Bump version to 1.0.0-rc15

Cargo.lock

@@ -436,7 +436,7 @@ dependencies = [
 
 [[package]]
 name = "dosh"
-version = "1.0.0-rc11"
+version = "1.0.0-rc15"
 dependencies = [
  "anyhow",
  "base64",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "dosh"
-version = "1.0.0-rc11"
+version = "1.0.0-rc15"
 edition = "2024"
 license = "MIT"
 

src/bin/dosh-client.rs

@@ -61,6 +61,7 @@ use tokio::net::{TcpListener, TcpStream, UdpSocket};
 use tokio::sync::mpsc;
 
 const STREAM_INITIAL_WINDOW: usize = 1024 * 1024;
+const STREAM_RETIRED_TOMBSTONES: usize = 16 * 1024;
 const MAX_PENDING_USER_INPUT_BYTES: usize = 1024 * 1024;
 const STARTUP_INPUT_HOLD: Duration = Duration::from_millis(750);
 const POST_SUBMIT_ALL_INPUT_HOLD: Duration = Duration::from_millis(120);
@@ -4335,6 +4336,8 @@ async fn run_terminal(
     let mut stream_sent_data: HashMap<u64, BTreeMap<u64, PendingStreamChunk>> = HashMap::new();
     let mut stream_next_recv_offset: HashMap<u64, u64> = HashMap::new();
     let mut stream_recv_pending: HashMap<u64, BTreeMap<u64, Vec<u8>>> = HashMap::new();
+    let mut stream_retired: HashSet<u64> = HashSet::new();
+    let mut stream_retired_order: VecDeque<u64> = VecDeque::new();
     let mut pending_user_input: VecDeque<PendingUserInput> = VecDeque::new();
     let mut pending_user_input_bytes = 0usize;
     let mut startup_input_hold_until: Option<Instant> = None;
@@ -4827,6 +4830,18 @@ async fn run_terminal(
                             continue;
                         };
                         last_packet_at = Instant::now();
+                        if stream_retired.contains(&open.stream_id) {
+                            send_stream_open_reject(
+                                &socket,
+                                addr,
+                                &cred,
+                                &mut send_seq,
+                                open.stream_id,
+                                "stream closed".to_string(),
+                            )
+                            .await?;
+                            continue;
+                        }
                         if opened_streams.contains(&open.stream_id) {
                             send_stream_open_ok(
                                 &socket,
@@ -4986,7 +5001,9 @@ async fn run_terminal(
                             continue;
                         };
                         last_packet_at = Instant::now();
-                        stream_pending_opens.remove(&ok.stream_id);
+                        if stream_pending_opens.remove(&ok.stream_id).is_none() {
+                            continue;
+                        }
                         opened_streams.insert(ok.stream_id);
                         stream_send_credit.entry(ok.stream_id).or_insert(STREAM_INITIAL_WINDOW);
                         stream_next_send_offset.entry(ok.stream_id).or_insert(0);
@@ -5022,13 +5039,19 @@ async fn run_terminal(
                         {
                             let _ = writer.write_all(&[5, 5, 0, 1, 0, 0, 0, 0, 0, 0]).await;
                         }
-                        opened_streams.remove(&reject.stream_id);
-                        stream_send_credit.remove(&reject.stream_id);
-                        stream_pending_data.remove(&reject.stream_id);
-                        stream_next_send_offset.remove(&reject.stream_id);
-                        stream_sent_data.remove(&reject.stream_id);
-                        stream_next_recv_offset.remove(&reject.stream_id);
-                        stream_recv_pending.remove(&reject.stream_id);
+                        retire_stream_state(
+                            reject.stream_id,
+                            &mut opened_streams,
+                            &mut stream_send_credit,
+                            &mut stream_pending_data,
+                            &mut stream_pending_opens,
+                            &mut stream_next_send_offset,
+                            &mut stream_sent_data,
+                            &mut stream_next_recv_offset,
+                            &mut stream_recv_pending,
+                            &mut stream_retired,
+                            &mut stream_retired_order,
+                        );
                         stream_writers.remove(&reject.stream_id);
                     }
                     PacketKind::StreamData => {
@@ -5040,6 +5063,9 @@ async fn run_terminal(
                         };
                         last_packet_at = Instant::now();
                         let stream_id = data.stream_id;
+                        if !opened_streams.contains(&stream_id) {
+                            continue;
+                        }
                         let (writes, consumed, received_offset) =
                             accept_stream_data(&mut stream_next_recv_offset, &mut stream_recv_pending, data);
                         if let Some(writer) = stream_writers.get_mut(&stream_id) {
@@ -5074,6 +5100,9 @@ async fn run_terminal(
                             continue;
                         };
                         last_packet_at = Instant::now();
+                        if !opened_streams.contains(&adjust.stream_id) {
+                            continue;
+                        }
                         ack_stream_data(
                             &mut stream_sent_data,
                             &mut stream_send_credit,
@@ -5101,14 +5130,19 @@ async fn run_terminal(
                         };
                         last_packet_at = Instant::now();
                         pending_socks_replies.remove(&close.stream_id);
-                        stream_pending_opens.remove(&close.stream_id);
-                        opened_streams.remove(&close.stream_id);
-                        stream_send_credit.remove(&close.stream_id);
-                        stream_pending_data.remove(&close.stream_id);
-                        stream_next_send_offset.remove(&close.stream_id);
-                        stream_sent_data.remove(&close.stream_id);
-                        stream_next_recv_offset.remove(&close.stream_id);
-                        stream_recv_pending.remove(&close.stream_id);
+                        retire_stream_state(
+                            close.stream_id,
+                            &mut opened_streams,
+                            &mut stream_send_credit,
+                            &mut stream_pending_data,
+                            &mut stream_pending_opens,
+                            &mut stream_next_send_offset,
+                            &mut stream_sent_data,
+                            &mut stream_next_recv_offset,
+                            &mut stream_recv_pending,
+                            &mut stream_retired,
+                            &mut stream_retired_order,
+                        );
                         stream_writers.remove(&close.stream_id);
                         #[cfg(unix)]
                         agent_writers.remove(&close.stream_id);
@@ -5160,14 +5194,19 @@ async fn run_terminal(
                     }
                     Some(ForwardEvent::Close { stream_id }) => {
                         pending_socks_replies.remove(&stream_id);
-                        stream_pending_opens.remove(&stream_id);
-                        opened_streams.remove(&stream_id);
-                        stream_send_credit.remove(&stream_id);
-                        stream_pending_data.remove(&stream_id);
-                        stream_next_send_offset.remove(&stream_id);
-                        stream_sent_data.remove(&stream_id);
-                        stream_next_recv_offset.remove(&stream_id);
-                        stream_recv_pending.remove(&stream_id);
+                        retire_stream_state(
+                            stream_id,
+                            &mut opened_streams,
+                            &mut stream_send_credit,
+                            &mut stream_pending_data,
+                            &mut stream_pending_opens,
+                            &mut stream_next_send_offset,
+                            &mut stream_sent_data,
+                            &mut stream_next_recv_offset,
+                            &mut stream_recv_pending,
+                            &mut stream_retired,
+                            &mut stream_retired_order,
+                        );
                         stream_writers.remove(&stream_id);
                         #[cfg(unix)]
                         agent_writers.remove(&stream_id);
@@ -5764,6 +5803,7 @@ fn stale_mouse_report_len(bytes: &[u8], offset: usize) -> Option<usize> {
         },
         byte if byte.is_ascii_digit() => mouse_report_params_len(bytes, offset, 1)
             .or_else(|| orphan_mouse_suffix_len(bytes, offset)),
+        b'M' | b'm' if offset == 0 => orphan_leading_mouse_terminator_len(bytes, offset),
         _ => None,
     }
 }
@@ -5800,6 +5840,13 @@ fn orphan_mouse_suffix_len(bytes: &[u8], offset: usize) -> Option<usize> {
     None
 }
 
