@onlineapps/mq-client-core 2.0.1 → 3.0.0

package/src/transports/rabbitmqClient.js

@@ -2,8 +2,8 @@
 
 /**
  * RabbitMQClient: transport implementation for RabbitMQ using amqplib.
- * Simplified version for infrastructure services - no queueConfig dependency.
  * Implements connect, disconnect, publish, consume, ack, nack, and error propagation.
+ * Queue arguments come from the central `../config/queueConfig` — see the require below.
  */
 
 const amqp = require('amqplib');
@@ -14,12 +14,66 @@ const {
   QueueNotFoundError,
   classifyPublishError,
   missingInfrastructureQueueMessage,
+  missingQueueDefinitionMessage,
 } = require('../utils/publishErrors');
-const { createLogger } = require('@onlineapps/infra-logger');
+const {
+  ConnectionError,
+  PublishError,
+  ConsumeError,
+  ValidationError,
+  CONNECTION_CLOSED_UNEXPECTEDLY,
+  connectionClosedUnexpectedly,
+  CONSUMER_QUEUE_MISSING,
+  CONSUMER_DEAD_LETTER_ROUTE_MISSING
+} = require('../utils/errorHandler');
+const { assertLogger } = require('@onlineapps/logger-contract');
 const PublishLayer = require('../layers/PublishLayer');
 const RecoveryWorker = require('../workers/RecoveryWorker');
 const PublishMonitor = require('../monitoring/PublishMonitor');
 const runtimeCfg = require('../config');
+const defaultConfig = require('../config/defaultConfig');
+const composeConfig = require('../config/composeConfig');
+const { redactConnectionTarget } = require('../utils/redactCredentials');
+// Central queue classification and arguments. A sibling module of this file: it loads
+// with the package or the package does not run, so there is nothing to guard against
+// and nothing to stand in for it. It used to be required lazily inside three methods,
+// one of them under a `catch` that carried on with "default queue options" — the exact
+// 406 PRECONDITION-FAILED this config exists to prevent (`architecture-principles.md` §3).
+const queueConfig = require('../config/queueConfig');
+// The dead-letter policy of consume(): attempt counting, classification and the
+// header that carries the count. A sibling module of this file, loaded with the
+// package. @see ../config/deliveryPolicy.js
+const deliveryPolicy = require('../config/deliveryPolicy');
+// "Did you mean this one" for a key nothing declares — one implementation, shared
+// with the config schema's own refusal. @see ../utils/nearestKey.js
+const { nameUnknownKeys } = require('../utils/nearestKey');
+
+/**
+ * How long a queue lives, said by the caller — the two keys `assertQueue()` gained
+ * in d.396c.
+ *
+ * `exclusive`: the broker deletes the queue when the connection that declared it
+ * goes away, and no other connection may use it in the meantime.
+ * `autoDelete`: the broker deletes it when its last consumer does.
+ *
+ * They are the ONLY rail on which a caller can say "this queue is temporary", and
+ * they are meaningful solely for a name the central `queueConfig` does not
+ * classify — an infrastructure or business queue outlives its declarer by design,
+ * so asking for either on one of those names is refused, not overruled in silence.
+ */
+const LIFETIME_QUEUE_OPTION_KEYS = Object.freeze(['exclusive', 'autoDelete']);
+
+/**
+ * Every option `assertQueue()` reads. A key outside this set is refused by name:
+ * an option nobody reads declares nothing, and the caller acts on a guarantee
+ * nobody gave (`architecture-principles.md` §4, §8). Same contract, and the same
+ * refusal shape, as the config schema's `additionalProperties: false` since d.291b.
+ */
+const ASSERT_QUEUE_OPTION_KEYS = Object.freeze([
+  'durable',
+  'arguments',
+  ...LIFETIME_QUEUE_OPTION_KEYS,
+]);
 
 /** AMQP basic.publish fields forwarded from publish() options (amqplib Options.Publish). */
 const AMQP_MESSAGE_PROPERTY_KEYS = [
@@ -36,6 +90,62 @@ const AMQP_MESSAGE_PROPERTY_KEYS = [
   'appId',
 ];
 
+/**
+ * The exchange types AMQP 0-9-1 defines. `assertExchange()` refuses anything
+ * else at the call site rather than letting the broker close the channel with a
+ * 503 the caller cannot read (`architecture-principles.md` §4, §5).
+ */
+const EXCHANGE_TYPES = ['direct', 'topic', 'fanout', 'headers'];
+
+/**
+ * The AMQP reply codes with which a broker REFUSES a connection or a channel —
+ * an answer, not a silence. `_isBrokerRefusal()` reads them; the note there
+ * carries the measurement and the reason the codes are matched in the message.
+ *
+ *   403 ACCESS-REFUSED      the account may not log in / may not use the resource
+ *   530 NOT-ALLOWED         the account may not use this vhost
+ *   406 PRECONDITION-FAILED the topology the broker holds is not the one asked for
+ */
+const REFUSAL_REPLY_CODES = [403, 530, 406];
+
+/**
+ * The workflow id an AMQP message carries, or `null` when it carries none.
+ *
+ * ONE spelling, and no substitute for an absent value — the two halves of the
+ * expression this replaced (`headers.workflowId || headers.workflow_id ||
+ * 'unknown'`, three copies of it, d.416):
+ *
+ *  - `workflow_id` is the only spelling the envelope contract admits, and a
+ *    reader that accepts the camelCase alias is forbidden as such, not merely a
+ *    producer that writes it (`docs/biz/70-contracts/workflow-message.md` §2.2,
+ *    owner decision `workflow-message-aliases` 001). The alias is still written
+ *    today by the gateway's webhook submit, whose removal is its owner's
+ *    (`docs/standards/JSON_NAMING_CONVENTION.md` § alias read, `infra/TODO.md`);
+ *    a reader that keeps honouring it is what makes the pair impossible to
+ *    retire, because nothing then shows which producers still write it.
+ *  - a missing id is reported as missing. `'unknown'` is a value, and a log line
+ *    carrying it claims a workflow by that name — the same reason
+ *    `BaseClient._emitDeadLetterEvent()` resolves an absent id to `null` and
+ *    reports the absence rather than inventing a marker
+ *    (`docs/governance/confirmations/dlq-purge.md` 002).
+ *
+ * This is a LOGGING read, and that is the whole of its job: the transport does
+ * not validate the envelope. A message whose envelope carries no `workflow_id`
+ * is refused where the envelope is read — the wrapper's `InvalidEnvelopeError`
+ * (d.383) — and a refusal here would be a second rail for one concern
+ * (`change-discipline.md` § One rail per concern).
+ *
+ * @param {Object|undefined} headers - AMQP headers as amqplib hands them over.
+ * @returns {string|null} the id, or `null` when the headers carry no non-empty one.
+ */
+function workflowIdOf(headers) {
+  if (!headers) {
+    return null;
+  }
+  const value = headers.workflow_id;
+  return typeof value === 'string' && value !== '' ? value : null;
+}
+
 /**
  * Merge persistent + headers with whitelisted AMQP message properties for sendToQueue/publish.
  * @param {Object} options
@@ -59,8 +169,8 @@ function buildAmqpMessageProperties(options, persistent, headers) {
 class RabbitMQClient extends EventEmitter {
   /**
    * @param {Object} config
-   * @param {string} config.host         - AMQP URI or hostname (e.g., 'amqp://127.0.0.1:5672')
-   * @param {string} [config.queue]      - Default queue name (optional; can be overridden per call)
+   * @param {string} config.host         - AMQP URL (e.g., 'amqp://127.0.0.1:5672'). The ONE
+   *   name and the ONE shape of the connection target; refused at construction otherwise.
    * @param {string} [config.exchange]   - Default exchange (default: '')
    * @param {boolean} [config.durable]   - Declare queues/exchanges as durable (default: true)
    * @param {number} [config.prefetch]   - Default prefetch count for consumers (default: 1)
@@ -68,17 +178,103 @@ class RabbitMQClient extends EventEmitter {
    */
   constructor(config) {
     super();
-    this._config = Object.assign(
-      {
-        exchange: '',
-        durable: true,
-        prefetch: 1,
-        noAck: false,
-      },
-      config
+    // The module defaults, then what the caller wrote — through the ONE owner of
+    // both the values (`../config/defaultConfig.js`) and the composition
+    // (`../config/composeConfig.js`). `BaseClient` composes the same two sources
+    // before it validates them, so a client built through it is composed of
+    // exactly this; the composition is repeated here because this class is
+    // exported (`../index.js`) and can be built on its own, and composing
+    // idempotently from the same owner is not a second rail — a literal of its
+    // own would be (`change-discipline.md`).
+    //
+    // Four of these keys used to be written out again right here (`exchange`,
+    // `durable`, `prefetch`, `noAck`), and twenty-two more lived below as
+    // `this._config.<key> || <literal>` — see the file header of defaultConfig.
+    this._config = composeConfig(defaultConfig, config);
+
+    // ONE channel: the logger the owner injected, validated here and used by
+    // this transport and by everything it builds (publish layer, recovery
+    // worker, publish monitor, buffers). Until 2026-09-07 this constructor
+    // built its own structured logger from the platform logger package,
+    // AND handed the global console to its three collaborators as their
+    // logger, AND wrote to that global directly 122 times — four channels
+    // for one concern, none of them the `config.logger` the service configures.
+    // Owner confirmation
+    // `docs/governance/confirmations/connector-logger-contract.md` 001–004.
+    this._logger = assertLogger(
+      'RabbitMQClient',
+      this._config.logger,
+      'the transport reports its connection lifecycle, channel recovery and every consumer it registers',
+      'pass config.logger (BaseClient forwards the one your service built)'
     );
 
+    // THE connection target: one name, one shape. amqplib also accepts an options
+    // object (`{ hostname, port, username, … }`) and this constructor's `connect()`
+    // branched on `typeof rawTarget === 'string'` until 2026-09-14 — a branch no
+    // input could reach. The schema declares `host` as a string (`config/configSchema.js`),
+    // the platform supplies it as one URL in `RABBITMQ_URL` (`../config.js`), and
+    // nothing in the workspace passes an object (measured 2026-09-14: zero `host: {`
+    // in `shared/`, `infra/`, `api_biz/`). The second target name, `url`, is refused
+    // by `BaseClient` for the same reason — the value under it was discarded in
+    // silence. What is left is checked HERE too, because this class is exported
+    // (`src/index.js`) and can be built without `BaseClient`'s validation in front
+    // of it (`architecture-principles.md` §4).
+    //
+    // The REJECTED VALUE IS NOT PRINTED, only its type: a connection target
+    // carries the broker password (URL userinfo, or the `password` key of the
+    // options object this refuses), and an exception message is logged like any
+    // other line. The first version of this check did print it, and the suite
+    // that watches this client's logs for credentials caught it
+    // (`tests/unit/connect-credentials-not-logged.test.js`).
+    if (typeof this._config.host !== 'string' || this._config.host.length === 0) {
+      const got = typeof this._config.host === 'string'
+        ? 'an empty string'
+        : `a value of type ${this._config.host === null ? 'null' : typeof this._config.host}`;
+      throw new Error(
+        `[RabbitMQClient] Invalid config value for "host" - Expected a non-empty AMQP URL string, got ${got}. `
+          + 'Fix: pass config.host (BaseClient resolves it from the explicit value, else from RABBITMQ_URL); '
+          + 'an options object and the name "url" are not accepted.'
+      );
+    }
+
+    // ONE declaration of the heartbeat. amqplib 0.10 reads it from the URL QUERY
+    // and from nowhere else (`lib/connect.js`: `intOrDefault(query.heartbeat, 0)`),
+    // so this class composes it into the target below — and a target that already
+    // carries one is REFUSED rather than overwritten: two declarations of one
+    // fact is the thing this library refuses everywhere else
+    // (`architecture-principles.md` §3, §8). The value is not printed; the target
+    // carries the broker password.
+    if (/[?&]heartbeat=/.test(this._config.host)) {
+      throw new Error(
+        '[RabbitMQClient] The connection target declares a heartbeat - Expected: the heartbeat to come '
+          + 'from configuration (explicit value, else RABBITMQ_HEARTBEAT, else the module default), '
+          + 'which this client composes into the connection URL. '
+          + 'Fix: remove "heartbeat" from the query string of the AMQP URL and set config.heartbeat '
+          + '(or RABBITMQ_HEARTBEAT) instead.'
+      );
+    }
+
+    // Resolved through the SAME three-leg rail as the delivery budget — explicit
+    // → RABBITMQ_HEARTBEAT → `../defaults.js heartbeatSeconds` — so the number
+    // has one owner and no literal stands in for it. Until d.299 the two connect
+    // paths each wrote `this._config.heartbeat ?? 30`, a copy of that default,
+    // and then handed the result to amqplib in `socketOptions`, where it is not
+    // read at all: every client on this platform ran with heartbeats DISABLED
+    // while the schema said the opposite.
+    this._heartbeatSeconds = runtimeCfg.get('heartbeat', this._config.heartbeat);
+
     this._connection = null;
+    // THE source of truth about connection liveness. amqplib's `Connection`
+    // carries no `closed` property — measured on the live broker (0.10.9,
+    // 2026-09-12): `"closed" in conn === false` before, during and after death.
+    // So `!this._connection.closed` negated `undefined` and answered "alive" for
+    // a corpse. Liveness is recorded here instead, by the handlers that learn
+    // about it first-hand, and the connection close handler drops the reference
+    // in the same breath. The three `_ensure*Channel()` methods read this, and
+    // nothing else; `isConnected()` reads it plus `_reconnecting`, because a
+    // socket whose channels are still being recreated is not yet usable (d.340).
+    // Channels do the same through `channel._alive` (see `_isChannelAlive()`).
+    this._connectionAlive = false;
     this._channel = null; // ConfirmChannel for publish operations
     this._queueChannel = null; // Regular channel for queue operations (assertQueue, checkQueue)
     this._consumerChannel = null; // Dedicated channel for consume operations
@@ -88,25 +284,89 @@ class RabbitMQClient extends EventEmitter {
     
     // Connection-level recovery
     this._reconnecting = false;
-    this._disconnecting = false;
+    // Did the CALLER end this client? A connection can die two ways and they are
+    // not the same event: the broker or the network dropped it (a fault — that
+    // is what recovery is for), or `disconnect()` was called (an intention —
+    // there is nothing to recover, the caller wants this client gone).
+    // The flag is therefore TERMINAL: set by `disconnect()`, cleared only by an
+    // explicit `connect()`. Until d.283 the same member was called
+    // `_disconnecting` and lasted only for the duration of the teardown, so a
+    // recovery round already inside `amqp.connect()` — or any `close` frame
+    // arriving after `disconnect()` had returned — read `false` and revived a
+    // client its owner had already disposed of. Measured: three live sockets and
+    // three recreated channels after `disconnect()` resolved, which is why a
+    // test worker that closes its client never exits.
+    this._closedByCaller = false;
     this._reconnectAttempts = 0;
     this._activeTimers = new Set();
-    this._maxReconnectAttempts = this._config.maxReconnectAttempts || 10; // Max 10 attempts
-    this._reconnectBaseDelay = this._config.reconnectBaseDelay || 1000; // Start with 1 second
-    this._reconnectMaxDelay = this._config.reconnectMaxDelay || 30000; // Max 30 seconds
-    this._reconnectEnabled = this._config.reconnectEnabled !== false; // Default: enabled
+    // Recovery budget: explicit config → RABBITMQ_MAX_RECONNECT_ATTEMPTS → module
+    // default (see ../config.js and ../defaults.js). Not an inline `|| 10`: that
+    // hid the value from every operator and silently swallowed a configured 0.
+    this._maxReconnectAttempts = runtimeCfg.get(
+      'maxReconnectAttempts',
+      this._config.maxReconnectAttempts
+    );
+    // How many whole recovery CYCLES this client may spend before the connection
+    // is declared permanently lost. Same three legs as the attempt budget above
+    // (explicit config → RABBITMQ_MAX_RECONNECT_CYCLES → module default), for the
+    // same reason: one owner, one documented override path.
+    this._maxReconnectCycles = runtimeCfg.get(
+      'maxReconnectCycles',
+      this._config.maxReconnectCycles
+    );
+    // Cycles spent so far. Counted up when a cycle starts, back to 0 the moment
+    // one succeeds — a client that recovered owes nothing for the outage it
+    // survived.
+    this._reconnectCycles = 0;
+    // The reason the last cycle ended without a connection, kept for the refusal
+    // the next use gets and for the fatal error when the cap is reached.
+    this._lastConnectionError = null;
+    // Set once the connection is permanently lost — the broker REFUSED it, or
+    // the cycle cap is spent. From that point this client will not try again and
+    // it must not report itself as connected.
+    this._connectionFatal = false;
+    // Injected by the owner of this client (service/wrapper). The LIBRARY never
+    // ends the process — that decision belongs to whoever owns the lifecycle.
+    this._onFatal = this._config.onFatal;
+    if (this._onFatal !== null && typeof this._onFatal !== 'function') {
+      throw new Error(
+        '[RabbitMQClient] Invalid config value for "onFatal" - Expected a function, got ' +
+          `"${typeof this._config.onFatal}". Fix: pass a callback that stops the process, or omit the key.`
+      );
+    }
+    this._reconnectBaseDelay = this._config.reconnectBaseDelay;
+    this._reconnectMaxDelay = this._config.reconnectMaxDelay;
+    this._reconnectEnabled = this._config.reconnectEnabled;
     this._reconnectTimer = null;
-    // Reconnect wait timeout: at least maxReconnectAttempts × reconnectMaxDelay, minimum 60s
-    this._reconnectWaitTimeout = this._config.reconnectWaitTimeout || 
-      Math.max(60000, (this._maxReconnectAttempts * this._reconnectMaxDelay));
+    // The one default that is DERIVED rather than declared: how long a caller
+    // waiting for recovery waits, computed from the budget and the ceiling of the
+    // backoff, never shorter than a minute. A constant copy of it in
+    // `defaultConfig` would be free to disagree with the two values it comes from,
+    // so the derivation stays here — and `=== undefined` asks "did the caller
+    // write one?", which `||` could not: `reconnectWaitTimeout: 0` is a legal
+    // value of its own (`minimum: 0` in the schema).
+    this._reconnectWaitTimeout = this._config.reconnectWaitTimeout === undefined
+      ? Math.max(60000, (this._maxReconnectAttempts * this._reconnectMaxDelay))
+      : this._config.reconnectWaitTimeout;
     
-    // Publisher retry configuration
-    this._publishRetryEnabled = this._config.publishRetryEnabled !== false; // Default: enabled
-    this._publishMaxRetries = this._config.publishMaxRetries || 3; // Default: 3 attempts
-    this._publishRetryBaseDelay = this._config.publishRetryBaseDelay || 100; // Default: 100ms
-    this._publishRetryMaxDelay = this._config.publishRetryMaxDelay || 5000; // Default: 5s
-    this._publishRetryBackoffMultiplier = this._config.publishRetryBackoffMultiplier || 2; // Default: 2 (exponential)
-    this._publishConfirmationTimeout = this._config.publishConfirmationTimeout || 5000; // Default: 5s per attempt
+    // Publisher retry configuration (values: ../config/defaultConfig.js)
+    this._publishRetryEnabled = this._config.publishRetryEnabled;
+    this._publishMaxRetries = this._config.publishMaxRetries;
+    this._publishRetryBaseDelay = this._config.publishRetryBaseDelay;
+    this._publishRetryMaxDelay = this._config.publishRetryMaxDelay;
+    this._publishRetryBackoffMultiplier = this._config.publishRetryBackoffMultiplier;
+    // ONE number, two consumers, and therefore a name that belongs to neither of
+    // them alone: how long this client waits for an ANSWER from the broker. The
+    // publish confirm waits for it (`_publishOnce`), and so does the whole
+    // teardown of `disconnect()` (d.283 chose deliberately not to invent a second
+    // number for that; the name it inherited then said "publish confirmation",
+    // which was true of one consumer and false of the other).
+    this._brokerAnswerTimeout = this._config.brokerAnswerTimeout;
+    // How long the connect handshake may take before the attempt is abandoned.
+    this._connectTimeout = this._config.connectTimeout;
+    // How long after `sendToQueue()` the attempt looks to see whether the missing
+    // confirm is a dead channel rather than a slow broker.
+    this._publishConfirmWatchdogDelay = this._config.publishConfirmWatchdogDelay;
     
     // Channel close hooks - called when channel closes with detailed information
     this._channelCloseHooks = []; // Array of { type: 'publisher'|'queue'|'consumer', callback: (details) => void }
@@ -117,69 +377,54 @@ class RabbitMQClient extends EventEmitter {
       queue: [],
       consumer: []
     };
-    this._thrashingThreshold = this._config.thrashingThreshold || 5; // Max closes per minute
-    this._thrashingWindowMs = this._config.thrashingWindowMs || 60000; // 1 minute window
-    this._thrashingAlertCallback = this._config.thrashingAlertCallback || null; // (type, count, windowMs) => void
+    this._thrashingThreshold = this._config.thrashingThreshold;
+    this._thrashingWindowMs = this._config.thrashingWindowMs;
+    this._thrashingAlertCallback = this._config.thrashingAlertCallback; // (type, count, windowMs) => void
     this._thrashingAlertsSent = new Set(); // Track which alerts we've already sent to avoid spam
     
     // Prefetch monitoring - track utilization per queue
     this._prefetchTracking = new Map(); // queue -> { prefetchCount: number, inFlight: number, lastCheck: number }
-    this._prefetchUtilizationThreshold = this._config.prefetchUtilizationThreshold || 0.8; // 80% threshold
-    this._prefetchCheckInterval = this._config.prefetchCheckInterval || 10000; // Check every 10s
-    this._prefetchAlertCallback = this._config.prefetchAlertCallback || null; // (queue, utilization, inFlight, prefetchCount) => void
+    this._prefetchUtilizationThreshold = this._config.prefetchUtilizationThreshold;
+    this._prefetchCheckInterval = this._config.prefetchCheckInterval;
+    this._prefetchAlertCallback = this._config.prefetchAlertCallback; // (queue, utilization, inFlight, prefetchCount) => void
     this._prefetchCheckTimer = null;
     
     // Health monitoring
     this._healthCheckInterval = null;
-    this._healthCheckIntervalMs = this._config.healthCheckInterval || 30000; // Default 30s
-    this._healthCheckEnabled = this._config.healthCheckEnabled !== false;
+    this._healthCheckIntervalMs = this._config.healthCheckInterval;
+    this._healthCheckEnabled = this._config.healthCheckEnabled;
     
     // Health reporting callbacks
-    this._healthReportCallback = this._config.healthReportCallback || null; // (health) => Promise<void>
-    this._healthCriticalCallback = this._config.healthCriticalCallback || null; // (health) => Promise<void>
-    this._criticalHealthShutdown = this._config.criticalHealthShutdown !== false; // Default: true - shutdown on critical health
-    this._criticalHealthShutdownDelay = this._config.criticalHealthShutdownDelay || 60000; // Default: 60s delay before shutdown
+    this._healthReportCallback = this._config.healthReportCallback; // (health) => Promise<void>
+    this._healthCriticalCallback = this._config.healthCriticalCallback; // (health) => Promise<void>
+    this._criticalHealthShutdown = this._config.criticalHealthShutdown;
+    this._criticalHealthShutdownDelay = this._config.criticalHealthShutdownDelay;
     this._criticalHealthStartTime = null; // Track when critical health started
 
-    // Create structured logger for infrastructure logging (module-owned)
-    // ONE implementation of the infrastructure logger, in
-    // @onlineapps/infra-logger. A private copy lived here until 2026-08-29,
-    // justified as avoiding a dependency cycle — a cycle that is not there:
-    // the comment named infrastructure-tools, but the logger is infra-logger,
-    // which declares no @onlineapps dependency at all. The copy meanwhile
-    // missed the identity fail-fast that 2.0.0 added (change-discipline.md:
-    // one fact, one owner).
-    this._log = createLogger('mq-client-core', 'transport');
-    
     // Publish layer (retry + buffer)
     this._publishLayer = new PublishLayer({
       client: this,
-      logger: console,
+      logger: this._logger,
       bufferConfig: {
         inMemory: {
-          maxSize: this._config.publishBufferMaxSize || 100,
-          ttlMs: this._config.publishBufferTtlMs || 5 * 60 * 1000,
-        },
-        persistent: {
-          enabled: !!this._config.persistentBufferEnabled,
-          redisClient: this._config.persistentRedisClient || null,
+          maxSize: this._config.publishBufferMaxSize,
+          ttlMs: this._config.publishBufferTtlMs,
         },
       },
     });
 
-    // Recovery worker (connection recovery, queue creation pro business)
+    // Recovery worker — connection recovery, and the report of a queue that does
+    // not exist. It creates none: queue creation left it with the two callbacks
+    // that fed it (d.419).
     this._recoveryWorker = new RecoveryWorker({
       client: this,
-      scope: this._config.recoveryScope || 'infrastructure',
-      queueCreationFilter: this._config.queueCreationFilter || null,
-      queueCreationCallback: this._config.queueCreationCallback || null, // Delegates to QueueManager if provided
-      logger: console,
+      scope: this._config.recoveryScope,
+      logger: this._logger,
     });
 
-    // Publish monitor (metriky)
-    this._publishMonitor = new PublishMonitor({
-      logger: console,
-    });
+    // Publish monitor (metriky) — counts only, reports through return values,
+    // takes no logger (see PublishMonitor's header).
+    this._publishMonitor = new PublishMonitor();
 
     // Event listeners pro monitoring
     this._setupPublishMonitoring();
@@ -244,22 +489,40 @@ class RabbitMQClient extends EventEmitter {
     return {
       publisher: {
         exists: !!this._channel,
-        closed: this._channel ? this._channel.closed : true,
-        ready: this._channel && !this._channel.closed
+        closed: !this._isChannelAlive(this._channel),
+        ready: this._isChannelAlive(this._channel)
       },
       queue: {
         exists: !!this._queueChannel,
-        closed: this._queueChannel ? this._queueChannel.closed : true,
-        ready: this._queueChannel && !this._queueChannel.closed
+        closed: !this._isChannelAlive(this._queueChannel),
+        ready: this._isChannelAlive(this._queueChannel)
       },
       consumer: {
         exists: !!this._consumerChannel,
-        closed: this._consumerChannel ? this._consumerChannel.closed : true,
-        ready: this._consumerChannel && !this._consumerChannel.closed
+        closed: !this._isChannelAlive(this._consumerChannel),
+        ready: this._isChannelAlive(this._consumerChannel)
       }
     };
   }
 
