@fuzdev/fuz_app 0.129.0 → 0.130.0

package/dist/auth/audit_log_routes.d.ts

@@ -56,9 +56,13 @@ export interface AuditLogRouteOptions {
  * nothing else — to an `EventSource`, a stream closed an instant after it
  * opened (the client's reconnect is answered by the gates, with the precise
  * status). A pending registration receives no audit row, counts toward no cap,
- * and is removed when a re-read refuses the request. The twin of the Rust
- * spine's `audit_stream_router`, which registers before its role read rather
- * than repeating it.
+ * and is removed when a re-read refuses the request. Once the server is
+ * shutting down (`SubscriberRegistry` class doc, "Shutdown") the registration
+ * is born closed, the re-reads are skipped, and the answer is that same
+ * connect comment alone — as it is when the shutdown closes a registration
+ * whose re-read is in flight, even if the re-read then fails. The twin of the
+ * Rust spine's `audit_stream_router`, which registers before its role read
+ * rather than repeating it.
  *
  * @param options - optional stream wiring + role override
  * @returns the SSE route spec (when `options.stream` is provided) or an empty array

package/dist/auth/audit_log_routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit_log_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/audit_log_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAUvD,OAAO,EAAuB,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAU7E,yCAAyC;AACzC,MAAM,WAAW,oBAAoB;IACpC,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE;QACR,QAAQ,EAAE,kBAAkB,CAAC,eAAe,CAAC,CAAC;QAC9C,GAAG,EAAE,MAAM,CAAC;KACZ,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,4BAA4B,GAAI,UAAU,oBAAoB,KAAG,KAAK,CAAC,SAAS,CAgF5F,CAAC"}
+{"version":3,"file":"audit_log_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/audit_log_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAUvD,OAAO,EAAuB,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAU7E,yCAAyC;AACzC,MAAM,WAAW,oBAAoB;IACpC,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE;QACR,QAAQ,EAAE,kBAAkB,CAAC,eAAe,CAAC,CAAC;QAC9C,GAAG,EAAE,MAAM,CAAC;KACZ,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,eAAO,MAAM,4BAA4B,GAAI,UAAU,oBAAoB,KAAG,KAAK,CAAC,SAAS,CAiG5F,CAAC"}

package/dist/auth/audit_log_routes.js

@@ -42,9 +42,13 @@ import { AUDIT_LOG_CHANNEL } from '../realtime/sse_auth_guard.js';
  * nothing else — to an `EventSource`, a stream closed an instant after it
  * opened (the client's reconnect is answered by the gates, with the precise
  * status). A pending registration receives no audit row, counts toward no cap,
- * and is removed when a re-read refuses the request. The twin of the Rust
- * spine's `audit_stream_router`, which registers before its role read rather
- * than repeating it.
+ * and is removed when a re-read refuses the request. Once the server is
+ * shutting down (`SubscriberRegistry` class doc, "Shutdown") the registration
+ * is born closed, the re-reads are skipped, and the answer is that same
+ * connect comment alone — as it is when the shutdown closes a registration
+ * whose re-read is in flight, even if the re-read then fails. The twin of the
+ * Rust spine's `audit_stream_router`, which registers before its role read
+ * rather than repeating it.
  *
  * @param options - optional stream wiring + role override
  * @returns the SSE route spec (when `options.stream` is provided) or an empty array
@@ -87,34 +91,52 @@ export const create_audit_log_route_specs = (options) => {
                     // a revocation that closed before the registration is committed,
                     // so these see it. A throw here fails closed — no stream opens
                     // unchecked. Skipped under the test-preset escape hatch, whose
-                    // pre-baked context has no rows behind it to re-read.
-                    if (!c.get(TEST_CONTEXT_PRESET_KEY)) {
-                        const resolved = get_resolved_auth(c);
-                        const credential_is_live = resolved !== null && (await revalidate_resolved_auth(route, resolved));
-                        if (!credential_is_live) {
-                            log.info('audit stream: credential revoked during the request', ctx.account.id);
-                            return c.json({ error: ERROR_AUTHENTICATION_REQUIRED }, 401);
-                        }
-                        // Global grants only, like the `require_role` gate that ran in
-                        // the pipeline — a scoped grant must not open the instance-wide
-                        // stream.
-                        if (!has_scoped_role(await refresh_role_grants(ctx, route), required_role, null)) {
-                            log.info('audit stream: role revoked during the request', ctx.account.id);
-                            return c.json({ error: ERROR_INSUFFICIENT_PERMISSIONS, required_roles: [required_role] }, 403);
-                        }
+                    // pre-baked context has no rows behind it to re-read, and for a
+                    // registration born closed by the shutdown, which admission
+                    // refuses whatever they answer.
+                    if (!c.get(TEST_CONTEXT_PRESET_KEY) && !registry.closing) {
+                        const reread = async () => {
+                            const resolved = get_resolved_auth(c);
+                            const credential_is_live = resolved !== null && (await revalidate_resolved_auth(route, resolved));
+                            if (!credential_is_live) {
+                                log.info('audit stream: credential revoked during the request', ctx.account.id);
+                                return c.json({ error: ERROR_AUTHENTICATION_REQUIRED }, 401);
+                            }
+                            // Global grants only, like the `require_role` gate that ran in
+                            // the pipeline — a scoped grant must not open the instance-wide
+                            // stream.
+                            if (!has_scoped_role(await refresh_role_grants(ctx, route), required_role, null)) {
+                                log.info('audit stream: role revoked during the request', ctx.account.id);
+                                return c.json({ error: ERROR_INSUFFICIENT_PERMISSIONS, required_roles: [required_role] }, 403);
+                            }
+                            return null;
+                        };
+                        const refusal = await reread().catch((error) => {
+                            // the shutdown closed the registration and then the database
+                            // under the re-read: the answer is the shutdown's — admission
+                            // below refuses, since a closing registry admits nothing —
+                            // not a failure
+                            if (registry.closing)
+                                return null;
+                            throw error;
+                        });
+                        if (refusal)
+                            return refusal;
                     }
                     // Admit — the cap's eviction happens here, after every gate. A
-                    // registration a revocation closed while it was pending is not
-                    // admitted: the stream is closed at once, so the body is the
+                    // registration a revocation or the shutdown closed while it was
+                    // pending, or one born closed, is not admitted: the stream is
+                    // closed at once, so the body is the
                     // connect comment and nothing else, and the client reconnects
-                    // into the gates.
+                    // into the gates. The close listener goes on first: a client that
+                    // left during the re-reads gets a stream that is already closed,
+                    // whose listener runs at once and removes the registration, so
+                    // `admit` refuses it rather than evicting a live stream for it.
                     const { response, stream } = create_sse_response(c, log);
+                    stream.on_close(pending.unsubscribe);
                     admitted = registry.admit(pending, stream);
-                    if (admitted) {
-                        stream.on_close(pending.unsubscribe);
-                    }
-                    else {
-                        log.info('audit stream: closed by a revocation before admission', ctx.account.id);
+                    if (!admitted) {
+                        log.info('audit stream: closed before admission', ctx.account.id);
                         stream.close();
                     }
                     return response;

