@fuzdev/fuz_app 0.129.0 → 0.130.0

package/dist/actions/CLAUDE.md

@@ -362,7 +362,7 @@ and `allow_fallback: boolean` (default `true`). Explicit
 - `WS_CLOSE_CLIENT_HEARTBEAT_TIMEOUT = 4002` — client observed receive-silence past its receive timeout (`resolve_heartbeat_receive_timeout`).
 - `WS_CLOSE_SERVER_HEARTBEAT_TIMEOUT = 4003` — server observed receive-silence past `DEFAULT_SERVER_HEARTBEAT_TIMEOUT` (60s).
 - `WS_CLOSE_CONNECTION_LIMIT = 4004` — server closed this socket to admit a newer one on the same account, past the per-account connection cap (reason `connection limit`). Not a revocation: the client stays `closed` with `superseded` set and no reconnect, until `connect()` is called. Twin of the Rust spine's constant.
-- `WS_CLOSE_GOING_AWAY = 1001` — the server is shutting down (reason `WS_CLOSE_GOING_AWAY_REASON`, `Server shutting down`): `close_all_sockets`, which `AppServer.close` runs. Not a revocation: the client reconnects under its ordinary backoff.
+- `WS_CLOSE_GOING_AWAY = 1001` — the server is shutting down (reason `WS_CLOSE_GOING_AWAY_REASON`, `Server shutting down`): `close_all_sockets`, which `AppServer.close` runs. Also the close for an upgrade the shutdown refuses — pending at the close-all, or born closed after it. Not a revocation: the client reconnects under its ordinary backoff.
 - `WS_CLOSE_MESSAGE_TOO_BIG = 1009` — server received a message over its `max_message_bytes` cap (RFC 6455 "Message Too Big").
 - `WS_CLOSE_POLICY_VIOLATION = 1008` — a socket sent too much while it was still opening (before admission and `on_socket_open` completed): past `MAX_PRE_ADMISSION_FRAMES` frames or the `PRE_ADMISSION_QUEUE_BYTES_FACTOR` byte budget.
 - `WS_CLOSE_INTERNAL_ERROR = 1011` — the admission credential re-check itself failed (reason `internal error`), `on_socket_open` threw (reason `socket bootstrap failed`), or the socket's connection was removed from the transport without a close (reason `connection unregistered`). Not a revocation: the client reconnects under its ordinary backoff. Twin of the Rust spine's constant.
@@ -487,7 +487,15 @@ each closed connection's controller):
 
 `close_all_sockets()` closes every connection, pending and admitted, with
 `WS_CLOSE_GOING_AWAY` instead — the shutdown close, removing and aborting each
-the same way.
+the same way — and leaves the transport **closing** for good (`is_closing()`):
+every later registration is **born closed**. `register_pending` and
+`add_connection` then insert nothing, abort the caller's controller, and close
+the socket with `WS_CLOSE_GOING_AWAY` before returning an id that names
+nothing, so `admit` refuses it — an upgrade in flight when the server shuts
+down is closed rather than outliving it. The flag is set in the same
+synchronous step as the closes, so an admission that finds its entry gone
+during shutdown reads the shutdown, never a revocation. Twin of the Rust
+registry's closing flag.
 
 Fan-out, to admitted connections only: `send(notification)` broadcasts to every
 connection; `broadcast_filtered(message, predicate)` runs per-connection ACL
@@ -542,7 +550,10 @@ a `SubscriberRegistry` (`close_all_sockets` is `SubscriberRegistry.close_all`).
 Closing is idempotent and synchronous. `close_all_sockets` is the one method no
 revocation calls: `AppServer.close` runs it on `deps.connection_closer` to end
 every live connection of the backend at shutdown, and it has no
-`ConnectionCloseTarget` variant — nor a counterpart on the Rust
+`ConnectionCloseTarget` variant. It also leaves each member closing — the WS
+transport and `SubscriberRegistry` refuse every later registration (born
+closed) — so a closed transport or registry hosts nothing more. Its Rust
+counterpart is `ShutdownCloser::close_all_sockets`, a supertrait of
 `SocketRevoker`.
 
 **Every revocation closes after its commit.** A handler never calls a closer
@@ -727,6 +738,8 @@ HTTP RPC also calls. `register_action_ws` owns only WS-specific concerns:
 
 - **Wire envelope parsing** — JSON.parse → batch rejection → peer-response routing → envelope-version guard → notification interception (cancel, silent drop) → `JsonrpcRequest.safeParse` → per-message dispatch. The version guard is what makes `{method: 'x'}` and `{jsonrpc: '1.0', method: 'x'}` an `invalid_request` answer rather than a silently dropped notification, matching the first check the Rust `classify` runs. Peer-response routing is the twin's response shape exactly — no `method` key, a string/number `id`, exactly one of `result` / `error` — so a hybrid frame like `{method, id, result}` stays a dispatchable request instead of being demuxed and swallowed. The envelope schema is the same one the HTTP POST path runs, so `params: null`, an array `params`, or a non-string/number `id` answers `invalid_request` (-32600) on both transports rather than reaching the dispatcher as `invalid_params`. It runs **after** the notification/cancel block: notifications carry no id to echo and stay unvalidated, and `cancel` routing precedes it. The version guard echoes the id via `to_jsonrpc_envelope_id` (a scalar frame answers `id: null`), the later steps via `to_jsonrpc_message_id`.
 - **Cancel-notification interception** — `{request_id → AbortController}` map; aborts the matching pending controller before the cancel bubbles past the dispatcher
+- **Duplicate live ids refused** — a request whose id names a request still running on the socket is answered `invalid_request` with `data.reason` `ERROR_DUPLICATE_REQUEST_ID` and not dispatched; the running request keeps its controller, its cancel entry, and its reply id. An id is free again once its request is answered. Same refusal on the Rust spine
+- **In-flight ceiling** — at most `MAX_INBOUND_DISPATCHES_PER_CONNECTION` (128) requests run at once per socket (`@hono/node-ws` does not await `onMessage`, so nothing else bounds them); one more is answered `queue_overflow` (`WS_INBOUND_DISPATCH_OVERFLOW_MESSAGE`) and not dispatched, and the socket stays open and keeps reading — a reply to a server-initiated request still gets through. The duplicate check runs first; neither refusal reaches `perform_action`, so neither charges the action rate limiters. Same cap, message, and order as the Rust spine's `MAX_INBOUND_DISPATCHES_PER_CONN`
 - **Socket-scoped notify** — `(method, params) => ws.send(notification)`, threaded into `perform_action` as `notify`
 - **Composed abort signal** — `AbortSignal.any([socket_close, per_request_cancel])`, threaded as `signal`
 - **Connection lifecycle** — admission (`transport.register_pending` → credential re-read → `transport.admit`, which enforces the per-account connection cap) / `remove_connection`, `on_socket_open` / `_close` hooks, server heartbeat
@@ -741,8 +754,12 @@ audit stream shares, read off the keys the auth middleware set), then
 meanwhile, closes the socket with `WS_CLOSE_SESSION_REVOKED` and the reason a
 revoked socket gets; a re-check that throws closes it with
 `WS_CLOSE_INTERNAL_ERROR` (`internal error`) — fail closed, never admitted
-unchecked. A refused socket gets nothing else written to it, evicts nothing,
-and runs neither lifecycle hook. An upgrade with no resolved credential on its
+unchecked. During shutdown a refusal is the shutdown's instead: an upgrade
+pending at the close-all was closed by it with `WS_CLOSE_GOING_AWAY` and its
+controller aborted, so the refusal after the re-read — even one the closing
+database failed — writes nothing more; an upgrade that registers after it is
+born closed and skips the re-read. A refused socket gets nothing else written
+to it, evicts nothing, and runs neither lifecycle hook. An upgrade with no resolved credential on its
 context, or one on another account than its request context, throws before the
 socket exists. The test-preset escape hatch
 (`TEST_CONTEXT_PRESET_KEY`) skips the re-read — a pre-baked credential has no
@@ -859,7 +876,7 @@ A timeout unregisters the connection and aborts its signal along with the
 Two abort signals composed via `AbortSignal.any`:
 