+  /**
+   * THE source of truth about one channel's liveness.
+   *
+   * `_attach*ChannelHandlers()` marks the channel alive when it attaches, and
+   * its `error` / `close` handlers mark it dead — the two events that know. The
+   * reading this replaced, `channel && !channel.closed`, asked amqplib for a
+   * property it does not define (measured, 0.10.9), so it answered "alive" for
+   * every channel it was handed, dead or not, and returned the channel object
+   * rather than a boolean.
+   *
+   * @param {Object|null} channel
+   * @returns {boolean}
+   * @private
+   */
+  _isChannelAlive(channel) {
+    return !!channel && channel._alive === true;
+  }
+
   /**
    * Get current consumer state
    * @returns {Object} Consumer state information
@@ -278,17 +541,334 @@ class RabbitMQClient extends EventEmitter {
   getBufferState() {
     return {
       size: this._publishLayer._buffer.size(),
-      inMemory: this._publishLayer._buffer._inMemory?.size() || 0,
-      persistent: this._publishLayer._buffer._persistent ? (this._publishLayer._buffer._persistent.size?.() || 0) : 0
+      // No `persistent` count. There is one buffer, so a second number could
+      // only ever be 0 — a field that reports a mechanism that does not exist
+      // (d.343, `automation-gates.md` §5).
+      inMemory: this._publishLayer._buffer._inMemory?.size() || 0
     };
   }
 
   /**
-   * Check if client is connected
-   * @returns {boolean} True if connection exists and is not closed
+   * Can this client be used right now?
+   *
+   * Three things have to be true, and they are three different facts:
+   *   - the recovery budget is not spent (`_connectionFatal`);
+   *   - the socket is up (`_connectionAlive`, THE liveness source — d.260);
+   *   - the recovery is FINISHED (`_reconnecting`), because a re-established
+   *     socket with no channels on it cannot publish or consume.
+   *
+   * The third was missing until d.340. `_reconnectWithBackoff()` marks the
+   * connection alive the instant `amqp.connect()` resolves and recreates the
+   * publisher, queue and consumer channels after that, so for the width of that
+   * restore `isConnected()` answered TRUE while `getChannelState()` reported all
+   * three channels missing — the same split answer d.260 removed from the
+   * outage, reappearing at the other end of it. Measured as a race in
+   * `tests/integration/connection-liveness-single-source.integration.test.js`
+   * ("when the broker is reachable again"): the poll on `isConnected()` returned
+   * before the channels were back and the channel-state assertion that followed
+   * it failed.
+   *
+   * `_reconnecting` is the recovery's own flag: set when a round starts, cleared
+   * when the channels are back (success), when the budget is spent
+   * (`_failFatally`) or when the caller ended the client mid-round. So "recovery
+   * in progress" and "not usable" are the same state, read from the one member
+   * that already records it — no second liveness flag.
+   *
+   * @returns {boolean} True if the connection AND its channels are in place
    */
   isConnected() {
-    return !!(this._connection && !this._connection.closed);
+    if (this._connectionFatal) return false;
+    if (this._reconnecting) return false;
+    return this._connectionAlive === true;
+  }
+
+  /**
+   * THE connection target, composed: the configured host plus the resolved
+   * heartbeat, in the one place amqplib reads it — the URL query.
+   *
+   * Both connect paths (the first handshake and every reconnect) call this, so
+   * a revived connection is negotiated with exactly the parameters the first one
+   * was. Until d.299 they each built their own options object and put the
+   * heartbeat where amqplib does not look.
+   *
+   * @returns {string} the AMQP URL, credentials untouched
+   * @private
+   */
+  _connectionTarget() {
+    const target = new URL(this._config.host);
+    target.searchParams.set('heartbeat', String(this._heartbeatSeconds));
+    return target.toString();
+  }
+
+  /**
+   * THE client properties of a connection — what the broker shows an operator in
+   * its connection list.
+   *
+   * @returns {Object} amqplib socket options
+   * @private
+   */
+  _connectionSocketOptions() {
+    const connectionName =
+      this._config.connectionName ||
+      this._config.clientName ||
+      `oa-client:${runtimeCfg.get('serviceName')}:${process.pid}`;
+    return { clientProperties: { connection_name: connectionName } };
+  }
+
+  /**
+   * The two things this client must know about ANY connection it holds: that it
+   * errored, and that it died.
+   *
+   * One rail since d.299. Both were registered twice, once in `connect()` and
+   * once in the recovery path, as two copies of the same two handlers — and a
+   * handler maintained twice diverges (`change-discipline.md` § One rail per
+   * concern). amqplib always follows a connection `error` with `close`, so the
+   * error handler is not the rail that recovers: it is one of the two moments
+   * that KNOW the connection is gone, and liveness is recorded at both.
+   *
+   * @param {Object} connection - the amqplib connection
+   * @private
+   */
+  _attachConnectionHandlers(connection) {
+    connection.on('error', (err) => {
+      this._connectionAlive = false;
+      this._logger.error('[RabbitMQClient] Connection error:', err.message);
+      this.emit('error', err);
+    });
+    connection.on('close', () => this._onConnectionDied());
+  }
+
+  /**
+   * True once the connection is permanently lost — the broker refused it, or the
+   * whole cycle cap is spent. From that point the client makes no further
+   * attempts. A single spent ATTEMPT budget is not this state; see
+   * `_standDown()`.
+   * @returns {boolean}
+   */
+  isConnectionFatal() {
+    return this._connectionFatal === true;
+  }
+
+  /**
+   * Did the BROKER refuse this connection, or did nobody answer?
+   *
+   * The two are not the same failure and must not get the same treatment. A
+   * refusal is an answer: the broker read the handshake and said no — wrong
+   * credentials, a vhost this account may not use, a topology it will not
+   * accept. Nothing about that answer changes by asking again, so retrying is
+   * dishonest work. Nobody answering is a condition that ends on its own, and
+   * it is the one the owner forbade turning into a permanent death
+   * (`docs/governance/confirmations/mq-client-lifecycle-contract.md` 001 point 3).
+   *
+   * WHAT IT READS, and why the message rather than a code. Measured against
+   * amqplib 0.10.9 on the live dev broker, 2026-09-14:
+   *
+   *     amqp://nobody:wrong@…      Error, code=undefined, message=
+   *       'Handshake terminated by server: 403 (ACCESS-REFUSED) with message
+   *        "ACCESS_REFUSED - Login was refused using authentication mechanism
+   *        PLAIN. For details see the broker logfile."'
+   *     amqp://…@127.0.0.1:39999   Error, code='ECONNREFUSED', errno=-61,
+   *       syscall='connect'
+   *
+   * amqplib renders the broker's `connection.close` frame into the message and
+   * leaves `err.code` undefined, so the reply code lives in the text. What is
+   * matched is therefore the AMQP reply code the BROKER sent — 403, 530, 406 —
+   * a protocol constant, never wording invented here. A channel-level refusal
+   * arrives the other way round, as a numeric `err.code`, and that is read too.
+   *
+   * NOT recognised, and said rather than implied (`automation-gates.md` §5): a
+   * wrong vhost reaches amqplib as `Expected ConnectionOpenOk; got
+   * <ConnectionClose channel:0>` (measured, same run) — the broker's 530 is
+   * dropped before the error is built, so this classifier cannot see it and
+   * treats it as transient. It ends in the cycle cap instead of at once.
+   *
+   * Anything unrecognised is TRANSIENT on purpose: the confirmation forbids
+   * giving up forever, and the cycle cap already bounds the other end.
+   *
+   * @param {Error|null} err
+   * @returns {boolean} true if the broker answered and refused
+   * @private
+   */
+  _isBrokerRefusal(err) {
+    if (!err) return false;
+    if (REFUSAL_REPLY_CODES.includes(err.code)) return true;
+    const message = typeof err.message === 'string' ? err.message : '';
+    return REFUSAL_REPLY_CODES.some((code) => message.includes(`server: ${code} (`));
+  }
+
+  /**
+   * A recovery cycle is over and the client is NOT connected, but the broker
+   * never refused it — so this is not the end.
+   *
+   * The client stands down: no timer, no socket, `isConnected()` false, and the
+   * attempt counter back to zero so the next cycle gets its full budget. Nothing
+   * polls; the next USE of this client (publish, consume, `performHealthCheck()`)
+   * starts the next cycle through `_resumeRecovery()`. That is the "lazy retry on
+   * next use" the owner's decision requires, and it is why "dead until the
+   * process restarts" — what this package did until d.339, and what its README
+   * taught — is gone.
+   *
+   * @param {Error|null} lastError - the error from the final failed attempt
+   * @returns {Error} the stand-down error, so callers can throw it
+   * @private
+   */
+  _standDown(lastError) {
+    this._reconnecting = false;
+    this._reconnectAttempts = 0;
+    this._lastConnectionError = lastError || null;
+
+    const standby = new ConnectionError(
+      `[RabbitMQClient] Connection not re-established - recovery cycle ${this._reconnectCycles}`
+        + `/${this._maxReconnectCycles} spent its ${this._maxReconnectAttempts} attempts and the broker `
+        + `did not answer (last error: ${lastError ? lastError.message : 'unknown'}). `
+        + 'Expected: the broker to become reachable again; this is an outage, not a refusal. '
+        + 'Fix: nothing to do here — the next publish, consume or performHealthCheck() starts the next '
+        + 'cycle; raise RABBITMQ_MAX_RECONNECT_CYCLES if more of them must be survived in-process.'
+    );
+    standby.code = 'MQ_CONNECTION_STANDBY';
+    standby.cycle = this._reconnectCycles;
+    standby.cyclesMax = this._maxReconnectCycles;
+    standby.attempts = this._maxReconnectAttempts;
+    standby.cause = lastError;
+
+    this._logger.warn(`[RabbitMQClient] [mq-client-core] ${standby.message}`);
+    this.emit('connection:standby', {
+      cycle: this._reconnectCycles,
+      cyclesMax: this._maxReconnectCycles,
+      attempts: this._maxReconnectAttempts,
+      lastError: lastError ? lastError.message : null,
+      timestamp: new Date().toISOString()
+    });
+
+    return standby;
+  }
+
+  /**
+   * Somebody wants to use a client that is not connected. Start the next
+   * recovery cycle if the contract allows one, and say whether a recovery is now
+   * in flight.
+   *
+   * This is the lazy half of the retry contract, and it deliberately starts NO
+   * second loop: it re-enters `_reconnectWithBackoff()`, the one recovery rail
+   * this transport has (`change-discipline.md` § One rail per concern). What it
+   * adds is the decision to enter it again, which the automatic close handler
+   * makes only once.
+   *
+   * @returns {boolean} true if a recovery is in flight (already, or from here)
+   * @private
+   */
+  _resumeRecovery() {
+    if (this._reconnecting) return true;
+    if (this._connectionFatal) return false;
+    if (this._closedByCaller) return false;
+    if (!this._reconnectEnabled) return false;
+
+    this._logger.info(
+      `[RabbitMQClient] [mq-client-core] Client used while disconnected - starting recovery cycle `
+        + `${this._reconnectCycles + 1}/${this._maxReconnectCycles}`
+    );
+    this._reconnectWithBackoff().catch((err) => this._reportRecoveryFailure(err));
+
+    return this._reconnecting === true;
+  }
+
+  /**
+   * A recovery cycle rejected. Say so — ONCE, on the channel that belongs to the
+   * thing that happened.
+   *
+   * A cycle that stood down or died fatally has already announced itself on
+   * `connection:standby` / `connection:fatal`, synchronously, at the moment it
+   * happened. Re-emitting the same error on the generic `error` channel is a
+   * second notification of one event, and the harmful kind: it arrives a turn
+   * later, which is long enough to land inside the NEXT cycle's
+   * `_waitForReconnection()` and reject it with the previous cycle's obituary
+   * (measured while writing d.339 — a publish that started a healthy cycle was
+   * rejected by the stand-down of the cycle before it).
+   *
+   * Anything else that comes out of a recovery round is unannounced, so it goes
+   * to `error`.
+   *
+   * @param {Error} err
+   * @private
+   */
+  _reportRecoveryFailure(err) {
+    this._logger.error(`[RabbitMQClient] [mq-client-core] Recovery cycle ended: ${err.message}`);
+    if (err.code === 'MQ_CONNECTION_FATAL' || err.code === 'MQ_CONNECTION_STANDBY') {
+      return;
+    }
+    this.emit('error', err);
+  }
+
+  /**
+   * Declare the connection permanently lost: stop retrying, stop reporting
+   * health, tell the owner.
+   *
+   * There are exactly TWO ways to get here, and they are different facts, so
+   * they carry different sentences (`architecture-principles.md` §5 — a message
+   * that cannot tell an operator which of the two happened sends them to the
+   * wrong place):
+   *
+   *   - `broker-refused` — the broker answered and said no (403/530/406). No
+   *     number of retries changes that answer, so not one attempt is spent on
+   *     it; the fix is credentials, vhost or topology.
+   *   - `cycles-spent` — every recovery cycle the cap allows has been spent
+   *     against a broker that never answered. This is the bounded end of the
+   *     lazy-retry contract, not the first spent attempt budget: that one stands
+   *     the client down (`_standDown()`) and waits to be used again.
+   *
+   * The library deliberately does NOT call `process.exit()`. Ending the process
+   * is the lifecycle owner's decision (service / wrapper), and a library that
+   * takes it removes the owner's chance to drain, flush or log first. What the
+   * library owes the owner is the truth, once, on a channel that cannot be
+   * confused with an ordinary transient error: the `connection:fatal` event and
+   * the injected `onFatal` callback.
+   *
+   * @param {Error} lastError - The error from the final failed attempt.
+   * @param {'broker-refused'|'cycles-spent'} reason - Which of the two it is.
+   * @returns {Error} The fatal error, so callers can throw it.
+   * @private
+   */
+  _failFatally(lastError, reason) {
+    this._connectionFatal = true;
+    this._reconnecting = false;
+    this._lastConnectionError = lastError || null;
+
+    const because = lastError ? lastError.message : 'unknown';
+    const fatal = new Error(
+      reason === 'broker-refused'
+        ? '[RabbitMQClient] Connection permanently lost - the broker REFUSED the connection, '
+            + `so retrying cannot change the answer (reason: ${because}). `
+            + 'Expected: credentials, vhost and topology this broker accepts. '
+            + 'Fix: correct RABBITMQ_URL (user, password, vhost) or the topology the broker refused, '
+            + 'then restart the process.'
+        : `[RabbitMQClient] Connection permanently lost - all ${this._maxReconnectCycles} recovery cycles `
+            + `of ${this._maxReconnectAttempts} attempts each failed against a broker that did not answer `
+            + `(last error: ${because}). `
+            + 'Expected: the owner of this client stops the process so its restart policy can boot it against a verified broker. '
+            + 'Fix: register an onFatal handler (or a "connection:fatal" listener) that exits non-zero; '
+            + 'raise RABBITMQ_MAX_RECONNECT_CYCLES (or RABBITMQ_MAX_RECONNECT_ATTEMPTS) only if a longer outage '
+            + 'must be survived in-process.'
+    );
+    fatal.code = 'MQ_CONNECTION_FATAL';
+    fatal.reason = reason;
+    fatal.attempts = this._maxReconnectAttempts;
+    fatal.cycles = this._reconnectCycles;
+    fatal.cause = lastError;
+
+    this._logger.error(`[RabbitMQClient] [mq-client-core] ${fatal.message}`);
+    this.emit('connection:fatal', fatal);
+
+    if (this._onFatal) {
+      try {
+        this._onFatal(fatal);
+      } catch (err) {
+        this._logger.error(
+          `[RabbitMQClient] [mq-client-core] onFatal handler threw: ${err.message}`
+        );
+      }
+    }
+
+    return fatal;
   }
 
   /**
@@ -307,11 +887,40 @@ class RabbitMQClient extends EventEmitter {
   }
   
   /**
-   * Getter for queue channel - regular channel for queue operations
-   * Use this for assertQueue, checkQueue to avoid RPC reply queue issues
+   * The channel queue operations run on — `assertQueue`, `checkQueue`,
+   * `purgeQueue`, `deleteQueue`.
+   *
+   * It answers with the queue channel or with an error, never with another
+   * channel. Until d.281 it read `this._queueChannel || this._channel`, so
+   * whenever the queue channel was absent — the state every channel death
+   * leaves behind, because the close handler nulls the reference — a caller
+   * reaching queue operations through this getter ran them on the publisher's
+   * ConfirmChannel. A queue operation is EXPECTED to fail (404 for a missing
+   * queue, 406 for a divergent declaration) and an AMQP channel-level failure
+   * closes the channel, which on the ConfirmChannel takes every pending
+   * publisher confirm with it. That is the very outcome the three-channel
+   * separation exists to prevent, so the fallback contradicted both its own
+   * premise and `architecture-principles.md` §3.
+   *
+   * This getter is a state reading and cannot open anything: the asynchronous
+   * way to a live queue channel is a queue operation on this client, each of
+   * which ensures the channel first.
+   *
+   * @see /docs/architecture/rabbitmq-channel-lifecycle.md
+   * @returns {Object} the live queue channel
+   * @throws {ConnectionError} when the queue channel is absent or not alive
    */
   get queueChannel() {
-    return this._queueChannel || this._channel; // Fallback to main channel if queueChannel not available
+    if (!this._isChannelAlive(this._queueChannel)) {
+      throw new ConnectionError(
+        '[RabbitMQClient] Queue channel is not available - '
+          + 'Expected: an open queue channel, opened by connect() and recreated after a channel death. '
+          + 'Fix: run the queue operation through the client (assertQueue/checkQueue/purgeQueue/deleteQueue) — '
+          + 'those ensure the channel first; the publisher channel is never a substitute, because a queue '
+          + "operation's 404/406 would close it and take the pending publisher confirms with it."
+      );
+    }
+    return this._queueChannel;
   }
   
   /**
@@ -334,7 +943,7 @@ class RabbitMQClient extends EventEmitter {
     const history = this._channelCloseHistory[channelType];
     
     if (!history) {
-      console.warn(`[RabbitMQClient] Unknown channel type for thrashing tracking: ${channelType}`);
+      this._logger.warn(`[RabbitMQClient] Unknown channel type for thrashing tracking: ${channelType}`);
       return;
     }
     
@@ -365,7 +974,7 @@ class RabbitMQClient extends EventEmitter {
         }
         
         const message = `Channel thrashing detected: ${channelType} channel closed ${history.length} times in ${Math.round(this._thrashingWindowMs / 1000)}s (threshold: ${this._thrashingThreshold})`;
-        console.error(`[RabbitMQClient] [mq-client-core] 🚨 ${message}`);
+        this._logger.error(`[RabbitMQClient] [mq-client-core] 🚨 ${message}`);
         
         // Call alert callback if provided
         if (this._thrashingAlertCallback) {
@@ -376,7 +985,7 @@ class RabbitMQClient extends EventEmitter {
               windowMs: this._thrashingWindowMs
             });
           } catch (alertErr) {
-            console.error(`[RabbitMQClient] [mq-client-core] Thrashing alert callback error:`, alertErr.message);
+            this._logger.error(`[RabbitMQClient] [mq-client-core] Thrashing alert callback error:`, alertErr.message);
           }
         }
         
@@ -412,7 +1021,7 @@ class RabbitMQClient extends EventEmitter {
       reason: reason,
       timestamp: new Date().toISOString(),
       stack: error?.stack || new Error().stack,
-      connectionState: this._connection ? (this._connection.closed ? 'closed' : 'open') : 'null',
+      connectionState: this._connection ? (this._connectionAlive ? 'open' : 'closed') : 'null',
       channelCreatedAt: channel?._createdAt || 'unknown',
       lastOperation: channel?._lastOperation || 'unknown'
     };
@@ -422,7 +1031,7 @@ class RabbitMQClient extends EventEmitter {
         try {
           hook.callback(details);
         } catch (hookErr) {
-          console.error(`[RabbitMQClient] [mq-client-core] Channel close hook error:`, hookErr.message);
+          this._logger.error(`[RabbitMQClient] [mq-client-core] Channel close hook error:`, hookErr.message);
         }
       }
     }
@@ -436,6 +1045,157 @@ class RabbitMQClient extends EventEmitter {
    * @returns {Promise<void>}
    * @throws {Error} If connection or channel creation fails.
    */
+  /**
+   * The connection died — the ONE thing this client does about it.
+   *
+   * A connection can die twice over the life of one client: the one `connect()`
+   * opened, and the one a recovery round re-established. Both registrations of
+   * `connection.on('close')` come here, because this is one concern and a
+   * concern with two implementations is a defect by default
+   * (`change-discipline.md` § One rail per concern). The cost of the two copies
+   * is on record: d.283 had to fix one defect in two places, and the copy on the
+   * recovery side had never asked about `_closedByCaller` at all — which is how
+   * a client its owner had already disposed of came back to life.
+   *
+   * The steps, in this order:
+   *
+   *   1. record the death — `_connectionAlive` is the ONE liveness source
+   *      (d.260), and it is set before anything decides what to do about it;
+   *   2. drop the corpse: the three channels and the connection itself. Until
+   *      d.260 the reference survived until the recovery loop's first backoff had
+   *      elapsed, and `!this._connection.closed` read `undefined` throughout — so
+   *      for that whole window `isConnected()` answered TRUE and
+   *      `_ensure*Channel()` opened channels on a corpse;
+   *   3. ask whose doing it was. A close the CALLER ordered is not a fault:
+   *      there is nothing to recover and nothing to report (d.283);
+   *   4. start recovery BEFORE reporting the close, so an `error` listener that
+   *      throws cannot prevent the reconnect;
+   *   5. report the close.
+   *
+   * @private
+   */
+  _onConnectionDied() {
+    this._connectionAlive = false;
+    this._channel = null;
+    this._queueChannel = null;
+    this._consumerChannel = null;
+    this._connection = null;
+
+    if (this._closedByCaller) {
+      this._logger.info('[RabbitMQClient] Connection closed during disconnect (expected)');
+      return;
+    }
+
+    this._logger.warn('[RabbitMQClient] Connection closed unexpectedly - close handler STARTED');
+    this._logger.debug(`[RabbitMQClient] Close handler: reconnectEnabled=${this._reconnectEnabled}, reconnecting=${this._reconnecting}`);
+
+    if (this._reconnectEnabled && !this._reconnecting) {
+      this._logger.info('[RabbitMQClient] \u2713 Conditions met - starting connection-level recovery');
+      this._reconnectWithBackoff().catch((err) => this._reportRecoveryFailure(err));
+    } else {
+      this._logger.warn(`[RabbitMQClient] \u2717 Reconnect NOT starting: enabled=${this._reconnectEnabled}, reconnecting=${this._reconnecting}`);
+    }
+
+    this.emit('error', connectionClosedUnexpectedly());
+
+    this._logger.debug('[RabbitMQClient] Close handler FINISHED');
+  }
+
+  /**
+   * Close one amqplib handle during teardown, and never wait longer than the
+   * budget left for the whole teardown.
+   *
+   * The budget is NOT a new number: `brokerAnswerTimeout` is this client's
+   * declared answer to exactly this question — how long it waits for the broker
+   * to answer a frame it sent (`config/configSchema.js`) — and a `close-ok` is
+   * that same kind of answer. The key carried the name of only one of its two
+   * consumers (`publishConfirmationTimeout`) until d.299.
+   *
+   * @param {string} what - the handle's name, for the log
+   * @param {Object|null} handle - an amqplib channel or connection, or nothing
+   * @param {number} budgetMs - what is left of the teardown budget
+   * @returns {Promise<{status: 'absent'|'closed'|'refused'|'unanswered', error: Error|null}>}
+   * @private
+   */
+  async _closeWithinTeardownBudget(what, handle, budgetMs) {
+    if (!handle) {
+      return { status: 'absent', error: null };
+    }
+
+    const UNANSWERED = Symbol('teardown-budget-spent');
+    let deadlineTimer = null;
+    const outcome = await Promise.race([
+      handle.close().then(
+        () => ({ status: 'closed', error: null }),
+        (err) => ({ status: 'refused', error: err })
+      ),
+      new Promise((resolve) => {
+        deadlineTimer = this._setTimeout(() => resolve(UNANSWERED), budgetMs);
+      })
+    ]);
+    this._clearTimeout(deadlineTimer);
+
+    if (outcome === UNANSWERED) {
+      this._logger.warn(
+        `[RabbitMQClient] The broker did not answer the ${what} close within the teardown budget `
+          + `(${this._brokerAnswerTimeout}ms) - `
+          + 'Expected: a close-ok frame for the close this client sent. '
+          + 'Fix: nothing to do here — the teardown stops waiting and drops the socket, so '
+          + 'disconnect() ends and the process can exit; a broker that never answers a close is '
+          + 'a broker-side or network fault, and the declared brokerAnswerTimeout sets how '
+          + 'long this client gives it.'
+      );
+      return { status: 'unanswered', error: null };
+    }
+
+    return outcome;
+  }
+
+  /**
+   * Drop everything a connection the broker never answered on still holds.
+   *
+   * amqplib lets go of both of these itself when a close COMPLETES — its
+   * `toClosed()` clears the heartbeater and ends the stream. A close that is
+   * never answered never reaches it, so the teardown does it: the socket,
+   * because an open socket keeps the process alive, and the heartbeat interval,
+   * because an armed repeating timer does exactly the same (measured: the
+   * integration tier reported one open handle, `setInterval(30000)` from
+   * `amqplib/lib/heartbeat.js`, after the socket alone was dropped).
+   *
+   * Both live on amqplib's inner `Connection` (`connection.connection`):
+   * `.stream` is the socket (0.10.9 — `wrapStream()` returns a `net.Socket`
+   * unchanged, because a socket already is a Duplex) and `.heartbeater` is the
+   * `Heart`. There is no public way to abort a connection whose `close()` will
+   * never settle, so the shape is checked before it is used and a change in it
+   * is reported rather than silently survived.
+   *
+   * @param {Object|null} connection - the amqplib ChannelModel being torn down
+   * @private
+   */
+  _dropUnansweredConnection(connection) {
+    const inner = connection && connection.connection ? connection.connection : null;
+    const socket = inner && inner.stream ? inner.stream : null;
+
+    if (!socket || typeof socket.destroy !== 'function') {
+      this._logger.warn(
+        '[RabbitMQClient] Teardown could not reach the socket of an unanswered connection - '
+          + 'Expected: amqplib to expose it at connection.connection.stream (0.10.x). '
+          + 'Fix: the socket may outlive disconnect() and keep the process alive; check whether '
+          + 'the installed amqplib still has that shape.'
+      );
+      return;
+    }
+
+    // A connection that never finished opening has no heartbeater; one that did
+    // has an interval nobody else will clear now.
+    if (inner.heartbeater && typeof inner.heartbeater.clear === 'function') {
+      inner.heartbeater.clear();
+    }
+
+    socket.destroy();
+    this._logger.warn('[RabbitMQClient] Teardown dropped the socket and heartbeat of a connection the broker never answered on');
+  }
+
   /**
    * Helper to set a trackable timeout
    * @private
@@ -473,72 +1233,46 @@ class RabbitMQClient extends EventEmitter {
 
