@onlineapps/mq-client-core 4.2.0 → 5.1.0

package/src/transports/rabbitmqClient.js

@@ -7,14 +7,22 @@
  */
 
 const amqp = require('amqplib');
+// amqplib's own class for "this handle is in a terminal state". It is what
+// `close()` on a closed connection and `createChannel()` on one answer with, and it
+// is read instead of the sentence those answers carry (d.696).
+const { IllegalOperationError } = require('amqplib');
 const EventEmitter = require('events');
 const {
+  AMQP_NOT_FOUND,
+  AMQP_PRECONDITION_FAILED,
   TransientPublishError,
   PermanentPublishError,
   QueueNotFoundError,
   classifyPublishError,
+  collateralCloseMessage,
   missingInfrastructureQueueMessage,
   missingQueueDefinitionMessage,
+  refusedSendMessage,
 } = require('../utils/publishErrors');
 const {
   ConnectionError,
@@ -28,7 +36,6 @@ const {
 } = require('../utils/errorHandler');
 const { assertLogger } = require('@onlineapps/logger-contract');
 const PublishLayer = require('../layers/PublishLayer');
-const RecoveryWorker = require('../workers/RecoveryWorker');
 const PublishMonitor = require('../monitoring/PublishMonitor');
 const runtimeCfg = require('../config');
 const defaultConfig = require('../config/defaultConfig');
@@ -118,11 +125,10 @@ const REFUSAL_REPLY_CODES = [403, 530, 406];
  *  - `workflow_id` is the only spelling the envelope contract admits, and a
  *    reader that accepts the camelCase alias is forbidden as such, not merely a
  *    producer that writes it (`docs/biz/70-contracts/workflow-message.md` §2.2,
- *    owner decision `workflow-message-aliases` 001). The alias is still written
- *    today by the gateway's webhook submit, whose removal is its owner's
- *    (`docs/standards/JSON_NAMING_CONVENTION.md` § alias read, `infra/TODO.md`);
- *    a reader that keeps honouring it is what makes the pair impossible to
- *    retire, because nothing then shows which producers still write it.
+ *    owner decision `workflow-message-aliases` 001). No producer in `shared/**`
+ *    or `infra/**` writes the alias (re-measured d.1134: the gateway's headers
+ *    carry `workflow_id` alone, `infra/api_gateway/shared/workflowMessageHeaders.js`),
+ *    and a reader that honoured it would hide the next producer that did.
  *  - a missing id is reported as missing. `'unknown'` is a value, and a log line
  *    carrying it claims a workflow by that name — the same reason
  *    `BaseClient._emitDeadLetterEvent()` resolves an absent id to `null` and
@@ -275,9 +281,16 @@ class RabbitMQClient extends EventEmitter {
     // socket whose channels are still being recreated is not yet usable (d.340).
     // Channels do the same through `channel._alive` (see `_isChannelAlive()`).
     this._connectionAlive = false;
+    // The broker's reason while it blocks this connection (`connection.blocked`), `null` otherwise
+    // (d.1145). Written by `_onConnectionBlocked()` / `_onConnectionUnblocked()`.
+    this._connectionBlockedBy = null;
     this._channel = null; // ConfirmChannel for publish operations
     this._queueChannel = null; // Regular channel for queue operations (assertQueue, checkQueue)
     this._consumerChannel = null; // Dedicated channel for consume operations
+    // A SECOND ConfirmChannel, for the client's own telemetry (d.724). It is created on
+    // the first telemetry publish and never before: a client that publishes no telemetry
+    // must not hold a channel for it. See `_ensurePublisherChannel()` § roles.
+    this._telemetryChannel = null;
     
     // Track active consumers for re-registration after channel recreation
     this._activeConsumers = new Map(); // queue -> { handler, options, consumerTag }
@@ -355,12 +368,14 @@ class RabbitMQClient extends EventEmitter {
     this._publishRetryBaseDelay = this._config.publishRetryBaseDelay;
     this._publishRetryMaxDelay = this._config.publishRetryMaxDelay;
     this._publishRetryBackoffMultiplier = this._config.publishRetryBackoffMultiplier;
-    // ONE number, two consumers, and therefore a name that belongs to neither of
-    // them alone: how long this client waits for an ANSWER from the broker. The
-    // publish confirm waits for it (`_publishOnce`), and so does the whole
-    // teardown of `disconnect()` (d.283 chose deliberately not to invent a second
-    // number for that; the name it inherited then said "publish confirmation",
-    // which was true of one consumer and false of the other).
+    // ONE number, and therefore a name that belongs to none of its consumers
+    // alone: how long this client waits for an ANSWER from the broker. The
+    // publish confirm waits for it (`_publishOnce`), so does the whole teardown
+    // of `disconnect()` (d.283 chose deliberately not to invent a second number
+    // for that; the name it inherited then said "publish confirmation", which was
+    // true of one consumer and false of the other), and so does every request a
+    // channel sends and waits on (`_askBroker()`, conf `mq-broker-answer-budget`
+    // 001, d.1135).
     this._brokerAnswerTimeout = this._config.brokerAnswerTimeout;
     // How long the connect handshake may take before the attempt is abandoned.
     this._connectTimeout = this._config.connectTimeout;
@@ -413,16 +428,6 @@ class RabbitMQClient extends EventEmitter {
       },
     });
 
-    // Recovery worker — connection recovery, and the report of a queue that does
-    // not exist. It creates none: queue creation left it with the two callbacks
-    // that fed it (d.419) and with `recoveryScope`, the permission they were
-    // filtered by (d.514). Which rule the report names is decided by the
-    // ownership class in the error, not by who built this client.
-    this._recoveryWorker = new RecoveryWorker({
-      client: this,
-      logger: this._logger,
-    });
-
     // Publish monitor (metriky) — counts only, reports through return values,
     // takes no logger (see PublishMonitor's header).
     this._publishMonitor = new PublishMonitor();
@@ -456,16 +461,12 @@ class RabbitMQClient extends EventEmitter {
       this._publishMonitor.trackBuffered();
     });
 
-    // Recovery worker - handle QueueNotFoundError via error event
-    this.on('error', async (err) => {
-      if (err instanceof QueueNotFoundError) {
-        try {
-          await this._recoveryWorker.handleQueueNotFound(err, { queue: err.queueName });
-        } catch (recoveryErr) {
-          // Recovery failed - error already thrown
-        }
-      }
-    });
+    // A missing queue is answered ONCE, by the refusal of the publish (d.971): the
+    // caller gets `PublishError` with the `QueueNotFoundError` as its `cause`, which
+    // names the queue, its ownership class and the Fix. Until d.971 a second worker
+    // listened on this client's `error` channel for the same verdict and repeated it
+    // into the log; d.419 had taken its only other job (creating the queue) and
+    // d.811b its input.
   }
 
   /**
@@ -483,8 +484,14 @@ class RabbitMQClient extends EventEmitter {
   }
 
   /**
-   * Get current channel state
-   * @returns {Object} Channel state information
+   * The state of every channel this client holds — the keys ARE the list:
+   * `publisher`, `queue`, `consumer` and `telemetry` (the client's own events,
+   * d.724), each as `{ exists, closed, ready }`. The telemetry channel opens on the
+   * first telemetry publish and not before; until then it reads the way any channel
+   * not yet opened reads, `{ exists: false, closed: true, ready: false }`. It was
+   * missing from this report until d.1007.
+   *
+   * @returns {{publisher: Object, queue: Object, consumer: Object, telemetry: Object}}
    */
   getChannelState() {
     return {
@@ -502,6 +509,11 @@ class RabbitMQClient extends EventEmitter {
         exists: !!this._consumerChannel,
         closed: !this._isChannelAlive(this._consumerChannel),
         ready: this._isChannelAlive(this._consumerChannel)
+      },
+      telemetry: {
+        exists: !!this._telemetryChannel,
+        closed: !this._isChannelAlive(this._telemetryChannel),
+        ready: this._isChannelAlive(this._telemetryChannel)
       }
     };
   }
@@ -524,6 +536,32 @@ class RabbitMQClient extends EventEmitter {
     return !!channel && channel._alive === true;
   }
 
+  /**
+   * Did this failure to open a channel only report the connection going away?
+   *
+   * THE rule for "a refused channel open is transient" (d.1000, d.1003, d.1003b, d.1003c)
+   * — one body, read by `_ensurePublisherChannel()` and by the consumer and queue
+   * channels' close handlers. Two carriers, neither of them a sentence:
+   *
+   *   - amqplib's CLASS: on a closing or closed connection `createChannel()` /
+   *     `createConfirmChannel()` answer `IllegalOperationError` (`'Connection closing'`,
+   *     `'Connection closed (…)'`), no `code` — measured on amqplib 0.10.9 over a live
+   *     broker (d.1000);
+   *   - this client's STATE: a connection that dies WHILE the channel opens rejects the
+   *     pending RPC with a bare `Error('Channel ended, no reply will be forthcoming')`,
+   *     no class, no code — but by then the connection has already emitted `'close'`
+   *     and `_onConnectionDied()` has dropped `_connectionAlive`, the one liveness
+   *     source (measured over a live broker, d.1003: 8 of 12 broker-side closes during
+   *     the open).
+   *
+   * @param {*} amqpError - the error amqplib answered the open with
+   * @returns {boolean}
+   * @private
+   */
+  _connectionIsGoingAway(amqpError) {
+    return amqpError instanceof IllegalOperationError || !this._connectionAlive;
+  }
+
   /**
    * THE definition of "this client's consumer is attached to that queue".
    *
@@ -549,6 +587,37 @@ class RabbitMQClient extends EventEmitter {
     return typeof consumerInfo?.consumerTag === 'string' && consumerInfo.consumerTag !== '';
   }
 
+  /**
+   * The tracked queues whose consumer is NOT attached (`_isConsumerAttached()`), in
+   * tracking order — what a recreate summary names (d.1003d).
+   *
+   * @returns {string[]}
+   * @private
+   */
+  _unattachedConsumerQueues() {
+    const unattached = [];
+    for (const [queue, consumerInfo] of this._activeConsumers.entries()) {
+      if (!this._isConsumerAttached(consumerInfo)) {
+        unattached.push(queue);
+      }
+    }
+    return unattached;
+  }
+
+  /**
+   * `_ensureConsumerChannel()`'s answer for a channel that is already alive: every
+   * tracked consumer is counted by whether it is ATTACHED, not assumed re-registered
+   * (d.1003d). `failed` is a tracked consumer without an attachment — the state a
+   * refused re-registration leaves (d.262 keeps it tracked, d.386b drops its tag).
+   *
+   * @returns {{reRegistered: number, failed: number}}
+   * @private
+   */
+  _consumerAttachmentCounts() {
+    const failed = this._unattachedConsumerQueues().length;
+    return { reRegistered: this._activeConsumers.size - failed, failed };
+  }
+
   /**
    * Get current consumer state.
    *
@@ -575,17 +644,32 @@ class RabbitMQClient extends EventEmitter {
   }
 
