@fuzdev/fuz_app 0.128.0 → 0.130.0

package/dist/http/common_routes.js

@@ -71,7 +71,7 @@ export const load_expected_schema = (url) => {
  * else `503 {error}` (`schema_drift` when columns are missing, `db_unreachable`
  * when the introspection query throws). The detailed drift goes to the server
  * log only — the public body stays a minimal code so the endpoint doesn't leak
- * schema structure (mirrors why `/api/surface` is authenticated). A deploy poll
+ * schema structure (mirrors why `/api/surface` is admin-only). A deploy poll
  * treats `503` as a failed release and rolls back, turning a silent
  * schema-drift auth outage into a loud blocked deploy. See `db/schema_ready.ts`
  * for the column-presence rationale and `auth/migrations.ts` for the
@@ -129,21 +129,3 @@ export const create_server_status_route_spec = (options) => ({
     input: z.null(),
     output: z.looseObject({ version: z.string(), uptime_ms: z.number() })
 });
-/**
- * Create an authenticated route spec that serves the `AppSurface` as JSON.
- *
- * Surface data reveals API structure (routes, auth, schemas), so this
- * requires authentication like the server status route.
- */
-export const create_surface_route_spec = (options) => ({
-    method: 'GET',
-    path: '/api/surface',
-    auth: { account: 'required', actor: 'none' },
-    handler: (c) => c.json(options.surface),
-    description: 'Application surface (routes, middleware, schemas)',
-    input: z.null(),
-    output: z.looseObject({
-        routes: z.array(z.looseObject({})),
-        middleware: z.array(z.looseObject({}))
-    })
-});

package/dist/http/ip_canonical.d.ts

@@ -12,7 +12,7 @@
  * IPv6 forms (`::ffff:127.0.0.1` vs `0:0:0:0:0:ffff:7f00:1` vs the
  * bare `127.0.0.1`) — three keys for one address.
  *
- * Canonicalization runs through {@link canonicalize_ip} which:
+ * Canonicalization runs through `canonicalize_ip` which:
  *
  * 1. Lowercases and char-set filters (`IP_LITERAL_CHARS`) — non-IP
  *    strings (`'unknown'`, `'attacker:controlled'`, `'::1\n'`) pass

package/dist/http/ip_canonical.js

@@ -12,7 +12,7 @@
  * IPv6 forms (`::ffff:127.0.0.1` vs `0:0:0:0:0:ffff:7f00:1` vs the
  * bare `127.0.0.1`) — three keys for one address.
  *
- * Canonicalization runs through {@link canonicalize_ip} which:
+ * Canonicalization runs through `canonicalize_ip` which:
  *
  * 1. Lowercases and char-set filters (`IP_LITERAL_CHARS`) — non-IP
  *    strings (`'unknown'`, `'attacker:controlled'`, `'::1\n'`) pass

