressed frame when no codec was negotiated", async () => withTestCleanup(async (after) => {
+    const tempDir = await mkdtemp(join(tmpdir(), "socketduct-client-unnegotiated-"))
+    after(() => rm(tempDir, {recursive: true, force: true}))
+    const stub = await relayStub({
+      onReady: (socket) => {
+        socket.write(encodeFrame({
+          type: "stream.data",
+          direction: "target-to-client",
+          sequence: 64,
+          encoding: "zstd",
+          dataLength: 64
+        }, Buffer.from("not really compressed")))
+      }
+    })
+    after(async () => {
+      await stub.close()
+    })
 
-test("client fails closed on a target-to-client sequence overlap without acknowledging it", async () => {
-  const tempDir = await mkdtemp(join(tmpdir(), "socketduct-client-overlap-"))
-  const stub = await relayStub({
-    onReady: (socket) => {
-      // 8 payload bytes claiming to end at offset 4: overlaps bytes never sent.
-      socket.write(encodeFrame({
-        type: "stream.data",
-        direction: "target-to-client",
-        sequence: 4
-      }, Buffer.from("12345678")))
-    }
-  })
+    const error = await expectClientError(stub, tempDir)
+    expect(error.message).toMatch(/was not negotiated/)
+    // Nothing was acknowledged.
+    expect(stub.received.some((frame) => frame.header.type === "stream.ack")).toBe(false)
+  }))
+
+  it("client fails closed on a corrupt compressed frame", {skip: !zstdAvailable()}, async () => withTestCleanup(async (after) => {
+    const tempDir = await mkdtemp(join(tmpdir(), "socketduct-client-corrupt-"))
+    after(() => rm(tempDir, {recursive: true, force: true}))
+    const payload = compressibleChunk(4096)
+    const encoded = await encodeStreamPayload(payload, "zstd")
+    const corrupted = Buffer.from(encoded.payload)
+    corrupted.writeUInt8(corrupted.readUInt8(corrupted.length - 1) ^ 0xff, corrupted.length - 1)
+    corrupted.writeUInt8(corrupted.readUInt8(8) ^ 0xff, 8)
+
+    const stub = await relayStub({
+      compression: "zstd",
+      onReady: (socket) => {
+        socket.write(encodeFrame({
+          type: "stream.data",
+          direction: "target-to-client",
+          sequence: payload.length,
+          encoding: "zstd",
+          dataLength: payload.length
+        }, corrupted))
+      }
+    })
+    after(async () => {
+      await stub.close()
+    })
 
-  const error = await expectClientError(stub, tempDir)
-  assert.match(error.message, /overlap \(expected contiguous offset 8\)/)
-  assert.equal(stub.received.some((frame) => frame.header.type === "stream.ack"), false)
+    const error = await expectClientError(stub, tempDir)
+    expect(error.message).toMatch(/failed to decompress/)
+    expect(stub.received.some((frame) => frame.header.type === "stream.ack")).toBe(false)
+  }))
+
+  it("client fails closed on a target-to-client sequence gap without acknowledging it", async () => withTestCleanup(async (after) => {
+    const tempDir = await mkdtemp(join(tmpdir(), "socketduct-client-gap-"))
+    after(() => rm(tempDir, {recursive: true, force: true}))
+    const stub = await relayStub({
+      onReady: (socket) => {
+        // 8 payload bytes but a sequence claiming offset 100: a 92-byte hole.
+        socket.write(encodeFrame({
+          type: "stream.data",
+          direction: "target-to-client",
+          sequence: 100
+        }, Buffer.from("12345678")))
+      }
+    })
+    after(async () => {
+      await stub.close()
+    })
 
-  await stub.close()
-  await rm(tempDir, {recursive: true, force: true})
-})
+    const error = await expectClientError(stub, tempDir)
+    expect(error.message).toMatch(/gap \(expected contiguous offset 8\)/)
+    expect(stub.received.some((frame) => frame.header.type === "stream.ack")).toBe(false)
+  }))
+
+  it("client fails closed on a target-to-client sequence overlap without acknowledging it", async () => withTestCleanup(async (after) => {
+    const tempDir = await mkdtemp(join(tmpdir(), "socketduct-client-overlap-"))
+    after(() => rm(tempDir, {recursive: true, force: true}))
+    const stub = await relayStub({
+      onReady: (socket) => {
+        // 8 payload bytes claiming to end at offset 4: overlaps bytes never sent.
+        socket.write(encodeFrame({
+          type: "stream.data",
+          direction: "target-to-client",
+          sequence: 4
+        }, Buffer.from("12345678")))
+      }
+    })
+    after(async () => {
+      await stub.close()
+    })
 
