Guards evaluated before this route's WebSocket handshake is accepted.

They run in declared order. The first guard that returns a refusal object rejects the upgrade; when omitted, the matching route accepts upgrades as it did before route-scoped guards existed.