package/dist/http/CLAUDE.md

@@ -383,7 +383,7 @@ own by casting `as JsonrpcErrorCode`):
 - `rate_limited` (-32006, HTTP 429) — server-side policy.
 - `service_unavailable` (-32007, HTTP 503) — upstream down / maintenance.
 - `timeout` (-32008, HTTP 504) — handler exceeded time budget.
-- `queue_overflow` (-32009, HTTP 429) — **client-side** backpressure (WS reconnect queue full).
+- `queue_overflow` (-32009, HTTP 429) — backpressure: a buffer refused a new request because it was full — client-side (the WS reconnect queue) or server-side (a socket past `MAX_INBOUND_DISPATCHES_PER_CONNECTION` in-flight requests).
 - `request_cancelled` (-32010, HTTP 499) — caller-initiated cancellation (nginx "client closed").
 
 **`invalid_params` vs `validation_error`** — use `invalid_params` (standard

package/dist/http/jsonrpc_errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jsonrpc_errors.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/jsonrpc_errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAEnE,OAAO,EAMN,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,MAAM,cAAc,CAAC;AAEtB,0CAA0C;AAC1C,eAAO,MAAM,qBAAqB,kBAAkB,CAAC;AAErD,sEAAsE;AACtE,MAAM,MAAM,gBAAgB,GACzB,aAAa,GACb,iBAAiB,GACjB,kBAAkB,GAClB,gBAAgB,GAChB,gBAAgB,GAChB,iBAAiB,GACjB,WAAW,GACX,WAAW,GACX,UAAU,GACV,kBAAkB,GAClB,cAAc,GACd,qBAAqB,GACrB,SAAS,GACT,gBAAgB,GAChB,mBAAmB,CAAC;AAEvB;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,EA0C1B,QAAQ,CAAC,MAAM,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,QAAQ,GAAI,CAAC,EAAE,OAAO,CAAC,KAAG,CAAC,GAAG,SAAsC,CAAC;AAElF;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,EAmG7B,QAAQ,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,kBAAkB,CAAC,CAAC,CAAC;AAEtF;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC5C,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,CAAC,EAAE,OAAO,CAAC;gBAEH,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,YAAY;CAK3F;AAWD;;;;GAIG;AACH,eAAO,MAAM,cAAc;8CAXQ,kBAAkB;kDAAlB,kBAAkB;mDAAlB,kBAAkB;iDAAlB,kBAAkB;iDAAlB,kBAAkB;kDAAlB,kBAAkB;4CAAlB,kBAAkB;4CAAlB,kBAAkB;2CAAlB,kBAAkB;mDAAlB,kBAAkB;+CAAlB,kBAAkB;sDAAlB,kBAAkB;0CAAlB,kBAAkB;iDAAlB,kBAAkB;oDAAlB,kBAAkB;CA2BqC,CAAC;AAI3F;;;;;;;GAOG;AACH,eAAO,MAAM,iCAAiC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAkBpE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAMzC,CAAC;AAEvC;;;;;;;;;GASG;AACH,eAAO,MAAM,iCAAiC,GAAI,MAAM,gBAAgB,KAAG,oBACQ,CAAC;AAEpF;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,GAAI,QAAQ,MAAM,KAAG,gBACa,CAAC;AAEjF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAMjF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,GAAI,MAAM,gBAAgB,KAAG,gBACL,CAAC"}
+{"version":3,"file":"jsonrpc_errors.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/jsonrpc_errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAEnE,OAAO,EAMN,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,MAAM,cAAc,CAAC;AAEtB,0CAA0C;AAC1C,eAAO,MAAM,qBAAqB,kBAAkB,CAAC;AAErD,sEAAsE;AACtE,MAAM,MAAM,gBAAgB,GACzB,aAAa,GACb,iBAAiB,GACjB,kBAAkB,GAClB,gBAAgB,GAChB,gBAAgB,GAChB,iBAAiB,GACjB,WAAW,GACX,WAAW,GACX,UAAU,GACV,kBAAkB,GAClB,cAAc,GACd,qBAAqB,GACrB,SAAS,GACT,gBAAgB,GAChB,mBAAmB,CAAC;AAEvB;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,EA4C1B,QAAQ,CAAC,MAAM,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,QAAQ,GAAI,CAAC,EAAE,OAAO,CAAC,KAAG,CAAC,GAAG,SAAsC,CAAC;AAElF;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,EAmG7B,QAAQ,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,kBAAkB,CAAC,CAAC,CAAC;AAEtF;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC5C,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,CAAC,EAAE,OAAO,CAAC;gBAEH,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,YAAY;CAK3F;AAWD;;;;GAIG;AACH,eAAO,MAAM,cAAc;8CAXQ,kBAAkB;kDAAlB,kBAAkB;mDAAlB,kBAAkB;iDAAlB,kBAAkB;iDAAlB,kBAAkB;kDAAlB,kBAAkB;4CAAlB,kBAAkB;4CAAlB,kBAAkB;2CAAlB,kBAAkB;mDAAlB,kBAAkB;+CAAlB,kBAAkB;sDAAlB,kBAAkB;0CAAlB,kBAAkB;iDAAlB,kBAAkB;oDAAlB,kBAAkB;CA2BqC,CAAC;AAI3F;;;;;;;GAOG;AACH,eAAO,MAAM,iCAAiC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAkBpE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAMzC,CAAC;AAEvC;;;;;;;;;GASG;AACH,eAAO,MAAM,iCAAiC,GAAI,MAAM,gBAAgB,KAAG,oBACQ,CAAC;AAEpF;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,GAAI,QAAQ,MAAM,KAAG,gBACa,CAAC;AAEjF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAMjF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,GAAI,MAAM,gBAAgB,KAAG,gBACL,CAAC"}

package/dist/http/jsonrpc_errors.js

@@ -61,9 +61,11 @@ export const JSONRPC_ERROR_CODES = Object.freeze({
     service_unavailable: -32007,
     timeout: -32008,
     /**
-     * Client-side backpressure — an outbound buffer (e.g. `FrontendWebsocketClient`'s
-     * disconnected request queue) refused a new request because it was full.
-     * Distinct from `rate_limited`, which signals a server-side policy.
+     * Backpressure — a buffer refused a new request because it was full: on the
+     * client an outbound buffer (e.g. `FrontendWebsocketClient`'s disconnected
+     * request queue), on the server a WebSocket already running
+     * `MAX_INBOUND_DISPATCHES_PER_CONNECTION` requests. Distinct from
+     * `rate_limited`, which signals a server-side policy over time.
      */
     queue_overflow: -32009,
     /**
@@ -242,8 +244,8 @@ export const JSONRPC_ERROR_CODE_TO_HTTP_STATUS = {
     [-32004]: 409, // conflict
     [-32005]: 422, // validation_error
     // queue_overflow shares 429 with rate_limited — listed first so reverse
-    // map wins with rate_limited (server-side) rather than client-side overflow.
-    [-32009]: 429, // queue_overflow (client-side backpressure)
+    // map wins with rate_limited (a policy) rather than a full buffer.
+    [-32009]: 429, // queue_overflow (backpressure)
     [-32006]: 429, // rate_limited
     [-32007]: 503, // service_unavailable
     [-32008]: 504, // timeout

