Hi,

Follow-up to our earlier thread about edge-proxy disconnects on hokm.live (early June 2026 — we were grouped with the edge-proxy reports and your networking team was investigating the keep-alive POST resets and the permessage-deflate WS path). Today we are seeing a much more severe episode and we've isolated it to the Railway side with controlled tests. All times UTC, date 2026-07-18.

WHO WE ARE

• Project: hokm (85c2c3d5-9620-4205-a01e-3a0f7e5820da)
• Service: hokm-server, production env (d951619a-b8f8-4add-94da-ac38d3c15288), service id fa0cfa7c-2a8a-40b7-86d8-ddbe30bdcf74
• Domains: hokm.live (Cloudflare-proxied) / origin eyjx3806.up.railway.app; UAT: hokm-server-uat.up.railway.app / uat.hokm.live
• Realtime 4-player card game, socket.io (pingInterval 5000 / pingTimeout 22000)

WHAT WE SEE

• Every long-lived connection (WebSocket AND HTTP long-polling) is killed within ~20–90 seconds, for ALL connected users (multiple countries), in BOTH production and UAT.
• Server-side disconnect reasons: overwhelmingly "transport close" (upstream closed the TCP connection), plus "transport error"/"ping timeout". Median socket lifetime today ~47s (measured across ~875 connections), broad distribution — not a fixed timeout.
• Short HTTP requests are completely unaffected (consistent 200s at ~150–200 ms on both paths).
• Our app containers are healthy throughout: no restarts, no crashes, event loop responsive, reconnections accepted instantly.

TIMELINE (UTC, 2026-07-18)

• From at least 08:00: recurring churn waves. Sampled bursts against only ~26–35 concurrent clients: 32 disconnects/min at 10:37, 26/min at 10:44, 22/min at 12:50.
• 15:29 onward: sustained 15–30 disconnects/min. Player-visible impact: 4-player matches degraded into constant rejoin loops; matchmaking games repeatedly cancelled.
• Still active at 16:14+ when we ran the live tests below.

CONTROLLED REPRODUCTION (16:08–16:16 UTC, bare socket.io client, clean external gigabit network, WebSocket transport)

1. wss via Cloudflare to hokm.live: 8 drops in 8 min, all "ping timeout" — CF keeps the client leg open but the upstream leg to Railway dies silently, pongs stop.

2. DIRECT to the Railway edge (TLS/SNI dial eyjx3806.up.railway.app, Host: hokm.live — Cloudflare fully bypassed): 10 drops in 8 min, all "transport close", connection killed every ~20–80s.

3. UAT (hokm-server-uat.up.railway.app and uat.hokm.live): 10 and 9 drops respectively in 6 min, all "transport close" — a different container/deployment, same behavior.

4. Control: a WebSocket to a non-Railway host from the same machine at the same time stayed up with zero drops.

WHAT WE'VE RULED OUT

• Our deploys: identical churn on the previous deployment's build (running code from before today's merges).
• Our application code: unauthenticated test sockets that execute none of our app logic are killed at the transport level; our server never issues disconnects (those would surface as "io server disconnect", which never appears).
• Cloudflare: bypassing it entirely makes the drops MORE frequent.
• Client networks: multiple countries affected simultaneously, and the non-Railway control connection is rock solid.

ASKS

1. Please check the edge fleet / networking path for our services around the timestamps above — is something cycling or resetting long-lived connections far more aggressively than normal?

2. Is this related to the keep-alive reset / permessage-deflate investigation from our June thread?

3. If there's an incident or mitigation in progress, a heads-up would help us decide whether to communicate downtime to players.

Happy to provide raw logs, socket IDs, or run further tests on request.

Thanks,

Mahmoud (hokm.live)