   async connect() {
     let connectTimeoutTimer = null;
+    // An explicit `connect()` is the one thing that undoes an explicit
+    // `disconnect()`: the caller wants this client alive again, so recovery is
+    // armed again with it. Nothing else clears the flag.
+    this._closedByCaller = false;
+    // …and the recovery budget starts over with it, for the same reason: the
+    // cycles were spent against the outage the caller has just decided is over
+    // (d.339).
+    this._reconnectCycles = 0;
+    this._reconnectAttempts = 0;
+    this._lastConnectionError = null;
     try {
-      const rawTarget = this._config.host || this._config.url;
-      const heartbeat = this._config.heartbeat ?? 30;
-      const connectionName =
-        this._config.connectionName ||
-        this._config.clientName ||
-        `oa-client:${runtimeCfg.get('serviceName')}:${process.pid}`;
-
-      console.log(`[RabbitMQClient] Attempting to connect to: ${rawTarget}`);
-      const connectArgs = typeof rawTarget === 'string'
-        ? [rawTarget, { heartbeat, clientProperties: { connection_name: connectionName } }]
-        : [{ ...rawTarget, heartbeat, clientProperties: { connection_name: connectionName } }];
-
-      const connectPromise = amqp.connect(...connectArgs);
+      const rawTarget = this._connectionTarget();
+
+      // The target carries the broker password in its URL userinfo. Only the
+      // redacted form reaches the log; the real value goes to amqplib untouched.
+      const safeTarget = redactConnectionTarget(rawTarget);
+      this._logger.info(`[RabbitMQClient] Attempting to connect to: ${safeTarget}`);
+
+      const connectPromise = amqp.connect(rawTarget, this._connectionSocketOptions());
       const timeoutPromise = new Promise((_, reject) => {
-        connectTimeoutTimer = this._setTimeout(() => reject(new Error('Connection timeout after 10 seconds')), 10000);
+        connectTimeoutTimer = this._setTimeout(() => reject(new ConnectionError(
+          `[RabbitMQClient] Connection timeout after ${this._connectTimeout} ms - `
+            + `Expected: the broker to accept a TCP+AMQP handshake within connectTimeout (${this._connectTimeout} ms). `
+            + 'Fix: check the broker is up and reachable from this container, and that the configured host/port and credentials are the ones it serves.'
+        )), this._connectTimeout);
         if (connectTimeoutTimer && typeof connectTimeoutTimer.unref === 'function') {
           connectTimeoutTimer.unref();
         }
       });
-      console.log('[RabbitMQClient] Starting connection race...');
+      this._logger.debug('[RabbitMQClient] Starting connection race...');
       this._connection = await Promise.race([connectPromise, timeoutPromise]);
       if (connectTimeoutTimer) {
         this._clearTimeout(connectTimeoutTimer);
         connectTimeoutTimer = null;
       }
-      console.log('[RabbitMQClient] Connection established');
+      this._logger.info('[RabbitMQClient] Connection established');
+      this._connectionAlive = true;
       this._reconnectAttempts = 0; // Reset reconnect attempts on successful connection
-      
-      this._connection.on('error', (err) => {
-        console.error('[RabbitMQClient] Connection error:', err.message);
-        this.emit('error', err);
-        // Connection errors may lead to close event - let close handler handle reconnection
-      });
-      
-      this._connection.on('close', () => {
-        if (this._disconnecting) {
-          console.log('[RabbitMQClient] Connection closed during disconnect (expected)');
-          return;
-        }
-        console.warn('[RabbitMQClient] Connection closed unexpectedly - close handler STARTED');
-        console.log(`[RabbitMQClient] Close handler: reconnectEnabled=${this._reconnectEnabled}, reconnecting=${this._reconnecting}`);
-        
-        // Mark all channels as closed
-        this._channel = null;
-        this._queueChannel = null;
-        this._consumerChannel = null;
-        
-        // CONNECTION-LEVEL RECOVERY: Attempt to reconnect with exponential backoff
-        // PREDICTABLE: Check conditions and log why reconnect is/isn't starting
-        // IMPORTANT: Do this BEFORE emitting error, so reconnect can start even if error handler throws
-        if (this._reconnectEnabled && !this._reconnecting) {
-          console.log('[RabbitMQClient] ✓ Conditions met - starting connection-level recovery from initial connect() close handler');
-          this._reconnectWithBackoff().catch(err => {
-            console.error('[RabbitMQClient] Reconnection failed after all attempts:', err.message);
-            this.emit('error', err);
-          });
-        } else {
-          console.warn(`[RabbitMQClient] ✗ Reconnect NOT starting: enabled=${this._reconnectEnabled}, reconnecting=${this._reconnecting}`);
-        }
-        
-        // Emit connection close event AFTER starting reconnect (so reconnect isn't blocked by error handler)
-        this.emit('error', new Error('RabbitMQ connection closed unexpectedly'));
-        
-        console.log('[RabbitMQClient] Close handler FINISHED');
-      });
+
+      this._attachConnectionHandlers(this._connection);
 
       // Use ConfirmChannel to enable publisher confirms for publish operations
       this._channel = await this._connection.createConfirmChannel();
@@ -584,6 +1318,7 @@ class RabbitMQClient extends EventEmitter {
       }
     } catch (err) {
       // Cleanup partially created resources
+      this._connectionAlive = false;
       if (this._connection) {
         try {
           await this._connection.close();
@@ -610,37 +1345,104 @@ class RabbitMQClient extends EventEmitter {
    */
   async _waitForReconnection() {
     if (!this._reconnecting) {
-      throw new Error('Cannot wait for reconnection: not currently reconnecting');
+      throw new ConnectionError(
+        '[RabbitMQClient] Cannot wait for reconnection: not currently reconnecting - '
+          + 'Expected: _waitForReconnection() to be called only while a reconnect is in flight. '
+          + 'Fix: check this._reconnecting before calling it; a closed connection that is not reconnecting is fatal, not transient.'
+      );
     }
     
-    // Wait for 'reconnected' event
+    // A cycle has exactly three endings, and this wait ends on each of them:
+    // `reconnected` (it worked), `connection:standby` (the cycle is spent, the
+    // client waits to be used again — d.339) and `connection:fatal` (it is over).
+    // The generic `error` channel stays as the fourth listener for everything
+    // else, but the two terminal outcomes are NOT read from it: they are
+    // announced on their own channels the moment they happen, whereas the copy
+    // that reaches `error` is re-emitted a turn later by the recovery's catch —
+    // late enough to land inside the NEXT cycle's wait and reject it with the
+    // previous cycle's obituary (measured while writing d.339).
     return new Promise((resolve, reject) => {
-      const timeout = this._setTimeout(() => {
+      const done = () => {
+        this._clearTimeout(timeout);
         this.removeListener('reconnected', onReconnected);
         this.removeListener('error', onError);
-        reject(new Error(`Reconnection timeout after ${this._reconnectWaitTimeout}ms`));
+        this.removeListener('connection:standby', onStandby);
+        this.removeListener('connection:fatal', onFatal);
+      };
+
+      const timeout = this._setTimeout(() => {
+        done();
+        reject(new ConnectionError(
+          `[RabbitMQClient] Reconnection timeout after ${this._reconnectWaitTimeout}ms - `
+            + 'Expected: the broker to accept a new connection within RABBITMQ_RECONNECT_WAIT_TIMEOUT. '
+            + 'Fix: check the broker is up and reachable; raise that timeout only if a longer outage must be survived in-process.'
+        ));
       }, this._reconnectWaitTimeout);
       
       const onReconnected = () => {
-        this._clearTimeout(timeout);
-        this.removeListener('reconnected', onReconnected);
-        this.removeListener('error', onError);
-        // Wait a bit for channels to be fully recreated
-        this._setTimeout(resolve, 500);
+        done();
+        // Resolved AT the event, not half a second after it. `reconnected` is
+        // emitted once the connection is back and its three channels have been
+        // recreated (d.340), so the guarantee this used to buy with
+        // `this._setTimeout(resolve, 500)` — "wait a bit for channels to be fully
+        // recreated" — is now in the event's own meaning.
+        //
+        // The sleep was also a hang: `_setTimeout` registers in `_activeTimers`
+        // and `disconnect()` clears every one of them, so a disconnect inside
+        // that window cancelled the pending `resolve` and left the awaiting
+        // publish unsettled for ever (measured, d.369).
+        resolve();
+      };
+
+      const onStandby = (state) => {
+        done();
+        reject(new ConnectionError(
+          `[RabbitMQClient] Waiting for reconnection ended: recovery cycle ${state.cycle}/${state.cyclesMax} `
+            + `spent its ${state.attempts} attempts without reaching the broker (last error: ${state.lastError}). `
+            + 'Expected: the broker to answer within one recovery cycle. '
+            + 'Fix: run the operation again once the broker is back — that starts the next cycle; '
+            + 'RABBITMQ_MAX_RECONNECT_CYCLES bounds how many of them this client will run.'
+        ));
+      };
+
+      const onFatal = (fatal) => {
+        done();
+        reject(fatal);
       };
       
       const onError = (error) => {
-        // Ignore connection errors during reconnection
-        if (error.message && error.message.includes('Connection closed unexpectedly')) {
+        // The transport's own close notification is the normal state of the thing being
+        // waited for, so it never ends this wait. Recognised by its code, never by its
+        // wording: the text comparison this replaced asked for a capital `C` the emitted
+        // message never had, so it ignored nothing at all (d.153a → d.164).
+        if (error.code === CONNECTION_CLOSED_UNEXPECTEDLY) {
           return; // Expected during reconnection
         }
-        this._clearTimeout(timeout);
-        this.removeListener('reconnected', onReconnected);
-        this.removeListener('error', onError);
+        // A PUBLISH failure is the outcome of a MESSAGE, not of the connection, so it
+        // never ends a wait for the connection. `_publishOnce()` puts every classified
+        // publish failure on this same `error` channel, so until d.435 one concurrent
+        // publish that failed while the link was coming back rejected EVERY waiter:
+        // `PublishLayer` buffered their messages and reported `reconnectFailed: true`
+        // while the recovery it declared failed was still running.
+        //
+        // The test is the PRESENCE of a publish classification, not its verdict: d.435
+        // asked `retryable === true`, which still let a `PermanentPublishError` or a
+        // `QueueNotFoundError` from a concurrent publish end the wait — and neither is
+        // a statement about this connection either; "no retry will help this message"
+        // says nothing about whether the link is coming back (d.435b). An error that
+        // never went through the ONE classification rail (`utils/publishErrors.js`)
+        // carries no `retryable` at all, and that absence is the whole condition —
+        // never a second list of codes kept here.
+        if (error.retryable !== undefined) {
+          return; // Somebody else's message failed; the connection has said nothing
+        }
+        done();
         reject(error);
       };
       
       this.once('reconnected', onReconnected);
+      this.once('connection:standby', onStandby);
+      this.once('connection:fatal', onFatal);
       this.on('error', onError);
     });
   }
@@ -652,42 +1454,48 @@ class RabbitMQClient extends EventEmitter {
    * @returns {Promise<void>}
    */
   async _ensurePublisherChannel() {
-    if (this._channel && !this._channel.closed) {
+    if (this._isChannelAlive(this._channel)) {
       return; // Channel is good
     }
-    
-    if (!this._connection || this._connection.closed) {
-      // Connection is closed - wait for reconnection
-      console.warn('[RabbitMQClient] [mq-client-core] Cannot recreate publisher channel: connection is closed (waiting for reconnection)');
-      
-      // Wait for reconnection to complete
-      if (this._reconnecting) {
+
+    if (!this._connectionAlive) {
+      // Connection is closed. THIS is the lazy half of the retry contract: a
+      // publish through a client that stood down after a spent cycle starts the
+      // next one here (d.339), rather than being refused for the life of the
+      // process.
+      this._logger.warn('[RabbitMQClient] [mq-client-core] Cannot recreate publisher channel: connection is closed (waiting for reconnection)');
+
+      if (this._resumeRecovery()) {
         await this._waitForReconnection();
-        
+
         // After reconnection, try again
-        if (this._channel && !this._channel.closed) {
+        if (this._isChannelAlive(this._channel)) {
           return; // Channel was recreated during reconnection
         }
         // If still no channel, connection might have failed - check again
-        if (!this._connection || this._connection.closed) {
-          throw new Error('Connection reconnection failed - cannot create publisher channel');
+        if (!this._connectionAlive) {
+          throw new ConnectionError(
+            '[RabbitMQClient] Connection reconnection failed - cannot create publisher channel. '
+              + 'Expected: an open connection once the reconnect completed. '
+              + 'Fix: check the broker is reachable; the client spends RABBITMQ_MAX_RECONNECT_ATTEMPTS per cycle and '
+              + 'RABBITMQ_MAX_RECONNECT_CYCLES cycles in all, then emits connection:fatal.'
+          );
         }
       } else {
-        // Not reconnecting - connection is closed and not recovering
-        throw new Error('Connection is closed and not reconnecting - cannot create publisher channel');
+        // No recovery can be started: the connection is permanently lost (the
+        // broker refused it, or every cycle is spent), the caller ended this
+        // client, or recovery is disarmed by configuration.
+        throw new ConnectionError(
+          '[RabbitMQClient] Connection is closed and no recovery can be started - cannot create publisher channel. '
+            + 'Expected: either an open connection, or a recovery this client is still allowed to run. '
+            + 'Fix: read connection:fatal for which of the two ended it — a broker refusal (credentials, vhost, '
+            + 'topology) or RABBITMQ_MAX_RECONNECT_CYCLES spent; reconnectEnabled: false and disconnect() also '
+            + 'leave the client here, on purpose.'
+        );
       }
     }
     
     try {
-      // Close old channel if exists
-      if (this._channel) {
-        try {
-          await this._channel.close();
-        } catch (_) {
-          // Ignore errors when closing already-closed channel
-        }
-      }
-      
       // Create new ConfirmChannel
       this._channel = await this._connection.createConfirmChannel();
       
@@ -700,7 +1508,7 @@ class RabbitMQClient extends EventEmitter {
       // Attach event handlers
       this._attachPublisherChannelHandlers(this._channel);
       
-      console.log('[RabbitMQClient] [mq-client-core] ✓ Publisher channel recreated');
+      this._logger.info('[RabbitMQClient] [mq-client-core] ✓ Publisher channel recreated');
     } catch (err) {
       this._channel = null;
 
@@ -709,17 +1517,24 @@ class RabbitMQClient extends EventEmitter {
       // Pokud se connection právě zavírá, považujeme to za přechodný stav – explicitně vyhodíme
       // TransientPublishError, aby vyšší vrstva (retry / worker) věděla, že má počkat na reconnect.
       if (msg.includes('Connection closing') || msg.includes('Connection closed')) {
-        console.warn(
+        this._logger.warn(
           `[RabbitMQClient] [mq-client-core] Failed to recreate publisher channel (connection closing): ${msg}`
         );
         throw new TransientPublishError(
-          'Publisher channel cannot be recreated because connection is closing/closed (transient condition)',
+          '[RabbitMQClient] Publisher channel cannot be recreated because connection is closing/closed (transient condition) - '
+            + 'Expected: the reconnect to restore the connection shortly. '
+            + 'Fix: retry the publish after the reconnect; PublishLayer does this on its own and buffers the message meanwhile.',
           err
         );
       }
 
       // Ostatní chyby považujeme za permanentní problém na úrovni kanálu/spojení.
-      throw new PermanentPublishError(`Failed to recreate publisher channel: ${msg}`, err);
+      throw new PermanentPublishError(
+        `[RabbitMQClient] Failed to recreate publisher channel: ${msg} - `
+          + 'Expected: createConfirmChannel() to succeed on an open connection. '
+          + 'Fix: read error.cause for the broker reason; a channel-level refusal here is not retried, so the connection must be re-established.',
+        err
+      );
     }
   }
 
@@ -730,28 +1545,19 @@ class RabbitMQClient extends EventEmitter {
    * @returns {Promise<void>}
    */
   async _ensureQueueChannel() {
-    if (this._queueChannel && !this._queueChannel.closed) {
+    if (this._isChannelAlive(this._queueChannel)) {
       return; // Channel is good
     }
-    
-    if (!this._connection || this._connection.closed) {
+
+    if (!this._connectionAlive) {
       // Connection is closed - cannot recreate channel
       // Reconnection logic will handle this - don't throw, just return
       // The channel will be recreated after reconnection completes
-      console.warn('[RabbitMQClient] [mq-client-core] Cannot recreate queue channel: connection is closed (reconnection in progress)');
+      this._logger.warn('[RabbitMQClient] [mq-client-core] Cannot recreate queue channel: connection is closed (reconnection in progress)');
       return;
     }
     
     try {
-      // Close old channel if exists
-      if (this._queueChannel) {
-        try {
-          await this._queueChannel.close();
-        } catch (_) {
-          // Ignore errors when closing already-closed channel
-        }
-      }
-      
       // Create new regular channel
       this._queueChannel = await this._connection.createChannel();
       
@@ -764,15 +1570,20 @@ class RabbitMQClient extends EventEmitter {
       // Attach event handlers
       this._attachQueueChannelHandlers(this._queueChannel);
       
-      console.log('[RabbitMQClient] [mq-client-core] ✓ Queue channel recreated');
+      this._logger.info('[RabbitMQClient] [mq-client-core] ✓ Queue channel recreated');
     } catch (err) {
       this._queueChannel = null;
       // If connection is closed, don't throw - reconnection will handle it
-      if (this._connection && !this._connection.closed) {
-        throw new Error(`Failed to recreate queue channel: ${err.message}`);
+      if (this._connectionAlive) {
+        throw new ConnectionError(
+          `[RabbitMQClient] Failed to recreate queue channel: ${err.message} - `
+            + 'Expected: createChannel() to succeed while the connection is open. '
+            + 'Fix: read error.cause for the broker reason; if the connection itself dropped, the reconnect recreates the channel.',
+          err
+        );
       }
       // Connection is closed - reconnection will recreate channel
-      console.warn(`[RabbitMQClient] [mq-client-core] Failed to recreate queue channel (connection closed): ${err.message}`);
+      this._logger.warn(`[RabbitMQClient] [mq-client-core] Failed to recreate queue channel (connection closed): ${err.message}`);
     }
   }
 
@@ -783,29 +1594,40 @@ class RabbitMQClient extends EventEmitter {
    * @returns {Promise<{reRegistered: number, failed: number}>} - Number of consumers re-registered and failed
    */
   async _ensureConsumerChannel() {
-    if (this._consumerChannel && !this._consumerChannel.closed) {
+    if (this._isChannelAlive(this._consumerChannel)) {
       // Channel is good - return current consumer state
       return { reRegistered: this._activeConsumers.size, failed: 0 };
     }
-    
-    if (!this._connection || this._connection.closed) {
-      // Connection is closed - cannot recreate channel
-      // Reconnection logic will handle this - don't throw, just return
-      // The channel will be recreated after reconnection completes
-      console.warn('[RabbitMQClient] [mq-client-core] Cannot recreate consumer channel: connection is closed (reconnection in progress)');
-      return { reRegistered: 0, failed: this._activeConsumers.size };
-    }
-    
-    try {
-      // Close old channel if exists
-      if (this._consumerChannel) {
-        try {
-          await this._consumerChannel.close();
-        } catch (_) {
-          // Ignore errors when closing already-closed channel
-        }
+
+    if (!this._connectionAlive) {
+      // Same lazy half as the publisher path: `consume()` is one of the three
+      // uses the contract names, so it starts the next recovery cycle instead of
+      // reporting every consumer as failed and leaving the client down (d.339).
+      this._logger.warn('[RabbitMQClient] [mq-client-core] Cannot recreate consumer channel: connection is closed (reconnection in progress)');
+
+      if (!this._resumeRecovery()) {
+        return { reRegistered: 0, failed: this._activeConsumers.size };
       }
-      
+
+      try {
+        await this._waitForReconnection();
+      } catch (err) {
+        this._logger.warn(
+          `[RabbitMQClient] [mq-client-core] Consumer channel waited for a recovery that did not arrive: ${err.message}`
+        );
+        return { reRegistered: 0, failed: this._activeConsumers.size };
+      }
+
+      if (this._isChannelAlive(this._consumerChannel)) {
+        // The recovery recreated it and re-registered what was tracked.
+        return { reRegistered: this._activeConsumers.size, failed: 0 };
+      }
+      if (!this._connectionAlive) {
+        return { reRegistered: 0, failed: this._activeConsumers.size };
+      }
+    }
+    
+    try {
       // Create new regular channel
       this._consumerChannel = await this._connection.createChannel();
       
@@ -821,16 +1643,31 @@ class RabbitMQClient extends EventEmitter {
       // Re-register all active consumers
       const { reRegistered, failed } = await this._reRegisterConsumers();
       
-      console.log(`[RabbitMQClient] [mq-client-core] ✓ Consumer channel recreated (re-registered: ${reRegistered}, failed: ${failed})`);
+      this._logger.info(`[RabbitMQClient] [mq-client-core] ✓ Consumer channel recreated (re-registered: ${reRegistered}, failed: ${failed})`);
       return { reRegistered, failed };
     } catch (err) {
       this._consumerChannel = null;
-      throw new Error(`Failed to recreate consumer channel: ${err.message}`);
+      throw new ConnectionError(
+        `[RabbitMQClient] Failed to recreate consumer channel: ${err.message} - `
+          + 'Expected: createChannel() and the consumer re-registration to succeed while the connection is open. '
+          + 'Fix: read error.cause for the broker reason; consumers are re-registered automatically on the next reconnect.',
+        err
+      );
     }
   }
 
   /**
-   * Internal helper to re-register all active consumers on the current consumer channel
+   * Re-register every tracked consumer on the current consumer channel.
+   *
+   * The queue step is NOT repeated here: it is `_prepareQueueForConsume()`, the
+   * same rail the first `consume()` runs, so a re-registration classifies,
+   * declares and refuses exactly what the first attachment did. The copy this
+   * replaced asserted every tracked queue unconditionally — declaring queues the
+   * consumer does not own — and answered a 406 by DELETING the consumer from
+   * tracking, which made the eviction permanent: nothing re-registered it before
+   * the process restarted. A failure now leaves the consumer tracked, so the
+   * next channel recreate tries again (d.262).
+   *
    * @private
    * @returns {Promise<{reRegistered: number, failed: number}>}
    */
@@ -838,43 +1675,23 @@ class RabbitMQClient extends EventEmitter {
     let reRegistered = 0;
     let failed = 0;
 
-    if (!this._consumerChannel || this._consumerChannel.closed) {
+    if (!this._isChannelAlive(this._consumerChannel)) {
       return { reRegistered: 0, failed: this._activeConsumers.size };
     }
 
     if (this._activeConsumers.size > 0) {
-      console.log(`[RabbitMQClient] [mq-client-core] Re-registering ${this._activeConsumers.size} consumers...`);
+      this._logger.info(`[RabbitMQClient] [mq-client-core] Re-registering ${this._activeConsumers.size} consumers...`);
       for (const [queue, consumerInfo] of this._activeConsumers.entries()) {
         try {
-          // Re-assert queue with correct options before consuming (may have been deleted)
-          if (consumerInfo.options.queueOptions) {
-            try {
-              await this._ensureQueueChannel();
-              if (!this._queueChannel || this._queueChannel.closed) {
-                throw new Error('Queue channel is not available (connection may be closed)');
-              }
-              this._trackChannelOperation(this._queueChannel, `assertQueue ${queue} (re-register)`);
-              await this._queueChannel.assertQueue(queue, consumerInfo.options.queueOptions);
-            } catch (assertErr) {
-              if (assertErr.code === 404) {
-                console.warn(`[RabbitMQClient] [mq-client-core] Queue ${queue} does not exist, skipping consumer re-registration`);
-                this._activeConsumers.delete(queue);
-                failed++;
-                this.emit('consumer:re-registration:failed', { queue, error: 'Queue does not exist', code: 404 });
-                continue;
-              }
-              // 406 error means queue exists with different args - skip this consumer
-              if (assertErr.code === 406) {
-                console.warn(`[RabbitMQClient] [mq-client-core] Queue ${queue} exists with different args, skipping consumer re-registration`);
-                this._activeConsumers.delete(queue);
-                failed++;
-                this.emit('consumer:re-registration:failed', { queue, error: 'Queue exists with different arguments', code: 406 });
-                continue;
-              }
-              throw assertErr;
-            }
-          }
-          
+          await this._prepareQueueForConsume(queue, {
+            durable: consumerInfo.options.durable,
+            queueOptions: consumerInfo.options.queueOptions
+          });
+
+          // The consumer's prefetch is re-applied here for the same reason the
+          // queue step is: the channel is new, and QoS lives on the channel.
+          await this._applyConsumerPrefetch(queue, consumerInfo.options.prefetch);
+
           const consumeResult = await this._consumerChannel.consume(
             queue,
             consumerInfo.handler,
@@ -882,14 +1699,31 @@ class RabbitMQClient extends EventEmitter {
           );
           consumerInfo.consumerTag = consumeResult.consumerTag;
           reRegistered++;
-          console.log(`[RabbitMQClient] [mq-client-core] ✓ Re-registered consumer for queue: ${queue} (consumerTag: ${consumeResult.consumerTag})`);
+          this._logger.info(`[RabbitMQClient] [mq-client-core] \u2713 Re-registered consumer for queue: ${queue} (consumerTag: ${consumeResult.consumerTag})`);
         } catch (err) {
           failed++;
-          console.error(`[RabbitMQClient] [mq-client-core] Failed to re-register consumer for queue ${queue}:`, err.message);
-          // Remove failed consumer from tracking
-          this._activeConsumers.delete(queue);
-          // Emit event for re-registration failure
-          this.emit('consumer:re-registration:failed', { queue, error: err.message, code: err.code });
+          this._logger.error(`[RabbitMQClient] [mq-client-core] Failed to re-register consumer for queue ${queue}:`, err.message);
+          // The consumer STAYS tracked. Whatever refused it — a 406 against the
+          // owner's declaration, a missing infrastructure queue, a channel that
+          // went away mid-flight — is a condition somebody fixes at its source,
+          // and the next recreate must find the consumer still on the list.
+          //
+          // Its TAG does not stay, and the two are not the same fact (d.386b). A
+          // consumer tag names an attachment on ONE channel; the channel that
+          // issued this one is gone and the new one refused to re-attach, so the
+          // string the entry carried names nothing on the broker. Two readers
+          // took it for an attachment that exists: `_performHealthCheck()` counts
+          // `active` by "is the tag set", so a client whose only consumer had
+          // just been refused reported `healthy: true` and `1/1 consumers active`
+          // — the false OK d.386 exists to end, one layer below where d.386 could
+          // reach it; and `cancelConsumer()` sent `basic.cancel` with it, asking
+          // the broker to stop a consumer it does not hold.
+          consumerInfo.consumerTag = null;
+          // The broker's own code is what a listener acts on (406 = the queue
+          // exists with different arguments), and the rail wraps it in a typed
+          // error, so it is read from the cause when the wrapper carries none.
+          const code = err.code !== undefined ? err.code : (err.cause ? err.cause.code : undefined);
+          this.emit('consumer:re-registration:failed', { queue, error: err.message, code });
         }
       }
     }
@@ -913,13 +1747,13 @@ class RabbitMQClient extends EventEmitter {
       try {
         await this._performHealthCheck();
       } catch (err) {
-        console.error(`[RabbitMQClient] [mq-client-core] Health check error:`, err.message);
+        this._logger.error(`[RabbitMQClient] [mq-client-core] Health check error:`, err.message);
         // Emit event for external monitoring
         this.emit('health:check:error', err);
       }
     }, this._healthCheckIntervalMs);
     