 - `socket_abort_controller` — per-socket, fires when the socket ends: at the server's close (revocation, cap eviction, heartbeat timeout, …) or the client's. Registered with the transport, which aborts it on the closes it makes. Drives every handler's `ctx.signal`.
-- `pending_controllers: Map<JsonrpcRequestId, AbortController>` — per-request. Registered before dispatch, cleared in `finally` so late cancels for a completed id (or a reused id) can't null-abort the wrong handler. Unknown cancels no-op.
+- `pending_controllers: Map<JsonrpcRequestId, AbortController>` — per-request. Registered before dispatch (one entry per running request — a duplicate live id is refused — so its size is the in-flight count the ceiling bounds), cleared in `finally` so late cancels for a completed id (or a reused id) can't null-abort the wrong handler. Unknown cancels no-op.
 
 ## Protocol actions (`actions/protocol.ts`)
 

package/dist/actions/connection_closer.d.ts

@@ -74,7 +74,9 @@ export interface ConnectionCloser {
      * Close every connection, whoever opened it — the shutdown close
      * `AppServer.close` runs. Not a revocation: a WebSocket gets
      * `WS_CLOSE_GOING_AWAY`, so its client reconnects rather than treating
-     * its credential as revoked.
+     * its credential as revoked. The transport is left closing: a
+     * registration that arrives afterward is born closed, refused at once
+     * (`BackendWebsocketTransport` and `SubscriberRegistry` both do).
      */
     close_all_sockets: () => number;
 }

package/dist/actions/connection_closer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connection_closer.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/connection_closer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAGnD,OAAO,EAAqB,KAAK,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAE5F;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,gBAAgB;IAChC,qGAAqG;IACrG,yBAAyB,EAAE,CAAC,kBAAkB,EAAE,MAAM,KAAK,MAAM,CAAC;IAClE,4EAA4E;IAC5E,uBAAuB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC;IAC1D;;;;OAIG;IACH,yBAAyB,EAAE,CAAC,UAAU,EAAE,IAAI,KAAK,MAAM,CAAC;IACxD;;;;;OAKG;IACH,iBAAiB,EAAE,MAAM,MAAM,CAAC;CAChC;AAED;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAC9B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,IAAI,CAAA;CAAE,CAAC;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,GAC7B,QAAQ,gBAAgB,EACxB,QAAQ,qBAAqB,KAC3B,MAWF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB,GAClC,KAAK,sBAAsB,EAC3B,QAAQ,gBAAgB,EACxB,QAAQ,qBAAqB,KAC3B,IAIF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,gBAKnC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,cAAe,SAAQ,gBAAgB;IACvD;;;;;;;;;;;;;;;OAeG;IACH,GAAG,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,MAAM,IAAI,CAAC;IAC9C,2EAA2E;IAC3E,YAAY,EAAE,MAAM,MAAM,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,QAAO,cA4CzC,CAAC"}
+{"version":3,"file":"connection_closer.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/connection_closer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAGnD,OAAO,EAAqB,KAAK,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAE5F;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,gBAAgB;IAChC,qGAAqG;IACrG,yBAAyB,EAAE,CAAC,kBAAkB,EAAE,MAAM,KAAK,MAAM,CAAC;IAClE,4EAA4E;IAC5E,uBAAuB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC;IAC1D;;;;OAIG;IACH,yBAAyB,EAAE,CAAC,UAAU,EAAE,IAAI,KAAK,MAAM,CAAC;IACxD;;;;;;;OAOG;IACH,iBAAiB,EAAE,MAAM,MAAM,CAAC;CAChC;AAED;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAC9B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,IAAI,CAAA;CAAE,CAAC;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,GAC7B,QAAQ,gBAAgB,EACxB,QAAQ,qBAAqB,KAC3B,MAWF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB,GAClC,KAAK,sBAAsB,EAC3B,QAAQ,gBAAgB,EACxB,QAAQ,qBAAqB,KAC3B,IAIF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,gBAKnC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,cAAe,SAAQ,gBAAgB;IACvD;;;;;;;;;;;;;;;OAeG;IACH,GAAG,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,MAAM,IAAI,CAAC;IAC9C,2EAA2E;IAC3E,YAAY,EAAE,MAAM,MAAM,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,QAAO,cA4CzC,CAAC"}

package/dist/actions/register_action_ws.d.ts

@@ -59,6 +59,14 @@
  * re-read itself failed — fail closed, never admitted unchecked. The handshake
  * has already answered `101`, so a refusal can only be a close frame.
  *
+ * Once the server is shutting down (`AppServer.close` ran the transport's
+ * `close_all_sockets`) a refusal is `WS_CLOSE_GOING_AWAY` instead, so the
+ * client reconnects rather than treating its credential as revoked: an upgrade
+ * pending at the close-all is closed by it — and its abort makes the refusal
+ * that follows the re-read send nothing more, even when the database closed
+ * under that re-read — and one that registers after it is born closed and
+ * skips the re-read (`BackendWebsocketTransport` module doc, "Shutdown").
+ *
  * Frames that arrive before admission are queued, not dispatched: nothing runs
  * on a credential that has not been re-read. They dispatch in arrival order
  * once the socket is admitted and `on_socket_open` has completed, and are
@@ -137,6 +145,38 @@ export declare const PRE_ADMISSION_QUEUE_BYTES_FACTOR = 4;
  * overflows its pre-admission queue, by count or by bytes.
  */
 export declare const WS_CLOSE_PRE_ADMISSION_OVERFLOW_REASON = "too much sent before the socket opened";
+/**
+ * Max requests one socket may have dispatching at once. A request that
+ * arrives past it is answered `queue_overflow` with its id
+ * (`WS_INBOUND_DISPATCH_OVERFLOW_MESSAGE`) and not dispatched; the socket
+ * stays open, and the requests already running keep answering.
+ *
+ * A runtime adapter can hand frames over without awaiting the previous one's
+ * dispatch (`@hono/node-ws` does not await `onMessage`), so without a ceiling
+ * one socket could hold any number of handlers — and their pooled database
+ * work — at once. Shedding rather than queueing keeps the socket reading, so a
+ * reply to a server-initiated request still reaches the handler awaiting it.
+ * Generous, so ordinary pipelining never meets it. Same value as the Rust
+ * spine's `MAX_INBOUND_DISPATCHES_PER_CONN`.
+ *
+ * Counted are the requests that passed envelope validation and are not yet
+ * answered — the entries of the socket's cancellation map. Notifications,
+ * replies to server-initiated requests, and refused frames never count.
+ */
+export declare const MAX_INBOUND_DISPATCHES_PER_CONNECTION = 128;
+/**
+ * The `queue_overflow` message a request gets past
+ * `MAX_INBOUND_DISPATCHES_PER_CONNECTION`. Same text as the Rust spine's.
+ */
+export declare const WS_INBOUND_DISPATCH_OVERFLOW_MESSAGE = "too many concurrent requests on this connection";
+/**
+ * The `data.reason` of the `invalid_request` a WebSocket request gets when its
+ * id names a request still running on the same socket. The duplicate is not
+ * dispatched; the running request keeps its id, so its reply, and a `cancel`
+ * naming that id, stay its own. An id is free again once its request has been
+ * answered.
+ */
+export declare const ERROR_DUPLICATE_REQUEST_ID = "duplicate_request_id";
 /**
  * Context passed to the `on_socket_open` hook.
  *
@@ -339,6 +379,12 @@ export interface RegisterActionWsResult {
  * - Notifications (method + no id) are silently dropped per JSON-RPC spec.
  *   Exception: `cancel` notifications abort the matching pending request's
  *   `ctx.signal` before bubbling out.
+ * - A request whose id names a request still running on the socket is
+ *   answered `invalid_request` with `data.reason` `ERROR_DUPLICATE_REQUEST_ID`
+ *   and not dispatched.
+ * - At most `MAX_INBOUND_DISPATCHES_PER_CONNECTION` requests run at once per
+ *   socket; one more is answered `queue_overflow` and not dispatched, and the
+ *   socket stays open.
  * - Per-message dispatch goes through `perform_action`: pre-authorization
  *   auth (401) → authorization phase → post-authorization auth (403) →
  *   rate limit (429) → input validation (400) → handler (with transaction

