// A zero-byte end can arrive after the final write consumed the head.

if (!outbox.front_complete() || outbox.front_failed()) return false;

outbox.consume_front(0);

return true;

websocket_upgrade_result out;

auto plan = negotiate_http1_websocket(head_, options,

engine_->config_.head.max_head_bytes, engine_->config_.head.max_fields);

out.status = plan.status; out.rejection_status = plan.rejection_status;

out.rejection_fields = std::move(plan.rejection_fields);

if (!out.status.ok()) return out;

if (slot_ == nullptr) {

out.status = {http::outcome_code::invalid_state, "upgrade slot unavailable"};

return out;

}

const auto& cap = engine_->config_.websocket_limits;

auto limits = options.limits;

// Default route values project down to server caps. Explicit values

// can tighten, never enlarge, any per-connection allocation budget.

limits.max_message_bytes = std::min(limits.max_message_bytes, cap.max_message_bytes);

limits.incoming_bytes = std::min(limits.incoming_bytes, cap.incoming_bytes);

limits.output_bytes = std::min(limits.output_bytes, cap.output_bytes);

limits.incoming_messages = std::min(limits.incoming_messages, cap.incoming_messages);

limits.outgoing_messages = std::min(limits.outgoing_messages, cap.outgoing_messages);

// Queue allocation and empty-message metadata use the same envelopes as

// multiplexed WebSockets. These reservations belong to the live upgrade.

const auto input_fixed = 16384 + 4096 + 256 * limits.incoming_messages;

const auto wire_headroom = 256 + plan.selected_subprotocol.size();

const auto output_fixed = 4096 + (8192 + 256) * (limits.outgoing_messages + 3);

auto free = [&](server::resource kind) {

return engine_->budget_.capacity(kind) - engine_->budget_.in_use(kind);

};

if (free(server::resource::body_buffer_bytes) <= input_fixed ||

free(server::resource::response_queue_bytes) <= output_fixed + wire_headroom) {

out.status = {http::outcome_code::limit_exceeded, "WebSocket queue storage exhausted"}; return out;

}

limits.incoming_bytes = std::min(limits.incoming_bytes, (free(server::resource::body_buffer_bytes) - input_fixed) / 5);

limits.output_bytes = std::min(limits.output_bytes, (free(server::resource::response_queue_bytes) - output_fixed - wire_headroom) / 4);

if (limits.output_bytes <= 10) {

out.status = {http::outcome_code::limit_exceeded, "WebSocket output storage exhausted"}; return out;

}

limits.max_message_bytes = std::min({limits.max_message_bytes, limits.incoming_bytes,

limits.output_bytes - 10, free(server::resource::ws_message_bytes)});

server::reservation input, output, message;

if (!limits.max_message_bytes ||

!engine_->budget_.reserve(server::resource::body_buffer_bytes, 5 * limits.incoming_bytes + input_fixed, input).ok() ||

!engine_->budget_.reserve(server::resource::response_queue_bytes, 4 * limits.output_bytes + output_fixed, output).ok() ||

!engine_->budget_.reserve(server::resource::ws_message_bytes, limits.max_message_bytes, message).ok()) {

out.status = {http::outcome_code::limit_exceeded, "WebSocket shared storage admission refused"}; return out;

}

out.status = limits.validate();

if (!out.status.ok()) return out;

auto driver = std::make_shared<websocket_driver>(limits);

engine_->observe_websocket_driver(driver);

auto session = driver->take_session();

std::shared_ptr<op_state> pending_read;

{

std::lock_guard lock(engine_->mu_);

if (engine_->shutdown_ || engine_->quiescing_ || engine_->eof_ || engine_->phase_ != connection_engine::stream_phase::http) {

out.status = {http::outcome_code::connection_closed, "upgrade connection unavailable"};

return out;

}

std::string tail;

tail.reserve(engine_->early_bytes_.size() + engine_->pending_tail_.size());

tail.append(engine_->early_bytes_).append(engine_->pending_tail_);

out.status = slot_->commit_upgrade(plan.accept, plan.selected_subprotocol);

if (!out.status.ok()) return out;

// All throwing allocations precede commitment. Only the reader

// feeds this tail, ahead of any read already in flight.

engine_->pending_tail_ = std::move(tail);

engine_->early_bytes_.clear();

engine_->websocket_ = driver;

engine_->websocket_input_charge_ = std::move(input);

engine_->websocket_output_charge_ = std::move(output);

engine_->websocket_message_charge_ = std::move(message);

engine_->release_tail_charge_locked();

engine_->phase_ = connection_engine::stream_phase::upgrade_pending_flush;

engine_->upgrade_anchor_ = std::chrono::steady_clock::now();

engine_->gate_ = connection_engine::body_gate::none;

upgraded_ = true;

pending_read = engine_->pending_read_;

}

out.session.emplace(std::move(session)); out.selected_subprotocol = std::move(plan.selected_subprotocol);

if (pending_read) static_cast<void>(engine_->backend_.request_cancel(*pending_read));

engine_->wake_loops_ordered(); engine_->rearm_watchdog();

return out;

std::shared_ptr<websocket_driver> driver;

std::span<const std::byte> bytes;

{

std::lock_guard lock(mu_);

driver = websocket_;

if (!driver || (pending_tail_.empty() && !websocket_codec_blocked_)) return;

// This sole reader owns the buffer until feed returns. Protocol

// notifications run outside mu_ and cannot mutate the wire buffer.

