Prepare Dosh 1.0.0 rc1

Cargo.lock

@@ -436,7 +436,7 @@ dependencies = [
 
 [[package]]
 name = "dosh"
-version = "0.1.15"
+version = "1.0.0-rc1"
 dependencies = [
  "anyhow",
  "base64",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "dosh"
-version = "0.1.15"
+version = "1.0.0-rc1"
 edition = "2024"
 license = "MIT"
 

Makefile

@@ -1,4 +1,4 @@
-.PHONY: build test fmt clippy release-check install package-release package-release-linux package-release-windows publish-release bench-report bench-local bench-local-json bench-docker-ssh bench-docker-mosh fuzz-smoke fuzz-deep soak-local tui-harness
+.PHONY: build test fmt clippy release-check 1.0-check reconnect-check hostile-network-check persistence-check package-check install package-release package-release-linux package-release-windows publish-release bench-report bench-local bench-local-json bench-docker-ssh bench-docker-mosh fuzz-smoke fuzz-deep soak-local tui-harness
 
 build:
 	cargo build --release
@@ -19,6 +19,25 @@ release-check:
 	cargo test
 	$(MAKE) tui-harness
 
+1.0-check: release-check reconnect-check hostile-network-check persistence-check package-check
+
+reconnect-check:
+	cargo test --test integration_smoke resume_updates_udp_endpoint_for_roaming -- --nocapture
+	DOSH_SOAK_SECONDS=$${DOSH_SOAK_SECONDS:-300} cargo test --test integration_smoke sleep_roaming_soak_30m -- --ignored --nocapture
+
+hostile-network-check:
+	cargo test --test hostile_network -- --nocapture
+	DOSH_BADNET_SOAK_SECONDS=$${DOSH_BADNET_SOAK_SECONDS:-300} cargo test --test hostile_network bad_network_tui_work_soak_30m -- --ignored --nocapture
+
+persistence-check:
+	cargo test --test integration_smoke session_survives_server_restart_same_shell_and_screen -- --nocapture
+	cargo test --test integration_smoke multiple_persistent_named_sessions_survive_restart_independently -- --nocapture
+
+package-check:
+	$(MAKE) package-release-linux
+	$(MAKE) package-release-windows
+	sh scripts/verify-release-artifacts.sh
+
 install:
 	sh install.sh --from-current
 

install.sh

@@ -426,7 +426,7 @@ Wants=network-online.target
 [Service]
 Type=simple
 ExecStart=$bindir/dosh-server serve
-Restart=on-failure
+Restart=always
 RestartSec=1
 KillMode=process
 

packaging/systemd/dosh-server.service

@@ -6,7 +6,7 @@ Wants=network-online.target
 [Service]
 Type=simple
 ExecStart=%h/.local/bin/dosh-server serve
-Restart=on-failure
+Restart=always
 RestartSec=1
 KillMode=process
 

scripts/verify-release-artifacts.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env sh
+set -eu
+
+repo_root="$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)"
+cd "$repo_root"
+
+version="$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | sed -n '1p')"
+out_dir="${DOSH_PACKAGE_DIR:-target/dosh-release}"
+
+artifact_version() {
+  artifact="$1"
+  case "$artifact" in
+    *.tar.gz)
+      tar -xOf "$artifact" dosh/VERSION 2>/dev/null | tr -d '\r\n'
+      ;;
+    *.zip)
+      unzip -p "$artifact" dosh/VERSION 2>/dev/null | tr -d '\r\n'
+      ;;
+    *)
+      return 1
+      ;;
+  esac
+}
+
+failed=0
+for artifact in \
+  "$out_dir/dosh-linux-x86_64.tar.gz" \
+  "$out_dir/dosh-macos-aarch64.tar.gz" \
+  "$out_dir/dosh-windows-x86_64.zip"; do
+  if [ ! -f "$artifact" ]; then
+    echo "missing release artifact: $artifact" >&2
+    failed=1
+    continue
+  fi
+  if [ ! -f "$artifact.sha256" ]; then
+    echo "missing release checksum: $artifact.sha256" >&2
+    failed=1
+  fi
+  actual="$(artifact_version "$artifact" || true)"
+  if [ "$actual" != "$version" ]; then
+    echo "artifact version mismatch: $artifact has ${actual:-unknown}, expected $version" >&2
+    failed=1
+  fi
+done
+
+exit "$failed"

