@@ -304,7 +304,7 @@ class MuxCarrier(
         // The Portal's answer is the first byte of this stream's payload, in
         // exactly the place a dedicated lane reads it from the socket.
         val setup = ByteArray(1)
-        if (readStream(stream, setup, 0, 1) != 1) {
+        if (!awaitSetupByte(stream, setup)) {
             releaseStream(stream)
             return invalid(stream.failure ?: MuxCarrierReason.NoSetupByte)
         }
@@ -319,7 +319,24 @@ class MuxCarrier(
             }
         stream.setupResult = result
         if (result.isRejection) {
-            reset(stream)
+            // Released, **not reset**. The rejection is the teardown: the
+            // Portal answered and forgot the stream in the same breath, and
+            // section 3 says "STREAM data for an unknown flow is a carrier
+            // error" — so a RST for a flow it has already refused does not
+            // tidy anything up, it closes the whole carrier and fails every
+            // other flow on it.
+            //
+            // Measured, because it is invisible in any test that opens one
+            // flow at a time. Android's Private DNS probes an address on port
+            // 853 the moment a tunnel comes up; the Portal answers DIAL_FAILED;
+            // this reset the stream; half a second later four unrelated fetches
+            // on the same carrier reported "the Portal closed the Mux carrier".
+            // One to four of sixteen concurrent fetches came back empty,
+            // intermittently, depending on which shard the probe landed on.
+            //
+            // The dedicated lane has always done it this way — a rejected lane
+            // is simply closed — so this is also the two carriers agreeing
+            // again.
             releaseStream(stream)
             return invalid(MuxCarrierReason.Rejected(result))
         }
@@ -528,6 +545,45 @@ class MuxCarrier(
         }
     }
 
+    /**
+     * Waits for the Portal's setup byte, for as long as a dedicated lane does.
+     *
+     * **A quiet stream is not a refused one**, and telling them apart is the
+     * whole job here. [readStream] answers three things with three values: 1 is
+     * the byte, -1 is a stream or carrier that has gone, and **0 is "nothing in
+     * the last [READ_WAIT_MILLIS]"** — which is a poll interval, not a verdict.
+     *
+     * Treating that 0 as a verdict is what this used to do, and it produced the
+     * worst failure this layer has had. Sixteen flows open at once, four land on
+     * one carrier, the Portal dials four targets and answers each as it
+     * finishes; any answer slower than a quarter of a second was read as *"the
+     * Portal did not answer on this stream — authentication most likely
+     * failed"*, which is both wrong and the most misleading sentence available.
+     * The flow then reset a stream the Portal was still setting up, the Portal
+     * closed the carrier, and **the other three flows on it died too** — three
+     * short responses out of sixteen, intermittently, with nothing in the
+     * Portal's log but a carrier that closed.
+     *
+     * The deadline is the dedicated lane's, deliberately. It is the same
+     * protocol step over the same kind of connection to the same Portal, and a
+     * carrier that gave it sixty times less patience than a lane was not making
+     * a considered choice — it was reusing a queue-polling constant as a
+     * protocol timeout.
+     */
+    private fun awaitSetupByte(
+        stream: Stream,
+        into: ByteArray,
+    ): Boolean {
+        val deadline = clock() + SETUP_DEADLINE_MILLIS
+        while (true) {
+            when (readStream(stream, into, 0, 1)) {
+                1 -> return true
+                0 -> if (clock() >= deadline) return false
+                else -> return false
+            }
+        }
+    }
+
     // ── Stream reading, from the caller's thread ────────────────────────────
 
     private fun readStream(
@@ -605,13 +661,18 @@ class MuxCarrier(
         if (stream.receiveClosed.get()) releaseStream(stream)
     }
 
-    /** RST is the only flag that may accompany it, and its value must be zero. */
-    private fun reset(stream: Stream) {
-        if (!stream.sendClosed.compareAndSet(false, true)) return
-        runCatching {
-            enqueue(MuxHeader(MuxKind.Stream, MuxHeader.FLAG_RST, 0, stream.id).encode())
-        }
-    }
+    // This client sends no RST, and that is a decision rather than an omission.
+    //
+    // RST had exactly one caller: a flow the Portal had just rejected. That was
+    // wrong for the reason written where the rejection is handled — the Portal
+    // forgets a refused stream as it answers, and section 3 makes a frame for a
+    // flow it does not know a *carrier* error, so the reset killed every other
+    // flow sharing the connection. Every other way a flow ends here is a
+    // half-close, which is what FIN is for.
+    //
+    // The frame itself stays implemented and tested in `MuxHeader`, because the
+    // Portal may send one and this client has to read it. Writing one is what
+    // no path needs.
 
