svelte-adapter-uws 0.5.4 → 0.5.6

package/README.md

@@ -1274,6 +1274,22 @@ export async function GET({ platform }) {
 
 The returned `Map` is the live module-level instance - read-only, do not mutate. In test mode (`process.env.VITEST` set, or `NODE_ENV === 'test'`) the assert helper additionally throws so test runners surface the failure; in production it logs and counts but does not throw, so a violation inside a uWS callback frame cannot crash the worker.
 
+### `platform.closedWsAborts`
+
+Per-worker count of best-effort uWS operations that aborted because the underlying WebSocket had already closed. Bumped every time `platform.subscribe`, `platform.unsubscribe`, `platform.send`, `platform.sendCoalesced`, `platform.sendTo`, or `platform.request` is called on a `ws` whose native handle has been freed - typically because the caller `await`-ed something (auth, loader, subscribe hook) and the client closed during the wait.
+
+These methods are *closed-WS safe* by contract: they swallow uWS's `Invalid access of closed uWS.WebSocket` exception, return a success-shaped no-op sentinel (`null` for subscribe, `false` for unsubscribe, `2` for send, etc.), and bump this counter. Callers can fire-and-forget without a per-site try/catch.
+
+```js
+export async function GET({ platform }) {
+  return json({ closedWsAborts: platform.closedWsAborts });
+}
+```
+
+A non-zero value is normal under client churn (tab close, network blips, mass reconnect waves). A rapidly-growing value under steady load indicates either pathological client behaviour or that the server's async setup path is too long for its connect rate. In clustered mode, sum across workers for cluster-wide visibility.
+
+Monotonic, per-worker, reset only on process restart.
+
 ### `platform.pressure` and `platform.onPressure(cb)`
 
 Worker-local backpressure signal. The adapter samples once per second (configurable) and reports the most urgent active stress as a single `reason` enum, so user code can degrade with intent instead of generic panic.
@@ -2882,22 +2898,23 @@ const positions = cursor('canvas', { maxAge: 30_000 });
 
 #### How throttle works
 
-The cursor plugin uses two layers of leading-edge + trailing-edge throttle:
+The cursor plugin uses two layers of throttle:
 
-1. **`throttle`** caps how often a single user broadcasts on a single topic.
-2. **`topicThrottle`** caps how often a topic emits a frame at all. Multiple movers in the same window coalesce into one `bulk` array; a single mover in the window emits one `update`.
+1. **`throttle`** caps how often a single user broadcasts on a single topic. Leading edge fires the first move immediately; subsequent moves within the window are stored and a trailing timer flushes the latest position at the window boundary.
+2. **`topicThrottle`** caps how often a topic emits a frame at all. Every move appends to the topic's dirty set and shares a single tracker-wide timer that fires once per cadence cycle. Multiple movers in the same window coalesce into one `bulk` array; a single mover in the window emits one `update`. There is no synchronous leading-edge fire: every flush goes through the tick, so movers arriving from different sockets (each a separate JS task in production) batch into the same frame regardless of how many task boundaries separate them.
 
 ```
 throttle: 16, topicThrottle: 16
 
-t=0    A.update({x:0})         --> 'join' A, 'update' {x:0}        (leading edge of both)
+t=0    A.update({x:0})         --> 'join' A (catalog channel)
+                                   position queued in topic dirty set
 t=4    B.update({x:0})         --> 'join' B (catalog channel)
                                    position queued in topic dirty set
 t=8    A.update({x:5})         --> queued (entry-level throttle says wait until t=16)
-t=16   [trailing timer fires]  --> 'bulk' [{key:A, data:{x:5}}, {key:B, data:{x:0}}]
+t=16   [tick timer fires]      --> 'bulk' [{key:A, data:{x:5}}, {key:B, data:{x:0}}]
 ```
 
-The trailing edges ensure you always see where each cursor stopped, even when the user stops moving mid-window.
+Latency cost vs. the alternate "fire-the-first-mover-synchronously" design: the first mover on an idle topic waits up to `topicThrottleMs` before its frame leaves. At the default 16 ms (~60 Hz) that's one frame-budget; well below the perceptual floor for cursor. The cost buys cross-socket coalescing - without it, the first mover from each socket fragments out as its own single-cursor `update` because uWS dispatches each WS message as its own JS task and microtasks drain between dispatches.
 
