First server-booting test in the package, on purpose: every other test
here is a pure-function unit test, but the gates' contract is about what
reaches the wire — a refused upgrade gets a literal 403 *before* it
upgrades, the hello frame is never written to a rejected socket, and a
blocked Host costs the upstream zero requests. Raw sockets rather than a
WebSocket client, so the assertions are on first bytes, including the
byte-for-byte deny response.
Replays the #15 reproduction verbatim (cross-origin upgrade to the
control socket), covers Origin: null vs absent-Origin, both upgrade
doors (control socket and HMR tunnel), the IP-literal Host allowance,
LAN unreachability of the default bind, and the widened bind keeping a
clickable localhost URL.
Nayan
10887e7426