package/dist/http/jsonrpc_errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jsonrpc_errors.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/jsonrpc_errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAEnE,OAAO,EAMN,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,MAAM,cAAc,CAAC;AAEtB,0CAA0C;AAC1C,eAAO,MAAM,qBAAqB,kBAAkB,CAAC;AAErD,sEAAsE;AACtE,MAAM,MAAM,gBAAgB,GACzB,aAAa,GACb,iBAAiB,GACjB,kBAAkB,GAClB,gBAAgB,GAChB,gBAAgB,GAChB,iBAAiB,GACjB,WAAW,GACX,WAAW,GACX,UAAU,GACV,kBAAkB,GAClB,cAAc,GACd,qBAAqB,GACrB,SAAS,GACT,gBAAgB,GAChB,mBAAmB,CAAC;AAEvB;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,EA0C1B,QAAQ,CAAC,MAAM,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,QAAQ,GAAI,CAAC,EAAE,OAAO,CAAC,KAAG,CAAC,GAAG,SAAsC,CAAC;AAElF;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,EAmG7B,QAAQ,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,kBAAkB,CAAC,CAAC,CAAC;AAEtF;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC5C,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,CAAC,EAAE,OAAO,CAAC;gBAEH,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,YAAY;CAK3F;AAWD;;;;GAIG;AACH,eAAO,MAAM,cAAc;8CAXQ,kBAAkB;kDAAlB,kBAAkB;mDAAlB,kBAAkB;iDAAlB,kBAAkB;iDAAlB,kBAAkB;kDAAlB,kBAAkB;4CAAlB,kBAAkB;4CAAlB,kBAAkB;2CAAlB,kBAAkB;mDAAlB,kBAAkB;+CAAlB,kBAAkB;sDAAlB,kBAAkB;0CAAlB,kBAAkB;iDAAlB,kBAAkB;oDAAlB,kBAAkB;CA2BqC,CAAC;AAI3F;;;;;;;GAOG;AACH,eAAO,MAAM,iCAAiC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAkBpE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAMzC,CAAC;AAEvC;;;;;;;;;GASG;AACH,eAAO,MAAM,iCAAiC,GAAI,MAAM,gBAAgB,KAAG,oBACQ,CAAC;AAEpF;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,GAAI,QAAQ,MAAM,KAAG,gBACa,CAAC;AAEjF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAMjF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,GAAI,MAAM,gBAAgB,KAAG,gBACL,CAAC"}
+{"version":3,"file":"jsonrpc_errors.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/jsonrpc_errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAEnE,OAAO,EAMN,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,MAAM,cAAc,CAAC;AAEtB,0CAA0C;AAC1C,eAAO,MAAM,qBAAqB,kBAAkB,CAAC;AAErD,sEAAsE;AACtE,MAAM,MAAM,gBAAgB,GACzB,aAAa,GACb,iBAAiB,GACjB,kBAAkB,GAClB,gBAAgB,GAChB,gBAAgB,GAChB,iBAAiB,GACjB,WAAW,GACX,WAAW,GACX,UAAU,GACV,kBAAkB,GAClB,cAAc,GACd,qBAAqB,GACrB,SAAS,GACT,gBAAgB,GAChB,mBAAmB,CAAC;AAEvB;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,EA4C1B,QAAQ,CAAC,MAAM,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,QAAQ,GAAI,CAAC,EAAE,OAAO,CAAC,KAAG,CAAC,GAAG,SAAsC,CAAC;AAElF;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,EAmG7B,QAAQ,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,kBAAkB,CAAC,CAAC,CAAC;AAEtF;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC5C,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,CAAC,EAAE,OAAO,CAAC;gBAEH,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,YAAY;CAK3F;AAWD;;;;GAIG;AACH,eAAO,MAAM,cAAc;8CAXQ,kBAAkB;kDAAlB,kBAAkB;mDAAlB,kBAAkB;iDAAlB,kBAAkB;iDAAlB,kBAAkB;kDAAlB,kBAAkB;4CAAlB,kBAAkB;4CAAlB,kBAAkB;2CAAlB,kBAAkB;mDAAlB,kBAAkB;+CAAlB,kBAAkB;sDAAlB,kBAAkB;0CAAlB,kBAAkB;iDAAlB,kBAAkB;oDAAlB,kBAAkB;CA2BqC,CAAC;AAI3F;;;;;;;GAOG;AACH,eAAO,MAAM,iCAAiC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAkBpE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAMzC,CAAC;AAEvC;;;;;;;;;GASG;AACH,eAAO,MAAM,iCAAiC,GAAI,MAAM,gBAAgB,KAAG,oBACQ,CAAC;AAEpF;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,GAAI,QAAQ,MAAM,KAAG,gBACa,CAAC;AAEjF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAMjF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,GAAI,MAAM,gBAAgB,KAAG,gBACL,CAAC"}

package/dist/http/jsonrpc_errors.js

@@ -61,9 +61,11 @@ export const JSONRPC_ERROR_CODES = Object.freeze({
     service_unavailable: -32007,
     timeout: -32008,
     /**
-     * Client-side backpressure — an outbound buffer (e.g. `FrontendWebsocketClient`'s
-     * disconnected request queue) refused a new request because it was full.
-     * Distinct from `rate_limited`, which signals a server-side policy.
+     * Backpressure — a buffer refused a new request because it was full: on the
+     * client an outbound buffer (e.g. `FrontendWebsocketClient`'s disconnected
+     * request queue), on the server a WebSocket already running
+     * `MAX_INBOUND_DISPATCHES_PER_CONNECTION` requests. Distinct from
+     * `rate_limited`, which signals a server-side policy over time.
      */
     queue_overflow: -32009,
     /**
@@ -242,8 +244,8 @@ export const JSONRPC_ERROR_CODE_TO_HTTP_STATUS = {
     [-32004]: 409, // conflict
     [-32005]: 422, // validation_error
     // queue_overflow shares 429 with rate_limited — listed first so reverse
-    // map wins with rate_limited (server-side) rather than client-side overflow.
-    [-32009]: 429, // queue_overflow (client-side backpressure)
+    // map wins with rate_limited (a policy) rather than a full buffer.
+    [-32009]: 429, // queue_overflow (backpressure)
     [-32006]: 429, // rate_limited
     [-32007]: 503, // service_unavailable
     [-32008]: 504, // timeout