src/bin/dosh-client.rs

@@ -3524,6 +3524,60 @@ fn resolve_addr(host: &str, port: u16) -> Result<SocketAddr> {
         .ok_or_else(|| anyhow!("no UDP address resolved for {host}:{port}"))
 }
 
+async fn send_terminal_udp(socket: &UdpSocket, packet: &[u8], addr: SocketAddr) -> Result<bool> {
+    match socket.send_to(packet, addr).await {
+        Ok(_) => Ok(true),
+        Err(err) if is_transient_udp_send_error(&err) => Ok(false),
+        Err(err) => Err(err).with_context(|| format!("send UDP packet to {addr}")),
+    }
+}
+
+fn is_transient_udp_send_error(err: &std::io::Error) -> bool {
+    matches!(
+        err.kind(),
+        std::io::ErrorKind::Interrupted
+            | std::io::ErrorKind::TimedOut
+            | std::io::ErrorKind::WouldBlock
+    ) || err.raw_os_error().is_some_and(is_transient_udp_os_error)
+}
+
+#[cfg(unix)]
+fn is_transient_udp_os_error(code: i32) -> bool {
+    matches!(
+        code,
+        libc::EADDRNOTAVAIL
+            | libc::ECONNREFUSED
+            | libc::ECONNRESET
+            | libc::EHOSTDOWN
+            | libc::EHOSTUNREACH
+            | libc::ENETDOWN
+            | libc::ENETRESET
+            | libc::ENETUNREACH
+            | libc::ETIMEDOUT
+    )
+}
+
+#[cfg(windows)]
+fn is_transient_udp_os_error(code: i32) -> bool {
+    matches!(
+        code,
+        10049  // WSAEADDRNOTAVAIL
+            | 10050 // WSAENETDOWN
+            | 10051 // WSAENETUNREACH
+            | 10052 // WSAENETRESET
+            | 10054 // WSAECONNRESET
+            | 10060 // WSAETIMEDOUT
+            | 10061 // WSAECONNREFUSED
+            | 10064 // WSAEHOSTDOWN
+            | 10065 // WSAEHOSTUNREACH
+    )
+}
+
+#[cfg(not(any(unix, windows)))]
+fn is_transient_udp_os_error(_code: i32) -> bool {
+    false
+}
+
 #[allow(clippy::too_many_arguments)]
 async fn try_native_auth(
     socket: &UdpSocket,
@@ -4337,7 +4391,13 @@ async fn run_terminal(
         && cred.mode != "view-only"
         && !forward_only
     {
-        send_input(&socket, addr, &cred, &mut send_seq, bytes).await?;
+        if !send_input(&socket, addr, &cred, &mut send_seq, bytes.clone()).await? {
+            queue_stale_pending_user_input(
+                &mut pending_user_input,
+                &mut pending_user_input_bytes,
+                bytes,
+            )?;
+        }
         startup_input_hold_until = Some(Instant::now() + STARTUP_INPUT_HOLD);
         startup_gate_mode = StartupGateMode::HoldAll;
     }
@@ -4411,8 +4471,15 @@ async fn run_terminal(
                                 && let Some((send_now, mut hold_for_later)) =
                                     split_after_command_submit(&bytes)
                             {
-                                predictor.observe_input(&send_now)?;
-                                send_input(&socket, addr, &cred, &mut send_seq, send_now).await?;
+                                if send_input(&socket, addr, &cred, &mut send_seq, send_now.clone()).await? {
+                                    predictor.observe_input(&send_now)?;
+                                } else {
+                                    queue_stale_pending_user_input(
+                                        &mut pending_user_input,
+                                        &mut pending_user_input_bytes,
+                                        send_now,
+                                    )?;
+                                }
                                 startup_input_hold_until = Some(
                                     Instant::now()
                                         + post_submit_hold_duration(&hold_for_later),
@@ -4431,15 +4498,23 @@ async fn run_terminal(
                                     )?;
                                     continue;
                                 } else if !hold_for_later.is_empty() {
-                                    predictor.observe_input(&hold_for_later)?;
-                                    send_input(
+                                    let sent = send_input(
                                         &socket,