package/dist/realtime/sse.d.ts

@@ -21,7 +21,12 @@ export interface SseStream<T = unknown> {
     comment: (text: string) => void;
     /** Close the stream. */
     close: () => void;
-    /** Register a listener called when the stream closes (client disconnect or explicit close). */
+    /**
+     * Register a listener called when the stream closes (client disconnect or
+     * explicit close). Called at once when the stream has already closed — a
+     * client can leave before the caller registers — so a cleanup registered
+     * through it always runs.
+     */
     on_close: (fn: () => void) => void;
 }
 /**
@@ -43,6 +48,14 @@ export interface SseNotification {
  * The callback suspends via a promise that resolves on client disconnect
  * or explicit `close()`, keeping the stream alive for external sends.
  *
+ * The stream closes when its client disconnects, whenever that happens — also
+ * before the handler returns the response, which no runtime reports by
+ * cancelling the body. A client already gone when this is called yields a
+ * stream that is already closed, so register cleanup with `on_close` (which
+ * runs a late listener at once) before handing the stream anywhere that would
+ * count it — `SubscriberRegistry.admit` after `on_close(pending.unsubscribe)`
+ * refuses it.
+ *
  * Uses `hono_stream.write()` directly (not `writeSSE`) to avoid
  * Hono's HTML callback resolution — keeps the same `data: JSON\n\n` format.
  *

package/dist/realtime/sse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sse.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/realtime/sse.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAItD;;;;GAIG;AACH,MAAM,WAAW,SAAS,CAAC,CAAC,GAAG,OAAO;IACrC,mDAAmD;IACnD,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC;IACxB,6CAA6C;IAC7C,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,wBAAwB;IACxB,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,+FAA+F;IAC/F,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;CACnC;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC/B,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,MAAM,EAAE,OAAO,CAAC;CAChB;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,mBAAmB,GAAI,CAAC,GAAG,OAAO,EAC9C,GAAG,OAAO,EACV,KAAK,MAAM,KACT;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAA;CAiD5C,CAAC;AAEF,gFAAgF;AAChF,MAAM,WAAW,SAAS;IACzB,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC;IAClB,8DAA8D;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GAAI,CAAC,SAAS,eAAe,EACrE,aAAa;IAAE,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,IAAI,CAAA;CAAE,EAC9D,aAAa,KAAK,CAAC,SAAS,CAAC,EAC7B,KAAK,MAAM,KACT;IAAE,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,IAAI,CAAA;CAmBjD,CAAC"}
+{"version":3,"file":"sse.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/realtime/sse.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAItD;;;;GAIG;AACH,MAAM,WAAW,SAAS,CAAC,CAAC,GAAG,OAAO;IACrC,mDAAmD;IACnD,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC;IACxB,6CAA6C;IAC7C,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,wBAAwB;IACxB,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;CACnC;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC/B,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,MAAM,EAAE,OAAO,CAAC;CAChB;AA8DD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,mBAAmB,GAAI,CAAC,GAAG,OAAO,EAC9C,GAAG,OAAO,EACV,KAAK,MAAM,KACT;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAA;CA4D5C,CAAC;AAEF,gFAAgF;AAChF,MAAM,WAAW,SAAS;IACzB,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC;IAClB,8DAA8D;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GAAI,CAAC,SAAS,eAAe,EACrE,aAAa;IAAE,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,IAAI,CAAA;CAAE,EAC9D,aAAa,KAAK,CAAC,SAAS,CAAC,EAC7B,KAAK,MAAM,KACT;IAAE,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,IAAI,CAAA;CAmBjD,CAAC"}

