A sound implementation does not ask users to refresh until it works. Each phase has an input, an output, a timeout, and a terminal state. Device identity is long lived, but a runtime instance is not. The server validates both identity and current epoch on every mutation to distinguish an old tab of the same user.
A real-time backend needs coherent semantics for identity, ordering, backpressure, and reconnects. Every message needs a session version, replay rule, and bounded outcome for slow consumers.
Define the system contract first
Turn the important choices into durable contracts: validate inputs, assign state ownership, define cleanup, and specify fallback for older peers. Later optimization must not change those semantics.
- Registering a new instance atomically advances the epoch and fences the old socket; data mutations use WHERE epoch = expected and treat zero updated rows as stale.
- Give state one owner, a version, and terminal states; callbacks may mutate only the version that created them.
- Ship conservative defaults, server-side ceilings, and a rollout switch instead of trusting browser-provided numbers as resource budgets.
The delivery standard for Session Fencing Tokens That Exclude Stale Tabs and Connections is a usable normal path, convergent failures, bounded resources, and a state users can understand. The result is a production capability that can be explained, degraded safely, and rolled back—not a demo that works once.
What can break that contract
Boundaries turn hidden assumptions into incidents. Weak networks, refresh, concurrency, and capacity need combined coverage because retries can hide each one in isolation.
- Closing the old WebSocket is insufficient because old ICE gatherers and timeout callbacks may still send stale commands through a new socket.
- A boolean failure cannot distinguish retryable, user-action, and permanent refusal, producing an endless loop.
- User or task IDs in metric labels create high-cardinality cost and leak unnecessary identity into diagnostics.
How to test the contract line by line
Write the expected state trace before injecting faults. At every phase, reconcile user-visible outcome, both protocol endpoints, persistent records, and resource counts to prove the loop.
- Queue commands in an offline old tab, connect from a new tab, then restore the old network; every stale-epoch write must be rejected without new prompts.
- Run one hundred start, fail, retry, and cancel cycles; handles, listeners, queues, and temporary data must return to baseline.
- Cover direct, relayed, weak-network, background-tab, and mobile paths; do not rely on averages or one successful screenshot.
Completion is not one passing path. Every terminal state reconciles, automation stays below user intent, and every operational cost has an explicit ceiling.