package/dist/realtime/sse.d.ts

@@ -21,7 +21,12 @@ export interface SseStream<T = unknown> {
     comment: (text: string) => void;
     /** Close the stream. */
     close: () => void;
-    /** Register a listener called when the stream closes (client disconnect or explicit close). */
+    /**
+     * Register a listener called when the stream closes (client disconnect or
+     * explicit close). Called at once when the stream has already closed — a
+     * client can leave before the caller registers — so a cleanup registered
+     * through it always runs.
+     */
     on_close: (fn: () => void) => void;
 }
 /**
@@ -43,6 +48,14 @@ export interface SseNotification {
  * The callback suspends via a promise that resolves on client disconnect
  * or explicit `close()`, keeping the stream alive for external sends.
  *
+ * The stream closes when its client disconnects, whenever that happens — also
+ * before the handler returns the response, which no runtime reports by
+ * cancelling the body. A client already gone when this is called yields a
+ * stream that is already closed, so register cleanup with `on_close` (which
+ * runs a late listener at once) before handing the stream anywhere that would
+ * count it — `SubscriberRegistry.admit` after `on_close(pending.unsubscribe)`
+ * refuses it.
+ *
  * Uses `hono_stream.write()` directly (not `writeSSE`) to avoid
  * Hono's HTML callback resolution — keeps the same `data: JSON\n\n` format.
  *

package/dist/realtime/sse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sse.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/realtime/sse.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAItD;;;;GAIG;AACH,MAAM,WAAW,SAAS,CAAC,CAAC,GAAG,OAAO;IACrC,mDAAmD;IACnD,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC;IACxB,6CAA6C;IAC7C,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,wBAAwB;IACxB,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,+FAA+F;IAC/F,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;CACnC;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC/B,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,MAAM,EAAE,OAAO,CAAC;CAChB;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,mBAAmB,GAAI,CAAC,GAAG,OAAO,EAC9C,GAAG,OAAO,EACV,KAAK,MAAM,KACT;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAA;CAiD5C,CAAC;AAEF,gFAAgF;AAChF,MAAM,WAAW,SAAS;IACzB,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC;IAClB,8DAA8D;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GAAI,CAAC,SAAS,eAAe,EACrE,aAAa;IAAE,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,IAAI,CAAA;CAAE,EAC9D,aAAa,KAAK,CAAC,SAAS,CAAC,EAC7B,KAAK,MAAM,KACT;IAAE,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,IAAI,CAAA;CAmBjD,CAAC"}
+{"version":3,"file":"sse.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/realtime/sse.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAItD;;;;GAIG;AACH,MAAM,WAAW,SAAS,CAAC,CAAC,GAAG,OAAO;IACrC,mDAAmD;IACnD,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC;IACxB,6CAA6C;IAC7C,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,wBAAwB;IACxB,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;CACnC;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC/B,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,MAAM,EAAE,OAAO,CAAC;CAChB;AA8DD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,mBAAmB,GAAI,CAAC,GAAG,OAAO,EAC9C,GAAG,OAAO,EACV,KAAK,MAAM,KACT;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAA;CA4D5C,CAAC;AAEF,gFAAgF;AAChF,MAAM,WAAW,SAAS;IACzB,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC;IAClB,8DAA8D;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GAAI,CAAC,SAAS,eAAe,EACrE,aAAa;IAAE,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,IAAI,CAAA;CAAE,EAC9D,aAAa,KAAK,CAAC,SAAS,CAAC,EAC7B,KAAK,MAAM,KACT;IAAE,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,IAAI,CAAA;CAmBjD,CAAC"}

