fix(client): connect contract + abortable open — subscribe races, revived-transport latch, CONNECTING leak

[grrowl]

Fixes two facets of one defect family in the transport's connect/close boundary — the in-flight-open() window between "start dialing" and "socket adopted". Recorded as ADR-0020 (amends ADR-0016 + ADR-0011's Transport seam; supersedes neither).

Issue #37 — connect() could resolve having adopted no socket

The close-epoch discard returned, resolving connect() with this.ws === null. The awaiting subscribe/sendMut/fetch then sent on a null socket and threw — floating an unhandled rejection (measured: 9 per cold page load) and leaving the collection silently empty. Two residues shared the surface: intentionallyClosed latched forever (a transport revived by a later connect() — connection pools reuse instances — lost auto-reconnect), and the same latch silenced onClosed on revived transports.

Fix:

• connect() never resolves disconnected — at the epoch discard it re-dials a revived transport (defers to whichever dial now owns it) or rejects the new typed TransportClosedError.
• Dialing clears intentionallyClosed — one line restores both auto-reconnect and onClosed on a revived transport.
• Only the dial that still owns connectPromise drives failure recovery (ownership-guarded catch), so a re-dialing superseded attempt can't null a newer dial's promise or double-schedule its reconnect.

Issue #38 — close() could not abort an in-flight open()

close() disposes through this.ws, which is null during the handshake, so a slow/never-completing open() leaked a socket stuck in CONNECTING forever.

Fix: open gains an optional AbortSignal that close() aborts while the handshake is in flight; the default browser opener honours it (closes the socket, rejects). Backward-compatible — a signal-ignoring opener still works via the epoch-discard backstop, but a never-resolving handshake then leaks (documented; the only residual gap, opt-in, closed by honouring the signal).

Acceptance criteria — test by test

New tests/connect-contract.test.ts (7):

• client: connect() can resolve disconnected; intentionallyClosed never resets — subscribe throws, reconnect and onClosed silenced #37 subscribe before the handshake completes still lands the sub frame once connected — subscribe-before-open.
• client: connect() can resolve disconnected; intentionallyClosed never resets — subscribe throws, reconnect and onClosed silenced #37 close() during the handshake rejects the in-flight connect() typed — never resolves disconnected; rejects TransportClosedError.
• client: connect() can resolve disconnected; intentionallyClosed never resets — subscribe throws, reconnect and onClosed silenced #37 close() during the first subscribe's handshake, then a fresh connect() revives and lands the sub — close-during-handshake then re-connect; first subscribe rejects typed (no unhandled), revived dial lands the frame.
• client: connect() can resolve disconnected; intentionallyClosed never resets — subscribe throws, reconnect and onClosed silenced #37 auto-reconnects on a 1006 drop after a connect() revives a closed transport — revived-transport reconnect on 1006.
• client: connect() can resolve disconnected; intentionallyClosed never resets — subscribe throws, reconnect and onClosed silenced #37 delivers onClosed on a terminal 4xxx close after a connect() revives a closed transport — revived-transport onClosed on a terminal code.
• client: close() cannot abort a socket whose open() is in flight — leaks CONNECTING sockets #38 close() during a never-resolving open() aborts (closes) the still-CONNECTING socket — no CONNECTING leak, via a fake open that exposes its socket.
• client: close() cannot abort a socket whose open() is in flight — leaks CONNECTING sockets #38 a custom open() that IGNORES the signal still has its late socket discarded and closed — backward-compat + "eventual resolution closes it immediately".

Rewrote reconnect-policy.test.ts "intentional close() is permanent" → close() suppresses auto-reconnect until a later connect() REVIVES the transport (the old test pinned the now-reversed permanence contract; #37 acceptance is revival).

Validation

• npm test: 277 passed (was 270 on this base), 54 files, no skips.
• npm run typecheck: clean.

Codex adversary pass (gpt-5.6-sol)

No serious findings. It confirmed: the epoch re-dial cannot resolve before a socket installs; abort ownership is per-dial; the connectPromise ownership guard prevents wiping a newer dial / double-consuming the policy; ADR-0016 policy is not bypassed (the epoch branch re-dials only after another connect() cleared the latch); ADR-0011 stale-socket receipt semantics intact. One theoretical edge dismissed: a hostile/non-conforming injected WebSocketLike whose addEventListener/binaryType setter/send() synchronously re-enters close() between the epoch check and install — browser WebSockets never dispatch those synchronously, so it's out of the documented opener contract.

Deliberate departures / scope

• Did not adopt ADR-0016's deferred generation-counter unification: it doesn't cleanly fall out of this fix, the diff stays surgical, and the existing race tests (its intended harness) remain green. The deferral stands.
• Behavior change (documented): close() is no longer permanent across a later connect(). Code relying on permanent terminality must not re-connect() the same instance.
• Issue client: in-flight mut/call across an unexpected close is abandoned to its timeout — after the server may have committed #39 (pendingTx settlement on unexpected close) is out of scope, untouched, and not made harder.

Fixes #37
Fixes #38

🤖 Generated with Claude Code