Spend a WebSocket one-time key with one GETDEL

Shipped

September 28, 2026 at 6:57 PM UTC

Author

Kamo

Commit

8783606

spendOneTimeKey read the key and then deleted it, so two handshakes racing with the same key inside its 30 s life could both read it and both open a socket for the session (SP99 final review M-3). The key is now read and deleted in one command (getAndDelete, Redis GETDEL); the test pins that no separate GET or DEL is sent.