package/dist/realtime/sse.js

@@ -10,6 +10,62 @@ import { streamSSE } from 'hono/streaming';
 import { z } from 'zod';
 import { DEV } from 'esm-env';
 import { SSE_CONNECTED_COMMENT } from './sse_constants.js';
+const is_node_connection_stream = (value) => {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const candidate = value;
+    return typeof candidate.destroyed === 'boolean' && typeof candidate.once === 'function';
+};
+/**
+ * The Node stream that ends with the client's connection, from the
+ * `c.env.outgoing` that `@hono/node-server` passes a handler: over HTTP/1 the
+ * `ServerResponse` itself, over HTTP/2 the `Http2ServerResponse`'s `stream` —
+ * the response is no stream there and has no `destroyed`.
+ */
+const to_node_connection_stream = (env) => {
+    if (typeof env !== 'object' || env === null)
+        return null;
+    const outgoing = env.outgoing;
+    if (typeof outgoing !== 'object' || outgoing === null)
+        return null;
+    if (is_node_connection_stream(outgoing))
+        return outgoing;
+    const { stream } = outgoing;
+    return is_node_connection_stream(stream) ? stream : null;
+};
+/**
+ * Call `on_gone` once the client of `c` has disconnected — at once if it
+ * already has.
+ *
+ * A stream closes on its own only when the runtime cancels the response body,
+ * and a runtime cancels only a body it has started to send. A client that
+ * leaves before the handler returns — one awaiting a credential re-read, say —
+ * is never sent the body, so nothing would close the stream.
+ *
+ * On `@hono/node-server` the request's `signal` cannot be trusted for this:
+ * the adapter creates it on first read and aborts it only if it existed when
+ * the connection closed, so a handler that reads it after an `await` can hold
+ * a signal that never fires. The Node stream behind the response says whether
+ * the connection is gone and emits `close` when it goes, so that is what is
+ * watched there — the response object (`c.env.outgoing`) over HTTP/1, its
+ * `Http2Stream` over HTTP/2. Elsewhere the request's `signal` is the
+ * disconnect — the Fetch-standard runtimes abort it when the client leaves.
+ */
+const watch_client_disconnect = (c, on_gone) => {
+    const connection = to_node_connection_stream(c.env);
+    if (connection) {
+        if (connection.destroyed)
+            on_gone();
+        else
+            connection.once('close', on_gone);
+        return;
+    }
+    const { signal } = c.req.raw;
+    if (signal.aborted)
+        on_gone();
+    else
+        signal.addEventListener('abort', on_gone, { once: true });
+};
 /**
  * Create an SSE response for a Hono context.
  *
@@ -18,6 +74,14 @@ import { SSE_CONNECTED_COMMENT } from './sse_constants.js';
  * The callback suspends via a promise that resolves on client disconnect
  * or explicit `close()`, keeping the stream alive for external sends.
  *
+ * The stream closes when its client disconnects, whenever that happens — also
+ * before the handler returns the response, which no runtime reports by
+ * cancelling the body. A client already gone when this is called yields a
+ * stream that is already closed, so register cleanup with `on_close` (which
+ * runs a late listener at once) before handing the stream anywhere that would
+ * count it — `SubscriberRegistry.admit` after `on_close(pending.unsubscribe)`
+ * refuses it.
+ *
  * Uses `hono_stream.write()` directly (not `writeSSE`) to avoid
  * Hono's HTML callback resolution — keeps the same `data: JSON\n\n` format.
  *
@@ -64,7 +128,16 @@ export const create_sse_response = (c, log) => {
             },
             close: do_close,
             on_close(fn) {
-                close_listeners.push(fn);
+                if (!resolved) {
+                    close_listeners.push(fn);
+                    return;
+                }
+                try {
+                    fn();
+                }
+                catch (e) {
+                    log.error('on_close listener threw:', e);
+                }
             }
         };
         hono_stream.onAbort(do_close);
@@ -73,6 +146,9 @@ export const create_sse_response = (c, log) => {
         void hono_stream.write(SSE_CONNECTED_COMMENT);
         await promise;
     });
+    // after the callback above has built `sse_stream`, which runs synchronously
+    // up to its first `await`
+    watch_client_disconnect(c, do_close);
     return { response, stream: sse_stream };
 };
 /**

package/dist/realtime/sse_auth_guard.d.ts

@@ -118,7 +118,9 @@ export declare const AUDIT_LOG_SSE_MAX_PER_SCOPE = 10;
  * connection closer.
  *
  * Combines `SubscriberRegistry`, `create_sse_auth_guard`, and the broadcast
- * call into a single object, and adds the registry to `connection_closer`.
+ * call into a single object, and adds the registry to `connection_closer` for
+ * good — the remover `add` returns is dropped, so a caller that must take the
+ * registry out again passes `null` and adds it itself.
  * The result satisfies `AuditLogRouteOptions['stream']`
  * and provides the `on_audit_event` listener for the audit emitter.
  *