+fn orphan_leading_mouse_terminator_len(bytes: &[u8], offset: usize) -> Option<usize> {
+    if offset != 0 || !matches!(bytes.get(offset), Some(b'M' | b'm')) {
+        return None;
+    }
+    mouse_report_params_len(bytes, offset + 1, 1).map(|len| len + 1)
+}
+
 fn stale_mouse_report_maybe_incomplete(bytes: &[u8], offset: usize) -> bool {
     let Some(rest) = bytes.get(offset..) else {
         return false;
@@ -6140,6 +6187,99 @@ fn accept_stream_data(
     (writes, consumed, *expected)
 }
 
+#[allow(clippy::too_many_arguments)]
+fn cleanup_stream_state(
+    stream_id: u64,
+    opened_streams: &mut HashSet<u64>,
+    stream_send_credit: &mut HashMap<u64, usize>,
+    stream_pending_data: &mut HashMap<u64, VecDeque<Vec<u8>>>,
+    stream_pending_opens: &mut HashMap<u64, PendingStreamOpen>,
+    stream_next_send_offset: &mut HashMap<u64, u64>,
+    stream_sent_data: &mut HashMap<u64, BTreeMap<u64, PendingStreamChunk>>,
+    stream_next_recv_offset: &mut HashMap<u64, u64>,
+    stream_recv_pending: &mut HashMap<u64, BTreeMap<u64, Vec<u8>>>,
+) {
+    opened_streams.remove(&stream_id);
+    stream_send_credit.remove(&stream_id);
+    stream_pending_data.remove(&stream_id);
+    stream_pending_opens.remove(&stream_id);
+    stream_next_send_offset.remove(&stream_id);
+    stream_sent_data.remove(&stream_id);
+    stream_next_recv_offset.remove(&stream_id);
+    stream_recv_pending.remove(&stream_id);
+}
+
+#[allow(clippy::too_many_arguments)]
+fn stream_state_exists(
+    stream_id: u64,
+    opened_streams: &HashSet<u64>,
+    stream_send_credit: &HashMap<u64, usize>,
+    stream_pending_data: &HashMap<u64, VecDeque<Vec<u8>>>,
+    stream_pending_opens: &HashMap<u64, PendingStreamOpen>,
+    stream_next_send_offset: &HashMap<u64, u64>,
+    stream_sent_data: &HashMap<u64, BTreeMap<u64, PendingStreamChunk>>,
+    stream_next_recv_offset: &HashMap<u64, u64>,
+    stream_recv_pending: &HashMap<u64, BTreeMap<u64, Vec<u8>>>,
+) -> bool {
+    opened_streams.contains(&stream_id)
+        || stream_send_credit.contains_key(&stream_id)
+        || stream_pending_data.contains_key(&stream_id)
+        || stream_pending_opens.contains_key(&stream_id)
+        || stream_next_send_offset.contains_key(&stream_id)
+        || stream_sent_data.contains_key(&stream_id)
+        || stream_next_recv_offset.contains_key(&stream_id)
+        || stream_recv_pending.contains_key(&stream_id)
+}
+
+#[allow(clippy::too_many_arguments)]
+fn retire_stream_state(
+    stream_id: u64,
+    opened_streams: &mut HashSet<u64>,
+    stream_send_credit: &mut HashMap<u64, usize>,
+    stream_pending_data: &mut HashMap<u64, VecDeque<Vec<u8>>>,
+    stream_pending_opens: &mut HashMap<u64, PendingStreamOpen>,
+    stream_next_send_offset: &mut HashMap<u64, u64>,
+    stream_sent_data: &mut HashMap<u64, BTreeMap<u64, PendingStreamChunk>>,
+    stream_next_recv_offset: &mut HashMap<u64, u64>,
+    stream_recv_pending: &mut HashMap<u64, BTreeMap<u64, Vec<u8>>>,
+    stream_retired: &mut HashSet<u64>,
+    stream_retired_order: &mut VecDeque<u64>,
+) {
+    let had_state = stream_state_exists(
+        stream_id,
+        opened_streams,
+        stream_send_credit,
+        stream_pending_data,
+        stream_pending_opens,
+        stream_next_send_offset,
+        stream_sent_data,
+        stream_next_recv_offset,
+        stream_recv_pending,
+    );
+    cleanup_stream_state(
+        stream_id,
+        opened_streams,
+        stream_send_credit,
+        stream_pending_data,
+        stream_pending_opens,
+        stream_next_send_offset,
+        stream_sent_data,
+        stream_next_recv_offset,
+        stream_recv_pending,
+    );
+    if !had_state || STREAM_RETIRED_TOMBSTONES == 0 {
+        return;
+    }
+    if stream_retired.insert(stream_id) {
+        stream_retired_order.push_back(stream_id);
+    }
+    while stream_retired_order.len() > STREAM_RETIRED_TOMBSTONES {
+        if let Some(expired) = stream_retired_order.pop_front() {
+            stream_retired.remove(&expired);
+        }
+    }
+}
+
 fn ack_stream_data(
     stream_sent_data: &mut HashMap<u64, BTreeMap<u64, PendingStreamChunk>>,
     stream_send_credit: &mut HashMap<u64, usize>,
@@ -6927,8 +7067,8 @@ fn contains_bytes(haystack: &[u8], needle: &[u8]) -> bool {
         .any(|window| window == needle)
 }
 
-const FRAME_GAP_RESYNC_AFTER_MS: u64 = 2_500;
-const FRAME_GAP_RESYNC_COOLDOWN_MS: u64 = 5_000;
+const FRAME_GAP_RESYNC_AFTER_MS: u64 = 250;
+const FRAME_GAP_RESYNC_COOLDOWN_MS: u64 = 1_000;
 const FRAME_GAP_PENDING_RESYNC_THRESHOLD: usize = 128;
 
 #[derive(Default)]
@@ -7425,14 +7565,15 @@ mod tests {
         FRAME_GAP_RESYNC_AFTER_MS, FrameBuffer, LocalForward, MAX_PENDING_USER_INPUT_BYTES,
         POST_SUBMIT_ALL_INPUT_HOLD, PendingStreamOpen, PredictMode, Predictor,
         RESTART_STATUS_SCRIPT, RemoteForward, STARTUP_INPUT_HOLD, SshConfig, StartupGateMode,
-        StatusAction, auth_allows, cache_key, cache_server_prefix, clear_cached_credentials,
-        ensure_tui_safe_status_overlay, input_contains_focus_in, input_matches_escape,
-        is_local_status_target, is_resume_response_for_client, latest_release_download_url,
-        load_first_native_identity_with_prompt, parse_dynamic_forward, parse_escape_key,
-        parse_local_forward, parse_remote_forward, parse_ssh_config, post_submit_hold_duration,
-        queue_pending_user_input, raw_contains_host_table, recv_response_until, refresh_live_addr,
-        release_tag_download_url, release_tag_from_effective_url, release_version_from_tag,
-        render_status_clear, render_status_overlay, requested_env, resolved_startup_command,
+        StatusAction, auth_allows, cache_key, cache_server_prefix, cleanup_stream_state,
+        clear_cached_credentials, ensure_tui_safe_status_overlay, input_contains_focus_in,
+        input_matches_escape, is_local_status_target, is_resume_response_for_client,
+        latest_release_download_url, load_first_native_identity_with_prompt, parse_dynamic_forward,
+        parse_escape_key, parse_local_forward, parse_remote_forward, parse_ssh_config,
+        post_submit_hold_duration, queue_pending_user_input, raw_contains_host_table,
+        recv_response_until, refresh_live_addr, release_tag_download_url,
+        release_tag_from_effective_url, release_version_from_tag, render_status_clear,
+        render_status_overlay, requested_env, resolved_startup_command, retire_stream_state,
         retransmit_stream_opens, rewrite_forward_command, selected_predict_mode, selected_udp_host,
         server_version_mismatch, should_flush_terminal_input_after_contact,
         should_hold_during_startup_gate, should_hold_post_submit_input,
@@ -7447,7 +7588,7 @@ mod tests {
     use dosh::protocol::{self, Frame, PacketKind};
     use dosh::udp::is_transient_udp_send_error;
     use ed25519_dalek::{SigningKey, VerifyingKey};
-    use std::collections::{HashMap, VecDeque};
+    use std::collections::{BTreeMap, HashMap, HashSet, VecDeque};
     use std::fs;
     use std::time::{Duration, Instant};
 