 #### Limitations
 
@@ -3333,6 +3350,8 @@ Per-worker limitations (acceptable for most apps):
 - `platform.connections`  - returns the count for the local worker only
 - `platform.subscribers(topic)`  - returns the count for the local worker only
 - `platform.sendTo(filter, ...)`  - iterates the local worker's connections only, no cross-worker relay
+- `platform.closedWsAborts`  - per-worker counter; sum across workers for cluster total
+- `platform.assertions`  - per-worker counter Map
 
 ### Docker / multi-process deployments (Linux)
 

package/files/handler.js

@@ -421,7 +421,8 @@ const closeHookRegistered = WS_ENABLED && !!wsModule.close;
  */
 function bumpIn(ws, message) {
 	if (!closeHookRegistered) return;
-	const stats = ws.getUserData()[WS_STATS];
+	let stats;
+	try { stats = ws.getUserData()[WS_STATS]; } catch { return; }
 	if (!stats) return;
 	stats.messagesIn++;
 	stats.bytesIn += typeof message === 'string' ? message.length : message.byteLength;
@@ -439,7 +440,8 @@ function bumpIn(ws, message) {
  */
 function bumpOut(ws, payload) {
 	if (!closeHookRegistered) return;
-	const stats = ws.getUserData()[WS_STATS];
+	let stats;
+	try { stats = ws.getUserData()[WS_STATS]; } catch { return; }
 	if (!stats) return;
 	stats.messagesOut++;
 	stats.bytesOut += payload.length;
@@ -489,6 +491,16 @@ function maybeWarnTopicRegistry() {
 
 let publishCountWindow = 0;
 let totalSubscriptions = 0;
+// Count of best-effort operations that aborted because the underlying
+// uWS WebSocket had already closed. The platform contract is that
+// ws-targeted public methods (subscribe / unsubscribe / send /
+// sendCoalesced / request) and internal helpers that may run after an
+// `await` never propagate uWS's "Invalid access of closed
+// uWS.WebSocket" exception to user code - they swallow it, return a
+// no-op sentinel, and bump this counter. Operators can read
+// `platform.closedWsAborts` to detect when mass-connect kernel /
+// backpressure churn is closing sockets mid-async-setup at scale.
+let closedWsAborts = 0;
 
 /**
  * Per-topic publish counters for runaway-publisher detection. Single
@@ -824,7 +836,7 @@ async function runUserSubscribeGate(ws, topic) {
 function sendSubscribed(ws, topic, ref) {
 	if (ref === null) return;
 	const payload = JSON.stringify({ type: 'subscribed', topic, ref });
-	ws.send(payload, false, false);
+	try { ws.send(payload, false, false); } catch { closedWsAborts++; return; }
 	bumpOut(ws, payload);
 }
 
@@ -840,7 +852,7 @@ function sendSubscribed(ws, topic, ref) {
 function sendSubscribeDenied(ws, topic, ref, reason) {
 	if (ref === null) return;
 	const payload = JSON.stringify({ type: 'subscribe-denied', topic, ref, reason });
-	ws.send(payload, false, false);
+	try { ws.send(payload, false, false); } catch { closedWsAborts++; return; }
 	bumpOut(ws, payload);
 }
 
@@ -852,15 +864,29 @@ function sendSubscribeDenied(ws, topic, ref, reason) {
  * @param {import('uWebSockets.js').WebSocket<any>} ws
  */
 function flushCoalescedFor(ws) {
-	const userData = ws.getUserData();
+	let userData;
+	try { userData = ws.getUserData(); }
+	catch { closedWsAborts++; return; }
 	const pending = userData[WS_COALESCED];
 	if (!pending || pending.size === 0) return;
 	assert(pending instanceof Map, 'coalesce.pending-type', null);
+	let aborted = false;
 	drainCoalesced(pending, (msg) => {
+		if (aborted) return 2;
 		assert(typeof msg.topic === 'string', 'coalesce.entry-topic-type', null);
 		assert(typeof msg.event === 'string', 'coalesce.entry-event-type', null);
 		const payload = envelopePrefix(msg.topic, msg.event) + JSON.stringify(msg.data ?? null) + '}';
-		const result = ws.send(payload, false, false);
+		let result;
+		try { result = ws.send(payload, false, false); }
+		catch {
+			// Socket closed mid-drain. There will be no further `drain`
+			// event to retry on, so dropping the rest of the buffer is
+			// the only correct outcome - returning 1 (BACKPRESSURE) lets
+			// drainCoalesced clear the current entry and stop iterating.
+			closedWsAborts++;
+			aborted = true;
+			return 1;
+		}
 		// `result` MUST propagate to drainCoalesced. 0=SUCCESS removes the
 		// entry; 1=BACKPRESSURE removes it and halts the loop; 2=DROPPED
 		// retains the entry for retry on next drain. Don't refactor away
@@ -869,6 +895,7 @@ function flushCoalescedFor(ws) {
 		if (result !== 2) bumpOut(ws, payload);
 		return result;
 	});
+	if (aborted) pending.clear();
 }
 