package/dist/realtime/sse.js

@@ -10,6 +10,62 @@ import { streamSSE } from 'hono/streaming';
 import { z } from 'zod';
 import { DEV } from 'esm-env';
 import { SSE_CONNECTED_COMMENT } from './sse_constants.js';
+const is_node_connection_stream = (value) => {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const candidate = value;
+    return typeof candidate.destroyed === 'boolean' && typeof candidate.once === 'function';
+};
+/**
+ * The Node stream that ends with the client's connection, from the
+ * `c.env.outgoing` that `@hono/node-server` passes a handler: over HTTP/1 the
+ * `ServerResponse` itself, over HTTP/2 the `Http2ServerResponse`'s `stream` —
+ * the response is no stream there and has no `destroyed`.
+ */
+const to_node_connection_stream = (env) => {
+    if (typeof env !== 'object' || env === null)
+        return null;
+    const outgoing = env.outgoing;
+    if (typeof outgoing !== 'object' || outgoing === null)
+        return null;
+    if (is_node_connection_stream(outgoing))
+        return outgoing;
+    const { stream } = outgoing;
+    return is_node_connection_stream(stream) ? stream : null;
+};
+/**
+ * Call `on_gone` once the client of `c` has disconnected — at once if it
+ * already has.
+ *
+ * A stream closes on its own only when the runtime cancels the response body,
+ * and a runtime cancels only a body it has started to send. A client that
+ * leaves before the handler returns — one awaiting a credential re-read, say —
+ * is never sent the body, so nothing would close the stream.
+ *
+ * On `@hono/node-server` the request's `signal` cannot be trusted for this:
+ * the adapter creates it on first read and aborts it only if it existed when
+ * the connection closed, so a handler that reads it after an `await` can hold
+ * a signal that never fires. The Node stream behind the response says whether
+ * the connection is gone and emits `close` when it goes, so that is what is
+ * watched there — the response object (`c.env.outgoing`) over HTTP/1, its
+ * `Http2Stream` over HTTP/2. Elsewhere the request's `signal` is the
+ * disconnect — the Fetch-standard runtimes abort it when the client leaves.
+ */
+const watch_client_disconnect = (c, on_gone) => {
+    const connection = to_node_connection_stream(c.env);
+    if (connection) {
+        if (connection.destroyed)
+            on_gone();
+        else
+            connection.once('close', on_gone);
+        return;
+    }
+    const { signal } = c.req.raw;
+    if (signal.aborted)
+        on_gone();
+    else
+        signal.addEventListener('abort', on_gone, { once: true });
+};
 /**
  * Create an SSE response for a Hono context.
  *
@@ -18,6 +74,14 @@ import { SSE_CONNECTED_COMMENT } from './sse_constants.js';
  * The callback suspends via a promise that resolves on client disconnect
  * or explicit `close()`, keeping the stream alive for external sends.
  *
+ * The stream closes when its client disconnects, whenever that happens — also
+ * before the handler returns the response, which no runtime reports by
+ * cancelling the body. A client already gone when this is called yields a
+ * stream that is already closed, so register cleanup with `on_close` (which
+ * runs a late listener at once) before handing the stream anywhere that would
+ * count it — `SubscriberRegistry.admit` after `on_close(pending.unsubscribe)`
+ * refuses it.
+ *
  * Uses `hono_stream.write()` directly (not `writeSSE`) to avoid
  * Hono's HTML callback resolution — keeps the same `data: JSON\n\n` format.
  *
@@ -64,7 +128,16 @@ export const create_sse_response = (c, log) => {
             },
             close: do_close,
             on_close(fn) {
-                close_listeners.push(fn);
+                if (!resolved) {
+                    close_listeners.push(fn);
+                    return;
+                }
+                try {
+                    fn();
+                }
+                catch (e) {
+                    log.error('on_close listener threw:', e);
+                }
             }
         };
         hono_stream.onAbort(do_close);
@@ -73,6 +146,9 @@ export const create_sse_response = (c, log) => {
         void hono_stream.write(SSE_CONNECTED_COMMENT);
         await promise;
     });
+    // after the callback above has built `sse_stream`, which runs synchronously
+    // up to its first `await`
+    watch_client_disconnect(c, do_close);
     return { response, stream: sse_stream };
 };
 /**

package/dist/realtime/sse_auth_guard.js

@@ -205,7 +205,7 @@ export const AUDIT_LOG_SSE_MAX_PER_SCOPE = 10;
 export const create_audit_log_sse = (options) => {
     const role = options.role ?? 'admin';
     const max_per_scope = options.max_per_scope === undefined ? AUDIT_LOG_SSE_MAX_PER_SCOPE : options.max_per_scope;
-    const registry = new SubscriberRegistry({ max_per_scope });
+    const registry = new SubscriberRegistry({ max_per_scope, log: options.log });
     const guard = create_sse_auth_guard(registry, role, options.log);
     options.connection_closer?.add(create_sse_connection_closer(registry));
     return {