     /** Gives back the carrier slot, exactly once however the stream ended. */
     private fun releaseStream(stream: Stream) {
@@ -686,7 +747,14 @@ class MuxCarrier(
         }
     }
 
-    private companion object {
+    /**
+     * Internal rather than private so that the tests can assert the *relation*
+     * between two of these numbers. `SETUP_DEADLINE_MILLIS` being sixty times
+     * `READ_WAIT_MILLIS` is the whole content of a defect that cost three of
+     * sixteen concurrent flows, and a test that can only observe it through
+     * timing would be a slow test that fails on a loaded machine.
+     */
+    internal companion object {
         /** The sentinel that means "no more data on this stream". */
         val EOF = ByteArray(0)
 
@@ -702,6 +770,17 @@ class MuxCarrier(
 
         /** The same, for a caller blocked on a stream that has gone quiet. */
         const val READ_WAIT_MILLIS = 250L
+
+        /**
+         * How long a flow waits for the Portal to answer its SYN.
+         *
+         * The dedicated lane's read timeout, because it is the same protocol
+         * step: the Portal dials the target and answers when it knows, and how
+         * long that takes is a property of the target rather than of the
+         * carrier the request arrived over. See [awaitSetupByte] for what a
+         * shorter one did.
+         */
+        const val SETUP_DEADLINE_MILLIS = 15_000L
     }
 }
 
 
@@ -92,6 +92,15 @@ class FakeMuxPortal(
     private val onReady: (FakeMuxPortal) -> Unit = {},
     /** Called for each STREAM frame that carries payload after the opening one. */
     private val onPayload: (FakeMuxPortal, UInt, ByteArray) -> Unit = { portal, id, bytes -> portal.sendStream(id, bytes) },
+    /**
+     * How long to think before answering a SYN.
+     *
+     * A real Portal dials the target before it answers, and how long that takes
+     * belongs to the target rather than to the carrier. Zero here would make
+     * every setup instantaneous, which is exactly the condition under which a
+     * carrier that mistook a poll interval for a refusal looked correct.
+     */
+    private val setupDelayMillis: Long = 0,
 ) {
     /** Every frame header the client sent, in order. */
     val received: MutableList<MuxHeader> = java.util.Collections.synchronizedList(mutableListOf())
@@ -307,6 +316,7 @@ class FakeMuxPortal(
             if (flowHeader is DecodeResult.Ok && target is DecodeResult.Ok) {
                 opened[header.flowId] = target.value.target
                 val result = setupResult(target.value.target)
+                if (setupDelayMillis > 0) Thread.sleep(setupDelayMillis)
                 sendStream(header.flowId, byteArrayOf(result.byte.toByte()))
                 if (result.isRejection) return
                 val consumed = FlowHeader.LENGTH + target.value.consumed
 
@@ -123,6 +123,42 @@ class MuxCarrierRefusalTest {
         assertEquals(MuxCarrierReason.ClosedByCaller, reason)
     }
 
