Prepare Dosh 1.0.0 rc1

Cargo.lock

@@ -436,7 +436,7 @@ dependencies = [
 
 [[package]]
 name = "dosh"
-version = "0.1.10"
+version = "1.0.0-rc1"
 dependencies = [
  "anyhow",
  "base64",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "dosh"
-version = "0.1.10"
+version = "1.0.0-rc1"
 edition = "2024"
 license = "MIT"
 

Makefile

@@ -1,4 +1,4 @@
-.PHONY: build test fmt clippy release-check install package-release package-release-linux package-release-windows publish-release bench-report bench-local bench-local-json bench-docker-ssh bench-docker-mosh fuzz-smoke fuzz-deep soak-local tui-harness
+.PHONY: build test fmt clippy release-check 1.0-check reconnect-check hostile-network-check persistence-check package-check install package-release package-release-linux package-release-windows publish-release bench-report bench-local bench-local-json bench-docker-ssh bench-docker-mosh fuzz-smoke fuzz-deep soak-local tui-harness
 
 build:
 	cargo build --release
@@ -19,6 +19,25 @@ release-check:
 	cargo test
 	$(MAKE) tui-harness
 
+1.0-check: release-check reconnect-check hostile-network-check persistence-check package-check
+
+reconnect-check:
+	cargo test --test integration_smoke resume_updates_udp_endpoint_for_roaming -- --nocapture
+	DOSH_SOAK_SECONDS=$${DOSH_SOAK_SECONDS:-300} cargo test --test integration_smoke sleep_roaming_soak_30m -- --ignored --nocapture
+
+hostile-network-check:
+	cargo test --test hostile_network -- --nocapture
+	DOSH_BADNET_SOAK_SECONDS=$${DOSH_BADNET_SOAK_SECONDS:-300} cargo test --test hostile_network bad_network_tui_work_soak_30m -- --ignored --nocapture
+
+persistence-check:
+	cargo test --test integration_smoke session_survives_server_restart_same_shell_and_screen -- --nocapture
+	cargo test --test integration_smoke multiple_persistent_named_sessions_survive_restart_independently -- --nocapture
+
+package-check:
+	$(MAKE) package-release-linux
+	$(MAKE) package-release-windows
+	sh scripts/verify-release-artifacts.sh
+
 install:
 	sh install.sh --from-current
 

install.sh

@@ -426,18 +426,9 @@ Wants=network-online.target
 [Service]
 Type=simple
 ExecStart=$bindir/dosh-server serve
-Restart=on-failure
+Restart=always
 RestartSec=1
 KillMode=process
-NoNewPrivileges=true
-PrivateTmp=true
-ProtectSystem=strict
-ProtectHome=read-only
-ReadWritePaths=$config_dir $data_dir
-RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
-RestrictRealtime=true
-LockPersonality=true
-MemoryDenyWriteExecute=true
 
 [Install]
 WantedBy=default.target

packaging/systemd/dosh-server.service

@@ -6,18 +6,9 @@ Wants=network-online.target
 [Service]
 Type=simple
 ExecStart=%h/.local/bin/dosh-server serve
-Restart=on-failure
+Restart=always
 RestartSec=1
 KillMode=process
-NoNewPrivileges=true
-PrivateTmp=true
-ProtectSystem=strict
-ProtectHome=read-only
-ReadWritePaths=%h/.config/dosh %h/.local/share/dosh
-RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
-RestrictRealtime=true
-LockPersonality=true
-MemoryDenyWriteExecute=true
 
 [Install]
 WantedBy=default.target

scripts/verify-release-artifacts.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env sh
+set -eu
+
+repo_root="$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)"
+cd "$repo_root"
+
+version="$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | sed -n '1p')"
+out_dir="${DOSH_PACKAGE_DIR:-target/dosh-release}"
+
+artifact_version() {
+  artifact="$1"
+  case "$artifact" in
+    *.tar.gz)
+      tar -xOf "$artifact" dosh/VERSION 2>/dev/null | tr -d '\r\n'
+      ;;
+    *.zip)
+      unzip -p "$artifact" dosh/VERSION 2>/dev/null | tr -d '\r\n'
+      ;;
+    *)
+      return 1
+      ;;
+  esac
+}
+
+failed=0
+for artifact in \
+  "$out_dir/dosh-linux-x86_64.tar.gz" \
+  "$out_dir/dosh-macos-aarch64.tar.gz" \
+  "$out_dir/dosh-windows-x86_64.zip"; do
+  if [ ! -f "$artifact" ]; then
+    echo "missing release artifact: $artifact" >&2
+    failed=1
+    continue
+  fi
+  if [ ! -f "$artifact.sha256" ]; then
+    echo "missing release checksum: $artifact.sha256" >&2
+    failed=1
+  fi
+  actual="$(artifact_version "$artifact" || true)"
+  if [ "$actual" != "$version" ]; then
+    echo "artifact version mismatch: $artifact has ${actual:-unknown}, expected $version" >&2
+    failed=1
+  fi
+done
+
+exit "$failed"

src/bin/dosh-client.rs

@@ -3524,6 +3524,60 @@ fn resolve_addr(host: &str, port: u16) -> Result<SocketAddr> {
         .ok_or_else(|| anyhow!("no UDP address resolved for {host}:{port}"))
 }
 
