svelte-adapter-uws 0.5.4 → 0.5.5

package/README.md

@@ -1274,6 +1274,22 @@ export async function GET({ platform }) {
 
 The returned `Map` is the live module-level instance - read-only, do not mutate. In test mode (`process.env.VITEST` set, or `NODE_ENV === 'test'`) the assert helper additionally throws so test runners surface the failure; in production it logs and counts but does not throw, so a violation inside a uWS callback frame cannot crash the worker.
 
+### `platform.closedWsAborts`
+
+Per-worker count of best-effort uWS operations that aborted because the underlying WebSocket had already closed. Bumped every time `platform.subscribe`, `platform.unsubscribe`, `platform.send`, `platform.sendCoalesced`, `platform.sendTo`, or `platform.request` is called on a `ws` whose native handle has been freed - typically because the caller `await`-ed something (auth, loader, subscribe hook) and the client closed during the wait.
+
+These methods are *closed-WS safe* by contract: they swallow uWS's `Invalid access of closed uWS.WebSocket` exception, return a success-shaped no-op sentinel (`null` for subscribe, `false` for unsubscribe, `2` for send, etc.), and bump this counter. Callers can fire-and-forget without a per-site try/catch.
+
+```js
+export async function GET({ platform }) {
+  return json({ closedWsAborts: platform.closedWsAborts });
+}
+```
+
+A non-zero value is normal under client churn (tab close, network blips, mass reconnect waves). A rapidly-growing value under steady load indicates either pathological client behaviour or that the server's async setup path is too long for its connect rate. In clustered mode, sum across workers for cluster-wide visibility.
+
+Monotonic, per-worker, reset only on process restart.
+
 ### `platform.pressure` and `platform.onPressure(cb)`
 
 Worker-local backpressure signal. The adapter samples once per second (configurable) and reports the most urgent active stress as a single `reason` enum, so user code can degrade with intent instead of generic panic.
@@ -3333,6 +3349,8 @@ Per-worker limitations (acceptable for most apps):
 - `platform.connections`  - returns the count for the local worker only
 - `platform.subscribers(topic)`  - returns the count for the local worker only
 - `platform.sendTo(filter, ...)`  - iterates the local worker's connections only, no cross-worker relay
+- `platform.closedWsAborts`  - per-worker counter; sum across workers for cluster total
+- `platform.assertions`  - per-worker counter Map
 
 ### Docker / multi-process deployments (Linux)
 

package/files/handler.js

@@ -421,7 +421,8 @@ const closeHookRegistered = WS_ENABLED && !!wsModule.close;
  */
 function bumpIn(ws, message) {
 	if (!closeHookRegistered) return;
-	const stats = ws.getUserData()[WS_STATS];
+	let stats;
+	try { stats = ws.getUserData()[WS_STATS]; } catch { return; }
 	if (!stats) return;
 	stats.messagesIn++;
 	stats.bytesIn += typeof message === 'string' ? message.length : message.byteLength;
@@ -439,7 +440,8 @@ function bumpIn(ws, message) {
  */
 function bumpOut(ws, payload) {
 	if (!closeHookRegistered) return;
-	const stats = ws.getUserData()[WS_STATS];
+	let stats;
+	try { stats = ws.getUserData()[WS_STATS]; } catch { return; }
 	if (!stats) return;
 	stats.messagesOut++;
 	stats.bytesOut += payload.length;
@@ -489,6 +491,16 @@ function maybeWarnTopicRegistry() {
 
 let publishCountWindow = 0;
 let totalSubscriptions = 0;
+// Count of best-effort operations that aborted because the underlying
+// uWS WebSocket had already closed. The platform contract is that
+// ws-targeted public methods (subscribe / unsubscribe / send /
+// sendCoalesced / request) and internal helpers that may run after an
+// `await` never propagate uWS's "Invalid access of closed
+// uWS.WebSocket" exception to user code - they swallow it, return a
+// no-op sentinel, and bump this counter. Operators can read
+// `platform.closedWsAborts` to detect when mass-connect kernel /
+// backpressure churn is closing sockets mid-async-setup at scale.
+let closedWsAborts = 0;
 