-    console.log(`[RabbitMQClient] [mq-client-core] Health monitoring started (interval: ${this._healthCheckIntervalMs}ms)`);
+    this._logger.info(`[RabbitMQClient] [mq-client-core] Health monitoring started (interval: ${this._healthCheckIntervalMs}ms)`);
   }
   
   /**
@@ -930,7 +1764,7 @@ class RabbitMQClient extends EventEmitter {
     if (this._healthCheckInterval) {
       clearInterval(this._healthCheckInterval);
       this._healthCheckInterval = null;
-      console.log('[RabbitMQClient] [mq-client-core] Health monitoring stopped');
+      this._logger.info('[RabbitMQClient] [mq-client-core] Health monitoring stopped');
     }
   }
   
@@ -941,6 +1775,16 @@ class RabbitMQClient extends EventEmitter {
    * @returns {Promise<Object>} Health check results
    */
   async performHealthCheck() {
+    // A health check by the SERVICE is a use, and the third the contract names:
+    // it starts the next recovery cycle if this client stood down (d.339). It
+    // does not WAIT for it — a health check owes its caller the state now, not
+    // after a backoff — so the answer it returns is "not connected, recovering",
+    // and the next one tells whether the cycle worked.
+    //
+    // The internal monitor calls `_performHealthCheck()` instead, deliberately:
+    // a timer resuming recovery would make the retry periodic, which is the
+    // opposite of the lazy contract.
+    this._resumeRecovery();
     return this._performHealthCheck();
   }
   
@@ -952,22 +1796,26 @@ class RabbitMQClient extends EventEmitter {
   async _performHealthCheck() {
     const health = {
       timestamp: new Date().toISOString(),
+      // Liveness comes from the ONE source the handlers set first-hand
+      // (`isConnected()` / `_isChannelAlive()`, d.260) — never from `closed`, a
+      // property amqplib does not define, which read `undefined` and made this
+      // check report `healthy: true` for a channel the broker had killed.
       connection: {
         exists: !!this._connection,
-        closed: this._connection ? this._connection.closed : true
+        closed: !this.isConnected()
       },
       channels: {
         publisher: {
           exists: !!this._channel,
-          closed: this._channel ? this._channel.closed : true
+          closed: !this._isChannelAlive(this._channel)
         },
         queue: {
           exists: !!this._queueChannel,
-          closed: this._queueChannel ? this._queueChannel.closed : true
+          closed: !this._isChannelAlive(this._queueChannel)
         },
         consumer: {
           exists: !!this._consumerChannel,
-          closed: this._consumerChannel ? this._consumerChannel.closed : true
+          closed: !this._isChannelAlive(this._consumerChannel)
         }
       },
       consumers: {
@@ -1005,7 +1853,7 @@ class RabbitMQClient extends EventEmitter {
     }
     
     // Check tracked consumers - verify queues exist and have active consumers
-    if (this._connection && !this._connection.closed && this._queueChannel && !this._queueChannel.closed) {
+    if (this.isConnected() && this._isChannelAlive(this._queueChannel)) {
       for (const [queue, consumerInfo] of this._activeConsumers.entries()) {
         health.queues.checked++;
         try {
@@ -1013,9 +1861,16 @@ class RabbitMQClient extends EventEmitter {
           this._trackChannelOperation(this._queueChannel, `checkQueue ${queue}`);
           const queueInfo = await this._queueChannel.checkQueue(queue);
           if (queueInfo) {
-            // Queue exists - check if consumer is active
-            // Note: RabbitMQ doesn't provide direct API to check if consumer is active
-            // We can only verify that consumerTag is set
+            // Queue exists - is THIS client's consumer attached to it?
+            //
+            // The tag is what answers, because it is the only fact that is about
+            // this client. `checkQueue()` does return `consumerCount` — the
+            // comment that stood here said RabbitMQ offers no way to ask, which
+            // is not true — but that number counts every consumer on the queue,
+            // this client's and everybody else's alike, so it cannot say whether
+            // the one asking is among them. The tag can: it is the name the
+            // broker gave THIS client's attachment, and since d.386b it is set
+            // only while that attachment exists.
             if (consumerInfo.consumerTag) {
               health.consumers.active++;
             } else {
@@ -1042,18 +1897,43 @@ class RabbitMQClient extends EventEmitter {
       }
     }
     
+    // A client that TRACKS consumers and has NONE attached consumes nothing, and
+    // that is its own verdict — not something a reader infers from two numbers
+    // sitting beside the channel findings. The per-queue issues above name WHICH
+    // queue lost its consumer, and they do not always exist: when the probe loop
+    // does not run (no connection, or a dead queue channel) the snapshot's only
+    // consumer evidence is `tracked` and `active`, and every issue names a
+    // channel instead. Measured 2026-09-08 (INFRA-monitoring): the whole account
+    // a reader got of a client taking no message off any queue was the line
+    // `Health check OK: 0/0 consumers active`.
+    //
+    // `tracked === 0` is a different client, not a lesser failure: a publisher
+    // registered no consumer and has none to lose. It stays healthy, and the OK
+    // line below says which of the two it is.
+    if (health.consumers.tracked > 0 && health.consumers.active === 0) {
+      health.healthy = false;
+      health.issues.push(
+        '[RabbitMQClient] No consumer of this client is attached - '
+          + `${health.consumers.tracked} consumer(s) tracked, 0 attached. `
+          + 'Expected: every consumer this client registered attached to the consumer channel. '
+          + 'Fix: none here - the issues beside this one name what stopped them (a dead channel, a '
+          + 'missing queue, a re-registration the broker refused); until one of those is resolved '
+          + 'this client takes no message off any queue.'
+      );
+    }
+
     // Emit health check result
     this.emit('health:check', health);
     
     // If unhealthy, log and potentially trigger shutdown
     if (!health.healthy) {
-      console.error(`[RabbitMQClient] [mq-client-core] Health check FAILED:`, health.issues);
-      console.error(`[RabbitMQClient] [mq-client-core] Health details:`, JSON.stringify(health, null, 2));
+      this._logger.error(`[RabbitMQClient] [mq-client-core] Health check FAILED:`, health.issues);
+      this._logger.error(`[RabbitMQClient] [mq-client-core] Health details:`, JSON.stringify(health, null, 2));
       
       // Track critical health start time
       if (!this._criticalHealthStartTime) {
         this._criticalHealthStartTime = Date.now();
-        console.error(`[RabbitMQClient] [mq-client-core] Critical health detected at ${new Date(this._criticalHealthStartTime).toISOString()}`);
+        this._logger.error(`[RabbitMQClient] [mq-client-core] Critical health detected at ${new Date(this._criticalHealthStartTime).toISOString()}`);
       }
       
       // Report to monitoring if callback provided
@@ -1061,7 +1941,7 @@ class RabbitMQClient extends EventEmitter {
         try {
           await this._healthReportCallback(health);
         } catch (reportErr) {
-          console.error(`[RabbitMQClient] [mq-client-core] Health report callback failed:`, reportErr.message);
+          this._logger.error(`[RabbitMQClient] [mq-client-core] Health report callback failed:`, reportErr.message);
         }
       }
       
@@ -1070,7 +1950,7 @@ class RabbitMQClient extends EventEmitter {
         try {
           await this._healthCriticalCallback(health);
         } catch (criticalErr) {
-          console.error(`[RabbitMQClient] [mq-client-core] Critical health callback failed:`, criticalErr.message);
+          this._logger.error(`[RabbitMQClient] [mq-client-core] Critical health callback failed:`, criticalErr.message);
         }
       }
       
@@ -1081,31 +1961,57 @@ class RabbitMQClient extends EventEmitter {
       if (this._criticalHealthShutdown) {
         const timeSinceCritical = Date.now() - this._criticalHealthStartTime;
         if (timeSinceCritical >= this._criticalHealthShutdownDelay) {
-          console.error(`[RabbitMQClient] [mq-client-core] Critical health persisted for ${timeSinceCritical}ms (threshold: ${this._criticalHealthShutdownDelay}ms) - triggering shutdown`);
+          this._logger.error(`[RabbitMQClient] [mq-client-core] Critical health persisted for ${timeSinceCritical}ms (threshold: ${this._criticalHealthShutdownDelay}ms) - triggering shutdown`);
           this.emit('health:shutdown', health);
           // Note: Actual shutdown should be handled by the application using this event
         } else {
           const remaining = this._criticalHealthShutdownDelay - timeSinceCritical;
-          console.warn(`[RabbitMQClient] [mq-client-core] Critical health will trigger shutdown in ${remaining}ms if not resolved`);
+          this._logger.warn(`[RabbitMQClient] [mq-client-core] Critical health will trigger shutdown in ${remaining}ms if not resolved`);
         }
       }
     } else {
       // Health is OK - reset critical health tracking
       if (this._criticalHealthStartTime) {
         const duration = Date.now() - this._criticalHealthStartTime;
-        console.log(`[RabbitMQClient] [mq-client-core] Health recovered after ${duration}ms of critical state`);
+        this._logger.info(`[RabbitMQClient] [mq-client-core] Health recovered after ${duration}ms of critical state`);
         this._criticalHealthStartTime = null;
       }
       
-      console.log(`[RabbitMQClient] [mq-client-core] Health check OK: ${health.consumers.active}/${health.consumers.tracked} consumers active, ${health.queues.checked} queues checked`);
+      // `0/0` said two different things and distinguished neither: a publisher
+      // that never registered a consumer, and a client whose consumers are all
+      // gone. The second one no longer reaches this branch at all (it is a
+      // failure now), so the line only has to name the first one plainly.
+      const consumers = health.consumers.tracked === 0
+        ? 'no consumers registered - this client only publishes'
+        : `${health.consumers.active}/${health.consumers.tracked} consumers active`;
+      this._logger.debug(`[RabbitMQClient] [mq-client-core] Health check OK: ${consumers}, ${health.queues.checked} queues checked`);
     }
     
     return health;
   }
 
+  /**
+   * End this client: stop recovery, stop monitoring, close the three channels
+   * and the connection, in reverse creation order.
+   *
+   * CONTRACT — an intentional close is not a fault. From the first line of this
+   * method the client is closed BY ITS CALLER, and that state is terminal: no
+   * `close` frame, no `error` frame and no recovery round already in flight
+   * brings the connection back. When this method resolves, the client holds no
+   * timer, no socket and no channel, `isConnected()` answers `false`, and the
+   * process is free to exit. Only an explicit `connect()` re-arms recovery.
+   *
+   * Idempotent: a second call finds nothing left to close and does nothing.
+   *
+   * @returns {Promise<void>}
+   */
   async disconnect() {
-    this._disconnecting = true;
-    
+    this._closedByCaller = true;
+    // From this point the client is not connected, whatever the sockets are still
+    // doing: the state says so before the first `close()` is awaited, so nothing
+    // reads "alive" out of a teardown in progress.
+    this._connectionAlive = false;
+
     // Clear all active timers (reconnection, waits, etc.)
     this._clearAllTimers();
     
@@ -1121,95 +2027,476 @@ class RabbitMQClient extends EventEmitter {
     // Clear prefetch tracking
     this._prefetchTracking.clear();
     
-    try {
-      if (this._consumerChannel) {
-        await this._consumerChannel.close();
-        this._consumerChannel = null;
-      }
-    } catch (err) {
-      console.warn('[RabbitMQClient] Error closing consumer channel:', err.message);
+    // ONE budget for the whole teardown. Every close below waits for an answer
+    // from the broker — a `close-ok` frame — and a socket that is OPEN but
+    // carries nothing never delivers one; amqplib clears its heartbeat watchdog
+    // the moment a close begins, so nothing else ends the wait either. Measured
+    // through a TCP proxy that keeps the socket open and forwards nothing:
+    // `disconnect()` was still pending after 335 s (d.287). The budget is one
+    // deadline for the teardown, not one per handle — the contract is that
+    // `disconnect()` ends, not that each of four closes ends.
+    const teardownDeadline = Date.now() + this._brokerAnswerTimeout;
+    const remaining = () => Math.max(0, teardownDeadline - Date.now());
+    let socketUnanswered = false;
+    const connection = this._connection;
+
+    const consumerOutcome = await this._closeWithinTeardownBudget(
+      'consumer channel',
+      this._consumerChannel,
+      remaining()
+    );
+    this._consumerChannel = null;
+    if (consumerOutcome.status === 'refused') {
+      this._logger.warn('[RabbitMQClient] Error closing consumer channel:', consumerOutcome.error.message);
     }
-    try {
-      if (this._queueChannel) {
-        await this._queueChannel.close();
-        this._queueChannel = null;
-      }
-    } catch (err) {
+    socketUnanswered = socketUnanswered || consumerOutcome.status === 'unanswered';
+
+    const queueOutcome = await this._closeWithinTeardownBudget(
+      'queue channel',
+      this._queueChannel,
+      remaining()
+    );
+    this._queueChannel = null;
+    if (queueOutcome.status === 'refused') {
       // Log but don't emit - queue channel errors are less critical
-      console.warn('[RabbitMQClient] Error closing queue channel:', err.message);
+      this._logger.warn('[RabbitMQClient] Error closing queue channel:', queueOutcome.error.message);
     }
-    try {
-      if (this._channel) {
-        await this._channel.close();
-        this._channel = null;
-      }
-    } catch (err) {
-      this.emit('error', err);
+    socketUnanswered = socketUnanswered || queueOutcome.status === 'unanswered';
+
+    const publisherOutcome = await this._closeWithinTeardownBudget(
+      'publisher channel',
+      this._channel,
+      remaining()
+    );
+    this._channel = null;
+    if (publisherOutcome.status === 'refused') {
+      this.emit('error', publisherOutcome.error);
     }
-    try {
-      if (this._connection) {
-        await this._connection.close();
-        this._connection = null;
-      }
-    } catch (err) {
+    socketUnanswered = socketUnanswered || publisherOutcome.status === 'unanswered';
+
+    const connectionOutcome = await this._closeWithinTeardownBudget(
+      'connection',
+      this._connection,
+      remaining()
+    );
+    this._connection = null;
+    if (connectionOutcome.status === 'refused') {
       // Don't emit error for expected connection closure during disconnect
       // This is a predictable, intentional closure
-      if (err.message && err.message.includes('Connection closed (by client)')) {
-        console.log('[RabbitMQClient] Connection closed during disconnect (expected)');
+      if (connectionOutcome.error.message && connectionOutcome.error.message.includes('Connection closed (by client)')) {
+        this._logger.info('[RabbitMQClient] Connection closed during disconnect (expected)');
       } else {
-        this.emit('error', err);
+        this.emit('error', connectionOutcome.error);
       }
     }
-    this._disconnecting = false;
+    socketUnanswered = socketUnanswered || connectionOutcome.status === 'unanswered';
+
+    // A teardown that returns while its socket is still open keeps the process
+    // alive — the very defect d.283 and d.285 were both about. So when the
+    // broker never answered, the socket is not left behind: amqplib would have
+    // ended it itself on a graceful close, and only then.
+    if (socketUnanswered) {
+      this._dropUnansweredConnection(connection);
+    }
+    // Second sweep, and the one that matters: the first happened before the
+    // awaits above, and anything the transport scheduled while they ran — a
+    // backoff wait, a connect timeout — would otherwise outlive the teardown
+    // that was supposed to end it.
+    this._clearAllTimers();
   }
 
   /**
    * Ensure a queue exists with correct parameters (TTL/DLQ/etc).
-   * This is required by higher-level routing libraries (e.g. cookbook-router QueueManager).
+   *
+   * PUBLIC: this is the one operation a collaborator needs in order to declare a
+   * queue on this client — higher-level routing libraries (cookbook-router's
+   * QueueManager) and `workers/RecoveryWorker.js` alike. It owns the whole
+   * sequence, so nobody has to assemble it out of private members: ensure the
+   * queue channel, refuse a channel that is not alive, resolve the arguments
+   * from the central `queueConfig`, declare.
+   *
+   * OPTIONS ARE A DECLARED SET, and everything outside it is refused by name.
+   * Until d.396c this method rebuilt `queueOptions` from `durable` and
+   * `arguments` and dropped every other key the caller wrote, without a word:
+   * a suite asking for `{ durable: false, exclusive: true }` got a queue the
+   * broker reported as `"exclusive": false`, believed it had declared one that
+   * dies with its connection, and left it standing with 0 consumers when the run
+   * was interrupted. A silently ignored option is worse than a rejected one —
+   * the caller acts on a guarantee nobody gave (`architecture-principles.md` §4
+   * fail-fast, §8 explicit over implicit). The refusal is the shape the config
+   * schema has used since d.291b: the key by name, and the declared key it is
+   * closest to (`utils/nearestKey.js`, shared with `BaseClient`).
+   *
+   * `exclusive` and `autoDelete` joined `durable` and `arguments` in that set
+   * because they are how a caller states a queue's LIFETIME, and no other rail
+   * offers it: a temporary queue that does not die with the thing that made it
+   * is residue on a shared broker.
+   *
+   * The central `queueConfig` keeps its ownership undiminished. For an
+   * infrastructure or business name it decides `durable` and `arguments` as
+   * before — and a LIFETIME asked for on such a name is refused rather than
+   * quietly overruled, because those queues outlive the connection that declares
+   * them by design.
    *
    * @param {string} queue - Queue name
-   * @param {Object} [options]
+   * @param {Object} [options] - `durable`, `arguments`, `exclusive`, `autoDelete`
+   *   for a queue the central config does not classify; for an infrastructure or
+   *   business queue the config's own declaration wins over `durable` and
+   *   `arguments`, and the two lifetime keys are refused. Any other key is refused.
    * @returns {Promise<Object>} amqplib assertQueue result
+   * @throws {Error} If `options` carries a key this operation does not read.
    */
   async assertQueue(queue, options = {}) {
+    // Both refusals come BEFORE the channel is touched: an option this operation
+    // cannot honour is a caller mistake, and the broker has nothing to do with it.
+    this._refuseUndeclaredQueueOptions(options);
+
+    // Central queueConfig decides the arguments (fail-fast queue argument consistency).
+    // The try/catch that used to wrap this block existed only for the lazy require —
+    // its own comment said so ("If queueConfig cannot be loaded") — and with the module
+    // loaded at the top there is nothing left for it to catch except a genuine error
+    // from the config itself, which must not be swallowed.
+    // ONE function answers "what is this queue declared with", for every path that
+    // declares a queue — this rail and the consumer's `_prepareQueueForConsume()`
+    // (d.410). Until then each rebuilt `{ durable: cfg.durable !== false,
+    // arguments: { ...cfg.arguments } }` from its own lookup, which is one concern
+    // on two rails (`change-discipline.md` § One rail per concern): edit one copy
+    // and the broker answers whichever declarer it hears second with
+    // `406 PRECONDITION_FAILED`.
+    const declared = queueConfig.declarationOptions(queue);
+
+    let queueOptions;
+
+    if (declared !== null) {
+      this._refuseCallerLifetime(queue, options);
+      queueOptions = declared;
+    } else {
+      queueOptions = {
+        durable: options.durable !== false,
+        arguments: { ...(options.arguments || {}) }
+      };
+
+      // Omitted, never sent as `false`: amqplib leaves out what it is not given,
+      // and an explicit `false` would make every re-declaration of an existing
+      // queue carry a value its first declaration never had.
+      for (const key of LIFETIME_QUEUE_OPTION_KEYS) {
+        if (options[key] !== undefined) {
+          queueOptions[key] = options[key];
+        }
+      }
+    }
+
+    const channel = await this._requireQueueChannel('assertQueue', queue);
+
+    return await channel.assertQueue(queue, queueOptions);
+  }
+
+  /**
+   * Refuse an option `assertQueue()` does not read, by name.
+   *
+   * @param {Object} options - what the caller passed.
+   * @throws {Error} naming every undeclared key and the declared key it is closest to.
+   * @private
+   */
+  _refuseUndeclaredQueueOptions(options) {
+    const unknown = Object.keys(options).filter(
+      (key) => !ASSERT_QUEUE_OPTION_KEYS.includes(key)
+    );
+
+    if (unknown.length === 0) {
+      return;
+    }
+
+    throw new Error(
+      `[RabbitMQClient] Queue option not declared by assertQueue(): `
+        + `${nameUnknownKeys(unknown, ASSERT_QUEUE_OPTION_KEYS)} - `
+        + `Expected: only ${ASSERT_QUEUE_OPTION_KEYS.join(', ')}. `
+        + 'Fix: correct the spelling, or remove the key - an option this operation does not read '
+        + 'declares nothing, and the queue the broker creates is not the queue the caller asked for.'
+    );
+  }
+
+  /**
+   * Refuse a lifetime asked for on a queue whose declaration the central config
+   * owns. Overruling it in silence is the defect this whole method was fixed for,
+   * one name further along.
+   *
+   * @param {string} queue - the classified queue name.
+   * @param {Object} options - what the caller passed.
+   * @throws {Error} naming the lifetime keys the caller wrote.
+   * @private
+   */
+  _refuseCallerLifetime(queue, options) {
+    const asked = LIFETIME_QUEUE_OPTION_KEYS.filter((key) => options[key] !== undefined);
+
+    if (asked.length === 0) {
+      return;
+    }
+
+    throw new Error(
+      `[RabbitMQClient] Queue lifetime is not the caller's to set for "${queue}": `
+        + `${asked.join(', ')} - Expected: the central queueConfig owns the declaration of every `
+        + 'infrastructure and business queue, including how long it lives. '
+        + 'Fix: drop the option - this queue outlives the connection that declares it, by design; '
+        + "a queue whose lifetime is the caller's is one queueConfig does not classify."
+    );
+  }
+
+  /**
+   * The one rail to the queue channel: ensure it, refuse it unless it is alive,
+   * record the operation for the post-mortem, hand it back.
+   *
+   * All four public queue operations (`assertQueue`, `checkQueue`, `purgeQueue`,
+   * `deleteQueue`) share one precondition, so they share one implementation of
+   * it. `_ensureQueueChannel()` alone is not that precondition: it returns
+   * without recreating anything while the connection is down, leaving the dead
+   * reference in place — so EXISTENCE of the reference is not the question,
+   * liveness is, read from the one source (`_isChannelAlive`, d.260).
+   *
+   * Until d.282 only `assertQueue()` asked that question (d.277b). The other
+   * three asked `if (!this._queueChannel)`, which a corpse answers exactly like
+   * a live channel, and then ran the operation on it — the caller got amqplib's
+   * bare "Channel closed" instead of a sentence naming the fix
+   * (`architecture-principles.md` §5). `checkQueue()` is also the operation that
+   * CAUSES those deaths: a 404 on a missing queue is a channel-level failure and
+   * closes the channel by AMQP rule.
+   *
+   * `_trackChannelOperation()` belongs here for the same reason: the channels
+   * most likely to die are the ones a queue operation is running on, and until
+   * this rail existed three of the four left `channel._lastOperation` unwritten,
+   * so the post-mortem in `getChannelState()` had nothing to report.
+   *
+   * @param {string} verb - the public operation asking, used in the refusal and
+   *   in `channel._lastOperation`
+   * @param {string} queue - the queue it is about
+   * @returns {Promise<Object>} the live queue channel
+   * @throws {ConnectionError} when no live queue channel can be had
+   * @private
+   */
+  async _requireQueueChannel(verb, queue) {
     await this._ensureQueueChannel();
-    if (!this._queueChannel) {
-      throw new Error('Cannot assertQueue: queue channel is not initialized');
+    if (!this._isChannelAlive(this._queueChannel)) {
+      throw new ConnectionError(
+        `[RabbitMQClient] Cannot ${verb} ${queue}: queue channel is not available - `
+          + 'Expected: an open queue channel after _ensureQueueChannel(). '
+          + `Fix: await client.connect() before ${verb}(); if the connection dropped, wait for `
+          + 'the reconnect to recreate the channel and run the operation again.'
+      );
+    }
+    this._trackChannelOperation(this._queueChannel, `${verb} ${queue}`);
+    return this._queueChannel;
+  }
+
+  /**
+   * The publish path's dialect of the queue-channel rail's refusal.
+   *
+   * `_requireQueueChannel()` answers `ConnectionError`, which on every other
+   * path means "this is over". On the publish path it means the opposite: the
+   * channel is missing because the connection is being restored, so the message
+   * is not lost — PublishLayer buffers it and retries after the reconnect. That
+   * is why the publish path translates rather than propagates.
+   *
+   * ONE place builds that translation, because there are two sites needing it
+   * (the pre-publish existence check and the declaration of a missing ownerless
+   * queue) and a sentence maintained twice diverges.
+   *
+   * @param {string} verb - the operation the publish path was about to run
+   * @param {string} queue
+   * @param {ConnectionError} cause - the rail's refusal
+   * @returns {TransientPublishError}
+   * @private
+   */
+  _publishPathTransient(verb, queue, cause) {
+    return new TransientPublishError(
+      `[RabbitMQClient] Cannot ${verb} ${queue}: queue channel is not available (connection may be closed) - `
+        + `Expected: an open queue channel before ${verb} on the publish path. `
+        + 'Fix: retry the publish after the reconnect; PublishLayer does this on its own and buffers the message meanwhile.',
+      cause
+    );
+  }
+
+  /**
+   * Declare an exchange.
+   *
+   * Public since d.302: confirmation `mq-client-lifecycle-contract` 001 point 4
+   * ("L8") names it as one of the four operations a service must be able to
+   * reach through this library. Until then the only `assertExchange` in the
+   * package was a private line on the publish path, so a service that had to
+   * declare an exchange reached around the library for a raw amqplib channel —
+   * the drift `mq-consumer-contract` 001 records as DL-007.
+   *
+   * It runs on the QUEUE channel, like `assertQueue()` and the other three queue
+   * operations: declaring topology is what that channel is for, and a rejected
+   * declaration (406 against an existing exchange of another type) must close
+   * that channel rather than the publisher's ConfirmChannel, which carries
+   * unconfirmed messages.
+   *
+   * @param {string} exchange - Exchange name; a non-empty string.
+   * @param {string} type - `direct`, `topic`, `fanout` or `headers`. Required:
+   *   an exchange's type is a topology decision the caller makes, and guessing
+   *   one here would declare a different exchange from the one they meant.
+   * @param {Object} [options] - amqplib exchange options. `durable` defaults to
+   *   the client's configured `durable`, never to a literal.
+   * @returns {Promise<Object>} amqplib's `assertExchange` result.
+   * @throws {ValidationError} If the name or the type cannot declare an exchange.
+   * @throws {ConnectionError} If no live queue channel can be had.
+   */
+  async assertExchange(exchange, type, options = {}) {
+    if (typeof exchange !== 'string' || exchange.trim() === '') {
+      throw new ValidationError(
+        '[RabbitMQClient] Invalid exchange name - Expected: a non-empty string, got '
+          + `${JSON.stringify(exchange)}. Fix: pass assertExchange('<exchange>', '<type>').`
+      );
+    }
+    if (!EXCHANGE_TYPES.includes(type)) {
+      throw new ValidationError(
+        `[RabbitMQClient] Invalid exchange type - Expected one of ${EXCHANGE_TYPES.join(', ')}, got `
+          + `${JSON.stringify(type)}. Fix: pass assertExchange('${exchange}', '<type>'); an exchange's `
+          + 'type is a topology decision, so this library does not choose one for you.'
+      );
     }
 
