redweb 0.12.0 → 0.13.1

package/src/ws/BaseSocketServer.js

@@ -7,8 +7,11 @@
  */
 
 const DefaultRoute = require('./DefaultRoute');
+const { createInspection } = require('../development/Inspection');
 const { PLACEMENT_REDIRECT, ADMISSION_SETTLEMENT } = require('./AdmissionPolicy');
 const { PROTOCOL_REJECTION } = require('./ProtocolPolicy');
+const { RequestFailure, UPGRADE_REJECTION } = require('../access/RequestFailure');
+const OwnedServerLifecycle = require('../OwnedServerLifecycle');
 const {
   listenServer,
   closeServer,
@@ -39,6 +42,7 @@ class BaseSocketServer {
    */
   constructor(server, options = {}, ownsServer = false, name = 'SocketServer') {
     if (!server || typeof server.on !== 'function') throw new TypeError('A Node HTTP(S) server is required.');
+    this._inspection = createInspection(options.development);
     Object.assign(this, { ...SOCKET_OPTIONS, ...options });
     validateListenerOptions(this);
     if (!Array.isArray(this.routes)) throw new TypeError('`routes` must be an array.');
@@ -47,12 +51,9 @@ class BaseSocketServer {
     this.closeServerOnShutdown = options.closeServerOnShutdown ?? ownsServer;
     this.draining = false;
     this.pendingUpgrades = new Map();
-    this.rawConnections = this.closeServerOnShutdown ? new Set() : null;
-    this._connectionHandler = this.rawConnections ? socket => {
-      this.rawConnections.add(socket);
-      socket.once('close', () => this.rawConnections.delete(socket));
-    } : null;
-    if (this._connectionHandler) this.server.on('connection', this._connectionHandler);
+    this._ownedServer = this.closeServerOnShutdown ? new OwnedServerLifecycle(server) : null;
+    this.rawConnections = this._ownedServer?.connections ?? null;
+    this._connectionHandler = this._ownedServer?.onConnection ?? null;
 
     /* ─── ROUTE INITIALISATION ─────────────────────────── */
     const RouteClasses = options.routes?.length ? [...options.routes] : [DefaultRoute];
@@ -67,6 +68,7 @@ class BaseSocketServer {
         this.routes.push(route);
       }
     } catch (error) {
+      this._ownedServer?.dispose();
       this.disposeRoutes(this.routes);
       throw error;
     }
@@ -75,14 +77,21 @@ class BaseSocketServer {
     this.server.on('upgrade', this._upgradeHandler);
 
     const shouldListen = (ownsServer && this.listen !== false) || (!ownsServer && options.listen === true);
-    if (shouldListen) {
-      listenServer(this.server, {
-        port: this.port,
-        bind: this.bind,
-        callback: this.listenCallback,
-        logger: this.logger,
-        name,
-      });
+    try {
+      if (shouldListen) {
+        listenServer(this.server, {
+          port: this.port,
+          bind: this.bind,
+          callback: this.listenCallback,
+          logger: this.logger,
+          name,
+        });
+      }
+    } catch (error) {
+      this.server.off('upgrade', this._upgradeHandler);
+      this._ownedServer?.dispose();
+      this.disposeRoutes(this.routes);
+      throw error;
     }
   }
 
@@ -115,37 +124,41 @@ class BaseSocketServer {
       (this.fallbackToRoot ? this.routes.find(r => r.path === '/') : undefined);
 
     if (!route) return sock.destroy();
-    if (this.draining) return this.rejectUpgrade(sock, 503, 'Service Unavailable');
-    if (route.isReady?.() === false) return this.rejectUpgrade(sock, 503, 'Service Unavailable');
+    if (this.draining) return this.rejectFailure(sock, 'SERVER_DRAINING');
+    if (route.isReady?.() === false) return this.rejectFailure(sock, 'ROUTE_UNAVAILABLE');
+
+    try { route.runtime.prepareRequest(req); }
+    catch { return this.rejectFailure(sock, 'REQUEST_INVALID'); }
 