package/dist/realtime/subscriber_registry.d.ts

@@ -22,6 +22,7 @@
  *
  * @module
  */
+import { Logger } from '@fuzdev/fuz_util/log.ts';
 import type { SseStream } from './sse.js';
 /** One admitted subscriber, as `SubscriberRegistry.broadcast` sees it. */
 export interface Subscriber<T> {
@@ -42,6 +43,13 @@ export interface SubscriberRegistryOptions {
      * `null` (default) disables the cap. `groups` identities are never capped.
      */
     max_per_scope?: number | null;
+    /**
+     * Logger for a stream whose `close` throws while the cap evicts it — the
+     * evicted stream is another subscriber's, so its failure is logged rather
+     * than failing the admission that evicted it. Unset falls back to an
+     * `[sse]` logger; `null` silences it.
+     */
+    log?: Logger | null;
 }
 /** Options for `SubscriberRegistry.subscribe` and `subscribe_pending`. */
 export interface SubscribeOptions {
@@ -105,6 +113,16 @@ export interface PendingSubscription {
  * behind it. The twin of the Rust `fuz_realtime` `SseRegistry`
  * (`subscribe_pending` / `admit` / `subscribe`).
  *
+ * ## Shutdown
+ *
+ * `close_all` — the close `AppServer.close` runs — closes every stream,
+ * pending or admitted, and leaves the registry **closing** for good: every
+ * later registration is born closed. `subscribe_pending` registers nothing,
+ * so `admit` refuses the handle and the route's stream ends after its connect
+ * comment; `subscribe` closes the stream it is given at once. A stream still
+ * opening when the server shuts down therefore ends rather than outliving it.
+ * The flag is set in the same synchronous step that closes the live streams.
+ *
  * @example
  * ```ts
  * const registry = new SubscriberRegistry<SseNotification>();
@@ -144,8 +162,10 @@ export interface PendingSubscription {
  *   return unauthorized();
  * }
  * const {response, stream} = create_sse_response(c, log);
- * if (registry.admit(pending, stream)) stream.on_close(pending.unsubscribe);
- * else stream.close(); // closed while pending — the body is the connect comment alone
+ * // first: a client that already left closes the stream, its listener runs at
+ * // once, and `admit` then refuses the removed registration
+ * stream.on_close(pending.unsubscribe);
+ * if (!registry.admit(pending, stream)) stream.close(); // the body is the connect comment alone
  * return response;
  * ```
  */
@@ -162,6 +182,13 @@ export declare class SubscriberRegistry<T> {
      * and `admit` (or their refusal). For telemetry and tests.
      */
     get pending_count(): number;
+    /**
+     * Whether `close_all` has run — the registry is shutting down and every
+     * registration from now on is born closed (class doc, "Shutdown"). The
+     * audit stream route reads it to skip the re-reads for a registration
+     * admission will refuse anyway.
+     */
+    get closing(): boolean;
     /**
      * Add a subscriber, admitted at once — the one-step form of
      * `subscribe_pending` + `admit`.
@@ -171,6 +198,10 @@ export declare class SubscriberRegistry<T> {
      * nothing, and the stream would open on a dead credential (class doc,
      * "Two-phase registration").
      *
+     * Once the registry is closing, the subscriber is born closed: `stream` is
+     * closed at once, nothing is registered, and the returned function is a
+     * no-op.
+     *
      * @param stream - SSE stream to send data to
      * @param options - channel filter and identity slots (`scope` + `groups`)
      * @returns unsubscribe function
@@ -186,18 +217,21 @@ export declare class SubscriberRegistry<T> {
      * broadcast, is not counted, and evicts nothing. A caller that then refuses
      * the request calls the returned handle's `unsubscribe`.
      *
+     * Once the registry is closing, the registration is born closed: nothing
+     * is registered, and `admit` refuses the handle.
+     *
      * @param options - channel filter and identity slots (`scope` + `groups`)
      * @returns the pending handle `admit` takes
-     * @mutates registry - adds the un-admitted registration
+     * @mutates registry - adds the un-admitted registration, unless the registry is closing
      */
     subscribe_pending(options?: SubscribeOptions): PendingSubscription;
     /**
      * Admit a pending subscription, attaching the stream it delivers to — phase
      * two (class doc).
      *
-     * If the registration is gone — a revocation closed it while it was
-     * pending, or it was unsubscribed — nothing is evicted and the subscription
-     * is refused. Otherwise the per-scope cap is enforced as in `subscribe`,
+     * If the registration is gone — a revocation or the shutdown closed it
+     * while it was pending, it was born closed, or it was unsubscribed —
+     * nothing is evicted and the subscription is refused. Otherwise the per-scope cap is enforced as in `subscribe`,
      * counting only admitted subscribers, and the stream starts receiving
      * `broadcast` data. Admitting twice is refused the second time.
      *
@@ -238,13 +272,15 @@ export declare class SubscriberRegistry<T> {
     close_by_identity(identity: string): number;
     /**
      * Force-close every subscriber, pending or admitted — the shutdown close
-     * `AppServer.close` runs through the registry's `ConnectionCloser`.
+     * `AppServer.close` runs through the registry's `ConnectionCloser` — and
+     * leave the registry closing, for good: every later registration is born
+     * closed (class doc, "Shutdown"). A second call closes nothing.
      *
      * A stream whose `close` throws does not stop the loop: every subscriber is
      * removed and closed, and the first error is thrown afterward.
      *
      * @returns the number of subscribers closed
-     * @mutates registry - removes every subscriber and closes its stream
+     * @mutates registry - sets the registry closing, removes every subscriber, and closes its stream
      * @throws the first error a stream's `close` threw, after every subscriber was attempted
      */
     close_all(): number;