-test("relay negotiates zstd and compresses target-to-client stream.data on the wire", {skip: !zstdAvailable()}, async () => {
-  const fixture = await startFixture()
-  const client = await framedClient(fixture.relayPort)
+    const error = await expectClientError(stub, tempDir)
+    expect(error.message).toMatch(/overlap \(expected contiguous offset 8\)/)
+    expect(stub.received.some((frame) => frame.header.type === "stream.ack")).toBe(false)
+  }))
+
+  it("relay negotiates zstd and compresses target-to-client stream.data on the wire", {skip: !zstdAvailable()}, async () => withTestCleanup(async (after) => {
+    const fixture = await startFixture()
+    const client = await framedClient(fixture.relayPort)
+    after(async () => {
+      client.close()
+      await fixture.close()
+    })
 
-  client.send({
-    type: "session.create",
-    token: fixture.token,
-    name: "compressed",
-    target: {host: "127.0.0.1", port: fixture.targetPort},
-    compression: ["zstd"]
-  })
+    client.send({
+      type: "session.create",
+      token: fixture.token,
+      name: "compressed",
+      target: {host: "127.0.0.1", port: fixture.targetPort},
+      compression: ["zstd"]
+    })
 
-  const created = await client.next()
-  assert.equal(created.header.type, "session.created")
-  assert.equal(created.header.compression, "zstd")
+    const created = await client.next()
+    expect(created.header.type).toBe("session.created")
+    expect(created.header.compression).toBe("zstd")
 
-  const payload = compressibleChunk(16384)
-  const encoded = await encodeStreamPayload(payload, "zstd")
-  assert.equal(encoded.encoding, "zstd")
+    const payload = compressibleChunk(16384)
+    const encoded = await encodeStreamPayload(payload, "zstd")
+    expect(encoded.encoding).toBe("zstd")
 
-  client.send({
-    type: "stream.data",
-    direction: "client-to-target",
-    sequence: payload.length,
-    encoding: encoded.encoding,
-    dataLength: encoded.dataLength
-  }, encoded.payload)
+    client.send({
+      type: "stream.data",
+      direction: "client-to-target",
+      sequence: payload.length,
+      encoding: encoded.encoding,
+      dataLength: encoded.dataLength
+    }, encoded.payload)
 
-  /** @type {Buffer[]} */
-  const echoed = []
-  let received = 0
-  let wireBytes = 0
-  let ackSequence = 0
-
-  while (received < payload.length || ackSequence === 0) {
-    const frame = await client.next()
-    if (frame.header.type === "stream.ack" && frame.header.direction === "client-to-target") {
-      ackSequence = /** @type {number} */ (frame.header.ackSequence)
-      continue
-    }
-    if (frame.header.type !== "stream.data") {
-      continue
+    /** @type {Buffer[]} */
+    const echoed = []
+    let received = 0
+    let wireBytes = 0
+    let ackSequence = 0
+
+    while (received < payload.length || ackSequence === 0) {
+      const frame = await client.next()
+      if (frame.header.type === "stream.ack" && frame.header.direction === "client-to-target") {
+        ackSequence = /** @type {number} */ (frame.header.ackSequence)
+        continue
+      }
+      if (frame.header.type !== "stream.data") {
+        continue
+      }
+      expect(frame.header.encoding).toBe("zstd")
+      wireBytes += frame.payload.length
+      const decoded = await decodeStreamPayload(frame.header, frame.payload, "zstd")
+      echoed.push(decoded)
+      received += decoded.length
     }
-    assert.equal(frame.header.encoding, "zstd")
-    wireBytes += frame.payload.length
-    const decoded = await decodeStreamPayload(frame.header, frame.payload, "zstd")
-    echoed.push(decoded)
-    received += decoded.length
-  }
-
-  // Acknowledgements are in uncompressed byte units.
-  assert.equal(ackSequence, payload.length)
-  assert.deepEqual(Buffer.concat(echoed), payload)
-  assert.ok(wireBytes < payload.length / 2, `expected >50% saving, sent ${wireBytes} of ${payload.length}`)
-
-  client.close()
-  await fixture.close()
-})
-
-test("relay uses compact uncompressed records when the client offers no compression", async () => {
-  const fixture = await startFixture()
-  const client = await framedClient(fixture.relayPort)
-
-  client.send({
-    type: "session.create",
-    token: fixture.token,
-    name: "uncompressed compact",
-    target: {host: "127.0.0.1", port: fixture.targetPort}
-  })
 
