const server::route_registry& routes,

const server::hook_bus& hooks,

const server::resource_budget& budget,

drain_scope& scope,

connection_engine_config config,

std::uint64_t id,

stopped_callback on_stopped,

net::peer_address peer,

const server::peer_policy* peers,

std::shared_ptr<io_socket_backend> transport,

connection_admission admission)

: admission_(std::move(admission)),

transport_(std::move(transport)),

backend_(transport_ ? *transport_ : backend),

handshaking_(static_cast<bool>(transport_)),

precounted_(admission_.seat && admission_.seat->owns()),

pool_(pool),

routes_(routes),

hooks_(hooks),

owner_(pool),

budget_(budget),

tail_charge_(budget, server::resource::body_buffer_bytes),

scope_(scope),

config_(std::move(config)),

id_(id),

on_stopped_(std::move(on_stopped)),

peer_(peer),

peers_(peers),

parser_(config_.head, budget),

outbox_(config_.outbox, budget) {

if (config_.pages == nullptr) {

// The v2 default pages serve when the options carried no

// custom factories.

config_.pages = std::make_shared<const error_page_factories>();

}

if (precounted_ && !admission_.retirement) scope_.enter();

server::diagnostic_event event{kind, reason, code};

event.protocol = protocol;

event.connection_id = id_;

event.stream_id = stream;

diagnostics_access::record(config_.diagnostics, event);

if (routed.disconnected()) {

observe(server::diagnostic_kind::stream_cancelled, sequence, routed.disconnect_reason().code(), server::diagnostic_reason::local_stop, routed.head().request_protocol);

} else {

observe(server::diagnostic_kind::stream_completed, sequence, http::outcome_code::ok, server::diagnostic_reason::none, routed.head().request_protocol);

}

if (diagnostic_failure_recorded_.exchange(true)) return;

server::diagnostic_event event{

code == http::outcome_code::limit_exceeded ? server::diagnostic_kind::resource_refused : server::diagnostic_kind::protocol_failure,

code == http::outcome_code::limit_exceeded ? server::diagnostic_reason::capacity : server::diagnostic_reason::malformed_input, code};

event.connection_id = id_;

event.resource_kind = kind;

diagnostics_access::record(config_.diagnostics, event);

{

std::lock_guard<std::mutex> lock(mu_);

if (started_) return;

started_ = true;

live_loops_ = handshaking_ ? 1 : 4;

}

if (!precounted_ && !budget_.reserve(server::resource::connections, 1, seat_).ok()) {

observe(server::diagnostic_kind::connection_rejected, 0, http::outcome_code::limit_exceeded, server::diagnostic_reason::capacity);

// Budget exhaustion: no response (the accept path closes the

// transport); report the stop so the record is erased.

backend_.release_connection(id_);

stopped_callback done;

{

std::lock_guard<std::mutex> lock(mu_);

live_loops_ = 0;

done = std::move(on_stopped_);

}

if (done) done();

return;

}

// The engine's counted unit spans its whole live window; the drain

// completion condition rides on it (finalize drops it only after

// every loop finished and the writer flushed).

observe(server::diagnostic_kind::connection_accepted);

if (!precounted_) scope_.enter();

if (handshaking_) {

auto self = shared_from_this();

spawn(pool_, handshake_loop(self), [self](task_result<void>) { self->loop_finished(); });

return;

}

start_http1();

std::shared_ptr<connection_engine> self = shared_from_this();

spawn(pool_, reader_loop(self),

[self](task_result<void>) { self->loop_finished(); });

spawn(pool_, writer_loop(self),

[self](task_result<void>) { self->loop_finished(); });

spawn(pool_, route_loop(self),

[self](task_result<void>) { self->loop_finished(); });

spawn(pool_, watchdog_loop(self),

[self](task_result<void>) { self->loop_finished(); });