                                         addr,
                                         &cred,
                                         &mut send_seq,
-                                        std::mem::take(&mut hold_for_later),
+                                        hold_for_later.clone(),
                                     )
                                     .await?;
+                                    if sent {
+                                        predictor.observe_input(&hold_for_later)?;
+                                    } else {
+                                        queue_stale_pending_user_input(
+                                            &mut pending_user_input,
+                                            &mut pending_user_input_bytes,
+                                            std::mem::take(&mut hold_for_later),
+                                        )?;
+                                    }
                                 }
                                 continue;
                             }
@@ -4477,8 +4552,15 @@ async fn run_terminal(
                                     .await?;
                                 }
                             } else {
-                                predictor.observe_input(&bytes)?;
-                                send_input(&socket, addr, &cred, &mut send_seq, bytes).await?;
+                                if send_input(&socket, addr, &cred, &mut send_seq, bytes.clone()).await? {
+                                    predictor.observe_input(&bytes)?;
+                                } else {
+                                    queue_stale_pending_user_input(
+                                        &mut pending_user_input,
+                                        &mut pending_user_input_bytes,
+                                        bytes,
+                                    )?;
+                                }
                             }
                         }
                     }
@@ -4610,6 +4692,22 @@ async fn run_terminal(
                     }
                     PacketKind::Pong => {
                         last_packet_at = Instant::now();
+                        if should_flush_terminal_input_after_contact(
+                            forward_only,
+                            &cred.mode,
+                            pending_user_input.is_empty(),
+                        ) {
+                            flush_pending_user_input(
+                                &socket,
+                                addr,
+                                &cred,
+                                &mut send_seq,
+                                &mut predictor,
+                                &mut pending_user_input,
+                                &mut pending_user_input_bytes,
+                            )
+                            .await?;
+                        }
                     }
                     PacketKind::Rekey => {
                         // Server-initiated transport rekey (spec §11). The Rekey is
@@ -4651,7 +4749,7 @@ async fn run_terminal(
                             CLIENT_TO_SERVER,
                             b"",
                         )?;
-                        socket.send_to(&ack, addr).await?;
+                        let _ = send_terminal_udp(&socket, &ack, addr).await?;
                     }
                     PacketKind::AttachReject => {
                         let reject: AttachReject = protocol::from_body(&packet.body)?;
@@ -5086,7 +5184,7 @@ async fn run_terminal(
                         b"",
                     )?;
                     send_seq += 1;
-                    socket.send_to(&packet, addr).await?;
+                    let _ = send_terminal_udp(&socket, &packet, addr).await?;
                 }
                 // Re-evaluate the prediction display policy on every timer tick so
                 // a latency spike (or recovery) flips speculation on/off promptly
@@ -5400,6 +5498,23 @@ fn queue_pending_user_input_with_filter(
     Ok(())
 }
 