bytes = {reinterpret_cast<const std::byte*>(pending_tail_.data()) + websocket_tail_offset_,

pending_tail_.size() - websocket_tail_offset_};

}

auto fed = driver->feed(bytes);

{

std::lock_guard lock(mu_);

websocket_tail_offset_ += fed.consumed;

websocket_codec_blocked_ = fed.blocked && fed.status.ok();

if (websocket_tail_offset_ == pending_tail_.size()) {

std::string().swap(pending_tail_);

release_tail_charge_locked();

websocket_tail_offset_ = 0;

}

}

std::lock_guard lock(mu_);

if (shutdown_ || close_after_drain_) return io_posture::stop;

if (websocket_ && (!pending_tail_.empty() || websocket_codec_blocked_) && websocket_->snapshot().input_ready) return io_posture::retry;

// A body pull can release room between tail replay and this locked

// posture check. Retry before parking so an earlier wake is not lost.

if (body_tail_ready_locked())

return io_posture::retry;

if (reader_may_read_locked()) return io_posture::proceed;

wake.submit(backend_);

return io_posture::park;

std::lock_guard lock(mu_);

if (shutdown_ || close_after_drain_) return false;

if (websocket_ && (!pending_tail_.empty() || websocket_codec_blocked_)) return false;

pending_read_ = read.state();

read.submit(backend_);

return true;

std::lock_guard lock(mu_);

pending_read_.reset();

return result.code == http::outcome_code::cancelled && websocket_ != nullptr;

bool upgraded;

{ std::lock_guard lock(mu_); upgraded = websocket_ != nullptr; }

if (upgraded) {

fail_websocket({http::outcome_code::connection_closed, "WebSocket transport read failed or EOF"});

shutdown();

return;

}

if (result.code == http::outcome_code::connection_closed) {

bool routing;

{ std::lock_guard lock(mu_); eof_ = true; routing = current_ != nullptr; }

if (routing) disconnect_current(http::outcome_code::connection_closed, "http1 connection engine: peer hangup mid-exchange");

} else {

disconnect_current(http::outcome_code::connection_closed, "http1 connection engine: transport read failed");

request_close();

}

wake_loops();

std::lock_guard lock(mu_);

if (!websocket_ || !outbox_.empty()) return {};

if (phase_ == stream_phase::upgrade_pending_flush) {

phase_ = stream_phase::websocket;

upgrade_anchor_.reset();

// Output queued while 101 was flushing gets its write interval now.

websocket_write_anchor_.reset();

if (websocket_->snapshot().output_pending) websocket_write_anchor_ = std::chrono::steady_clock::now();

}

return websocket_;

std::span<std::byte> buffer, std::shared_ptr<websocket_driver>& driver) {

const auto count = outbox_.copy_front(buffer);

if (count > 0) return count;

driver = websocket_output_driver();

return driver ? driver->copy_output(buffer) : 0;

const std::shared_ptr<websocket_driver>& driver, wake_operation& wake) {

std::lock_guard lock(mu_);

// Retire that slot, then recheck output and any eligible protocol transfer.

if (retire_completed_front(outbox_)) return io_posture::retry;

const bool ws_done = websocket_terminal(driver);

const bool ordinary_done = !websocket_ && route_done_;

if (outbox_drained() && (shutdown_ || ws_done || ordinary_done)) {

phase_ = stream_phase::terminal;

backend_.release_connection(id_);

return io_posture::stop;

}

// The observer mutates session state before acquiring this same

// registration mutex. Rechecking closes the notify-before-park race.

std::byte probe;

if (outbox_.copy_front(std::span(&probe, 1)) > 0) return io_posture::retry;

if (driver && driver->snapshot().output_pending) return io_posture::retry;

wake.submit(backend_);

return io_posture::park;

std::lock_guard lock(mu_);

const auto current = plan_watchdog_locked();

if (current.exit) return false;

if (current.defer != plan.defer || current.deadline != plan.deadline) return false;

pending_timer_ = timer.state();

timer.submit(backend_);

return true;

std::span<std::chrono::steady_clock::time_point> candidates, std::size_t& count) const {

if (phase_ == stream_phase::upgrade_pending_flush && upgrade_anchor_) {

candidates[count++] = *upgrade_anchor_ + config_.timeouts.handshake;

}

if (websocket_) {

const auto progress = websocket_->snapshot();

if (!progress.terminal && progress.closing_since)

candidates[count++] = *progress.closing_since + config_.timeouts.ws_close;

}

if (server_drain_deadline_) candidates[count++] = *server_drain_deadline_;

if (!progress.output_pending) {

websocket_write_anchor_.reset();

} else if (progress.output_pending_since && (!websocket_write_anchor_ ||

*websocket_write_anchor_ < *progress.output_pending_since)) {

websocket_write_anchor_ = progress.output_pending_since;

}

bool terminal = false;

{

std::lock_guard lock(mu_);

const auto progress = websocket_ ? websocket_->snapshot() : websocket_progress{};

terminal = progress.terminal;

if (phase_ == stream_phase::websocket) {

update_websocket_write_anchor_locked(progress);

}

if (terminal) close_after_drain_ = true;

wake_loops();

}

if (terminal) disconnect_current(http::outcome_code::connection_closed, "WebSocket session terminal");

rearm_watchdog();

std::shared_ptr<websocket_driver> driver;

{ std::lock_guard lock(mu_); driver = websocket_; }

if (driver) driver->transport_failed(std::move(reason));