#ifdef NATIVE_V3_TLS

tls_handshake_operation operation(self->owner_, self->id_,

std::chrono::steady_clock::now() + self->config_.timeouts.handshake);

operation.submit(self->backend_);

const auto result = co_await operation;

auto& transport = static_cast<tls_socket_backend&>(self->backend_);

const auto protocol = transport.negotiated_protocol();

if (result.code != http::outcome_code::ok

|| (protocol != tls_negotiated_protocol::none && protocol != tls_negotiated_protocol::http1 && protocol != tls_negotiated_protocol::h2)) {

self->shutdown(result.code == http::outcome_code::ok ? http::outcome_code::not_supported : result.code);

co_return;

}

if (protocol == tls_negotiated_protocol::h2) {

std::shared_ptr<http2_tcp_owner> h2;

{

std::lock_guard lock(self->mu_);

if (self->shutdown_ || self->quiescing_) co_return;

self->tls_peer_ = transport.peer_metadata();

self->handshaking_ = false;

++self->live_loops_;

h2 = std::make_shared<http2_tcp_owner>(self->backend_, self->pool_, self->routes_, self->budget_, self->config_,

self->id_, self->peer_, self->peers_, self->hooks_, self->tls_peer_, [self] { self->loop_finished(); });

self->http2_ = h2;

}

h2->start();

co_return;

}

{

std::lock_guard lock(self->mu_);

if (self->shutdown_ || self->quiescing_) co_return;

self->tls_peer_ = transport.peer_metadata();

self->handshaking_ = false;

self->live_loops_ += 4;

}

self->start_http1();

#else

self->shutdown(http::outcome_code::not_supported);

#endif

co_return;

std::shared_ptr<http2_tcp_owner> h2;

{

std::lock_guard<std::mutex> lock(mu_);

if (shutdown_) return;

shutdown_ = true;

h2 = http2_;

}

if (h2) {

h2->stop(reason);

return;

}

fail_websocket({reason, reason == http::outcome_code::timeout

? "WebSocket drain deadline" : "WebSocket server stop"});

disconnect_current(http::outcome_code::connection_closed,

"http1 connection engine: server stop");

outbox_.abandon();

backend_.release_connection(id_);

wake_loops();

std::shared_ptr<websocket_driver> driver;

std::shared_ptr<http2_tcp_owner> h2;

bool cancel_handshake = false;

{

std::lock_guard<std::mutex> lock(mu_);

if (shutdown_ || quiescing_) return;

quiescing_ = true;

cancel_handshake = handshaking_;

if (server_deadline != std::chrono::steady_clock::time_point::max()) server_drain_deadline_ = server_deadline;

driver = websocket_;

h2 = http2_;

if (!driver && !h2 && current_ == nullptr) close_after_drain_ = true;

}

if (h2) {

h2->drain(server_deadline);

return;

}

if (cancel_handshake) {

shutdown();

return;

}

if (driver) static_cast<void>(driver->begin_close(1001, "server drain"));

wake_loops();

rearm_watchdog();

std::string detail) noexcept {

http1_body_source* body = nullptr;

{

std::lock_guard<std::mutex> lock(mu_);

if (current_ == nullptr) return;

static_cast<void>(current_->disconnect(reason, std::move(detail)));

// Only the admitted state can hold parked body reads (the

// decoder is unfed until admission).

if (gate_ == body_gate::admitted) body = body_.get();

}

// Second half of the body wake pairing (http1_body_source): the

// exchange's stop is sticky now, so a read parked before this

// moment wakes here and one parking later fails at its own gate.

if (body != nullptr) body->cancel_parked();

{

std::lock_guard<std::mutex> lock(mu_);

close_after_drain_ = true;

}

wake_loops();

bool body_failed = false;

bool quota_failed = false;

bool drain_done = false;

note_transport_activity();

{

std::lock_guard<std::mutex> lock(mu_);

if (shutdown_) return;

const bool parking = !websocket_input_charge_.owns() && (phase_ != stream_phase::http || gate_ == body_gate::pending ||

gate_ == body_gate::admitted || head_routed_ || parser_.state() == http1_head_state::complete || !pending_tail_.empty());

quota_failed = parking && !tail_charge_.grow(3 * data.size());

if (quota_failed) {

close_after_drain_ = true;