-  const created = await client.next()
-  assert.equal(created.header.type, "session.created")
-  assert.equal("compression" in created.header, false)
+    // Acknowledgements are in uncompressed byte units.
+    expect(ackSequence).toBe(payload.length)
+    expect(Buffer.concat(echoed)).toEqual(payload)
+    // expected >50% saving, sent ${wireBytes} of ${payload.length}
+    expect(wireBytes < payload.length / 2).toBeTruthy()
+  }))
+
+  it("relay uses compact uncompressed records when the client offers no compression", async () => withTestCleanup(async (after) => {
+    const fixture = await startFixture()
+    const client = await framedClient(fixture.relayPort)
+    after(async () => {
+      client.close()
+      await fixture.close()
+    })
 
-  const payload = compressibleChunk(8192)
-  client.send({type: "stream.data", direction: "client-to-target", sequence: payload.length}, payload)
+    client.send({
+      type: "session.create",
+      token: fixture.token,
+      name: "uncompressed compact",
+      target: {host: "127.0.0.1", port: fixture.targetPort}
+    })
 
-  /** @type {Buffer[]} */
-  const echoed = []
-  let received = 0
-  while (received < payload.length) {
-    const frame = await client.next()
-    if (frame.header.type !== "stream.data") {
-      continue
+    const created = await client.next()
+    expect(created.header.type).toBe("session.created")
+    expect("compression" in created.header).toBe(false)
+
+    const payload = compressibleChunk(8192)
+    client.send({type: "stream.data", direction: "client-to-target", sequence: payload.length}, payload)
+
+    /** @type {Buffer[]} */
+    const echoed = []
+    let received = 0
+    while (received < payload.length) {
+      const frame = await client.next()
+      if (frame.header.type !== "stream.data") {
+        continue
+      }
+      // No compression metadata may appear on an uncompressed compact tunnel.
+      expect("encoding" in frame.header).toBe(false)
+      expect("dataLength" in frame.header).toBe(false)
+      echoed.push(frame.payload)
+      received += frame.payload.length
     }
-    // No compression metadata may appear on an uncompressed compact tunnel.
-    assert.equal("encoding" in frame.header, false)
-    assert.equal("dataLength" in frame.header, false)
-    echoed.push(frame.payload)
-    received += frame.payload.length
-  }
-
-  assert.deepEqual(Buffer.concat(echoed), payload)
-
-  client.close()
-  await fixture.close()
-})
-
-test("relay declines compression when it is disabled, even if the client offers it", async () => {
-  const fixture = await startFixture({compressionEnabled: false})
-  const client = await framedClient(fixture.relayPort)
-
-  client.send({
-    type: "session.create",
-    token: fixture.token,
-    name: "disabled",
-    target: {host: "127.0.0.1", port: fixture.targetPort},
-    compression: ["zstd"]
-  })
-
-  const created = await client.next()
-  assert.equal(created.header.type, "session.created")
-  assert.equal("compression" in created.header, false)
-
-  client.close()
-  await fixture.close()
-})
 
-test("relay fails closed on a compressed frame when no codec was negotiated", async () => {
-  const fixture = await startFixture({compressionEnabled: false})
-  const client = await framedClient(fixture.relayPort)
+    expect(Buffer.concat(echoed)).toEqual(payload)
+  }))
 
-  client.send({
-    type: "session.create",
-    token: fixture.token,
-    name: "unnegotiated",
-    target: {host: "127.0.0.1", port: fixture.targetPort},
-    compression: ["zstd"]
-  })
-  await client.next()
-
-  client.send({
-    type: "stream.data",
-    direction: "client-to-target",
-    sequence: 100,
-    encoding: "zstd",
-    dataLength: 100
-  }, Buffer.from("not really compressed"))
-
-  const response = await client.next()
-  assert.equal(response.header.type, "error")
-  assert.equal(response.header.code, "PROTOCOL_VIOLATION")
-
-  // Fail closed: the connection ends and nothing reaches the target.
-  await client.closed()
-  assert.equal(fixture.targetReceived(), 0)
-
-  client.close()
-  await fixture.close()
-})
+  it("relay declines compression when it is disabled, even if the client offers it", async () => withTestCleanup(async (after) => {
+    const fixture = await startFixture({compressionEnabled: false})
+    const client = await framedClient(fixture.relayPort)
+    after(async () => {
+      client.close()
+      await fixture.close()
+    })
 