 /**
  * Per-topic publish counters for runaway-publisher detection. Single
@@ -824,7 +836,7 @@ async function runUserSubscribeGate(ws, topic) {
 function sendSubscribed(ws, topic, ref) {
 	if (ref === null) return;
 	const payload = JSON.stringify({ type: 'subscribed', topic, ref });
-	ws.send(payload, false, false);
+	try { ws.send(payload, false, false); } catch { closedWsAborts++; return; }
 	bumpOut(ws, payload);
 }
 
@@ -840,7 +852,7 @@ function sendSubscribed(ws, topic, ref) {
 function sendSubscribeDenied(ws, topic, ref, reason) {
 	if (ref === null) return;
 	const payload = JSON.stringify({ type: 'subscribe-denied', topic, ref, reason });
-	ws.send(payload, false, false);
+	try { ws.send(payload, false, false); } catch { closedWsAborts++; return; }
 	bumpOut(ws, payload);
 }
 
@@ -852,15 +864,29 @@ function sendSubscribeDenied(ws, topic, ref, reason) {
  * @param {import('uWebSockets.js').WebSocket<any>} ws
  */
 function flushCoalescedFor(ws) {
-	const userData = ws.getUserData();
+	let userData;
+	try { userData = ws.getUserData(); }
+	catch { closedWsAborts++; return; }
 	const pending = userData[WS_COALESCED];
 	if (!pending || pending.size === 0) return;
 	assert(pending instanceof Map, 'coalesce.pending-type', null);
+	let aborted = false;
 	drainCoalesced(pending, (msg) => {
+		if (aborted) return 2;
 		assert(typeof msg.topic === 'string', 'coalesce.entry-topic-type', null);
 		assert(typeof msg.event === 'string', 'coalesce.entry-event-type', null);
 		const payload = envelopePrefix(msg.topic, msg.event) + JSON.stringify(msg.data ?? null) + '}';
-		const result = ws.send(payload, false, false);
+		let result;
+		try { result = ws.send(payload, false, false); }
+		catch {
+			// Socket closed mid-drain. There will be no further `drain`
+			// event to retry on, so dropping the rest of the buffer is
+			// the only correct outcome - returning 1 (BACKPRESSURE) lets
+			// drainCoalesced clear the current entry and stop iterating.
+			closedWsAborts++;
+			aborted = true;
+			return 1;
+		}
 		// `result` MUST propagate to drainCoalesced. 0=SUCCESS removes the
 		// entry; 1=BACKPRESSURE removes it and halts the loop; 2=DROPPED
 		// retains the entry for retry on next drain. Don't refactor away
@@ -869,6 +895,7 @@ function flushCoalescedFor(ws) {
 		if (result !== 2) bumpOut(ws, payload);
 		return result;
 	});
+	if (aborted) pending.clear();
 }
 
 /** @type {import('./index.js').Platform} */
@@ -927,7 +954,13 @@ const platform = {
 	send(ws, topic, event, data) {
 		const payload = envelopePrefix(topic, event) + JSON.stringify(data ?? null) + '}';
 		assert(payload.length > 0, 'envelope.send-empty', { topic, event });
-		const result = ws.send(payload, false, false);
+		// `ws.send` throws on a freed native handle (callers may reach
+		// here after an `await` that outlasted the socket). Return 2
+		// (DROPPED, the uWS sentinel) so callers can pattern-match
+		// without distinguishing closed from backpressure-dropped.
+		let result;
+		try { result = ws.send(payload, false, false); }
+		catch { closedWsAborts++; return 2; }
 		bumpOut(ws, payload);
 		return result;
 	},
@@ -954,7 +987,9 @@ const platform = {
 	 * on the next drain.
 	 */
 	sendCoalesced(ws, { key, topic, event, data }) {
-		const userData = ws.getUserData();
+		let userData;
+		try { userData = ws.getUserData(); }
+		catch { closedWsAborts++; return; }
 		let pending = userData[WS_COALESCED];
 		if (!pending) {
 			pending = new Map();
@@ -990,7 +1025,15 @@ const platform = {
 		const envelope = envelopePrefix(topic, event) + JSON.stringify(data ?? null) + '}';
 		let count = 0;
 		for (const ws of wsConnections) {
-			const decision = filter(ws.getUserData());
+			// uWS's close event fires synchronously and removes from
+			// wsConnections before any user code runs, so under normal
+			// flow every entry here is open. Defensive try/catch covers
+			// pathological cases (e.g. user filter triggers a close via
+			// side effect, or another worker raced through cleanup).
+			let userData;
+			try { userData = ws.getUserData(); }
+			catch { closedWsAborts++; continue; }
+			const decision = filter(userData);
 			if (decision && typeof decision.then === 'function') {
 				if (!sendToAsyncWarned) {
 					sendToAsyncWarned = true;
@@ -1005,7 +1048,8 @@ const platform = {
 				continue;
 			}
 			if (decision) {
-				ws.send(envelope, false, false);
+				try { ws.send(envelope, false, false); }
+				catch { closedWsAborts++; continue; }
 				bumpOut(ws, envelope);
 				count++;
 			}
@@ -1040,6 +1084,30 @@ const platform = {
 		return readAssertionCounts();
 	},
 