     if (route.admissionPolicy || route.protocolPolicy || route.transportPolicy && route.transportPolicy.maxConnections !== Infinity) {
       let reservation;
       try {
         reservation = route.reserveUpgrade(req);
-      } catch (error) {
-        this.logger?.error?.('WebSocket admission reservation failed:', error);
+      } catch {
+        this.logAdmissionFailure('WebSocket admission reservation failed:');
+        return this.rejectFailure(sock, 'ADMISSION_FAILED');
       }
-      if (!reservation) return this.rejectUpgrade(sock, 503, 'Service Unavailable');
+      if (!reservation) return this.rejectFailure(sock, 'ADMISSION_CAPACITY');
       const controller = new AbortController();
       this.pendingUpgrades.set(sock, { controller, route, reservation });
       void Promise.resolve()
         .then(() => route.authorizeUpgrade(req, sock, controller.signal))
         .then(accepted => {
           if (sock.destroyed) return;
-          if (this.draining) return this.rejectUpgrade(sock, 503, 'Service Unavailable');
+          if (this.draining) return this.rejectFailure(sock, 'SERVER_DRAINING');
           if (!accepted) {
             const redirect = req[PLACEMENT_REDIRECT];
-            if (redirect) return this.rejectUpgrade(sock, 307, 'Temporary Redirect', { Location: redirect });
-            const rejection = req[PROTOCOL_REJECTION];
+            if (redirect) return this.rejectUpgrade(sock, 307, 'Temporary Redirect', { Location: redirect, 'Cache-Control': 'no-store' });
+            const rejection = req[UPGRADE_REJECTION] || req[PROTOCOL_REJECTION];
             return rejection
               ? this.rejectUpgrade(sock, rejection.statusCode, rejection.statusText, rejection.headers)
-              : this.rejectUpgrade(sock, 401, 'Unauthorized');
+              : this.rejectFailure(sock, 'AUTHENTICATION_REQUIRED');
           }
           this.completeUpgrade(route, req, sock, head);
         })
-        .catch(error => {
-          this.logger?.error?.('WebSocket admission failed:', error);
-          if (!sock.destroyed) this.rejectUpgrade(sock, 401, 'Unauthorized');
+        .catch(() => {
+          this.logAdmissionFailure('WebSocket admission failed:');
+          if (!sock.destroyed) this.rejectFailure(sock, 'ADMISSION_FAILED');
         })
         .finally(async () => {
           await req[ADMISSION_SETTLEMENT];
@@ -164,6 +177,16 @@ class BaseSocketServer {
     );
   }
 
+  logAdmissionFailure(message) {
+    try { this.logger?.error?.(message, new RequestFailure('ADMISSION_FAILED')); }
+    catch { /* A failing application logger must not prevent rejection or cleanup. */ }
+  }
+
+  rejectFailure(socket, code) {
+    const { statusCode, statusText, headers } = new RequestFailure(code).rejection;
+    return this.rejectUpgrade(socket, statusCode, statusText, headers);
+  }
+
   rejectUpgrade(socket, statusCode, statusText, headers = {}) {
     try {
       const extraHeaders = Object.entries(headers).map(([name, value]) => `${name}: ${value}\r\n`).join('');
@@ -204,6 +227,8 @@ class BaseSocketServer {
     return !this.draining && this.routes.every(route => route.isReady?.() !== false);
   }
 