 /** @type {import('./index.js').Platform} */
@@ -927,7 +954,13 @@ const platform = {
 	send(ws, topic, event, data) {
 		const payload = envelopePrefix(topic, event) + JSON.stringify(data ?? null) + '}';
 		assert(payload.length > 0, 'envelope.send-empty', { topic, event });
-		const result = ws.send(payload, false, false);
+		// `ws.send` throws on a freed native handle (callers may reach
+		// here after an `await` that outlasted the socket). Return 2
+		// (DROPPED, the uWS sentinel) so callers can pattern-match
+		// without distinguishing closed from backpressure-dropped.
+		let result;
+		try { result = ws.send(payload, false, false); }
+		catch { closedWsAborts++; return 2; }
 		bumpOut(ws, payload);
 		return result;
 	},
@@ -954,7 +987,9 @@ const platform = {
 	 * on the next drain.
 	 */
 	sendCoalesced(ws, { key, topic, event, data }) {
-		const userData = ws.getUserData();
+		let userData;
+		try { userData = ws.getUserData(); }
+		catch { closedWsAborts++; return; }
 		let pending = userData[WS_COALESCED];
 		if (!pending) {
 			pending = new Map();
@@ -990,7 +1025,15 @@ const platform = {
 		const envelope = envelopePrefix(topic, event) + JSON.stringify(data ?? null) + '}';
 		let count = 0;
 		for (const ws of wsConnections) {
-			const decision = filter(ws.getUserData());
+			// uWS's close event fires synchronously and removes from
+			// wsConnections before any user code runs, so under normal
+			// flow every entry here is open. Defensive try/catch covers
+			// pathological cases (e.g. user filter triggers a close via
+			// side effect, or another worker raced through cleanup).
+			let userData;
+			try { userData = ws.getUserData(); }
+			catch { closedWsAborts++; continue; }
+			const decision = filter(userData);
 			if (decision && typeof decision.then === 'function') {
 				if (!sendToAsyncWarned) {
 					sendToAsyncWarned = true;
@@ -1005,7 +1048,8 @@ const platform = {
 				continue;
 			}
 			if (decision) {
-				ws.send(envelope, false, false);
+				try { ws.send(envelope, false, false); }
+				catch { closedWsAborts++; continue; }
 				bumpOut(ws, envelope);
 				count++;
 			}
@@ -1040,6 +1084,30 @@ const platform = {
 		return readAssertionCounts();
 	},
 