@@ -7493,6 +7634,148 @@ mod tests {
         assert_eq!(vscode_safe_alias(":///"), "host");
     }
 
+    #[test]
+    fn cleanup_stream_state_removes_all_per_stream_state_only_for_target() {
+        let stream_id = 42;
+        let other_stream_id = 43;
+        let mut opened_streams = std::collections::HashSet::from([stream_id, other_stream_id]);
+        let mut stream_send_credit = HashMap::from([(stream_id, 12), (other_stream_id, 34)]);
+        let mut stream_pending_data = HashMap::from([
+            (stream_id, VecDeque::from([vec![1]])),
+            (other_stream_id, VecDeque::from([vec![2]])),
+        ]);
+        let mut stream_pending_opens = HashMap::from([
+            (
+                stream_id,
+                PendingStreamOpen {
+                    target_host: "127.0.0.1".to_string(),
+                    target_port: 1234,
+                    last_sent: Instant::now(),
+                    attempts: 1,
+                },
+            ),
+            (
+                other_stream_id,
+                PendingStreamOpen {
+                    target_host: "127.0.0.1".to_string(),
+                    target_port: 1235,
+                    last_sent: Instant::now(),
+                    attempts: 1,
+                },
+            ),
+        ]);
+        let mut stream_next_send_offset = HashMap::from([(stream_id, 55), (other_stream_id, 66)]);
+        let mut stream_sent_data = HashMap::from([
+            (
+                stream_id,
+                BTreeMap::from([(
+                    0,
+                    super::PendingStreamChunk {
+                        offset: 0,
+                        bytes: vec![3],
+                        last_sent: Instant::now(),
+                        attempts: 1,
+                    },
+                )]),
+            ),
+            (
+                other_stream_id,
+                BTreeMap::from([(
+                    0,
+                    super::PendingStreamChunk {
+                        offset: 0,
+                        bytes: vec![4],
+                        last_sent: Instant::now(),
+                        attempts: 1,
+                    },
+                )]),
+            ),
+        ]);
+        let mut stream_next_recv_offset = HashMap::from([(stream_id, 77), (other_stream_id, 88)]);
+        let mut stream_recv_pending = HashMap::from([
+            (stream_id, BTreeMap::from([(77, vec![5])])),
+            (other_stream_id, BTreeMap::from([(88, vec![6])])),
+        ]);
+
+        cleanup_stream_state(
+            stream_id,
+            &mut opened_streams,
+            &mut stream_send_credit,
+            &mut stream_pending_data,
+            &mut stream_pending_opens,
+            &mut stream_next_send_offset,
+            &mut stream_sent_data,
+            &mut stream_next_recv_offset,
+            &mut stream_recv_pending,
+        );
+
+        assert!(!opened_streams.contains(&stream_id));
+        assert!(!stream_send_credit.contains_key(&stream_id));
+        assert!(!stream_pending_data.contains_key(&stream_id));
+        assert!(!stream_pending_opens.contains_key(&stream_id));
+        assert!(!stream_next_send_offset.contains_key(&stream_id));
+        assert!(!stream_sent_data.contains_key(&stream_id));
+        assert!(!stream_next_recv_offset.contains_key(&stream_id));
+        assert!(!stream_recv_pending.contains_key(&stream_id));
+
+        assert!(opened_streams.contains(&other_stream_id));
+        assert!(stream_send_credit.contains_key(&other_stream_id));
+        assert!(stream_pending_data.contains_key(&other_stream_id));
+        assert!(stream_pending_opens.contains_key(&other_stream_id));
+        assert!(stream_next_send_offset.contains_key(&other_stream_id));
+        assert!(stream_sent_data.contains_key(&other_stream_id));
+        assert!(stream_next_recv_offset.contains_key(&other_stream_id));
+        assert!(stream_recv_pending.contains_key(&other_stream_id));
+    }
+
+    #[test]
+    fn retire_stream_state_tombstones_only_real_stream_state() {
+        let stream_id = 42;
+        let mut opened_streams = HashSet::from([stream_id]);
+        let mut stream_send_credit = HashMap::from([(stream_id, 12)]);
+        let mut stream_pending_data = HashMap::new();
+        let mut stream_pending_opens = HashMap::new();
+        let mut stream_next_send_offset = HashMap::new();
+        let mut stream_sent_data = HashMap::new();
+        let mut stream_next_recv_offset = HashMap::new();
+        let mut stream_recv_pending = HashMap::new();
+        let mut stream_retired = HashSet::new();
+        let mut stream_retired_order = VecDeque::new();
+
+        retire_stream_state(
+            stream_id,
+            &mut opened_streams,
+            &mut stream_send_credit,
+            &mut stream_pending_data,
+            &mut stream_pending_opens,
+            &mut stream_next_send_offset,
+            &mut stream_sent_data,
+            &mut stream_next_recv_offset,
+            &mut stream_recv_pending,
+            &mut stream_retired,
+            &mut stream_retired_order,
+        );
+        retire_stream_state(
+            99,
+            &mut opened_streams,
+            &mut stream_send_credit,
+            &mut stream_pending_data,
+            &mut stream_pending_opens,
+            &mut stream_next_send_offset,
+            &mut stream_sent_data,
+            &mut stream_next_recv_offset,
+            &mut stream_recv_pending,
+            &mut stream_retired,
+            &mut stream_retired_order,
+        );
+
+        assert!(!opened_streams.contains(&stream_id));
+        assert!(!stream_send_credit.contains_key(&stream_id));
+        assert!(stream_retired.contains(&stream_id));
+        assert!(!stream_retired.contains(&99));
+        assert_eq!(stream_retired_order, VecDeque::from([stream_id]));
+    }
+
     #[test]
     fn managed_ssh_block_is_replaced_not_duplicated() {
         let dir = tempfile::tempdir().unwrap();
@@ -8780,11 +9063,18 @@ mod tests {
         assert_eq!(strip_stale_mouse_reports(b"10m"), b"");
     }
 
+    #[test]
+    fn leading_mouse_terminator_from_split_report_is_stripped() {
+        assert_eq!(strip_stale_mouse_reports(b"M35;149;1Mls\r"), b"ls\r");
+        assert_eq!(strip_stale_mouse_reports(b"m35;149;1Mls\r"), b"ls\r");
+    }
+
     #[test]
     fn numeric_semicolon_input_survives_stale_filter() {
         assert_eq!(strip_stale_mouse_reports(b"123;"), b"123;");
         assert_eq!(strip_stale_mouse_reports(b"12;34"), b"12;34");
         assert_eq!(strip_stale_mouse_reports(b"echo 1;"), b"echo 1;");
+        assert_eq!(strip_stale_mouse_reports(b"make test"), b"make test");
     }
 
     #[test]

src/bin/dosh-server.rs

@@ -47,6 +47,7 @@ use tokio::process::Command as TokioCommand;
 use tokio::sync::mpsc;
 
 const STREAM_INITIAL_WINDOW: usize = 1024 * 1024;
+const STREAM_RETIRED_TOMBSTONES: usize = 16 * 1024;
 