+	/**
+	 * Per-worker count of best-effort uWS operations that aborted
+	 * because the underlying WebSocket had already closed.
+	 *
+	 * Ws-targeted platform methods (`subscribe`, `unsubscribe`, `send`,
+	 * `sendCoalesced`, `sendTo`, `request`) and the wire-level
+	 * subscribe / subscribe-batch handlers all swallow uWS's "Invalid
+	 * access of closed uWS.WebSocket" exception so callers never need
+	 * a per-site try/catch. Each swallow bumps this counter.
+	 *
+	 * A non-zero value is normal under churn (clients close mid-async-
+	 * setup all the time). A rapidly-growing value under steady load
+	 * indicates either pathological client behaviour or that the
+	 * server's async setup path is too long for its connect rate -
+	 * worth investigating but not, by itself, a bug.
+	 *
+	 * Monotonic, per-worker, reset only on process restart.
+	 *
+	 * @returns {number}
+	 */
+	get closedWsAborts() {
+		return closedWsAborts;
+	},
+
 	/**
 	 * Number of clients subscribed to a specific topic.
 	 */
@@ -1138,7 +1206,13 @@ const platform = {
 		// non-ASCII topic names (`__signal:Jose`, presence rooms with
 		// localized labels) must not be blocked at the platform layer.
 		if (!isValidWireTopic(topic, true)) return 'INVALID_TOPIC';
-		const subs = ws.getUserData()[WS_SUBSCRIPTIONS];
+		// `ws.getUserData()` throws on a freed native handle. RPC and
+		// plugin code paths routinely `await` something else before
+		// reaching here, so the WS may already be closed by the time
+		// this runs. Treat as a silent no-op.
+		let subs;
+		try { subs = ws.getUserData()[WS_SUBSCRIPTIONS]; }
+		catch { closedWsAborts++; return null; }
 		assert(subs instanceof Set, 'subs.shape', null);
 		if (subs.has(topic)) return null;
 		if (subs.size >= MAX_SUBSCRIPTIONS_PER_CONNECTION) return 'RATE_LIMITED';
@@ -1150,7 +1224,13 @@ const platform = {
 		// counter bump in that case.
 		if (subs.has(topic)) return null;
 		if (subs.size >= MAX_SUBSCRIPTIONS_PER_CONNECTION) return 'RATE_LIMITED';
-		ws.subscribe(topic);
+		// `ws.subscribe()` throws if the socket closed during the await
+		// above. Under mass-connect / backpressure churn this is the
+		// dominant abort mode (10-15% of connections close mid-setup).
+		// Swallow, count, and return success-shaped null so callers can
+		// fire-and-forget without per-site try/catch.
+		try { ws.subscribe(topic); }
+		catch { closedWsAborts++; return null; }
 		subs.add(topic);
 		totalSubscriptions++;
 		return null;
@@ -1227,10 +1307,17 @@ const platform = {
 	 * @returns {boolean} `true` if a subscription was removed
 	 */
 	unsubscribe(ws, topic) {
-		const subs = ws.getUserData()[WS_SUBSCRIPTIONS];
+		// Closed sockets get an early-out: there is no subscription
+		// state to remove, no uWS bookkeeping to drop, no informational
+		// hook to fire. The platform contract is "best effort; no throw
+		// on closed WS" - mirrors subscribe / send.
+		let subs;
+		try { subs = ws.getUserData()[WS_SUBSCRIPTIONS]; }
+		catch { closedWsAborts++; return false; }
 		assert(subs instanceof Set, 'subs.shape-unsubscribe', null);
 		if (!subs.has(topic)) return false;
-		ws.unsubscribe(topic);
+		try { ws.unsubscribe(topic); }
+		catch { closedWsAborts++; return false; }
 		subs.delete(topic);
 		totalSubscriptions--;
 		assert(totalSubscriptions >= 0, 'subs.total-negative', { totalSubscriptions });
@@ -1493,7 +1580,12 @@ const platform = {
 	 * so cleanup is automatic on close - no module-level leak risk.
 	 */
 	request(ws, event, data, options) {
-		const userData = ws.getUserData();
+		let userData;
+		try { userData = ws.getUserData(); }
+		catch {
+			closedWsAborts++;
+			return Promise.reject(new Error('connection closed'));
+		}
 		let pending = userData[WS_PENDING_REQUESTS];
 		if (!pending) {
 			pending = new Map();
@@ -1514,7 +1606,14 @@ const platform = {
 			}, timeoutMs);
 			pending.set(ref, { resolve, reject, timer });
 			const payload = JSON.stringify({ type: 'request', ref, event, data: data ?? null });
-			ws.send(payload, false, false);
+			try { ws.send(payload, false, false); }
+			catch {
+				closedWsAborts++;
+				clearTimeout(timer);
+				pending.delete(ref);
+				reject(new Error('connection closed'));
+				return;
+			}
 			bumpOut(ws, payload);
 		});
 	},
@@ -3093,7 +3192,8 @@ if (WS_ENABLED) {
 						sendSubscribeDenied(ws, msg.topic, ref, 'RATE_LIMITED');
 						return;
 					}
-					try { ws.subscribe(msg.topic); } catch { return; }
+					try { ws.subscribe(msg.topic); }
+					catch { closedWsAborts++; return; }
 					subs.add(msg.topic);
 					totalSubscriptions++;
 					if (wsDebug) console.log('[ws] subscribe topic=%s', msg.topic);
@@ -3171,7 +3271,8 @@ if (WS_ENABLED) {
 							sendSubscribeDenied(ws, topic, ref, 'RATE_LIMITED');
 							continue;
 						}
-						try { ws.subscribe(topic); } catch { continue; }
+						try { ws.subscribe(topic); }
+						catch { closedWsAborts++; continue; }
 						subs.add(topic);
 						totalSubscriptions++;
 						subscribed++;