+fn requeue_pending_user_input_front(
+    pending: &mut VecDeque<PendingUserInput>,
+    pending_bytes: &mut usize,
+    input: PendingUserInput,
+) -> Result<()> {
+    let next = pending_bytes
+        .checked_add(input.bytes.len())
+        .ok_or_else(|| anyhow!("pending input buffer overflow"))?;
+    anyhow::ensure!(
+        next <= MAX_PENDING_USER_INPUT_BYTES,
+        "pending input buffer full while disconnected"
+    );
+    *pending_bytes = next;
+    pending.push_front(input);
+    Ok(())
+}
+
 #[derive(Debug, Clone, PartialEq, Eq)]
 struct PendingUserInput {
     bytes: Vec<u8>,
@@ -5439,6 +5554,14 @@ fn should_hold_during_startup_gate(
     mode == StartupGateMode::HoldAll || already_queued || should_hold_post_submit_input(bytes)
 }
 
+fn should_flush_terminal_input_after_contact(
+    forward_only: bool,
+    mode: &str,
+    pending_empty: bool,
+) -> bool {
+    !forward_only && !pending_empty && mode != "view-only" && mode != "forward-only"
+}
+
 async fn flush_pending_user_input(
     socket: &UdpSocket,
     addr: SocketAddr,
@@ -5462,8 +5585,19 @@ async fn flush_pending_user_input(
         if bytes.is_empty() {
             continue;
         }
-        predictor.observe_input(&bytes)?;
-        send_input(socket, addr, cred, send_seq, bytes).await?;
+        if send_input(socket, addr, cred, send_seq, bytes.clone()).await? {
+            predictor.observe_input(&bytes)?;
+        } else {
+            requeue_pending_user_input_front(
+                pending,
+                pending_bytes,
+                PendingUserInput {
+                    bytes,
+                    strip_mouse_reports: false,
+                },
+            )?;
+            break;
+        }
     }
     Ok(())
 }
@@ -5595,7 +5729,7 @@ async fn send_input(
     cred: &CachedCredential,
     send_seq: &mut u64,
     bytes: Vec<u8>,
-) -> Result<()> {
+) -> Result<bool> {
     let body = protocol::to_body(&Input { bytes })?;
     let packet = protocol::encode_encrypted(
         PacketKind::Input,
@@ -5607,8 +5741,7 @@ async fn send_input(
         &body,
     )?;
     *send_seq += 1;
-    socket.send_to(&packet, addr).await?;
-    Ok(())
+    send_terminal_udp(socket, &packet, addr).await
 }
 
 async fn send_stream_open(
@@ -5951,7 +6084,7 @@ async fn send_stream_packet(
         body,
     )?;
     *send_seq += 1;
-    socket.send_to(&packet, addr).await?;
+    let _ = send_terminal_udp(socket, &packet, addr).await?;
     Ok(())
 }
 
@@ -6715,7 +6848,7 @@ async fn send_resize(
         &body,
     )?;
     *send_seq += 1;
-    socket.send_to(&packet, addr).await?;
+    let _ = send_terminal_udp(socket, &packet, addr).await?;
     Ok(())
 }
 
@@ -6735,7 +6868,7 @@ async fn send_ack(
         b"",
     )?;
     *send_seq += 1;
-    socket.send_to(&packet, addr).await?;
+    let _ = send_terminal_udp(socket, &packet, addr).await?;
     Ok(())
 }
 
@@ -6750,7 +6883,7 @@ async fn detach_once(socket: &UdpSocket, cred: &CachedCredential, seq: u64) -> R
         CLIENT_TO_SERVER,
         b"",
     )?;
-    socket.send_to(&packet, addr).await?;
+    let _ = send_terminal_udp(socket, &packet, addr).await?;
     Ok(())
 }
 