   /**
-   * Get current buffer state
-   * @returns {Object} Buffer state information
+   * Get current buffer state.
+   *
+   * ONE buffer, read ONCE. `MessageBuffer.size()` IS `_inMemory.size()`
+   * (`buffer/MessageBuffer.js`), so both numbers describe the same messages and
+   * both come from the same call.
+   *
+   * Until d.645 the second one came off `_buffer._inMemory?.size() || 0`, and
+   * neither operator could do anything but hide: the `?.` cannot fire, because
+   * `MessageBuffer`'s constructor always builds `_inMemory` and the line above
+   * already calls `_buffer.size()` without a guard — a buffer that is not there
+   * has thrown before this expression runs. What the pair DID produce, for a
+   * buffer whose internals were not the assumed ones, was `inMemory: 0` beside a
+   * non-zero `size`: "held, but nowhere", a state no real buffer can be in,
+   * reported without a word and indistinguishable from an empty buffer for
+   * whoever reads it (`architecture-principles.md` §3 No Fallbacks, §8 Explicit
+   * Over Implicit; `automation-gates.md` §5).
+   *
+   * @returns {{size: number, inMemory: number}} How many messages are held
    */
   getBufferState() {
-    return {
-      size: this._publishLayer._buffer.size(),
-      // No `persistent` count. There is one buffer, so a second number could
-      // only ever be 0 — a field that reports a mechanism that does not exist
-      // (d.343, `automation-gates.md` §5).
-      inMemory: this._publishLayer._buffer._inMemory?.size() || 0
-    };
+    // No `persistent` count. There is one buffer, so a second number could
+    // only ever be 0 — a field that reports a mechanism that does not exist
+    // (d.343, `automation-gates.md` §5).
+    const held = this._publishLayer._buffer.size();
+
+    return { size: held, inMemory: held };
   }
 
   /**
@@ -648,11 +732,31 @@ class RabbitMQClient extends EventEmitter {
    * @private
    */
   _connectionSocketOptions() {
-    const connectionName =
-      this._config.connectionName ||
-      this._config.clientName ||
-      `oa-client:${runtimeCfg.get('serviceName')}:${process.pid}`;
-    return { clientProperties: { connection_name: connectionName } };
+    const explicit = this._config.connectionName || this._config.clientName;
+
+    if (explicit) {
+      return { clientProperties: { connection_name: explicit } };
+    }
+
+    // Composed from THIS CLIENT'S OWN config, not from the runtime config (d.770). The
+    // name is the caller's fact and the constructor already resolved it — asking the
+    // runtime config here was a second reader of it, and the one that answered the
+    // fabricated module default `oa-service` when the caller had named itself properly.
+    if (typeof this._config.serviceName !== 'string' || this._config.serviceName === '') {
+      throw new ValidationError(
+        '[RabbitMQClient] Missing configuration - the connection has no name and no '
+          + 'serviceName to compose one from. '
+          + 'Expected: connectionName, clientName or serviceName in this client\'s config '
+          + '(BaseClient resolves serviceName from the explicit key or ENV SERVICE_NAME). '
+          + 'Fix: pass serviceName to the client, or set SERVICE_NAME in env-active/*.env.'
+      );
+    }
+
+    return {
+      clientProperties: {
+        connection_name: `oa-client:${this._config.serviceName}:${process.pid}`
+      }
+    };
   }
 
   /**
@@ -670,12 +774,86 @@ class RabbitMQClient extends EventEmitter {
    * @private
    */
   _attachConnectionHandlers(connection) {
+    // A fault is RECORDED on the connection, the way `_attach*ChannelHandlers()` has
+    // recorded a channel's since d.264 — and for the same reason (d.696). Once a
+    // connection is closed, amqplib answers every operation on it with the same
+    // `IllegalOperationError`, whether it got there by our `close()` or by a broker
+    // fault; the only difference is a sentence it composes (`Connection.toClosed()`, `lib/connection.js`).
+    // Which of the two happened is this client's own knowledge, so it is kept as state
+    // rather than read back out of a message (`error-handling.md` §6).
+    connection._closeError = null;
     connection.on('error', (err) => {
       this._connectionAlive = false;
+      connection._closeError = err;
       this._logger.error('[RabbitMQClient] Connection error:', err.message);
       this.emit('error', err);
     });
     connection.on('close', () => this._onConnectionDied());
+    // A broker in a memory or disk alarm blocks a connection that publishes and reads nothing
+    // more from it until the alarm clears; the connection stays alive, so no reconnect — and
+    // no flush — follows (measured d.1143 on the platform's image). amqplib announces the
+    // capability and re-emits both frames (`lib/connect.js`, `lib/channel_model.js`).
+    this._connectionBlockedBy = null;
+    connection.on('blocked', (reason) => this._onConnectionBlocked(connection, reason));
+    connection.on('unblocked', () => this._onConnectionUnblocked(connection));
+  }
+
+  /**
+   * The broker blocked this connection (`connection.blocked`, d.1145).
+   *
+   * Recorded as state — the publish path names it when it refuses (`_publishPathTransient()`)
+   * — and reported once as a warning. A frame of a stale connection (one this client already
+   * replaced) says nothing about the current one and is ignored.
+   *
+   * @param {Object} connection - the amqplib connection that received the frame
+   * @param {string} reason - the broker's reason (RabbitMQ: "low on memory", "low on disk")
+   * @private
+   */
+  _onConnectionBlocked(connection, reason) {
+    if (connection !== this._connection) {
+      return;
+    }
+    this._connectionBlockedBy = String(reason);
+    this._logger.warn(
+      `[RabbitMQClient] The broker blocked this connection (reason: ${this._connectionBlockedBy}) - `
+        + 'Expected: an alarm-free broker. It reads nothing this client sends until the alarm clears: '
+        + 'publishes and every request wait, and end on brokerAnswerTimeout. '
+        + 'Fix: clear the broker alarm (management API /api/health/checks/alarms names it); the buffer '
+        + 're-sends what never left once the broker unblocks the connection.'
+    );
+  }
+
+  /**
+   * The broker unblocked this connection (`connection.unblocked`, d.1145).
+   *
+   * The flush after it is the one rail `PublishLayer.flushBuffered()` with the trigger
+   * `'unblocked'`: only the entries whose frame never left the client are re-sent; the broker
+   * delivers the rest by itself (conf `mq-publish-buffer` 001). A failed flush is reported the
+   * way the flush after a reconnect reports it.
+   *
+   * @param {Object} connection - the amqplib connection that received the frame
+   * @private
+   */
+  _onConnectionUnblocked(connection) {
+    if (connection !== this._connection) {
+      return;
+    }
+    const wasBlockedBy = this._connectionBlockedBy;
+    this._connectionBlockedBy = null;
+    this._logger.warn(
+      `[RabbitMQClient] The broker unblocked this connection (it had been blocked: ${wasBlockedBy === null ? 'no blocked frame seen' : wasBlockedBy}) - `
+        + 're-sending the buffered messages whose frame never left this client.'
+    );
+    this._publishLayer.flushBuffered('unblocked').then(
+      (flushed) => {
+        this._publishMonitor.trackFlushed(flushed);
+        this._logger.info(`[RabbitMQClient] ✓ Flushed ${flushed} buffered messages after the broker unblocked the connection`);
+      },
+      (flushErr) => {
+        this._logger.warn(`[RabbitMQClient] Failed to flush buffered messages after unblocked: ${flushErr.message}`);
+        this.emit('buffer:flush:failed', { error: flushErr.message, bufferSize: this._publishLayer._buffer.size() });
+      }
+    );
   }
 
   /**
@@ -732,6 +910,15 @@ class RabbitMQClient extends EventEmitter {
   _isBrokerRefusal(err) {
     if (!err) return false;
     if (REFUSAL_REPLY_CODES.includes(err.code)) return true;
+    // THE ONE TEXT READING THIS FILE KEEPS, and it is kept because amqplib leaves nothing
+    // else. A refused HANDSHAKE is the carrier: measured 2026-09-20 against the dev broker
+    // with a wrong password, amqplib answers `connect()` with a plain `Error` whose own
+    // properties are `stack` and `message` — NO `code`, no class of its own — and whose
+    // sentence is `'Handshake terminated by server: 403 (ACCESS-REFUSED) with message …'`.
+    // The branch above cannot see it, so without this one a refused login would read as a
+    // transient connection fault and the client would retry credentials that can never
+    // work. Do not "finish the d.677 work" by deleting it: measure first, and if amqplib
+    // ever puts a code on that error, the branch above already covers it (d.696).
     const message = typeof err.message === 'string' ? err.message : '';
     return REFUSAL_REPLY_CODES.some((code) => message.includes(`server: ${code} (`));
   }
@@ -1272,7 +1459,10 @@ class RabbitMQClient extends EventEmitter {
    */
   _onConnectionDied() {
     this._connectionAlive = false;
+    // A dead connection is no longer blocked; a new one starts unblocked (d.1145).
+    this._connectionBlockedBy = null;
     this._channel = null;
+    this._telemetryChannel = null;
     this._queueChannel = null;
     this._consumerChannel = null;
     this._connection = null;
@@ -1318,12 +1508,56 @@ class RabbitMQClient extends EventEmitter {
       return { status: 'absent', error: null };
     }
 
-    const UNANSWERED = Symbol('teardown-budget-spent');
+    const outcome = await this._awaitBrokerAnswer(() => handle.close(), budgetMs);
+
+    if (outcome.status === 'unanswered') {
+      this._logger.warn(
+        `[RabbitMQClient] The broker did not answer the ${what} close within the teardown budget `
+          + `(${this._brokerAnswerTimeout}ms) - `
+          + 'Expected: a close-ok frame for the close this client sent. '
+          + 'Fix: nothing to do here — the teardown stops waiting and drops the socket, so '
+          + 'the teardown ends (disconnect(), or a connect() that failed half-way) and the process '
+          + 'can exit; a broker that never answers a close is a broker-side or network fault, and '
+          + 'the declared brokerAnswerTimeout sets how long this client gives it.'
+      );
+      return { status: 'unanswered', error: null };
+    }
+    if (outcome.status === 'refused') {
+      return { status: 'refused', error: outcome.error };
+    }
+    return { status: 'closed', error: null };
+  }
+
+  /**
+   * Wait for the broker's answer to ONE request, never longer than `budgetMs`.
+   *
+   * THE one clock for "how long does this client wait for the broker to answer" (conf
+   * `mq-broker-answer-budget` 001, d.1135). Its two readers are `_askBroker()` — every
+   * request a channel or the connection sends and waits on — and
+   * `_closeWithinTeardownBudget()`, which asks it for the `close-ok` of a teardown with what
+   * is left of that teardown's budget. The publish confirm keeps its own timer inside the
+   * send callback (`_publishOnce()`), because it is not a promise to race: it is a callback
+   * that also has to be disarmed, counted and attributed.
+   *
+   * `request` is called here, synchronously, so a request that throws before it is sent
+   * reads as a refusal rather than escaping the budget as an exception.
+   *
+   * @param {() => Promise<*>} request - sends the request and answers its reply
+   * @param {number} budgetMs - how long the answer may take
+   * @returns {Promise<{status: 'answered', value: *, pending: Promise<*>}
+   *   |{status: 'refused', error: Error, pending: Promise<*>}
+   *   |{status: 'unanswered', pending: Promise<*>}>} `pending` is the request's own
+   *   promise, for a caller that must deal with an answer arriving after the budget
+   * @private
+   */
+  async _awaitBrokerAnswer(request, budgetMs) {
+    const pending = new Promise((resolve) => resolve(request()));
+    const UNANSWERED = Symbol('broker-answer-budget-spent');
     let deadlineTimer = null;
     const outcome = await Promise.race([
-      handle.close().then(
-        () => ({ status: 'closed', error: null }),
-        (err) => ({ status: 'refused', error: err })
+      pending.then(
+        (value) => ({ status: 'answered', value }),
+        (error) => ({ status: 'refused', error })
       ),
       new Promise((resolve) => {
         deadlineTimer = this._setTimeout(() => resolve(UNANSWERED), budgetMs);
@@ -1332,19 +1566,145 @@ class RabbitMQClient extends EventEmitter {
     this._clearTimeout(deadlineTimer);
 