package/dist/actions/register_action_ws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register_action_ws.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/register_action_ws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAE3D,OAAO,EAAU,KAAK,MAAM,IAAI,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAWnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAmBtD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAa7D,OAAO,EAAE,yBAAyB,EAAE,KAAK,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAIhG,0EAA0E;AAC1E,eAAO,MAAM,gCAAgC,QAAS,CAAC;AAEvD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAElD;;;GAGG;AACH,eAAO,MAAM,sCAAsC,2CAA2C,CAAC;AAsC/F;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IACjC,qFAAqF;IACrF,EAAE,EAAE,SAAS,CAAC;IACd,8EAA8E;IAC9E,aAAa,EAAE,IAAI,CAAC;IACpB,oDAAoD;IACpD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B;;;OAGG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IAClD;;;;;OAKG;IACH,MAAM,EAAE,WAAW,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB;IAClC;;;;OAIG;IACH,EAAE,EAAE,SAAS,CAAC;IACd,2CAA2C;IAC3C,aAAa,EAAE,IAAI,CAAC;IACpB,8EAA8E;IAC9E,QAAQ,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAsB;IACtC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wCAAwC;AACxC,MAAM,WAAW,uBAAuB;IACvC,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,GAAG,EAAE,IAAI,CAAC;IACV,iEAAiE;IACjE,gBAAgB,EAAE,gBAAgB,CAAC;IACnC;;;;;;;OAOG;IACH,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B;;;;;;;;;OASG;IACH,EAAE,EAAE,EAAE,CAAC;IACP;;;;OAIG;IACH,SAAS,CAAC,EAAE,yBAAyB,CAAC;IACtC;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,EAAE,cAAc,GAAG,IAAI,CAAC;IACzC;;;;;;;;OAQG;IACH,2BAA2B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,sBAAsB,CAAC;IAC7C,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE;;;;;;;;OAQG;IACH,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C;;;;;;OAMG;IACH,2BAA2B,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD;AAED,sCAAsC;AACtC,MAAM,WAAW,sBAAsB;IACtC,yEAAyE;IACzE,SAAS,EAAE,yBAAyB,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,eAAO,MAAM,kBAAkB,GAAI,SAAS,uBAAuB,KAAG,sBAmsBrE,CAAC"}
+{"version":3,"file":"register_action_ws.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/register_action_ws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+FG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAE3D,OAAO,EAAU,KAAK,MAAM,IAAI,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAWnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAmBtD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAa7D,OAAO,EAAE,yBAAyB,EAAE,KAAK,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAIhG,0EAA0E;AAC1E,eAAO,MAAM,gCAAgC,QAAS,CAAC;AAEvD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAElD;;;GAGG;AACH,eAAO,MAAM,sCAAsC,2CAA2C,CAAC;AAE/F;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,qCAAqC,MAAM,CAAC;AAEzD;;;GAGG;AACH,eAAO,MAAM,oCAAoC,oDACC,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,yBAAyB,CAAC;AAsCjE;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IACjC,qFAAqF;IACrF,EAAE,EAAE,SAAS,CAAC;IACd,8EAA8E;IAC9E,aAAa,EAAE,IAAI,CAAC;IACpB,oDAAoD;IACpD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B;;;OAGG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IAClD;;;;;OAKG;IACH,MAAM,EAAE,WAAW,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB;IAClC;;;;OAIG;IACH,EAAE,EAAE,SAAS,CAAC;IACd,2CAA2C;IAC3C,aAAa,EAAE,IAAI,CAAC;IACpB,8EAA8E;IAC9E,QAAQ,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAsB;IACtC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wCAAwC;AACxC,MAAM,WAAW,uBAAuB;IACvC,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,GAAG,EAAE,IAAI,CAAC;IACV,iEAAiE;IACjE,gBAAgB,EAAE,gBAAgB,CAAC;IACnC;;;;;;;OAOG;IACH,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B;;;;;;;;;OASG;IACH,EAAE,EAAE,EAAE,CAAC;IACP;;;;OAIG;IACH,SAAS,CAAC,EAAE,yBAAyB,CAAC;IACtC;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,EAAE,cAAc,GAAG,IAAI,CAAC;IACzC;;;;;;;;OAQG;IACH,2BAA2B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,sBAAsB,CAAC;IAC7C,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE;;;;;;;;OAQG;IACH,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C;;;;;;OAMG;IACH,2BAA2B,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD;AAED,sCAAsC;AACtC,MAAM,WAAW,sBAAsB;IACtC,yEAAyE;IACzE,SAAS,EAAE,yBAAyB,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,eAAO,MAAM,kBAAkB,GAAI,SAAS,uBAAuB,KAAG,sBA4vBrE,CAAC"}