+async fn send_terminal_udp(socket: &UdpSocket, packet: &[u8], addr: SocketAddr) -> Result<bool> {
+    match socket.send_to(packet, addr).await {
+        Ok(_) => Ok(true),
+        Err(err) if is_transient_udp_send_error(&err) => Ok(false),
+        Err(err) => Err(err).with_context(|| format!("send UDP packet to {addr}")),
+    }
+}
+
+fn is_transient_udp_send_error(err: &std::io::Error) -> bool {
+    matches!(
+        err.kind(),
+        std::io::ErrorKind::Interrupted
+            | std::io::ErrorKind::TimedOut
+            | std::io::ErrorKind::WouldBlock
+    ) || err.raw_os_error().is_some_and(is_transient_udp_os_error)
+}
+
+#[cfg(unix)]
+fn is_transient_udp_os_error(code: i32) -> bool {
+    matches!(
+        code,
+        libc::EADDRNOTAVAIL
+            | libc::ECONNREFUSED
+            | libc::ECONNRESET
+            | libc::EHOSTDOWN
+            | libc::EHOSTUNREACH
+            | libc::ENETDOWN
+            | libc::ENETRESET
+            | libc::ENETUNREACH
+            | libc::ETIMEDOUT
+    )
+}
+
+#[cfg(windows)]
+fn is_transient_udp_os_error(code: i32) -> bool {
+    matches!(
+        code,
+        10049  // WSAEADDRNOTAVAIL
+            | 10050 // WSAENETDOWN
+            | 10051 // WSAENETUNREACH
+            | 10052 // WSAENETRESET
+            | 10054 // WSAECONNRESET
+            | 10060 // WSAETIMEDOUT
+            | 10061 // WSAECONNREFUSED
+            | 10064 // WSAEHOSTDOWN
+            | 10065 // WSAEHOSTUNREACH
+    )
+}
+
+#[cfg(not(any(unix, windows)))]
+fn is_transient_udp_os_error(_code: i32) -> bool {
+    false
+}
+
 #[allow(clippy::too_many_arguments)]
 async fn try_native_auth(
     socket: &UdpSocket,
@@ -4271,6 +4325,7 @@ async fn run_terminal(
     let mut status_tick = tokio::time::interval(Duration::from_secs(1));
     let mut resize_tick = tokio::time::interval(Duration::from_millis(250));
     let mut stream_retransmit_tick = tokio::time::interval(Duration::from_millis(200));
+    let mut frame_gap_tick = tokio::time::interval(Duration::from_millis(250));
     let mut last_size = terminal_size();
     // React to terminal resize the instant it happens via SIGWINCH (mosh-style),
     // instead of waiting up to one `resize_tick`. The 250ms poll below stays as a
@@ -4336,7 +4391,13 @@ async fn run_terminal(
         && cred.mode != "view-only"
         && !forward_only
     {
-        send_input(&socket, addr, &cred, &mut send_seq, bytes).await?;
+        if !send_input(&socket, addr, &cred, &mut send_seq, bytes.clone()).await? {
+            queue_stale_pending_user_input(
+                &mut pending_user_input,
+                &mut pending_user_input_bytes,
+                bytes,
+            )?;
+        }
         startup_input_hold_until = Some(Instant::now() + STARTUP_INPUT_HOLD);
         startup_gate_mode = StartupGateMode::HoldAll;
     }
@@ -4410,8 +4471,15 @@ async fn run_terminal(
                                 && let Some((send_now, mut hold_for_later)) =
                                     split_after_command_submit(&bytes)
                             {
-                                predictor.observe_input(&send_now)?;
+                                if send_input(&socket, addr, &cred, &mut send_seq, send_now.clone()).await? {
-                                send_input(&socket, addr, &cred, &mut send_seq, send_now).await?;
+                                    predictor.observe_input(&send_now)?;
+                                } else {
+                                    queue_stale_pending_user_input(
+                                        &mut pending_user_input,
+                                        &mut pending_user_input_bytes,
+                                        send_now,
+                                    )?;
+                                }
                                 startup_input_hold_until = Some(
                                     Instant::now()
                                         + post_submit_hold_duration(&hold_for_later),
@@ -4430,15 +4498,23 @@ async fn run_terminal(
                                     )?;
                                     continue;
                                 } else if !hold_for_later.is_empty() {
-                                    predictor.observe_input(&hold_for_later)?;
+                                    let sent = send_input(
-                                    send_input(
                                         &socket,
                                         addr,
                                         &cred,
                                         &mut send_seq,
-                                        std::mem::take(&mut hold_for_later),
+                                        hold_for_later.clone(),
                                     )
                                     .await?;
+                                    if sent {
+                                        predictor.observe_input(&hold_for_later)?;
+                                    } else {
+                                        queue_stale_pending_user_input(
+                                            &mut pending_user_input,
+                                            &mut pending_user_input_bytes,
+                                            std::mem::take(&mut hold_for_later),
+                                        )?;
+                                    }
                                 }
                                 continue;
                             }
@@ -4476,8 +4552,15 @@ async fn run_terminal(
                                     .await?;
                                 }
                             } else {
-                                predictor.observe_input(&bytes)?;
+                                if send_input(&socket, addr, &cred, &mut send_seq, bytes.clone()).await? {
-                                send_input(&socket, addr, &cred, &mut send_seq, bytes).await?;
+                                    predictor.observe_input(&bytes)?;
+                                } else {
+                                    queue_stale_pending_user_input(
+                                        &mut pending_user_input,
+                                        &mut pending_user_input_bytes,
+                                        bytes,
+                                    )?;
+                                }
                             }
                         }
                     }
@@ -4498,6 +4581,36 @@ async fn run_terminal(
             _ = resize_tick.tick() => {
                 maybe_send_resize(&socket, addr, &cred, &mut send_seq, &mut last_size).await?;
             }
+            _ = frame_gap_tick.tick() => {
+                if frame_buffer.resync_due()
+                    && let Some(frame) = reconnect(
+                        &socket,
+                        &mut cred,
+                        &mut send_seq,
+                        last_size,
+                        &mut frame_buffer,
+                        &mut predictor,
+                    )
+                    .await?
+                {
+                    refresh_live_addr(&mut addr, &cred)?;
+                    if !forward_only {
+                        render_frame(&frame)?;
+                        predictor.observe_output(&frame.bytes);
+                    }
+                    last_packet_at = Instant::now();
+                    flush_pending_user_input(
+                        &socket,
+                        addr,
+                        &cred,
+                        &mut send_seq,
+                        &mut predictor,
+                        &mut pending_user_input,
+                        &mut pending_user_input_bytes,
+                    )
+                    .await?;
+                }
+            }
             recv = socket.recv_from(&mut recv_buf) => {
                 let (n, _) = recv?;
                 let Ok(packet) = protocol::decode(&recv_buf[..n]) else {
@@ -4579,6 +4692,22 @@ async fn run_terminal(
                     }
                     PacketKind::Pong => {
                         last_packet_at = Instant::now();
+                        if should_flush_terminal_input_after_contact(
+                            forward_only,
+                            &cred.mode,
+                            pending_user_input.is_empty(),
+                        ) {
+                            flush_pending_user_input(
+                                &socket,
+                                addr,
+                                &cred,
+                                &mut send_seq,
+                                &mut predictor,
+                                &mut pending_user_input,
+                                &mut pending_user_input_bytes,
+                            )
+                            .await?;
+                        }
                     }
                     PacketKind::Rekey => {
                         // Server-initiated transport rekey (spec §11). The Rekey is
@@ -4620,7 +4749,7 @@ async fn run_terminal(
                             CLIENT_TO_SERVER,
                             b"",
                         )?;
-                        socket.send_to(&ack, addr).await?;
+                        let _ = send_terminal_udp(&socket, &ack, addr).await?;
                     }
                     PacketKind::AttachReject => {
                         let reject: AttachReject = protocol::from_body(&packet.body)?;
@@ -5055,7 +5184,7 @@ async fn run_terminal(
                         b"",
                     )?;
                     send_seq += 1;
-                    socket.send_to(&packet, addr).await?;
+                    let _ = send_terminal_udp(&socket, &packet, addr).await?;
                 }
                 // Re-evaluate the prediction display policy on every timer tick so
                 // a latency spike (or recovery) flips speculation on/off promptly
@@ -5369,6 +5498,23 @@ fn queue_pending_user_input_with_filter(
     Ok(())
 }
 