@@ -7088,18 +7221,19 @@ mod tests {
         PredictMode, Predictor, RESTART_STATUS_SCRIPT, RemoteForward, STARTUP_INPUT_HOLD,
         SshConfig, StartupGateMode, StatusAction, auth_allows, cache_key, cache_server_prefix,
         clear_cached_credentials, ensure_tui_safe_status_overlay, input_matches_escape,
-        is_local_status_target, is_resume_response_for_client, latest_release_download_url,
-        load_first_native_identity_with_prompt, parse_dynamic_forward, parse_escape_key,
-        parse_local_forward, parse_remote_forward, parse_ssh_config, post_submit_hold_duration,
-        queue_pending_user_input, raw_contains_host_table, recv_response_until, refresh_live_addr,
-        release_tag_download_url, release_tag_from_effective_url, release_version_from_tag,
-        render_status_clear, render_status_overlay, requested_env, resolved_startup_command,
-        retransmit_stream_opens, rewrite_forward_command, selected_predict_mode, selected_udp_host,
-        server_version_mismatch, should_hold_during_startup_gate, should_hold_post_submit_input,
-        split_after_command_submit, ssh_destination_host, ssh_username, ssh_with_user,
-        startup_command, status_ssh_target, strip_stale_mouse_reports, toml_bare_key_or_quoted,
-        update_check_requested, update_version_status, upsert_managed_block, valid_forward_host,
-        vscode_safe_alias,
+        is_local_status_target, is_resume_response_for_client, is_transient_udp_os_error,
+        latest_release_download_url, load_first_native_identity_with_prompt, parse_dynamic_forward,
+        parse_escape_key, parse_local_forward, parse_remote_forward, parse_ssh_config,
+        post_submit_hold_duration, queue_pending_user_input, raw_contains_host_table,
+        recv_response_until, refresh_live_addr, release_tag_download_url,
+        release_tag_from_effective_url, release_version_from_tag, render_status_clear,
+        render_status_overlay, requested_env, resolved_startup_command, retransmit_stream_opens,
+        rewrite_forward_command, selected_predict_mode, selected_udp_host, server_version_mismatch,
+        should_flush_terminal_input_after_contact, should_hold_during_startup_gate,
+        should_hold_post_submit_input, split_after_command_submit, ssh_destination_host,
+        ssh_username, ssh_with_user, startup_command, status_ssh_target, strip_stale_mouse_reports,
+        toml_bare_key_or_quoted, update_check_requested, update_version_status,
+        upsert_managed_block, valid_forward_host, vscode_safe_alias,
     };
     use dosh::config::{ClientConfig, CommandExtension, HostConfig};
     use dosh::native::EnvVar;
@@ -7879,6 +8013,34 @@ mod tests {
         assert_eq!(post_submit_hold_duration(b"x"), POST_SUBMIT_ALL_INPUT_HOLD);
     }
 
+    #[test]
+    fn contact_flushes_pending_terminal_input_for_interactive_sessions() {
+        assert!(should_flush_terminal_input_after_contact(
+            false, "normal", false
+        ));
+        assert!(should_flush_terminal_input_after_contact(
+            false,
+            "read-write",
+            false
+        ));
+        assert!(!should_flush_terminal_input_after_contact(
+            false, "normal", true
+        ));
+        assert!(!should_flush_terminal_input_after_contact(
+            true, "normal", false
+        ));
+        assert!(!should_flush_terminal_input_after_contact(
+            false,
+            "view-only",
+            false
+        ));
+        assert!(!should_flush_terminal_input_after_contact(
+            false,
+            "forward-only",
+            false
+        ));
+    }
+
     #[test]
     fn reconnect_refreshes_live_send_address_from_credentials() {
         let mut addr = "127.0.0.1:50000".parse().unwrap();
@@ -8301,6 +8463,25 @@ mod tests {
         assert_eq!(pending_bytes, MAX_PENDING_USER_INPUT_BYTES);
     }
 
+    #[test]
+    fn transient_udp_send_errors_are_not_terminal_fatal() {
+        #[cfg(unix)]
+        {
+            assert!(is_transient_udp_os_error(libc::ENETUNREACH));
+            assert!(is_transient_udp_os_error(libc::EHOSTUNREACH));
+            assert!(is_transient_udp_os_error(libc::EADDRNOTAVAIL));
+            assert!(!is_transient_udp_os_error(libc::EINVAL));
+        }
+
+        #[cfg(windows)]
+        {
+            assert!(is_transient_udp_os_error(10051)); // WSAENETUNREACH
+            assert!(is_transient_udp_os_error(10065)); // WSAEHOSTUNREACH
+            assert!(is_transient_udp_os_error(10049)); // WSAEADDRNOTAVAIL
+            assert!(!is_transient_udp_os_error(10022)); // WSAEINVAL
+        }
+    }
+
     #[test]
     fn stale_mouse_reports_are_stripped_from_pending_input() {
         let input = b"\x1b[<35;152;1Mhello\x1b[<0;107;10m";