} else if (phase_ != stream_phase::http) {

pending_tail_.append(data);

} else {

switch (gate_) {

case body_gate::none:

absorb_head_locked(data);

break;

case body_gate::pending:

absorb_pending_locked(data);

break;

case body_gate::admitted:

body_failed = absorb_admitted_locked(data);

break;

case body_gate::draining:

drain_done = absorb_drain_locked(data);

break;

}

}

release_tail_charge_locked();

}

if (quota_failed) {

disconnect_current(http::outcome_code::limit_exceeded, "shared HTTP/1 receive storage exhausted");

fail_websocket({http::outcome_code::limit_exceeded, "shared WebSocket transport storage exhausted"});

wake_loops();

}

if (drain_done) {

// The route loop's drain await re-checks, and the drain

// candidate leaves the watchdog's inventory.

wake_loops();

rearm_watchdog();

}

if (body_failed) {

observe_failure(http::outcome_code::protocol_error);

// A framing failure poisons the byte stream: unwind the live

// exchange and close per the decoder's posture.

disconnect_current(http::outcome_code::protocol_error,

"http1 connection engine: request body framing"

" failed");

request_close();

}

stop_source cancel;

const std::uint64_t sequence = [this] {

std::lock_guard<std::mutex> lock(mu_);

return next_sequence_++;

}();

http1_response_sink& slot = outbox_.open(sequence, cancel.get_token());

http::request_head request;

request.request_protocol = http::protocol::http_1_1;

request.request_method = http::method::known(http::method_id::get);

request.raw_target = "/";

request.route_path = "/";

request.head_fields.append("Connection", "close");

http::fields fields;

fields.append("Content-Length", "0");

static_cast<void>(slot.start(request, http::status::from_code(code),

fields, config_.clock));

static_cast<void>(slot.push_end(http::fields()));

wake_loops_ordered();

request_close();

http::outcome_code code) noexcept {

if (code == http::outcome_code::limit_exceeded) return 431;

if (code == http::outcome_code::not_supported) return 501;

return 400;

{

std::lock_guard<std::mutex> lock(mu_);

const auto needed = 3 * pending_tail_.size();

if (needed > tail_charge_.units() && !tail_charge_.grow(needed - tail_charge_.units())) return false;

body_ = std::make_unique<http1_body_source>(mode, config_.body, [weak = weak_from_this()] {

if (auto engine = weak.lock()) engine->wake_loops_ordered();

}, budget_);

gate_ = body_gate::pending;

// Include every reader byte received since head preparation. The

// owner and gate change together, so later absorbs append in order.

early_bytes_ = std::move(pending_tail_);

std::string().swap(pending_tail_);

}

// The reader may already be gated on the early cap (or becomes so

// now), and the watchdog's candidate set changed.

wake_loops();

rearm_watchdog();

return true;

bool seed_failed = false;

{

std::lock_guard<std::mutex> lock(mu_);

// gate_ == none covers a bodyless request (no decoder exists);

// the transition runs exactly once per exchange.

if (gate_ != body_gate::pending) return true;

std::string seed = std::move(early_bytes_);

std::string().swap(early_bytes_);

if (body_ != nullptr && !seed.empty()) {

// Fed under mu_: the admitted absorb path holds the same

// lock, so socket bytes can never overtake the seed.

const std::size_t consumed = body_->feed(seed);

pending_tail_.assign(seed, consumed, seed.size() - consumed);

seed_failed = body_->failed();

}

gate_ = body_gate::admitted;

release_tail_charge_locked();

}

// The gated reader resumes, and body_idle may be nearer than

// whatever is armed.

wake_loops();

rearm_watchdog();

if (seed_failed) {

disconnect_current(http::outcome_code::protocol_error,

"http1 connection engine: request body framing"

" failed");

request_close();

return false;

}

return true;

// A complete untaken head accepts nothing: park the bytes for the

// route loop (they are the body seed or the next head).

if (head_routed_ || parser_.state() == http1_head_state::complete) {

pending_tail_.append(data);

return;