package/dist/realtime/subscriber_registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subscriber_registry.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/realtime/subscriber_registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE1C,0EAA0E;AAC1E,MAAM,WAAW,UAAU,CAAC,CAAC;IAC5B,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IACrB,sEAAsE;IACtE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAC7B,mDAAmD;IACnD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,qEAAqE;IACrE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;CAC3B;AASD,wCAAwC;AACxC,MAAM,WAAW,yBAAyB;IACzC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAChC,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACjC;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC/B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;OAIG;IACH,WAAW,EAAE,MAAM,IAAI,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyEG;AACH,qBAAa,kBAAkB,CAAC,CAAC;;gBAQpB,OAAO,CAAC,EAAE,yBAAyB;IAI/C;;;OAGG;IACH,IAAI,KAAK,IAAI,MAAM,CAMlB;IAED;;;OAGG;IACH,IAAI,aAAa,IAAI,MAAM,CAM1B;IAED;;;;;;;;;;;;;OAaG;IACH,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,MAAM,IAAI;IASvE;;;;;;;;;;;;OAYG;IACH,iBAAiB,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,mBAAmB;IAYlE;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO;IASlE;;;;;;;OAOG;IACH,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI;IASzC;;;;;;;;;;;;;;;;;;OAkBG;IACH,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAM3C;;;;;;;;;;OAUG;IACH,SAAS,IAAI,MAAM;CA0EnB"}
+{"version":3,"file":"subscriber_registry.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/realtime/subscriber_registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE1C,0EAA0E;AAC1E,MAAM,WAAW,UAAU,CAAC,CAAC;IAC5B,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IACrB,sEAAsE;IACtE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAC7B,mDAAmD;IACnD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,qEAAqE;IACrE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;CAC3B;AASD,wCAAwC;AACxC,MAAM,WAAW,yBAAyB;IACzC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB;AAED,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAChC,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACjC;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC/B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;OAIG;IACH,WAAW,EAAE,MAAM,IAAI,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AACH,qBAAa,kBAAkB,CAAC,CAAC;;gBAYpB,OAAO,CAAC,EAAE,yBAAyB;IAK/C;;;OAGG;IACH,IAAI,KAAK,IAAI,MAAM,CAMlB;IAED;;;OAGG;IACH,IAAI,aAAa,IAAI,MAAM,CAM1B;IAED;;;;;OAKG;IACH,IAAI,OAAO,IAAI,OAAO,CAErB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,MAAM,IAAI;IAavE;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,mBAAmB;IAYlE;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO;IASlE;;;;;;;OAOG;IACH,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI;IASzC;;;;;;;;;;;;;;;;;;OAkBG;IACH,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAM3C;;;;;;;;;;;;OAYG;IACH,SAAS,IAAI,MAAM;CAsFnB"}