+    @Test
+    fun aRejectedFlowIsReleasedRatherThanReset() {
+        // The rejection is the teardown. The Portal answers and forgets the
+        // stream in the same breath, and section 3 makes a frame for a flow it
+        // does not know a *carrier* error — so a RST here does not tidy up one
+        // flow, it closes the connection and fails every other flow sharing it.
+        //
+        // Found on a device and not by any test that opens one flow at a time.
+        // Android's Private DNS probes port 853 the moment a tunnel comes up,
+        // the Portal answered DIAL_FAILED, this client reset the stream, and
+        // half a second later four unrelated fetches on the same carrier
+        // reported "the Portal closed the Mux carrier". One to four of sixteen
+        // concurrent fetches came back empty, intermittently, depending on
+        // which shard the probe happened to land on.
+        val (clientSide, portalSide) = LoopbackTransport.pair()
+        val fake = FakeMuxPortal(portalSide, { SetupResult.DialFailed }).also { it.start() }
+        val built = MuxCarrier(clientSide, key, SessionId.random())
+        assertTrue(built.start() is DecodeResult.Ok)
+        carrier = built
+        portal = fake
+
+        val refused = built.open(target, FlowKind.Tcp, 1u)
+        assertEquals(
+            MuxCarrierReason.Rejected(SetupResult.DialFailed),
+            (refused as DecodeResult.Invalid).reason,
+        )
+
+        // Give the writer thread a chance to send anything it was going to.
+        Thread.sleep(300)
+        val reset = fake.frames().filter { it.isReset }
+        assertTrue("a rejected flow must not be reset, but $reset went out", reset.isEmpty())
+
+        // And the carrier is still usable, which is the point of not resetting.
+        assertTrue("the carrier died with the flow it refused", built.isOpen)
+    }
+
     @Test
     fun everyRefusalSaysSomethingDifferent() {
         // The seven rejections lesson, applied here: a caller that cannot tell
 
@@ -45,9 +45,10 @@ class MuxCarrierTest {
         onReady: (FakeMuxPortal) -> Unit = {},
         onPayload: (FakeMuxPortal, UInt, ByteArray) -> Unit = { p, id, bytes -> p.sendStream(id, bytes) },
         clock: () -> Long = { System.nanoTime() / 1_000_000 },
+        setupDelayMillis: Long = 0,
     ): Pair<MuxCarrier, FakeMuxPortal> {
         val (clientSide, portalSide) = LoopbackTransport.pair()
-        val fake = FakeMuxPortal(portalSide, setupResult, onReady, onPayload).also { it.start() }
+        val fake = FakeMuxPortal(portalSide, setupResult, onReady, onPayload, setupDelayMillis).also { it.start() }
         val built = MuxCarrier(clientSide, key, SessionId.random(), clock)
         assertTrue("the carrier failed to start", built.start() is DecodeResult.Ok)
         carrier = built
@@ -291,4 +292,42 @@ class MuxCarrierTest {
         val reason = (openFlow(built, flowId = 0u) as DecodeResult.Invalid).reason
         assertEquals(MuxReason.StreamFlowIdZero, reason)
     }
+
+    @Test
+    fun aPortalThatTakesItsTimeAnsweringIsNotAFailedAuthentication() {
+        // The defect this pins cost three of sixteen concurrent fetches, on a
+        // device, intermittently. `readStream` answers 0 for "nothing in the
+        // last 250 ms", and `open` used to read that as the Portal having
+        // refused — reporting "authentication most likely failed" for a flow
+        // whose answer was merely in flight, then resetting a stream the Portal
+        // was still setting up, at which point the Portal closed the carrier
+        // and took every other flow on it down too.
+        //
+        // 600 ms is comfortably past the poll interval and nowhere near the
+        // deadline, which is the window the old code could not represent.
+        val (built, _) = connect(setupDelayMillis = 600)
+        val opened = built.open(target, FlowKind.Tcp, flowId = 1u)
+        assertTrue(
+            "a Portal that answered after 600 ms was treated as a failure: " +
+                (opened as? DecodeResult.Invalid)?.reason?.detail,
+            opened is DecodeResult.Ok,
+        )
+        assertEquals(SetupResult.Ready, (opened as DecodeResult.Ok).value.setupResult)
+    }
+
+    @Test
+    fun theSetupDeadlineIsTheDedicatedLanesRatherThanAPollInterval() {
+        // Stated as a relation rather than a number: the two are the same
+        // protocol step over the same kind of connection, and the moment they
+        // differ by two orders of magnitude somebody has reused a queue
+        // constant as a protocol timeout.
+        assertTrue(
+            "a setup deadline of ${MuxCarrier.SETUP_DEADLINE_MILLIS} ms is not a protocol deadline",
+            MuxCarrier.SETUP_DEADLINE_MILLIS >= 10_000L,
+        )
+        assertTrue(
+            "the setup deadline must be far longer than a poll interval",
+            MuxCarrier.SETUP_DEADLINE_MILLIS > MuxCarrier.READ_WAIT_MILLIS * 20,
+        )
+    }
 }
@@ -145,17 +145,37 @@ else
     fi
 fi
 