}

if (!pending_tail_.empty()) {

std::string queued = std::move(pending_tail_);

pending_tail_.clear();

parser_.feed(queued);

if (parser_.state() == http1_head_state::complete) {

pending_tail_.append(data);

return;

}

}

parser_.feed(data);

// Never discard pre-admission bytes: they are this exchange's body

// prefix. The reader gate bounds the buffer at the staging cap

// (plus at most one read buffer of overshoot).

early_bytes_.append(data);

if (body_ == nullptr || body_->message_complete()) {

absorb_head_locked(data);

return false;

}

// The decoder keeps the unconsumed tail (its backpressure

// semantic); the reader re-feeds it ahead of every later chunk.

std::string combined;

combined.reserve(pending_tail_.size() + data.size());

combined.append(pending_tail_).append(data);

pending_tail_.clear();

const std::size_t consumed = body_->feed(combined);

pending_tail_.assign(combined, consumed, combined.size() - consumed);

return body_->failed();

const std::size_t discard = static_cast<std::size_t>(

std::min<std::uint64_t>(drain_remaining_, data.size()));

drain_remaining_ -= discard;

data.remove_prefix(discard);

if (drain_remaining_ > 0) return false; // more counted bytes due

// The counted remainder is gone: anything past it is a pipelined

// next head, and the route loop's drain await observes the gate

// flip.

gate_ = body_gate::none;

drain_anchor_.reset();

if (!data.empty()) absorb_head_locked(data);

return true;

if (pending_tail_.empty()) std::string().swap(pending_tail_);

if (early_bytes_.empty()) std::string().swap(early_bytes_);

const auto retained = websocket_input_charge_.owns() ? 0 :

std::max(3 * (pending_tail_.size() + early_bytes_.size()),

(pending_tail_.empty() ? 0 : pending_tail_.capacity()) + (early_bytes_.empty() ? 0 : early_bytes_.capacity()));

if (tail_charge_.units() > retained) tail_charge_.shrink(tail_charge_.units() - retained);

if (websocket_) {

return websocket_->snapshot().input_ready;

}

if (head_routed_ && gate_ == body_gate::none)

return pending_tail_.size() < config_.body.max_staged_bytes;

switch (gate_) {

case body_gate::none:

// A complete, untaken head plus no live exchange: parked

// pipelined bytes wait for the route loop, bounded at the

// same cap.

if (parser_.state() == http1_head_state::complete

&& current_ == nullptr) {

return pending_tail_.size() < config_.body.max_staged_bytes;

}

return true;

case body_gate::pending:

return early_bytes_.size() < config_.body.max_staged_bytes;

case body_gate::admitted:

return admitted_body_may_read_locked();

case body_gate::draining:

return true;

}

return true;

if (body_ == nullptr || body_->message_complete())

return pending_tail_.size() < config_.body.max_staged_bytes;

return pending_tail_.empty() && body_->staged_bytes() < config_.body.max_staged_bytes;

bool failed = false;

{

std::lock_guard<std::mutex> lock(mu_);

if (!shutdown_ && body_tail_ready_locked()) {

failed = absorb_admitted_locked({});

release_tail_charge_locked();

}

}

if (failed) {

disconnect_current(http::outcome_code::protocol_error, "request body framing failed");

request_close();

}

std::shared_ptr<connection_engine> self) {

std::array<std::byte, k_read_buffer_bytes> buffer;

for (;;) {

self->feed_body_tail();

self->feed_websocket_tail();

wake_operation gate_op(self->owner_, self->id_);

const auto posture = self->reader_posture(gate_op);

if (posture == io_posture::stop) co_return;

if (posture == io_posture::retry) continue;

if (posture == io_posture::park) {

const io_result r = co_await std::move(gate_op);

if (r.code != http::outcome_code::ok) co_return;

continue;

}

read_operation op(self->owner_, self->id_, buffer);

if (!self->submit_read(op)) continue;

const io_result r = co_await std::move(op);

if (self->read_completed(r)) continue;

if (r.code == http::outcome_code::ok) {

self->absorb(std::string_view(

reinterpret_cast<const char*>(buffer.data()), r.transferred));

self->wake_loops();

continue;