package/index.d.ts

@@ -1202,6 +1202,14 @@ export interface Platform {
 	 * Send a message to a single WebSocket connection.
 	 * Wraps in the same `{ topic, event, data }` envelope as `publish()`.
 	 *
+	 * Returns the uWS send result: `0` = SUCCESS, `1` = BACKPRESSURE
+	 * (queued, will flush on drain), `2` = DROPPED (frame discarded
+	 * because the socket has closed or its queue is over the limit).
+	 *
+	 * Closed-WS safe: if the socket has already closed, returns `2`
+	 * (DROPPED) and bumps `platform.closedWsAborts` rather than
+	 * propagating uWS's "Invalid access" exception.
+	 *
 	 * @example
 	 * ```js
 	 * // In hooks.ws.js - reply to sender:
@@ -1310,6 +1318,36 @@ export interface Platform {
 	 */
 	readonly connections: number;
 
+	/**
+	 * Per-worker count of best-effort uWS operations that aborted
+	 * because the underlying WebSocket had already closed.
+	 *
+	 * Ws-targeted platform methods (`subscribe`, `unsubscribe`, `send`,
+	 * `sendCoalesced`, `sendTo`, `request`) and the wire-level
+	 * subscribe / subscribe-batch handlers swallow uWS's "Invalid
+	 * access of closed uWS.WebSocket" exception so callers never need
+	 * a per-site try/catch when a socket closes mid-async-setup.
+	 * Each swallow bumps this counter.
+	 *
+	 * A non-zero value is normal under client churn (browser tab close,
+	 * network blips, mass-reconnect waves). A rapidly-growing value
+	 * under steady load indicates either pathological client behaviour
+	 * or that the server's async setup path is too long for its
+	 * connect rate - worth investigating but not, on its own, a bug.
+	 *
+	 * Monotonic, per-worker, reset only on process restart. In
+	 * clustered mode, sum across workers to get the cluster total.
+	 *
+	 * @example
+	 * ```js
+	 * // periodic ops log
+	 * setInterval(() => {
+	 *   console.log('closed-ws aborts:', platform.closedWsAborts);
+	 * }, 60_000);
+	 * ```
+	 */
+	readonly closedWsAborts: number;
+
 	/**
 	 * Number of clients subscribed to a specific topic.
 	 *
@@ -1387,6 +1425,13 @@ export interface Platform {
 	 * hook may be async (the framework awaits the hook before inspecting
 	 * its return). Callers must `await` the result.
 	 *
+	 * Closed-WS safe: if the socket closes during the awaited hook (or
+	 * before the call, e.g. caller `await`-ed something else first) the
+	 * method silently returns `null` rather than propagating uWS's
+	 * "Invalid access of closed uWS.WebSocket" exception. Each abort
+	 * increments `platform.closedWsAborts`. Callers can fire-and-forget
+	 * without a per-site try/catch.
+	 *
 	 * @example
 	 * ```js
 	 * // In an RPC handler that needs to subscribe the connection
@@ -1456,6 +1501,9 @@ export interface Platform {
 	 * otherwise removes the subscription, decrements `totalSubscriptions`,