package/dist/actions/register_action_ws.js

@@ -59,6 +59,14 @@
  * re-read itself failed — fail closed, never admitted unchecked. The handshake
  * has already answered `101`, so a refusal can only be a close frame.
  *
+ * Once the server is shutting down (`AppServer.close` ran the transport's
+ * `close_all_sockets`) a refusal is `WS_CLOSE_GOING_AWAY` instead, so the
+ * client reconnects rather than treating its credential as revoked: an upgrade
+ * pending at the close-all is closed by it — and its abort makes the refusal
+ * that follows the re-read send nothing more, even when the database closed
+ * under that re-read — and one that registers after it is born closed and
+ * skips the re-read (`BackendWebsocketTransport` module doc, "Shutdown").
+ *
  * Frames that arrive before admission are queued, not dispatched: nothing runs
  * on a credential that has not been re-read. They dispatch in arrival order
  * once the socket is admitted and `on_socket_open` has completed, and are
@@ -145,6 +153,38 @@ export const PRE_ADMISSION_QUEUE_BYTES_FACTOR = 4;
  * overflows its pre-admission queue, by count or by bytes.
  */
 export const WS_CLOSE_PRE_ADMISSION_OVERFLOW_REASON = 'too much sent before the socket opened';
+/**
+ * Max requests one socket may have dispatching at once. A request that
+ * arrives past it is answered `queue_overflow` with its id
+ * (`WS_INBOUND_DISPATCH_OVERFLOW_MESSAGE`) and not dispatched; the socket
+ * stays open, and the requests already running keep answering.
+ *
+ * A runtime adapter can hand frames over without awaiting the previous one's
+ * dispatch (`@hono/node-ws` does not await `onMessage`), so without a ceiling
+ * one socket could hold any number of handlers — and their pooled database
+ * work — at once. Shedding rather than queueing keeps the socket reading, so a
+ * reply to a server-initiated request still reaches the handler awaiting it.
+ * Generous, so ordinary pipelining never meets it. Same value as the Rust
+ * spine's `MAX_INBOUND_DISPATCHES_PER_CONN`.
+ *
+ * Counted are the requests that passed envelope validation and are not yet
+ * answered — the entries of the socket's cancellation map. Notifications,
+ * replies to server-initiated requests, and refused frames never count.
+ */
+export const MAX_INBOUND_DISPATCHES_PER_CONNECTION = 128;
+/**
+ * The `queue_overflow` message a request gets past
+ * `MAX_INBOUND_DISPATCHES_PER_CONNECTION`. Same text as the Rust spine's.
+ */
+export const WS_INBOUND_DISPATCH_OVERFLOW_MESSAGE = 'too many concurrent requests on this connection';
+/**
+ * The `data.reason` of the `invalid_request` a WebSocket request gets when its
+ * id names a request still running on the same socket. The duplicate is not
+ * dispatched; the running request keeps its id, so its reply, and a `cancel`
+ * naming that id, stay its own. An id is free again once its request has been
+ * answered.
+ */
+export const ERROR_DUPLICATE_REQUEST_ID = 'duplicate_request_id';
 /** Send one JSON-RPC error response frame on `ws`. */
 const send_error_response = (ws, id, error) => {
     ws.send(JSON.stringify(create_jsonrpc_error_response(id, error)));
@@ -187,6 +227,12 @@ const is_peer_response = (json) => {
  * - Notifications (method + no id) are silently dropped per JSON-RPC spec.
  *   Exception: `cancel` notifications abort the matching pending request's
  *   `ctx.signal` before bubbling out.
+ * - A request whose id names a request still running on the socket is
+ *   answered `invalid_request` with `data.reason` `ERROR_DUPLICATE_REQUEST_ID`
+ *   and not dispatched.
+ * - At most `MAX_INBOUND_DISPATCHES_PER_CONNECTION` requests run at once per
+ *   socket; one more is answered `queue_overflow` and not dispatched, and the
+ *   socket stays open.
  * - Per-message dispatch goes through `perform_action`: pre-authorization
  *   auth (401) → authorization phase → post-authorization auth (403) →
  *   rate limit (429) → input validation (400) → handler (with transaction
@@ -333,7 +379,10 @@ export const register_action_ws = (options) => {
         // Populated on request dispatch, cleared in the handler's `finally`
         // so a late-arriving cancel for a completed id (or a reused id)
         // can't null-abort a freshly-arrived request. Idempotent: cancel
-        // for unknown ids no-ops.
+        // for unknown ids no-ops. One entry per running request — a
+        // request reusing a live id is refused before it gets one — so its
+        // size is the in-flight count `MAX_INBOUND_DISPATCHES_PER_CONNECTION`
+        // bounds.
         const pending_controllers = new Map();
         // Identity is assembled at upgrade time so `on_socket_close` can
         // read it — by the time the hook runs the transport record is gone,
@@ -407,8 +456,10 @@ export const register_action_ws = (options) => {
             }
         };
         // Refuse an upgrade at admission. A socket that already ended needs no
-        // close frame: either a revocation closed its pending registration (the
-        // transport sent the 4001) or the client went away.
+        // close frame: a revocation closed its pending registration (the
+        // transport sent the 4001), the shutdown did (the 1001 — so a refusal
+        // during shutdown never sends a revocation's or a failure's code), or
+        // the client went away.
         const refuse_upgrade = (ws, code, reason) => {
             if (captured_connection_id !== undefined) {
                 transport.remove_connection(captured_connection_id);
@@ -435,6 +486,17 @@ export const register_action_ws = (options) => {
             // Pending first, synchronously: from here every revocation finds it.
             const connection_id = transport.register_pending(ws, token_hash, account_id, api_token_id, socket_abort_controller);
             captured_connection_id = connection_id;
+            // Born closed — the server is shutting down, and the transport has
+            // already closed the socket with `WS_CLOSE_GOING_AWAY` — or ended
+            // otherwise before the re-read: nothing to re-read for. The removal
+            // is a no-op for a born-closed registration, which was never inserted.
+            if (socket_abort_controller.signal.aborted) {
+                transport.remove_connection(connection_id);
+                log.info(transport.is_closing()
+                    ? 'ws upgrade admission: refused, the server is shutting down'
+                    : 'ws upgrade admission: socket ended before the re-check', connection_id, account_id);
+                return null;
+            }
             if (!upgrade_preset) {
                 let credential_is_live;
                 try {
@@ -443,8 +505,15 @@ export const register_action_ws = (options) => {
                     credential_is_live = await revalidate_resolved_auth({ db }, resolved);
                 }
                 catch (error) {
-                    // fail closed — never admitted unchecked
-                    log.error('ws upgrade admission: credential re-check failed', error);
+                    // fail closed — never admitted unchecked. During shutdown the
+                    // database may close under the re-read; that is the shutdown's
+                    // refusal, not a failure.
+                    if (transport.is_closing()) {
+                        log.info('ws upgrade admission: re-check ended by the shutdown', error);
+                    }
+                    else {
+                        log.error('ws upgrade admission: credential re-check failed', error);
+                    }
                     refuse_upgrade(ws, WS_CLOSE_INTERNAL_ERROR, 'internal error');
                     return null;
                 }
@@ -457,7 +526,9 @@ export const register_action_ws = (options) => {
             // The cap's eviction happens here, after every gate and the re-read,
             // so a refused upgrade never closes someone else's socket.
             if (!transport.admit(connection_id)) {
-                log.info('ws upgrade admission: closed by a revocation while pending', connection_id, account_id);
+                log.info(transport.is_closing()
+                    ? 'ws upgrade admission: closed by the shutdown while pending'
+                    : 'ws upgrade admission: closed by a revocation while pending', connection_id, account_id);
                 refuse_upgrade(ws, WS_CLOSE_SESSION_REVOKED, WS_CLOSE_SESSION_REVOKED_REASON);
                 return null;
             }
@@ -614,6 +685,24 @@ export const register_action_ws = (options) => {
                 return;
             }
             const { method, id, params } = envelope.data;
+            // A request is live from here until its reply is sent. One reusing
+            // a live id is refused rather than dispatched: two requests under
+            // one id would share a cancel entry and a reply id, and the first to
+            // finish would clear the other's. Checked before the ceiling — a
+            // duplicate is the client's error whatever the load, and retrying it
+            // cannot succeed while the first runs. Neither refusal reaches
+            // `perform_action`, so neither charges the action rate limiters —
+            // the same on the Rust spine.
+            if (pending_controllers.has(id)) {
+                send_error_response(ws, id, jsonrpc_error_messages.invalid_request({ reason: ERROR_DUPLICATE_REQUEST_ID }));
+                return;
+            }
+            // The in-flight ceiling: shed, don't queue — see
+            // `MAX_INBOUND_DISPATCHES_PER_CONNECTION`.
+            if (pending_controllers.size >= MAX_INBOUND_DISPATCHES_PER_CONNECTION) {
+                send_error_response(ws, id, jsonrpc_error_messages.queue_overflow(WS_INBOUND_DISPATCH_OVERFLOW_MESSAGE));
+                return;
+            }
             // Per-action method lookup — return method_not_found before
             // we engage the dispatch machinery. Specs without a handler
             // (client-only / dispatcher-handled) miss action_map and
@@ -623,16 +712,14 @@ export const register_action_ws = (options) => {
                 send_error_response(ws, id, jsonrpc_error_messages.method_not_found(method));
                 return;
             }
-            if (artificial_delay > 0) {
-                log.debug(`throttling ${artificial_delay}ms`);
-                await wait(artificial_delay);
-            }
             // Per-request controller — fires on explicit `cancel` or when the
             // socket ends (via the socket_abort_controller chain below).
-            // Registered before dispatch so a cancel arriving mid-handler
-            // finds it; cleared in `finally` so late cancels for a
-            // completed id (or a future request that reuses the id) can't
-            // null-abort the wrong handler.
+            // Registered before dispatch — ahead of `artificial_delay` too, so
+            // the request is live (counted, and its id taken) from the moment
+            // it is accepted — so a cancel arriving mid-handler finds it;
+            // cleared in `finally` so late cancels for a completed id (or a
+            // future request that reuses the id) can't null-abort the wrong
+            // handler.
             const request_controller = new AbortController();
             pending_controllers.set(id, request_controller);
             // Per-message side-effect queues. `pending_effects` collects
@@ -669,6 +756,10 @@ export const register_action_ws = (options) => {
             const request_client = (request_method, request_params, request_options) => transport.request_connection(connection_id, request_method, request_params, request_options);
             const signal = AbortSignal.any([socket_abort_controller.signal, request_controller.signal]);
             try {
+                if (artificial_delay > 0) {
+                    log.debug(`throttling ${artificial_delay}ms`);
+                    await wait(artificial_delay);
+                }
                 const result = await perform_action({
                     action,
                     raw_params: params,