-head2 "3c. An IPv6 destination through the tunnel"
-# Needs an origin the Portal can reach over IPv6. The docker origin
-# e2e-fakeip.sh starts is v4-only, so this is supplied or it is a note --
-# never a silent pass.
-if [ -z "${NOWHERE_E2E_TARGET6:-}" ]; then
-    note "no NOWHERE_E2E_TARGET6 given, so nothing checked that a v6 destination is carried. Set it to [addr]:port of an HTTP origin reachable over IPv6 from the Portal, serving /blob.bin with X-Content-Sha256."
-elif NOWHERE_E2E_CARRIER=tcp "$ROOT/e2e-tunnel-fetch.sh" "$NOWHERE_E2E_TARGET6" /blob.bin > /tmp/somewhere-fetch-v6.log 2>&1; then
+head2 "3c. A synthetic IPv6 address, end to end"
+# The v6 half of the fake-IP layer, proved with nothing but this device: the
+# name is resolved through the tunnel's own resolver, which answers AAAA with an
+# address out of fc00::/96; the packet takes the ::/0 route into the TUN;
+# lwIP's IPv6 side carries it; the address is resolved back to the name; and the
+# Portal dials that name over whichever family its own network prefers. No
+# IPv6 connectivity is needed anywhere outside this device.
+#
+# It needs a NAME rather than an address, because a synthetic address exists
+# only as the answer to a query. NOWHERE_E2E_ORIGIN is that name; without one
+# this says so rather than passing.
+if [ -z "${NOWHERE_E2E_ORIGIN:-}" ]; then
+    note "no NOWHERE_E2E_ORIGIN given, so the v6 half of the fake-IP layer was not exercised. Set it to name:port of an origin only the Portal can resolve — e2e-fakeip.sh starts one at origin.somewhere.test:8080."
+elif NOWHERE_E2E_FAMILY=6 NOWHERE_E2E_CARRIER=tcp "$ROOT/e2e-tunnel-fetch.sh" "$NOWHERE_E2E_ORIGIN" /blob.bin > /tmp/somewhere-fetch-v6.log 2>&1; then
     RELAYED6="$(grep -o 'the Portal relayed [0-9]* bytes' /tmp/somewhere-fetch-v6.log | head -1)"
-    pass "an IPv6 destination is carried — ${RELAYED6:-no counter}"
+    SYNTH="$(grep -o 'resolved to [0-9a-fA-F:]*' /tmp/somewhere-fetch-v6.log | head -1)"
+    pass "a synthetic IPv6 address carried 20 MB — $SYNTH, ${RELAYED6:-no counter}"
+else
+    miss "synthetic IPv6: $(tail -3 /tmp/somewhere-fetch-v6.log | tr '\n' ' ')"
+fi
+
+head2 "3d. A real IPv6 destination through the tunnel"
+# The other half, which this device cannot supply: an origin the Portal reaches
+# over IPv6. Supplied or a note, never a silent pass.
+if [ -z "${NOWHERE_E2E_TARGET6:-}" ]; then
+    note "no NOWHERE_E2E_TARGET6 given, so nothing checked that a genuinely IPv6 destination is carried. Set it to [addr]:port of an HTTP origin reachable over IPv6 from the Portal, serving /blob.bin with X-Content-Sha256."
+elif NOWHERE_E2E_CARRIER=tcp "$ROOT/e2e-tunnel-fetch.sh" "$NOWHERE_E2E_TARGET6" /blob.bin > /tmp/somewhere-fetch-v6dst.log 2>&1; then
+    RELAYED6D="$(grep -o 'the Portal relayed [0-9]* bytes' /tmp/somewhere-fetch-v6dst.log | head -1)"
+    pass "an IPv6 destination is carried — ${RELAYED6D:-no counter}"
 else
-    miss "IPv6 destination: $(tail -3 /tmp/somewhere-fetch-v6.log | tr '\n' ' ')"
+    miss "IPv6 destination: $(tail -3 /tmp/somewhere-fetch-v6dst.log | tr '\n' ' ')"
 fi
 
 # ── 4. The tunnel actually carries traffic ──────────────────────────────────