+  inspect() { return this._inspection ? this._inspection.snapshot(this) : null; }
+
   beginDrain() {
     if (this.draining) return false;
     this.draining = true;
@@ -217,28 +242,18 @@ class BaseSocketServer {
     this.server.off?.('upgrade', this._upgradeHandler);
     const deadline = Date.now() + Math.max(0, ...this.routes.map(route => route.shutdownTimeoutMs));
     const errors = await settleTasks(this.routes.map(route => () => route.shutdown?.()));
-    if (this.closeServerOnShutdown && this.server.listening) {
+    if (this.closeServerOnShutdown) {
       try {
         await this.closeOwnedServer(Math.max(0, deadline - Date.now()));
       } catch (error) {
         errors.push(error);
       }
     }
-    if (this._connectionHandler) this.server.off?.('connection', this._connectionHandler);
     throwCleanupErrors(errors, 'One or more WebSocket server cleanup operations failed.');
   }
 
   closeOwnedServer(timeoutMs) {
-    let timer;
-    const closing = closeServer(this.server);
-    const timeout = new Promise(resolve => {
-      timer = setTimeout(() => {
-        this.rawConnections?.forEach(socket => socket.destroy?.());
-        resolve();
-      }, timeoutMs);
-      timer.unref?.();
-    });
-    return Promise.race([closing, timeout]).finally(() => clearTimeout(timer));
+    return this._ownedServer.close(timeoutMs, () => closeServer(this.server));
   }
 }
 

package/src/ws/ContractValidationError.js

@@ -0,0 +1,12 @@
+class ContractValidationError extends TypeError {
+    constructor(code = 'INVALID_PAYLOAD') {
+        super(code === 'UNKNOWN_HANDLER' ? 'Message type is not defined in the contract.' : 'Payload does not match the socket contract.');
+        this.name = 'ContractValidationError';
+        this.code = code;
+    }
+}
+
+// Only errors from the inbound validation stage should be reported as a bad client payload.
+class InboundContractValidationError extends ContractValidationError {}
+
+module.exports = { ContractValidationError, InboundContractValidationError };

package/src/ws/HeartbeatMonitor.js

@@ -2,7 +2,12 @@ const { performance } = require('perf_hooks');
 
 function acknowledgePong() {
     const state = this.__redwebHeartbeatState;
-    if (state) state.awaitingPong = false;
+    if (!state) return;
+    state.awaitingPong = false;
+    if (state.terminationTimer) {
+        clearTimeout(state.terminationTimer);
+        state.terminationTimer = null;
+    }
 }
 
 class HeartbeatMonitor {
@@ -25,7 +30,7 @@ class HeartbeatMonitor {
 
     attach(socket) {
         this.detach(socket);
-        const state = { awaitingPong: false, lastPing: null };
+        const state = { awaitingPong: false, lastPing: null, terminationTimer: null };
         socket.__redwebHeartbeatState = state;
         this.sockets.set(socket, state);
         socket.on('pong', acknowledgePong);
@@ -34,6 +39,8 @@ class HeartbeatMonitor {
     detach(socket) {
         const state = this.sockets.get(socket);
         if (!state) return false;
+        if (state.terminationTimer) clearTimeout(state.terminationTimer);
+        state.terminationTimer = null;
         socket.off?.('pong', acknowledgePong);
         delete socket.__redwebHeartbeatState;
         this.sockets.delete(socket);
@@ -44,12 +51,7 @@ class HeartbeatMonitor {
         const now = this.clock();
         this.sockets.forEach((state, socket) => {
             if (state.awaitingPong && now - state.lastPing >= this.timeoutMs) {
-                this.detach(socket);
-                try {
-                    socket.terminate?.();
-                } catch (error) {
-                    this.logger?.error?.('Error terminating unresponsive socket:', error);
-                }
+                this.scheduleTermination(socket, state);
                 return;
             }
             if (!state.awaitingPong && (state.lastPing === null || now - state.lastPing >= this.intervalMs)) {
@@ -64,6 +66,22 @@ class HeartbeatMonitor {
         });
     }
 