 /// Persist a persistent session's screen to disk after this many bytes of output
 /// have accumulated since the last mirror. Keeps the atomic write off the
@@ -399,6 +400,8 @@ struct ClientState {
     stream_sent_data: HashMap<u64, BTreeMap<u64, PendingStreamChunk>>,
     stream_next_recv_offset: HashMap<u64, u64>,
     stream_recv_pending: HashMap<u64, BTreeMap<u64, Vec<u8>>>,
+    stream_retired: HashSet<u64>,
+    stream_retired_order: VecDeque<u64>,
     /// Current transport key epoch (0 = original handshake key). Bumped on rekey.
     epoch: u64,
     /// When the current epoch began, for the wall-clock rekey trigger.
@@ -1201,6 +1204,8 @@ async fn handle_native_user_auth(
                     stream_sent_data: HashMap::new(),
                     stream_next_recv_offset: HashMap::new(),
                     stream_recv_pending: HashMap::new(),
+                    stream_retired: HashSet::new(),
+                    stream_retired_order: VecDeque::new(),
                     epoch: 0,
                     epoch_started: Instant::now(),
                     epoch_packets: 0,
@@ -1348,6 +1353,8 @@ async fn handle_bootstrap_attach(
                     stream_sent_data: HashMap::new(),
                     stream_next_recv_offset: HashMap::new(),
                     stream_recv_pending: HashMap::new(),
+                    stream_retired: HashSet::new(),
+                    stream_retired_order: VecDeque::new(),
                     epoch: 0,
                     epoch_started: Instant::now(),
                     epoch_packets: 0,
@@ -1482,6 +1489,8 @@ async fn handle_ticket_attach(
                     stream_sent_data: HashMap::new(),
                     stream_next_recv_offset: HashMap::new(),
                     stream_recv_pending: HashMap::new(),
+                    stream_retired: HashSet::new(),
+                    stream_retired_order: VecDeque::new(),
                     epoch: 0,
                     epoch_started: Instant::now(),
                     epoch_packets: 0,
@@ -1831,7 +1840,9 @@ async fn handle_stream_open(
         }
         client.endpoint = peer;
         client.last_seen = Instant::now();
-        if client.opened_streams.contains(&open.stream_id) {
+        if client.stream_retired.contains(&open.stream_id) {
+            StreamOpenCheck::New(Err(anyhow!("stream {} is closed", open.stream_id)))
+        } else if client.opened_streams.contains(&open.stream_id) {
             StreamOpenCheck::Duplicate
         } else {
             StreamOpenCheck::New(stream_open_allowed(&config, client, &open))
@@ -2053,6 +2064,9 @@ async fn handle_stream_data(
         }
         client.endpoint = peer;
         client.last_seen = Instant::now();
+        if !client.opened_streams.contains(&data.stream_id) {
+            return Ok(());
+        }
         let writer = client.stream_writers.get(&data.stream_id).cloned();
         let (writes, consumed, received_offset) = accept_stream_data(client, data);
         (writer, writes, consumed, received_offset)
@@ -2062,9 +2076,9 @@ async fn handle_stream_data(
             let _ = writer.send(bytes).await;
         }
     }
-    // Always return flow-control credit, even when the stream's writer is already
-    // gone (closed/unknown). The peer debited its send window for these bytes, so
-    // skipping the adjust would wedge the stream at a permanent credit deficit.
+    // Always return flow-control credit for live streams, even when the stream's
+    // writer is already gone. The peer debited its send window for these bytes,
+    // so skipping the adjust would wedge the stream at a permanent credit deficit.
     send_stream_window_adjust_to_client(
         state,
         socket,
@@ -2101,7 +2115,9 @@ async fn handle_stream_open_ok(
         }
         client.endpoint = peer;
         client.last_seen = Instant::now();
-        client.stream_pending_opens.remove(&ok.stream_id);
+        if client.stream_pending_opens.remove(&ok.stream_id).is_none() {
+            return Ok(());
+        }
         client.opened_streams.insert(ok.stream_id);
         client
             .stream_send_credit
@@ -2133,11 +2149,7 @@ async fn handle_stream_open_reject(
     }
     client.endpoint = peer;
     client.last_seen = Instant::now();
-    client.stream_writers.remove(&reject.stream_id);
-    client.stream_pending_opens.remove(&reject.stream_id);
-    client.opened_streams.remove(&reject.stream_id);
-    client.stream_send_credit.remove(&reject.stream_id);
-    client.stream_pending_data.remove(&reject.stream_id);
+    retire_client_stream(client, reject.stream_id);
     Ok(())
 }
 
@@ -2165,6 +2177,9 @@ async fn handle_stream_window_adjust(
         }
         client.endpoint = peer;
         client.last_seen = Instant::now();
+        if !client.opened_streams.contains(&adjust.stream_id) {
+            return Ok(());
+        }
         ack_stream_data(client, adjust.stream_id, adjust.received_offset);
     }
     flush_stream_pending_data_to_client(state, socket, packet.header.conn_id, adjust.stream_id)
@@ -2192,15 +2207,7 @@ async fn handle_stream_close(
     // Connection migration on any authenticated, fresh packet (spec §11).
     client.endpoint = peer;
     client.last_seen = Instant::now();
-    client.stream_writers.remove(&close.stream_id);
-    client.stream_pending_opens.remove(&close.stream_id);
-    client.opened_streams.remove(&close.stream_id);
-    client.stream_send_credit.remove(&close.stream_id);
-    client.stream_pending_data.remove(&close.stream_id);
-    client.stream_next_send_offset.remove(&close.stream_id);
-    client.stream_sent_data.remove(&close.stream_id);
-    client.stream_next_recv_offset.remove(&close.stream_id);
-    client.stream_recv_pending.remove(&close.stream_id);
+    retire_client_stream(client, close.stream_id);
     Ok(())
 }
 
@@ -3280,6 +3287,46 @@ fn accept_stream_data(client: &mut ClientState, data: StreamData) -> (Vec<Vec<u8
     (writes, consumed, *expected)
 }
 
+fn cleanup_client_stream(client: &mut ClientState, stream_id: u64) {
+    client.stream_writers.remove(&stream_id);
+    client.stream_pending_opens.remove(&stream_id);
+    client.opened_streams.remove(&stream_id);
+    client.stream_send_credit.remove(&stream_id);
+    client.stream_pending_data.remove(&stream_id);
+    client.stream_next_send_offset.remove(&stream_id);
+    client.stream_sent_data.remove(&stream_id);
+    client.stream_next_recv_offset.remove(&stream_id);
+    client.stream_recv_pending.remove(&stream_id);
+}
+
+fn client_has_stream_state(client: &ClientState, stream_id: u64) -> bool {
+    client.stream_writers.contains_key(&stream_id)
+        || client.stream_pending_opens.contains_key(&stream_id)
+        || client.opened_streams.contains(&stream_id)
+        || client.stream_send_credit.contains_key(&stream_id)
+        || client.stream_pending_data.contains_key(&stream_id)
+        || client.stream_next_send_offset.contains_key(&stream_id)
+        || client.stream_sent_data.contains_key(&stream_id)
+        || client.stream_next_recv_offset.contains_key(&stream_id)
+        || client.stream_recv_pending.contains_key(&stream_id)
+}
+
+fn retire_client_stream(client: &mut ClientState, stream_id: u64) {
+    let had_state = client_has_stream_state(client, stream_id);
+    cleanup_client_stream(client, stream_id);
+    if !had_state || STREAM_RETIRED_TOMBSTONES == 0 {
+        return;
+    }
+    if client.stream_retired.insert(stream_id) {
+        client.stream_retired_order.push_back(stream_id);
+    }
+    while client.stream_retired_order.len() > STREAM_RETIRED_TOMBSTONES {
+        if let Some(expired) = client.stream_retired_order.pop_front() {
+            client.stream_retired.remove(&expired);
+        }
+    }
+}
+
 fn ack_stream_data(client: &mut ClientState, stream_id: u64, received_offset: u64) {
     let Some(sent) = client.stream_sent_data.get_mut(&stream_id) else {
         return;
@@ -3340,14 +3387,7 @@ async fn send_stream_close_to_client(
     {
         let mut locked = state.lock().expect("server state poisoned");
         if let Some(client) = locked.client_mut(&client_id) {
-            client.stream_writers.remove(&stream_id);
-            client.opened_streams.remove(&stream_id);
-            client.stream_send_credit.remove(&stream_id);
-            client.stream_pending_data.remove(&stream_id);
-            client.stream_next_send_offset.remove(&stream_id);
-            client.stream_sent_data.remove(&stream_id);
-            client.stream_next_recv_offset.remove(&stream_id);
-            client.stream_recv_pending.remove(&stream_id);
+            retire_client_stream(client, stream_id);
         }
     }
     let body = protocol::to_body(&StreamClose { stream_id })?;
@@ -4046,6 +4086,8 @@ mod tests {
             stream_sent_data: HashMap::new(),
             stream_next_recv_offset: HashMap::new(),
             stream_recv_pending: HashMap::new(),
+            stream_retired: HashSet::new(),
+            stream_retired_order: VecDeque::new(),
             epoch: 0,
             epoch_started: Instant::now(),
             epoch_packets: 0,
@@ -4053,6 +4095,125 @@ mod tests {
         }
     }
 