-    let queueOptions = {
-      durable: options.durable !== false,
-      arguments: { ...(options.arguments || {}) }
+    const channel = await this._requireQueueChannel('assertExchange', exchange);
+    const exchangeOptions = {
+      ...options,
+      durable: options.durable !== undefined ? options.durable : this._config.durable
     };
+    return await channel.assertExchange(exchange, type, exchangeOptions);
+  }
 
-    // Prefer central queueConfig (fail-fast queue argument consistency)
-    try {
-      const queueConfig = require('../config/queueConfig');
-      const isInfraQueue = queueConfig ? queueConfig.isInfrastructureQueue(queue) : false;
-      const isBusinessQueue = queueConfig ? queueConfig.isBusinessQueue(queue) : false;
-
-      if (isInfraQueue) {
-        const infraConfig = queueConfig.getInfrastructureQueueConfig(queue);
-        queueOptions = {
-          durable: infraConfig.durable !== false,
-          arguments: { ...infraConfig.arguments }
-        };
-      } else if (isBusinessQueue) {
-        const parsed = queueConfig.parseBusinessQueue(queue);
-        if (parsed) {
-          const businessConfig = queueConfig.getBusinessQueueConfig(parsed.queueType, parsed.serviceName);
-          queueOptions = {
-            durable: businessConfig.durable !== false,
-            arguments: { ...businessConfig.arguments }
-          };
+  /**
+   * Bind a queue to an exchange under a routing pattern.
+   *
+   * Public since d.302, for the same reason and on the same channel as
+   * `assertExchange()` above. The binding is what makes a fanout or topic
+   * exchange reach a queue at all, so a library that declares exchanges and
+   * queues but cannot bind them leaves every consumer of an exchange-routed
+   * queue reaching for a raw channel.
+   *
+   * @param {string} queue - Queue to bind; a non-empty string.
+   * @param {string} exchange - Exchange to bind it to; a non-empty string.
+   * @param {string} pattern - Routing pattern / key. REQUIRED, and an empty
+   *   string is a legal value (a fanout exchange ignores the key): which key a
+   *   binding carries is a decision, and defaulting it would bind a queue to
+   *   traffic nobody asked for.
+   * @returns {Promise<Object>} amqplib's `bindQueue` result.
+   * @throws {ValidationError} If a name or the pattern cannot form a binding.
+   * @throws {ConnectionError} If no live queue channel can be had.
+   */
+  async bindQueue(queue, exchange, pattern) {
+    if (typeof queue !== 'string' || queue.trim() === '') {
+      throw new ValidationError(
+        '[RabbitMQClient] Invalid queue name for binding - Expected: a non-empty string, got '
+          + `${JSON.stringify(queue)}. Fix: pass bindQueue('<queue>', '<exchange>', '<pattern>').`
+      );
+    }
+    if (typeof exchange !== 'string' || exchange.trim() === '') {
+      throw new ValidationError(
+        '[RabbitMQClient] Invalid exchange name for binding - Expected: a non-empty string, got '
+          + `${JSON.stringify(exchange)}. Fix: pass bindQueue('${queue}', '<exchange>', '<pattern>').`
+      );
+    }
+    if (typeof pattern !== 'string') {
+      throw new ValidationError(
+        '[RabbitMQClient] Invalid binding pattern - Expected: a string (the empty string is legal, '
+          + `a fanout exchange ignores the key), got ${JSON.stringify(pattern)}. Fix: pass `
+          + `bindQueue('${queue}', '${exchange}', '<pattern>') — this library does not guess a routing key.`
+      );
+    }
+
+    const channel = await this._requireQueueChannel('bindQueue', `${queue} -> ${exchange}`);
+    return await channel.bindQueue(queue, exchange, pattern);
+  }
+
+  /**
+   * Stop one consumer this client registered, by its consumer tag or by the
+   * queue it consumes.
+   *
+   * Public since d.302 ("L8"). The tag is the broker's name for the consumer and
+   * is what `consume()` returns; the queue name is what the caller usually still
+   * has at hand, so both are accepted and resolved against the ONE registry of
+   * live consumers this client keeps (`_activeConsumers`).
+   *
+   * The consumer is also DROPPED from that registry, not merely cancelled on the
+   * broker. The registry is what connection-level recovery re-attaches after a
+   * reconnect (`_reRegisterConsumers()`), so a cancelled consumer left in it
+   * would come back on the next outage — the caller asked for it to stop, not to
+   * pause.
+   *
+   * @param {string} consumerTagOrQueue - The tag `consume()` returned, or the queue name.
+   * @returns {Promise<Object>} amqplib's `cancel` result.
+   * @throws {ValidationError} If this client has no such consumer, or holds it
+   *   tracked but not attached (its re-registration was refused — d.386b).
+   * @throws {ConnectionError} If the consumer channel is not alive.
+   */
+  async cancelConsumer(consumerTagOrQueue) {
+    if (typeof consumerTagOrQueue !== 'string' || consumerTagOrQueue.trim() === '') {
+      throw new ValidationError(
+        '[RabbitMQClient] Invalid consumer reference - Expected: the consumer tag consume() returned, '
+          + `or the queue name, got ${JSON.stringify(consumerTagOrQueue)}. `
+          + "Fix: pass cancelConsumer('<consumerTag>') or cancelConsumer('<queue>')."
+      );
+    }
+
+    let queue = null;
+    if (this._activeConsumers.has(consumerTagOrQueue)) {
+      queue = consumerTagOrQueue;
+    } else {
+      for (const [registeredQueue, info] of this._activeConsumers.entries()) {
+        if (info.consumerTag === consumerTagOrQueue) {
+          queue = registeredQueue;
+          break;
         }
       }
-    } catch (err) {
-      // If queueConfig cannot be loaded, keep caller-provided options (explicit).
-      // No fallbacks to "random defaults" here.
     }
 
-    return await this._queueChannel.assertQueue(queue, queueOptions);
+    if (queue === null) {
+      const known = Array.from(this._activeConsumers.entries())
+        .map(([registeredQueue, info]) => `${registeredQueue} (${info.consumerTag})`);
+      throw new ValidationError(
+        `[RabbitMQClient] No consumer to cancel - this client holds no consumer for ${JSON.stringify(consumerTagOrQueue)}. `
+          + `Expected: a queue name or consumer tag from ${known.length > 0 ? known.join(', ') : 'this client (it holds none)'}. `
+          + 'Fix: cancel on the client that registered the consumer, or read the tag consume() returned.'
+      );
+    }
+
+    const info = this._activeConsumers.get(queue);
+
+    // Tracked is not attached. A consumer whose re-registration the broker
+    // refused keeps its place on the list — that is how the next channel
+    // recreate finds it (d.262) — but it holds no tag, because the attachment
+    // its tag named is gone (d.386b). There is nothing to cancel on the broker,
+    // and asking anyway is a channel error rather than a cancel, so the caller
+    // is told plainly instead of being handed one.
+    if (info.consumerTag === null || info.consumerTag === undefined) {
+      throw new ValidationError(
+        `[RabbitMQClient] Cannot cancelConsumer ${queue}: the consumer is tracked but not attached - `
+          + 'Expected: a consumer holding the tag its last basic.consume returned. '
+          + 'Fix: nothing to cancel on the broker - the attachment is already gone and the client keeps '
+          + 'the consumer only so the next channel recreate can re-attach it. Listen for '
+          + 'consumer:re-registration:failed to learn why it could not.'
+      );
+    }
+
+    if (!this._isChannelAlive(this._consumerChannel)) {
+      throw new ConnectionError(
+        `[RabbitMQClient] Cannot cancelConsumer ${queue}: consumer channel is not available - `
+          + 'Expected: an open consumer channel to send the cancel on. '
+          + 'Fix: a dead channel has already stopped the consumer; it is re-registered only if it '
+          + 'is still tracked, so call cancelConsumer() again once the connection is back.'
+      );
+    }
+
+    this._trackChannelOperation(this._consumerChannel, `cancelConsumer ${queue}`);
+    const result = await this._consumerChannel.cancel(info.consumerTag);
+    // Dropped only after the broker accepted the cancel: a consumer that is
+    // still delivering must stay on the list recovery re-attaches.
+    this._activeConsumers.delete(queue);
+    this._prefetchTracking.delete(queue);
+    this._logger.info(
+      `[RabbitMQClient] [mq-client-core] [CONSUMER] Cancelled consumer for queue "${queue}" (consumerTag: ${info.consumerTag})`
+    );
+    return result;
   }
 
   /**
@@ -1217,11 +2504,8 @@ class RabbitMQClient extends EventEmitter {
    * @returns {Promise<Object>} amqplib checkQueue result
    */
   async checkQueue(queue) {
-    await this._ensureQueueChannel();
-    if (!this._queueChannel) {
-      throw new Error('Cannot checkQueue: queue channel is not initialized');
-    }
-    return await this._queueChannel.checkQueue(queue);
+    const channel = await this._requireQueueChannel('checkQueue', queue);
+    return await channel.checkQueue(queue);
   }
 
   /**
@@ -1229,11 +2513,8 @@ class RabbitMQClient extends EventEmitter {
    * @returns {Promise<Object>} amqplib purgeQueue result
    */
   async purgeQueue(queue) {
-    await this._ensureQueueChannel();
-    if (!this._queueChannel) {
-      throw new Error('Cannot purgeQueue: queue channel is not initialized');
-    }
-    return await this._queueChannel.purgeQueue(queue);
+    const channel = await this._requireQueueChannel('purgeQueue', queue);
+    return await channel.purgeQueue(queue);
   }
 
   /**
@@ -1242,11 +2523,8 @@ class RabbitMQClient extends EventEmitter {
    * @returns {Promise<Object>} amqplib deleteQueue result
    */
   async deleteQueue(queue, options = {}) {
-    await this._ensureQueueChannel();
-    if (!this._queueChannel) {
-      throw new Error('Cannot deleteQueue: queue channel is not initialized');
-    }
-    return await this._queueChannel.deleteQueue(queue, options);
+    const channel = await this._requireQueueChannel('deleteQueue', queue);
+    return await channel.deleteQueue(queue, options);
   }
 
   /**
@@ -1275,16 +2553,32 @@ class RabbitMQClient extends EventEmitter {
     // Track operation for debugging
     this._trackChannelOperation(this._channel, `publish to ${queue}`);
     
-    const exchange = options.exchange || this._config.exchange || '';
-    const exchangeType = options.exchangeType || 'direct';
-    const routingKey = options.routingKey || queue;
+    // Asked with `=== undefined`, not with `||`: the empty string IS a value here
+    // — it names the default exchange — and the third leg was a third copy of a
+    // default `config/defaultConfig.js` already owns (d.311).
+    const exchange = options.exchange !== undefined ? options.exchange : this._config.exchange;
+    // NO `exchangeType` here. It existed for the per-publish `assertExchange()`
+    // this path no longer makes, so it has no reader and is not left lying
+    // around (`change-discipline.md` § Removing something removes its
+    // declaration). An exchange's type is declared by its owner, in
+    // `config/queueConfig.js`, and applied through the public `assertExchange()`.
+    // Asked with `=== undefined`, like the exchange above and for the same
+    // reason: `''` is a VALUE here — it is the routing key a fanout publish
+    // writes, and what `monitoring-publish.js` passes — not "nothing written".
+    // `||` replaced it with the queue name, which a topic or direct exchange
+    // would then route by (d.369; same family as d.311, one leg it missed).
+    const routingKey = options.routingKey !== undefined ? options.routingKey : queue;
     const persistent = options.persistent !== undefined ? options.persistent : this._config.durable;
     const headers = options.headers || {};
     
-    // Structured log: extract workflow_id from headers for traceability
-    const workflowId = headers.workflowId || headers.workflow_id || 'unknown';
+    // Structured log: the workflow id this message carries, read on the one rail
+    // that reads it (`workflowIdOf()` above) — one spelling, and `null` when the
+    // message carries none.
+    const workflowId = workflowIdOf(headers);
     const msgSize = buffer ? buffer.length : 0;
-    this._log.input(workflowId, 'PUBLISH_START', {
+    this._logger.debug('[RabbitMQClient] PUBLISH_START', {
+      workflow_id: workflowId,
+      action: 'PUBLISH_START',
       handler: 'publish',
       function: 'RabbitMQClient._publishOnce',
       input: {
@@ -1311,17 +2605,21 @@ class RabbitMQClient extends EventEmitter {
         // This prevents creating queues with wrong arguments (no TTL) which causes 406 errors later
         if (!skipQueueExistencePrecheck) {
         try {
-          // Ensure queue channel exists and is open (auto-recreates if closed)
-          await this._ensureQueueChannel();
-          if (!this._queueChannel || this._queueChannel.closed) {
-            // Connection is closed and not reconnecting - cannot check queue
-            throw new TransientPublishError(
-              `Cannot check queue ${queue}: queue channel is not available (connection may be closed)`,
-              new Error('Queue channel unavailable')
-            );
+          // The queue channel comes from the ONE rail (d.282): ensure it, refuse
+          // it unless it is ALIVE, record the operation. Until d.284 this site
+          // assembled that sequence itself — `_ensureQueueChannel()` plus
+          // `_isChannelAlive()` by hand — differing from the rail in nothing but
+          // the error type, which is `_publishPathTransient()`'s job below.
+          let queueChannel;
+          try {
+            queueChannel = await this._requireQueueChannel('checkQueue', queue);
+          } catch (railErr) {
+            if (railErr instanceof ConnectionError) {
+              throw this._publishPathTransient('checkQueue', queue, railErr);
+            }
+            throw railErr;
           }
-          this._trackChannelOperation(this._queueChannel, `checkQueue ${queue}`);
-          await this._queueChannel.checkQueue(queue);
+          await queueChannel.checkQueue(queue);
           // Queue exists - proceed to publish
         } catch (checkErr) {
           // If queue doesn't exist (404), this je ERROR – ale rozlišujeme infra vs. non-infra:
@@ -1331,19 +2629,17 @@ class RabbitMQClient extends EventEmitter {
           // - Business fronty (`queueConfig.isBusinessQueue`, tj. `{service}.{workflow|queue|dlq}`)
           //   zakládá vlastnící služba přes setupServiceQueues() po registraci
           //   → QueueNotFoundError(kind='business'). Publisher je nikdy nevytváří.
-          // - Ostatní jména (ani infra, ani business vzor) se smějí založit
-          //   s default parametry, pokud to scope RecoveryWorkeru dovoluje.
+          // - Ostatní jména (ani infra, ani business vzor) nemá kdo vlastnit, takže
+          //   je nezakládá nikdo → QueueNotFoundError(kind='unowned'), d.419.
           if (checkErr.code === 404) {
-            // `../config/queueConfig` is a sibling module of this file; the require
-            // cannot fail. It used to sit in a try/catch whose `catch` re-implemented
+            // `queueConfig` is loaded once at the top of this module. It used to be
+            // required here, inside a try/catch whose `catch` re-implemented
             // `isInfrastructureQueue` as an inline prefix list — a fallback
             // (`architecture-principles.md` §3) that had also gone stale: it was
             // missing `telemetry.` and `delivery.`, both of which the real
             // queueConfig classifies as infrastructure. A fallback that answers
             // differently from the thing it stands in for is a second, wrong source
             // of truth, so it is gone.
-            const queueConfig = require('../config/queueConfig');
-
             if (queueConfig.isInfrastructureQueue(queue)) {
               // Jasný, hlasitý signál pro infra služby – fronta chybí, je to programátorská chyba
               throw new QueueNotFoundError(queue, true, checkErr, 'infrastructure');
@@ -1364,35 +2660,32 @@ class RabbitMQClient extends EventEmitter {
             if (queueConfig.isBusinessQueue(queue)) {
               throw new QueueNotFoundError(queue, false, checkErr, 'business');
             }
-          // For non-infrastructure queues, check if queue creation is allowed before auto-creating
-          // Check recovery scope and filter
-          if (this._recoveryWorker && !this._recoveryWorker._queueCreationEnabled) {
-            // Queue creation disabled for this scope (e.g., infrastructure scope)
-            throw new QueueNotFoundError(queue, false, checkErr);
-          }
-          
-          // Check queue creation filter if provided
-          if (this._recoveryWorker && this._recoveryWorker._queueCreationFilter) {
-            if (!this._recoveryWorker._queueCreationFilter(queue)) {
-              // Queue creation filtered out - throw QueueNotFoundError so RecoveryWorker can handle it
-              throw new QueueNotFoundError(queue, false, checkErr);
-            }
-          }
-          
-          // For non-infrastructure queues, allow auto-creation with default options
-          const queueOptions = options.queueOptions || { durable: this._config.durable };
-          console.warn(`[RabbitMQClient] [mq-client-core] [PUBLISH] Auto-creating non-infrastructure queue ${queue} with default options (no TTL). This should be avoided for production.`);
-          // Channel could have been nulled out by close handlers; ensure it's available
-          await this._ensureQueueChannel();
-          if (!this._queueChannel || this._queueChannel.closed) {
-            // Connection is closed and not reconnecting - cannot create queue
-            throw new TransientPublishError(
-              `Cannot create queue ${queue}: queue channel is not available (connection may be closed)`,
-              checkErr
-            );
-          }
-          this._trackChannelOperation(this._queueChannel, `assertQueue ${queue}`);
-          await this._queueChannel.assertQueue(queue, queueOptions);
+          // Nobody owns this name. Until d.419 that opened a THIRD case beside
+          // the two above: the publish path asked `RecoveryWorker` whether this
+          // client might declare it and, when the answer was yes, declared it —
+          // `durable=true, arguments={}`, no TTL, no dead-letter route (measured
+          // live, d.410). The concept had already ruled that out: "queues come
+          // into being only from declarations (`queueConfig`,
+          // `setupServiceQueues()` from the business templates)", and a new family
+          // of queues gets "a `queueConfig` template first, never a generic
+          // create-anything method"
+          // (`docs/governance/confirmations/mq-consumer-contract.md` 006). And the
+          // queue so created was unusable at the other end anyway: `consume()`
+          // refuses a queue the config declares no dead-letter route for (d.259),
+          // so the door produced queues that could be published into and never
+          // consumed from.
+          //
+          // The name reaching this line is exactly the one the ONE owner of "what
+          // is this queue declared with" — `queueConfig.declarationOptions()`
+          // (d.410) — answers `null` for: that function returns a declaration for
+          // an infrastructure name and for a business name, and both were refused
+          // above, so the remainder is the set with no declaration at all. It is
+          // asked this way round rather than called here because it REFUSES a name
+          // belonging to a section that holds no entry for it (a configuration
+          // defect, reported by the lookup that owns it) — a different failure from
+          // "nothing declares this name", and the publish path must not flatten the
+          // two into one message.
+          throw new QueueNotFoundError(queue, false, checkErr, 'unowned');
           } else {
             // Other error - rethrow
             throw checkErr;
@@ -1401,25 +2694,57 @@ class RabbitMQClient extends EventEmitter {
         }
         // Publish to queue using ConfirmChannel (for publisher confirms)
         // Channel is guaranteed to be open (ensured above)
-        console.log(`[RabbitMQClient] [mq-client-core] [PUBLISH] Sending message to queue "${queue}" (size: ${buffer.length} bytes)`);
+        this._logger.debug(`[RabbitMQClient] [mq-client-core] [PUBLISH] Sending message to queue "${queue}" (size: ${buffer.length} bytes)`);
         
         // Use callback-based confirmation - kanály jsou spolehlivé, takže callback vždy dorazí
         const confirmPromise = new Promise((resolve, reject) => {
+          // ONE disarm for this attempt. Both timers below belong to this single
+          // publish, so every settle path — confirmed, refused, timed out, thrown —
+          // clears them by one name instead of naming whichever handle it happens
+          // to remember. The safety timer was the one nobody remembered: its handle
+          // was discarded at the call site, so a publish the broker confirmed in a
+          // millisecond left a referenced timer armed for a further second, holding
+          // the event loop and the closure's `buffer`/`options`/`originalChannel`
+          // with it (d.285).
+          let timeout = null;
+          let safetyTimer = null;
+          let settled = false;
+          const disarm = () => {
+            settled = true;
+            this._clearTimeout(timeout);
+            this._clearTimeout(safetyTimer);
+            timeout = null;
+            safetyTimer = null;
+          };
+
           // Set timeout for publish confirmation (configurable)
-          const timeout = this._setTimeout(() => {
-            reject(new Error(`Publish confirmation timeout for queue "${queue}" after ${this._publishConfirmationTimeout}ms`));
-          }, this._publishConfirmationTimeout);
+          timeout = this._setTimeout(() => {
+            disarm();
+            reject(new PublishError(
+              `[RabbitMQClient] Publish confirmation timeout for queue "${queue}" after ${this._brokerAnswerTimeout}ms - `
+                + 'Expected: the broker to confirm the message within brokerAnswerTimeout. '
+                + 'Fix: delivery is NOT guaranteed — treat the message as unconfirmed and republish it; check broker load and flow control.',
+              queue,
+              null
+            ));
+          }, this._brokerAnswerTimeout);
           
-          // Check if channel is still valid before sending
-          if (!this._channel || this._channel.closed) {
-            this._clearTimeout(timeout);
-            reject(new Error(`Cannot publish: channel is closed for queue "${queue}"`));
+          // Check if channel is still valid before sending. The channel can die
+          // during the awaits above (queue existence pre-check), so this is not
+          // a repeat of `_ensurePublisherChannel()` — it is the last reading
+          // before the payload leaves, and it reads the one liveness source.
+          if (!this._isChannelAlive(this._channel)) {
+            disarm();
+            reject(new ConnectionError(
+              `[RabbitMQClient] Cannot publish: channel is closed for queue "${queue}" - `
+                + 'Expected: an open publisher channel at send time. '
+                + 'Fix: retry the publish after the reconnect; PublishLayer does this on its own and buffers the message meanwhile.'
+            ));
             return;
           }
           
           // Track original channel to detect if it was closed/recreated during publish
           const originalChannel = this._channel;
-          const channelId = originalChannel ? originalChannel._createdAt : null;
           let callbackInvoked = false;
           
           // Send message with callback
@@ -1430,14 +2755,16 @@ class RabbitMQClient extends EventEmitter {
               buildAmqpMessageProperties(options, persistent, headers),
               (err, ok) => {
               callbackInvoked = true;
-              this._clearTimeout(timeout);
+              disarm();
               
-              // CRITICAL: Check if channel was closed or recreated during publish
-              // If channel was recreated, the delivery tag is invalid - ignore this callback
-              if (!this._channel || this._channel.closed || this._channel !== originalChannel || 
-                  (this._channel._createdAt && this._channel._createdAt !== channelId)) {
+              // CRITICAL: the delivery tag belongs to the channel that SENT the
+              // message, so that channel's liveness is the whole question. One
+              // reading answers it: a channel that was replaced is a channel that
+              // died first (`_ensurePublisherChannel()` recreates only a dead one),
+              // so identity and `_createdAt` comparisons said nothing this does not.
+              if (!this._isChannelAlive(originalChannel)) {
                 // Channel was closed or recreated - delivery tag is invalid
-                console.warn(`[RabbitMQClient] [mq-client-core] [PUBLISH] Channel closed/recreated during publish to queue "${queue}", ignoring callback`);
+                this._logger.warn(`[RabbitMQClient] [mq-client-core] [PUBLISH] Channel closed/recreated during publish to queue "${queue}", ignoring callback`);
                 // If we're reconnecting, wait and retry
                 if (this._reconnecting) {
                   this._waitForReconnection().then(() => {
@@ -1447,7 +2774,13 @@ class RabbitMQClient extends EventEmitter {
                 } else {
                   // Not reconnecting - this is a real error
                   // We cannot guarantee the message was delivered - must fail
-                  reject(new Error(`Channel closed during publish to queue "${queue}" and not reconnecting - message delivery not guaranteed`));
+                  reject(new PublishError(
+                    `[RabbitMQClient] Channel closed during publish to queue "${queue}" and not reconnecting - message delivery not guaranteed. `
+                      + 'Expected: the channel to stay open until the broker confirms, or a reconnect to be in flight. '
+                      + 'Fix: republish the message — the confirm never arrived, so it may or may not have been stored.',
+                    queue,
+                    null
+                  ));
                 }
                 return;
               }
@@ -1455,7 +2788,7 @@ class RabbitMQClient extends EventEmitter {
               if (err) {
                 // Check if error is about invalid delivery tag (channel was closed)
                 if (err.message && (err.message.includes('unknown delivery tag') || err.message.includes('PRECONDITION_FAILED'))) {
-                  console.warn(`[RabbitMQClient] [mq-client-core] [PUBLISH] Delivery tag invalid (channel may have been closed) for queue "${queue}"`);
+                  this._logger.warn(`[RabbitMQClient] [mq-client-core] [PUBLISH] Delivery tag invalid (channel may have been closed) for queue "${queue}"`);
                   // If we're reconnecting, wait and retry
                   if (this._reconnecting) {
                     this._waitForReconnection().then(() => {
@@ -1464,16 +2797,24 @@ class RabbitMQClient extends EventEmitter {
                     }).then(resolve).catch(reject);
                   } else {
                     // Not reconnecting - delivery tag is invalid, message delivery not guaranteed
-                    reject(new Error(`Delivery tag invalid for queue "${queue}" (channel closed) and not reconnecting - message delivery not guaranteed`));
+                    reject(new PublishError(
+                      `[RabbitMQClient] Delivery tag invalid for queue "${queue}" (channel closed) and not reconnecting - message delivery not guaranteed. `
+                        + 'Expected: the delivery tag to stay valid until the broker confirms, or a reconnect to be in flight. '
+                        + 'Fix: republish the message — the confirm never arrived, so it may or may not have been stored.',
+                      queue,
+                      null
+                    ));
                   }
                 } else {
-                  console.error(`[RabbitMQClient] [mq-client-core] [PUBLISH] Send callback error for queue "${queue}":`, err.message);
+                  this._logger.error(`[RabbitMQClient] [mq-client-core] [PUBLISH] Send callback error for queue "${queue}":`, err.message);
                   reject(err);
                 }
               } else {
                 // Structured log: publish confirmed
-                const wfId = headers.workflowId || headers.workflow_id || 'unknown';
-                this._log.output(wfId, 'PUBLISH_CONFIRMED', {
+                const wfId = workflowIdOf(headers);
+                this._logger.debug('[RabbitMQClient] PUBLISH_CONFIRMED', {
+                  workflow_id: wfId,
+                  action: 'PUBLISH_CONFIRMED',
                   handler: 'publish',
                   function: 'RabbitMQClient._publishOnce',
                   input: { queue, size: buffer ? buffer.length : 0 },
@@ -1483,23 +2824,28 @@ class RabbitMQClient extends EventEmitter {
               }
             });
             
