detachHttp decided which list to remove a connection from by reading _state, without taking the per-connection _mut that swapList holds across (remove -> publish _state -> insert). The reactor could therefore remove a conn from a list it was not in yet, which clobbers that list's head/tail, and then free a Conn the list still referenced. When the pool handed that storage back out for a websocket that later died, the retired tombstone was still reachable and reading .protocol.http on it panicked -- the crash that SIGABRT'd this PDS on 2026-08-18. Upstream moves setState(.handover) inside the lock and adds a deterministic regression test using a barrier hook. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>