}

self->handle_read_failure(r);

co_return;

}

std::shared_ptr<connection_engine> self) {

// The engine drives the socket writes itself (copy_front /

// write_operation / consume_front) so every completed write is

// visible as transport activity for the write-idle deadline.

std::array<std::byte, k_write_buffer_bytes> buffer;

for (;;) {

std::shared_ptr<websocket_driver> driver;

const std::size_t buffered = self->copy_transport_output(buffer, driver);

if (buffered == 0) {

wake_operation op(self->owner_, self->id_);

const auto posture = self->writer_posture(driver, op);

if (posture == io_posture::stop) co_return;

if (posture == io_posture::retry) continue;

const io_result r = co_await std::move(op);

if (r.code != http::outcome_code::ok) co_return;

continue;

}

write_operation op(self->owner_, self->id_,

std::span<const std::byte>(buffer.data(), buffered));

{

std::lock_guard lock(self->mu_);

if (self->shutdown_) co_return;

op.submit(self->backend_);

}

const io_result r = co_await std::move(op);

if (r.code != http::outcome_code::ok) {

self->fail_websocket({http::outcome_code::connection_closed, "WebSocket transport write failed"});

self->shutdown();

co_return;

}

// Publish write progress before consume_output delivers its observer,

// so a concurrent watchdog never sees an expired pre-write anchor.

self->note_transport_activity(true);

if (driver) static_cast<void>(driver->consume_output(r.transferred));

else self->outbox_.consume_front(r.transferred);

}

if (phase_ != stream_phase::http || current_ == nullptr || !current_->suspended()

|| current_->disconnected()) {

suspension_anchor_.reset();

return std::nullopt;

}

if (!suspension_anchor_.has_value()) {

suspension_anchor_ = std::chrono::steady_clock::now();

}

return *suspension_anchor_ + config_.timeouts.suspension;

if (gate_ != body_gate::draining || drain_remaining_ == 0

|| !drain_anchor_.has_value()) {

return std::nullopt;

}

return *drain_anchor_ + config_.timeouts.drain;

watchdog_plan plan;

if (watchdog_terminal_locked()) {

plan.exit = true;

return plan;

}

// Nearest-deadline order, as the contract promises: collect every

// candidate the current state offers and arm the minimum. A

// trickling body slides body_idle but never the suspension or

// drain anchors, so a suspended exchange and a stalled rejection

// drain both reach their deadlines; the sliding candidates still

// win whenever they are genuinely nearer. While an exchange is

// routed and no candidate applies, the plan defers -- the drain

// ticket's deadline (or a stop) bounds that window instead

// (TASK-110).

std::chrono::steady_clock::time_point candidates[7];

std::size_t candidate_count = 0;

if (body_decode_pending_locked()) {

candidates[candidate_count++] =

last_activity_ + config_.timeouts.body_idle;

}

if (phase_ == stream_phase::websocket) {

// Read admission identity and pending state atomically. A new interval

// survives drain/requeue even when neither observer saw empty output.

update_websocket_write_anchor_locked(websocket_->snapshot());

if (websocket_write_anchor_) {

candidates[candidate_count++] = *websocket_write_anchor_ + config_.timeouts.write_idle;

}

} else if (transport_output_pending_locked()) {

candidates[candidate_count++] = last_activity_ + config_.timeouts.write_idle;

} else {

websocket_write_anchor_.reset();

}

if (const std::optional<std::chrono::steady_clock::time_point>

suspended_until = suspension_deadline_locked()) {

candidates[candidate_count++] = *suspended_until;

}

if (const std::optional<std::chrono::steady_clock::time_point>

drain_until = drain_deadline_locked()) {

candidates[candidate_count++] = *drain_until;

}

add_protocol_deadlines_locked(candidates, candidate_count);

if (candidate_count == 0) {

if (head_routed_) {

plan.defer = true;

return plan;

}

plan.deadline = last_activity_ + config_.timeouts.header;

return plan;