 	 * fires `hooks.ws.unsubscribe` (informational, not a gate - mirrors
 	 * the wire-level unsubscribe path), and returns `true`.
+	 *
+	 * Closed-WS safe: returns `false` and bumps `platform.closedWsAborts`
+	 * if the socket has already closed.
 	 */
 	unsubscribe(ws: WebSocket<unknown>, topic: string): boolean;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svelte-adapter-uws",
-  "version": "0.5.4",
+  "version": "0.5.5",
   "publishConfig": {
     "tag": "latest"
   },

package/plugins/cursor/server.js

@@ -254,9 +254,17 @@ export function createCursor(options = {}) {
 				const oldest = wsState.keys().next().value;
 				if (oldest !== undefined) wsState.delete(oldest);
 			}
+			let userData = {};
+			if (typeof ws.getUserData === 'function') {
+				// Closed-WS race: caller may reach here after an `await`
+				// that outlasted the socket; getUserData throws on a
+				// freed handle. Fall back to an empty userData rather
+				// than crashing the worker.
+				try { userData = ws.getUserData(); } catch { userData = {}; }
+			}
 			state = {
 				key: String(++connCounter),
-				user: select(typeof ws.getUserData === 'function' ? ws.getUserData() : {}),
+				user: select(userData),
 				topics: new Set()
 			};
 			wsState.set(ws, state);
@@ -377,9 +385,21 @@ export function createCursor(options = {}) {
 	 * Route a broadcast through the per-topic coalesce window when
 	 * `topicThrottle` is enabled, or directly publish when disabled.
 	 *
-	 * Leading-edge synchronous flush preserves the contract that the first
-	 * call on an idle topic publishes immediately (no setTimeout(0) detour).
-	 * Trailing-edge fires via the single tracker-wide `tickTimer`.
+	 * Leading-edge claims the cadence slot synchronously (lastFlush =
+	 * now) but defers the actual flush by one microtask so co-arriving
+	 * broadcasts in the same JS pass batch into a single bulk frame.
+	 * Without the microtask defer, an event-loop pause > topicThrottleMs
+	 * caused the post-pause first cursor to fire alone (single-cursor
+	 * UPDATE) while every other cursor in the same burst queued to the
+	 * trailing tick: under sustained pressure (30K RPCs/sec/worker) this
+	 * fragmented 86% of cursor frames into single-cursor UPDATEs.
+	 * Microtasks run after the current synchronous code completes but
+	 * before the next I/O / setTimeout / event-loop tick, so any
+	 * subsequent broadcast() in the same handler batch adds itself to
+	 * `dirty` before the flush runs.
+	 *
+	 * Trailing-edge fires via the single tracker-wide `tickTimer` for
+	 * broadcasts that land mid-window.
 	 */
 	function broadcast(topic, key, data, platform) {
 		if (topicThrottleMs <= 0) {
@@ -389,7 +409,7 @@ export function createCursor(options = {}) {
 