+fn requeue_pending_user_input_front(
+    pending: &mut VecDeque<PendingUserInput>,
+    pending_bytes: &mut usize,
+    input: PendingUserInput,
+) -> Result<()> {
+    let next = pending_bytes
+        .checked_add(input.bytes.len())
+        .ok_or_else(|| anyhow!("pending input buffer overflow"))?;
+    anyhow::ensure!(
+        next <= MAX_PENDING_USER_INPUT_BYTES,
+        "pending input buffer full while disconnected"
+    );
+    *pending_bytes = next;
+    pending.push_front(input);
+    Ok(())
+}
+
 #[derive(Debug, Clone, PartialEq, Eq)]
 struct PendingUserInput {
     bytes: Vec<u8>,
@@ -5408,6 +5554,14 @@ fn should_hold_during_startup_gate(
     mode == StartupGateMode::HoldAll || already_queued || should_hold_post_submit_input(bytes)
 }
 
+fn should_flush_terminal_input_after_contact(
+    forward_only: bool,
+    mode: &str,
+    pending_empty: bool,
+) -> bool {
+    !forward_only && !pending_empty && mode != "view-only" && mode != "forward-only"
+}
+
 async fn flush_pending_user_input(
     socket: &UdpSocket,
     addr: SocketAddr,
@@ -5431,8 +5585,19 @@ async fn flush_pending_user_input(
         if bytes.is_empty() {
             continue;
         }
-        predictor.observe_input(&bytes)?;
+        if send_input(socket, addr, cred, send_seq, bytes.clone()).await? {
-        send_input(socket, addr, cred, send_seq, bytes).await?;
+            predictor.observe_input(&bytes)?;
+        } else {
+            requeue_pending_user_input_front(
+                pending,
+                pending_bytes,
+                PendingUserInput {
+                    bytes,
+                    strip_mouse_reports: false,
+                },
+            )?;
+            break;
+        }
     }
     Ok(())
 }
@@ -5564,7 +5729,7 @@ async fn send_input(
     cred: &CachedCredential,
     send_seq: &mut u64,
     bytes: Vec<u8>,
-) -> Result<()> {
+) -> Result<bool> {
     let body = protocol::to_body(&Input { bytes })?;
     let packet = protocol::encode_encrypted(
         PacketKind::Input,
@@ -5576,8 +5741,7 @@ async fn send_input(
         &body,
     )?;
     *send_seq += 1;
-    socket.send_to(&packet, addr).await?;
+    send_terminal_udp(socket, &packet, addr).await
-    Ok(())
 }
 
 async fn send_stream_open(
@@ -5920,7 +6084,7 @@ async fn send_stream_packet(
         body,
     )?;
     *send_seq += 1;
-    socket.send_to(&packet, addr).await?;
+    let _ = send_terminal_udp(socket, &packet, addr).await?;
     Ok(())
 }
 
@@ -6561,14 +6725,22 @@ fn contains_bytes(haystack: &[u8], needle: &[u8]) -> bool {
         .any(|window| window == needle)
 }
 
+const FRAME_GAP_RESYNC_AFTER_MS: u64 = 2_500;
+const FRAME_GAP_RESYNC_COOLDOWN_MS: u64 = 5_000;
+const FRAME_GAP_PENDING_RESYNC_THRESHOLD: usize = 128;
+
 #[derive(Default)]
 struct FrameBuffer {
     pending: BTreeMap<u64, Frame>,
+    gap_since: Option<Instant>,
+    last_resync_at: Option<Instant>,
 }
 
 impl FrameBuffer {
     fn clear(&mut self) {
         self.pending.clear();
+        self.gap_since = None;
+        self.last_resync_at = None;
     }
 