+    #[test]
+    fn cleanup_client_stream_removes_all_per_stream_state_only_for_target() {
+        let stream_id = 42;
+        let other_stream_id = 43;
+        let mut client = test_client_state([7u8; 32]);
+        let (writer_tx, _writer_rx) = mpsc::channel(1);
+        client.stream_writers.insert(stream_id, writer_tx);
+        client.opened_streams.insert(stream_id);
+        client.opened_streams.insert(other_stream_id);
+        client.stream_send_credit.insert(stream_id, 12);
+        client.stream_send_credit.insert(other_stream_id, 34);
+        client
+            .stream_pending_data
+            .insert(stream_id, VecDeque::from([vec![1]]));
+        client
+            .stream_pending_data
+            .insert(other_stream_id, VecDeque::from([vec![2]]));
+        client.stream_pending_opens.insert(
+            stream_id,
+            PendingStreamOpen {
+                target_host: "127.0.0.1".to_string(),
+                target_port: 1234,
+                last_sent: Instant::now(),
+                attempts: 1,
+            },
+        );
+        client.stream_pending_opens.insert(
+            other_stream_id,
+            PendingStreamOpen {
+                target_host: "127.0.0.1".to_string(),
+                target_port: 1235,
+                last_sent: Instant::now(),
+                attempts: 1,
+            },
+        );
+        client.stream_next_send_offset.insert(stream_id, 55);
+        client.stream_next_send_offset.insert(other_stream_id, 66);
+        client.stream_sent_data.insert(
+            stream_id,
+            BTreeMap::from([(
+                0,
+                PendingStreamChunk {
+                    offset: 0,
+                    bytes: vec![3],
+                    last_sent: Instant::now(),
+                    attempts: 1,
+                },
+            )]),
+        );
+        client.stream_sent_data.insert(
+            other_stream_id,
+            BTreeMap::from([(
+                0,
+                PendingStreamChunk {
+                    offset: 0,
+                    bytes: vec![4],
+                    last_sent: Instant::now(),
+                    attempts: 1,
+                },
+            )]),
+        );
+        client.stream_next_recv_offset.insert(stream_id, 77);
+        client.stream_next_recv_offset.insert(other_stream_id, 88);
+        client
+            .stream_recv_pending
+            .insert(stream_id, BTreeMap::from([(77, vec![5])]));
+        client
+            .stream_recv_pending
+            .insert(other_stream_id, BTreeMap::from([(88, vec![6])]));
+
+        cleanup_client_stream(&mut client, stream_id);
+
+        assert!(!client.stream_writers.contains_key(&stream_id));
+        assert!(!client.opened_streams.contains(&stream_id));
+        assert!(!client.stream_send_credit.contains_key(&stream_id));
+        assert!(!client.stream_pending_data.contains_key(&stream_id));
+        assert!(!client.stream_pending_opens.contains_key(&stream_id));
+        assert!(!client.stream_next_send_offset.contains_key(&stream_id));
+        assert!(!client.stream_sent_data.contains_key(&stream_id));
+        assert!(!client.stream_next_recv_offset.contains_key(&stream_id));
+        assert!(!client.stream_recv_pending.contains_key(&stream_id));
+
+        assert!(client.opened_streams.contains(&other_stream_id));
+        assert!(client.stream_send_credit.contains_key(&other_stream_id));
+        assert!(client.stream_pending_data.contains_key(&other_stream_id));
+        assert!(client.stream_pending_opens.contains_key(&other_stream_id));
+        assert!(
+            client
+                .stream_next_send_offset
+                .contains_key(&other_stream_id)
+        );
+        assert!(client.stream_sent_data.contains_key(&other_stream_id));
+        assert!(
+            client
+                .stream_next_recv_offset
+                .contains_key(&other_stream_id)
+        );
+        assert!(client.stream_recv_pending.contains_key(&other_stream_id));
+    }
+
+    #[test]
+    fn retire_client_stream_tombstones_only_real_stream_state() {
+        let stream_id = 42;
+        let mut client = test_client_state([8u8; 32]);
+        client.opened_streams.insert(stream_id);
+        client
+            .stream_send_credit
+            .insert(stream_id, STREAM_INITIAL_WINDOW);
+
+        retire_client_stream(&mut client, stream_id);
+        retire_client_stream(&mut client, 99);
+
+        assert!(!client.opened_streams.contains(&stream_id));
+        assert!(!client.stream_send_credit.contains_key(&stream_id));
+        assert!(client.stream_retired.contains(&stream_id));
+        assert!(!client.stream_retired.contains(&99));
+        assert_eq!(client.stream_retired_order, VecDeque::from([stream_id]));
+    }
+
     #[test]
     fn client_index_stays_in_sync_with_session_clients() {
         let (pty_tx, _pty_rx) = mpsc::unbounded_channel();
@@ -4258,6 +4419,74 @@ mod tests {
         assert_eq!(ok.stream_id, stream_id);
     }
 
+    #[tokio::test]
+    async fn retired_stream_open_is_rejected_not_reopened() {
+        let (pty_tx, _pty_rx) = mpsc::unbounded_channel();
+        let mut state = ServerState::new(ServerConfig::default(), [0u8; 32], pty_tx);
+        let client_id = [15u8; 16];
+        let session_key = [16u8; 32];
+        let stream_id = 100;
+        let receiver = UdpSocket::bind("127.0.0.1:0").await.unwrap();
+        let sender = Arc::new(UdpSocket::bind("127.0.0.1:0").await.unwrap());
+        let mut client = test_client_state(session_key);
+        client.endpoint = receiver.local_addr().unwrap();
+        client.stream_retired.insert(stream_id);
+        client.stream_retired_order.push_back(stream_id);
+        state.sessions.insert(
+            "test".to_string(),
+            Session {
+                pty: None,
+                parser: vt100::Parser::new(24, 80, 100),
+                clients: HashMap::from([(client_id, client)]),
+                output_seq: 0,
+                recent: VecDeque::new(),
+                empty_since: None,
+                holder_control: None,
+                persistent: false,
+                bytes_since_persist: 0,
+                last_persisted_seq: 0,
+            },
+        );
+        state.client_index.insert(client_id, "test".to_string());
+        let state = Arc::new(Mutex::new(state));
+        let raw = protocol::encode_encrypted(
+            PacketKind::StreamOpen,
+            client_id,
+            2,
+            0,
+            &session_key,
+            CLIENT_TO_SERVER,
+            &protocol::to_body(&StreamOpen {
+                stream_id,
+                target_host: "127.0.0.1".to_string(),
+                target_port: 9,
+            })
+            .unwrap(),
+        )
+        .unwrap();
+        let packet = protocol::decode(&raw).unwrap();
+
+        handle_stream_open(&state, &sender, receiver.local_addr().unwrap(), &packet)
+            .await
+            .unwrap();
+
+        let mut buf = [0u8; 2048];
+        let (n, _) = tokio::time::timeout(Duration::from_secs(1), receiver.recv_from(&mut buf))
+            .await
+            .unwrap()
+            .unwrap();
+        let packet = protocol::decode(&buf[..n]).unwrap();
+        assert_eq!(packet.header.kind, PacketKind::StreamOpenReject);
+        let plain = protocol::decrypt_body(&packet, &session_key, SERVER_TO_CLIENT).unwrap();
+        let reject: StreamOpenReject = protocol::from_body(&plain).unwrap();
+        assert_eq!(reject.stream_id, stream_id);
+        assert!(reject.reason.contains("closed"));
+
+        let locked = state.lock().unwrap();
+        let client = locked.sessions["test"].clients.get(&client_id).unwrap();
+        assert!(!client.opened_streams.contains(&stream_id));
+    }
+
     #[tokio::test]
     async fn pending_server_stream_open_is_retransmitted() {
         let (pty_tx, _pty_rx) = mpsc::unbounded_channel();
@@ -4445,6 +4674,8 @@ mod tests {
                         stream_sent_data: HashMap::new(),
                         stream_next_recv_offset: HashMap::new(),
                         stream_recv_pending: HashMap::new(),
+                        stream_retired: HashSet::new(),
+                        stream_retired_order: VecDeque::new(),
                         epoch: 0,
                         epoch_started: Instant::now(),
                         epoch_packets: 0,
@@ -4539,6 +4770,8 @@ mod tests {
                         stream_sent_data: HashMap::new(),
                         stream_next_recv_offset: HashMap::new(),
                         stream_recv_pending: HashMap::new(),
+                        stream_retired: HashSet::new(),
+                        stream_retired_order: VecDeque::new(),
                         epoch: 0,
                         epoch_started: Instant::now(),
                         epoch_packets: 0,