 		let state = topicFlush.get(topic);
 		if (!state) {
-			state = { dirty: new Map(), lastFlush: 0 };
+			state = { dirty: new Map(), lastFlush: 0, pendingMicroflush: false };
 			topicFlush.set(topic, state);
 		}
 		state.dirty.set(key, { data, platform });
@@ -397,9 +417,18 @@ export function createCursor(options = {}) {
 		const now = Date.now();
 		if (now - state.lastFlush >= topicThrottleMs) {
 			state.lastFlush = now;
-			flushDirty(topic, state.dirty);
-			state.dirty.clear();
 			dirtyTopics.delete(topic);
+			// Schedule once per cycle slot; subsequent broadcasts inside
+			// the same microtask boundary just append to `state.dirty`.
+			if (!state.pendingMicroflush) {
+				state.pendingMicroflush = true;
+				queueMicrotask(() => {
+					state.pendingMicroflush = false;
+					if (state.dirty.size === 0) return;
+					flushDirty(topic, state.dirty);
+					state.dirty.clear();
+				});
+			}
 			return;
 		}
 

package/plugins/groups/server.js

@@ -168,7 +168,15 @@ export function createGroup(name, options = {}) {
 			// Publish join BEFORE subscribing so joiner doesn't see own join
 			platform.publish(internalTopic, 'join', { role, count: members.size });
 
-			ws.subscribe(internalTopic);
+			// Callers reach `join` after their own async auth chain; the
+			// socket may have closed in the meantime. Roll back the
+			// member entry instead of letting uWS's "Invalid access"
+			// crash the worker.
+			try { ws.subscribe(internalTopic); }
+			catch {
+				members.delete(ws);
+				return false;
+			}
 
 			// Send current member list to the joiner
 			platform.send(ws, internalTopic, 'members', membersList());

package/plugins/presence/server.js

@@ -443,7 +443,13 @@ export function createPresence(options = {}) {
 			let connTopics = wsTopics.get(ws);
 			if (connTopics && connTopics.has(topic)) return;
 
-			const data = select(ws.getUserData());
+			// Callers typically reach here after an `await` in their own
+			// join flow (auth, loader, RPC handshake). If the socket
+			// closed mid-await `getUserData()` throws; presence is a
+			// best-effort layer, so silently no-op rather than crash.
+			let userData;
+			try { userData = ws.getUserData(); } catch { return; }
+			const data = select(userData);
 			if (!data || typeof data !== 'object') {
 				throw new TypeError(
 					`presence select() must return a plain object, got ${data === null ? 'null' : typeof data}`
@@ -492,8 +498,10 @@ export function createPresence(options = {}) {
 				bufferDiff(topic, 'join', key, data, platform);
 			}
 
-			// Subscribe this ws to the presence channel (server-side, idempotent)
-			ws.subscribe(presenceTopic);
+			// Subscribe this ws to the presence channel (server-side, idempotent).
+			// `platform.send` is closed-ws-safe on the adapter side; the
+			// direct `ws.subscribe` is not - guard locally.
+			try { ws.subscribe(presenceTopic); } catch { return; }
 