     fn accept(&mut self, frame: Frame, last_rendered_seq: &mut u64) -> Vec<Frame> {
@@ -6577,6 +6749,8 @@ impl FrameBuffer {
                 return Vec::new();
             }
             self.pending.clear();
+            self.gap_since = None;
+            self.last_resync_at = None;
             *last_rendered_seq = frame.output_seq;
             return vec![frame];
         }
@@ -6590,8 +6764,47 @@ impl FrameBuffer {
             *last_rendered_seq = frame.output_seq;
             ready.push(frame);
         }
+        self.refresh_gap(*last_rendered_seq);
         ready
     }
+
+    fn refresh_gap(&mut self, last_rendered_seq: u64) {
+        let waiting_on_missing = self
+            .pending
+            .first_key_value()
+            .is_some_and(|(&seq, _)| seq > last_rendered_seq.saturating_add(1));
+        if waiting_on_missing {
+            self.gap_since.get_or_insert_with(Instant::now);
+        } else {
+            self.gap_since = None;
+            self.last_resync_at = None;
+        }
+    }
+
+    fn resync_due(&mut self) -> bool {
+        let Some(gap_since) = self.gap_since else {
+            return false;
+        };
+        let now = Instant::now();
+        let waited = now.duration_since(gap_since);
+        if waited < Duration::from_millis(FRAME_GAP_RESYNC_AFTER_MS)
+            && self.pending.len() < FRAME_GAP_PENDING_RESYNC_THRESHOLD
+        {
+            return false;
+        }
+        if self.last_resync_at.is_some_and(|last| {
+            now.duration_since(last) < Duration::from_millis(FRAME_GAP_RESYNC_COOLDOWN_MS)
+        }) {
+            return false;
+        }
+        self.last_resync_at = Some(now);
+        true
+    }
+
+    #[cfg(test)]
+    fn backdate_gap_for_test(&mut self, elapsed: Duration) {
+        self.gap_since = Some(Instant::now() - elapsed);
+    }
 }
 
 /// Read the current terminal size and, if it changed since `last_size`, send a
@@ -6635,7 +6848,7 @@ async fn send_resize(
         &body,
     )?;
     *send_seq += 1;
-    socket.send_to(&packet, addr).await?;
+    let _ = send_terminal_udp(socket, &packet, addr).await?;
     Ok(())
 }
 
@@ -6655,7 +6868,7 @@ async fn send_ack(
         b"",
     )?;
     *send_seq += 1;
-    socket.send_to(&packet, addr).await?;
+    let _ = send_terminal_udp(socket, &packet, addr).await?;
     Ok(())
 }
 
@@ -6670,7 +6883,7 @@ async fn detach_once(socket: &UdpSocket, cred: &CachedCredential, seq: u64) -> R
         CLIENT_TO_SERVER,
         b"",
     )?;
-    socket.send_to(&packet, addr).await?;
+    let _ = send_terminal_udp(socket, &packet, addr).await?;
     Ok(())
 }
 
@@ -7003,23 +7216,24 @@ const TERMINAL_CLEANUP: &[u8] = concat!(
 #[cfg(test)]
 mod tests {
     use super::{
-        CachedCredential, DisconnectStatus, DynamicForward, FrameBuffer, LocalForward,
+        CachedCredential, DisconnectStatus, DynamicForward, FRAME_GAP_RESYNC_AFTER_MS, FrameBuffer,
-        MAX_PENDING_USER_INPUT_BYTES, POST_SUBMIT_ALL_INPUT_HOLD, PendingStreamOpen, PredictMode,
+        LocalForward, MAX_PENDING_USER_INPUT_BYTES, POST_SUBMIT_ALL_INPUT_HOLD, PendingStreamOpen,
-        Predictor, RESTART_STATUS_SCRIPT, RemoteForward, STARTUP_INPUT_HOLD, SshConfig,
+        PredictMode, Predictor, RESTART_STATUS_SCRIPT, RemoteForward, STARTUP_INPUT_HOLD,
-        StartupGateMode, StatusAction, auth_allows, cache_key, cache_server_prefix,
+        SshConfig, StartupGateMode, StatusAction, auth_allows, cache_key, cache_server_prefix,
         clear_cached_credentials, ensure_tui_safe_status_overlay, input_matches_escape,
-        is_local_status_target, is_resume_response_for_client, latest_release_download_url,
+        is_local_status_target, is_resume_response_for_client, is_transient_udp_os_error,
-        load_first_native_identity_with_prompt, parse_dynamic_forward, parse_escape_key,
+        latest_release_download_url, load_first_native_identity_with_prompt, parse_dynamic_forward,
-        parse_local_forward, parse_remote_forward, parse_ssh_config, post_submit_hold_duration,
+        parse_escape_key, parse_local_forward, parse_remote_forward, parse_ssh_config,
-        queue_pending_user_input, raw_contains_host_table, recv_response_until, refresh_live_addr,
+        post_submit_hold_duration, queue_pending_user_input, raw_contains_host_table,
-        release_tag_download_url, release_tag_from_effective_url, release_version_from_tag,
+        recv_response_until, refresh_live_addr, release_tag_download_url,
-        render_status_clear, render_status_overlay, requested_env, resolved_startup_command,
+        release_tag_from_effective_url, release_version_from_tag, render_status_clear,
-        retransmit_stream_opens, rewrite_forward_command, selected_predict_mode, selected_udp_host,
+        render_status_overlay, requested_env, resolved_startup_command, retransmit_stream_opens,
-        server_version_mismatch, should_hold_during_startup_gate, should_hold_post_submit_input,
+        rewrite_forward_command, selected_predict_mode, selected_udp_host, server_version_mismatch,
-        split_after_command_submit, ssh_destination_host, ssh_username, ssh_with_user,
+        should_flush_terminal_input_after_contact, should_hold_during_startup_gate,
-        startup_command, status_ssh_target, strip_stale_mouse_reports, toml_bare_key_or_quoted,
+        should_hold_post_submit_input, split_after_command_submit, ssh_destination_host,
-        update_check_requested, update_version_status, upsert_managed_block, valid_forward_host,
+        ssh_username, ssh_with_user, startup_command, status_ssh_target, strip_stale_mouse_reports,
-        vscode_safe_alias,
+        toml_bare_key_or_quoted, update_check_requested, update_version_status,
+        upsert_managed_block, valid_forward_host, vscode_safe_alias,
     };
     use dosh::config::{ClientConfig, CommandExtension, HostConfig};
     use dosh::native::EnvVar;
@@ -7457,6 +7671,54 @@ mod tests {
         assert!(buffer.accept(test_frame(12, false), &mut last).is_empty());
     }
 