package/dist/actions/transports.d.ts

@@ -42,7 +42,8 @@ export declare const WS_CLOSE_CONNECTION_LIMIT = 4004;
 /**
  * WebSocket close code — the server is shutting down (RFC 6455 §7.4.1 "Going
  * Away"). Sent to every live socket by `close_all_sockets`, which
- * `AppServer.close` runs. Not a revocation: the credential is still good, so a
+ * `AppServer.close` runs, and to an upgrade the shutdown refuses — one
+ * pending at the close-all, or born closed after it. Not a revocation: the credential is still good, so a
  * client reconnects under its ordinary backoff once a server is back.
  */
 export declare const WS_CLOSE_GOING_AWAY = 1001;

package/dist/actions/transports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transports.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/transports.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EACX,gCAAgC,EAChC,gCAAgC,EAChC,mBAAmB,EACnB,cAAc,EACd,sBAAsB,EACtB,oBAAoB,EACpB,MAAM,oBAAoB,CAAC;AAE5B;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAC7C;;;;GAIG;AACH,eAAO,MAAM,+BAA+B,oBAAoB,CAAC;AACjE,sEAAsE;AACtE,eAAO,MAAM,iCAAiC,OAAO,CAAC;AACtD,yEAAyE;AACzE,eAAO,MAAM,iCAAiC,OAAO,CAAC;AACtD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAC9C;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,OAAO,CAAC;AACxC,wDAAwD;AACxD,eAAO,MAAM,0BAA0B,yBAAyB,CAAC;AACjE;;;GAGG;AACH,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAC7C;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAC9C;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,QAAc,CAAC;AAIxD;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,EAAE,WAAW,MAAM,KAAG,MAAM,GAAG,IAI3E,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,MAAM,MAAM,KAAG,MAA8C,CAAC;AAK1F,eAAO,MAAM,aAAa,aAAa,CAAC;AACxC,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACpC;;;;;OAKG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACzB,cAAc,EAAE,aAAa,CAAC;IAE9B,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/F,IAAI,CACH,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IACxC,IAAI,CACH,OAAO,EAAE,gCAAgC,EACzC,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,gCAAgC,GAAG,IAAI,CAAC,CAAC;IACpD,QAAQ,EAAE,MAAM,OAAO,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;CACrB;AAED,qBAAa,UAAU;;IAItB;;;OAGG;IACH,cAAc,EAAE,OAAO,CAAQ;IAE/B;;;;;OAKG;IACH,kBAAkB,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI;IAQ9C;;;;;OAKG;IACH,qBAAqB,CAAC,cAAc,EAAE,aAAa,GAAG,IAAI;IAM1D;;;;;;OAMG;IACH,aAAa,CAAC,cAAc,CAAC,EAAE,aAAa,GAAG,SAAS,GAAG,IAAI;IAO/D,QAAQ,IAAI,OAAO,GAAG,IAAI;IAM1B,qBAAqB,IAAI,SAAS,GAAG,IAAI;IAIzC,0BAA0B,IAAI,aAAa,GAAG,IAAI;IAIlD,qBAAqB,CAAC,cAAc,EAAE,aAAa,GAAG,SAAS,GAAG,IAAI;CAwCtE"}
+{"version":3,"file":"transports.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/transports.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EACX,gCAAgC,EAChC,gCAAgC,EAChC,mBAAmB,EACnB,cAAc,EACd,sBAAsB,EACtB,oBAAoB,EACpB,MAAM,oBAAoB,CAAC;AAE5B;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAC7C;;;;GAIG;AACH,eAAO,MAAM,+BAA+B,oBAAoB,CAAC;AACjE,sEAAsE;AACtE,eAAO,MAAM,iCAAiC,OAAO,CAAC;AACtD,yEAAyE;AACzE,eAAO,MAAM,iCAAiC,OAAO,CAAC;AACtD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAC9C;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,OAAO,CAAC;AACxC,wDAAwD;AACxD,eAAO,MAAM,0BAA0B,yBAAyB,CAAC;AACjE;;;GAGG;AACH,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAC7C;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAC9C;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,QAAc,CAAC;AAIxD;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,EAAE,WAAW,MAAM,KAAG,MAAM,GAAG,IAI3E,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,MAAM,MAAM,KAAG,MAA8C,CAAC;AAK1F,eAAO,MAAM,aAAa,aAAa,CAAC;AACxC,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACpC;;;;;OAKG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACzB,cAAc,EAAE,aAAa,CAAC;IAE9B,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/F,IAAI,CACH,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IACxC,IAAI,CACH,OAAO,EAAE,gCAAgC,EACzC,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,gCAAgC,GAAG,IAAI,CAAC,CAAC;IACpD,QAAQ,EAAE,MAAM,OAAO,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;CACrB;AAED,qBAAa,UAAU;;IAItB;;;OAGG;IACH,cAAc,EAAE,OAAO,CAAQ;IAE/B;;;;;OAKG;IACH,kBAAkB,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI;IAQ9C;;;;;OAKG;IACH,qBAAqB,CAAC,cAAc,EAAE,aAAa,GAAG,IAAI;IAM1D;;;;;;OAMG;IACH,aAAa,CAAC,cAAc,CAAC,EAAE,aAAa,GAAG,SAAS,GAAG,IAAI;IAO/D,QAAQ,IAAI,OAAO,GAAG,IAAI;IAM1B,qBAAqB,IAAI,SAAS,GAAG,IAAI;IAIzC,0BAA0B,IAAI,aAAa,GAAG,IAAI;IAIlD,qBAAqB,CAAC,cAAc,EAAE,aAAa,GAAG,SAAS,GAAG,IAAI;CAwCtE"}