     if (outcome === UNANSWERED) {
-      this._logger.warn(
-        `[RabbitMQClient] The broker did not answer the ${what} close within the teardown budget `
-          + `(${this._brokerAnswerTimeout}ms) - `
-          + 'Expected: a close-ok frame for the close this client sent. '
-          + 'Fix: nothing to do here — the teardown stops waiting and drops the socket, so '
-          + 'disconnect() ends and the process can exit; a broker that never answers a close is '
-          + 'a broker-side or network fault, and the declared brokerAnswerTimeout sets how '
-          + 'long this client gives it.'
+      return { status: 'unanswered', pending };
+    }
+    return { ...outcome, pending };
+  }
+
+  /**
+   * Ask the broker one thing and wait for its answer within `brokerAnswerTimeout`.
+   *
+   * ONE rail for every request this client sends and then waits on (conf
+   * `mq-broker-answer-budget` 001, verdict A; d.1135): queue and exchange declarations,
+   * `checkQueue`, `bindQueue`, `purgeQueue`, `deleteQueue`, `basic.consume`, `basic.cancel`,
+   * `basic.qos` and every channel open. Until d.1135 none of them had a limit. A broker in a
+   * memory alarm keeps the connection open and its heartbeats flowing while it answers
+   * nothing — measured by d.1126 on an isolated broker of the platform's image: every one of
+   * these calls still pending after 300 s, settled only when the alarm was cleared; a paused
+   * broker was ended by amqplib's heartbeat after ~90 s. The heartbeat is not part of this
+   * rail: in an alarm it never fires, so only the budget ends the wait.
+   *
+   * The budget is `brokerAnswerTimeout` and never a second number — its declared meaning is
+   * exactly this question (`config/configSchema.js`).
+   *
+   * WHEN THE BUDGET IS SPENT:
+   *   - the channel that carried the request is DISCARDED (`_discardUnansweredChannel()`):
+   *     amqplib queues the requests of one channel behind each other, so every later request
+   *     on it would wait behind the silent one. The next operation opens a fresh channel;
+   *   - a request that OPENS a channel has no channel yet; the one the broker may still open
+   *     later is closed as soon as it arrives, so an alarm does not leak channels;
+   *   - the caller gets `ConnectionError` naming the operation, its target and the budget.
+   *     The publish path translates it into `TransientPublishError`
+   *     (`_publishPathTransient()`), so retry, the buffer and `bufferOnFailure: false` apply
+   *     to it exactly as to any other transient failure.
+   *
+   * A bare `Error('Channel ended, no reply will be forthcoming')` — amqplib's
+   * `_rejectPending()` answering a request whose channel or connection died first, no class,
+   * no `code` — is the same fact ("no answer came") and becomes the same class. It is
+   * recognised by the carrier's STATE, never by the sentence (d.683): no `code`, a plain
+   * `Error`, and a carrier that is dead by the time the rejection arrives (amqplib emits
+   * `close` synchronously before the rejection's handlers run). A numbered refusal is an
+   * ANSWER and passes through untouched, as does anything already typed.
+   *
+   * @param {Object} request
+   * @param {string} request.operation - the request's name, as the message states it
+   * @param {string} request.target - what it is about (queue, exchange, channel)
+   * @param {Object|null} request.channel - the channel carrying it; `null` for a channel
+   *   open, which the connection carries
+   * @param {() => Promise<*>} send - sends the request and answers its reply
+   * @returns {Promise<*>} the broker's answer
+   * @throws {ConnectionError} when no answer came within the budget, or the carrier ended
+   *   before it could
+   * @private
+   */
+  async _askBroker({ operation, target, channel }, send) {
+    const budgetMs = this._brokerAnswerTimeout;
+    const outcome = await this._awaitBrokerAnswer(send, budgetMs);
+
+    if (outcome.status === 'answered') {
+      return outcome.value;
+    }
+
+    if (outcome.status === 'unanswered') {
+      if (channel) {
+        this._discardUnansweredChannel(channel, `${operation} ${target}`);
+      } else {
+        outcome.pending.then(
+          (late) => this._closeLateChannel(late, target),
+          () => {}
+        );
+      }
+      throw new ConnectionError(
+        `[RabbitMQClient] The broker did not answer ${operation} ${target} within brokerAnswerTimeout `
+          + `(${budgetMs}ms) - Expected: an answer to the request this client sent; a broker that `
+          + 'blocks publishers (memory or disk alarm) or is frozen keeps the connection open and '
+          + 'answers nothing. Fix: check the broker for an alarm (management API '
+          + '/api/health/checks/alarms) or a paused node; the channel that carried the request '
+          + 'is discarded and the next operation opens a fresh one. brokerAnswerTimeout is the '
+          + 'one budget for every answer this client waits for.'
       );
-      return { status: 'unanswered', error: null };
     }
 
-    return outcome;
+    const err = outcome.error;
+    const carrierDead = channel ? !this._isChannelAlive(channel) : !this._connectionAlive;
+    const bare = err instanceof Error && err.constructor === Error && err.code === undefined;
+    if (bare && carrierDead) {
+      throw new ConnectionError(
+        `[RabbitMQClient] ${operation} ${target} got no answer: the ${channel ? 'channel' : 'connection'} `
+          + 'carrying it ended before the broker answered - Expected: an answer to the request '
+          + 'this client sent. Fix: nothing is refused — the request never got a reply; run the '
+          + 'operation again once the channel is back (error.cause carries amqplib\'s rejection).',
+        err
+      );
+    }
+    throw err;
+  }
+
+  /**
+   * Take a channel whose request the broker did not answer out of service.
+   *
+   * It is marked dead first (`_isChannelAlive()`, the one liveness source — d.260), then
+   * dropped from whichever slot still holds it — only if it still holds THIS channel, the
+   * same obituary rule the close handlers keep — and then asked to close. The close is not
+   * awaited: it is an answer from the same silent broker. amqplib sends it at once and
+   * ignores every frame but `close-ok` from then on, so a broker that wakes up closes the
+   * channel cleanly (its consumers cancelled, its unacked deliveries requeued) instead of
+   * keeping it open with nobody holding it; its `close` event then reaches the handlers
+   * attached to it, exactly as for any other channel that ends.
+   *
+   * @param {Object} channel - the amqplib channel that carried the unanswered request
+   * @param {string} reason - which request went unanswered, for the post-mortem
+   * @private
+   */
+  _discardUnansweredChannel(channel, reason) {
+    channel._alive = false;
+    channel._closeReason = `No answer from the broker to ${reason} within brokerAnswerTimeout (${this._brokerAnswerTimeout}ms)`;
+    if (this._channel === channel) this._channel = null;
+    if (this._telemetryChannel === channel) this._telemetryChannel = null;
+    if (this._queueChannel === channel) this._queueChannel = null;
+    if (this._consumerChannel === channel) this._consumerChannel = null;
+    channel.close().catch((err) => {
+      this._logger.debug(`[RabbitMQClient] Discarded channel (${reason}) did not close: ${err.message}`);
+    });
+  }
+
+  /**
+   * Close a channel the broker opened after this client stopped waiting for it. Nobody
+   * holds it, so left open it would be a channel on the broker with no owner.
+   *
+   * @param {Object} channel - the late amqplib channel
+   * @param {string} what - which channel was being opened, for the log
+   * @private
+   */
+  _closeLateChannel(channel, what) {
+    this._logger.warn(
+      `[RabbitMQClient] The broker opened the ${what} after brokerAnswerTimeout (${this._brokerAnswerTimeout}ms) - `
+        + 'Expected: nothing to do; the open had already been reported as unanswered. '
+        + 'Fix: none — the late channel is closed now, so it is not left open with no owner.'
+    );
+    channel.close().catch((err) => {
+      this._logger.debug(`[RabbitMQClient] Late ${what} did not close: ${err.message}`);
+    });
   }
 
   /**
@@ -1416,6 +1776,38 @@ class RabbitMQClient extends EventEmitter {
     }
   }
 
+  /**
+   * Helper to set a trackable interval — the SAME evidence, the other kind of timer.
+   *
+   * A repeating timer is the one that most needs to be in it: `_setTimeout()` deletes its
+   * handle when it fires, an interval never fires last, so nothing ever removes it by
+   * itself. Until d.759e the two repeating timers this client arms — the health monitor
+   * and the prefetch monitor — were armed with the bare global, so `_activeTimers` could
+   * not see them and `_clearAllTimers()` could not end them. Measured (d.759d): a client
+   * that had consumed held a live `setInterval(10000)` which only `disconnect()` could
+   * end; a unit suite that left four behind never let its runner exit, while
+   * `expect(client._activeTimers.size).toBe(0)` — the assertion five suites of this
+   * package read — stayed green throughout.
+   *
+   * @private
+   */
+  _setInterval(callback, ms) {
+    const timer = setInterval(callback, ms);
+    this._activeTimers.add(timer);
+    return timer;
+  }
+
+  /**
+   * Helper to clear a trackable interval
+   * @private
+   */
+  _clearInterval(timer) {
+    if (timer) {
+      clearInterval(timer);
+      this._activeTimers.delete(timer);
+    }
+  }
+
   /**
    * Race an `amqp.connect()` handshake against its `connectTimeout`, and own the
    * handshake the timeout abandons.
@@ -1482,9 +1874,21 @@ class RabbitMQClient extends EventEmitter {
 
   /**
    * Clear all active timers
+   *
+   * The repeating ones go through their own owners first, because each of them holds a
+   * REFERENCE that has to be dropped together with the handle: a sweep that ended the
+   * timer and left `_healthCheckInterval` / `_prefetchCheckTimer` pointing at the dead
+   * handle would make the next `_start*Monitoring()` return early ("already started") and
+   * monitoring would be off for the rest of the client's life, silently. The rest is a
+   * plain sweep — `clearTimeout()` ends an interval handle as well (measured on this
+   * runtime: a `setInterval` cleared with `clearTimeout` never ticks and reports
+   * `_destroyed`), so one loop covers both kinds.
+   *
    * @private
    */
   _clearAllTimers() {
+    this._stopHealthMonitoring();
+    this._stopPrefetchMonitoring();
     for (const timer of this._activeTimers) {
       clearTimeout(timer);
     }
@@ -1535,7 +1939,10 @@ class RabbitMQClient extends EventEmitter {
       this._attachConnectionHandlers(this._connection);
 