-            // Set a safety timeout - if callback wasn't invoked and channel closed, retry
-            this._setTimeout(() => {
-              if (!callbackInvoked && (!this._channel || this._channel.closed || this._channel !== originalChannel)) {
-                console.warn(`[RabbitMQClient] [mq-client-core] [PUBLISH] Callback timeout and channel closed for queue "${queue}", will retry after reconnection`);
-                if (this._reconnecting) {
-                  this._clearTimeout(timeout);
-                  this._waitForReconnection().then(() => {
-                    return this.publish(queue, buffer, options);
-                  }).then(resolve).catch(reject);
+            // Set a safety timeout - if callback wasn't invoked and channel closed, retry.
+            // A broker confirm can land inside `sendToQueue()` itself, so the
+            // attempt may already be settled here; arming a safety net for an
+            // attempt that has ended is the leak, not a safety net.
+            if (!settled) {
+              safetyTimer = this._setTimeout(() => {
+                if (!callbackInvoked && !this._isChannelAlive(originalChannel)) {
+                  this._logger.warn(`[RabbitMQClient] [mq-client-core] [PUBLISH] Callback timeout and channel closed for queue "${queue}", will retry after reconnection`);
+                  if (this._reconnecting) {
+                    disarm();
+                    this._waitForReconnection().then(() => {
+                      return this.publish(queue, buffer, options);
+                    }).then(resolve).catch(reject);
+                  }
                 }
-              }
-            }, 1000);
+              }, this._publishConfirmWatchdogDelay);
+            }
           } catch (sendErr) {
-            clearTimeout(timeout);
+            disarm();
             // If channel is closed, try to wait for reconnection and retry
             if (sendErr.message && (sendErr.message.includes('Channel ended') || sendErr.message.includes('Channel closed'))) {
-              console.warn(`[RabbitMQClient] [mq-client-core] [PUBLISH] Channel closed during sendToQueue, will retry after reconnection`);
+              this._logger.warn(`[RabbitMQClient] [mq-client-core] [PUBLISH] Channel closed during sendToQueue, will retry after reconnection`);
               // Wait for reconnection and retry
               if (this._reconnecting) {
                 this._waitForReconnection().then(() => {
@@ -1517,16 +2863,41 @@ class RabbitMQClient extends EventEmitter {
         
         await confirmPromise;
       } else {
-        // If exchange is specified, assert exchange and publish to it
-        // Channel is guaranteed to be open (ensured above)
-        await this._channel.assertExchange(exchange, exchangeType, { durable: this._config.durable });
+        // An exchange is NAMED here, never declared. Its type and durability are
+        // topology, and topology belongs to the owner: `config/queueConfig.js`
+        // declares each platform exchange and the owning service asserts exactly
+        // that (`infra/api_monitoring/src/consumer/index.js`,
+        // `infra/api_services_registry/src/services/infrastructureEventPublisher.js`,
+        // `infra/api_delivery_endpoint/src/mq/MQConnection.js`).
+        //
+        // Until d.342 this line asserted the exchange before EVERY publish, with
+        // arguments made up on the spot — the type from `options.exchangeType ||
+        // 'direct'` and the durability from the PUBLISHING client's own config.
+        // That is a second declaration beside the owner's, and the owner's
+        // decision names this exact defect one object down: "the endpoint's own
+        // `{ durable: true }` assert is a second declaration and already yields
+        // 406 against the library's"
+        // (`docs/governance/confirmations/mq-consumer-contract.md` 003, point 4).
+        // A client configured `durable: false` therefore got
+        // 406 PRECONDITION-FAILED from a publish that was itself faultless.
+        //
+        // Same rule as for queues, one object up (`README.md` § Queue ownership):
+        // a publisher does not create what somebody else owns. An exchange that
+        // nobody declared is a broker-side 404 on this channel — fail-fast, not
+        // an exchange invented by whoever published first.
         
         // Use callback-based confirmation - kanály jsou spolehlivé
         const confirmPromise = new Promise((resolve, reject) => {
           // Set timeout for exchange publish confirmation
           const timeout = this._setTimeout(() => {
-            reject(new Error(`Exchange publish confirmation timeout for exchange "${exchange}" after ${this._publishConfirmationTimeout}ms`));
-          }, this._publishConfirmationTimeout);
+            reject(new PublishError(
+              `[RabbitMQClient] Exchange publish confirmation timeout for exchange "${exchange}" after ${this._brokerAnswerTimeout}ms - `
+                + 'Expected: the broker to confirm the message within brokerAnswerTimeout. '
+                + 'Fix: delivery is NOT guaranteed — treat the message as unconfirmed and republish it; check broker load and flow control.',
+              exchange,
+              null
+            ));
+          }, this._brokerAnswerTimeout);
           
           this._channel.publish(
             exchange,
@@ -1536,10 +2907,10 @@ class RabbitMQClient extends EventEmitter {
             (err, ok) => {
             this._clearTimeout(timeout);
             if (err) {
-              console.error(`[RabbitMQClient] [mq-client-core] [PUBLISH] Exchange publish callback error:`, err.message);
+              this._logger.error(`[RabbitMQClient] [mq-client-core] [PUBLISH] Exchange publish callback error:`, err.message);
               reject(err);
             } else {
-              console.log(`[RabbitMQClient] [mq-client-core] [PUBLISH] ✓ Exchange publish confirmed`);
+              this._logger.debug(`[RabbitMQClient] [mq-client-core] [PUBLISH] ✓ Exchange publish confirmed`);
               resolve();
             }
           });
@@ -1553,13 +2924,265 @@ class RabbitMQClient extends EventEmitter {
       // Pokud channel closed, vyhodíme TransientPublishError a necháme PublishLayer řešit retry
       
       // Všechny chyby projdou jednotnou klasifikací do Transient/Permanent/QueueNotFound
-      const classifiedErr = classifyPublishError(err);
+      const classifiedErr = classifyPublishError(err, queue);
       this.emit('error', classifiedErr);
       throw classifiedErr;
     }
   }
 
 
+  /**
+   * Apply one consumer's prefetch to the CURRENT consumer channel, and record
+   * what the broker was told.
+   *
+   * `.prefetch()` is per-channel QoS, and a consumer channel is recreated on
+   * every channel death and every reconnect. Until d.263 it was applied in
+   * exactly one place — the first `consume()` — so every later channel carried
+   * no bound at all, while `_prefetchTracking` went on measuring in-flight
+   * messages against the number the consumer had asked for. The utilisation
+   * alarm was therefore reading a limit nobody enforced.
+   *
+   * A non-numeric prefetch (the caller asked for none) sets none, and records
+   * none: there is nothing to measure utilisation against.
+   *
+   * @param {string} queue - Queue name
+   * @param {number|null|undefined} prefetch - The consumer's prefetch
+   * @returns {Promise<void>}
+   * @private
+   */
+  async _applyConsumerPrefetch(queue, prefetch) {
+    if (typeof prefetch !== 'number') {
+      return;
+    }
+
+    await this._consumerChannel.prefetch(prefetch);
+
+    const tracking = this._prefetchTracking.get(queue);
+    if (tracking) {
+      tracking.prefetchCount = prefetch;
+    } else {
+      this._prefetchTracking.set(queue, {
+        prefetchCount: prefetch,
+        inFlight: 0,
+        lastCheck: Date.now()
+      });
+    }
+
+    if (!this._prefetchCheckTimer) {
+      this._startPrefetchMonitoring();
+    }
+  }
+
+  /**
+   * Prepare one queue for a consumer, and answer with the arguments it is
+   * declared with.
+   *
+   * ONE rail for the first `consume()` and for every re-registration after a
+   * channel recreate. It classifies the queue (reply / infrastructure /
+   * business), resolves the arguments from the central config, refuses a queue
+   * whose config declares no dead-letter route, and then CHECKS an
+   * infrastructure queue (consumers never create those) or ASSERTS a business
+   * one.
+   *
+   * Until d.262 `_reRegisterConsumers()` carried a second, simpler copy:
+   * `assertQueue(queue, options.queueOptions)` for every tracked queue, with no
+   * classification and no dead-letter gate — so a recreate could DECLARE a queue
+   * the consumer does not own, and its `404` branch was unreachable, because
+   * `assertQueue()` creates what is missing instead of answering 404.
+   *
+   * @param {string} queue - Queue name
+   * @param {Object} options - `durable` and the caller's `queueOptions`, if any
+   * @returns {Promise<Object>} the queueOptions this queue is declared with
+   * @private
+   */
+  async _prepareQueueForConsume(queue, options = {}) {
+    const durable = options.durable !== undefined ? options.durable : this._config.durable;
+    let queueOptions = options.queueOptions || { durable };
+
+    // Skip assertQueue for reply queues (they're already created with specific settings)
+    // Reply queues start with 'rpc.reply.' and are created as non-durable
+    const isReplyQueue = queue.startsWith('rpc.reply.');
+    // Classification is read once and used by both blocks below — the one that
+    // resolves the central arguments, and the one that checks or asserts the queue.
+    const isInfraQueue = !isReplyQueue && queueConfig.isInfrastructureQueue(queue);
+    const isBusinessQueue = !isReplyQueue && queueConfig.isBusinessQueue(queue);
+
+    if (!isReplyQueue) {
+    // CRITICAL: Use queueConfig.js to get correct parameters (TTL, max-length, etc.)
+    // This prevents 406 PRECONDITION-FAILED errors from TTL mismatches.
+    // queueConfig is loaded once at the top of this module; it used to be required
+    // here, with a `catch` that announced a fall back to the caller's defaults and
+    // then asserted the queue with exactly the arguments this config exists to override.
+
+    if (isInfraQueue || isBusinessQueue) {
+      // An infrastructure queue is CHECKED here and never created — ownership rule:
+      // infra queues are created by their owning infra service. A business queue is
+      // asserted, on the public rail below.
+      //
+      // Either way the arguments come from the ONE function that owns the mapping
+      // name → declaration (`queueConfig.declarationOptions()`, d.410), the same one
+      // the public `assertQueue()` reads. Until then this method rebuilt
+      // `{ durable: cfg.durable !== false, arguments: { ...cfg.arguments } }` from
+      // its own lookup, once per class of queue — a second implementation of one
+      // concern (`change-discipline.md` § One rail per concern), and the way a queue
+      // ends up declared differently by two paths that both believe they follow the
+      // central config.
+      //
+      // A failed lookup is a CONFIGURATION DEFECT, not a condition to log and
+      // survive. Until 2026-09-07 both branches below caught it, warned, and
+      // carried on with `queueOptions` as the caller left them — the bare
+      // `{ durable }` default — which is precisely the substitution the
+      // central config exists to prevent (406 PRECONDITION-FAILED against the
+      // owner's declaration, or a queue created without TTL and DLQ). Same
+      // fallback the lazy `require` had one floor up in `assertQueue()`, and
+      // removed there for the same reason.
+      try {
+        queueOptions = queueConfig.declarationOptions(queue);
+      } catch (configErr) {
+        throw new ConsumeError(
+          missingQueueDefinitionMessage(queue, isInfraQueue),
+          queue,
+          configErr
+        );
+      }
+      this._logger.debug(
+        isInfraQueue
+          ? `[RabbitMQClient] [mq-client-core] [CONSUMER] Checking infrastructure queue ${queue} exists (no auto-create)`
+          : `[RabbitMQClient] [mq-client-core] [CONSUMER] Asserting business queue ${queue} with the declaration queueConfig owns`
+      );
+    }
+    // End of the queue-classification block. What follows applies to EVERY
+    // queue this consumer may attach to, reply queues included.
+    }
+
+    // The dead-letter policy below rejects a spent message with
+    // `nack(requeue=false)`, and the broker then moves it ONLY if the queue
+    // declares where to: `x-dead-letter-exchange` + `x-dead-letter-routing-key`.
+    // Without them the broker DROPS it — while `_rejectDelivery()` publishes a
+    // `message_dlq` event saying it reached `.dlq`. So the policy refuses to run
+    // at all over a queue with no route, at REGISTRATION rather than at the first
+    // failure (`architecture-principles.md` §4): a consumer that cannot
+    // dead-letter is never attached, so no message is taken off that queue and
+    // lost. There is no opt-out and no fallback to requeue-for-ever — one rail
+    // for business and infrastructure consumers alike
+    // (`docs/governance/confirmations/mq-consumer-contract.md` 002;
+    // `automation-gates.md` §1 requirement 5).
+    //
+    // The source of truth is the declaration in queueConfig, never a question to
+    // the broker: `checkQueue()` returns `queue.declare-ok`, which carries no
+    // arguments (measured, 2026-09-12 — see queueConfig.getDeadLetterRoute()).
+    // The caller's own `queueOptions` do not count either; a route supplied at
+    // the call site would be a second declaration of one queue's topology.
+    if (queueConfig.getDeadLetterRoute(queue) === null) {
+      throw new ConsumeError(
+        `[RabbitMQClient] consume(${queue}): the dead-letter policy needs a dead-letter route and `
+          + 'queueConfig declares none for this queue - '
+          + "Expected: x-dead-letter-exchange/-routing-key in the queue's queueConfig section "
+          + '(docs/governance/confirmations/mq-consumer-contract.md 002, d.198a). '
+          + 'Fix: declare the route in src/config/queueConfig.js and bind the queue that receives it, '
+          + 'or consume a queue that already declares one — there is no consumer without a dead-letter '
+          + 'route, because nack(requeue=false) on a queue with no route makes the broker drop the message.',
+        queue,
+        undefined,
+        CONSUMER_DEAD_LETTER_ROUTE_MISSING
+      );
+    }
+
+    if (!isReplyQueue) {
+    this._logger.debug(`[RabbitMQClient] [mq-client-core] [CONSUMER] Asserting queue ${queue} before consume() at ${new Date().toISOString()}`);
+    this._logger.debug(`[RabbitMQClient] [mq-client-core] [CONSUMER] Queue options:`, JSON.stringify(queueOptions, null, 2));
+    this._logger.debug(`[RabbitMQClient] [mq-client-core] [CONSUMER] _queueChannel state: exists=${!!this._queueChannel}, closed=${!this._isChannelAlive(this._queueChannel)}`);
+
+    // Every queue operation below goes to the queue channel through the ONE rail
+    // (`_requireQueueChannel`, d.282): ensure it, refuse it unless it is ALIVE,
+    // record the operation. Until d.284 this method was the sixth place with its
+    // own copy of that sequence, and the copy asked the wrong question:
+    // `if (!this._queueChannel)` is about the REFERENCE, which a corpse answers
+    // exactly like a live channel. A consumer over a dead-but-referenced channel
+    // therefore ran checkQueue/assertQueue on the corpse and the caller got
+    // amqplib's bare "Channel closed" — the defect d.282 removed from the four
+    // public queue operations, one floor down.
+    //
+    // There is exactly ONE question to the broker per queue, and it is the one
+    // that decides: `checkQueue` for an infrastructure queue (a consumer never
+    // creates one, so a 404 is the verdict), `assertQueue` for a business queue
+    // (the declaration itself, and a 406 is the verdict on argument drift).
+    // A `checkQueue` used to run ahead of both, its result reaching nothing but
+    // a `debug` line. It was written to catch a queue "already created with
+    // different arguments" — a question `checkQueue` cannot answer, because
+    // `queue.declare-ok` carries the name and two counters and no arguments at
+    // all, which its author noted in the next breath and then asked anyway. It
+    // was not free: a 404 closes the channel by AMQP rule, and a queue that does
+    // not exist yet is the ordinary case for every new business queue, so each
+    // first `consume()` cost one queue channel, killed and recreated (measured
+    // against the live broker: closes=1, channel identity changed). On the
+    // infrastructure path it was a literal duplicate of the call below (d.287).
+
+    if (isInfraQueue) {
+      // IMPORTANT: Do NOT auto-create infrastructure queues in consumers.
+      // If missing, fail-fast. The owning infra service must recreate on startup.
+      const queueChannel = await this._requireQueueChannel('checkQueue', queue);
+      try {
+        await queueChannel.checkQueue(queue);
+        this._logger.debug(`[RabbitMQClient] [mq-client-core] [CONSUMER] ✓ Infrastructure queue ${queue} exists (consumer will proceed)`);
+      } catch (checkErr) {
+        if (checkErr.code === 404) {
+          // Typed and coded since d.297: a bare `Error` lost the queue AND the
+          // class, so the layer above could not tell "this queue does not exist"
+          // from "the policy refused this queue" and told the reader the wrong
+          // one. The sentence is unchanged — it was already the true one.
+          throw new ConsumeError(
+            missingInfrastructureQueueMessage(queue),
+            queue,
+            checkErr,
+            CONSUMER_QUEUE_MISSING
+          );
+        }
+        throw checkErr;
+      }
+    } else {
+      // Business queue (or unknown) — declared on the ONE public rail, the same
+      // `assertQueue()` the publish path's 404 branch (d.281) and
+      // `RecoveryWorker.createQueue()` (d.277b) go through. It ensures the queue
+      // channel, refuses one that is not alive (d.282) and resolves the arguments
+      // from `queueConfig.declarationOptions()` — so a declaration made here and a
+      // declaration made anywhere else are the same declaration by construction,
+      // not by two copies of the same three lines happening to agree (d.410).
+      //
+      // A name the central config declares carries NO caller options: the
+      // declaration is the owner's, and `assertQueue()` refuses a caller lifetime
+      // over it by name. For an unclassified name the caller's `queueOptions` are
+      // the only statement of the queue's lifetime there is, so they travel on.
+      try {
+        this._logger.debug(`[RabbitMQClient] [mq-client-core] [CONSUMER] About to call assertQueue(${queue}, ${JSON.stringify(queueOptions)})`);
+        await this.assertQueue(queue, isBusinessQueue ? {} : (options.queueOptions || {}));
+        this._logger.debug(`[RabbitMQClient] [mq-client-core] [CONSUMER] ✓ Queue ${queue} asserted successfully`);
+      } catch (assertErr) {
+        // If queue exists with different arguments (406), this is a CRITICAL ERROR
+        // We should NOT proceed - the root cause must be fixed
+        if (assertErr.code === 406) {
+          this._logger.error(`[RabbitMQClient] [mq-client-core] [CONSUMER] ✗ CRITICAL: Queue ${queue} exists with different arguments!`);
+          this._logger.error(`[RabbitMQClient] [mq-client-core] [CONSUMER] Error:`, assertErr.message);
+          this._logger.error(`[RabbitMQClient] [mq-client-core] [CONSUMER] Expected options:`, JSON.stringify(queueOptions, null, 2));
+          this._logger.error(`[RabbitMQClient] [mq-client-core] [CONSUMER] This means assertQueue() was called without parameters somewhere else. Root cause must be fixed!`);
+          throw new ConsumeError(
+            `[RabbitMQClient] Cannot assertQueue ${queue}: queue exists with different arguments (406 PRECONDITION-FAILED). `
+              + 'Expected: every declaration of this queue to use the arguments queueConfig prescribes (TTL, DLQ, max-length). '
+              + 'Fix: find the assertQueue() call that declared it without parameters and fix that call; '
+              + 'the queue is NOT redeclared here, because doing so would hide the drift instead of ending it.',
+            queue,
+            assertErr
+          );
+        }
+        // Other error - rethrow
+        throw assertErr;
+      }
+    }
+    }
+
+    return queueOptions;
+  }
+
   /**
    * Starts consuming messages from the specified queue.
    * @param {string} queue                         - Queue name to consume from.
@@ -1569,6 +3192,77 @@ class RabbitMQClient extends EventEmitter {
    * @throws {Error} If consume setup fails or channel is not available.
    */
   async consume(queue, onMessage, options = {}) {
+    // Dead-letter policy FIRST, before the broker is touched: a budget that
+    // cannot bound anything must not reach a registered consumer
+    // (`architecture-principles.md` §4). The default comes from ../config.js
+    // (explicit → RABBITMQ_MAX_DELIVERY_ATTEMPTS → defaults.js), never from a
+    // literal here; only the env form is coerced, an explicit value is taken
+    // exactly as written. @see ../config/deliveryPolicy.js
+    // `requeueOnError` is the SAME policy said in one word, never a second one
+    // (`mq-client-lifecycle-contract` 001 point 4 "L8" names the option;
+    // `mq-consumer-contract` 002 point 3 owns the policy it must fold into).
+    // `false` = the budget is one attempt, so the first failure rejects into
+    // `<svc>.dlq` — exactly what a `permanent` classification already does.
+    // `true` or absent = the budget configuration decides. There is no third
+    // meaning, and the combination that would need one is refused below rather
+    // than resolved by silently preferring one of the two.
+    if (options.requeueOnError !== undefined && typeof options.requeueOnError !== 'boolean') {
+      throw new ValidationError(
+        '[RabbitMQClient] Invalid requeueOnError - Expected: true or false, got '
+          + `${JSON.stringify(options.requeueOnError)}. Fix: pass consume(queue, handler, `
+          + '{ requeueOnError: false }) to dead-letter on the first failure, or leave it out and '
+          + 'let the delivery budget decide.'
+      );
+    }
+
+    const noRequeue = options.requeueOnError === false;
+
+    if (noRequeue && options.maxAttempts !== undefined && options.maxAttempts !== 1) {
+      throw new ValidationError(
+        '[RabbitMQClient] Contradictory delivery policy - requeueOnError: false means one attempt, '
+          + `but maxAttempts says ${JSON.stringify(options.maxAttempts)}. Expected: one statement about `
+          + 'how many times a handler may run. Fix: drop requeueOnError to keep the budget, or drop '
+          + 'maxAttempts to dead-letter on the first failure.'
+      );
+    }
+
+    const maxAttempts = noRequeue
+      ? 1
+      : options.maxAttempts === undefined
+        ? runtimeCfg.get('maxDeliveryAttempts', this._config.maxDeliveryAttempts)
+        : options.maxAttempts;
+
+    if (!Number.isInteger(maxAttempts) || maxAttempts < 1) {
+      throw new ValidationError(
+        '[RabbitMQClient] Invalid delivery budget - maxAttempts must be an integer >= 1, got '
+          + `${JSON.stringify(maxAttempts)}. Fix: pass consume(queue, handler, { maxAttempts: <integer >= 1> }), `
+          + 'or leave it out and let the module default (defaults.js maxDeliveryAttempts, '
+          + 'env RABBITMQ_MAX_DELIVERY_ATTEMPTS) decide.'
+      );
+    }
+
+    const classify = options.classify === undefined
+      ? deliveryPolicy.defaultClassification
+      : options.classify;
+
+    if (typeof classify !== 'function') {
+      throw new ValidationError(
+        '[RabbitMQClient] Invalid error classifier - classify must be a function returning '
+          + `'transient' or 'permanent', got ${typeof options.classify}. Fix: pass consume(queue, handler, `
+          + '{ classify: (error) => … }), or leave it out and every error is treated as transient.'
+      );
+    }
+
+    const policy = { maxAttempts, classify };
+    const onDeadLetter = options.onDeadLetter;
+    if (onDeadLetter !== undefined && typeof onDeadLetter !== 'function') {
+      throw new ValidationError(
+        '[RabbitMQClient] Invalid dead-letter hook - onDeadLetter must be a function, got '
+          + `${typeof onDeadLetter}. Fix: consume through BaseClient, which injects the hook that `
+          + 'publishes the message_dlq event, or omit the option when driving this transport directly.'
+      );
+    }
+
     // Ensure consumer channel exists and is open (auto-recreates if closed and re-registers consumers)
     await this._ensureConsumerChannel();
     
@@ -1579,148 +3273,27 @@ class RabbitMQClient extends EventEmitter {
     const prefetch = options.prefetch !== undefined ? options.prefetch : this._config.prefetch;
     const noAck = options.noAck !== undefined ? options.noAck : this._config.noAck;
 