+    scheduleTermination(socket, state) {
+        if (state.terminationTimer) return;
+        // Give an already-sent pong one full timeout window to reach JavaScript.
+        // This prevents a delayed server event loop from blaming a responsive peer.
+        state.terminationTimer = setTimeout(() => {
+            state.terminationTimer = null;
+            this.detach(socket);
+            try {
+                socket.terminate?.();
+            } catch (error) {
+                this.logger?.error?.('Error terminating unresponsive socket:', error);
+            }
+        }, this.timeoutMs);
+        state.terminationTimer.unref();
+    }
+
     stop() {
         if (!this.timer) return;
         clearInterval(this.timer);

package/src/ws/ProtocolPolicy.js

@@ -77,7 +77,7 @@ class ProtocolPolicy {
         request[PROTOCOL_REJECTION] = {
             statusCode: 426,
             statusText: 'Upgrade Required',
-            headers: { 'Redweb-Versions': this.versions.join(', ') },
+            headers: { 'Redweb-Versions': this.versions.join(', '), 'Redweb-Error': 'PROTOCOL_UNSUPPORTED', 'Cache-Control': 'no-store' },
             message,
         };
         return false;

package/src/ws/RoomAccess.js

@@ -0,0 +1,82 @@
+'use strict';
+
+const { AccessPolicy, AccessDenied } = require('../access/AccessPolicy');
+
+/** Admission work is charged until the underlying policy settles, even after timeout. */
+class RoomAccess {
+    constructor(options, contextFor) {
+        const { authorize, authorizationTimeoutMs, maxPendingAuthorizations = 128, maxPendingPerConnection = 4 } = options;
+        for (const [name, value] of Object.entries({ maxPendingAuthorizations, maxPendingPerConnection })) {
+            if (!Number.isSafeInteger(value) || value < 1) throw new TypeError(`rooms.${name} must be a positive safe integer.`);
+        }
+        if (typeof authorize !== 'function') throw new TypeError('rooms.authorize must be a function.');
+        this.policy = new AccessPolicy(async (context, attempt) => {
+            attempt.started = true;
+            try { return await authorize(context, attempt.roomId); }
+            finally { attempt.release(); }
+        }, authorizationTimeoutMs);
+        this.contextFor = contextFor;
+        this.maximum = maxPendingAuthorizations;
+        this.perConnection = maxPendingPerConnection;
+        this.running = 0;
+        this.counts = new WeakMap();
+        this.pending = new Map();
+        this.cancelling = new Set();
+    }
+
+    enter(roomId, socket, commit) {
+        if (this.cancelling.has(socket)) return Promise.reject(new AccessDenied('ACCESS_CANCELLED'));
+        const existing = this.pending.get(socket)?.get(roomId);
+        if (existing) return existing.promise;
+        const count = this.counts.get(socket) || 0;
+        if (this.running >= this.maximum || count >= this.perConnection) return Promise.reject(new AccessDenied('ACCESS_CAPACITY'));
+        const context = this.contextFor(socket);
+        if (!context?.signal || context.signal.aborted) return Promise.reject(new AccessDenied('ACCESS_CANCELLED'));
+        const controller = new AbortController();
+        const attempt = { roomId, controller, started: false, release: () => {
+            this.running--;
+            this.counts.set(socket, this.counts.get(socket) - 1);
+        } };
+        this.running++;
+        this.counts.set(socket, count + 1);
+        const group = this.pending.get(socket) || new Map();
+        group.set(roomId, attempt);
+        this.pending.set(socket, group);
+        const abort = () => controller.abort();
+        context.signal.addEventListener('abort', abort, { once: true });
+        attempt.promise = (async () => {
+            try {
+                await this.policy.check({ ...context, signal: controller.signal }, attempt);
+                if (controller.signal.aborted) throw new AccessDenied('ACCESS_CANCELLED');
+                return commit();
+            } finally {
+                context.signal.removeEventListener('abort', abort);
+                if (!attempt.started) attempt.release();
+                if (this.pending.get(socket)?.get(roomId) === attempt) {
+                    group.delete(roomId);
+                    if (!group.size) this.pending.delete(socket);
+                }
+            }
+        })();
+        return attempt.promise;
+    }
+
+    cancel(socket, roomId) {
+        const group = this.pending.get(socket);
+        if (!group) return;
+        const attempts = [...group.values()].filter(attempt => roomId === undefined || attempt.roomId === roomId);
+        if (!attempts.length) return;
+        for (const attempt of attempts) group.delete(attempt.roomId);
+        if (!group.size) this.pending.delete(socket);
+        const nested = this.cancelling.has(socket);
+        this.cancelling.add(socket);
+        try { for (const attempt of attempts) attempt.controller.abort(); }
+        finally { if (!nested) this.cancelling.delete(socket); }
+    }
+
+    clear() {
+        for (const socket of [...this.pending.keys()]) this.cancel(socket);
+    }
+}
+
+module.exports = RoomAccess;