package/dist/realtime/sse_auth_guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sse_auth_guard.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/realtime/sse_auth_guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAGtD,OAAO,EAIN,KAAK,aAAa,EAClB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE3D,2DAA2D;AAC3D,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,GAAI,CAAC,EAC7C,UAAU,kBAAkB,CAAC,CAAC,CAAC,KAC7B,gBAKD,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,qBAAqB,GAAI,CAAC,EACtC,UAAU,kBAAkB,CAAC,CAAC,CAAC,EAC/B,eAAe,MAAM,GAAG,IAAI,EAC5B,KAAK,MAAM,KACT,CAAC,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CA4DjC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC3B;;;;;OAKG;IACH,QAAQ,EAAE,kBAAkB,CAAC,eAAe,CAAC,CAAC;IAC9C,kFAAkF;IAClF,GAAG,EAAE,MAAM,CAAC;IACZ,yJAAyJ;IACzJ,cAAc,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;CAC/C;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,KAAK,CAAC,SAAS,CAOlD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,eAAO,MAAM,oBAAoB,GAAI,SAAS;IAC7C,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;;OASG;IACH,iBAAiB,EAAE,cAAc,GAAG,IAAI,CAAC;IACzC;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,KAAG,WAgBH,CAAC"}
+{"version":3,"file":"sse_auth_guard.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/realtime/sse_auth_guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAGtD,OAAO,EAIN,KAAK,aAAa,EAClB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE3D,2DAA2D;AAC3D,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,GAAI,CAAC,EAC7C,UAAU,kBAAkB,CAAC,CAAC,CAAC,KAC7B,gBAKD,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,qBAAqB,GAAI,CAAC,EACtC,UAAU,kBAAkB,CAAC,CAAC,CAAC,EAC/B,eAAe,MAAM,GAAG,IAAI,EAC5B,KAAK,MAAM,KACT,CAAC,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CA4DjC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC3B;;;;;OAKG;IACH,QAAQ,EAAE,kBAAkB,CAAC,eAAe,CAAC,CAAC;IAC9C,kFAAkF;IAClF,GAAG,EAAE,MAAM,CAAC;IACZ,yJAAyJ;IACzJ,cAAc,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;CAC/C;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,KAAK,CAAC,SAAS,CAOlD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,eAAO,MAAM,oBAAoB,GAAI,SAAS;IAC7C,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;;OASG;IACH,iBAAiB,EAAE,cAAc,GAAG,IAAI,CAAC;IACzC;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,KAAG,WAgBH,CAAC"}

package/dist/realtime/sse_auth_guard.js

@@ -164,7 +164,9 @@ export const AUDIT_LOG_SSE_MAX_PER_SCOPE = 10;
  * connection closer.
  *
  * Combines `SubscriberRegistry`, `create_sse_auth_guard`, and the broadcast
- * call into a single object, and adds the registry to `connection_closer`.
+ * call into a single object, and adds the registry to `connection_closer` for
+ * good — the remover `add` returns is dropped, so a caller that must take the
+ * registry out again passes `null` and adds it itself.
  * The result satisfies `AuditLogRouteOptions['stream']`
  * and provides the `on_audit_event` listener for the audit emitter.
  *
@@ -203,7 +205,7 @@ export const AUDIT_LOG_SSE_MAX_PER_SCOPE = 10;
 export const create_audit_log_sse = (options) => {
     const role = options.role ?? 'admin';
     const max_per_scope = options.max_per_scope === undefined ? AUDIT_LOG_SSE_MAX_PER_SCOPE : options.max_per_scope;
-    const registry = new SubscriberRegistry({ max_per_scope });
+    const registry = new SubscriberRegistry({ max_per_scope, log: options.log });
     const guard = create_sse_auth_guard(registry, role, options.log);
     options.connection_closer?.add(create_sse_connection_closer(registry));
     return {