-test("relay fails closed on a corrupt compressed payload and never writes it to the target", {skip: !zstdAvailable()}, async () => {
-  const fixture = await startFixture()
-  const client = await framedClient(fixture.relayPort)
+    client.send({
+      type: "session.create",
+      token: fixture.token,
+      name: "disabled",
+      target: {host: "127.0.0.1", port: fixture.targetPort},
+      compression: ["zstd"]
+    })
 
-  client.send({
-    type: "session.create",
-    token: fixture.token,
-    name: "corrupt",
-    target: {host: "127.0.0.1", port: fixture.targetPort},
-    compression: ["zstd"]
-  })
-  const created = await client.next()
-  assert.equal(created.header.compression, "zstd")
-
-  const payload = compressibleChunk(4096)
-  const encoded = await encodeStreamPayload(payload, "zstd")
-  const corrupted = Buffer.from(encoded.payload)
-  corrupted.writeUInt8(corrupted.readUInt8(corrupted.length - 1) ^ 0xff, corrupted.length - 1)
-  corrupted.writeUInt8(corrupted.readUInt8(8) ^ 0xff, 8)
-
-  client.send({
-    type: "stream.data",
-    direction: "client-to-target",
-    sequence: payload.length,
-    encoding: "zstd",
-    dataLength: payload.length
-  }, corrupted)
-
-  const response = await client.next()
-  assert.equal(response.header.type, "error")
-  assert.equal(response.header.code, "PROTOCOL_VIOLATION")
-
-  await client.closed()
-  assert.equal(fixture.targetReceived(), 0)
-
-  client.close()
-  await fixture.close()
-})
+    const created = await client.next()
+    expect(created.header.type).toBe("session.created")
+    expect("compression" in created.header).toBe(false)
+  }))
+
+  it("relay fails closed on a compressed frame when no codec was negotiated", async () => withTestCleanup(async (after) => {
+    const fixture = await startFixture({compressionEnabled: false})
+    const client = await framedClient(fixture.relayPort)
+    after(async () => {
+      client.close()
+      await fixture.close()
+    })
 
-test("relay fails closed on a dataLength that disagrees with the decompressed size", {skip: !zstdAvailable()}, async () => {
-  const fixture = await startFixture()
-  const client = await framedClient(fixture.relayPort)
+    client.send({
+      type: "session.create",
+      token: fixture.token,
+      name: "unnegotiated",
+      target: {host: "127.0.0.1", port: fixture.targetPort},
+      compression: ["zstd"]
+    })
+    await client.next()
 
-  client.send({
-    type: "session.create",
-    token: fixture.token,
-    name: "lying length",
-    target: {host: "127.0.0.1", port: fixture.targetPort},
-    compression: ["zstd"]
-  })
-  await client.next()
+    client.send({
+      type: "stream.data",
+      direction: "client-to-target",
+      sequence: 100,
+      encoding: "zstd",
+      dataLength: 100
+    }, Buffer.from("not really compressed"))
 
-  const payload = compressibleChunk(4096)
-  const encoded = await encodeStreamPayload(payload, "zstd")
+    const response = await client.next()
+    expect(response.header.type).toBe("error")
+    expect(response.header.code).toBe("PROTOCOL_VIOLATION")
 
-  client.send({
-    type: "stream.data",
-    direction: "client-to-target",
-    sequence: payload.length + 1,
-    encoding: "zstd",
-    dataLength: payload.length + 1
-  }, encoded.payload)
+    // Fail closed: the connection ends and nothing reaches the target.
+    await client.closed()
+    expect(fixture.targetReceived()).toBe(0)
+  }))
+
+  it("relay fails closed on a corrupt compressed payload and never writes it to the target", {skip: !zstdAvailable()}, async () => withTestCleanup(async (after) => {
+    const fixture = await startFixture()
+    const client = await framedClient(fixture.relayPort)
+    after(async () => {
+      client.close()
+      await fixture.close()
+    })
 