package/src/ws/RoomRegistry.js

@@ -1,7 +1,8 @@
-const { broadcast } = require('./util');
+const { broadcast, sendPayload } = require('./util');
+const RoomAccess = require('./RoomAccess');
 
 class RoomRegistry {
-    constructor(options = {}, { hasConnection, policy, onChange } = {}) {
+    constructor(options = {}, { hasConnection, policy, onChange, contextFor = socket => socket.context } = {}) {
         if (!options || typeof options !== 'object' || Array.isArray(options)) {
             throw new TypeError('`rooms` must be an object or true.');
         }
@@ -27,6 +28,12 @@ class RoomRegistry {
         this.rooms = new Map();
         this.memberships = new WeakMap();
         this.closed = false;
+        this.clearing = false;
+        if (typeof contextFor !== 'function') throw new TypeError('contextFor must be a function.');
+        if (options.authorize === undefined && ['authorizationTimeoutMs', 'maxPendingAuthorizations', 'maxPendingPerConnection'].some(name => options[name] !== undefined)) {
+            throw new TypeError('Room authorization options require authorize.');
+        }
+        this.access = options.authorize === undefined ? null : new RoomAccess(options, contextFor);
     }
 
     validateRoomId(roomId) {
@@ -37,7 +44,18 @@ class RoomRegistry {
 
     join(roomId, socket) {
         this.validateRoomId(roomId);
-        if (this.closed) return false;
+        if (this.access) throw new TypeError('Protected rooms require await enterRoom(roomId) or rooms.enter(roomId, socket).');
+        return this.#commit(roomId, socket);
+    }
+
+    enter(roomId, socket) {
+        this.validateRoomId(roomId);
+        if (this.closed || this.clearing || !socket || !this.hasConnection(socket)) return Promise.resolve(false);
+        return this.access ? this.access.enter(roomId, socket, () => this.#commit(roomId, socket)) : Promise.resolve(this.#commit(roomId, socket));
+    }
+
+    #commit(roomId, socket) {
+        if (this.closed || this.clearing) return false;
         if (!socket || !this.hasConnection(socket)) return false;
         let members = this.rooms.get(roomId);
         if (members?.has(socket)) return true;
@@ -58,21 +76,29 @@ class RoomRegistry {
 
     leave(roomId, socket) {
         this.validateRoomId(roomId);
+        const removed = this.#remove(roomId, socket);
+        this.access?.cancel(socket, roomId);
+        if (removed) this.onChange('leave', roomId, socket);
+        return removed;
+    }
+
+    #remove(roomId, socket) {
         const members = this.rooms.get(roomId);
         if (!members?.delete(socket)) return false;
         const memberships = this.memberships.get(socket);
         memberships?.delete(roomId);
         if (!memberships?.size) this.memberships.delete(socket);
         if (!members.size) this.rooms.delete(roomId);
-        this.onChange('leave', roomId, socket);
         return true;
     }
 
     leaveAll(socket) {
         const memberships = this.memberships.get(socket);
-        if (!memberships) return 0;
+        if (!memberships) { this.access?.cancel(socket); return 0; }
         const roomIds = [...memberships];
-        roomIds.forEach(roomId => this.leave(roomId, socket));
+        roomIds.forEach(roomId => this.#remove(roomId, socket));
+        this.access?.cancel(socket);
+        roomIds.forEach(roomId => this.onChange('leave', roomId, socket));
         return roomIds.length;
     }
 