+	/**
+	 * Per-worker count of best-effort uWS operations that aborted
+	 * because the underlying WebSocket had already closed.
+	 *
+	 * Ws-targeted platform methods (`subscribe`, `unsubscribe`, `send`,
+	 * `sendCoalesced`, `sendTo`, `request`) and the wire-level
+	 * subscribe / subscribe-batch handlers all swallow uWS's "Invalid
+	 * access of closed uWS.WebSocket" exception so callers never need
+	 * a per-site try/catch. Each swallow bumps this counter.
+	 *
+	 * A non-zero value is normal under churn (clients close mid-async-
+	 * setup all the time). A rapidly-growing value under steady load
+	 * indicates either pathological client behaviour or that the
+	 * server's async setup path is too long for its connect rate -
+	 * worth investigating but not, by itself, a bug.
+	 *
+	 * Monotonic, per-worker, reset only on process restart.
+	 *
+	 * @returns {number}
+	 */
+	get closedWsAborts() {
+		return closedWsAborts;
+	},
+
 	/**
 	 * Number of clients subscribed to a specific topic.
 	 */
@@ -1138,7 +1206,13 @@ const platform = {
 		// non-ASCII topic names (`__signal:Jose`, presence rooms with
 		// localized labels) must not be blocked at the platform layer.
 		if (!isValidWireTopic(topic, true)) return 'INVALID_TOPIC';
-		const subs = ws.getUserData()[WS_SUBSCRIPTIONS];
+		// `ws.getUserData()` throws on a freed native handle. RPC and
+		// plugin code paths routinely `await` something else before
+		// reaching here, so the WS may already be closed by the time
+		// this runs. Treat as a silent no-op.
+		let subs;
+		try { subs = ws.getUserData()[WS_SUBSCRIPTIONS]; }
+		catch { closedWsAborts++; return null; }
 		assert(subs instanceof Set, 'subs.shape', null);
 		if (subs.has(topic)) return null;
 		if (subs.size >= MAX_SUBSCRIPTIONS_PER_CONNECTION) return 'RATE_LIMITED';
@@ -1150,7 +1224,13 @@ const platform = {
 		// counter bump in that case.
 		if (subs.has(topic)) return null;
 		if (subs.size >= MAX_SUBSCRIPTIONS_PER_CONNECTION) return 'RATE_LIMITED';
-		ws.subscribe(topic);
+		// `ws.subscribe()` throws if the socket closed during the await
+		// above. Under mass-connect / backpressure churn this is the
+		// dominant abort mode (10-15% of connections close mid-setup).
+		// Swallow, count, and return success-shaped null so callers can
+		// fire-and-forget without per-site try/catch.
+		try { ws.subscribe(topic); }
+		catch { closedWsAborts++; return null; }
 		subs.add(topic);
 		totalSubscriptions++;
 		return null;
@@ -1227,10 +1307,17 @@ const platform = {
 	 * @returns {boolean} `true` if a subscription was removed
 	 */
 	unsubscribe(ws, topic) {
-		const subs = ws.getUserData()[WS_SUBSCRIPTIONS];
+		// Closed sockets get an early-out: there is no subscription
+		// state to remove, no uWS bookkeeping to drop, no informational
+		// hook to fire. The platform contract is "best effort; no throw
+		// on closed WS" - mirrors subscribe / send.
+		let subs;
+		try { subs = ws.getUserData()[WS_SUBSCRIPTIONS]; }
+		catch { closedWsAborts++; return false; }
 		assert(subs instanceof Set, 'subs.shape-unsubscribe', null);
 		if (!subs.has(topic)) return false;
-		ws.unsubscribe(topic);
+		try { ws.unsubscribe(topic); }
+		catch { closedWsAborts++; return false; }
 		subs.delete(topic);
 		totalSubscriptions--;
 		assert(totalSubscriptions >= 0, 'subs.total-negative', { totalSubscriptions });
@@ -1493,7 +1580,12 @@ const platform = {
 	 * so cleanup is automatic on close - no module-level leak risk.
 	 */
 	request(ws, event, data, options) {
-		const userData = ws.getUserData();
+		let userData;
+		try { userData = ws.getUserData(); }
+		catch {
+			closedWsAborts++;
+			return Promise.reject(new Error('connection closed'));
+		}
 		let pending = userData[WS_PENDING_REQUESTS];
 		if (!pending) {
 			pending = new Map();
@@ -1514,7 +1606,14 @@ const platform = {
 			}, timeoutMs);
 			pending.set(ref, { resolve, reject, timer });
 			const payload = JSON.stringify({ type: 'request', ref, event, data: data ?? null });
-			ws.send(payload, false, false);
+			try { ws.send(payload, false, false); }
+			catch {
+				closedWsAborts++;
+				clearTimeout(timer);
+				pending.delete(ref);
+				reject(new Error('connection closed'));
+				return;
+			}
 			bumpOut(ws, payload);
 		});
 	},
@@ -3093,7 +3192,8 @@ if (WS_ENABLED) {
 						sendSubscribeDenied(ws, msg.topic, ref, 'RATE_LIMITED');
 						return;
 					}
-					try { ws.subscribe(msg.topic); } catch { return; }
+					try { ws.subscribe(msg.topic); }
+					catch { closedWsAborts++; return; }
 					subs.add(msg.topic);
 					totalSubscriptions++;
 					if (wsDebug) console.log('[ws] subscribe topic=%s', msg.topic);
@@ -3171,7 +3271,8 @@ if (WS_ENABLED) {
 							sendSubscribeDenied(ws, topic, ref, 'RATE_LIMITED');
 							continue;
 						}
-						try { ws.subscribe(topic); } catch { continue; }
+						try { ws.subscribe(topic); }
+						catch { closedWsAborts++; continue; }
 						subs.add(topic);
 						totalSubscriptions++;
 						subscribed++;

