diff --git a/CHANGELOG.md b/CHANGELOG.md
index a3a9f5d..0a9f2d5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -34,7 +34,7 @@
   name a refused `NaN` too, where the refusal used to read `null`.
 - An `alert_notification` or an `outbind` from the peer is logged and left unanswered, as SMPP 3.4
   gives neither a response. Each one used to emit `sessionError`, `"alert_notification" has no
-  response command`, and a server did the same for an `outbind` before bind.
+  response command`.
 
 ## 0.5.0
 
diff --git a/test/session.test.ts b/test/session.test.ts
index c0f6c39..3b4de31 100644
--- a/test/session.test.ts
+++ b/test/session.test.ts
@@ -322,19 +322,16 @@ describe('bind', () => {
 
 		smpp.on('session', session => { session.on('sessionError', err => { errors.push(err); }); });
 
-		const responded = once<string>(resolve => {
-			const sock = net.connect({ port: smpp.port }, () => {
-				sock.write(pduBytes({ cmdName: 'outbind', params: { password: 'pass', system_id: 'smsc' }, seqNr: 1 }));
-				sock.write(Buffer.from('00000010000000150000000000000002', 'hex'));
-			});
+		const peer = rawPeer(t, smpp.port);
 
-			sock.on('data', data => {
-				sock.destroy();
-				resolve(data.toString('hex'));
-			});
-		});
+		peer.write({ cmdName: 'outbind', params: { password: 'pass', system_id: 'smsc' }, seqNr: 1 });
+		peer.write({ cmdName: 'enquire_link', seqNr: 2 });
 
-		assert.equal(await responded, '00000010800000150000000400000002');
+		const answered = await raceWithin(2000, peer.next());
+
+		assert.ok(answered, 'the peer was never answered');
+		assert.equal(answered.cmdStatus, 'ESME_RINVBNDSTS');
+		assert.equal(answered.seqNr, 2);
 		assert.deepEqual(errors, []);
 	});
 
@@ -1529,6 +1526,30 @@ describe('robustness', () => {
 		assert.ok(Date.now() - started < 5000, 'should have given up quickly');
 	});
 
+	test('leaves an alert_notification and an outbind unanswered, since SMPP names no response', async t => {
+		const peer = await smscPeer(t);
+		const { session } = await client({ port: peer.port });
+		const errors: Error[] = [];
+
+		assert.ok(session);
+		closeAfter(t, session);
+		session.on('sessionError', err => { errors.push(err); });
+		peer.writeRaw(pduBytes({
+			cmdName: 'alert_notification',
+			params: { esme_addr: '46709771337', source_addr: '46701113311' },
+			seqNr: 10,
+		}));
+		peer.writeRaw(pduBytes({ cmdName: 'outbind', params: { password: 'pass', system_id: 'smsc' }, seqNr: 11 }));
+		peer.writeRaw(pduBytes({ cmdName: 'enquire_link', seqNr: 12 }));
+
+		const answered = await raceWithin(2000, peer.next());
+
+		assert.ok(answered, 'the peer was never answered');
+		assert.equal(answered.cmdName, 'enquire_link_resp');
+		assert.equal(answered.seqNr, 12);
+		assert.deepEqual(errors, []);
+	});
+
 	test('stops a connection attempt on an aborted signal', async () => {
 		const controller = new AbortController();
 
@@ -1814,26 +1835,6 @@ describe('a PDU the codec cannot read', () => {
 		assert.ok((await raceWithin(2000, failed)) instanceof Error, 'one sessionError per refused PDU');
 	});
 
-	test('leaves an alert_notification and an outbind unanswered, since SMPP names no response', async t => {
-		const { peer, session } = await bound(t);
-		const errors: Error[] = [];
-
-		session.on('sessionError', err => { errors.push(err); });
-		peer.writeRaw(pduBytes({
-			cmdName: 'alert_notification',
-			params: { esme_addr: '46709771337', source_addr: '46701113311' },
-			seqNr: 10,
-		}));
-		peer.writeRaw(pduBytes({ cmdName: 'outbind', params: { password: 'pass', system_id: 'smsc' }, seqNr: 11 }));
-		peer.writeRaw(pduBytes({ cmdName: 'enquire_link', seqNr: 12 }));
-
-		const answered = await answerTo(peer);
-
-		assert.equal(answered.cmdName, 'enquire_link_resp');
-		assert.equal(answered.seqNr, 12);
-		assert.deepEqual(errors, []);
-	});
-
 	test('answers a deliver_sm with a truncated TLV stream with ESME_RINVTLVSTREAM', async t => {
 		const { peer, session } = await bound(t);
 		let reports = 0;
diff --git a/todo.md b/todo.md
index 0ecb709..f45351d 100644
--- a/todo.md
+++ b/todo.md
@@ -409,6 +409,11 @@ and is also what the panel ranked hardest — two methods, one answer.
 
 ## Worth doing, not blocking
 
+- [ ] **Decide whether `alert_notification` reaches the application as more than `incomingPduObj`.**
+      It is the SMSC saying a handset it could not reach is reachable again (`esme_addr`,
+      `ms_availability_status`); a client has no `onRequest`, so the raw PDU event is the only way in.
+      Raised by the stability review of #21.
+
 - [ ] **Cut the three teardown sentences `test/teardown.ts` already says.** Under AGENTS.md's
       Conventions, "`test/teardown.ts` covers a session, a server and a listener" restates its two
       exported names, "Its close aborts rather than drains" restates `closeAfter`'s own doc comment,