 			// Send the full current snapshot to this connection. The joining
 			// user sees the complete state (including themselves) immediately;
@@ -518,7 +526,7 @@ export function createPresence(options = {}) {
 			capturePlatform(platform);
 			const users = topicPresence.get(topic);
 			const presenceTopic = TOPIC_PREFIX + topic;
-			ws.subscribe(presenceTopic);
+			try { ws.subscribe(presenceTopic); } catch { return; }
 			platform.send(ws, presenceTopic, 'presence_state', snapshotState(users));
 		},
 

package/testing.js

@@ -150,16 +150,25 @@ export async function createTestServer(options = {}) {
 
 	const closeHookRegisteredT = !!handler.close;
 	let sendToAsyncWarnedT = false;
+	// Mirrors prod's `closedWsAborts`. createTestServer uses real uWS,
+	// so a closed-WS race (subscribe gate awaits something, client
+	// closes during the await, post-await ws.subscribe throws) is
+	// exercisable here exactly like in production. Hardening below
+	// catches the uWS exception, bumps this counter, and returns the
+	// platform's success-shaped no-op sentinel.
+	let closedWsAbortsT = 0;
 	function bumpInT(ws, message) {
 		if (!closeHookRegisteredT) return;
-		const stats = ws.getUserData()[WS_STATS];
+		let stats;
+		try { stats = ws.getUserData()[WS_STATS]; } catch { return; }
 		if (!stats) return;
 		stats.messagesIn++;
 		stats.bytesIn += typeof message === 'string' ? message.length : message.byteLength;
 	}
 	function bumpOutT(ws, payload) {
 		if (!closeHookRegisteredT) return;
-		const stats = ws.getUserData()[WS_STATS];
+		let stats;
+		try { stats = ws.getUserData()[WS_STATS]; } catch { return; }
 		if (!stats) return;
 		stats.messagesOut++;
 		stats.bytesOut += payload.length;
@@ -186,12 +195,15 @@ export async function createTestServer(options = {}) {
 		const delay = chaos.getDelayMs();
 		if (delay > 0) {
 			setTimeout(() => {
-				try { ws.send(payload, false, false); } catch {}
+				try { ws.send(payload, false, false); }
+				catch { closedWsAbortsT++; return; }
 				bumpOutT(ws, payload);
 			}, delay);
 			return 1;
 		}
-		const result = ws.send(payload, false, false);
+		let result;
+		try { result = ws.send(payload, false, false); }
+		catch { closedWsAbortsT++; return 2; }
 		bumpOutT(ws, payload);
 		return result;
 	}
@@ -225,7 +237,10 @@ export async function createTestServer(options = {}) {
 			const msg = envelope(topic, event, data);
 			let count = 0;
 			for (const ws of wsConnections) {
-				const decision = filter(ws.getUserData());
+				let userData;
+				try { userData = ws.getUserData(); }
+				catch { closedWsAbortsT++; continue; }
+				const decision = filter(userData);
 				if (decision && typeof decision.then === 'function') {
 					if (!sendToAsyncWarnedT) {
 						sendToAsyncWarnedT = true;
@@ -247,6 +262,7 @@ export async function createTestServer(options = {}) {
 		},
 		get connections() { return wsConnections.size; },
 		get assertions() { return readAssertionCounts(); },
+		get closedWsAborts() { return closedWsAbortsT; },
 		subscribers(topic) { return app.numSubscribers(topic); },
 		// Mirror production: report a numeric cap and a constant-time
 		// bufferedAmount so test code can exercise the same backpressure-
@@ -264,7 +280,9 @@ export async function createTestServer(options = {}) {
 			// user hook so async hooks gate correctly.
 			// Server-side caller: trust non-ASCII topics (matches platform.subscribe in production).
 			if (!isValidWireTopic(topic, true)) return 'INVALID_TOPIC';
-			const subs = ws.getUserData()[WS_SUBSCRIPTIONS];
+			let subs;
+			try { subs = ws.getUserData()[WS_SUBSCRIPTIONS]; }
+			catch { closedWsAbortsT++; return null; }
 			if (!(subs instanceof Set)) return 'INVALID_TOPIC';