package/dist/realtime/subscriber_registry.d.ts

@@ -22,6 +22,7 @@
  *
  * @module
  */
+import { Logger } from '@fuzdev/fuz_util/log.ts';
 import type { SseStream } from './sse.js';
 /** One admitted subscriber, as `SubscriberRegistry.broadcast` sees it. */
 export interface Subscriber<T> {
@@ -42,6 +43,13 @@ export interface SubscriberRegistryOptions {
      * `null` (default) disables the cap. `groups` identities are never capped.
      */
     max_per_scope?: number | null;
+    /**
+     * Logger for a stream whose `close` throws while the cap evicts it — the
+     * evicted stream is another subscriber's, so its failure is logged rather
+     * than failing the admission that evicted it. Unset falls back to an
+     * `[sse]` logger; `null` silences it.
+     */
+    log?: Logger | null;
 }
 /** Options for `SubscriberRegistry.subscribe` and `subscribe_pending`. */
 export interface SubscribeOptions {
@@ -105,6 +113,16 @@ export interface PendingSubscription {
  * behind it. The twin of the Rust `fuz_realtime` `SseRegistry`
  * (`subscribe_pending` / `admit` / `subscribe`).
  *
+ * ## Shutdown
+ *
+ * `close_all` — the close `AppServer.close` runs — closes every stream,
+ * pending or admitted, and leaves the registry **closing** for good: every
+ * later registration is born closed. `subscribe_pending` registers nothing,
+ * so `admit` refuses the handle and the route's stream ends after its connect
+ * comment; `subscribe` closes the stream it is given at once. A stream still
+ * opening when the server shuts down therefore ends rather than outliving it.
+ * The flag is set in the same synchronous step that closes the live streams.
+ *
  * @example
  * ```ts
  * const registry = new SubscriberRegistry<SseNotification>();
@@ -144,8 +162,10 @@ export interface PendingSubscription {
  *   return unauthorized();
  * }
  * const {response, stream} = create_sse_response(c, log);
- * if (registry.admit(pending, stream)) stream.on_close(pending.unsubscribe);
- * else stream.close(); // closed while pending — the body is the connect comment alone
+ * // first: a client that already left closes the stream, its listener runs at
+ * // once, and `admit` then refuses the removed registration
+ * stream.on_close(pending.unsubscribe);
+ * if (!registry.admit(pending, stream)) stream.close(); // the body is the connect comment alone
  * return response;
  * ```
  */
@@ -162,6 +182,13 @@ export declare class SubscriberRegistry<T> {
      * and `admit` (or their refusal). For telemetry and tests.
      */
     get pending_count(): number;
+    /**
+     * Whether `close_all` has run — the registry is shutting down and every
+     * registration from now on is born closed (class doc, "Shutdown"). The
+     * audit stream route reads it to skip the re-reads for a registration
+     * admission will refuse anyway.
+     */
+    get closing(): boolean;
     /**
      * Add a subscriber, admitted at once — the one-step form of
      * `subscribe_pending` + `admit`.
@@ -171,6 +198,10 @@ export declare class SubscriberRegistry<T> {
      * nothing, and the stream would open on a dead credential (class doc,
      * "Two-phase registration").
      *
+     * Once the registry is closing, the subscriber is born closed: `stream` is
+     * closed at once, nothing is registered, and the returned function is a
+     * no-op.
+     *
      * @param stream - SSE stream to send data to
      * @param options - channel filter and identity slots (`scope` + `groups`)
      * @returns unsubscribe function
@@ -186,18 +217,21 @@ export declare class SubscriberRegistry<T> {
      * broadcast, is not counted, and evicts nothing. A caller that then refuses
      * the request calls the returned handle's `unsubscribe`.
      *
+     * Once the registry is closing, the registration is born closed: nothing
+     * is registered, and `admit` refuses the handle.
+     *
      * @param options - channel filter and identity slots (`scope` + `groups`)
      * @returns the pending handle `admit` takes
-     * @mutates registry - adds the un-admitted registration
+     * @mutates registry - adds the un-admitted registration, unless the registry is closing
      */
     subscribe_pending(options?: SubscribeOptions): PendingSubscription;
     /**
      * Admit a pending subscription, attaching the stream it delivers to — phase
      * two (class doc).
      *
-     * If the registration is gone — a revocation closed it while it was
-     * pending, or it was unsubscribed — nothing is evicted and the subscription
-     * is refused. Otherwise the per-scope cap is enforced as in `subscribe`,
+     * If the registration is gone — a revocation or the shutdown closed it
+     * while it was pending, it was born closed, or it was unsubscribed —
+     * nothing is evicted and the subscription is refused. Otherwise the per-scope cap is enforced as in `subscribe`,
      * counting only admitted subscribers, and the stream starts receiving
      * `broadcast` data. Admitting twice is refused the second time.
      *
@@ -238,13 +272,15 @@ export declare class SubscriberRegistry<T> {
     close_by_identity(identity: string): number;
     /**
      * Force-close every subscriber, pending or admitted — the shutdown close
-     * `AppServer.close` runs through the registry's `ConnectionCloser`.
+     * `AppServer.close` runs through the registry's `ConnectionCloser` — and
+     * leave the registry closing, for good: every later registration is born
+     * closed (class doc, "Shutdown"). A second call closes nothing.
      *
      * A stream whose `close` throws does not stop the loop: every subscriber is
      * removed and closed, and the first error is thrown afterward.
      *
      * @returns the number of subscribers closed
-     * @mutates registry - removes every subscriber and closes its stream
+     * @mutates registry - sets the registry closing, removes every subscriber, and closes its stream
      * @throws the first error a stream's `close` threw, after every subscriber was attempted
      */
     close_all(): number;