package/dist/realtime/subscriber_registry.js

@@ -22,6 +22,7 @@
  *
  * @module
  */
+import { Logger } from '@fuzdev/fuz_util/log.ts';
 /**
  * Generic subscriber registry with channel-based filtering and identity-keyed disconnection.
  *
@@ -52,6 +53,16 @@
  * behind it. The twin of the Rust `fuz_realtime` `SseRegistry`
  * (`subscribe_pending` / `admit` / `subscribe`).
  *
+ * ## Shutdown
+ *
+ * `close_all` — the close `AppServer.close` runs — closes every stream,
+ * pending or admitted, and leaves the registry **closing** for good: every
+ * later registration is born closed. `subscribe_pending` registers nothing,
+ * so `admit` refuses the handle and the route's stream ends after its connect
+ * comment; `subscribe` closes the stream it is given at once. A stream still
+ * opening when the server shuts down therefore ends rather than outliving it.
+ * The flag is set in the same synchronous step that closes the live streams.
+ *
  * @example
  * ```ts
  * const registry = new SubscriberRegistry<SseNotification>();
@@ -91,8 +102,10 @@
  *   return unauthorized();
  * }
  * const {response, stream} = create_sse_response(c, log);
- * if (registry.admit(pending, stream)) stream.on_close(pending.unsubscribe);
- * else stream.close(); // closed while pending — the body is the connect comment alone
+ * // first: a client that already left closes the stream, its listener runs at
+ * // once, and `admit` then refuses the removed registration
+ * stream.on_close(pending.unsubscribe);
+ * if (!registry.admit(pending, stream)) stream.close(); // the body is the connect comment alone
  * return response;
  * ```
  */
@@ -103,8 +116,13 @@ export class SubscriberRegistry {
     // another registry names nothing here
     #pending = new WeakMap();
     #max_per_scope;
+    #log;
+    // set once by `close_all`, never cleared — every later registration is born
+    // closed (class doc, "Shutdown")
+    #closing = false;
     constructor(options) {
         this.#max_per_scope = options?.max_per_scope ?? null;
+        this.#log = options?.log === undefined ? new Logger('[sse]') : options.log;
     }
     /**
      * Number of open — **admitted** — subscribers. A registration still pending
@@ -130,6 +148,15 @@ export class SubscriberRegistry {
         }
         return count;
     }
+    /**
+     * Whether `close_all` has run — the registry is shutting down and every
+     * registration from now on is born closed (class doc, "Shutdown"). The
+     * audit stream route reads it to skip the re-reads for a registration
+     * admission will refuse anyway.
+     */
+    get closing() {
+        return this.#closing;
+    }
     /**
      * Add a subscriber, admitted at once — the one-step form of
      * `subscribe_pending` + `admit`.
@@ -139,12 +166,20 @@ export class SubscriberRegistry {
      * nothing, and the stream would open on a dead credential (class doc,
      * "Two-phase registration").
      *
+     * Once the registry is closing, the subscriber is born closed: `stream` is
+     * closed at once, nothing is registered, and the returned function is a
+     * no-op.
+     *
      * @param stream - SSE stream to send data to
      * @param options - channel filter and identity slots (`scope` + `groups`)
      * @returns unsubscribe function
      * @mutates registry - adds the new subscriber; closes oldest matching subscribers when `max_per_scope` is exceeded
      */
     subscribe(stream, options) {
+        if (this.#closing) {
+            stream.close();
+            return () => { };
+        }
         const subscriber = this.#create_entry(options);
         this.#admit_entry(subscriber, stream);
         this.#subscribers.add(subscriber);
@@ -161,13 +196,17 @@ export class SubscriberRegistry {
      * broadcast, is not counted, and evicts nothing. A caller that then refuses
      * the request calls the returned handle's `unsubscribe`.
      *
+     * Once the registry is closing, the registration is born closed: nothing
+     * is registered, and `admit` refuses the handle.
+     *
      * @param options - channel filter and identity slots (`scope` + `groups`)
      * @returns the pending handle `admit` takes
-     * @mutates registry - adds the un-admitted registration
+     * @mutates registry - adds the un-admitted registration, unless the registry is closing
      */
     subscribe_pending(options) {
         const subscriber = this.#create_entry(options);