src/transport.rs

@@ -30,6 +30,7 @@ use tokio::net::UdpSocket;
 pub const DEFAULT_INITIAL_WINDOW: usize = 1024 * 1024;
 pub const DEFAULT_RETRANSMIT_AFTER: Duration = Duration::from_millis(200);
 pub const DEFAULT_KEEPALIVE_AFTER: Duration = Duration::from_secs(2);
+pub const DEFAULT_RETIRED_STREAM_TOMBSTONES: usize = 16 * 1024;
 pub const SERVICE_TARGET_PREFIX: &str = "@dosh-";
 
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -37,6 +38,7 @@ pub struct TransportConfig {
     pub initial_window: usize,
     pub retransmit_after: Duration,
     pub keepalive_after: Duration,
+    pub retired_stream_tombstones: usize,
 }
 
 impl Default for TransportConfig {
@@ -45,6 +47,7 @@ impl Default for TransportConfig {
             initial_window: DEFAULT_INITIAL_WINDOW,
             retransmit_after: DEFAULT_RETRANSMIT_AFTER,
             keepalive_after: DEFAULT_KEEPALIVE_AFTER,
+            retired_stream_tombstones: DEFAULT_RETIRED_STREAM_TOMBSTONES,
         }
     }
 }
@@ -141,6 +144,9 @@ pub enum TransportEvent {
     Close {
         stream_id: u64,
     },
+    Ignored {
+        stream_id: u64,
+    },
 }
 
 #[derive(Debug, Clone)]
@@ -170,6 +176,8 @@ pub struct StreamMux {
     next_send_offset: HashMap<u64, u64>,
     next_recv_offset: HashMap<u64, u64>,
     recv_pending: HashMap<u64, BTreeMap<u64, Vec<u8>>>,
+    retired_streams: HashSet<u64>,
+    retired_stream_order: VecDeque<u64>,
 }
 
 #[derive(Debug, Clone, Default)]
@@ -225,6 +233,8 @@ impl StreamMux {
             next_send_offset: HashMap::new(),
             next_recv_offset: HashMap::new(),
             recv_pending: HashMap::new(),
+            retired_streams: HashSet::new(),
+            retired_stream_order: VecDeque::new(),
         }
     }
 
@@ -235,7 +245,10 @@ impl StreamMux {
         target_port: u16,
     ) -> Result<OutgoingStreamPacket> {
         let target_host = target_host.into();
-        if self.opened_streams.contains(&stream_id) || self.pending_opens.contains_key(&stream_id) {
+        if self.opened_streams.contains(&stream_id)
+            || self.pending_opens.contains_key(&stream_id)
+            || self.retired_streams.contains(&stream_id)
+        {
             bail!("stream {stream_id} already exists");
         }
         self.send_credit
@@ -262,6 +275,9 @@ impl StreamMux {
     }
 
     pub fn accept_open(&mut self, open: StreamOpen) -> Result<IncomingStreamOpen> {
+        if self.retired_streams.contains(&open.stream_id) {
+            bail!("stream {} was already closed", open.stream_id);
+        }
         if self.pending_opens.contains_key(&open.stream_id) {
             bail!(
                 "stream {} collides with a local pending open",
@@ -295,19 +311,39 @@ impl StreamMux {
         )
     }
 
-    pub fn handle_open_ok(&mut self, ok: StreamOpenOk) -> Result<Vec<OutgoingStreamPacket>> {
-        self.pending_opens.remove(&ok.stream_id);
+    pub fn reject_open(
+        &mut self,
+        stream_id: u64,
+        reason: impl Into<String>,
+    ) -> Result<OutgoingStreamPacket> {
+        if self.has_stream_state(stream_id) {
+            self.retire_stream(stream_id);
+        }
+        Self::open_reject(stream_id, reason)
+    }
+
+    pub fn handle_open_ok(
+        &mut self,
+        ok: StreamOpenOk,
+    ) -> Result<Option<Vec<OutgoingStreamPacket>>> {
+        if self.pending_opens.remove(&ok.stream_id).is_none() {
+            return Ok(None);
+        }
         self.opened_streams.insert(ok.stream_id);
         self.send_credit
             .entry(ok.stream_id)
             .or_insert(self.config.initial_window);
         self.next_send_offset.entry(ok.stream_id).or_insert(0);
         self.next_recv_offset.entry(ok.stream_id).or_insert(0);
-        self.flush_pending_data(ok.stream_id)
+        self.flush_pending_data(ok.stream_id).map(Some)
     }
 
-    pub fn handle_open_reject(&mut self, reject: StreamOpenReject) {
-        self.cleanup_stream(reject.stream_id);
+    pub fn handle_open_reject(&mut self, reject: StreamOpenReject) -> bool {
+        if !self.has_stream_state(reject.stream_id) {
+            return false;
+        }
+        self.retire_stream(reject.stream_id);
+        true
     }
 
     pub fn send_data(
@@ -344,8 +380,11 @@ impl StreamMux {
         Ok(vec![self.send_data_now(stream_id, bytes)?])
     }
 
-    pub fn handle_data(&mut self, data: StreamData) -> Result<IncomingStreamData> {
+    pub fn handle_data(&mut self, data: StreamData) -> Result<Option<IncomingStreamData>> {
         let stream_id = data.stream_id;
+        if !self.opened_streams.contains(&stream_id) {
+            return Ok(None);
+        }
         let (chunks, consumed, received_offset) = self.accept_data(data);
         let window_adjust = encode_packet(
             PacketKind::StreamWindowAdjust,
@@ -355,37 +394,52 @@ impl StreamMux {
                 bytes: consumed.min(u32::MAX as usize) as u32,
             },
         )?;
-        Ok(IncomingStreamData {
+        Ok(Some(IncomingStreamData {
             stream_id,
             chunks,
             consumed,
             received_offset,
             window_adjust,
-        })
+        }))
     }
 
     pub fn handle_window_adjust(
         &mut self,
         adjust: StreamWindowAdjust,
-    ) -> Result<Vec<OutgoingStreamPacket>> {
+    ) -> Result<Option<Vec<OutgoingStreamPacket>>> {
+        if !self.opened_streams.contains(&adjust.stream_id) {
+            return Ok(None);
+        }
         let acked_bytes = self.ack_data(adjust.stream_id, adjust.received_offset);
         self.add_credit(adjust.stream_id, acked_bytes);
-        self.flush_pending_data(adjust.stream_id)
+        self.flush_pending_data(adjust.stream_id).map(Some)
     }
 
     pub fn close_stream(&mut self, stream_id: u64) -> Result<OutgoingStreamPacket> {
-        self.cleanup_stream(stream_id);
+        if !self.has_stream_state(stream_id) {
+            bail!("stream {stream_id} is not open");
+        }
+        self.retire_stream(stream_id);
         encode_packet(PacketKind::StreamClose, &StreamClose { stream_id })
     }
 