@@ -87,10 +113,30 @@ class RoomRegistry {
     }
 
     broadcast(roomId, data, { except } = {}) {
+        return this.#broadcast(roomId, data, except);
+    }
+
+    broadcastFrom(socket, roomId, data, { except } = {}) {
+        if (!socket) return 0;
+        return this.#broadcast(roomId, data, except, socket);
+    }
+
+    #broadcast(roomId, data, except, sender) {
         this.validateRoomId(roomId);
         if (this.closed) return 0;
         const members = this.rooms.get(roomId);
         if (!members) return 0;
+        if (this.access) {
+            const eligible = socket => members.has(socket) && this.hasConnection(socket);
+            if (sender && !eligible(sender)) return 0;
+            const payload = JSON.stringify(data);
+            if (this.closed || this.rooms.get(roomId) !== members || (sender && !eligible(sender))) return 0;
+            let sent = 0;
+            for (const socket of members) {
+                if (socket !== except && eligible(socket) && sendPayload(socket, payload, this.policy)) sent++;
+            }
+            return sent;
+        }
         const recipients = except === undefined
             ? members
             : [...members].filter(socket => socket !== except);
@@ -100,6 +146,10 @@ class RoomRegistry {
     clear() {
         this.rooms.clear();
         this.memberships = new WeakMap();
+        const nested = this.clearing;
+        this.clearing = true;
+        try { this.access?.clear(); }
+        finally { if (!nested) this.clearing = false; }
     }
 
     close() {

package/src/ws/RouteRuntime.js

@@ -5,10 +5,12 @@ const HeartbeatMonitor = require('./HeartbeatMonitor');
 const RoomRegistry = require('./RoomRegistry');
 const SessionRegistry = require('./SessionRegistry');
 const DistributionBridge = require('./DistributionBridge');
+const requestSnapshot = require('../context/RequestSnapshot');
 
 function joinRoom(roomId) { return this.__redwebRuntimeOwner.rooms.join(roomId, this); }
+function enterRoom(roomId) { return this.__redwebRuntimeOwner.rooms.enter(roomId, this); }
 function leaveRoom(roomId) { return this.__redwebRuntimeOwner.rooms.leave(roomId, this); }
-function roomBroadcast(roomId, data, options) { return this.__redwebRuntimeOwner.rooms.broadcast(roomId, data, options); }
+function roomBroadcast(roomId, data, options) { return this.__redwebRuntimeOwner.rooms.broadcastFrom(this, roomId, data, options); }
 function createSession(sessionId, data) {
     this.__redwebRuntimeOwner.ensureContext(this);
     return this.__redwebRuntimeOwner.sessions.create(sessionId, data, this);
@@ -18,6 +20,7 @@ function resumeSession(sessionId) {
     return this.__redwebRuntimeOwner.sessions.resume(sessionId, this);
 }
 function publishEvent(type, payload) { return this.__redwebRuntimeOwner.route.publish(type, payload); }
+function connectionContext() { return this.__redwebRuntimeOwner.ensureContext(this); }
 
 class RouteRuntime {
     constructor(route, { heartbeat, rooms, sessions, distribution, drainHandlers }) {
@@ -25,12 +28,17 @@ class RouteRuntime {
         this.inFlight = drainHandlers ? new Set() : null;
         this.abortController = drainHandlers ? new AbortController() : null;
         this.acceptingWork = true;
+        this.contexts = new WeakMap();
+        this.requests = new WeakMap();
+        this.needsContext = Boolean(route.admissionPolicy || route.protocolPolicy || rooms || sessions || drainHandlers);
         try {
             this.heartbeat = heartbeat === undefined ? null : new HeartbeatMonitor(heartbeat, route.logger);
             this.rooms = rooms === undefined || rooms === false
                 ? null
                 : new RoomRegistry(rooms === true ? {} : rooms, {
-                    hasConnection: socket => route.clients.get(socket.clientKey) === socket,
+                    hasConnection: socket => !route.draining && route.clients.get(socket.clientKey) === socket &&
+                        socket.readyState === 1 && this.contexts.get(socket)?.active !== false,
+                    contextFor: socket => this.ensureContext(socket),
                     policy: route.transportPolicy,
                     onChange: action => {
                         route.metrics?.increment(`redweb.room.${action}`);
@@ -65,10 +73,11 @@ class RouteRuntime {
     }
 