}

plan.deadline = *std::min_element(candidates,

candidates + candidate_count);

return plan;

std::chrono::steady_clock::time_point deadline) {

std::lock_guard<std::mutex> lock(mu_);

const watchdog_plan plan = plan_watchdog_locked();

return !plan.exit && !plan.defer && plan.deadline == deadline

&& std::chrono::steady_clock::now() >= deadline;

std::shared_ptr<op_state> pending;

{

std::lock_guard<std::mutex> lock(mu_);

pending = pending_timer_;

}

if (pending != nullptr) {

static_cast<void>(backend_.request_cancel(*pending));

}

{

std::lock_guard<std::mutex> lock(mu_);

last_activity_ = std::chrono::steady_clock::now();

if (written && phase_ == stream_phase::websocket) websocket_write_anchor_ = last_activity_;

}

rearm_watchdog();

bool global_expiry = false, close_expiry = false;

{

std::lock_guard<std::mutex> lock(mu_);

global_expiry = server_drain_deadline_ && *server_drain_deadline_ <= deadline;

if (websocket_) {

auto progress = websocket_->snapshot();

close_expiry = !progress.terminal && progress.closing_since &&

*progress.closing_since + config_.timeouts.ws_close <= deadline;

}

}

if (global_expiry && scope_.expire_if_due(std::chrono::steady_clock::now())) return;

// A fired deadline means the peer or the exchange will not

// progress. Disconnect the live exchange (its parked handler

// unwinds through run_route), mark the close, and release the

// transport so every parked loop terminal-completes. No response

// is synthesized: a timed-out peer is not reading one.

fail_websocket({http::outcome_code::timeout, close_expiry

? "WebSocket Close timeout" : "WebSocket watchdog timeout"});

disconnect_current(http::outcome_code::timeout,

"http1 connection engine: watchdog timeout");

{

std::lock_guard<std::mutex> lock(mu_);

close_after_drain_ = true;

}

backend_.release_connection(id_);

wake_loops();

std::shared_ptr<connection_engine> self) {

for (;;) {

watchdog_plan plan;

{

std::lock_guard<std::mutex> lock(self->mu_);

plan = self->plan_watchdog_locked();

}

if (plan.exit) co_return;

const auto deadline = plan.defer

? std::chrono::steady_clock::now() + k_watchdog_tick

: plan.deadline;

timer_operation op(self->owner_, self->id_, deadline);

if (!self->arm_watchdog(op, plan)) continue;

const io_result r = co_await std::move(op);

{

std::lock_guard<std::mutex> lock(self->mu_);

self->pending_timer_.reset();

}

// A released transport ends the watchdog with the connection.

if (r.code == http::outcome_code::connection_closed) co_return;

// A cancellation (state moved) and a deferred re-check tick

// both re-plan with fresh eyes.

if (r.code != http::outcome_code::ok || plan.defer) continue;

// Fired: enforce only when the deadline still governs the

// current state (activity moved it -- re-arm).

if (!self->watchdog_due(deadline)) continue;

self->enforce_timeout(deadline);

co_return;

}

{

std::lock_guard<std::mutex> lock(mu_);

if (live_loops_ > 0) --live_loops_;

if (live_loops_ > 0) return;

}

finalize();

// The engine's counted unit drops first: by the time the listener

// erases its record, a drain waiting on the scope observes

// completion with every loop finished and the writer flushed.

{

std::lock_guard<std::mutex> lock(mu_);

body_.reset(); parser_ = http1_head_parser(config_.head);

std::string().swap(pending_tail_); std::string().swap(early_bytes_);

tail_charge_.shrink(tail_charge_.units());

websocket_input_charge_.release(); websocket_output_charge_.release(); websocket_message_charge_.release();

seat_.release(); outbox_.retire();

}

observe(server::diagnostic_kind::connection_closed);

if (!admission_.retirement) scope_.leave();

backend_.release_connection(id_);

stopped_callback done;

{

std::lock_guard<std::mutex> lock(mu_);

done = std::move(on_stopped_);

}

if (done) done();