package/dist/realtime/subscriber_registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subscriber_registry.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/realtime/subscriber_registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE1C,0EAA0E;AAC1E,MAAM,WAAW,UAAU,CAAC,CAAC;IAC5B,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IACrB,sEAAsE;IACtE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAC7B,mDAAmD;IACnD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,qEAAqE;IACrE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;CAC3B;AASD,wCAAwC;AACxC,MAAM,WAAW,yBAAyB;IACzC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAChC,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACjC;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC/B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;OAIG;IACH,WAAW,EAAE,MAAM,IAAI,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyEG;AACH,qBAAa,kBAAkB,CAAC,CAAC;;gBAQpB,OAAO,CAAC,EAAE,yBAAyB;IAI/C;;;OAGG;IACH,IAAI,KAAK,IAAI,MAAM,CAMlB;IAED;;;OAGG;IACH,IAAI,aAAa,IAAI,MAAM,CAM1B;IAED;;;;;;;;;;;;;OAaG;IACH,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,MAAM,IAAI;IASvE;;;;;;;;;;;;OAYG;IACH,iBAAiB,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,mBAAmB;IAYlE;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO;IASlE;;;;;;;OAOG;IACH,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI;IASzC;;;;;;;;;;;;;;;;;;OAkBG;IACH,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAM3C;;;;;;;;;;OAUG;IACH,SAAS,IAAI,MAAM;CA0EnB"}
+{"version":3,"file":"subscriber_registry.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/realtime/subscriber_registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE1C,0EAA0E;AAC1E,MAAM,WAAW,UAAU,CAAC,CAAC;IAC5B,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IACrB,sEAAsE;IACtE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAC7B,mDAAmD;IACnD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,qEAAqE;IACrE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;CAC3B;AASD,wCAAwC;AACxC,MAAM,WAAW,yBAAyB;IACzC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB;AAED,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAChC,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACjC;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC/B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;OAIG;IACH,WAAW,EAAE,MAAM,IAAI,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AACH,qBAAa,kBAAkB,CAAC,CAAC;;gBAYpB,OAAO,CAAC,EAAE,yBAAyB;IAK/C;;;OAGG;IACH,IAAI,KAAK,IAAI,MAAM,CAMlB;IAED;;;OAGG;IACH,IAAI,aAAa,IAAI,MAAM,CAM1B;IAED;;;;;OAKG;IACH,IAAI,OAAO,IAAI,OAAO,CAErB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,MAAM,IAAI;IAavE;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,mBAAmB;IAYlE;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO;IASlE;;;;;;;OAOG;IACH,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI;IASzC;;;;;;;;;;;;;;;;;;OAkBG;IACH,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAM3C;;;;;;;;;;;;OAYG;IACH,SAAS,IAAI,MAAM;CAsFnB"}