-    pub fn handle_close(&mut self, close: StreamClose) {
-        self.cleanup_stream(close.stream_id);
+    pub fn handle_close(&mut self, close: StreamClose) -> bool {
+        if !self.has_stream_state(close.stream_id) {
+            return false;
+        }
+        self.retire_stream(close.stream_id);
+        true
     }
 
     pub fn handle_packet(&mut self, kind: PacketKind, body: &[u8]) -> Result<TransportEvent> {
         match kind {
             PacketKind::StreamOpen => {
                 let open: StreamOpen = protocol::from_body(body)?;
+                if self.retired_streams.contains(&open.stream_id) {
+                    return Ok(TransportEvent::Ignored {
+                        stream_id: open.stream_id,
+                    });
+                }
                 if self.opened_streams.contains(&open.stream_id) {
                     return Ok(TransportEvent::DuplicateOpen {
                         stream_id: open.stream_id,
@@ -397,32 +451,47 @@ impl StreamMux {
             PacketKind::StreamOpenOk => {
                 let ok: StreamOpenOk = protocol::from_body(body)?;
                 let stream_id = ok.stream_id;
-                let flushed = self.handle_open_ok(ok)?;
-                Ok(TransportEvent::OpenOk { stream_id, flushed })
+                match self.handle_open_ok(ok)? {
+                    Some(flushed) => Ok(TransportEvent::OpenOk { stream_id, flushed }),
+                    None => Ok(TransportEvent::Ignored { stream_id }),
+                }
             }
             PacketKind::StreamOpenReject => {
                 let reject: StreamOpenReject = protocol::from_body(body)?;
-                self.handle_open_reject(reject.clone());
-                Ok(TransportEvent::OpenReject {
-                    stream_id: reject.stream_id,
-                    reason: reject.reason,
-                })
+                let stream_id = reject.stream_id;
+                if self.handle_open_reject(reject.clone()) {
+                    Ok(TransportEvent::OpenReject {
+                        stream_id,
+                        reason: reject.reason,
+                    })
+                } else {
+                    Ok(TransportEvent::Ignored { stream_id })
+                }
             }
             PacketKind::StreamData => {
                 let data: StreamData = protocol::from_body(body)?;
-                self.handle_data(data).map(TransportEvent::Data)
+                let stream_id = data.stream_id;
+                match self.handle_data(data)? {
+                    Some(data) => Ok(TransportEvent::Data(data)),
+                    None => Ok(TransportEvent::Ignored { stream_id }),
+                }
             }
             PacketKind::StreamWindowAdjust => {
                 let adjust: StreamWindowAdjust = protocol::from_body(body)?;
                 let stream_id = adjust.stream_id;
-                let flushed = self.handle_window_adjust(adjust)?;
-                Ok(TransportEvent::WindowAdjust { stream_id, flushed })
+                match self.handle_window_adjust(adjust)? {
+                    Some(flushed) => Ok(TransportEvent::WindowAdjust { stream_id, flushed }),
+                    None => Ok(TransportEvent::Ignored { stream_id }),
+                }
             }
             PacketKind::StreamClose => {
                 let close: StreamClose = protocol::from_body(body)?;
                 let stream_id = close.stream_id;
-                self.handle_close(close);
-                Ok(TransportEvent::Close { stream_id })
+                if self.handle_close(close) {
+                    Ok(TransportEvent::Close { stream_id })
+                } else {
+                    Ok(TransportEvent::Ignored { stream_id })
+                }
             }
             _ => bail!("packet kind {kind:?} is not a stream transport packet"),
         }
@@ -610,6 +679,32 @@ impl StreamMux {
         *credit = credit.saturating_add(bytes).min(self.config.initial_window);
     }
 
+    fn has_stream_state(&self, stream_id: u64) -> bool {
+        self.opened_streams.contains(&stream_id)
+            || self.pending_opens.contains_key(&stream_id)
+            || self.send_credit.contains_key(&stream_id)
+            || self.pending_data.contains_key(&stream_id)
+            || self.sent_data.contains_key(&stream_id)
+            || self.next_send_offset.contains_key(&stream_id)
+            || self.next_recv_offset.contains_key(&stream_id)
+            || self.recv_pending.contains_key(&stream_id)
+    }
+
+    fn retire_stream(&mut self, stream_id: u64) {
+        self.cleanup_stream(stream_id);
+        if self.config.retired_stream_tombstones == 0 {
+            return;
+        }
+        if self.retired_streams.insert(stream_id) {
+            self.retired_stream_order.push_back(stream_id);
+        }
+        while self.retired_stream_order.len() > self.config.retired_stream_tombstones {
+            if let Some(expired) = self.retired_stream_order.pop_front() {
+                self.retired_streams.remove(&expired);
+            }
+        }
+    }
+
     fn cleanup_stream(&mut self, stream_id: u64) {
         self.opened_streams.remove(&stream_id);
         self.pending_opens.remove(&stream_id);
@@ -727,8 +822,8 @@ impl DoshTransport {
     }
 
     pub async fn reject_stream(&mut self, stream_id: u64, reason: impl Into<String>) -> Result<()> {
-        self.send_outgoing(StreamMux::open_reject(stream_id, reason)?)
-            .await
+        let packet = self.mux.reject_open(stream_id, reason)?;
+        self.send_outgoing(packet).await
     }
 
     pub async fn send(&mut self, stream_id: u64, bytes: impl Into<Vec<u8>>) -> Result<()> {
@@ -853,7 +948,8 @@ impl DoshTransport {
             }
             TransportEvent::Open(_)
             | TransportEvent::OpenReject { .. }
-            | TransportEvent::Close { .. } => {}
+            | TransportEvent::Close { .. }
+            | TransportEvent::Ignored { .. } => {}
         }
         Ok(())
     }
@@ -976,7 +1072,10 @@ mod tests {
         assert!(mux.send_data(7, b"hello".to_vec()).unwrap().is_empty());
         assert_eq!(mux.pending_bytes(7), 5);
 
-        let flushed = mux.handle_open_ok(StreamOpenOk { stream_id: 7 }).unwrap();
+        let flushed = mux
+            .handle_open_ok(StreamOpenOk { stream_id: 7 })
+            .unwrap()
+            .unwrap();
         assert_eq!(flushed.len(), 1);
         assert_eq!(flushed[0].kind, PacketKind::StreamData);
         let data: StreamData = decode(&flushed[0]);
@@ -999,6 +1098,7 @@ mod tests {
                 offset: 5,
                 bytes: b"world".to_vec(),
             })
+            .unwrap()
             .unwrap();
         assert!(first.chunks.is_empty());
         assert_eq!(first.received_offset, 0);
@@ -1009,6 +1109,7 @@ mod tests {
                 offset: 0,
                 bytes: b"hello".to_vec(),
             })
+            .unwrap()
             .unwrap();
         assert_eq!(second.chunks, vec![b"hello".to_vec(), b"world".to_vec()]);
         assert_eq!(second.consumed, 10);
@@ -1023,7 +1124,9 @@ mod tests {
             ..TransportConfig::default()
         });
         mux.open_stream(1, "@dosh-test", 0).unwrap();
-        mux.handle_open_ok(StreamOpenOk { stream_id: 1 }).unwrap();
+        mux.handle_open_ok(StreamOpenOk { stream_id: 1 })
+            .unwrap()
+            .unwrap();
         let sent = mux.send_data(1, b"hello".to_vec()).unwrap();
         assert_eq!(sent.len(), 1);
         assert!(mux.send_data(1, b"!".to_vec()).unwrap().is_empty());
@@ -1034,6 +1137,7 @@ mod tests {
                 received_offset: 5,
                 bytes: 5,
             })
+            .unwrap()
             .unwrap();
         assert_eq!(flushed.len(), 1);
         let data: StreamData = decode(&flushed[0]);
@@ -1049,7 +1153,9 @@ mod tests {
             ..TransportConfig::default()
         });
         mux.open_stream(1, "@dosh-test", 0).unwrap();
-        mux.handle_open_ok(StreamOpenOk { stream_id: 1 }).unwrap();
+        mux.handle_open_ok(StreamOpenOk { stream_id: 1 })
+            .unwrap()
+            .unwrap();
         assert_eq!(mux.send_data(1, b"hello".to_vec()).unwrap().len(), 1);
         assert_eq!(mux.send_credit[&1], 0);
 