package/dist/actions/transports.js

@@ -41,7 +41,8 @@ export const WS_CLOSE_CONNECTION_LIMIT = 4004;
 /**
  * WebSocket close code — the server is shutting down (RFC 6455 §7.4.1 "Going
  * Away"). Sent to every live socket by `close_all_sockets`, which
- * `AppServer.close` runs. Not a revocation: the credential is still good, so a
+ * `AppServer.close` runs, and to an upgrade the shutdown refuses — one
+ * pending at the close-all, or born closed after it. Not a revocation: the credential is still good, so a
  * client reconnects under its ordinary backoff once a server is back.
  */
 export const WS_CLOSE_GOING_AWAY = 1001;

package/dist/actions/transports_ws_backend.d.ts

@@ -44,6 +44,21 @@
  * uses the two-phase form. The twin of the Rust `fuz_realtime`
  * `ConnectionRegistry`.
  *
+ * ## Shutdown
+ *
+ * `close_all_sockets` — the close `AppServer.close` runs — closes every
+ * connection, pending or admitted, with `WS_CLOSE_GOING_AWAY`, and leaves the
+ * transport **closing**: from then on every registration is born closed. A
+ * `register_pending` or `add_connection` inserts nothing — it aborts the
+ * caller's controller and closes the socket with `WS_CLOSE_GOING_AWAY` at once
+ * — so an upgrade still in flight when the server shuts down is closed rather
+ * than outliving it. An upgrade registered before the close-all is closed by
+ * it; one registered after is born closed; none is admitted. The flag is set
+ * in the same synchronous step that closes the live connections, so an `admit`
+ * that finds its entry gone and reads `is_closing()` sees the shutdown, never
+ * a revocation. Closing is permanent: a closed transport hosts no further
+ * connections.
+ *
  * @module
  */
 import type { WSContext } from 'hono/ws';
@@ -142,6 +157,11 @@ export declare class BackendWebsocketTransport implements FilterableBroadcastTra
      * The caller owns the entry until it is admitted: every refusal path calls
      * `remove_connection` with the returned id.
      *
+     * Once the transport is closing (`close_all_sockets`) the registration is
+     * born closed: nothing is inserted, `abort_controller` is aborted, and `ws`
+     * is closed with `WS_CLOSE_GOING_AWAY` before this returns. The id names
+     * nothing, so `admit` refuses it (module doc, "Shutdown").
+     *
      * @param ws - the socket to close on revocation
      * @param token_hash - blake3 session token hash, or `null` for non-session credentials
      * @param account_id - the authenticated account
@@ -149,7 +169,8 @@ export declare class BackendWebsocketTransport implements FilterableBroadcastTra
      * @param abort_controller - the socket-scoped controller to abort when the
      *   transport closes this connection (revocation or cap eviction)
      * @returns the freshly assigned `connection_id` (branded `Uuid`)
-     * @mutates this - inserts an un-admitted entry into `#connections`
+     * @mutates this - inserts an un-admitted entry into `#connections`, unless
+     *   the transport is closing
      */
     register_pending(ws: WSContext, token_hash: string | null, account_id: Uuid, api_token_id?: string | null, abort_controller?: AbortController | null): Uuid;
     /**
@@ -192,7 +213,8 @@ export declare class BackendWebsocketTransport implements FilterableBroadcastTra
      * inserted. A removed connection gets no further broadcast or peer request,
      * stops counting toward the cap at once, and has its `abort_controller`
      * aborted; its socket is closed when the close handshake completes. The new
-     * connection is always admitted.
+     * connection is always admitted — unless the transport is closing: then it
+     * is born closed, as in `register_pending`, and evicts nothing.
      *
      * @returns the freshly assigned `connection_id` (branded `Uuid`)
      * @mutates this - inserts an admitted entry into `#connections`; past the
@@ -261,12 +283,23 @@ export declare class BackendWebsocketTransport implements FilterableBroadcastTra
      * revocation does, so its heartbeat timer stops and nothing more dispatches
      * on it. A socket whose `close` throws does not stop the loop.
      *
+     * Leaves the transport closing, for good: every later registration is born
+     * closed (module doc, "Shutdown"). A second call closes nothing.
+     *
      * @returns the number of sockets closed
-     * @mutates this - removes every connection, aborts its registered
-     *   controller, and closes its underlying `WSContext` with `WS_CLOSE_GOING_AWAY`
+     * @mutates this - sets the transport closing, removes every connection,
+     *   aborts its registered controller, and closes its underlying `WSContext`
+     *   with `WS_CLOSE_GOING_AWAY`
      * @throws the first error a socket's `close` threw, after every connection was attempted
      */
     close_all_sockets(): number;
+    /**
+     * Whether `close_all_sockets` has run — the transport is shutting down and
+     * every registration from now on is born closed (module doc, "Shutdown").
+     * For telemetry and logs: `register_action_ws` reads it to say why an
+     * upgrade was refused.
+     */
+    is_closing(): boolean;
     send(message: JsonrpcRequest, options?: TransportSendOptions): Promise<JsonrpcResponseOrError>;
     send(message: JsonrpcNotification, options?: TransportSendOptions): Promise<JsonrpcErrorResponse | null>;
     /**

