writeonce/docs/stories/language-runtime-database/24-chat-websocket-workload.md

iteration	status	chain
24	done	4

Iteration 24 — chat: the WebSocket pub/sub driving workload

Format: product/story-iteration-template. Part of Story — one language, one runtime, one database, one binary.

Inserted 2026-08-20 (concurrency-chain refinement): the 8+11 arc's driving workload, the role log-watcher played for iterations 3–7. Needs its spec AFTER the arc's — it lands at the arc's end and proves it.

RE-SEQUENCED 2026-08-21: fourth in the chain, stage 3 → 22 → 31 → 24 → 23 → 32 — chat cannot be written honestly before iteration 31 (request/response, bounded mailboxes, actor death, timers). Iteration 19 LANDED 2026-08-20, so Bytes is available for frame parse/serialize.

✅ LANDED 2026-08-27 (branch chat-ws-lifecycle, merged to master ed5334d). Ten tasks: crypto (T1), bounded mailboxes (T2), call/reply and actor death (T3), monitor (T4), time.after (T5), the WS upgrade seam (T6), the pure-.wo frame codec (T7), the chat sample (T8), the gate (T9), this closeout (T10). It absorbed 31 and 34, which land with it.

Gate — just chat, 11 checks, 0 failures at the full 1000-client soak: handshake with an independently recomputed accept-key, the functional matrix (presence, broadcast, room isolation, leave) on both WO_IO backends and on a single shard, the 1k hot-room soak, the fd invariant, the SIGTERM drain, WO_MAILBOX=8 backpressure, and an ASan run with zero leaks. Battery alongside: runtime 36 suites 0 fail, compiler 556 checks, corpus 119 checks. The sample logs to /tmp/chat.log.

Two disclosed deviations from the spec. monitor takes three arguments (watched, observer, msg) rather than two, because the caller may be main, which has no mailbox and cannot be an implicit observer. And a call reply is a typed scalar in v1 — which is what let the agreement be checked at compile time (WO-E226) instead of carried as a tagged value.

What finishing the gate found. Making every leg start its own server exposed a real runtime bug the warmed soak server had been hiding: on a fresh server, 5 of 16 SIGTERM drains left a client at EOF with no close frame. It was not this sample's fault — the fix is an engine guarantee, split out as 40. Design notes: docs/examples/chat/CODE-LOGIC.md.

Why this iteration exists

Everything the framework ledger parks behind concurrency — WebSockets, pub/sub, streaming, per-request cancellation, the keep-alive parking retirement — needs a workload that actually exercises long-lived connections and cross-shard broadcast, or the arc ships mechanism without proof. Chat is the smallest honest such workload: rooms, N concurrent clients, fan-out on every message, presence on connect/disconnect — one binary, no broker.

Goals

• docs/examples/chat: rooms + broadcast + presence over WebSocket, served by the framework through [deps] exactly as the web-app is.
• Framework grows the WS mechanism in pure .wo: the HTTP/1.1 upgrade handshake (Sec-WebSocket-Accept needs SHA-1/base64 — the crypto-builtin fork's first real consumer), frame parse/serialize (text, close, ping), fiber-per-connection serving (iteration 11), and in-memory channels whose delivery is cross-shard message send (iteration 8).
• The arc's acceptance teeth: 1k concurrent clients across shards, broadcast latency measured, starvation-free under one hot room, SIGTERM drains every connection cleanly.

Acceptance Criteria (draft — the spec after the arc refines)

• Given two clients in one room on DIFFERENT shards, when one sends, then the other receives the frame (cross-shard ownership-move delivery), and a third client in another room receives nothing.
• Given 1k connected clients with one hot sender, when the reduction budget preempts, then every room keeps making progress (no starvation) on one OS thread per core, verified by TID.
• Given SIGTERM with clients connected, when the server drains, then every connection gets a close frame, every fiber unwinds its drop maps (ASan zero leaks), and the process exits 0.
• Given the web-app running beside chat features, when the standing gates run, then nothing regresses — HTTP and WS share the serve loop honestly.

Out Of Scope

Message persistence/history (a @table an app adds if it wants — not the workload's point); auth beyond the existing bearer mechanism; permessage compression; binary frames beyond echo coverage; wss (TLS stays at the proxy — the proxy story extends to WS pass-through, documented).

Info

• Dependencies: the 8+11 arc (fibers + cross-shard send — stages 1+2 landed 2026-08-20, stage 3 pending), iteration 31 (request/response, backpressure, death, timers — the mechanisms rooms and presence are made of), iteration 19 (LANDED 2026-08-20 — Bytes carries the frames), the crypto builtins fork (SHA-1 for the upgrade handshake — note: the ledger's crypto slice lists SHA-256/512; the WS handshake specifically needs SHA-1, so the builtin set must include it), and the framework's parse seam (upgrade is an HTTP request until it isn't).
• Unparks on landing: the framework ledger's WebSocket/pub-sub rows and the iteration-18 rejection note ("pub/sub REJECTED until 8/11").

Proposed Solution

Brainstorm → spec → plan after the arc's spec exists; the arc's plan and this iteration's are written against each other (the arc names chat as its acceptance, chat names the arc as its substrate).