-    // Initialize queueOptions with default value
-    let queueOptions = options.queueOptions || { durable };
-    
-    try {
-      // Skip assertQueue for reply queues (they're already created with specific settings)
-      // Reply queues start with 'rpc.reply.' and are created as non-durable
-      if (!queue.startsWith('rpc.reply.')) {
-      // CRITICAL: Use queueConfig.js to get correct parameters (TTL, max-length, etc.)
-      // This prevents 406 PRECONDITION-FAILED errors from TTL mismatches
-      // Use local queueConfig from mq-client-core (it has infrastructure queue configs)
-      let queueConfig = null;
-      try {
-        queueConfig = require('../config/queueConfig');
-      } catch (requireErr) {
-        console.warn(`[RabbitMQClient] [mq-client-core] [CONSUMER] Cannot load queueConfig:`, requireErr.message);
-        console.warn(`[RabbitMQClient] [mq-client-core] [CONSUMER] Using default queue options (this may cause 406 errors if queue exists with different args)`);
-      }
-      
-      // Only check queue types if queueConfig is available
-      const isInfraQueue = queueConfig ? queueConfig.isInfrastructureQueue(queue) : false;
-      const isBusinessQueue = queueConfig ? queueConfig.isBusinessQueue(queue) : false;
-      
-      if (queueConfig) {
-        if (isInfraQueue) {
-          // Infrastructure queue - use central config for expected arguments,
-          // but DO NOT create it here. Ownership rule: infra queues are created by their owning infra service.
-          try {
-            const infraConfig = queueConfig.getInfrastructureQueueConfig(queue);
-            queueOptions = {
-              durable: infraConfig.durable !== false,
-              arguments: { ...infraConfig.arguments }
-            };
-            console.log(`[RabbitMQClient] [mq-client-core] [CONSUMER] Checking infrastructure queue ${queue} exists (no auto-create)`);
-          } catch (configErr) {
-            console.warn(`[RabbitMQClient] [mq-client-core] [CONSUMER] Infrastructure queue config not found for ${queue}, will still require it to exist:`, configErr.message);
-          }
-        } else if (isBusinessQueue) {
-          // Business queue - use central config
-          try {
-            const parsed = queueConfig.parseBusinessQueue(queue);
-            if (parsed) {
-              const businessConfig = queueConfig.getBusinessQueueConfig(parsed.queueType, parsed.serviceName);
-              queueOptions = {
-                durable: businessConfig.durable !== false,
-                arguments: { ...businessConfig.arguments }
-              };
-              console.log(`[RabbitMQClient] [mq-client-core] [CONSUMER] Asserting business queue ${queue} with config from queueConfig`);
-            }
-          } catch (configErr) {
-            console.warn(`[RabbitMQClient] [mq-client-core] [CONSUMER] Business queue config not found for ${queue}, using default:`, configErr.message);
-          }
-        }
-      }
-      
-      console.log(`[RabbitMQClient] [mq-client-core] [CONSUMER] Asserting queue ${queue} before consume() at ${new Date().toISOString()}`);
-      console.log(`[RabbitMQClient] [mq-client-core] [CONSUMER] Queue options:`, JSON.stringify(queueOptions, null, 2));
-      console.log(`[RabbitMQClient] [mq-client-core] [CONSUMER] _queueChannel state: exists=${!!this._queueChannel}, closed=${this._queueChannel ? this._queueChannel.closed : 'N/A'}`);
-      
-      // CRITICAL: Check if queue already exists with different arguments
-      // This can happen if sendToQueue() or amqplib's consume() auto-created it without TTL
-      try {
-        const queueInfo = await this._queueChannel.checkQueue(queue);
-        console.log(`[RabbitMQClient] [mq-client-core] [CONSUMER] Queue ${queue} already exists with arguments:`, JSON.stringify(queueInfo.messageCount !== undefined ? { messageCount: queueInfo.messageCount, consumerCount: queueInfo.consumerCount } : queueInfo));
-        // If queue exists, we need to check if arguments match
-        // Note: checkQueue() doesn't return arguments, so we'll try assertQueue() and catch 406
-      } catch (checkErr) {
-        if (checkErr.code === 404) {
-          console.log(`[RabbitMQClient] [mq-client-core] [CONSUMER] Queue ${queue} does not exist (404), will be created with options`);
-        } else {
-          console.warn(`[RabbitMQClient] [mq-client-core] [CONSUMER] checkQueue() failed for ${queue}:`, checkErr.message);
-        }
-      }
-      
-      // Ensure queue channel is available
-      await this._ensureQueueChannel();
-      if (!this._queueChannel) {
-        throw new Error('Queue channel is not available (connection may be closed)');
-      }
+    let queueOptions;
 
-      if (isInfraQueue) {
-        // IMPORTANT: Do NOT auto-create infrastructure queues in consumers.
-        // If missing, fail-fast. The owning infra service must recreate on startup.
-        try {
-          this._trackChannelOperation(this._queueChannel, `checkQueue ${queue}`);
-          await this._queueChannel.checkQueue(queue);
-          console.log(`[RabbitMQClient] [mq-client-core] [CONSUMER] ✓ Infrastructure queue ${queue} exists (consumer will proceed)`);
-        } catch (checkErr) {
-          if (checkErr.code === 404) {
-            throw new Error(missingInfrastructureQueueMessage(queue));
-          }
-          throw checkErr;
-        }
-      } else {
-        // Business queue (or unknown) - assert with canonical parameters to prevent 406 drift.
-        try {
-          console.log(`[RabbitMQClient] [mq-client-core] [CONSUMER] About to call assertQueue(${queue}, ${JSON.stringify(queueOptions)})`);
-          this._trackChannelOperation(this._queueChannel, `assertQueue ${queue}`);
-          await this._queueChannel.assertQueue(queue, queueOptions);
-          console.log(`[RabbitMQClient] [mq-client-core] [CONSUMER] ✓ Queue ${queue} asserted successfully`);
-        } catch (assertErr) {
-          // If queue exists with different arguments (406), this is a CRITICAL ERROR
-          // We should NOT proceed - the root cause must be fixed
-          if (assertErr.code === 406) {
-            console.error(`[RabbitMQClient] [mq-client-core] [CONSUMER] ✗ CRITICAL: Queue ${queue} exists with different arguments!`);
-            console.error(`[RabbitMQClient] [mq-client-core] [CONSUMER] Error:`, assertErr.message);
-            console.error(`[RabbitMQClient] [mq-client-core] [CONSUMER] Expected options:`, JSON.stringify(queueOptions, null, 2));
-            console.error(`[RabbitMQClient] [mq-client-core] [CONSUMER] This means assertQueue() was called without parameters somewhere else. Root cause must be fixed!`);
-            throw new Error(`Cannot assertQueue ${queue}: queue exists with different arguments. Root cause: assertQueue() was called without parameters. Fix the root cause instead of proceeding.`);
-          }
-          // Other error - rethrow
-          throw assertErr;
-        }
-      }
-      }
-      // Set prefetch if provided (on consumer channel)
-      if (typeof prefetch === 'number') {
-        this._consumerChannel.prefetch(prefetch);
-        
-        // Track prefetch for monitoring
-        if (!this._prefetchTracking.has(queue)) {
-          this._prefetchTracking.set(queue, {
-            prefetchCount: prefetch,
-            inFlight: 0,
-            lastCheck: Date.now()
-          });
-        } else {
-          const tracking = this._prefetchTracking.get(queue);
-          tracking.prefetchCount = prefetch;
-        }
-        
-        // Start prefetch monitoring if not already started
-        if (!this._prefetchCheckTimer) {
-          this._startPrefetchMonitoring();
-        }
-      }
+    try {
+      // Classify the queue, resolve its declared arguments, refuse it if the
+      // config declares no dead-letter route, check or assert it. ONE rail,
+      // shared with `_reRegisterConsumers()`.
+      queueOptions = await this._prepareQueueForConsume(queue, {
+        durable,
+        queueOptions: options.queueOptions
+      });
+      // Set prefetch if provided (on consumer channel). ONE rail, shared with
+      // `_reRegisterConsumers()` — prefetch belongs to the consumer, not to the
+      // channel that happened to be open when it first attached.
+      await this._applyConsumerPrefetch(queue, prefetch);
 
       // CRITICAL: Log before calling amqplib's consume()
       // amqplib's consume() may internally call assertQueue() without parameters if queue doesn't exist
       // This would create queue with default arguments (no TTL), causing 406 errors later
-      console.log(`[RabbitMQClient] [mq-client-core] [CONSUMER] About to call amqplib's consumerChannel.consume(${queue})`);
-      console.log(`[RabbitMQClient] [mq-client-core] [CONSUMER] ⚠ WARNING: amqplib's consume() may internally call assertQueue() WITHOUT parameters if queue doesn't exist`);
-      console.log(`[RabbitMQClient] [mq-client-core] [CONSUMER] ⚠ WARNING: We already asserted queue with correct parameters above - this should prevent auto-creation`);
+      this._logger.debug(`[RabbitMQClient] [mq-client-core] [CONSUMER] About to call amqplib's consumerChannel.consume(${queue})`);
+      this._logger.debug(`[RabbitMQClient] [mq-client-core] [CONSUMER] ⚠ WARNING: amqplib's consume() may internally call assertQueue() WITHOUT parameters if queue doesn't exist`);
+      this._logger.debug(`[RabbitMQClient] [mq-client-core] [CONSUMER] ⚠ WARNING: We already asserted queue with correct parameters above - this should prevent auto-creation`);
       
       // Use dedicated consumer channel for consume operations
       // This prevents conflicts with ConfirmChannel used for publish operations
@@ -1740,9 +3313,11 @@ class RabbitMQClient extends EventEmitter {
         
         // Structured log: message received
         const msgHeaders = msg.properties?.headers || {};
-        const wfId = msgHeaders.workflowId || msgHeaders.workflow_id || 'unknown';
+        const wfId = workflowIdOf(msgHeaders);
         const msgSize = msg.content ? msg.content.length : 0;
-        this._log.input(wfId, 'MSG_RECEIVED', {
+        this._logger.debug('[RabbitMQClient] MSG_RECEIVED', {
+          workflow_id: wfId,
+          action: 'MSG_RECEIVED',
           handler: 'consume',
           function: 'RabbitMQClient.consume',
           input: {
@@ -1760,12 +3335,63 @@ class RabbitMQClient extends EventEmitter {
           this._checkPrefetchUtilization(queue, tracking);
         }
         
+        // Which attempt this delivery is, read from the header this library
+        // writes (`../config/deliveryPolicy.js`). `null` = the header carries a
+        // value this library never wrote, so the message cannot be bounded and
+        // the handler is NOT run for it; it is rejected below.
+        const attemptsMade = deliveryPolicy.readAttemptsMade(msgHeaders);
+        const attempt = attemptsMade === null ? null : attemptsMade + 1;
+
+        if (attempt === null) {
+          this._logger.error(
+            '[RabbitMQClient] Unreadable delivery counter - the '
+              + `${deliveryPolicy.ATTEMPTS_HEADER} header of a message on "${queue}" holds `
+              + `${JSON.stringify(msgHeaders[deliveryPolicy.ATTEMPTS_HEADER])}, which is not a `
+              + 'non-negative integer. Expected: only this library writes that header. '
+              + 'Fix: the message is rejected into the dead-letter queue unread — reading a '
+              + 'malformed counter as zero would make the redelivery loop unbounded again.',
+            { queue }
+          );
+          await this._rejectDelivery({
+            msg,
+            queue,
+            channelForMsg,
+            noAck,
+            error: new Error(
+              `[RabbitMQClient] Message on "${queue}" carries an unreadable `
+                + `${deliveryPolicy.ATTEMPTS_HEADER} header`
+            ),
+            classification: deliveryPolicy.UNCLASSIFIABLE,
+            attempts: null,
+            maxAttempts: policy.maxAttempts,
+            onDeadLetter
+          });
+          if (tracking) {
+            tracking.inFlight = Math.max(0, tracking.inFlight - 1);
+            tracking.lastCheck = Date.now();
+          }
+          return;
+        }
+
         try {
-          await onMessage(msg);
+          // The handler is told WHICH attempt it is on, so a side effect that
+          // must happen once — the RPC error reply above all — happens on the
+          // last attempt only, instead of once per redelivery. A handler that
+          // takes one argument ignores the second.
+          await onMessage(msg, {
+            attempt,
+            maxAttempts: policy.maxAttempts,
+            isFinalAttempt: attempt >= policy.maxAttempts
+          });
           // Acknowledge message after successful processing
           if (!noAck && !msg._mqProcessed) {
-            if (!channelForMsg || channelForMsg.closed) {
-              console.warn('[RabbitMQClient] [mq-client-core] [CONSUMER] Cannot ack - consumer channel is closed/recreated (message will be requeued by broker)');
+            // Liveness comes from the ONE source the channel handlers set
+            // first-hand (`_isChannelAlive()`, d.260). The reading this
+            // replaced, `channelForMsg.closed`, asked amqplib for a property it
+            // does not define, so it answered "alive" for the channel the
+            // broker had just killed and handed the corpse an `ack`.
+            if (!this._isChannelAlive(channelForMsg)) {
+              this._logger.warn('[RabbitMQClient] [mq-client-core] [CONSUMER] Cannot ack - consumer channel is closed/recreated (message will be requeued by broker)');
               return;
             }
             try {
@@ -1775,12 +3401,14 @@ class RabbitMQClient extends EventEmitter {
               const m = ackErr && ackErr.message ? ackErr.message : '';
               if (m.includes('unknown delivery tag') || m.includes('PRECONDITION_FAILED') || m.includes('Channel closed')) {
                 msg._mqProcessed = true;
-                console.warn('[RabbitMQClient] [mq-client-core] [CONSUMER] Ack failed due to invalid delivery tag / closed channel (message delivery will be handled by broker)', { error: m });
+                this._logger.warn('[RabbitMQClient] [mq-client-core] [CONSUMER] Ack failed due to invalid delivery tag / closed channel (message delivery will be handled by broker)', { error: m });
                 return;
               }
               throw ackErr;
             }
-            this._log.output(wfId, 'MSG_ACKED', {
+            this._logger.debug('[RabbitMQClient] MSG_ACKED', {
+              workflow_id: wfId,
+              action: 'MSG_ACKED',
               handler: 'consume',
               function: 'RabbitMQClient.consume',
               input: { queue },
@@ -1793,17 +3421,23 @@ class RabbitMQClient extends EventEmitter {
             }
           }
         } catch (handlerErr) {
-          // Negative acknowledge and requeue by default
-          // Skip if already acked/nacked by the handler (prevents double ack → 406)
-          if (!msg._mqProcessed && channelForMsg && !channelForMsg.closed) {
-            try {
-              channelForMsg.nack(msg, false, true);
-              msg._mqProcessed = true;
-            } catch (nackErr) {
-              msg._mqProcessed = true;
-              console.warn(`[RabbitMQClient] [mq-client-core] Failed to nack message (channel may be closed): ${nackErr.message}`);
-            }
-          }
+          // The dead-letter policy decides what a failed handler costs: one more
+          // attempt (a copy carrying the advanced counter, then an ack of the
+          // original) or a rejection into `<svc>.dlq`. Until 2026-09-11 this
+          // branch was an unconditional `nack(msg, false, true)` with no counter,
+          // so a permanently failing message was redelivered for ever and the DLQ
+          // the topology declares was never reached from the client side
+          // (`docs/governance/confirmations/mq-consumer-contract.md` 002 point 3).
+          await this._applyDeliveryPolicy({
+            msg,
+            queue,
+            channelForMsg,
+            noAck,
+            error: handlerErr,
+            attempt,
+            policy,
+            onDeadLetter
+          });
           if (tracking) {
             tracking.inFlight = Math.max(0, tracking.inFlight - 1);
             tracking.lastCheck = Date.now();
@@ -1824,7 +3458,7 @@ class RabbitMQClient extends EventEmitter {
         consumerTag: consumeResult.consumerTag
       });
       
-      console.log(`[RabbitMQClient] [mq-client-core] [CONSUMER] ✓ Consumer registered for queue "${queue}" (consumerTag: ${consumeResult.consumerTag})`);
+      this._logger.info(`[RabbitMQClient] [mq-client-core] [CONSUMER] ✓ Consumer registered for queue "${queue}" (consumerTag: ${consumeResult.consumerTag})`);
       
       // Return consumer tag for cancellation
       return consumeResult.consumerTag;
@@ -1841,15 +3475,37 @@ class RabbitMQClient extends EventEmitter {
    * @returns {Promise<void>}
    */
   async _reconnectWithBackoff() {
+    if (this._closedByCaller) {
+      this._logger.debug(
+        '[RabbitMQClient] Client was closed by its caller - no connection-level recovery'
+      );
+      return;
+    }
+    if (this._connectionFatal) {
+      this._logger.warn(
+        '[RabbitMQClient] Connection already declared permanently lost - no further recovery attempts'
+      );
+      return;
+    }
     if (this._reconnecting) {
-      console.log('[RabbitMQClient] Reconnection already in progress, skipping');
+      this._logger.debug('[RabbitMQClient] Reconnection already in progress, skipping');
       return;
     }
 
     this._reconnecting = true;
-    console.log(`[RabbitMQClient] Starting connection-level recovery (attempt ${this._reconnectAttempts + 1}/${this._maxReconnectAttempts})...`);
+    // A CYCLE is one whole attempt budget. The first is started by the death of
+    // the connection, every further one by `_resumeRecovery()` when somebody uses
+    // the client. The counter is what makes the lazy retry finite, and it goes
+    // back to 0 the moment a cycle succeeds.
+    this._reconnectCycles += 1;
+    this._logger.info(
+      `[RabbitMQClient] Starting connection-level recovery, cycle ${this._reconnectCycles}/${this._maxReconnectCycles} `
+        + `(attempt ${this._reconnectAttempts + 1}/${this._maxReconnectAttempts})...`
+    );
+
+    let lastError = null;
 
-    while (this._reconnectAttempts < this._maxReconnectAttempts && !this._disconnecting) {
+    while (this._reconnectAttempts < this._maxReconnectAttempts && !this._closedByCaller) {
       try {
         // Calculate exponential backoff delay: baseDelay * 2^attempts, capped at maxDelay
         const delay = Math.min(
@@ -1857,72 +3513,70 @@ class RabbitMQClient extends EventEmitter {
           this._reconnectMaxDelay
         );
         
-        console.log(`[RabbitMQClient] Waiting ${delay}ms before reconnection attempt ${this._reconnectAttempts + 1}...`);
+        this._logger.debug(`[RabbitMQClient] Waiting ${delay}ms before reconnection attempt ${this._reconnectAttempts + 1}...`);
         await new Promise(resolve => this._setTimeout(resolve, delay));
 
         // Check if we started disconnecting during the wait
-        if (this._disconnecting) {
-          console.log('[RabbitMQClient] Disconnecting during reconnection wait, aborting');
+        if (this._closedByCaller) {
+          this._logger.info('[RabbitMQClient] Disconnecting during reconnection wait, aborting');
+          this._reconnecting = false;
           return;
         }
 
         // Attempt to reconnect
-        console.log(`[RabbitMQClient] Reconnection attempt ${this._reconnectAttempts + 1}...`);
-        
-        // Close old connection if exists
-        if (this._connection) {
-          try {
-            await this._connection.close();
-          } catch (_) {
-            // Ignore errors when closing already-closed connection
-          }
-          this._connection = null;
-        }
+        this._logger.info(`[RabbitMQClient] Reconnection attempt ${this._reconnectAttempts + 1}...`);
 
         // Reconnect
-        const rawTarget = this._config.host || this._config.url;
-        const heartbeat = this._config.heartbeat ?? 30;
-        const connectionName =
-          this._config.connectionName ||
-          this._config.clientName ||
-          `oa-client:${runtimeCfg.get('serviceName')}:${process.pid}`;
-
-        const connectArgs = typeof rawTarget === 'string'
-          ? [rawTarget, { heartbeat, clientProperties: { connection_name: connectionName } }]
-          : [{ ...rawTarget, heartbeat, clientProperties: { connection_name: connectionName } }];
-
-        const connectPromise = amqp.connect(...connectArgs);
+        const connectPromise = amqp.connect(
+          this._connectionTarget(),
+          this._connectionSocketOptions()
+        );
         const timeoutPromise = new Promise((_, reject) => {
-          this._setTimeout(() => reject(new Error('Connection timeout after 10 seconds')), 10000);
+          this._setTimeout(() => reject(new ConnectionError(
+            `[RabbitMQClient] Connection timeout after ${this._connectTimeout} ms while reconnecting - `
+              + `Expected: the broker to accept a TCP+AMQP handshake within connectTimeout (${this._connectTimeout} ms). `
+              + 'Fix: check the broker is up and reachable from this container; the reconnect retries until the attempt budget is spent.'
+          )), this._connectTimeout);
         });
 
-        this._connection = await Promise.race([connectPromise, timeoutPromise]);
-        console.log('[RabbitMQClient] ✓ Connection re-established');
-
-        // Re-attach connection event handlers
-        this._connection.on('error', (err) => {
-          console.error('[RabbitMQClient] Connection error:', err.message);
-          this.emit('error', err);
-        });
+        const revived = await Promise.race([connectPromise, timeoutPromise]);
 
-        this._connection.on('close', () => {
-          console.warn('[RabbitMQClient] Connection closed unexpectedly');
-          this._channel = null;
-          this._queueChannel = null;
-          this._consumerChannel = null;
-          this.emit('error', new Error('RabbitMQ connection closed unexpectedly'));
-          
-          // Attempt to reconnect again if enabled
-          if (this._reconnectEnabled && !this._reconnecting) {
-            this._reconnectWithBackoff().catch(err => {
-              console.error('[RabbitMQClient] Reconnection failed after all attempts:', err.message);
-              this.emit('error', err);
-            });
+        // The caller may have disposed of this client while that handshake was
+        // in flight. The socket is up, and it belongs to nobody: keeping it
+        // would revive a client its owner has already ended, and dropping the
+        // reference without closing it would leak an open handle that keeps the
+        // process alive. Close it, and stop.
+        if (this._closedByCaller) {
+          this._logger.info(
+            '[RabbitMQClient] Client was closed by its caller during recovery - closing the re-established connection'
+          );
+          try {
+            await revived.close();
+          } catch (closeErr) {
+            this._logger.warn(
+              `[RabbitMQClient] Error closing the connection re-established after disconnect: ${closeErr.message}`
+            );
           }
-        });
+          this._connection = null;
+          this._connectionAlive = false;
+          this._reconnecting = false;
+          this._clearAllTimers();
+          return;
+        }
+
+        this._connection = revived;
+        // The socket is up. The CLIENT is not yet: `_reconnecting` stays true
+        // until the channels below are back, and `isConnected()` reads it, so
+        // nobody is told "connected" while there is nothing to publish on
+        // (d.340).
+        this._connectionAlive = true;
+        this._logger.info('[RabbitMQClient] ✓ Connection re-established');
+
+        // Re-attach connection event handlers — the same rail as the first connect.
+        this._attachConnectionHandlers(this._connection);
 
         // Recreate all channels with best effort - partial success is better than total failure
-        console.log('[RabbitMQClient] Recreating channels...');
+        this._logger.debug('[RabbitMQClient] Recreating channels...');
         
         const channelState = { publisher: false, queue: false, consumer: false };
         let consumerReRegResult = { reRegistered: 0, failed: 0 };
@@ -1931,9 +3585,9 @@ class RabbitMQClient extends EventEmitter {
         try {
           await this._ensurePublisherChannel();
           channelState.publisher = true;
-          console.log('[RabbitMQClient] ✓ Publisher channel recreated');
+          this._logger.info('[RabbitMQClient] ✓ Publisher channel recreated');
         } catch (err) {
-          console.error('[RabbitMQClient] Failed to recreate publisher channel:', err.message);
+          this._logger.error('[RabbitMQClient] Failed to recreate publisher channel:', err.message);
           // Continue - partial success is better than total failure
         }
         
@@ -1941,9 +3595,9 @@ class RabbitMQClient extends EventEmitter {
         try {
           await this._ensureQueueChannel();
           channelState.queue = true;
-          console.log('[RabbitMQClient] ✓ Queue channel recreated');
+          this._logger.info('[RabbitMQClient] ✓ Queue channel recreated');
         } catch (err) {
-          console.error('[RabbitMQClient] Failed to recreate queue channel:', err.message);
+          this._logger.error('[RabbitMQClient] Failed to recreate queue channel:', err.message);
           // Continue - partial success is better than total failure
         }
         
@@ -1959,15 +3613,19 @@ class RabbitMQClient extends EventEmitter {
           // Re-register all consumers - use internal helper to avoid the "channel already open" check
           consumerReRegResult = await this._reRegisterConsumers();
           channelState.consumer = true;
-          console.log('[RabbitMQClient] ✓ Consumer channel recreated');
+          this._logger.info('[RabbitMQClient] ✓ Consumer channel recreated');
         } catch (err) {
-          console.error('[RabbitMQClient] Failed to recreate consumer channel:', err.message);
+          this._logger.error('[RabbitMQClient] Failed to recreate consumer channel:', err.message);
           this._consumerChannel = null;
           // Continue - partial success is better than total failure
         }
 
-        // Reset reconnect state
+        // Reset reconnect state. The cycle counter goes with it: a client that
+        // recovered owes nothing for the outage it survived, so the next one
+        // starts again at cycle 1 (d.339).
         this._reconnectAttempts = 0;
+        this._reconnectCycles = 0;
+        this._lastConnectionError = null;
         this._reconnecting = false;
         
         // Emit reconnected event with state information
@@ -1978,49 +3636,85 @@ class RabbitMQClient extends EventEmitter {
           timestamp: new Date().toISOString()
         };
         
-        console.log('[RabbitMQClient] ✓ Connection-level recovery completed', JSON.stringify(reconnectState, null, 2));
+        this._logger.info('[RabbitMQClient] ✓ Connection-level recovery completed', JSON.stringify(reconnectState, null, 2));
         this.emit('reconnected', reconnectState);
         
         // Flush buffered messages po reconnectu
-        let bufferFlushResult = { inMemory: 0, persistent: 0, flushed: false };
+        let bufferFlushResult = { inMemory: 0, flushed: false };
         try {
           const flushResult = await this._publishLayer.flushBuffered();
-          bufferFlushResult = {
-            inMemory: flushResult.inMemory || 0,
-            persistent: flushResult.persistent || 0,
-            flushed: true
-          };
-          this._publishMonitor.trackFlushed(bufferFlushResult.inMemory + bufferFlushResult.persistent);
-          console.log(`[RabbitMQClient] ✓ Flushed ${bufferFlushResult.inMemory + bufferFlushResult.persistent} buffered messages after reconnection`);
+          bufferFlushResult = { inMemory: flushResult, flushed: true };
+          this._publishMonitor.trackFlushed(bufferFlushResult.inMemory);
+          this._logger.info(`[RabbitMQClient] ✓ Flushed ${bufferFlushResult.inMemory} buffered messages after reconnection`);
         } catch (flushErr) {
-          console.warn(`[RabbitMQClient] Failed to flush buffered messages after reconnection: ${flushErr.message}`);
+          this._logger.warn(`[RabbitMQClient] Failed to flush buffered messages after reconnection: ${flushErr.message}`);
           this.emit('buffer:flush:failed', { error: flushErr.message, bufferSize: this._publishLayer._buffer.size() });
         }
         