+    #[test]
+    fn frame_buffer_keeps_gap_buffered_without_snapshot_resync() {
+        let mut buffer = FrameBuffer::default();
+        let mut last = 10;
+
+        assert!(buffer.accept(test_frame(13, false), &mut last).is_empty());
+        assert_eq!(last, 10);
+        assert!(buffer.accept(test_frame(14, false), &mut last).is_empty());
+        assert_eq!(last, 10);
+        assert!(!buffer.resync_due());
+
+        let ready = buffer.accept(test_frame(11, false), &mut last);
+        assert_eq!(ready.len(), 1);
+        assert_eq!(ready[0].output_seq, 11);
+        assert_eq!(last, 11);
+
+        let ready = buffer.accept(test_frame(12, false), &mut last);
+        assert_eq!(ready.len(), 3);
+        assert_eq!(
+            ready
+                .iter()
+                .map(|frame| frame.output_seq)
+                .collect::<Vec<_>>(),
+            vec![12, 13, 14]
+        );
+        assert_eq!(last, 14);
+    }
+
+    #[test]
+    fn frame_buffer_resyncs_old_gap_with_cooldown() {
+        let mut buffer = FrameBuffer::default();
+        let mut last = 10;
+
+        assert!(buffer.accept(test_frame(13, false), &mut last).is_empty());
+        buffer.backdate_gap_for_test(Duration::from_millis(FRAME_GAP_RESYNC_AFTER_MS + 10));
+        assert!(buffer.resync_due());
+        assert!(
+            !buffer.resync_due(),
+            "resync must be rate-limited so snapshots cannot churn the TUI"
+        );
+
+        let ready = buffer.accept(test_frame(20, true), &mut last);
+        assert_eq!(ready.len(), 1);
+        assert_eq!(ready[0].output_seq, 20);
+        assert_eq!(last, 20);
+        assert!(!buffer.resync_due());
+    }
+
     #[test]
     fn frame_buffer_ignores_stale_snapshot() {
         let mut buffer = FrameBuffer::default();
@@ -7751,6 +8013,34 @@ mod tests {
         assert_eq!(post_submit_hold_duration(b"x"), POST_SUBMIT_ALL_INPUT_HOLD);
     }
 
+    #[test]
+    fn contact_flushes_pending_terminal_input_for_interactive_sessions() {
+        assert!(should_flush_terminal_input_after_contact(
+            false, "normal", false
+        ));
+        assert!(should_flush_terminal_input_after_contact(
+            false,
+            "read-write",
+            false
+        ));
+        assert!(!should_flush_terminal_input_after_contact(
+            false, "normal", true
+        ));
+        assert!(!should_flush_terminal_input_after_contact(
+            true, "normal", false
+        ));
+        assert!(!should_flush_terminal_input_after_contact(
+            false,
+            "view-only",
+            false
+        ));
+        assert!(!should_flush_terminal_input_after_contact(
+            false,
+            "forward-only",
+            false
+        ));
+    }
+
     #[test]
     fn reconnect_refreshes_live_send_address_from_credentials() {
         let mut addr = "127.0.0.1:50000".parse().unwrap();
@@ -8173,6 +8463,25 @@ mod tests {
         assert_eq!(pending_bytes, MAX_PENDING_USER_INPUT_BYTES);
     }
 
+    #[test]
+    fn transient_udp_send_errors_are_not_terminal_fatal() {
+        #[cfg(unix)]
+        {
+            assert!(is_transient_udp_os_error(libc::ENETUNREACH));
+            assert!(is_transient_udp_os_error(libc::EHOSTUNREACH));
+            assert!(is_transient_udp_os_error(libc::EADDRNOTAVAIL));
+            assert!(!is_transient_udp_os_error(libc::EINVAL));
+        }
+
+        #[cfg(windows)]
+        {
+            assert!(is_transient_udp_os_error(10051)); // WSAENETUNREACH
+            assert!(is_transient_udp_os_error(10065)); // WSAEHOSTUNREACH
+            assert!(is_transient_udp_os_error(10049)); // WSAEADDRNOTAVAIL
+            assert!(!is_transient_udp_os_error(10022)); // WSAEINVAL
+        }
+    }
+
     #[test]
     fn stale_mouse_reports_are_stripped_from_pending_input() {
         let input = b"\x1b[<35;152;1Mhello\x1b[<0;107;10m";

src/bin/dosh-server.rs

@@ -512,12 +512,13 @@ impl ServerState {
 
     /// Whether a session named `name` should be backed by a persistent holder.
     ///
-    /// With persistence enabled, every PTY session gets a detached holder. That
+    /// With persistence enabled, explicitly named sessions get a detached
-    /// includes implicit `term-<millis>-<pid>` sessions: a reconnecting client has
+    /// holder. Implicit `term-<millis>-<pid>` sessions are one-off terminals
-    /// the exact session name in its ticket cache, so it can reattach after a
+    /// created by `dosh host`; users cannot intentionally reattach to them by
-    /// quick server restart without forcing users to name sessions manually.
+    /// name, so persisting them only leaves stale holders that can be
-    fn should_persist_session(&self, _name: &str) -> bool {
+    /// accidentally re-adopted after restarts.
-        self.config.persist_sessions
+    fn should_persist_session(&self, name: &str) -> bool {
+        self.config.persist_sessions && !protocol::is_implicit_session_name(name)
     }
 