       // Use ConfirmChannel to enable publisher confirms for publish operations
-      this._channel = await this._connection.createConfirmChannel();
+      this._channel = await this._askBroker(
+        { operation: 'createConfirmChannel', target: 'publisher channel', channel: null },
+        () => this._connection.createConfirmChannel()
+      );
       
       // Track channel metadata for debugging
       this._channel._createdAt = new Date().toISOString();
@@ -1544,11 +1951,14 @@ class RabbitMQClient extends EventEmitter {
       this._channel._type = 'publisher';
       
       // Attach event handlers
-      this._attachPublisherChannelHandlers(this._channel);
+      this._attachPublisherChannelHandlers(this._channel, 'publisher');
       
       // Create a separate regular channel for queue operations (assertQueue, checkQueue)
       // This avoids RPC reply queue issues with ConfirmChannel.assertQueue()
-      this._queueChannel = await this._connection.createChannel();
+      this._queueChannel = await this._askBroker(
+        { operation: 'createChannel', target: 'queue channel', channel: null },
+        () => this._connection.createChannel()
+      );
       
       // Track channel metadata for debugging
       this._queueChannel._createdAt = new Date().toISOString();
@@ -1561,7 +1971,10 @@ class RabbitMQClient extends EventEmitter {
       
       // Create a dedicated channel for consume operations
       // This prevents channel conflicts between publish (ConfirmChannel) and consume operations
-      this._consumerChannel = await this._connection.createChannel();
+      this._consumerChannel = await this._askBroker(
+        { operation: 'createChannel', target: 'consumer channel', channel: null },
+        () => this._connection.createChannel()
+      );
       
       // Track channel metadata for debugging
       this._consumerChannel._createdAt = new Date().toISOString();
@@ -1580,10 +1993,15 @@ class RabbitMQClient extends EventEmitter {
       // Cleanup partially created resources
       this._connectionAlive = false;
       if (this._connection) {
-        try {
-          await this._connection.close();
-        } catch (_) {
-          /* ignore */
+        // Within the one budget (d.1135): a connect that failed because the broker stopped
+        // answering (a channel open above) would otherwise wait for a `close-ok` from that
+        // same silent broker. What the close answers is not the caller's business here —
+        // the failure that brought us into this catch is — so only a close that got no
+        // answer at all is acted on: its socket is dropped, as the teardown does.
+        const halfOpen = this._connection;
+        const closing = await this._closeWithinTeardownBudget('connection', halfOpen, this._brokerAnswerTimeout);
+        if (closing.status === 'unanswered') {
+          this._dropUnansweredConnection(halfOpen);
         }
         this._connection = null;
       }
@@ -1609,7 +2027,11 @@ class RabbitMQClient extends EventEmitter {
       throw err;
     } finally {
       if (connectTimeoutTimer) {
-        clearTimeout(connectTimeoutTimer);
+        // Through the evidence, like every other ending of this timer: a bare
+        // `clearTimeout()` here left the handle in `_activeTimers`, so after a FAILED
+        // connect the client reported one armed timer it no longer had (měřeno d.759e:
+        // size 1 with nothing armed).
+        this._clearTimeout(connectTimeoutTimer);
         connectTimeoutTimer = null;
       }
     }
@@ -1651,10 +2073,17 @@ class RabbitMQClient extends EventEmitter {
 
       const timeout = this._setTimeout(() => {
         done();
+        // The sentence names the lever that is READ (d.1138): the configuration key when
+        // the caller wrote it, the derivation in the constructor otherwise. It named an
+        // environment variable until d.1138 that nothing reads.
+        const budgetSource = this._config.reconnectWaitTimeout === undefined
+          ? 'not set, so derived as max(60000, maxReconnectAttempts × reconnectMaxDelay)'
+          : 'set in the client configuration';
         reject(new ConnectionError(
           `[RabbitMQClient] Reconnection timeout after ${this._reconnectWaitTimeout}ms - `
-            + 'Expected: the broker to accept a new connection within RABBITMQ_RECONNECT_WAIT_TIMEOUT. '
-            + 'Fix: check the broker is up and reachable; raise that timeout only if a longer outage must be survived in-process.'
+            + `Expected: the broker to accept a new connection within reconnectWaitTimeout (${this._reconnectWaitTimeout}ms, ${budgetSource}). `
+            + 'Fix: check the broker is up and reachable; raise reconnectWaitTimeout in the configuration handed to '
+            + 'the client only if a longer outage must be survived in-process.'
         ));
       }, this._reconnectWaitTimeout);
       
@@ -1727,13 +2156,49 @@ class RabbitMQClient extends EventEmitter {
   }
 
   /**
-   * Ensure publisher channel exists and is open
-   * Auto-recreates if closed
+   * The ConfirmChannel of one ROLE, open — recreated when the last one died.
+   *
+   * TWO ROLES, TWO CHANNELS (d.724):
+   *
+   *  - `'publisher'` — the caller's messages. `this._channel`, created at connect time
+   *    with everything else.
+   *  - `'telemetry'` — the client's OWN events, the ones nobody asked it to send
+   *    (`src/monitoring-publish.js`, reached through `BaseClient.publishTelemetry()`).
+   *    `this._telemetryChannel`, created on the first such publish and not before.
+   *
+   * WHY THEY MAY NOT SHARE ONE (measured d.711, 3 of 7 runs of an unrelated suite red):
+   * a channel dies of the FIRST refusal it meets, and takes every unconfirmed publish on
+   * it along. The client's dead-letter telemetry publishes through
+   * `monitoring.workflow.fanout`; in a vhost where that exchange is not declared the
+   * broker answers `404` and closes the channel — and the caller's business message,
+   * still waiting for its confirm on the same channel, died with it. d.723 stopped that
+   * from being reported as the business message's own refusal; this separation stops it
+   * from happening at all. The module that sends the telemetry states the rule it could
+   * not keep on its own: "Fail-safe about PUBLISHING" (`src/monitoring-publish.js`
+   * § Principles) — fail-safe for the event is worth nothing if it is not also fail-safe
+   * for everything beside it.
+   *
+   * IT IS A CONFIRM CHANNEL, NOT A PLAIN ONE, because the telemetry's answer to its
+   * caller is `true`/`false`, and only a confirm can tell those apart: on a plain channel
+   * `publish()` returns as soon as the bytes are written, so every event would be
+   * reported as sent — including the ones the broker refuses, which is exactly the case
+   * this separation exists for.
+   *
+   * @param {'publisher'|'telemetry'} [role] - Whose channel to ensure.
    * @private
    * @returns {Promise<void>}
    */
-  async _ensurePublisherChannel() {
-    if (this._isChannelAlive(this._channel)) {
+  async _ensurePublisherChannel(role = 'publisher') {
+    if (role !== 'publisher' && role !== 'telemetry') {
+      throw new Error(
+        '[RabbitMQClient] Unknown send channel role - '
+          + `Expected: 'publisher' (the caller's messages) or 'telemetry' (the client's own events), `
+          + `got ${JSON.stringify(role)}. `
+          + 'Fix: publish through publish() or publishTelemetry(); nothing else picks a channel.'
+      );
+    }
+
+    if (this._isChannelAlive(this._sendChannelOf(role))) {
       return; // Channel is good
     }
 
@@ -1748,7 +2213,7 @@ class RabbitMQClient extends EventEmitter {
         await this._waitForReconnection();
 
         // After reconnection, try again
-        if (this._isChannelAlive(this._channel)) {
+        if (this._isChannelAlive(this._sendChannelOf(role))) {
           return; // Channel was recreated during reconnection
         }
         // If still no channel, connection might have failed - check again
@@ -1776,26 +2241,50 @@ class RabbitMQClient extends EventEmitter {
     
     try {
       // Create new ConfirmChannel
-      this._channel = await this._connection.createConfirmChannel();
-      
+      const channel = await this._askBroker(
+        { operation: 'createConfirmChannel', target: `${role} channel`, channel: null },
+        () => this._connection.createConfirmChannel()
+      );
+
       // Track channel metadata for debugging
-      this._channel._createdAt = new Date().toISOString();
-      this._channel._closeReason = null;
-      this._channel._lastOperation = 'Recreated via _ensurePublisherChannel()';
-      this._channel._type = 'publisher';
-      
+      channel._createdAt = new Date().toISOString();
+      channel._closeReason = null;
+      channel._lastOperation = `Recreated via _ensurePublisherChannel('${role}')`;
+      channel._type = role;
+
+      this._setSendChannelOf(role, channel);
+
       // Attach event handlers
-      this._attachPublisherChannelHandlers(this._channel);
-      
-      this._logger.info('[RabbitMQClient] [mq-client-core] ✓ Publisher channel recreated');
+      this._attachPublisherChannelHandlers(channel, role);
+
+      this._logger.info(`[RabbitMQClient] [mq-client-core] ✓ ${role} channel recreated`);
     } catch (err) {
-      this._channel = null;
+      this._setSendChannelOf(role, null);
 
       const msg = err && err.message ? err.message : String(err);
 
-      // Pokud se connection právě zavírá, považujeme to za přechodný stav – explicitně vyhodíme
-      // TransientPublishError, aby vyšší vrstva (retry / worker) věděla, že má počkat na reconnect.
-      if (msg.includes('Connection closing') || msg.includes('Connection closed')) {
+      // Spojení odchází — rozhoduje TŘÍDA amqplibu, ne věta (d.1000, poslední textová
+      // větev po d.676–d.711). Změřeno nad amqplib 0.10.9 a živým brokerem:
+      // `createConfirmChannel()` nad spojením, jehož `close()` začalo, odpoví
+      // `IllegalOperationError('Connection closing')`, nad zavřeným
+      // `IllegalOperationError('Connection closed (…)')` — bez `code`, jiný nosič
+      // nemá (`lib/connection.js` `invalidateSend()` / `toClosed()`). Uvnitř
+      // `createConfirmChannel()` tu třídu nevydá nic jiného než odcházející spojení
+      // (`'Channel closed'` nového kanálu jen přes spojení, které zavírá své kanály).
+      //
+      // Druhý nosič je STAV (d.1003): spadne-li spojení UPROSTŘED otevírání,
+      // amqplib odmítne čekající RPC holým `Error('Channel ended, no reply will be
+      // forthcoming')` (`_rejectPending()`, `lib/channel.js`) — bez třídy, bez `code`.
+      // Změřeno nad živým brokerem: zavření brokerem (management API) během
+      // `createConfirmChannel()` 8× z 12, `close()` o `setImmediate` později 3× ze 3;
+      // pokaždé spojení UŽ ohlásilo `'close'`, takže `_onConnectionDied()` shodil
+      // `_connectionAlive` — jediný zdroj živosti (d.260) — dřív, než sem odmítnutí
+      // doběhlo. Věta nerozhoduje: táž věta nad živým spojením zůstává trvalá.
+      //
+      // Stav je přechodný: PublishLayer publikaci podrží a zopakuje po reconnectu.
+      // Pravidlo má jedno tělo, `_connectionIsGoingAway()` — čte ho i obnova
+      // consumer kanálu (d.1003b).
+      if (this._connectionIsGoingAway(err)) {
         this._logger.warn(
           `[RabbitMQClient] [mq-client-core] Failed to recreate publisher channel (connection closing): ${msg}`
         );
@@ -1806,10 +2295,28 @@ class RabbitMQClient extends EventEmitter {
           err
         );
       }
+      // Třetí nosič (d.1135): broker na otevření kanálu neodpověděl v `brokerAnswerTimeout`
+      // (alarm paměti, zmrazený broker) — `_askBroker()` to hlásí `ConnectionError`, jinou
+      // chybu z otevření kanálu tahle třída nenese. Je to týž stav „odpověď nepřišla“, ne
+      // odmítnutí, takže přechodný jako oba nosiče výše. Stojí ZA nimi: spojení, které
+      // odchází, má svou vlastní (přesnější) větu i tehdy, když amqplib odmítnutí složil
+      // `_askBroker()` do `ConnectionError`.
+      if (err instanceof ConnectionError) {
+        this._logger.warn(
+          `[RabbitMQClient] [mq-client-core] Failed to recreate ${role} channel (no answer from the broker): ${msg}`
+        );
+        throw new TransientPublishError(
+          `[RabbitMQClient] ${role} channel cannot be recreated: the broker did not answer the open (transient condition) - `
+            + `Expected: an answer within brokerAnswerTimeout (${this._brokerAnswerTimeout}ms). `
+            + 'Fix: retry the publish; PublishLayer does this on its own and buffers the message meanwhile. '
+            + 'error.cause names the unanswered request.',
+          err
+        );
+      }
 