package/dist/actions/transports_ws_backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transports_ws_backend.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/transports_ws_backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzC,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,EAAe,KAAK,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAEhE,OAAO,KAAK,EAEX,gCAAgC,EAChC,mBAAmB,EACnB,cAAc,EACd,oBAAoB,EACpB,eAAe,EACf,sBAAsB,EACtB,oBAAoB,EACpB,MAAM,oBAAoB,CAAC;AAQ5B,OAAO,EAMN,KAAK,SAAS,EACd,KAAK,oBAAoB,EACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEN,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,MAAM,mBAAmB,CAAC;AAI3B;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IAClC,sEAAsE;IACtE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,4CAA4C;IAC5C,UAAU,EAAE,IAAI,CAAC;IACjB,sEAAsE;IACtE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,4BAA6B,SAAQ,SAAS;IAC9D,kBAAkB,EAAE,CACnB,OAAO,EAAE,gCAAgC,EACzC,SAAS,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,OAAO,KAChD,MAAM,CAAC;CACZ;AAED,qDAAqD;AACrD,eAAO,MAAM,iCAAiC,GAC7C,WAAW,SAAS,KAClB,SAAS,IAAI,4BAEqE,CAAC;AAEtF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mCAAmC,KAAK,CAAC;AAEtD,+CAA+C;AAC/C,MAAM,WAAW,gCAAgC;IAChD;;;;;;;;;;;;;;OAcG;IACH,2BAA2B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB;AAqBD,qBAAa,yBAA0B,YAAW,4BAA4B;;IAC7E,QAAQ,CAAC,cAAc,EAAG,uBAAuB,CAAU;IAkB3D;;;OAGG;gBACS,OAAO,CAAC,EAAE,gCAAgC;IActD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,gBAAgB,CACf,EAAE,EAAE,SAAS,EACb,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,UAAU,EAAE,IAAI,EAChB,YAAY,GAAE,MAAM,GAAG,IAAW,EAClC,gBAAgB,GAAE,eAAe,GAAG,IAAW,GAC7C,IAAI;IAIP;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,aAAa,EAAE,IAAI,GAAG,OAAO;IAanC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,cAAc,CACb,EAAE,EAAE,SAAS,EACb,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,UAAU,EAAE,IAAI,EAChB,YAAY,GAAE,MAAM,GAAG,IAAW,EAClC,gBAAgB,GAAE,eAAe,GAAG,IAAW,GAC7C,IAAI;IAyBP;;;;;;;;;;;;;;;;OAgBG;IACH,iBAAiB,CAAC,aAAa,EAAE,IAAI,GAAG,IAAI;IA8C5C;;;;;;;;OAQG;IACH,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;IAIrD;;;;;;;;OAQG;IACH,yBAAyB,CAAC,UAAU,EAAE,IAAI,GAAG,MAAM;IAInD;;;;;;;;;;;;OAYG;IACH,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM;IAIrD;;;;;;;;;;;;;OAaG;IACH,iBAAiB,IAAI,MAAM;IA4DrB,IAAI,CACT,OAAO,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAC5B,IAAI,CACT,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IA2CvC;;;;;;;;;;OAUG;IACH,kBAAkB,CACjB,OAAO,EAAE,gCAAgC,EACzC,SAAS,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,OAAO,GAClD,MAAM;IAeT;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,gCAAgC,GAAG,MAAM;IAIpF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,kBAAkB,CACjB,aAAa,EAAE,IAAI,EACnB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,oBAAoB,GAAG,SAAS,EACxC,OAAO,CAAC,EAAE,kBAAkB,GAC1B,OAAO,CAAC,kBAAkB,CAAC;IAqB9B;;;;;;;;;;OAUG;IACH,qBAAqB,CACpB,aAAa,EAAE,IAAI,EACnB,QAAQ,EAAE,eAAe,GAAG,oBAAoB,GAC9C,OAAO;IAIV;;;;;;;;;OASG;IACH,aAAa,CAAC,aAAa,EAAE,IAAI,GAAG,OAAO;IAI3C,QAAQ,IAAI,OAAO;IAInB;;;;;;;;OAQG;IACH,oBAAoB,IAAI,MAAM;IAQ9B;;;;;OAKG;IACH,4BAA4B,IAAI,MAAM;CAOtC"}
+{"version":3,"file":"transports_ws_backend.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/transports_ws_backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzC,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,EAAe,KAAK,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAEhE,OAAO,KAAK,EAEX,gCAAgC,EAChC,mBAAmB,EACnB,cAAc,EACd,oBAAoB,EACpB,eAAe,EACf,sBAAsB,EACtB,oBAAoB,EACpB,MAAM,oBAAoB,CAAC;AAQ5B,OAAO,EAMN,KAAK,SAAS,EACd,KAAK,oBAAoB,EACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEN,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,MAAM,mBAAmB,CAAC;AAI3B;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IAClC,sEAAsE;IACtE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,4CAA4C;IAC5C,UAAU,EAAE,IAAI,CAAC;IACjB,sEAAsE;IACtE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,4BAA6B,SAAQ,SAAS;IAC9D,kBAAkB,EAAE,CACnB,OAAO,EAAE,gCAAgC,EACzC,SAAS,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,OAAO,KAChD,MAAM,CAAC;CACZ;AAED,qDAAqD;AACrD,eAAO,MAAM,iCAAiC,GAC7C,WAAW,SAAS,KAClB,SAAS,IAAI,4BAEqE,CAAC;AAEtF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mCAAmC,KAAK,CAAC;AAEtD,+CAA+C;AAC/C,MAAM,WAAW,gCAAgC;IAChD;;;;;;;;;;;;;;OAcG;IACH,2BAA2B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB;AAqBD,qBAAa,yBAA0B,YAAW,4BAA4B;;IAC7E,QAAQ,CAAC,cAAc,EAAG,uBAAuB,CAAU;IAsB3D;;;OAGG;gBACS,OAAO,CAAC,EAAE,gCAAgC;IActD;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,gBAAgB,CACf,EAAE,EAAE,SAAS,EACb,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,UAAU,EAAE,IAAI,EAChB,YAAY,GAAE,MAAM,GAAG,IAAW,EAClC,gBAAgB,GAAE,eAAe,GAAG,IAAW,GAC7C,IAAI;IAKP;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,aAAa,EAAE,IAAI,GAAG,OAAO;IAanC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,cAAc,CACb,EAAE,EAAE,SAAS,EACb,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,UAAU,EAAE,IAAI,EAChB,YAAY,GAAE,MAAM,GAAG,IAAW,EAClC,gBAAgB,GAAE,eAAe,GAAG,IAAW,GAC7C,IAAI;IA0BP;;;;;;;;;;;;;;;;OAgBG;IACH,iBAAiB,CAAC,aAAa,EAAE,IAAI,GAAG,IAAI;IA8C5C;;;;;;;;OAQG;IACH,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;IAIrD;;;;;;;;OAQG;IACH,yBAAyB,CAAC,UAAU,EAAE,IAAI,GAAG,MAAM;IAInD;;;;;;;;;;;;OAYG;IACH,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM;IAIrD;;;;;;;;;;;;;;;;;OAiBG;IACH,iBAAiB,IAAI,MAAM;IAQ3B;;;;;OAKG;IACH,UAAU,IAAI,OAAO;IA8Ef,IAAI,CACT,OAAO,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAC5B,IAAI,CACT,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IA2CvC;;;;;;;;;;OAUG;IACH,kBAAkB,CACjB,OAAO,EAAE,gCAAgC,EACzC,SAAS,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,OAAO,GAClD,MAAM;IAeT;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,gCAAgC,GAAG,MAAM;IAIpF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,kBAAkB,CACjB,aAAa,EAAE,IAAI,EACnB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,oBAAoB,GAAG,SAAS,EACxC,OAAO,CAAC,EAAE,kBAAkB,GAC1B,OAAO,CAAC,kBAAkB,CAAC;IAqB9B;;;;;;;;;;OAUG;IACH,qBAAqB,CACpB,aAAa,EAAE,IAAI,EACnB,QAAQ,EAAE,eAAe,GAAG,oBAAoB,GAC9C,OAAO;IAIV;;;;;;;;;OASG;IACH,aAAa,CAAC,aAAa,EAAE,IAAI,GAAG,OAAO;IAI3C,QAAQ,IAAI,OAAO;IAInB;;;;;;;;OAQG;IACH,oBAAoB,IAAI,MAAM;IAQ9B;;;;;OAKG;IACH,4BAA4B,IAAI,MAAM;CAOtC"}