     /// Spawn (or, in the persistent case, spawn-and-adopt) a PTY for a session.
@@ -605,6 +606,20 @@ impl ServerState {
             if self.sessions.contains_key(&name) {
                 continue;
             }
+            if !self.should_persist_session(&name) {
+                eprintln!(
+                    "discarding stale implicit persistent session {name} (shell pid {})",
+                    meta.shell_pid
+                );
+                persist::request_shutdown(&sessions_dir, &name, None);
+                if meta.shell_pid > 0 {
+                    let _ = unsafe { libc::kill(meta.shell_pid, libc::SIGHUP) };
+                    let _ = unsafe { libc::kill(meta.shell_pid, libc::SIGTERM) };
+                    std::thread::sleep(Duration::from_millis(50));
+                    let _ = unsafe { libc::kill(meta.shell_pid, libc::SIGKILL) };
+                }
+                continue;
+            }
             let (pty, control) = match self.adopt_persistent_pty(&name) {
                 Ok(pair) => pair,
                 Err(err) => {
@@ -3504,11 +3519,9 @@ async fn retransmit_pending(
                     if pending.output_seq <= client.last_acked {
                         continue;
                     }
-                    if now.duration_since(pending.last_sent) >= Duration::from_millis(200)
+                    if now.duration_since(pending.last_sent) >= Duration::from_millis(200) {
-                        && pending.attempts < 8
-                    {
                         pending.last_sent = now;
-                        pending.attempts += 1;
+                        pending.attempts = pending.attempts.saturating_add(1);
                         sends.push((client.endpoint, pending.packet.clone()));
                     }
                 }
@@ -3841,7 +3854,7 @@ mod tests {
     use super::*;
 
     #[test]
-    fn persists_all_sessions_when_enabled() {
+    fn persists_named_sessions_when_enabled() {
         let (pty_tx, _rx) = mpsc::unbounded_channel();
         let config = ServerConfig {
             persist_sessions: true,
@@ -3851,7 +3864,7 @@ mod tests {
         let state = ServerState::new(config, [0u8; 32], pty_tx);
         assert!(state.should_persist_session("default")); // prewarmed
         assert!(state.should_persist_session("work")); // explicitly named
-        assert!(state.should_persist_session("term-1781470634216-76685")); // implicit reconnect
+        assert!(!state.should_persist_session("term-1781470634216-76685")); // one-off terminal
     }
 
     #[test]

src/persist.rs

@@ -435,6 +435,10 @@ pub fn run_holder(
         let mut cmd = [0u8; 1];
         match stream.read(&mut cmd) {
             Ok(1) if cmd[0] == HOLDER_CMD_SHUTDOWN => {
+                if shell_pid > 0 {
+                    let _ = unsafe { libc::kill(shell_pid, libc::SIGHUP) };
+                    let _ = unsafe { libc::kill(shell_pid, libc::SIGTERM) };
+                }
                 let _ = std::fs::remove_dir_all(runtime_dir);
                 std::process::exit(0);
             }

tests/hostile_network.rs

@@ -258,7 +258,8 @@ fn relay_loop(
     let mut upstream = new_upstream();
     let mut client_addr: Option<SocketAddr> = None;
     let mut rng = StdRng::seed_from_u64(seed);
-    let mut held: Option<(Vec<u8>, bool)> = None; // (packet, is_c2s) held for reorder
+    let mut held_c2s: Option<Vec<u8>> = None;
+    let mut held_s2c: Option<Vec<u8>> = None;
     let mut buf = [0u8; 65535];
 
     loop {
@@ -288,10 +289,9 @@ fn relay_loop(
                         &upstream,
                         server_addr,
                         packet,
-                        true,
                         &controls,
                         &mut rng,
-                        &mut held,
+                        &mut held_c2s,
                     );
                 }
             }
@@ -310,7 +310,12 @@ fn relay_loop(
                     let drop_pct = controls.drop_s2c_percent.load(Ordering::SeqCst);
                     if drop_pct == 0 || rng.gen_range(0..100) >= drop_pct {
                         forward_with_effects(
-                            &front, dst, packet, false, &controls, &mut rng, &mut held,
+                            &front,
+                            dst,
+                            packet,
+                            &controls,
+                            &mut rng,
+                            &mut held_s2c,
                         );
                     }
                 }
@@ -336,23 +341,22 @@ fn forward_with_effects(
     out: &UdpSocket,
     dst: SocketAddr,
     packet: Vec<u8>,
-    is_c2s: bool,
     controls: &RelayControls,
     rng: &mut StdRng,
-    held: &mut Option<(Vec<u8>, bool)>,
+    held: &mut Option<Vec<u8>>,
 ) {
     // Reorder: if armed, hold this packet and release the previously held one
     // afterward (so two consecutive packets swap order).
     if controls.reorder_next.swap(false, Ordering::SeqCst) {
-        if let Some((prev, _)) = held.take() {
+        if let Some(prev) = held.take() {
             let _ = out.send_to(&packet, dst);
             let _ = out.send_to(&prev, dst);
             return;
         }
-        *held = Some((packet, is_c2s));
+        *held = Some(packet);
         return;
     }
-    if let Some((prev, _)) = held.take() {
+    if let Some(prev) = held.take() {
         let _ = out.send_to(&prev, dst);
     }
 
@@ -767,6 +771,46 @@ fn wait_for_text(socket: &UdpSocket, key: &[u8; 32], needle: &str, millis: u64)
     acc.contains(needle)
 }
 
+fn wait_for_text_with_ack(
+    socket: &UdpSocket,
+    relay: &Relay,
+    client_id: [u8; 16],
+    seq: &mut u64,
+    key: &[u8; 32],
+    needle: &str,
+    millis: u64,
+) -> bool {
+    let prev = socket.read_timeout().unwrap();
+    socket
+        .set_read_timeout(Some(Duration::from_millis(100)))
+        .unwrap();
+    let deadline = Instant::now() + Duration::from_millis(millis);
+    let mut acc = String::new();
+    while Instant::now() < deadline {
+        if let Some((_header, frame)) = recv_frame(socket, key) {
+            acc.push_str(&String::from_utf8_lossy(&frame.bytes));
+            let ack = protocol::encode_encrypted(
+                PacketKind::Ack,
+                client_id,
+                *seq,
+                frame.output_seq,
+                key,
+                CLIENT_TO_SERVER,
+                b"",
+            )
+            .unwrap();
+            *seq += 1;
+            socket.send_to(&ack, relay.front_addr()).unwrap();
+            if acc.contains(needle) {
+                socket.set_read_timeout(prev).unwrap();
+                return true;
+            }
+        }
+    }
+    socket.set_read_timeout(prev).unwrap();
+    acc.contains(needle)
+}
+
 #[test]
 fn session_survives_packet_loss_and_reorder() {
     let dir = tempfile::tempdir().unwrap();
@@ -820,6 +864,94 @@ fn session_survives_packet_loss_and_reorder() {
     );
 }
 