       // Ostatní chyby považujeme za permanentní problém na úrovni kanálu/spojení.
       throw new PermanentPublishError(
-        `[RabbitMQClient] Failed to recreate publisher channel: ${msg} - `
+        `[RabbitMQClient] Failed to recreate ${role} channel: ${msg} - `
           + 'Expected: createConfirmChannel() to succeed on an open connection. '
           + 'Fix: read error.cause for the broker reason; a channel-level refusal here is not retried, so the connection must be re-established.',
         err
@@ -1838,7 +2345,10 @@ class RabbitMQClient extends EventEmitter {
     
     try {
       // Create new regular channel
-      this._queueChannel = await this._connection.createChannel();
+      this._queueChannel = await this._askBroker(
+        { operation: 'createChannel', target: 'queue channel', channel: null },
+        () => this._connection.createChannel()
+      );
       
       // Track channel metadata for debugging
       this._queueChannel._createdAt = new Date().toISOString();
@@ -1870,12 +2380,16 @@ class RabbitMQClient extends EventEmitter {
    * Ensure consumer channel exists and is open
    * Auto-recreates and re-registers all consumers if closed
    * @private
-   * @returns {Promise<{reRegistered: number, failed: number}>} - Number of consumers re-registered and failed
+   * @returns {Promise<{reRegistered: number, failed: number}>} - how many tracked
+   *   consumers are attached, and how many are tracked without being attached. On a
+   *   channel that was already alive both are MEASURED (`_consumerAttachmentCounts()`,
+   *   d.1003d), never assumed: until d.1003d this branch answered
+   *   `_activeConsumers.size` as re-registered, counting a consumer whose
+   *   re-registration the broker had refused (tracked, no tag — d.262, d.386b).
    */
   async _ensureConsumerChannel() {
     if (this._isChannelAlive(this._consumerChannel)) {
-      // Channel is good - return current consumer state
-      return { reRegistered: this._activeConsumers.size, failed: 0 };
+      return this._consumerAttachmentCounts();
     }
 
     if (!this._connectionAlive) {
@@ -1898,8 +2412,9 @@ class RabbitMQClient extends EventEmitter {
       }
 
       if (this._isChannelAlive(this._consumerChannel)) {
-        // The recovery recreated it and re-registered what was tracked.
-        return { reRegistered: this._activeConsumers.size, failed: 0 };
+        // The recovery recreated it and ran the re-registration; what it attached is
+        // measured, not assumed (d.1003d).
+        return this._consumerAttachmentCounts();
       }
       if (!this._connectionAlive) {
         return { reRegistered: 0, failed: this._activeConsumers.size };
@@ -1908,7 +2423,10 @@ class RabbitMQClient extends EventEmitter {
     
     try {
       // Create new regular channel
-      this._consumerChannel = await this._connection.createChannel();
+      this._consumerChannel = await this._askBroker(
+        { operation: 'createChannel', target: 'consumer channel', channel: null },
+        () => this._connection.createChannel()
+      );
       
       // Track channel metadata for debugging
       this._consumerChannel._createdAt = new Date().toISOString();
@@ -1921,8 +2439,20 @@ class RabbitMQClient extends EventEmitter {
       
       // Re-register all active consumers
       const { reRegistered, failed } = await this._reRegisterConsumers();
-      
-      this._logger.info(`[RabbitMQClient] [mq-client-core] ✓ Consumer channel recreated (re-registered: ${reRegistered}, failed: ${failed})`);
+
+      // A recreate that left a consumer unattached is not a success line (d.1003d):
+      // the ✓ at INFO read as "all good" while a queue had nobody reading it. The
+      // refusal itself is already an ERROR per queue (`_reRegisterConsumer()`); this
+      // summary names which queues are left without a consumer.
+      if (failed > 0) {
+        const unattached = this._unattachedConsumerQueues();
+        this._logger.warn(
+          `[RabbitMQClient] [mq-client-core] Consumer channel recreated, but ${unattached.length} consumer(s) are not attached: `
+            + `${unattached.join(', ')} (re-registered: ${reRegistered}, failed: ${failed})`
+        );
+      } else {
+        this._logger.info(`[RabbitMQClient] [mq-client-core] ✓ Consumer channel recreated (re-registered: ${reRegistered}, failed: ${failed})`);
+      }
       return { reRegistered, failed };
     } catch (err) {
       this._consumerChannel = null;
@@ -1971,6 +2501,33 @@ class RabbitMQClient extends EventEmitter {
     return { reRegistered, failed };
   }
 
+  /**
+   * The consumer channel, if it is alive — otherwise a refusal that names why.
+   *
+   * The one question every step that is about to use the consumer channel asks
+   * (`_isChannelAlive()`, the one liveness source, d.260). A refusal here is not a broker
+   * verdict: the consumer stays tracked and the next recovery re-attaches it.
+   *
+   * @param {string} action - what was about to happen, as the refusal states it
+   * @param {string} queue - the queue it is about
+   * @returns {Object} the live consumer channel
+   * @throws {ConnectionError} when the channel is dead or gone
+   * @private
+   */
+  _liveConsumerChannel(action, queue) {
+    const channel = this._consumerChannel;
+    if (!this._isChannelAlive(channel)) {
+      throw new ConnectionError(
+        `[RabbitMQClient] Cannot ${action} ${queue}: consumer channel is not available - `
+          + 'Expected: a live consumer channel for the whole re-registration. '
+          + 'Fix: nothing to do by hand — the channel died during the recovery (closed by the broker, or '
+          + 'discarded after brokerAnswerTimeout); the consumer stays tracked and the next channel recreate '
+          + 're-attaches it. Listen for consumer:re-registration:failed to see which ones wait.'
+      );
+    }
+    return channel;
+  }
+
   /**
    * Re-attach ONE tracked consumer on the current consumer channel.
    *
@@ -1994,19 +2551,29 @@ class RabbitMQClient extends EventEmitter {
    */
   async _reRegisterConsumer(queue, consumerInfo) {
     try {
+      // Asked before EACH re-registration, not once per loop (d.1138): a channel that
+      // died after the previous consumer — closed by the broker, or discarded by the
+      // broker-answer budget (d.1135) — leaves the slot empty, and reaching into it was a
+      // TypeError naming a JavaScript accident instead of the channel's state. Asked
+      // before the queue step, so a consumer that cannot be attached declares nothing.
+      this._liveConsumerChannel('re-register the consumer of', queue);
+
       await this._prepareQueueForConsume(queue, {
         durable: consumerInfo.options.durable,
         queueOptions: consumerInfo.options.queueOptions
       });
 
+      // …and again after it: the queue step awaits the broker on another channel,
+      // and the consumer channel can die meanwhile.
+      const consumerChannel = this._liveConsumerChannel('re-register the consumer of', queue);
+
       // The consumer's prefetch is re-applied here for the same reason the
       // queue step is: the channel is new, and QoS lives on the channel.
-      await this._applyConsumerPrefetch(queue, consumerInfo.options.prefetch);
+      await this._applyConsumerPrefetch(consumerChannel, queue, consumerInfo.options.prefetch);
 
-      const consumeResult = await this._consumerChannel.consume(
-        queue,
-        consumerInfo.handler,
-        { noAck: consumerInfo.options.noAck }
+      const consumeResult = await this._askBroker(
+        { operation: 'consume', target: queue, channel: consumerChannel },
+        () => consumerChannel.consume(queue, consumerInfo.handler, { noAck: consumerInfo.options.noAck })
       );
       consumerInfo.consumerTag = consumeResult.consumerTag;
       this._logger.info(`[RabbitMQClient] [mq-client-core] ✓ Re-registered consumer for queue: ${queue} (consumerTag: ${consumeResult.consumerTag})`);
@@ -2128,7 +2695,7 @@ class RabbitMQClient extends EventEmitter {
       return; // Already started
     }
     
-    this._healthCheckInterval = setInterval(async () => {
+    this._healthCheckInterval = this._setInterval(async () => {
       try {
         await this._performHealthCheck();
       } catch (err) {
@@ -2147,7 +2714,7 @@ class RabbitMQClient extends EventEmitter {
    */
   _stopHealthMonitoring() {
     if (this._healthCheckInterval) {
-      clearInterval(this._healthCheckInterval);
+      this._clearInterval(this._healthCheckInterval);
       this._healthCheckInterval = null;
       this._logger.info('[RabbitMQClient] [mq-client-core] Health monitoring stopped');
     }
@@ -2259,7 +2826,11 @@ class RabbitMQClient extends EventEmitter {
         try {
           // Check if queue exists
           this._trackChannelOperation(this._queueChannel, `checkQueue ${queue}`);
-          const queueInfo = await this._queueChannel.checkQueue(queue);
+          const queueChannel = this._queueChannel;
+          const queueInfo = await this._askBroker(
+            { operation: 'checkQueue', target: queue, channel: queueChannel },
+            () => queueChannel.checkQueue(queue)
+          );
           if (queueInfo) {
             // Queue exists - is THIS client's consumer attached to it?
             //
@@ -2287,7 +2858,7 @@ class RabbitMQClient extends EventEmitter {
             health.issues.push(`Queue ${queue} does not exist`);
           }
         } catch (err) {
-          if (err.code === 404) {
+          if (err.code === AMQP_NOT_FOUND) {
             health.queues.missing.push(queue);
             health.healthy = false;
             health.issues.push(`Queue ${queue} does not exist (404)`);
@@ -2465,6 +3036,23 @@ class RabbitMQClient extends EventEmitter {
     }
     socketUnanswered = socketUnanswered || queueOutcome.status === 'unanswered';
 