package/index.d.ts

@@ -1202,6 +1202,14 @@ export interface Platform {
 	 * Send a message to a single WebSocket connection.
 	 * Wraps in the same `{ topic, event, data }` envelope as `publish()`.
 	 *
+	 * Returns the uWS send result: `0` = SUCCESS, `1` = BACKPRESSURE
+	 * (queued, will flush on drain), `2` = DROPPED (frame discarded
+	 * because the socket has closed or its queue is over the limit).
+	 *
+	 * Closed-WS safe: if the socket has already closed, returns `2`
+	 * (DROPPED) and bumps `platform.closedWsAborts` rather than
+	 * propagating uWS's "Invalid access" exception.
+	 *
 	 * @example
 	 * ```js
 	 * // In hooks.ws.js - reply to sender:
@@ -1310,6 +1318,36 @@ export interface Platform {
 	 */
 	readonly connections: number;
 
+	/**
+	 * Per-worker count of best-effort uWS operations that aborted
+	 * because the underlying WebSocket had already closed.
+	 *
+	 * Ws-targeted platform methods (`subscribe`, `unsubscribe`, `send`,
+	 * `sendCoalesced`, `sendTo`, `request`) and the wire-level
+	 * subscribe / subscribe-batch handlers swallow uWS's "Invalid
+	 * access of closed uWS.WebSocket" exception so callers never need
+	 * a per-site try/catch when a socket closes mid-async-setup.
+	 * Each swallow bumps this counter.
+	 *
+	 * A non-zero value is normal under client churn (browser tab close,
+	 * network blips, mass-reconnect waves). A rapidly-growing value
+	 * under steady load indicates either pathological client behaviour
+	 * or that the server's async setup path is too long for its
+	 * connect rate - worth investigating but not, on its own, a bug.
+	 *
+	 * Monotonic, per-worker, reset only on process restart. In
+	 * clustered mode, sum across workers to get the cluster total.
+	 *
+	 * @example
+	 * ```js
+	 * // periodic ops log
+	 * setInterval(() => {
+	 *   console.log('closed-ws aborts:', platform.closedWsAborts);
+	 * }, 60_000);
+	 * ```
+	 */
+	readonly closedWsAborts: number;
+
 	/**
 	 * Number of clients subscribed to a specific topic.
 	 *
@@ -1387,6 +1425,13 @@ export interface Platform {
 	 * hook may be async (the framework awaits the hook before inspecting
 	 * its return). Callers must `await` the result.
 	 *
+	 * Closed-WS safe: if the socket closes during the awaited hook (or
+	 * before the call, e.g. caller `await`-ed something else first) the
+	 * method silently returns `null` rather than propagating uWS's
+	 * "Invalid access of closed uWS.WebSocket" exception. Each abort
+	 * increments `platform.closedWsAborts`. Callers can fire-and-forget
+	 * without a per-site try/catch.
+	 *
 	 * @example
 	 * ```js
 	 * // In an RPC handler that needs to subscribe the connection
@@ -1456,6 +1501,9 @@ export interface Platform {
 	 * otherwise removes the subscription, decrements `totalSubscriptions`,
 	 * fires `hooks.ws.unsubscribe` (informational, not a gate - mirrors
 	 * the wire-level unsubscribe path), and returns `true`.
+	 *
+	 * Closed-WS safe: returns `false` and bumps `platform.closedWsAborts`
+	 * if the socket has already closed.
 	 */
 	unsubscribe(ws: WebSocket<unknown>, topic: string): boolean;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svelte-adapter-uws",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "publishConfig": {
     "tag": "latest"
   },

package/plugins/cursor/server.js

@@ -254,9 +254,17 @@ export function createCursor(options = {}) {
 				const oldest = wsState.keys().next().value;
 				if (oldest !== undefined) wsState.delete(oldest);
 			}
+			let userData = {};
+			if (typeof ws.getUserData === 'function') {
+				// Closed-WS race: caller may reach here after an `await`
+				// that outlasted the socket; getUserData throws on a
+				// freed handle. Fall back to an empty userData rather
+				// than crashing the worker.
+				try { userData = ws.getUserData(); } catch { userData = {}; }
+			}
 			state = {
 				key: String(++connCounter),
-				user: select(typeof ws.getUserData === 'function' ? ws.getUserData() : {}),
+				user: select(userData),
 				topics: new Set()
 			};
 			wsState.set(ws, state);
@@ -375,11 +383,30 @@ export function createCursor(options = {}) {
 
