clean-architecture-backend-template/docs/websocket/advanced-support-matrix.md

WebSocket Advanced: support matrix

Every capability is off unless named. This table is what each one costs and what has to be true before it is promoted. AdvancedPromotionGate.forCapability is the machine-checked form of the last two columns; if they disagree, the code wins and this table is stale.

Capability	Flag	Adds	Required suites	Soak
RESUME	…advanced.resume.enabled	A signed token and a replay store	websocket:test, websocketJettyTest, resume-history-loss, resume-replay	8h
CLUSTER_REDIS	…advanced.cluster-redis.enabled	A Redis dependency on the routing path	websocket:test, multi-node-fanout, node-loss, index-partition	24h
CLUSTER_MESSAGING	…advanced.cluster-messaging.enabled	A broker dependency on the delivery path	as CLUSTER_REDIS	24h
PRESENCE	…advanced.presence.enabled	A read model over the cluster index	as CLUSTER_REDIS	24h
STOMP	…advanced.stomp.enabled	A second protocol parser, pre-authentication	websocket:test, broker-outage, broker-reconnect, user-destination	8h
BROKER_RELAY_RABBIT	…advanced.stomp.relay.enabled	A TCP dependency on an external broker	as STOMP	8h
CODEC_PROTOBUF	…advanced.codec-protobuf.enabled	A second decode path	websocket:test, websocketJettyTest	8h
CODEC_CBOR	…advanced.codec-cbor.enabled	A second decode path	websocket:test, websocketJettyTest	8h
COMPRESSION	…advanced.compression.enabled	Per-connection memory, and a length side channel	websocket:test, decompression-bound, memory-under-load	24h
OUTBOUND_CLIENT	…advanced.outbound-client.enabled	Long-lived connections this service initiates	websocket:test, websocketJettyTest	8h
SOCKJS_COMPAT	…advanced.sockjs.enabled	Credentialed cross-origin HTTP, so CSRF	websocket:test, websocketJettyTest	8h
HTTP2_COMPAT	…advanced.http2.enabled	RFC 8441 extended CONNECT	websocket:test, websocketNginxTest, proxy-matrix, classic-upgrade-fallback	7d
HTTP3_EXPERIMENTAL	…advanced.http3.enabled	QUIC, and every hop problem HTTP/2 has	as HTTP2_COMPAT	7d
GRAPHQL_TRANSPORT	…advanced.graphql-transport.enabled	A subprotocol on the Stable runtime	websocket:test, websocketJettyTest	8h

What is not supported, and why the row is here

Not supported	Reason
Simple broker in a multi-node deployment	It does not error. It delivers to whichever fraction of users is on the publishing node, which reads as intermittent loss. SimpleBrokerProfile.activatableUnder refuses it.
permessage-deflate on an endpoint mixing a secret with attacker-influenced content	The CRIME/BREACH shape. No parameter combination makes it safe; the leak is in the compressed length. CompressionPolicy.mayCompress refuses it.
JSONP polling on a sensitive endpoint	JSONP executes server-supplied script in the page.
Protobuf payloads above 256KB	The broker, the replay store and every in-memory queue would each hold the message whole.
Extended CONNECT on an untested hop	RFC 8441 fails by killing the connection, not by negotiating a fallback.
HTTP/3 as stable support	Http3ExperimentalProfile.stableSupport() returns false, always.
Both STOMP channels at once	The broker that results is whichever configurer ran last, with no error. StompBrokerExclusivity refuses it.

Promotion

Each capability is promoted on its own evidence. They share a feature-flag mechanism and nothing else, so promoting them together means the evidence for the cheapest is treated as evidence for the most dangerous.

Two conditions apply to all of them and are not waivable:

• Rollback exercised. A flag nobody has turned off is not known to turn off.
• Stable artifact unchanged. If enabling the capability changed Stable's wire contract or dependency graph, Stable was never independent of it, and deployments that did not enable it are affected anyway.