+    // The telemetry channel exists only when this client published telemetry (d.724);
+    // `_closeWithinTeardownBudget()` takes `null` as "nothing to close", so the client
+    // that never sent an event pays nothing for this line.
+    const telemetryOutcome = await this._closeWithinTeardownBudget(
+      'telemetry channel',
+      this._telemetryChannel,
+      remaining()
+    );
+    this._telemetryChannel = null;
+    if (telemetryOutcome.status === 'refused') {
+      // Reported, never raised: the client's own events are not the caller's business,
+      // and a telemetry channel that would not close is not a reason to fail a disconnect
+      // the caller asked for.
+      this._logger.warn('[RabbitMQClient] Error closing telemetry channel:', telemetryOutcome.error.message);
+    }
+    socketUnanswered = socketUnanswered || telemetryOutcome.status === 'unanswered';
+
     const publisherOutcome = await this._closeWithinTeardownBudget(
       'publisher channel',
       this._channel,
@@ -2483,9 +3071,14 @@ class RabbitMQClient extends EventEmitter {
     );
     this._connection = null;
     if (connectionOutcome.status === 'refused') {
-      // Don't emit error for expected connection closure during disconnect
-      // This is a predictable, intentional closure
-      if (connectionOutcome.error.message && connectionOutcome.error.message.includes('Connection closed (by client)')) {
+      // An EXPECTED refusal is two facts, and both are first-hand (d.696): amqplib
+      // answered with its terminal-state class — the connection was already closed — and
+      // this client recorded no fault on it, so what closed it was a `close()`. A fault
+      // recorded here means the connection died on its own and the refusal is worth
+      // raising, exactly as it was while this read the sentence `'Connection closed (by
+      // client)'` (amqplib composes that in `toClosed()`, `lib/connection.js`, and a
+      // fault gets `'Connection closed (<the error>)'` instead).
+      if (connectionOutcome.error instanceof IllegalOperationError && !connection._closeError) {
         this._logger.info('[RabbitMQClient] Connection closed during disconnect (expected)');
       } else {
         this.emit('error', connectionOutcome.error);
@@ -2512,7 +3105,7 @@ class RabbitMQClient extends EventEmitter {
    *
    * PUBLIC: this is the one operation a collaborator needs in order to declare a
    * queue on this client — higher-level routing libraries (cookbook-router's
-   * QueueManager) and `workers/RecoveryWorker.js` alike. It owns the whole
+   * QueueManager) alike. It owns the whole
    * sequence, so nobody has to assemble it out of private members: ensure the
    * queue channel, refuse a channel that is not alive, resolve the arguments
    * from the central `queueConfig`, declare.
@@ -2591,7 +3184,10 @@ class RabbitMQClient extends EventEmitter {
     const channel = await this._requireQueueChannel('assertQueue', queue);
 
     try {
-      return await channel.assertQueue(queue, queueOptions);
+      return await this._askBroker(
+        { operation: 'assertQueue', target: queue, channel },
+        () => channel.assertQueue(queue, queueOptions)
+      );
     } catch (err) {
       // The SAME verdict the consume rail states, through the SAME function
       // (d.582). This is the rail FÁZE 0.8 walks: a service declaring its own
@@ -2721,14 +3317,354 @@ class RabbitMQClient extends EventEmitter {
    * @private
    */
   _publishPathTransient(verb, queue, cause) {
+    // The sentence is chosen from this client's STATE, never from the cause's text (d.1145,
+    // finding of d.1143): since d.1135 this refusal also ends a pre-check the broker never
+    // answered, and on the platform's image the connection was then alive and BLOCKED by a
+    // memory alarm — "connection may be closed" sent the reader to a reconnect that was not
+    // coming. `sent` is false on every one of these (no frame was written), which is what the
+    // flush after `unblocked` reads.
+    let state;
+    let fix;
+    if (!this._connectionAlive) {
+      state = 'the connection is closed';
+      fix = 'Fix: nothing to do here — a reconnect restores it; PublishLayer retries and buffers the message meanwhile, '
+        + 'and the buffer re-sends it after the reconnect.';
+    } else if (this._connectionBlockedBy !== null) {
+      state = `the broker has blocked this connection (reason: ${this._connectionBlockedBy}) and answers nothing until it clears the alarm`;
+      fix = 'Fix: clear the broker alarm (management API /api/health/checks/alarms names it); PublishLayer retries and '
+        + 'buffers the message meanwhile, and the buffer re-sends it once the broker unblocks the connection (its frame never left).';
+    } else {
+      // Neither closed nor blocked: the cause says what happened (a request unanswered
+      // within brokerAnswerTimeout, or a channel open the broker refused) — this sentence
+      // does not guess which.
+      state = 'the queue channel is not available on a live, unblocked connection (error.cause names the request '
+        + 'that went unanswered or was refused)';
+      fix = 'Fix: read error.cause; an unanswered request points at a paused or overloaded broker. PublishLayer retries '
+        + 'and buffers the message meanwhile.';
+    }
     return new TransientPublishError(
-      `[RabbitMQClient] Cannot ${verb} ${queue}: queue channel is not available (connection may be closed) - `
-        + `Expected: an open queue channel before ${verb} on the publish path. `
-        + 'Fix: retry the publish after the reconnect; PublishLayer does this on its own and buffers the message meanwhile.',
+      `[RabbitMQClient] Cannot ${verb} ${queue}: ${state} - `
+        + `Expected: an answering broker on an open queue channel before ${verb} on the publish path. ${fix}`,
       cause
     );
   }
 