 	/**
 	 * Route a broadcast through the per-topic coalesce window when
-	 * `topicThrottle` is enabled, or directly publish when disabled.
+	 * `topicThrottle` is enabled, or publish immediately when disabled.
+	 *
+	 * Every broadcast appends to `dirty` and arms (or shares) the
+	 * tracker-wide tick timer. When the cadence window has already
+	 * elapsed since the last flush, the tick is armed at delay 0 so it
+	 * fires on the next event-loop iteration; otherwise it is armed at
+	 * the remaining window time. Either way, the actual fanout happens
+	 * inside `tick()`, never synchronously.
+	 *
+	 * Why no synchronous leading-edge fire: uWS dispatches each WS
+	 * message as its own JS task. Microtasks drain at the C++ <-> JS
+	 * boundary between tasks, so a `queueMicrotask`-deferred flush
+	 * (previous design) runs BEFORE the next socket's message handler -
+	 * cross-socket coalescing window is zero, and every "first message
+	 * of a new cadence slot" from any socket fires alone as a single-
+	 * cursor UPDATE. Going through the tick timer instead schedules a
+	 * macrotask, which is dequeued only after the poll phase processes
+	 * every ready message on every socket. All messages dispatched in
+	 * the same loop iteration end up in one flush.
 	 *
-	 * Leading-edge synchronous flush preserves the contract that the first
-	 * call on an idle topic publishes immediately (no setTimeout(0) detour).
-	 * Trailing-edge fires via the single tracker-wide `tickTimer`.
+	 * Latency cost: the first cursor on an idle topic waits up to
+	 * `topicThrottleMs` (one cycle) before its frame leaves. At the
+	 * default 16 ms / 60 Hz this is one frame-budget; at 8 ms / 125 Hz
+	 * it is half a frame. Below the perceptual floor for cursor.
 	 */
 	function broadcast(topic, key, data, platform) {
 		if (topicThrottleMs <= 0) {
@@ -389,22 +416,19 @@ export function createCursor(options = {}) {
 
 		let state = topicFlush.get(topic);
 		if (!state) {
-			state = { dirty: new Map(), lastFlush: 0 };
+			// Anchor lastFlush one full cycle in the past so the first
+			// broadcast on a fresh topic is treated as "cycle ready" and
+			// schedules the tick at delay 0 with zero drift, rather than
+			// inflating drift stats by Date.now() worth of "lateness".
+			state = { dirty: new Map(), lastFlush: Date.now() - topicThrottleMs };
 			topicFlush.set(topic, state);
 		}
 		state.dirty.set(key, { data, platform });
-
-		const now = Date.now();
-		if (now - state.lastFlush >= topicThrottleMs) {
-			state.lastFlush = now;
-			flushDirty(topic, state.dirty);
-			state.dirty.clear();
-			dirtyTopics.delete(topic);
-			return;
-		}
-
 		dirtyTopics.add(topic);
-		armTick(Math.max(0, topicThrottleMs - (now - state.lastFlush)));
+
+		const elapsed = Date.now() - state.lastFlush;
+		const delay = elapsed >= topicThrottleMs ? 0 : topicThrottleMs - elapsed;
+		armTick(delay);
 	}
 
 	/** @type {CursorTracker} */

package/plugins/groups/server.js

@@ -168,7 +168,15 @@ export function createGroup(name, options = {}) {
 			// Publish join BEFORE subscribing so joiner doesn't see own join
 			platform.publish(internalTopic, 'join', { role, count: members.size });
 
-			ws.subscribe(internalTopic);
+			// Callers reach `join` after their own async auth chain; the
+			// socket may have closed in the meantime. Roll back the
+			// member entry instead of letting uWS's "Invalid access"
+			// crash the worker.
+			try { ws.subscribe(internalTopic); }
+			catch {
+				members.delete(ws);
+				return false;
+			}
 
 			// Send current member list to the joiner
 			platform.send(ws, internalTopic, 'members', membersList());

package/plugins/presence/server.js

@@ -443,7 +443,13 @@ export function createPresence(options = {}) {
 			let connTopics = wsTopics.get(ws);
 			if (connTopics && connTopics.has(topic)) return;
 
-			const data = select(ws.getUserData());
+			// Callers typically reach here after an `await` in their own
+			// join flow (auth, loader, RPC handshake). If the socket
+			// closed mid-await `getUserData()` throws; presence is a
+			// best-effort layer, so silently no-op rather than crash.
+			let userData;
+			try { userData = ws.getUserData(); } catch { return; }
+			const data = select(userData);
 			if (!data || typeof data !== 'object') {
 				throw new TypeError(
 					`presence select() must return a plain object, got ${data === null ? 'null' : typeof data}`
@@ -492,8 +498,10 @@ export function createPresence(options = {}) {
 				bufferDiff(topic, 'join', key, data, platform);
 			}
 