+#[test]
+#[ignore = "30-minute hostile-network TUI soak; run with `DOSH_BADNET_SOAK_SECONDS=1800 cargo test --test hostile_network bad_network_tui_work_soak_30m -- --ignored --nocapture`"]
+fn bad_network_tui_work_soak_30m() {
+    let soak_secs = std::env::var("DOSH_BADNET_SOAK_SECONDS")
+        .ok()
+        .and_then(|value| value.parse::<u64>().ok())
+        .unwrap_or(30 * 60);
+    let dir = tempfile::tempdir().unwrap();
+    let port = free_udp_port();
+    let config = write_server_config(&dir, port);
+    let mut server = start_server(&dir, &config);
+    let relay = Relay::spawn(port, 0xBADC0DEu64);
+    let (socket, bootstrap, ok) = attach_through_relay(&config, &relay);
+
+    relay.set_drop_c2s(15);
+    relay.set_drop_s2c(20);
+    relay.set_dup(10);
+
+    let deadline = Instant::now() + Duration::from_secs(soak_secs);
+    let mut seq = 2u64;
+    let mut iteration = 0u64;
+    while Instant::now() < deadline {
+        if iteration.is_multiple_of(2) {
+            relay.arm_reorder();
+        }
+        if iteration > 0 && iteration.is_multiple_of(7) {
+            let _ = relay.rebind_upstream();
+        }
+        if iteration > 0 && iteration.is_multiple_of(11) {
+            relay.set_drop_s2c(100);
+            thread::sleep(Duration::from_millis(750));
+            relay.set_drop_s2c(20);
+        }
+
+        let marker = format!("DOSH_BADNET_TUI_{iteration}");
+        let command = format!(
+            "stty -echo; \
+             printf '\\033[?1049h\\033[?2026h\\033[?25l'; \
+             for i in 1 2 3 4 5 6; do \
+               printf '\\033[%s;4H{} ⠀⠁⠃⠇⡇⣇⣧⣷⣿ █▇▆▅▄▃▂▁ %s\\033[0m' \"$i\" \"$i\"; \
+             done; \
+             printf '\\033[?25h\\033[?2026l\\033[?1049l'\n",
+            marker
+        );
+
+        let step_deadline = Instant::now() + Duration::from_secs(8);
+        let mut seen = false;
+        let mut attempts = 0;
+        while Instant::now() < step_deadline && attempts < 12 {
+            send_input(
+                &socket,
+                &relay,
+                ok.client_id,
+                seq,
+                0,
+                &bootstrap.session_key,
+                command.as_bytes(),
+            );
+            seq += 1;
+            attempts += 1;
+            if wait_for_text_with_ack(
+                &socket,
+                &relay,
+                ok.client_id,
+                &mut seq,
+                &bootstrap.session_key,
+                &marker,
+                500,
+            ) {
+                seen = true;
+                break;
+            }
+        }
+        assert!(
+            seen,
+            "TUI marker {marker} did not arrive during hostile-network soak"
+        );
+
+        iteration += 1;
+        thread::sleep(Duration::from_millis(500));
+    }
+
+    relay.clear_impairments();
+    drop(relay);
+    let _ = server.kill();
+    let _ = server.wait();
+}
+
 #[test]
 fn duplicated_and_replayed_input_is_applied_at_most_once() {
     let dir = tempfile::tempdir().unwrap();

tests/integration_smoke.rs

@@ -1392,18 +1392,10 @@ fn server_retransmits_unacked_output_frames() {
     );
 
     let mut seen = Vec::new();
-    let mut duplicate = None;
+    let deadline = std::time::Instant::now() + Duration::from_secs(4);
-    let deadline = std::time::Instant::now() + Duration::from_secs(3);
     while std::time::Instant::now() < deadline {
         if let Some((header, frame)) = recv_frame(&socket, &bootstrap.session_key) {
             if String::from_utf8_lossy(&frame.bytes).contains("DOSH_RETRANSMIT") {
-                if seen
-                    .iter()
-                    .any(|(_, output_seq)| *output_seq == frame.output_seq)
-                {
-                    duplicate = Some((header.seq, frame.output_seq));
-                    break;
-                }
                 seen.push((header.seq, frame.output_seq));
             }
         }
@@ -1412,9 +1404,18 @@ fn server_retransmits_unacked_output_frames() {
     let _ = server.kill();
     let _ = server.wait();
 
+    let max_same_output_seq = seen
+        .iter()
+        .map(|(_, output_seq)| {
+            seen.iter()
+                .filter(|(_, candidate)| candidate == output_seq)
+                .count()
+        })
+        .max()
+        .unwrap_or(0);
     assert!(
-        duplicate.is_some(),
+        max_same_output_seq >= 10,
-        "expected retransmitted same output seq, seen={seen:?}"
+        "expected retransmission to continue past the old 8-attempt ceiling, seen={seen:?}"
     );
 }
 
@@ -2518,6 +2519,9 @@ fn write_persistent_server_config(dir: &tempfile::TempDir, port: u16) -> std::pa
     let mut raw = fs::read_to_string(&config).unwrap();
     // The base writer hardcodes `persist_sessions = false`; flip it on.
     raw = raw.replace("persist_sessions = false", "persist_sessions = true");
+    // Persistence tests attach the sessions they need explicitly. Leaving the
+    // base prewarm on here creates a detached default holder in every test.
+    raw = raw.replace("prewarm_sessions = [\"default\"]", "prewarm_sessions = []");
     fs::write(&config, raw).unwrap();
     config
 }
@@ -2553,6 +2557,45 @@ fn kill_holder(sessions_dir: &Path, session: &str) {
         .status();
 }
 
