diff --git a/hkexnet/consts.go b/hkexnet/consts.go
index 4248beb..9b19429 100644
--- a/hkexnet/consts.go
+++ b/hkexnet/consts.go
@@ -45,18 +45,47 @@ const (
 // This indicate channel-related or internal errors
 type CSExtendedCode uint32
 
-// Channel Status Op bytes - to distinguish packet types
+// Channel Status/Op bytes - packet types
 const (
+	// Main connection/session control
 	CSONone        = iota // No error, normal packet
 	CSOHmacInvalid        // HMAC mismatch detected on remote end
 	CSOTermSize           // set term size (rows:cols)
-	CSOTunReq             // client tunnel open request (dstport)
-	CSOTunAck             // server tunnel open ack (tunport)
-	CSOTunData            // packet contains [rport:data]
-	CSOTunClose           // request to close connection (tunnel stays open)
-	CSOTunRefused         // tunnel has died or could not be established to rport
 	CSOExitStatus         // Remote cmd exit status
 	CSOChaff              // Dummy packet, do not pass beyond decryption
+
+	// Tunnel setup/control/status
+	CSOTunSetup    // client -> server tunnel setup request (dstport)
+	CSOTunInUse    // server -> client: tunnel rport is in use
+	CSOTunSetupAck // server -> client tunnel setup ack
+	CSOTunAccept   // client -> server: tunnel client got an Accept()
+	// (Do we need a CSOTunAcceptAck server->client?)
+	CSOTunRefused // server -> client: tunnel rport connection refused
+	CSOTunData    // packet contains tunnel data [rport:data]
+	CSOTunDisconn // server -> client: tunnel rport disconnected
+	CSOTunHangup  // client -> server: tunnel lport hung up
+)
+
+// TunEndpoint.tunCtl control values
+const (
+	TunCtl_AcceptedClient = 'a' // client side has accept()ed a conn
+	// [CSOTunAccept]
+	// status: client listen() worker accepted conn on lport
+	// action:server side should dial() rport on client's behalf
+
+	TunCtl_LostClient = 'h' // client side has hung up
+	// [CSOTunHangup]
+	// status: client side conn hung up from lport
+	// action:server side should hang up on rport, on client's behalf
+
+	TunCtl_ConnRefused = 'r' // server side couldn't complete tunnel
+	// [CSOTunRefused]
+	// status:server side could not dial() remote side
+
+	TunCtl_LostConn = 'l' // server side disconnected
+	// [CSOTunDisconn]
+	// status:server side lost connection to rport
+	// action:client should disconnect accepted lport connection
 )
 
 // Channel status Op byte type
diff --git a/hkexnet/hkexnet.go b/hkexnet/hkexnet.go
index 904770b..e804481 100644
--- a/hkexnet/hkexnet.go
+++ b/hkexnet/hkexnet.go
@@ -810,10 +810,12 @@ func (hc Conn) Read(b []byte) (n int, err error) {
 					hc.SetStatus(CSETruncCSO)
 				}
 				hc.Close()
-			} else if ctrlStatOp == CSOTunReq {
+			} else if ctrlStatOp == CSOTunSetup {
 				// Client wants a tunnel set up - args [lport:rport]
 				lport := binary.BigEndian.Uint16(payloadBytes)
 				rport := binary.BigEndian.Uint16(payloadBytes[2:4])
+				// spawn workers to listen for data and tunnel events
+				// via channel comms to hc.tuns[rport].tunCtl
 				startServerTunnel(&hc, lport, rport)
 			} else if ctrlStatOp == CSOTunData {
 				lport := binary.BigEndian.Uint16(payloadBytes)
diff --git a/hkexnet/hkextun.go b/hkexnet/hkextun.go
index edb9552..259324c 100644
--- a/hkexnet/hkextun.go
+++ b/hkexnet/hkextun.go
@@ -40,9 +40,10 @@ type (
 
 	// TunEndpoint [securePort:peer:dataPort]
 	TunEndpoint struct {
-		Rport uint16 // Names are from client's perspective
-		Lport uint16 // ... ie., RPort is on server, LPort is on client
-		Peer  string //net.Addr
+		Rport  uint16      // Names are from client's perspective
+		Lport  uint16      // ... ie., RPort is on server, LPort is on client
+		Peer   string      //net.Addr
+		tunCtl chan<- rune //See TunCtl_* consts
 	}
 
 	TunPacket struct {
@@ -117,8 +118,8 @@ func startServerTunnel(hc *Conn, lport, rport uint16) {
 		go func() {
 			defer func() {
 				//if hc.tuns[rport] != nil {
-					//close(hc.tuns[rport])
-					//hc.tuns[rport] = nil
+				//close(hc.tuns[rport])
+				//hc.tuns[rport] = nil
 				//}
 				c.Close()
 			}()
@@ -215,8 +216,8 @@ func StartClientTunnel(hc *Conn, lport, rport uint16) {
 								//fmt.Printf("[Got this through tunnel:%v]\n", bytes)
 								c.Write(bytes)
 							} else {
-								fmt.Printf("[Channel closed? exiting client worker!]\n")
-								break
+								fmt.Printf("[Channel closed?]\n")
+								//break
 							}
 						}
 					}()