-			// Subscribe this ws to the presence channel (server-side, idempotent)
-			ws.subscribe(presenceTopic);
+			// Subscribe this ws to the presence channel (server-side, idempotent).
+			// `platform.send` is closed-ws-safe on the adapter side; the
+			// direct `ws.subscribe` is not - guard locally.
+			try { ws.subscribe(presenceTopic); } catch { return; }
 
 			// Send the full current snapshot to this connection. The joining
 			// user sees the complete state (including themselves) immediately;
@@ -518,7 +526,7 @@ export function createPresence(options = {}) {
 			capturePlatform(platform);
 			const users = topicPresence.get(topic);
 			const presenceTopic = TOPIC_PREFIX + topic;
-			ws.subscribe(presenceTopic);
+			try { ws.subscribe(presenceTopic); } catch { return; }
 			platform.send(ws, presenceTopic, 'presence_state', snapshotState(users));
 		},
 

package/testing.js

@@ -150,16 +150,25 @@ export async function createTestServer(options = {}) {
 
 	const closeHookRegisteredT = !!handler.close;
 	let sendToAsyncWarnedT = false;
+	// Mirrors prod's `closedWsAborts`. createTestServer uses real uWS,
+	// so a closed-WS race (subscribe gate awaits something, client
+	// closes during the await, post-await ws.subscribe throws) is
+	// exercisable here exactly like in production. Hardening below
+	// catches the uWS exception, bumps this counter, and returns the
+	// platform's success-shaped no-op sentinel.
+	let closedWsAbortsT = 0;
 	function bumpInT(ws, message) {
 		if (!closeHookRegisteredT) return;
-		const stats = ws.getUserData()[WS_STATS];
+		let stats;
+		try { stats = ws.getUserData()[WS_STATS]; } catch { return; }
 		if (!stats) return;
 		stats.messagesIn++;
 		stats.bytesIn += typeof message === 'string' ? message.length : message.byteLength;
 	}
 	function bumpOutT(ws, payload) {
 		if (!closeHookRegisteredT) return;
-		const stats = ws.getUserData()[WS_STATS];
+		let stats;
+		try { stats = ws.getUserData()[WS_STATS]; } catch { return; }
 		if (!stats) return;
 		stats.messagesOut++;
 		stats.bytesOut += payload.length;
@@ -186,12 +195,15 @@ export async function createTestServer(options = {}) {
 		const delay = chaos.getDelayMs();
 		if (delay > 0) {
 			setTimeout(() => {
-				try { ws.send(payload, false, false); } catch {}
+				try { ws.send(payload, false, false); }
+				catch { closedWsAbortsT++; return; }
 				bumpOutT(ws, payload);
 			}, delay);
 			return 1;
 		}
-		const result = ws.send(payload, false, false);
+		let result;
+		try { result = ws.send(payload, false, false); }
+		catch { closedWsAbortsT++; return 2; }
 		bumpOutT(ws, payload);
 		return result;
 	}
@@ -225,7 +237,10 @@ export async function createTestServer(options = {}) {
 			const msg = envelope(topic, event, data);
 			let count = 0;
 			for (const ws of wsConnections) {
-				const decision = filter(ws.getUserData());
+				let userData;
+				try { userData = ws.getUserData(); }
+				catch { closedWsAbortsT++; continue; }
+				const decision = filter(userData);
 				if (decision && typeof decision.then === 'function') {
 					if (!sendToAsyncWarnedT) {
 						sendToAsyncWarnedT = true;
@@ -247,6 +262,7 @@ export async function createTestServer(options = {}) {
 		},
 		get connections() { return wsConnections.size; },
 		get assertions() { return readAssertionCounts(); },
+		get closedWsAborts() { return closedWsAbortsT; },
 		subscribers(topic) { return app.numSubscribers(topic); },
 		// Mirror production: report a numeric cap and a constant-time
 		// bufferedAmount so test code can exercise the same backpressure-
@@ -264,7 +280,9 @@ export async function createTestServer(options = {}) {
 			// user hook so async hooks gate correctly.
 			// Server-side caller: trust non-ASCII topics (matches platform.subscribe in production).
 			if (!isValidWireTopic(topic, true)) return 'INVALID_TOPIC';
-			const subs = ws.getUserData()[WS_SUBSCRIPTIONS];