     decorate(socket, request) {
-        if (request?.[ADMISSION_CONTEXT] || request?.[PROTOCOL_CONTEXT] || this.abortController) this.ensureContext(socket, request);
+        if (this.needsContext) this.prepareContext(socket, request);
         if (this.rooms || this.sessions || this.distribution) socket.__redwebRuntimeOwner = this;
         if (this.rooms) {
             socket.joinRoom = joinRoom;
+            socket.enterRoom = enterRoom;
             socket.leaveRoom = leaveRoom;
             socket.roomBroadcast = roomBroadcast;
         }
@@ -79,17 +88,46 @@ class RouteRuntime {
         if (this.distribution) socket.publishEvent = publishEvent;
     }
 
-    ensureContext(socket, request) {
-        if (socket.context) return socket.context;
-        socket.context = {
-            connectionId: randomUUID(),
+    prepareContext(socket, request) {
+        const existing = this.contexts.get(socket);
+        if (existing) return existing;
+        const record = {
+            snapshot: this.requests.get(request) || requestSnapshot(request || {}),
             principal: request?.[ADMISSION_CONTEXT]?.principal,
+            protocol: request?.[PROTOCOL_CONTEXT],
+            active: !this.route.draining, context: null, controller: null,
+        };
+        this.contexts.set(socket, record);
+        socket.__redwebRuntimeOwner = this;
+        Object.defineProperty(socket, 'context', { get: connectionContext, enumerable: true });
+        return record;
+    }
+
+    ensureContext(socket, request) {
+        const record = this.prepareContext(socket, request);
+        if (record.context) return record.context;
+        const controller = new AbortController();
+        const snapshot = record.snapshot;
+        const context = {
             session: null,
             metadata: Object.create(null),
-            signal: this.abortController?.signal,
-            protocol: request?.[PROTOCOL_CONTEXT],
         };
-        return socket.context;
+        const stable = {
+            connectionId: randomUUID(),
+            principal: record.principal,
+            request: snapshot, params: snapshot.params, query: snapshot.query, body: snapshot.body,
+            signal: controller.signal,
+            protocol: record.protocol,
+        };
+        for (const [name, value] of Object.entries(stable)) Object.defineProperty(context, name, { value, enumerable: true });
+        record.context = context;
+        record.controller = controller;
+        if (!record.active) controller.abort();
+        return context;
+    }
+
+    prepareRequest(request) {
+        if (this.needsContext) this.requests.set(request, requestSnapshot(request));
     }
 
     attach(socket) {
@@ -97,7 +135,10 @@ class RouteRuntime {
     }
 
     detach(socket) {
+        const record = this.contexts.get(socket);
+        if (record) record.active = false;
         this.rooms?.leaveAll(socket);
+        record?.controller?.abort();
         this.sessions?.release(socket);
         this.heartbeat?.detach(socket);
     }
@@ -113,6 +154,11 @@ class RouteRuntime {
     }
 
     beginDrain() {
+        this.rooms?.close();
+        this.route.clients.forEach(socket => {
+            const record = this.contexts.get(socket);
+            if (record) { record.active = false; record.controller?.abort(); }
+        });
         this.abortController?.abort();
         this.route.clients.forEach(socket => socket.__redwebRuntime?.queue?.close());
     }