-  const response = await client.next()
-  assert.equal(response.header.type, "error")
-  assert.equal(response.header.code, "PROTOCOL_VIOLATION")
+    client.send({
+      type: "session.create",
+      token: fixture.token,
+      name: "corrupt",
+      target: {host: "127.0.0.1", port: fixture.targetPort},
+      compression: ["zstd"]
+    })
+    const created = await client.next()
+    expect(created.header.compression).toBe("zstd")
 
-  await client.closed()
-  assert.equal(fixture.targetReceived(), 0)
+    const payload = compressibleChunk(4096)
+    const encoded = await encodeStreamPayload(payload, "zstd")
+    const corrupted = Buffer.from(encoded.payload)
+    corrupted.writeUInt8(corrupted.readUInt8(corrupted.length - 1) ^ 0xff, corrupted.length - 1)
+    corrupted.writeUInt8(corrupted.readUInt8(8) ^ 0xff, 8)
 
-  client.close()
-  await fixture.close()
-})
+    client.send({
+      type: "stream.data",
+      direction: "client-to-target",
+      sequence: payload.length,
+      encoding: "zstd",
+      dataLength: payload.length
+    }, corrupted)
 
-test("SocketductSocket round-trips compressible and incompressible data with compression negotiated", {skip: !zstdAvailable()}, async () => {
-  const tempDir = await mkdtemp(join(tmpdir(), "socketduct-compression-test-"))
-  const fixture = await startFixture()
+    const response = await client.next()
+    expect(response.header.type).toBe("error")
+    expect(response.header.code).toBe("PROTOCOL_VIOLATION")
 
-  const socket = connectSocketduct({
-    relay: {host: "127.0.0.1", port: fixture.relayPort, token: fixture.token},
-    sessionName: "compressed session",
-    target: {host: "127.0.0.1", port: fixture.targetPort},
-    spoolDirectory: tempDir,
-    reconnect: {initialDelayMs: 10}
-  })
-  socket.on("error", () => {})
+    await client.closed()
+    expect(fixture.targetReceived()).toBe(0)
+  }))
+
+  it("relay fails closed on a dataLength that disagrees with the decompressed size", {skip: !zstdAvailable()}, async () => withTestCleanup(async (after) => {
+    const fixture = await startFixture()
+    const client = await framedClient(fixture.relayPort)
+    after(async () => {
+      client.close()
+      await fixture.close()
+    })
 
-  const received = collect(socket)
-  const payload = Buffer.concat([compressibleChunk(20_000), randomBytes(20_000), compressibleChunk(5_000)])
-  socket.write(payload)
+    client.send({
+      type: "session.create",
+      token: fixture.token,
+      name: "lying length",
+      target: {host: "127.0.0.1", port: fixture.targetPort},
+      compression: ["zstd"]
+    })
+    await client.next()
 
-  await received.waitFor(payload.length)
+    const payload = compressibleChunk(4096)
+    const encoded = await encodeStreamPayload(payload, "zstd")
 
-  assert.deepEqual(received.bytes(), payload)
-  assert.equal(socket.bytesWritten, payload.length)
-  assert.equal(socket.bytesRead, payload.length)
+    client.send({
+      type: "stream.data",
+      direction: "client-to-target",
+      sequence: payload.length + 1,
+      encoding: "zstd",
+      dataLength: payload.length + 1
+    }, encoded.payload)
 
-  socket.destroy()
-  await fixture.close()
-  await rm(tempDir, {recursive: true, force: true})
-})
+    const response = await client.next()
+    expect(response.header.type).toBe("error")
+    expect(response.header.code).toBe("PROTOCOL_VIOLATION")
 
-test("SocketductSocket replays raw spooled chunks across a reconnect that renegotiates compression", {skip: !zstdAvailable()}, async () => {
-  const tempDir = await mkdtemp(join(tmpdir(), "socketduct-compression-replay-"))
-  const fixture = await startFixture()
+    await client.closed()
+    expect(fixture.targetReceived()).toBe(0)
+  }))
+
+  it("SocketductSocket round-trips compressible and incompressible data with compression negotiated", {skip: !zstdAvailable()}, async () => withTestCleanup(async (after) => {
+    const tempDir = await mkdtemp(join(tmpdir(), "socketduct-compression-test-"))
+    after(() => rm(tempDir, {recursive: true, force: true}))
+    const fixture = await startFixture()
+    after(async () => {
+      await fixture.close()
+    })
 