@@ -1059,6 +1165,7 @@ mod tests {
                 received_offset: 5,
                 bytes: 0,
             })
+            .unwrap()
             .unwrap();
         assert!(flushed.is_empty());
         assert_eq!(mux.send_credit[&1], 5);
@@ -1119,13 +1226,142 @@ mod tests {
         let mut mux = StreamMux::new(TransportConfig::default());
         mux.open_stream(1, "@dosh-test", 0).unwrap();
         assert!(mux.send_data(1, b"queued".to_vec()).unwrap().is_empty());
-        mux.handle_open_ok(StreamOpenOk { stream_id: 1 }).unwrap();
+        mux.handle_open_ok(StreamOpenOk { stream_id: 1 })
+            .unwrap()
+            .unwrap();
         mux.close_stream(1).unwrap();
 
         assert!(mux.send_data(1, b"lost".to_vec()).is_err());
         assert!(mux.send_data(99, b"lost".to_vec()).is_err());
     }
 
+    #[test]
+    fn rejecting_incoming_stream_retires_local_state() {
+        let mut mux = StreamMux::new(TransportConfig::default());
+        mux.accept_open(StreamOpen {
+            stream_id: 7,
+            target_host: "@dosh-test".to_string(),
+            target_port: 0,
+        })
+        .unwrap();
+        assert!(mux.is_open(7));
+
+        let reject = mux.reject_open(7, "nope").unwrap();
+
+        assert_eq!(reject.kind, PacketKind::StreamOpenReject);
+        assert!(!mux.is_open(7));
+        assert!(mux.retired_streams.contains(&7));
+        assert!(mux.send_data(7, b"must-not-send".to_vec()).is_err());
+        assert!(
+            mux.accept_open(StreamOpen {
+                stream_id: 7,
+                target_host: "@dosh-test".to_string(),
+                target_port: 0,
+            })
+            .is_err()
+        );
+    }
+
+    #[test]
+    fn stale_packets_after_close_do_not_recreate_stream_state() {
+        let mut mux = StreamMux::new(TransportConfig::default());
+        mux.open_stream(1, "@dosh-test", 0).unwrap();
+        mux.handle_open_ok(StreamOpenOk { stream_id: 1 })
+            .unwrap()
+            .unwrap();
+        assert_eq!(mux.send_data(1, b"hello".to_vec()).unwrap().len(), 1);
+        mux.close_stream(1).unwrap();
+
+        let stale_data = protocol::to_body(&StreamData {
+            stream_id: 1,
+            offset: 0,
+            bytes: b"stale".to_vec(),
+        })
+        .unwrap();
+        assert_eq!(
+            mux.handle_packet(PacketKind::StreamData, &stale_data)
+                .unwrap(),
+            TransportEvent::Ignored { stream_id: 1 }
+        );
+
+        let stale_open_ok = protocol::to_body(&StreamOpenOk { stream_id: 1 }).unwrap();
+        assert_eq!(
+            mux.handle_packet(PacketKind::StreamOpenOk, &stale_open_ok)
+                .unwrap(),
+            TransportEvent::Ignored { stream_id: 1 }
+        );
+
+        let stale_adjust = protocol::to_body(&StreamWindowAdjust {
+            stream_id: 1,
+            received_offset: 5,
+            bytes: 5,
+        })
+        .unwrap();
+        assert_eq!(
+            mux.handle_packet(PacketKind::StreamWindowAdjust, &stale_adjust)
+                .unwrap(),
+            TransportEvent::Ignored { stream_id: 1 }
+        );
+
+        let stale_open = protocol::to_body(&StreamOpen {
+            stream_id: 1,
+            target_host: "@dosh-test".to_string(),
+            target_port: 0,
+        })
+        .unwrap();
+        assert_eq!(
+            mux.handle_packet(PacketKind::StreamOpen, &stale_open)
+                .unwrap(),
+            TransportEvent::Ignored { stream_id: 1 }
+        );
+
+        let stale_close = protocol::to_body(&StreamClose { stream_id: 1 }).unwrap();
+        assert_eq!(
+            mux.handle_packet(PacketKind::StreamClose, &stale_close)
+                .unwrap(),
+            TransportEvent::Ignored { stream_id: 1 }
+        );
+
+        assert!(!mux.is_open(1));
+        assert!(!mux.pending_opens.contains_key(&1));
+        assert!(!mux.send_credit.contains_key(&1));
+        assert!(!mux.pending_data.contains_key(&1));
+        assert!(!mux.sent_data.contains_key(&1));
+        assert!(!mux.next_send_offset.contains_key(&1));
+        assert!(!mux.next_recv_offset.contains_key(&1));
+        assert!(!mux.recv_pending.contains_key(&1));
+        assert!(mux.retired_streams.contains(&1));
+    }
+
+    #[test]
+    fn retired_stream_tombstones_are_bounded() {
+        let mut mux = StreamMux::new(TransportConfig {
+            retired_stream_tombstones: 2,
+            ..TransportConfig::default()
+        });
+        for stream_id in 1..=3 {
+            mux.open_stream(stream_id, "@dosh-test", 0).unwrap();
+            mux.close_stream(stream_id).unwrap();
+        }
+
+        assert_eq!(mux.retired_streams.len(), 2);
+        assert!(!mux.retired_streams.contains(&1));
+        assert!(mux.retired_streams.contains(&2));
+        assert!(mux.retired_streams.contains(&3));
+
+        let stale_open = protocol::to_body(&StreamOpen {
+            stream_id: 3,
+            target_host: "@dosh-test".to_string(),
+            target_port: 0,
+        })
+        .unwrap();
+        assert_eq!(
+            mux.handle_packet(PacketKind::StreamOpen, &stale_open)
+                .unwrap(),
+            TransportEvent::Ignored { stream_id: 3 }
+        );
+    }
+
     #[tokio::test]
     async fn session_transport_partitions_client_and_server_stream_ids() {
         let client_socket = UdpSocket::bind("127.0.0.1:0").await.unwrap();
@@ -1291,6 +1527,63 @@ mod tests {
         }
     }
 
+    #[tokio::test]
+    async fn session_transport_reject_stream_retires_server_state() {
+        let client_socket = UdpSocket::bind("127.0.0.1:0").await.unwrap();
+        let server_socket = UdpSocket::bind("127.0.0.1:0").await.unwrap();
+        let client_addr = client_socket.local_addr().unwrap();
+        let server_addr = server_socket.local_addr().unwrap();
+        let key = [46u8; 32];
+        let conn_id = [10u8; 16];
+        let mut client = DoshTransport::new_owned(
+            client_socket,
+            SessionTransportConfig {
+                role: SessionRole::Client,
+                conn_id,
+                session_key: key,
+                peer_addr: server_addr,
+                initial_send_seq: 1,
+                initial_ack: 0,
+                stream: TransportConfig::default(),
+            },
+        );
+        let mut server = DoshTransport::new_owned(
+            server_socket,
+            SessionTransportConfig {
+                role: SessionRole::Server,
+                conn_id,
+                session_key: key,
+                peer_addr: client_addr,
+                initial_send_seq: 1,
+                initial_ack: 0,
+                stream: TransportConfig::default(),
+            },
+        );
+
+        let stream_id = client.open_service("app").await.unwrap();
+        match server.recv().await.unwrap() {
+            SessionEvent::Stream(TransportEvent::Open(open)) => {
+                assert_eq!(open.stream_id, stream_id);
+                assert!(server.mux().is_open(stream_id));
+                server.reject_stream(stream_id, "disabled").await.unwrap();
+            }
+            other => panic!("unexpected event {other:?}"),
+        }
+
+        assert!(!server.mux().is_open(stream_id));
+        assert!(
+            server
+                .send(stream_id, b"must-not-send".to_vec())
+                .await
+                .is_err()
+        );
+        assert!(matches!(
+            client.recv().await.unwrap(),
+            SessionEvent::Stream(TransportEvent::OpenReject { stream_id: rejected, reason })
+                if rejected == stream_id && reason == "disabled"
+        ));
+    }
+
     #[tokio::test]
     async fn session_transport_roams_to_authenticated_new_peer_addr() {
         let server_socket = UdpSocket::bind("127.0.0.1:0").await.unwrap();