tests/hostile_network.rs

@@ -258,7 +258,8 @@ fn relay_loop(
     let mut upstream = new_upstream();
     let mut client_addr: Option<SocketAddr> = None;
     let mut rng = StdRng::seed_from_u64(seed);
-    let mut held: Option<(Vec<u8>, bool)> = None; // (packet, is_c2s) held for reorder
+    let mut held_c2s: Option<Vec<u8>> = None;
+    let mut held_s2c: Option<Vec<u8>> = None;
     let mut buf = [0u8; 65535];
 
     loop {
@@ -288,10 +289,9 @@ fn relay_loop(
                         &upstream,
                         server_addr,
                         packet,
-                        true,
                         &controls,
                         &mut rng,
-                        &mut held,
+                        &mut held_c2s,
                     );
                 }
             }
@@ -310,7 +310,12 @@ fn relay_loop(
                     let drop_pct = controls.drop_s2c_percent.load(Ordering::SeqCst);
                     if drop_pct == 0 || rng.gen_range(0..100) >= drop_pct {
                         forward_with_effects(
-                            &front, dst, packet, false, &controls, &mut rng, &mut held,
+                            &front,
+                            dst,
+                            packet,
+                            &controls,
+                            &mut rng,
+                            &mut held_s2c,
                         );
                     }
                 }
@@ -336,23 +341,22 @@ fn forward_with_effects(
     out: &UdpSocket,
     dst: SocketAddr,
     packet: Vec<u8>,
-    is_c2s: bool,
     controls: &RelayControls,
     rng: &mut StdRng,
-    held: &mut Option<(Vec<u8>, bool)>,
+    held: &mut Option<Vec<u8>>,
 ) {
     // Reorder: if armed, hold this packet and release the previously held one
     // afterward (so two consecutive packets swap order).
     if controls.reorder_next.swap(false, Ordering::SeqCst) {
-        if let Some((prev, _)) = held.take() {
+        if let Some(prev) = held.take() {
             let _ = out.send_to(&packet, dst);
             let _ = out.send_to(&prev, dst);
             return;
         }
-        *held = Some((packet, is_c2s));
+        *held = Some(packet);
         return;
     }
-    if let Some((prev, _)) = held.take() {
+    if let Some(prev) = held.take() {
         let _ = out.send_to(&prev, dst);
     }
 
@@ -767,6 +771,46 @@ fn wait_for_text(socket: &UdpSocket, key: &[u8; 32], needle: &str, millis: u64)
     acc.contains(needle)
 }
 
+fn wait_for_text_with_ack(
+    socket: &UdpSocket,
+    relay: &Relay,
+    client_id: [u8; 16],
+    seq: &mut u64,
+    key: &[u8; 32],
+    needle: &str,
+    millis: u64,
+) -> bool {
+    let prev = socket.read_timeout().unwrap();
+    socket
+        .set_read_timeout(Some(Duration::from_millis(100)))
+        .unwrap();
+    let deadline = Instant::now() + Duration::from_millis(millis);
+    let mut acc = String::new();
+    while Instant::now() < deadline {
+        if let Some((_header, frame)) = recv_frame(socket, key) {
+            acc.push_str(&String::from_utf8_lossy(&frame.bytes));
+            let ack = protocol::encode_encrypted(
+                PacketKind::Ack,
+                client_id,
+                *seq,
+                frame.output_seq,
+                key,
+                CLIENT_TO_SERVER,
+                b"",
+            )
+            .unwrap();
+            *seq += 1;
+            socket.send_to(&ack, relay.front_addr()).unwrap();
+            if acc.contains(needle) {
+                socket.set_read_timeout(prev).unwrap();
+                return true;
+            }
+        }
+    }
+    socket.set_read_timeout(prev).unwrap();
+    acc.contains(needle)
+}
+
 #[test]
 fn session_survives_packet_loss_and_reorder() {
     let dir = tempfile::tempdir().unwrap();
@@ -820,6 +864,94 @@ fn session_survives_packet_loss_and_reorder() {
     );
 }
 