+			let subs;
+			try { subs = ws.getUserData()[WS_SUBSCRIPTIONS]; }
+			catch { closedWsAbortsT++; return null; }
 			if (!(subs instanceof Set)) return 'INVALID_TOPIC';
 			if (subs.has(topic)) return null;
 			if (subs.size >= MAX_SUBSCRIPTIONS_PER_CONNECTION) return 'RATE_LIMITED';
@@ -272,7 +290,8 @@ export async function createTestServer(options = {}) {
 			if (denial !== null) return denial;
 			if (subs.has(topic)) return null;
 			if (subs.size >= MAX_SUBSCRIPTIONS_PER_CONNECTION) return 'RATE_LIMITED';
-			ws.subscribe(topic);
+			try { ws.subscribe(topic); }
+			catch { closedWsAbortsT++; return null; }
 			subs.add(topic);
 			return null;
 		},
@@ -282,9 +301,12 @@ export async function createTestServer(options = {}) {
 			return await runUserSubscribeGateT(ws, topic);
 		},
 		unsubscribe(ws, topic) {
-			const subs = ws.getUserData()[WS_SUBSCRIPTIONS];
+			let subs;
+			try { subs = ws.getUserData()[WS_SUBSCRIPTIONS]; }
+			catch { closedWsAbortsT++; return false; }
 			if (!(subs instanceof Set) || !subs.has(topic)) return false;
-			ws.unsubscribe(topic);
+			try { ws.unsubscribe(topic); }
+			catch { closedWsAbortsT++; return false; }
 			subs.delete(topic);
 			handler.unsubscribe?.(ws, topic, { platform: ws.getUserData()[WS_PLATFORM] });
 			return true;
@@ -370,7 +392,12 @@ export async function createTestServer(options = {}) {
 			app.publish(fanoutTopic, sharedBatchEnv, false, false);
 		},
 		request(ws, event, data, options) {
-			const userData = ws.getUserData();
+			let userData;
+			try { userData = ws.getUserData(); }
+			catch {
+				closedWsAbortsT++;
+				return Promise.reject(new Error('connection closed'));
+			}
 			let pending = userData[WS_PENDING_REQUESTS];
 			if (!pending) {
 				pending = new Map();
@@ -390,7 +417,21 @@ export async function createTestServer(options = {}) {
 				}, timeoutMs);
 				pending.set(ref, { resolve, reject, timer });
 				const payload = JSON.stringify({ type: 'request', ref, event, data: data ?? null });
-				sendOutboundT(ws, payload);
+				// Direct ws.send so we can distinguish "closed WS"
+				// (throws -> reject now) from "backpressure DROPPED"
+				// (returns 2 -> let it time out, matches production
+				// semantics where uWS will not retry on its own).
+				// sendOutboundT exists for chaos-injection; the request
+				// flow takes the bare path and re-uses bumpOutT.
+				try { ws.send(payload, false, false); }
+				catch {
+					closedWsAbortsT++;
+					clearTimeout(timer);
+					pending.delete(ref);
+					reject(new Error('connection closed'));
+					return;
+				}
+				bumpOutT(ws, payload);
 			});
 		},
 		topic(name) {
@@ -623,7 +664,8 @@ export async function createTestServer(options = {}) {
 								sendDeniedT(ws, msg.topic, ref, 'RATE_LIMITED');
 								return;
 							}
-							ws.subscribe(msg.topic);
+							try { ws.subscribe(msg.topic); }
+							catch { closedWsAbortsT++; return; }
 							subs.add(msg.topic);
 							sendSubscribedT(ws, msg.topic, ref);
 							return;
@@ -680,7 +722,8 @@ export async function createTestServer(options = {}) {
 									sendDeniedT(ws, topic, ref, 'RATE_LIMITED');
 									continue;
 								}
-								ws.subscribe(topic);
+								try { ws.subscribe(topic); }
+								catch { closedWsAbortsT++; continue; }
 								udSubs.add(topic);
 								sendSubscribedT(ws, topic, ref);
 							}

package/vite.js

@@ -398,6 +398,13 @@ export default function uws(options = {}) {
 			// see the documented "no violations" state.
 			return new Map();
 		},
+		get closedWsAborts() {
+			// Dev uses Node's `ws` library, not uWS - sockets do not
+			// throw "Invalid access" when written to after close, so
+			// the closed-WS abort path doesn't exist here. Mirror the
+			// prod surface as a constant zero.
+			return 0;
+		},
 		subscribers(topic) {
 			let count = 0;
 			for (const [, topics] of subscriptions) {