+  /**
+   * The broker's REFUSAL of this send, when that is what killed the channel — or `null`
+   * when the channel died without the broker saying anything about this message.
+   *
+   * A send the broker refuses closes the channel with a numbered close frame. amqplib
+   * puts that object on the channel's `error` event (`lib/channel.js`, `Channel.accept()`, case `ChannelClose`) and
+   * answers the publish callback with the bare `new Error('channel closed')`
+   * (the `Channel` constructor's `'close'` listener, `lib/channel.js`) — so the callback cannot see the reason, but the channel can:
+   * `_attachPublisherChannelHandlers()` records it as `channel._closeError`, and does so
+   * BEFORE the callback runs, because amqplib emits `error` first and only then `close`,
+   * which is what rejects the unconfirmed publishes.
+   *
+   * WHOSE ANSWER IT IS, THOUGH, IS A SECOND QUESTION (d.723). A ConfirmChannel carries
+   * more than one unconfirmed publish, and a numbered frame is an answer about exactly
+   * ONE of them; amqplib answers all of them with that same object. Until d.723 this
+   * method's own JSDoc called the reading "a fact about THIS send, first-hand" — it is
+   * that only while this send is the only unconfirmed one on the channel. Measured
+   * 2026-09-20, two publishes on one channel in a vhost of its own: one to an exchange
+   * nobody declared, one to a `good.fanout` the same client had just declared. Both came
+   * back `PermanentPublishError … Cannot publish to exchange "good.fanout": 404 NOT-FOUND
+   * - nothing declares it`, while the frame underneath named `no exchange
+   * 'no.such.exchange'`. A message the broker never refused was dropped, and its
+   * publisher was sent to declare an exchange that was already there.
+   *
+   * So `_closeFrameNamesThisSend()` decides attribution before the class is decided at
+   * all, and the sends it cannot claim get the collateral verdict
+   * (`_collateralSendTransient()`), which is transient: they were never answered, so they
+   * were never refused, and republishing them is right.
+   *
+   * So the reading is a fact about the send the frame is about:
+   *   - a NUMBER is an answer about this request. Measured against the dev broker,
+   *     `classId 60 / methodId 40` — `basic.publish` itself: `403 ACCESS-REFUSED` (an
+   *     account without `write` in the vhost) and `406 PRECONDITION-FAILED` (a `user_id`
+   *     property that is not the authenticated user). Repeating the request repeats the
+   *     answer, so it is PERMANENT — the same reading the queue-existence pre-check has
+   *     used for `405 RESOURCE_LOCKED` since d.683;
+   *   - `404 NOT-FOUND` is one of them, since d.693 (carrier B1: a publish through an
+   *     exchange nobody declared, measured `classId 60` on the send). It says something
+   *     the other codes do not — nothing DECLARED what was published to — but the
+   *     consequence is the same, because a publisher declares nothing and no reconnect
+   *     creates an exchange: `config/queueConfig.js` declares it and its owning service
+   *     asserts it. Retrying and buffering only held the message until its TTL dropped it.
+   *     It is NOT a `QueueNotFoundError`: that class belongs to the queue-existence
+   *     pre-check, and it carries a `queueName` and an ownership `kind` that
+   *     the caller reads from the refusal's `cause` — an exchange is neither;
+   *   - anything that is not a number is not a broker reply code. A socket error's
+   *     `'ECONNRESET'` says nothing about whether the message was stored, and reading it
+   *     as a refusal would drop messages a reconnect would have delivered.
+   *
+   * Until d.685a neither send leg read it. Both answered with their own `PublishError`,
+   * which the classification reads as transient (`utils/publishErrors.js`), so a message
+   * the broker refuses every single time was retried `publishMaxRetries` times and then
+   * buffered — and `InMemoryBuffer.flush()` returns an unsuccessful flush to the buffer,
+   * so it was re-offered on every reconnect until its TTL dropped it.
+   *
+   * @param {Object|null} channel - The channel that CARRIED the send, read before it was
+   *   replaced: `this._channel` may already be the successor by callback time.
+   * @param {'queue'|'exchange'} kind - Which leg is asking, so the message names what the
+   *   publish was addressed to (`architecture-principles.md` §5).
+   * @param {string} target - That queue or exchange.
+   * @returns {PermanentPublishError|null}
+   * @private
+   */
+  _refusedSendPermanent(channel, kind, target) {
+    const closeError = channel ? channel._closeError : null;
+    const code = closeError ? closeError.code : undefined;
+
+    if (typeof code !== 'number') {
+      return null;
+    }
+
+    if (!this._closeFrameNamesThisSend(channel, target)) {
+      return null;
+    }
+
+    return new PermanentPublishError(refusedSendMessage(kind, target, code), closeError);
+  }
+
+  /**
+   * The verdict for a send that was on the channel when SOMEBODY ELSE'S refusal closed
+   * it — or `null` when there was no numbered frame, or the frame was this send's own.
+   *
+   * Transient, and that is the whole point: the broker answered one message and never
+   * answered this one, so nothing about this message was decided. `PublishLayer` retries
+   * a `TransientPublishError` and buffers it meanwhile, which republishes it over the
+   * channel's successor; the permanent verdict would have dropped it on the first attempt
+   * (`src/layers/PublishLayer.js`).
+   *
+   * @param {Object|null} channel - The channel that CARRIED the send.
+   * @param {'queue'|'exchange'} kind - Which leg is asking.
+   * @param {string} target - That queue or exchange.
+   * @returns {TransientPublishError|null}
+   * @private
+   */
+  /**
+   * Say out loud what the broker answered about a send whose promise had already given up.
+   *
+   * The publish callback is not guarded by the attempt's `settled` flag, so when the
+   * confirmation budget has already rejected, the callback still runs and still builds the
+   * right verdict — and then hands it to a settled promise, where `reject()` is a no-op.
+   * The frame is not lost (it stays on `channel._closeError`) and the verdict is not
+   * overwritten; it simply reached nobody, while `PublishLayer` went on retrying and
+   * buffering a message the broker had refused for good.
+   *
+   * Silence is a defect of the same severity as a wrong result
+   * (`automation-gates.md` §5), so the verdict is REPORTED — and only reported. Nothing
+   * here changes the promise's outcome, the retry policy or the budget: making a late
+   * verdict DECIDE is a change of what happens to a message, which goes with the major
+   * wave (d.801).
+   *
+   * Measured (d.801, dev broker): a refused send is answered in tens of milliseconds —
+   * `404` median 13 ms idle and 31 ms (max 126 ms) under load 32 — so this path is not the
+   * ordinary one. It is what a budget set below that latency produces.
+   *
+   * @param {PermanentPublishError|TransientPublishError} verdict - What the frame decided.
+   * @param {'queue'|'exchange'} kind - Which leg is reporting.
+   * @param {string} target - The queue or exchange the send was addressed to.
+   * @param {string} queue - The queue the caller named (the exchange leg routes by it).
+   * @param {Object} options - The publish options, which carry the retry layer's `attempt`.
+   * @private
+   */
+  _reportLateSendVerdict(verdict, kind, target, queue, options) {
+    const code = verdict && verdict.cause ? verdict.cause.code : undefined;
+    const attempt = options && typeof options.attempt === 'number' ? options.attempt : null;
+
+    this._logger.warn(
+      `[RabbitMQClient] [mq-client-core] [PUBLISH] The broker refused this send and said so AFTER `
+        + `the confirmation budget of ${this._brokerAnswerTimeout}ms had already answered the caller - `
+        + `${kind} "${target}", broker code ${code}, verdict ${verdict.constructor.name}. `
+        + 'Expected: an answer within brokerAnswerTimeout, so the caller hears the broker rather '
+        + 'than the timeout. '
+        + 'Fix: the publish layer has already treated this message as unconfirmed and may retry it; '
+        + `raise brokerAnswerTimeout above the broker's answer latency for this route, or read `
+        + 'the publish:refused-late event to see how often it happens.'
+    );
+
+    this.emit('publish:refused-late', {
+      queue,
+      exchange: kind === 'exchange' ? target : undefined,
+      target,
+      kind,
+      code,
+      verdict: verdict.constructor.name,
+      // The verdict OBJECT, not only its name: since d.801c the retry layer acts on this
+      // event — it ends its loop with this very error instead of publishing again — and a
+      // listener that must act needs the thing, not a description of it.
+      error: verdict,
+      attempt,
+      budgetMs: this._brokerAnswerTimeout
+    });
+  }
+
+  _collateralSendTransient(channel, kind, target) {
+    const closeError = channel ? channel._closeError : null;
+    const code = closeError ? closeError.code : undefined;
+
+    if (typeof code !== 'number') {
+      return null;
+    }
+
+    if (this._closeFrameNamesThisSend(channel, target)) {
+      return null;
+    }
+
+    return new TransientPublishError(collateralCloseMessage(kind, target, code), closeError);
+  }
+
+  /**
+   * Is the broker's close frame on `channel` an answer about the send addressed to
+   * `target`?
+   *
+   * TWO READINGS, IN THIS ORDER, and the second only when the first cannot answer:
+   *
+   *  1. **How many sends the frame could be about.** When exactly one publish was
+   *     unconfirmed at the moment the frame arrived, the frame is about that one and
+   *     nothing else is possible. This is the case every earlier batch measured — d.685a
+   *     (403, 406), d.693 (404 on an undeclared exchange) — and it is why those verdicts
+   *     do not move. The count is the client's own (`_countSendInFlight()`), snapshotted
+   *     by `_attachPublisherChannelHandlers()` when it records the frame, because amqplib
+   *     emits `error` BEFORE `close` and it is `close` that rejects the callbacks: by
+   *     callback time the channel's own bookkeeping is already unwound.
+   *  2. **Whether the frame NAMES this target.** The broker quotes the subject of its
+   *     refusal in the reply text, and amqplib keeps that text inside the close error's
+   *     `message` — measured live 2026-09-20, the close error's own properties are
+   *     `["code","classId","methodId"]` and there is no `replyText` member, so the
+   *     sentence is where the name is:
+   *     `Channel closed by server: 404 (NOT-FOUND) with message "NOT_FOUND - no exchange
+   *     'no.such.exchange' in vhost 'mq-client-core-probe-…'"`.
+   *
+   * READING A SENTENCE IS NOT HOW THE CLASS IS DECIDED, and this does not change that
+   * (`docs/biz/70-contracts/error-handling.md` §6): the CODE still says what the answer
+   * means. The name only says WHOSE answer it is, and it is read in the one direction
+   * that is safe to get wrong — a name this cannot find, or a rewording that hides it,
+   * means "not claimed", so the send falls to the transient collateral verdict and the
+   * message is republished. The failure mode of a broker that rewords its text is a
+   * message sent twice, never a message dropped on a refusal that was not about it.
+   *
+   * @param {Object} channel - The channel carrying the recorded frame.
+   * @param {string} target - The queue or exchange THIS send was addressed to.
+   * @returns {boolean}
+   * @private
+   */
+  _closeFrameNamesThisSend(channel, target) {
+    const unconfirmed = channel._unconfirmedAtCloseFrame;
+
+    // The frame was recorded by `_attachPublisherChannelHandlers()`, which takes the
+    // snapshot in the same statement — so a missing number means the channel was never
+    // prepared by this client, and an unprepared channel is not one whose sends this may
+    // speak for. Not claimed, therefore transient: the safe direction.
+    if (typeof unconfirmed !== 'number') {
+      return false;
+    }
+
+    if (unconfirmed <= 1) {
+      return true;
+    }
+
+    const named = this._nameInCloseFrame(channel._closeError);
+    return named !== null && named === target;
+  }
+
+  /**
+   * The name the broker quoted in its close frame, or `null` when it quoted none.
+   *
+   * The first single-quoted token of the reply text is its subject — `no exchange 'X' in
+   * vhost 'Y'`, `no queue 'X' in vhost 'Y'`, `cannot obtain exclusive access to locked
+   * queue 'X' in vhost 'Y'`. A frame that quotes nothing (`PRECONDITION_FAILED - unknown
+   * delivery tag 999999`, measured d.698) answers with `null`, which is a real answer
+   * here: "this frame names nobody".
+   *
+   * @param {Error} closeError - The recorded close frame.
+   * @returns {string|null}
+   * @private
+   */
+  _nameInCloseFrame(closeError) {
+    const text = closeError && typeof closeError.message === 'string' ? closeError.message : '';
+    const quoted = /'([^']*)'/.exec(text);
+    return quoted ? quoted[1] : null;
+  }
+
+  /**
+   * Count one send as unconfirmed on `channel`, and hand back the ONE way to stop
+   * counting it.
+   *
+   * The count exists for `_closeFrameNamesThisSend()`: it is what says whether a numbered
+   * close frame can only be about this send. It is the client's own rather than amqplib's
+   * `unconfirmed` array, because that array is emptied by the very event this has to
+   * measure — `toClosed()` rejects every pending publish, and only then do the callbacks
+   * that ask this question run.
+   *
+   * A closure rather than a bare decrement at each site, because a send ends in three
+   * places (the callback, a synchronous throw, and nowhere at all when neither happens),
+   * and a count that is decremented twice or not at all makes the reading above answer
+   * for the wrong number of messages.
+   *
+   * @param {Object} channel - The channel the send is going out on.
+   * @returns {function(): void} Idempotent; call it when the send is no longer unconfirmed.
+   * @private
+   */
+  /**
+   * The channel of one send role, as it stands NOW.
+   *
+   * A getter rather than a captured value, because the member is replaced when the
+   * channel dies (`_attachPublisherChannelHandlers()` clears it, the next publish
+   * recreates it), and a caller holding the previous one would be sending on a corpse.
+   *
+   * @param {'publisher'|'telemetry'} role
+   * @returns {Object|null}
+   * @private
+   */
+  _sendChannelOf(role) {
+    return role === 'telemetry' ? this._telemetryChannel : this._channel;
+  }
+
+  /**
+   * The one place a send channel is assigned — so "which member does this role live in"
+   * is written once rather than at every site that creates, clears or tears one down.
+   *
+   * @param {'publisher'|'telemetry'} role
+   * @param {Object|null} channel
+   * @private
+   */
+  _setSendChannelOf(role, channel) {
+    if (role === 'telemetry') {
+      this._telemetryChannel = channel;
+    } else {
+      this._channel = channel;
+    }
+  }
+
+  /**
+   * Which channel a publish goes out on, from the options it was given.
+   *
+   * Explicit, never derived from the queue name (`architecture-principles.md` §8, §9): a
+   * telemetry publish says so because `BaseClient.publishTelemetry()` says so, and a name
+   * that merely looks like a monitoring queue does not move a caller's message onto
+   * another channel.
+   *
+   * @param {Object} options - The publish options as the caller handed them over.
+   * @returns {'publisher'|'telemetry'}
+   * @private
+   */
+  _sendRoleFor(options) {
+    return options && options.channelRole === 'telemetry' ? 'telemetry' : 'publisher';
+  }
+
+  _countSendInFlight(channel) {
+    channel._unconfirmedSends = (channel._unconfirmedSends || 0) + 1;
+    let counted = true;
+    return () => {
+      if (!counted) return;
+      counted = false;
+      channel._unconfirmedSends -= 1;
+    };
+  }
+
   /**
    * Declare an exchange.
    *
@@ -2775,7 +3711,10 @@ class RabbitMQClient extends EventEmitter {
       ...options,
       durable: options.durable !== undefined ? options.durable : this._config.durable
     };
-    return await channel.assertExchange(exchange, type, exchangeOptions);
+    return await this._askBroker(
+      { operation: 'assertExchange', target: exchange, channel },
+      () => channel.assertExchange(exchange, type, exchangeOptions)
+    );
   }
 
   /**
@@ -2819,7 +3758,10 @@ class RabbitMQClient extends EventEmitter {
     }
 
     const channel = await this._requireQueueChannel('bindQueue', `${queue} -> ${exchange}`);
-    return await channel.bindQueue(queue, exchange, pattern);
+    return await this._askBroker(
+      { operation: 'bindQueue', target: `${queue} -> ${exchange}`, channel },
+      () => channel.bindQueue(queue, exchange, pattern)
+    );
   }
 
   /**
@@ -2902,7 +3844,11 @@ class RabbitMQClient extends EventEmitter {
     }
 
     this._trackChannelOperation(this._consumerChannel, `cancelConsumer ${queue}`);
-    const result = await this._consumerChannel.cancel(info.consumerTag);
+    const consumerChannel = this._consumerChannel;
+    const result = await this._askBroker(
+      { operation: 'cancel', target: queue, channel: consumerChannel },
+      () => consumerChannel.cancel(info.consumerTag)
+    );
     // Dropped only after the broker accepted the cancel: a consumer that is
     // still delivering must stay on the list recovery re-attaches.
     this._activeConsumers.delete(queue);
@@ -2919,7 +3865,10 @@ class RabbitMQClient extends EventEmitter {
    */
   async checkQueue(queue) {
     const channel = await this._requireQueueChannel('checkQueue', queue);
-    return await channel.checkQueue(queue);
+    return await this._askBroker(
+      { operation: 'checkQueue', target: queue, channel },
+      () => channel.checkQueue(queue)
+    );
   }
 