-  const socket = connectSocketduct({
-    relay: {host: "127.0.0.1", port: fixture.relayPort, token: fixture.token},
-    sessionName: "replay session",
-    target: {host: "127.0.0.1", port: fixture.targetPort},
-    spoolDirectory: tempDir,
-    reconnect: {initialDelayMs: 10}
-  })
-  socket.on("error", () => {})
+    const socket = connectSocketduct({
+      relay: {host: "127.0.0.1", port: fixture.relayPort, token: fixture.token},
+      sessionName: "compressed session",
+      target: {host: "127.0.0.1", port: fixture.targetPort},
+      spoolDirectory: tempDir,
+      reconnect: {initialDelayMs: 10}
+    })
+    after(() => { socket.destroy() })
+    socket.on("error", () => {})
 
-  const received = collect(socket)
-  const first = compressibleChunk(8192)
-  socket.write(first)
-  await received.waitFor(first.length)
-  assert.deepEqual(received.bytes(), first)
+    const received = collect(socket)
+    const payload = Buffer.concat([compressibleChunk(20_000), randomBytes(20_000), compressibleChunk(5_000)])
+    socket.write(payload)
 
-  const identifierBeforeDrop = socket.sessionIdentifier
-  assert.ok(identifierBeforeDrop !== undefined)
+    await received.waitFor(payload.length)
 
-  // Drop the tunnel for real, then write while it is still down. The chunk can only
-  // reach the target by being spooled raw and replayed on the resumed connection,
-  // which renegotiates the codec from scratch.
-  fixture.relay.closeActiveTunnel()
-  const second = compressibleChunk(4096)
-  socket.write(second)
+    expect(received.bytes()).toEqual(payload)
+    expect(socket.bytesWritten).toBe(payload.length)
+    expect(socket.bytesRead).toBe(payload.length)
+  }))
 
-  await received.waitFor(first.length + second.length)
+  it("SocketductSocket replays raw spooled chunks across a reconnect that renegotiates compression", {skip: !zstdAvailable()}, async () => withTestCleanup(async (after) => {
+    const tempDir = await mkdtemp(join(tmpdir(), "socketduct-compression-replay-"))
+    after(() => rm(tempDir, {recursive: true, force: true}))
+    const fixture = await startFixture()
+    after(async () => {
+      await fixture.close()
+    })
 
-  // Same session identifier proves this was a resume, not a fresh session.
-  assert.equal(socket.sessionIdentifier, identifierBeforeDrop)
-  // Sequences are uncompressed offsets, so the relay's contiguity check still lines
-  // up after the codec was renegotiated on the new connection.
-  assert.deepEqual(received.bytes(), Buffer.concat([first, second]))
-  assert.equal(socket.bytesWritten, first.length + second.length)
-  assert.equal(fixture.targetReceived(), first.length + second.length)
+    const socket = connectSocketduct({
+      relay: {host: "127.0.0.1", port: fixture.relayPort, token: fixture.token},
+      sessionName: "replay session",
+      target: {host: "127.0.0.1", port: fixture.targetPort},
+      spoolDirectory: tempDir,
+      reconnect: {initialDelayMs: 10}
+    })
+    after(() => { socket.destroy() })
+    socket.on("error", () => {})
 
-  socket.destroy()
-  await fixture.close()
-  await rm(tempDir, {recursive: true, force: true})
+    const received = collect(socket)
+    const first = compressibleChunk(8192)
+    socket.write(first)
+    await received.waitFor(first.length)
+    expect(received.bytes()).toEqual(first)
+
+    const identifierBeforeDrop = socket.sessionIdentifier
+    expect(identifierBeforeDrop !== undefined).toBeTruthy()
+
+    // Drop the tunnel for real, then write while it is still down. The chunk can only
+    // reach the target by being spooled raw and replayed on the resumed connection,
+    // which renegotiates the codec from scratch.
+    fixture.relay.closeActiveTunnel()
+    const second = compressibleChunk(4096)
+    socket.write(second)
+
+    await received.waitFor(first.length + second.length)
+
+    // Same session identifier proves this was a resume, not a fresh session.
+    expect(socket.sessionIdentifier).toBe(identifierBeforeDrop)
+    // Sequences are uncompressed offsets, so the relay's contiguity check still lines
+    // up after the codec was renegotiated on the new connection.
+    expect(received.bytes()).toEqual(Buffer.concat([first, second]))
+    expect(socket.bytesWritten).toBe(first.length + second.length)
+    expect(fixture.targetReceived()).toBe(first.length + second.length)
+  }))
 })