 			if (subs.has(topic)) return null;
 			if (subs.size >= MAX_SUBSCRIPTIONS_PER_CONNECTION) return 'RATE_LIMITED';
@@ -272,7 +290,8 @@ export async function createTestServer(options = {}) {
 			if (denial !== null) return denial;
 			if (subs.has(topic)) return null;
 			if (subs.size >= MAX_SUBSCRIPTIONS_PER_CONNECTION) return 'RATE_LIMITED';
-			ws.subscribe(topic);
+			try { ws.subscribe(topic); }
+			catch { closedWsAbortsT++; return null; }
 			subs.add(topic);
 			return null;
 		},
@@ -282,9 +301,12 @@ export async function createTestServer(options = {}) {
 			return await runUserSubscribeGateT(ws, topic);
 		},
 		unsubscribe(ws, topic) {
-			const subs = ws.getUserData()[WS_SUBSCRIPTIONS];
+			let subs;
+			try { subs = ws.getUserData()[WS_SUBSCRIPTIONS]; }
+			catch { closedWsAbortsT++; return false; }
 			if (!(subs instanceof Set) || !subs.has(topic)) return false;
-			ws.unsubscribe(topic);
+			try { ws.unsubscribe(topic); }
+			catch { closedWsAbortsT++; return false; }
 			subs.delete(topic);
 			handler.unsubscribe?.(ws, topic, { platform: ws.getUserData()[WS_PLATFORM] });
 			return true;
@@ -370,7 +392,12 @@ export async function createTestServer(options = {}) {
 			app.publish(fanoutTopic, sharedBatchEnv, false, false);
 		},
 		request(ws, event, data, options) {
-			const userData = ws.getUserData();
+			let userData;
+			try { userData = ws.getUserData(); }
+			catch {
+				closedWsAbortsT++;
+				return Promise.reject(new Error('connection closed'));
+			}
 			let pending = userData[WS_PENDING_REQUESTS];
 			if (!pending) {
 				pending = new Map();
@@ -390,7 +417,21 @@ export async function createTestServer(options = {}) {
 				}, timeoutMs);
 				pending.set(ref, { resolve, reject, timer });
 				const payload = JSON.stringify({ type: 'request', ref, event, data: data ?? null });
-				sendOutboundT(ws, payload);
+				// Direct ws.send so we can distinguish "closed WS"
+				// (throws -> reject now) from "backpressure DROPPED"
+				// (returns 2 -> let it time out, matches production
+				// semantics where uWS will not retry on its own).
+				// sendOutboundT exists for chaos-injection; the request
+				// flow takes the bare path and re-uses bumpOutT.
+				try { ws.send(payload, false, false); }
+				catch {
+					closedWsAbortsT++;
+					clearTimeout(timer);
+					pending.delete(ref);
+					reject(new Error('connection closed'));
+					return;
+				}
+				bumpOutT(ws, payload);
 			});
 		},
 		topic(name) {
@@ -623,7 +664,8 @@ export async function createTestServer(options = {}) {
 								sendDeniedT(ws, msg.topic, ref, 'RATE_LIMITED');
 								return;
 							}
-							ws.subscribe(msg.topic);
+							try { ws.subscribe(msg.topic); }
+							catch { closedWsAbortsT++; return; }
 							subs.add(msg.topic);
 							sendSubscribedT(ws, msg.topic, ref);
 							return;
@@ -680,7 +722,8 @@ export async function createTestServer(options = {}) {
 									sendDeniedT(ws, topic, ref, 'RATE_LIMITED');
 									continue;
 								}
-								ws.subscribe(topic);
+								try { ws.subscribe(topic); }
+								catch { closedWsAbortsT++; continue; }
 								udSubs.add(topic);
 								sendSubscribedT(ws, topic, ref);
 							}

package/vite.js

@@ -398,6 +398,13 @@ export default function uws(options = {}) {
 			// see the documented "no violations" state.
 			return new Map();
 		},
+		get closedWsAborts() {
+			// Dev uses Node's `ws` library, not uWS - sockets do not
+			// throw "Invalid access" when written to after close, so
+			// the closed-WS abort path doesn't exist here. Mirror the
+			// prod surface as a constant zero.
+			return 0;
+		},
 		subscribers(topic) {
 			let count = 0;
 			for (const [, topics] of subscriptions) {