+#[test]
+#[ignore = "30-minute hostile-network TUI soak; run with `DOSH_BADNET_SOAK_SECONDS=1800 cargo test --test hostile_network bad_network_tui_work_soak_30m -- --ignored --nocapture`"]
+fn bad_network_tui_work_soak_30m() {
+    let soak_secs = std::env::var("DOSH_BADNET_SOAK_SECONDS")
+        .ok()
+        .and_then(|value| value.parse::<u64>().ok())
+        .unwrap_or(30 * 60);
+    let dir = tempfile::tempdir().unwrap();
+    let port = free_udp_port();
+    let config = write_server_config(&dir, port);
+    let mut server = start_server(&dir, &config);
+    let relay = Relay::spawn(port, 0xBADC0DEu64);
+    let (socket, bootstrap, ok) = attach_through_relay(&config, &relay);
+
+    relay.set_drop_c2s(15);
+    relay.set_drop_s2c(20);
+    relay.set_dup(10);
+
+    let deadline = Instant::now() + Duration::from_secs(soak_secs);
+    let mut seq = 2u64;
+    let mut iteration = 0u64;
+    while Instant::now() < deadline {
+        if iteration.is_multiple_of(2) {
+            relay.arm_reorder();
+        }
+        if iteration > 0 && iteration.is_multiple_of(7) {
+            let _ = relay.rebind_upstream();
+        }
+        if iteration > 0 && iteration.is_multiple_of(11) {
+            relay.set_drop_s2c(100);
+            thread::sleep(Duration::from_millis(750));
+            relay.set_drop_s2c(20);
+        }
+
+        let marker = format!("DOSH_BADNET_TUI_{iteration}");
+        let command = format!(
+            "stty -echo; \
+             printf '\\033[?1049h\\033[?2026h\\033[?25l'; \
+             for i in 1 2 3 4 5 6; do \
+               printf '\\033[%s;4H{} ⠀⠁⠃⠇⡇⣇⣧⣷⣿ █▇▆▅▄▃▂▁ %s\\033[0m' \"$i\" \"$i\"; \
+             done; \
+             printf '\\033[?25h\\033[?2026l\\033[?1049l'\n",
+            marker
+        );
+
+        let step_deadline = Instant::now() + Duration::from_secs(8);
+        let mut seen = false;
+        let mut attempts = 0;
+        while Instant::now() < step_deadline && attempts < 12 {
+            send_input(
+                &socket,
+                &relay,
+                ok.client_id,
+                seq,
+                0,
+                &bootstrap.session_key,
+                command.as_bytes(),
+            );
+            seq += 1;
+            attempts += 1;
+            if wait_for_text_with_ack(
+                &socket,
+                &relay,
+                ok.client_id,
+                &mut seq,
+                &bootstrap.session_key,
+                &marker,
+                500,
+            ) {
+                seen = true;
+                break;
+            }
+        }
+        assert!(
+            seen,
+            "TUI marker {marker} did not arrive during hostile-network soak"
+        );
+
+        iteration += 1;
+        thread::sleep(Duration::from_millis(500));
+    }
+
+    relay.clear_impairments();
+    drop(relay);
+    let _ = server.kill();
+    let _ = server.wait();
+}
+
 #[test]
 fn duplicated_and_replayed_input_is_applied_at_most_once() {
     let dir = tempfile::tempdir().unwrap();

tests/release_scripts.rs

@@ -25,6 +25,10 @@ fn systemd_service_does_not_sandbox_remote_shells() {
     let install = include_str!("../install.sh");
     for raw in [service, install] {
         assert!(raw.contains("KillMode=process"));
+        assert!(
+            raw.contains("Restart=always"),
+            "dosh-server should come back after accidental SIGTERM while preserving child shells"
+        );
         for directive in [
             "NoNewPrivileges=",
             "PrivateTmp=",