-        this.#subscribers.add(subscriber);
+        if (!this.#closing)
+            this.#subscribers.add(subscriber);
         const pending = {
             unsubscribe: () => {
                 this.#subscribers.delete(subscriber);
@@ -180,9 +219,9 @@ export class SubscriberRegistry {
      * Admit a pending subscription, attaching the stream it delivers to — phase
      * two (class doc).
      *
-     * If the registration is gone — a revocation closed it while it was
-     * pending, or it was unsubscribed — nothing is evicted and the subscription
-     * is refused. Otherwise the per-scope cap is enforced as in `subscribe`,
+     * If the registration is gone — a revocation or the shutdown closed it
+     * while it was pending, it was born closed, or it was unsubscribed —
+     * nothing is evicted and the subscription is refused. Otherwise the per-scope cap is enforced as in `subscribe`,
      * counting only admitted subscribers, and the stream starts receiving
      * `broadcast` data. Admitting twice is refused the second time.
      *
@@ -240,16 +279,20 @@ export class SubscriberRegistry {
     }
     /**
      * Force-close every subscriber, pending or admitted — the shutdown close
-     * `AppServer.close` runs through the registry's `ConnectionCloser`.
+     * `AppServer.close` runs through the registry's `ConnectionCloser` — and
+     * leave the registry closing, for good: every later registration is born
+     * closed (class doc, "Shutdown"). A second call closes nothing.
      *
      * A stream whose `close` throws does not stop the loop: every subscriber is
      * removed and closed, and the first error is thrown afterward.
      *
      * @returns the number of subscribers closed
-     * @mutates registry - removes every subscriber and closes its stream
+     * @mutates registry - sets the registry closing, removes every subscriber, and closes its stream
      * @throws the first error a stream's `close` threw, after every subscriber was attempted
      */
     close_all() {
+        // before any close, so a registration a close listener triggers is born closed too
+        this.#closing = true;
         return this.#close_where(() => true);
     }
     #close_where(predicate) {
@@ -304,6 +347,11 @@ export class SubscriberRegistry {
      * Close `scope`'s oldest **admitted** subscribers until one more fits under
      * `max`. Pending registrations are neither counted nor closed — a
      * subscription that may yet be refused must not cost a live one its slot.
+     *
+     * Every victim is removed, then closed in its own `try`: a stream whose
+     * `close` throws is still unregistered, the rest are still closed, and the
+     * error is logged — it belongs to another subscriber, so it must not fail
+     * the admission that evicted it.
      */
     #enforce_scope_limit(scope, max) {
         // admitted subscribers with this scope, in registration order (the
@@ -318,8 +366,14 @@ export class SubscriberRegistry {
         const overflow = matching.length - (max - 1);
         for (let i = 0; i < overflow; i++) {
             const [victim, stream] = matching[i];
-            stream.close();
+            // removed first, so a stream whose close throws is unregistered too
             this.#subscribers.delete(victim);
+            try {
+                stream.close();
+            }
+            catch (error) {
+                this.#log?.error('error closing a stream evicted by the cap:', error);
+            }
         }
     }
 }

package/dist/server/app_server.d.ts

@@ -433,7 +433,10 @@ export interface AppServer {
      *    audit stream — including transports supplied through
      *    `WsEndpointSpec.transport` or added by hand, since they are registered
      *    on the backend's closer and the backend is going away; a close that
-     *    throws is logged and the shutdown goes on
+     *    throws is logged and the shutdown goes on. Each transport and registry
+     *    is left closing, so an upgrade or stream that registers afterward is
+     *    born closed — refused at once rather than outliving the server — and
+     *    a closed transport hosts no other server
      * 3. release what assembly acquired, last acquired first: remove the
      *    audit listeners `create_app_server` registered on `deps.audit` (the
      *    audit-log SSE listener, the WS auth guards, each