package/dist/actions/transports_ws_backend.js

@@ -44,6 +44,21 @@
  * uses the two-phase form. The twin of the Rust `fuz_realtime`
  * `ConnectionRegistry`.
  *
+ * ## Shutdown
+ *
+ * `close_all_sockets` — the close `AppServer.close` runs — closes every
+ * connection, pending or admitted, with `WS_CLOSE_GOING_AWAY`, and leaves the
+ * transport **closing**: from then on every registration is born closed. A
+ * `register_pending` or `add_connection` inserts nothing — it aborts the
+ * caller's controller and closes the socket with `WS_CLOSE_GOING_AWAY` at once
+ * — so an upgrade still in flight when the server shuts down is closed rather
+ * than outliving it. An upgrade registered before the close-all is closed by
+ * it; one registered after is born closed; none is admitted. The flag is set
+ * in the same synchronous step that closes the live connections, so an `admit`
+ * that finds its entry gone and reads `is_closing()` sees the shutdown, never
+ * a revocation. Closing is permanent: a closed transport hosts no further
+ * connections.
+ *
  * @module
  */
 import { to_error_message } from '@fuzdev/fuz_util/error.ts';
@@ -78,6 +93,9 @@ export class BackendWebsocketTransport {
     // "oldest"). Adding a new identity scope (e.g. `device_id`) means adding a
     // field to `ConnectionIdentity`, not a parallel map.
     #connections = new Map();
+    // set once by `close_all_sockets`, never cleared — every later
+    // registration is born closed (module doc, "Shutdown")
+    #closing = false;
     // Server→client request correlation (ActionPeer). The transport owns the
     // sockets + the send; the registry owns the pending map, id allocation,
     // deadlines, and the per-connection in-flight cap (see `peer_request.ts`).
@@ -109,6 +127,11 @@ export class BackendWebsocketTransport {
      * The caller owns the entry until it is admitted: every refusal path calls
      * `remove_connection` with the returned id.
      *
+     * Once the transport is closing (`close_all_sockets`) the registration is
+     * born closed: nothing is inserted, `abort_controller` is aborted, and `ws`
+     * is closed with `WS_CLOSE_GOING_AWAY` before this returns. The id names
+     * nothing, so `admit` refuses it (module doc, "Shutdown").
+     *
      * @param ws - the socket to close on revocation
      * @param token_hash - blake3 session token hash, or `null` for non-session credentials
      * @param account_id - the authenticated account
@@ -116,9 +139,12 @@ export class BackendWebsocketTransport {
      * @param abort_controller - the socket-scoped controller to abort when the
      *   transport closes this connection (revocation or cap eviction)
      * @returns the freshly assigned `connection_id` (branded `Uuid`)
-     * @mutates this - inserts an un-admitted entry into `#connections`
+     * @mutates this - inserts an un-admitted entry into `#connections`, unless
+     *   the transport is closing
      */
     register_pending(ws, token_hash, account_id, api_token_id = null, abort_controller = null) {
+        if (this.#closing)
+            return this.#close_born_closed(ws, abort_controller);
         return this.#insert(ws, token_hash, account_id, api_token_id, abort_controller, false);
     }
     /**
@@ -174,7 +200,8 @@ export class BackendWebsocketTransport {
      * inserted. A removed connection gets no further broadcast or peer request,
      * stops counting toward the cap at once, and has its `abort_controller`
      * aborted; its socket is closed when the close handshake completes. The new
-     * connection is always admitted.
+     * connection is always admitted — unless the transport is closing: then it
+     * is born closed, as in `register_pending`, and evicts nothing.
      *
      * @returns the freshly assigned `connection_id` (branded `Uuid`)
      * @mutates this - inserts an admitted entry into `#connections`; past the
@@ -182,6 +209,8 @@ export class BackendWebsocketTransport {
      *   their `WSContext`
      */
     add_connection(ws, token_hash, account_id, api_token_id = null, abort_controller = null) {
+        if (this.#closing)
+            return this.#close_born_closed(ws, abort_controller);
         if (this.#max_connections_per_account !== null) {
             this.#evict_oldest_for_account(account_id, this.#max_connections_per_account);
         }
@@ -305,14 +334,49 @@ export class BackendWebsocketTransport {
      * revocation does, so its heartbeat timer stops and nothing more dispatches
      * on it. A socket whose `close` throws does not stop the loop.
      *
+     * Leaves the transport closing, for good: every later registration is born
+     * closed (module doc, "Shutdown"). A second call closes nothing.
+     *
      * @returns the number of sockets closed
-     * @mutates this - removes every connection, aborts its registered
-     *   controller, and closes its underlying `WSContext` with `WS_CLOSE_GOING_AWAY`
+     * @mutates this - sets the transport closing, removes every connection,
+     *   aborts its registered controller, and closes its underlying `WSContext`
+     *   with `WS_CLOSE_GOING_AWAY`
      * @throws the first error a socket's `close` threw, after every connection was attempted
      */
     close_all_sockets() {
+        // before any close, in the same synchronous step: an `admit` that finds
+        // its entry gone reads the shutdown, never a revocation — and set even
+        // when a socket's close throws
+        this.#closing = true;
         return this.#close_where(() => true, WS_CLOSE_GOING_AWAY, WS_CLOSE_GOING_AWAY_REASON);
     }
+    /**
+     * Whether `close_all_sockets` has run — the transport is shutting down and
+     * every registration from now on is born closed (module doc, "Shutdown").
+     * For telemetry and logs: `register_action_ws` reads it to say why an
+     * upgrade was refused.
+     */
+    is_closing() {
+        return this.#closing;
+    }
+    /**
+     * Close a registration that arrived after `close_all_sockets`, without
+     * inserting it. A socket whose `close` throws is logged, not thrown: the
+     * registration is refused either way, and its caller sees the aborted
+     * controller.
+     *
+     * @returns a fresh id that names no entry
+     */
+    #close_born_closed(ws, abort_controller) {
+        abort_controller?.abort();
+        try {
+            ws.close(WS_CLOSE_GOING_AWAY, WS_CLOSE_GOING_AWAY_REASON);
+        }
+        catch (error) {
+            this.#log?.error('error closing a socket registered during shutdown:', error);
+        }
+        return create_uuid();
+    }
     #cleanup_connection(connection_id) {
         this.#connections.delete(connection_id);
         // Wake any handler still awaiting a reply on this socket — the peer is