package/dist/realtime/subscriber_registry.js

@@ -22,6 +22,7 @@
  *
  * @module
  */
+import { Logger } from '@fuzdev/fuz_util/log.ts';
 /**
  * Generic subscriber registry with channel-based filtering and identity-keyed disconnection.
  *
@@ -52,6 +53,16 @@
  * behind it. The twin of the Rust `fuz_realtime` `SseRegistry`
  * (`subscribe_pending` / `admit` / `subscribe`).
  *
+ * ## Shutdown
+ *
+ * `close_all` — the close `AppServer.close` runs — closes every stream,
+ * pending or admitted, and leaves the registry **closing** for good: every
+ * later registration is born closed. `subscribe_pending` registers nothing,
+ * so `admit` refuses the handle and the route's stream ends after its connect
+ * comment; `subscribe` closes the stream it is given at once. A stream still
+ * opening when the server shuts down therefore ends rather than outliving it.
+ * The flag is set in the same synchronous step that closes the live streams.
+ *
  * @example
  * ```ts
  * const registry = new SubscriberRegistry<SseNotification>();
@@ -91,8 +102,10 @@
  *   return unauthorized();
  * }
  * const {response, stream} = create_sse_response(c, log);
- * if (registry.admit(pending, stream)) stream.on_close(pending.unsubscribe);
- * else stream.close(); // closed while pending — the body is the connect comment alone
+ * // first: a client that already left closes the stream, its listener runs at
+ * // once, and `admit` then refuses the removed registration
+ * stream.on_close(pending.unsubscribe);
+ * if (!registry.admit(pending, stream)) stream.close(); // the body is the connect comment alone
  * return response;
  * ```
  */
@@ -103,8 +116,13 @@ export class SubscriberRegistry {
     // another registry names nothing here
     #pending = new WeakMap();
     #max_per_scope;
+    #log;
+    // set once by `close_all`, never cleared — every later registration is born
+    // closed (class doc, "Shutdown")
+    #closing = false;
     constructor(options) {
         this.#max_per_scope = options?.max_per_scope ?? null;
+        this.#log = options?.log === undefined ? new Logger('[sse]') : options.log;
     }
     /**
      * Number of open — **admitted** — subscribers. A registration still pending
@@ -130,6 +148,15 @@ export class SubscriberRegistry {
         }
         return count;
     }
+    /**
+     * Whether `close_all` has run — the registry is shutting down and every
+     * registration from now on is born closed (class doc, "Shutdown"). The
+     * audit stream route reads it to skip the re-reads for a registration
+     * admission will refuse anyway.
+     */
+    get closing() {
+        return this.#closing;
+    }
     /**
      * Add a subscriber, admitted at once — the one-step form of
      * `subscribe_pending` + `admit`.
@@ -139,12 +166,20 @@ export class SubscriberRegistry {
      * nothing, and the stream would open on a dead credential (class doc,
      * "Two-phase registration").
      *
+     * Once the registry is closing, the subscriber is born closed: `stream` is
+     * closed at once, nothing is registered, and the returned function is a
+     * no-op.
+     *
      * @param stream - SSE stream to send data to
      * @param options - channel filter and identity slots (`scope` + `groups`)
      * @returns unsubscribe function
      * @mutates registry - adds the new subscriber; closes oldest matching subscribers when `max_per_scope` is exceeded
      */
     subscribe(stream, options) {
+        if (this.#closing) {
+            stream.close();
+            return () => { };
+        }
         const subscriber = this.#create_entry(options);
         this.#admit_entry(subscriber, stream);
         this.#subscribers.add(subscriber);
@@ -161,13 +196,17 @@ export class SubscriberRegistry {
      * broadcast, is not counted, and evicts nothing. A caller that then refuses
      * the request calls the returned handle's `unsubscribe`.
      *
+     * Once the registry is closing, the registration is born closed: nothing
+     * is registered, and `admit` refuses the handle.
+     *
      * @param options - channel filter and identity slots (`scope` + `groups`)
      * @returns the pending handle `admit` takes
-     * @mutates registry - adds the un-admitted registration
+     * @mutates registry - adds the un-admitted registration, unless the registry is closing
      */
     subscribe_pending(options) {
         const subscriber = this.#create_entry(options);
-        this.#subscribers.add(subscriber);
+        if (!this.#closing)
+            this.#subscribers.add(subscriber);
         const pending = {
             unsubscribe: () => {
                 this.#subscribers.delete(subscriber);
@@ -180,9 +219,9 @@ export class SubscriberRegistry {
      * Admit a pending subscription, attaching the stream it delivers to — phase
      * two (class doc).
      *
-     * If the registration is gone — a revocation closed it while it was
-     * pending, or it was unsubscribed — nothing is evicted and the subscription
-     * is refused. Otherwise the per-scope cap is enforced as in `subscribe`,
+     * If the registration is gone — a revocation or the shutdown closed it
+     * while it was pending, it was born closed, or it was unsubscribed —
+     * nothing is evicted and the subscription is refused. Otherwise the per-scope cap is enforced as in `subscribe`,
      * counting only admitted subscribers, and the stream starts receiving
      * `broadcast` data. Admitting twice is refused the second time.
      *
@@ -240,16 +279,20 @@ export class SubscriberRegistry {
     }
     /**
      * Force-close every subscriber, pending or admitted — the shutdown close
-     * `AppServer.close` runs through the registry's `ConnectionCloser`.
+     * `AppServer.close` runs through the registry's `ConnectionCloser` — and
+     * leave the registry closing, for good: every later registration is born
+     * closed (class doc, "Shutdown"). A second call closes nothing.
      *
      * A stream whose `close` throws does not stop the loop: every subscriber is
      * removed and closed, and the first error is thrown afterward.
      *
      * @returns the number of subscribers closed
-     * @mutates registry - removes every subscriber and closes its stream
+     * @mutates registry - sets the registry closing, removes every subscriber, and closes its stream
      * @throws the first error a stream's `close` threw, after every subscriber was attempted
      */
     close_all() {
+        // before any close, so a registration a close listener triggers is born closed too
+        this.#closing = true;
         return this.#close_where(() => true);
     }
     #close_where(predicate) {
@@ -304,6 +347,11 @@ export class SubscriberRegistry {
      * Close `scope`'s oldest **admitted** subscribers until one more fits under
      * `max`. Pending registrations are neither counted nor closed — a
      * subscription that may yet be refused must not cost a live one its slot.
+     *
+     * Every victim is removed, then closed in its own `try`: a stream whose
+     * `close` throws is still unregistered, the rest are still closed, and the
+     * error is logged — it belongs to another subscriber, so it must not fail
+     * the admission that evicted it.
      */
     #enforce_scope_limit(scope, max) {
         // admitted subscribers with this scope, in registration order (the
@@ -318,8 +366,14 @@ export class SubscriberRegistry {
         const overflow = matching.length - (max - 1);
         for (let i = 0; i < overflow; i++) {
             const [victim, stream] = matching[i];
-            stream.close();
+            // removed first, so a stream whose close throws is unregistered too
             this.#subscribers.delete(victim);
+            try {
+                stream.close();
+            }
+            catch (error) {
+                this.#log?.error('error closing a stream evicted by the cap:', error);
+            }
         }
     }
 }