         // If critical channels failed, log warning but don't throw - connection is re-established
         if (!channelState.publisher) {
-          console.warn('[RabbitMQClient] ⚠ Publisher channel not ready after reconnection - publish operations may fail');
+          this._logger.warn('[RabbitMQClient] ⚠ Publisher channel not ready after reconnection - publish operations may fail');
         }
         if (!channelState.queue) {
-          console.warn('[RabbitMQClient] ⚠ Queue channel not ready after reconnection - queue operations may fail');
+          this._logger.warn('[RabbitMQClient] ⚠ Queue channel not ready after reconnection - queue operations may fail');
         }
         if (!channelState.consumer) {
-          console.warn('[RabbitMQClient] ⚠ Consumer channel not ready after reconnection - consume operations may fail');
+          this._logger.warn('[RabbitMQClient] ⚠ Consumer channel not ready after reconnection - consume operations may fail');
         }
         
         return; // Success - exit reconnection loop
       } catch (err) {
+        lastError = err;
         this._reconnectAttempts++;
-        console.error(`[RabbitMQClient] Reconnection attempt ${this._reconnectAttempts} failed:`, err.message);
-        
+        this._logger.error(`[RabbitMQClient] Reconnection attempt ${this._reconnectAttempts} failed:`, err.message);
+
+        // The broker ANSWERED and refused. Spending the rest of the budget on it
+        // would be retrying a decision, not an outage (d.339).
+        if (this._isBrokerRefusal(err)) {
+          this._logger.error('[RabbitMQClient] ✗ The broker refused the connection - no further attempts');
+          throw this._failFatally(err, 'broker-refused');
+        }
+
         if (this._reconnectAttempts >= this._maxReconnectAttempts) {
-          console.error(`[RabbitMQClient] ✗ Connection-level recovery failed after ${this._maxReconnectAttempts} attempts`);
-          this._reconnecting = false;
-          throw new Error(`Failed to reconnect after ${this._maxReconnectAttempts} attempts: ${err.message}`);
+          this._logger.error(`[RabbitMQClient] ✗ Connection-level recovery failed after ${this._maxReconnectAttempts} attempts`);
+          throw this._endOfCycle(err);
         }
         // Continue to next attempt
       }
     }
+
+    // The loop can also fall through without ever running its body: the budget
+    // was already spent by an earlier recovery round. Before 2026-09-07 that
+    // path returned silently with `_reconnecting` left at true, which made every
+    // later recovery a no-op ("already in progress") and hung
+    // `_waitForReconnection()` for its full timeout. The state is the same as an
+    // exhausted round, so it is reported the same way.
+    if (this._closedByCaller) {
+      this._reconnecting = false;
+      return;
+    }
+    throw this._endOfCycle(lastError);
+  }
+
+  /**
+   * A cycle ended without a connection and the broker never refused one. Which
+   * of the two endings is it — stand down and wait to be used, or the bounded
+   * end of the lazy retry?
+   *
+   * ONE place decides, because there are two sites that reach this state (the
+   * attempt budget running out inside the loop, and the loop falling through on
+   * a budget an earlier round already spent) and a decision written twice
+   * diverges.
+   *
+   * @param {Error|null} lastError
+   * @returns {Error} the error to throw
+   * @private
+   */
+  _endOfCycle(lastError) {
+    if (this._reconnectCycles >= this._maxReconnectCycles) {
+      return this._failFatally(lastError, 'cycles-spent');
+    }
+    return this._standDown(lastError);
   }
 
   /**
@@ -2028,64 +3722,75 @@ class RabbitMQClient extends EventEmitter {
    * @private
    */
   _attachPublisherChannelHandlers(channel) {
+    // One closure, one notification. amqplib announces a broker-side channel
+    // death TWICE — `error` first, then `close` (measured against amqplib 0.10.9
+    // on the live broker, 2026-09-12: a `checkQueue()` on a missing queue yields
+    // `["error:404","close","rpcReject:404"]`). Until d.264 both handlers called
+    // `_callChannelCloseHooks()`, so every hook and every `channel:close`
+    // listener heard one death twice and `_trackChannelClose()` recorded two
+    // entries for it — which made channel thrashing fire at HALF of
+    // `thrashingThreshold`, an alarm at the wrong number.
+    // The rail is the `close` handler, because `close` always arrives, with or
+    // without a preceding `error`. The `error` handler only records WHY the
+    // channel is dying, here, for the one notification to carry.
+    channel._closeError = null;
+    channel._alive = true;
     channel.on('error', async (err) => {
-      if (this._disconnecting) {
+      channel._alive = false;
+      if (this._closedByCaller) {
         return;
       }
       const reason = `Publisher channel error: ${err.message} (code: ${err.code || 'unknown'})`;
       channel._closeReason = reason;
-      
+
       // "unknown delivery tag" errors occur when channel closes during publish
       // This is expected - the publish callback will handle retry
       // We still log it but don't try to recreate channel (it's already closing)
       if (err.message && err.message.includes('unknown delivery tag')) {
-        console.warn(`[RabbitMQClient] [mq-client-core] Publisher channel error (channel closing during publish): ${err.message}`);
+        this._logger.warn(`[RabbitMQClient] [mq-client-core] Publisher channel error (channel closing during publish): ${err.message}`);
         // Don't try to recreate - channel is already closing
         // Don't emit error - publish callback will handle retry
         return;
       }
       
-      console.error(`[RabbitMQClient] [mq-client-core] ${reason}`);
-      this._callChannelCloseHooks('publisher', channel, err, reason);
-      
-      // Only try to recreate if connection is available
-      // If connection is closed, reconnection logic will handle channel recreation
-      if (this._connection && !this._connection.closed) {
-        try {
-          await this._ensurePublisherChannel();
-        } catch (recreateErr) {
-          // Ignore errors during channel recreation if connection is closing
-          console.warn(`[RabbitMQClient] [mq-client-core] Failed to recreate publisher channel (connection may be closing): ${recreateErr.message}`);
-        }
-      }
-      
+      this._logger.error(`[RabbitMQClient] [mq-client-core] ${reason}`);
+      channel._closeError = err;
+      // Recovery is NOT started here — one rail, the `close` handler (d.261).
       this.emit('error', err);
     });
     
     channel.on('close', async () => {
-      if (this._disconnecting) {
+      if (this._closedByCaller) {
         return;
       }
+      channel._alive = false;
       const reason = channel._closeReason || 'Publisher channel closed unexpectedly';
-      console.warn(`[RabbitMQClient] [mq-client-core] ${reason} - will auto-recreate on next publish`);
-      this._callChannelCloseHooks('publisher', channel, null, reason);
-      const closedChannel = this._channel;
-      this._channel = null;
+      this._logger.warn(`[RabbitMQClient] [mq-client-core] ${reason} - will auto-recreate on next publish`);
+      this._callChannelCloseHooks('publisher', channel, channel._closeError || null, reason);
+      // Clear the reference ONLY if it still points at the channel that died.
+      // A stale channel's obituary must not erase a live successor: measured
+      // 2026-09-12 on the live integration tier, an unconditional `= null` here
+      // wiped a channel that had just been opened, and `consume()` then refused
+      // with "Queue channel is not available" against a perfectly open
+      // connection.
+      if (this._channel === channel) {
+        this._channel = null;
+      }
       
       // Only try to recreate if connection is available
       // If connection is closed, reconnection logic will handle channel recreation
-      if (this._connection && !this._connection.closed) {
+      if (this._connectionAlive) {
         try {
           await this._ensurePublisherChannel();
         } catch (err) {
           // Ignore errors during channel recreation if connection is closing
-          console.warn(`[RabbitMQClient] [mq-client-core] Failed to recreate publisher channel (connection may be closing): ${err.message}`);
+          this._logger.warn(`[RabbitMQClient] [mq-client-core] Failed to recreate publisher channel (connection may be closing): ${err.message}`);
         }
       }
     });
     
     channel.on('drain', () => {
-      console.log('[RabbitMQClient] [mq-client-core] Publisher channel drained');
+      this._logger.debug('[RabbitMQClient] [mq-client-core] Publisher channel drained');
     });
   }
 
@@ -2094,43 +3799,56 @@ class RabbitMQClient extends EventEmitter {
    * @private
    */
   _attachQueueChannelHandlers(channel) {
+    // One closure, one notification — see the note in
+    // `_attachPublisherChannelHandlers()` for the measurement behind it.
+    channel._closeError = null;
+    channel._alive = true;
     channel.on('error', async (err) => {
-      if (this._disconnecting) {
+      channel._alive = false;
+      if (this._closedByCaller) {
         return;
       }
       const reason = `Queue channel error: ${err.message} (code: ${err.code || 'unknown'})`;
       channel._closeReason = reason;
-      console.warn(`[RabbitMQClient] [mq-client-core] ${reason}`);
-      this._callChannelCloseHooks('queue', channel, err, reason);
-      await this._ensureQueueChannel();
+      channel._closeError = err;
+      this._logger.warn(`[RabbitMQClient] [mq-client-core] ${reason}`);
+      // Recovery is NOT started here — one rail, the `close` handler (d.261).
     });
     
     channel.on('close', async () => {
-      if (this._disconnecting) {
+      if (this._closedByCaller) {
         return;
       }
+      channel._alive = false;
       const reason = channel._closeReason || 'Queue channel closed unexpectedly';
-      console.warn(`[RabbitMQClient] [mq-client-core] ${reason} - will auto-recreate on next operation`);
-      this._callChannelCloseHooks('queue', channel, null, reason);
-      const closedChannel = this._queueChannel;
-      this._queueChannel = null;
+      this._logger.warn(`[RabbitMQClient] [mq-client-core] ${reason} - will auto-recreate on next operation`);
+      this._callChannelCloseHooks('queue', channel, channel._closeError || null, reason);
+      // Clear the reference ONLY if it still points at the channel that died.
+      // A stale channel's obituary must not erase a live successor: measured
+      // 2026-09-12 on the live integration tier, an unconditional `= null` here
+      // wiped a channel that had just been opened, and `consume()` then refused
+      // with "Queue channel is not available" against a perfectly open
+      // connection.
+      if (this._queueChannel === channel) {
+        this._queueChannel = null;
+      }
       
       // PREDICTABLE: Only recreate if connection is available and not closing
       // If connection is closed, reconnection logic will handle channel recreation
-      if (this._connection && !this._connection.closed && !this._reconnecting) {
+      if (this._connectionAlive && !this._reconnecting) {
         try {
           await this._ensureQueueChannel();
         } catch (err) {
           // If connection is closing, this is expected - don't throw
           if (err.message && err.message.includes('Connection closed')) {
-            console.warn(`[RabbitMQClient] [mq-client-core] Queue channel close during connection closure (expected - reconnection will handle)`);
+            this._logger.warn(`[RabbitMQClient] [mq-client-core] Queue channel close during connection closure (expected - reconnection will handle)`);
           } else {
             // Log but don't throw - channel will be recreated on next use or during reconnection
-            console.warn(`[RabbitMQClient] [mq-client-core] Failed to recreate queue channel: ${err.message} (will be recreated on next use)`);
+            this._logger.warn(`[RabbitMQClient] [mq-client-core] Failed to recreate queue channel: ${err.message} (will be recreated on next use)`);
           }
         }
       } else {
-        console.warn(`[RabbitMQClient] [mq-client-core] Queue channel closed - will be recreated during reconnection or on next use`);
+        this._logger.warn(`[RabbitMQClient] [mq-client-core] Queue channel closed - will be recreated during reconnection or on next use`);
       }
     });
   }
@@ -2140,36 +3858,49 @@ class RabbitMQClient extends EventEmitter {
    * @private
    */
   _attachConsumerChannelHandlers(channel) {
+    // One closure, one notification — see the note in
+    // `_attachPublisherChannelHandlers()` for the measurement behind it.
+    channel._closeError = null;
+    channel._alive = true;
     channel.on('error', async (err) => {
-      if (this._disconnecting) {
+      channel._alive = false;
+      if (this._closedByCaller) {
         return;
       }
       const reason = `Consumer channel error: ${err.message} (code: ${err.code || 'unknown'})`;
       channel._closeReason = reason;
-      console.warn(`[RabbitMQClient] [mq-client-core] ${reason}`);
-      this._callChannelCloseHooks('consumer', channel, err, reason);
-      await this._ensureConsumerChannel();
+      channel._closeError = err;
+      this._logger.warn(`[RabbitMQClient] [mq-client-core] ${reason}`);
+      // Recovery is NOT started here — one rail, the `close` handler (d.261).
       this.emit('error', err);
     });
     
     channel.on('close', async () => {
-      if (this._disconnecting) {
+      if (this._closedByCaller) {
         return;
       }
+      channel._alive = false;
       const reason = channel._closeReason || 'Consumer channel closed unexpectedly';
-      console.warn(`[RabbitMQClient] [mq-client-core] ${reason} - will auto-recreate and re-register consumers`);
-      this._callChannelCloseHooks('consumer', channel, null, reason);
-      const closedChannel = this._consumerChannel;
-      this._consumerChannel = null;
+      this._logger.warn(`[RabbitMQClient] [mq-client-core] ${reason} - will auto-recreate and re-register consumers`);
+      this._callChannelCloseHooks('consumer', channel, channel._closeError || null, reason);
+      // Clear the reference ONLY if it still points at the channel that died.
+      // A stale channel's obituary must not erase a live successor: measured
+      // 2026-09-12 on the live integration tier, an unconditional `= null` here
+      // wiped a channel that had just been opened, and `consume()` then refused
+      // with "Queue channel is not available" against a perfectly open
+      // connection.
+      if (this._consumerChannel === channel) {
+        this._consumerChannel = null;
+      }
       
       // Only try to recreate if connection is available
       // If connection is closed, reconnection logic will handle channel recreation
-      if (this._connection && !this._connection.closed) {
+      if (this._connectionAlive) {
         try {
           await this._ensureConsumerChannel();
         } catch (err) {
           // Ignore errors during channel recreation if connection is closing
-          console.warn(`[RabbitMQClient] [mq-client-core] Failed to recreate consumer channel (connection may be closing): ${err.message}`);
+          this._logger.warn(`[RabbitMQClient] [mq-client-core] Failed to recreate consumer channel (connection may be closing): ${err.message}`);
         }
       }
     });
@@ -2190,14 +3921,14 @@ class RabbitMQClient extends EventEmitter {
     
     if (utilization >= this._prefetchUtilizationThreshold) {
       const message = `Prefetch utilization high: queue '${queue}' has ${tracking.inFlight}/${tracking.prefetchCount} messages in-flight (${Math.round(utilization * 100)}%, threshold: ${Math.round(this._prefetchUtilizationThreshold * 100)}%)`;
-      console.warn(`[RabbitMQClient] [mq-client-core] ⚠️ ${message}`);
+      this._logger.warn(`[RabbitMQClient] [mq-client-core] ⚠️ ${message}`);
       
       // Call alert callback if provided
       if (this._prefetchAlertCallback) {
         try {
           this._prefetchAlertCallback(queue, utilization, tracking.inFlight, tracking.prefetchCount);
         } catch (alertErr) {
-          console.error(`[RabbitMQClient] [mq-client-core] Prefetch alert callback error:`, alertErr.message);
+          this._logger.error(`[RabbitMQClient] [mq-client-core] Prefetch alert callback error:`, alertErr.message);
         }
       }
       
@@ -2232,7 +3963,7 @@ class RabbitMQClient extends EventEmitter {
       }
     }, this._prefetchCheckInterval);
     
-    console.log(`[RabbitMQClient] [mq-client-core] Prefetch monitoring started (interval: ${this._prefetchCheckInterval}ms, threshold: ${Math.round(this._prefetchUtilizationThreshold * 100)}%)`);
+    this._logger.info(`[RabbitMQClient] [mq-client-core] Prefetch monitoring started (interval: ${this._prefetchCheckInterval}ms, threshold: ${Math.round(this._prefetchUtilizationThreshold * 100)}%)`);
   }
 
   /**
@@ -2258,6 +3989,219 @@ class RabbitMQClient extends EventEmitter {
     }
   }
 
+  /**
+   * Answer one failed delivery, per the dead-letter policy.
+   *
+   * Transient and budget left → publish a copy carrying the advanced counter to
+   * the SAME queue, then ack the original. That order is the whole safety
+   * argument: a copy that reaches the broker before the original leaves the
+   * queue can at worst duplicate the message, while an ack before the publish
+   * can lose it. A requeue cannot be used for this — it returns the message
+   * byte-for-byte, so it can carry no counter (measured; see
+   * ../config/deliveryPolicy.js).
+   *
+   * Anything else → reject into the dead-letter queue the broker routes for
+   * this queue (`x-dead-letter-routing-key`, `<svc>.dlq`).
+   *
+   * @param {Object} args
+   * @private
+   */
+  async _applyDeliveryPolicy({ msg, queue, channelForMsg, noAck, error, attempt, policy, onDeadLetter }) {
+    // The handler settled the message itself, or there is nothing to settle:
+    // both are the pre-existing contract of this branch, unchanged.
+    if (noAck || msg._mqProcessed) {
+      return;
+    }
+
+    // A dead channel is a THIRD case, and it is not silent. The policy spends
+    // an attempt by publishing a copy and acking the original; on a channel the
+    // broker has killed the ack cannot land, so the broker returns the original
+    // to the queue and the copy duplicates it. So nothing is settled and
+    // nothing is published — the delivery goes back to the queue by itself —
+    // and it is said out loud, because an attempt that never ran must not look
+    // like one that was spent. Liveness from the one source (`_isChannelAlive`,
+    // d.260); the reading this replaced (`channelForMsg.closed`) answered
+    // "alive" for every channel, amqplib defining no such property.
+    if (!this._isChannelAlive(channelForMsg)) {
+      this._logger.warn(
+        `[RabbitMQClient] [mq-client-core] [CONSUMER] Failed delivery on "${queue}" left unsettled - `
+          + 'the consumer channel died while the handler ran, so neither the retry copy nor the '
+          + 'rejection may be issued on it. Expected: the broker returns an unacked delivery to the '
+          + 'queue when the channel goes. Fix: none needed here — the message is redelivered and this '
+          + 'attempt is not counted against its budget.',
+        { queue, attempt, error: error && error.message ? error.message : null }
+      );
+      return;
+    }
+
+    const { classification, failure } = deliveryPolicy.classifyError(policy.classify, error);
+
+    if (failure !== null) {
+      this._logger.error(
+        '[RabbitMQClient] Error classifier refused - classify() must return '
+          + `'transient' or 'permanent'; it ${failure instanceof Error ? `threw "${failure.message}"` : failure}. `
+          + 'Expected: a total function over the errors this handler can throw. '
+          + 'Fix: the message is rejected into the dead-letter queue, because a message whose error '
+          + 'cannot be classified must not be retried on a guess.',
+        { queue, attempt }
+      );
+    }
+
+    const hasBudgetLeft = classification === deliveryPolicy.TRANSIENT && attempt < policy.maxAttempts;
+
+    if (!hasBudgetLeft) {
+      await this._rejectDelivery({
+        msg,
+        queue,
+        channelForMsg,
+        noAck,
+        error,
+        classification,
+        attempts: attempt,
+        maxAttempts: policy.maxAttempts,
+        onDeadLetter
+      });
+      return;
+    }
+
+    // One more attempt: the copy carries every property of the original — the
+    // RPC addressing included, so the reply still reaches the caller — and the
+    // counter advanced to the attempt just spent.
+    const headers = { ...(msg.properties.headers || {}) };
+    headers[deliveryPolicy.ATTEMPTS_HEADER] = attempt;
+
+    const copyOptions = {
+      headers,
+      // Preserved, never assumed: a message published transient stays transient.
+      persistent: msg.properties.deliveryMode === 2
+    };
+    for (const key of AMQP_MESSAGE_PROPERTY_KEYS) {
+      if (msg.properties[key] !== undefined && msg.properties[key] !== null && msg.properties[key] !== '') {
+        copyOptions[key] = msg.properties[key];
+      }
+    }
+
+    try {
+      await this.publish(queue, msg.content, copyOptions);
+    } catch (publishErr) {
+      // The copy did not reach the broker, so the original must NOT be acked.
+      // Requeue instead: the attempt number does not advance (the header on the
+      // requeued message is unchanged), so this delivery is repeated rather than
+      // consumed from the budget — the alternative, dead-lettering, would throw
+      // away a message that never spent its attempts because of a broker hiccup.
+      this._logger.error(
+        `[RabbitMQClient] Re-publish of a failed delivery did not reach the broker - queue "${queue}", `
+          + `attempt ${attempt} of ${policy.maxAttempts}, reason: ${publishErr.message}. `
+          + 'Expected: the copy carrying the advanced attempt counter to be accepted before the original is acked. '
+          + 'Fix: the original is requeued unchanged, so this attempt is retried, not spent; '
+          + 'check the broker and this queue for flow control.',
+        { queue, attempt }
+      );
+      try {
+        channelForMsg.nack(msg, false, true);
+        msg._mqProcessed = true;
+      } catch (nackErr) {
+        msg._mqProcessed = true;
+        this._logger.warn(
+          `[RabbitMQClient] [mq-client-core] Failed to nack message (channel may be closed): ${nackErr.message}`
+        );
+      }
+      return;
+    }
+
+    try {
+      channelForMsg.ack(msg);
+      msg._mqProcessed = true;
+    } catch (ackErr) {
+      // The copy is already in the queue. A failed ack means the broker will
+      // redeliver the original too, so the message is processed twice — said
+      // out loud rather than hidden, because the consumer's idempotency is the
+      // only thing that covers it.
+      msg._mqProcessed = true;
+      this._logger.warn(
+        '[RabbitMQClient] [mq-client-core] Ack of a re-published delivery failed (channel may be closed); '
+          + 'the copy is already queued, so the original may be delivered a second time',
+        { queue, attempt, error: ackErr.message }
+      );
+    }
+  }
+
+  /**
+   * Reject one message into the dead-letter queue the broker routes for this
+   * queue, and report it exactly once.
+   *
+   * `nack(requeue=false)` is what makes the broker dead-letter: it then stamps
+   * `x-death[0].reason = 'rejected'` on the copy it moves (measured on the live
+   * broker, 2026-09-11), which is the word the published event carries as its
+   * `status`.
+   *
+   * The `onDeadLetter` hook — and therefore the `message_dlq` event it publishes —
+   * is only ever reached for a message that CAN be dead-lettered: `consume()`
+   * refuses to register a consumer on a queue for which `queueConfig` declares no
+   * `x-dead-letter-exchange`/`-routing-key` (d.259), so by the time a delivery
+   * arrives here the route exists by declaration. Without that gate the same
+   * `nack(requeue=false)` made the broker DROP the message while this event
+   * announced it had reached `.dlq` — a report of a destination nothing routed to.
+   *
+   * @param {Object} args
+   * @private
+   */
+  async _rejectDelivery({ msg, queue, channelForMsg, noAck, error, classification, attempts, maxAttempts, onDeadLetter }) {
+    if (noAck || msg._mqProcessed) {
+      return;
+    }
+
+    // Same third case as in `_applyDeliveryPolicy()`, and here it also decides
+    // what monitoring is told: the `message_dlq` event reports a rejection the
+    // BROKER carried out, so a rejection that could not be issued must not
+    // publish one. `nack()` on a dead channel is an AMQP error, never a
+    // rejection. Liveness from the one source (`_isChannelAlive`, d.260).
+    if (!this._isChannelAlive(channelForMsg)) {
+      this._logger.warn(
+        `[RabbitMQClient] [mq-client-core] [CONSUMER] Delivery on "${queue}" not rejected - the `
+          + 'consumer channel died before the rejection could be issued, so no dead-letter event is '
+          + 'published for it. Expected: the broker returns the unacked delivery to the queue when '
+          + 'the channel goes. Fix: none needed here — the message is redelivered and rejected then.',
+        { queue, attempts, classification }
+      );
+      return;
+    }
+
+    try {
+      channelForMsg.nack(msg, false, false);
+      msg._mqProcessed = true;
+    } catch (nackErr) {
+      msg._mqProcessed = true;
+      this._logger.warn(
+        `[RabbitMQClient] [mq-client-core] Failed to nack message (channel may be closed): ${nackErr.message}`
+      );
+      return;
+    }
+
+    if (onDeadLetter === undefined) {
+      // Driving this transport directly is allowed (it is an export of this
+      // package), but then nothing owns the monitoring rail, and a message
+      // leaving for the DLQ with nobody told is the silence the contract exists
+      // to end. Said once, at the moment it happens.
+      this._logger.warn(
+        `[RabbitMQClient] Message rejected into the dead-letter queue of "${queue}" with no monitoring hook - `
+          + 'Expected: consume() through BaseClient, which injects the hook publishing the message_dlq event. '
+          + 'Fix: consume through BaseClient, or pass consume(queue, handler, { onDeadLetter }) yourself.',
+        { queue, attempts, classification }
+      );
+      return;
+    }
+
+    await onDeadLetter({
+      queue,
+      content: msg.content,
+      attempts,
+      maxAttempts,
+      classification,
+      error
+    });
+  }
+
   /**
    * Acknowledges a message.
    * @param {Object} msg - RabbitMQ message object.
@@ -2267,7 +4211,10 @@ class RabbitMQClient extends EventEmitter {
       return; // Already acked/nacked — idempotent
     }
     if (!this._consumerChannel) {
-      throw new Error('Cannot ack: consumer channel is not initialized');
+      throw new ConnectionError(
+        '[RabbitMQClient] Cannot ack: consumer channel is not initialized - Expected: an open consumer channel. '
+          + 'Fix: await client.connect() and start the consumer before acking; a message received before a reconnect can no longer be acked.'
+      );
     }
     try {
       this._consumerChannel.ack(msg);
@@ -2276,7 +4223,7 @@ class RabbitMQClient extends EventEmitter {
       const m = err && err.message ? err.message : '';
       if (m.includes('unknown delivery tag') || m.includes('PRECONDITION_FAILED') || m.includes('Channel closed')) {
         msg._mqProcessed = true;
-        console.warn('[RabbitMQClient] [mq-client-core] Cannot ack - consumer channel is closed/recreated (delivery tag invalid)', { error: m });
+        this._logger.warn('[RabbitMQClient] [mq-client-core] Cannot ack - consumer channel is closed/recreated (delivery tag invalid)', { error: m });
         return;
       }
       this.emit('error', err);
@@ -2286,15 +4233,28 @@ class RabbitMQClient extends EventEmitter {
 
   /**
    * Negative-acknowledges a message.
+   *
+   * `options` is an OBJECT, not amqplib's positional `(msg, allUpTo, requeue)`.
+   * A caller that passes the positional form hands `false` where the object is
+   * expected, so `options.requeue` reads `undefined` and the default below
+   * turns it into requeue=TRUE — the opposite of the intent, and an infinite
+   * redelivery loop. Pinned by tests/unit/nack-options-signature.test.js.
+   *
    * @param {Object} msg - RabbitMQ message object.
-   * @param {Object} [options] - { requeue: boolean }.
+   * @param {Object} [options] - { requeue: boolean }; `requeue` defaults to
+   *   `true` (an ordinary handler failure puts the message back on the queue),
+   *   so a caller that wants the message discarded must pass
+   *   `{ requeue: false }` explicitly.
    */
   async nack(msg, options = {}) {
     if (msg._mqProcessed) {
       return; // Already acked/nacked — idempotent
     }
     if (!this._consumerChannel) {
-      throw new Error('Cannot nack: consumer channel is not initialized');
+      throw new ConnectionError(
+        '[RabbitMQClient] Cannot nack: consumer channel is not initialized - Expected: an open consumer channel. '
+          + 'Fix: await client.connect() and start the consumer before nacking; a message received before a reconnect can no longer be nacked.'
+      );
     }
     const requeue = options.requeue !== undefined ? options.requeue : true;
     try {
@@ -2304,7 +4264,7 @@ class RabbitMQClient extends EventEmitter {
       const m = err && err.message ? err.message : '';
       if (m.includes('unknown delivery tag') || m.includes('PRECONDITION_FAILED') || m.includes('Channel closed')) {
         msg._mqProcessed = true;
-        console.warn('[RabbitMQClient] [mq-client-core] Cannot nack - consumer channel is closed/recreated (delivery tag invalid)', { error: m });
+        this._logger.warn('[RabbitMQClient] [mq-client-core] Cannot nack - consumer channel is closed/recreated (delivery tag invalid)', { error: m });
         return;
       }
       this.emit('error', err);