+/// Create a holder the way older Dosh builds did for implicit sessions, so
+/// startup migration can be tested without depending on the new spawn policy.
+fn spawn_legacy_holder(sessions_dir: &Path, session: &str) {
+    let server = env!("CARGO_BIN_EXE_dosh-server");
+    let runtime_dir = dosh::persist::ensure_runtime_dir(sessions_dir, session).unwrap();
+    let mut launcher = Command::new(server)
+        .arg("hold")
+        .arg("--runtime-dir")
+        .arg(&runtime_dir)
+        .arg("--session")
+        .arg(session)
+        .arg("--shell")
+        .arg("/bin/sh")
+        .arg("--cols")
+        .arg("80")
+        .arg("--rows")
+        .arg("24")
+        .stdout(Stdio::null())
+        .stderr(Stdio::null())
+        .spawn()
+        .unwrap();
+    let deadline = std::time::Instant::now() + Duration::from_secs(5);
+    while std::time::Instant::now() < deadline {
+        if holder_shell_pid(sessions_dir, session).is_some()
+            && runtime_dir.join("holder.sock").exists()
+        {
+            let _ = launcher.wait();
+            return;
+        }
+        if let Some(status) = launcher.try_wait().unwrap() {
+            panic!("legacy holder launcher exited before ready: {status}");
+        }
+        thread::sleep(Duration::from_millis(20));
+    }
+    let _ = launcher.kill();
+    let _ = launcher.wait();
+    panic!("legacy holder did not become ready");
+}
+
 /// Send one encrypted Input line and give the shell a moment to act.
 fn type_line(socket: &UdpSocket, port: u16, ok: &AttachOk, key: &[u8; 32], seq: u64, line: &str) {
     let input = Input {
@@ -2690,7 +2733,7 @@ fn session_survives_server_restart_same_shell_and_screen() {
 }
 
 #[test]
-fn implicit_session_survives_server_restart_for_same_ticket_holder() {
+fn implicit_session_does_not_create_restart_holder() {
     let dir = tempfile::tempdir().unwrap();
     let sessions_dir = dir.path().join("sessions");
     let port = free_udp_port();
@@ -2713,20 +2756,14 @@ fn implicit_session_survives_server_restart_for_same_ticket_holder() {
 
     let shell_pid_before = holder_shell_pid(&sessions_dir, &session);
     assert!(
-        shell_pid_before.is_some(),
+        shell_pid_before.is_none(),
-        "implicit sessions should get a persistent holder when persistence is enabled"
+        "implicit sessions must not get persistent holders when persistence is enabled"
     );
 
     let _ = server.kill();
     let _ = server.wait();
     thread::sleep(Duration::from_millis(300));
 
-    let pid = shell_pid_before.unwrap();
-    assert!(
-        unsafe { libc::kill(pid, 0) } == 0,
-        "implicit session shell pid {pid} must survive server restart"
-    );
-
     let mut server = start_server(&dir, &config);
     let (socket2, bootstrap2, ok2) = direct_attach_session(&config, port, "read-write", &session);
     let key2 = bootstrap2.session_key;
@@ -2743,15 +2780,44 @@ fn implicit_session_survives_server_restart_for_same_ticket_holder() {
 
     let _ = server.kill();
     let _ = server.wait();
-    kill_holder(&sessions_dir, &session);
 
-    assert_eq!(
+    assert!(
-        shell_pid_after, shell_pid_before,
+        shell_pid_after.is_none(),
-        "implicit session should re-adopt the same shell pid"
+        "implicit restart attach must stay ephemeral"
     );
     assert!(
-        post.contains("IMPLICIT_MARK=implicit_restart_42"),
+        post.contains("IMPLICIT_MARK=") && !post.contains("implicit_restart_42"),
-        "implicit session state must survive restart, got {post:?}"
+        "implicit session must start fresh after server restart, got {post:?}"
+    );
+}
+
+#[test]
+fn startup_discards_legacy_implicit_holders() {
+    let dir = tempfile::tempdir().unwrap();
+    let sessions_dir = dir.path().join("sessions");
+    let port = free_udp_port();
+    let config = write_persistent_server_config(&dir, port);
+    let session = protocol::generate_implicit_session_name();
+
+    spawn_legacy_holder(&sessions_dir, &session);
+    let shell_pid = holder_shell_pid(&sessions_dir, &session).expect("legacy holder shell pid");
+    assert!(
+        unsafe { libc::kill(shell_pid, 0) } == 0,
+        "legacy holder shell must be live before startup"
+    );
+
+    let mut server = start_server(&dir, &config);
+    thread::sleep(Duration::from_millis(300));
+
+    let _ = server.kill();
+    let _ = server.wait();
+    assert!(
+        holder_shell_pid(&sessions_dir, &session).is_none(),
+        "startup must remove old implicit holder metadata"
+    );
+    assert!(
+        unsafe { libc::kill(shell_pid, 0) } != 0,
+        "startup must shut down old implicit holder shell"
     );
 }
 

tests/release_scripts.rs

@@ -18,3 +18,35 @@ fn release_scripts_skip_stale_artifacts_when_auto_discovering() {
     assert!(publish.contains("skipping stale artifact"));
     assert!(publish.contains("actual=\"$(artifact_version \"$artifact\" || true)\""));
 }
+
+#[test]
+fn systemd_service_does_not_sandbox_remote_shells() {
+    let service = include_str!("../packaging/systemd/dosh-server.service");
+    let install = include_str!("../install.sh");
+    for raw in [service, install] {
+        assert!(raw.contains("KillMode=process"));
+        assert!(
+            raw.contains("Restart=always"),
+            "dosh-server should come back after accidental SIGTERM while preserving child shells"
+        );
+        for directive in [
+            "NoNewPrivileges=",
+            "PrivateTmp=",
+            "ProtectSystem=",
+            "ProtectHome=",
+            "RestrictAddressFamilies=",
+            "RestrictRealtime=",
+            "LockPersonality=",
+            "MemoryDenyWriteExecute=",
+        ] {
+            assert!(
+                !raw.contains(directive),
+                "dosh sessions are user shells; systemd sandbox directive {directive} changes terminal/app behavior"
+            );
+        }
+        assert!(
+            !raw.contains("ReadWritePaths="),
+            "remote shells must not be restricted to dosh config/data paths"
+        );
+    }
+}