   /**
@@ -2928,7 +3877,10 @@ class RabbitMQClient extends EventEmitter {
    */
   async purgeQueue(queue) {
     const channel = await this._requireQueueChannel('purgeQueue', queue);
-    return await channel.purgeQueue(queue);
+    return await this._askBroker(
+      { operation: 'purgeQueue', target: queue, channel },
+      () => channel.purgeQueue(queue)
+    );
   }
 
   /**
@@ -2938,7 +3890,10 @@ class RabbitMQClient extends EventEmitter {
    */
   async deleteQueue(queue, options = {}) {
     const channel = await this._requireQueueChannel('deleteQueue', queue);
-    return await channel.deleteQueue(queue, options);
+    return await this._askBroker(
+      { operation: 'deleteQueue', target: queue, channel },
+      () => channel.deleteQueue(queue, options)
+    );
   }
 
   /**
@@ -2957,15 +3912,60 @@ class RabbitMQClient extends EventEmitter {
   }
 
   /**
-   * Internal publish implementation - single attempt without retry
+   * One publish attempt, without retry — and, when it fails, whether its frame LEFT THE
+   * CLIENT (d.1145, conf `mq-publish-buffer` 001).
+   *
+   * Every error this attempt throws carries `sent` (boolean): `true` once `sendToQueue()` /
+   * `publish()` on the channel returned without throwing — the frame was written to the
+   * channel — and `false` for everything that failed before that (the pre-check, the channel
+   * ensure, a throwing send). It says nothing about whether the broker stored the frame; it is
+   * what tells a message the broker may still deliver (held in a blocked socket, measured
+   * d.1143) from one it never received. `PublishLayer` folds the attempts of one call into the
+   * fact it writes on its own error and on the buffer entry.
+   *
+   * A nested republish from the confirm path (see `_publishOneAttempt`) may throw an error
+   * that already says `sent: true`; that fact is kept, never lowered.
+   *
+   * @param {string} queue
+   * @param {Buffer} buffer
+   * @param {Object} [options]
+   * @returns {Promise<void>}
+   * @throws {Error} the attempt's failure, with `sent` written on it
    * @private
    */
   async _publishOnce(queue, buffer, options = {}) {
-    // Ensure publisher channel exists and is open (auto-recreates if closed)
-    await this._ensurePublisherChannel();
-    
+    const attempt = { sent: false };
+    try {
+      return await this._publishOneAttempt(queue, buffer, options, attempt);
+    } catch (err) {
+      if (err !== null && typeof err === 'object') {
+        err.sent = attempt.sent || err.sent === true;
+      }
+      throw err;
+    }
+  }
+
+  /**
+   * The body of one publish attempt. `attempt.sent` turns `true` the moment the frame is
+   * written to the channel; `_publishOnce()` reads it.
+   *
+   * @param {string} queue
+   * @param {Buffer} buffer
+   * @param {Object} options
+   * @param {{sent: boolean}} attempt - written here, read by `_publishOnce()`
+   * @private
+   */
+  async _publishOneAttempt(queue, buffer, options, attempt) {
+    // Whose channel this send goes out on (d.724). Read once, here: the role cannot
+    // change inside one attempt, and the channel it names can — so everything below asks
+    // `_sendChannelOf(sendRole)` rather than holding a member.
+    const sendRole = this._sendRoleFor(options);
+
+    // Ensure the send channel exists and is open (auto-recreates if closed)
+    await this._ensurePublisherChannel(sendRole);
+
     // Track operation for debugging
-    this._trackChannelOperation(this._channel, `publish to ${queue}`);
+    this._trackChannelOperation(this._sendChannelOf(sendRole), `publish to ${queue}`);
     
     // Asked with `=== undefined`, not with `||`: the empty string IS a value here
     // — it names the default exchange — and the third leg was a third copy of a
@@ -3018,13 +4018,16 @@ class RabbitMQClient extends EventEmitter {
         // If queue doesn't exist (404), we should NOT auto-create it - infrastructure queues must be created explicitly
         // This prevents creating queues with wrong arguments (no TTL) which causes 406 errors later
         if (!skipQueueExistencePrecheck) {
+        // Declared OUTSIDE the `try`, because the `catch` below has to ask whether
+        // the channel that CARRIED the RPC is still alive — that reading is what
+        // tells "the broker answered" from "the answer never came" (d.683).
+        let queueChannel = null;
         try {
           // The queue channel comes from the ONE rail (d.282): ensure it, refuse
           // it unless it is ALIVE, record the operation. Until d.284 this site
           // assembled that sequence itself — `_ensureQueueChannel()` plus
           // `_isChannelAlive()` by hand — differing from the rail in nothing but
           // the error type, which is `_publishPathTransient()`'s job below.
-          let queueChannel;
           try {
             queueChannel = await this._requireQueueChannel('checkQueue', queue);
           } catch (railErr) {
@@ -3033,7 +4036,11 @@ class RabbitMQClient extends EventEmitter {
             }
             throw railErr;
           }
-          await queueChannel.checkQueue(queue);
+          const checkedOn = queueChannel;
+          await this._askBroker(
+            { operation: 'checkQueue', target: queue, channel: checkedOn },
+            () => checkedOn.checkQueue(queue)
+          );
           // Queue exists - proceed to publish
         } catch (checkErr) {
           // If queue doesn't exist (404), this je ERROR – ale rozlišujeme infra vs. non-infra:
@@ -3045,7 +4052,7 @@ class RabbitMQClient extends EventEmitter {
           //   → QueueNotFoundError(kind='business'). Publisher je nikdy nevytváří.
           // - Ostatní jména (ani infra, ani business vzor) nemá kdo vlastnit, takže
           //   je nezakládá nikdo → QueueNotFoundError(kind='unowned'), d.419.
-          if (checkErr.code === 404) {
+          if (checkErr.code === AMQP_NOT_FOUND) {
             // `queueConfig` is loaded once at the top of this module. It used to be
             // required here, inside a try/catch whose `catch` re-implemented
             // `isInfrastructureQueue` as an inline prefix list — a fallback
@@ -3067,7 +4074,7 @@ class RabbitMQClient extends EventEmitter {
             // registration; a publisher that creates it is a programming error.
             //
             // The rule and this exact wording came from
-            // `conn-infra-mq/src/transports/rabbitmqClient.js:264-277` — a transport
+            // `conn-infra-mq/src/transports/rabbitmqClient.js` — a transport
             // that nothing in `src/` instantiated, so the guard protected nobody
             // while this file, the one every client actually runs, auto-created the
             // queue and only printed a warning.
@@ -3075,7 +4082,7 @@ class RabbitMQClient extends EventEmitter {
               throw new QueueNotFoundError(queue, false, checkErr, 'business');
             }
           // Nobody owns this name. Until d.419 that opened a THIRD case beside
-          // the two above: the publish path asked `RecoveryWorker` whether this
+          // the two above: the publish path asked the recovery worker whether this
           // client might declare it and, when the answer was yes, declared it —
           // `durable=true, arguments={}`, no TTL, no dead-letter route (measured
           // live, d.410). The concept had already ruled that out: "queues come
@@ -3100,6 +4107,40 @@ class RabbitMQClient extends EventEmitter {
           // "nothing declares this name", and the publish path must not flatten the
           // two into one message.
           throw new QueueNotFoundError(queue, false, checkErr, 'unowned');
+          } else if (
+            !(checkErr instanceof TransientPublishError)
+            && checkErr.code === undefined
+            && !this._isChannelAlive(queueChannel)
+          ) {
+            // THE RPC NEVER GOT AN ANSWER. amqplib answers the request that was in
+            // flight when a channel closed with the broker's own close frame — a
+            // NUMBER in `code` — and rejects whatever was queued behind it with a
+            // bare `new Error('Channel ended, no reply will be forthcoming')`
+            // (`_rejectPending`, `node_modules/amqplib/lib/channel.js`), whose
+            // only own properties are `stack` and `message`. Until d.683 that object
+            // travelled untouched to `classifyPublishError()`, which had to keep its
+            // verdict by matching the sentence — the one text branch d.677 could not
+            // remove from where it stood, because the sentence was all there was.
+            //
+            // This site does not have to read it: it knows which channel carried the
+            // RPC and can see that the channel is gone, so it answers in the dialect
+            // every other leg of this path already speaks. The three conditions are
+            // each doing work:
+            //   - `code === undefined` — a numbered refusal is an ANSWER about this
+            //     request (405 RESOURCE_LOCKED, measured), and repeating the request
+            //     repeats it. It stays permanent;
+            //   - the channel is dead — a failure on a LIVE channel did get through
+            //     to the broker and back, whatever it says;
+            //   - not already typed — `_publishPathTransient()` above throws into
+            //     this same `catch`, and wrapping a verdict in itself would bury the
+            //     rail's own sentence one level deeper for no reader.
+            //
+            // Since d.1135 the check goes through `_askBroker()`, so what arrives here
+            // is its `ConnectionError`: either the budget ran out (the channel is then
+            // discarded — dead) or amqplib's bare rejection, folded where it arrived. Both
+            // meet the three conditions unchanged; the bare error sits one level down, in
+            // `cause.cause`.
+            throw this._publishPathTransient('checkQueue', queue, checkErr);
           } else {
             // Other error - rethrow
             throw checkErr;
@@ -3123,8 +4164,16 @@ class RabbitMQClient extends EventEmitter {
           let timeout = null;
           let safetyTimer = null;
           let settled = false;
+          // Assigned once the send is on its way (below), and released here with the
+          // timers: the attempt ends in five places — the callback, a synchronous throw,
+          // the confirmation timeout, the liveness check before the send, and the
+          // watchdog — and a send still counted after its attempt has ended would make
+          // the next close frame on this channel look as if it could be about two
+          // messages (`_closeFrameNamesThisSend()`, d.723).
+          let sendSettled = () => {};
           const disarm = () => {
             settled = true;
+            sendSettled();
             this._clearTimeout(timeout);
             this._clearTimeout(safetyTimer);
             timeout = null;
@@ -3147,7 +4196,7 @@ class RabbitMQClient extends EventEmitter {
           // during the awaits above (queue existence pre-check), so this is not
           // a repeat of `_ensurePublisherChannel()` — it is the last reading
           // before the payload leaves, and it reads the one liveness source.
-          if (!this._isChannelAlive(this._channel)) {
+          if (!this._isChannelAlive(this._sendChannelOf(sendRole))) {
             disarm();
             reject(new ConnectionError(
               `[RabbitMQClient] Cannot publish: channel is closed for queue "${queue}" - `
@@ -3158,9 +4207,13 @@ class RabbitMQClient extends EventEmitter {
           }
           
           // Track original channel to detect if it was closed/recreated during publish
-          const originalChannel = this._channel;
+          const originalChannel = this._sendChannelOf(sendRole);
           let callbackInvoked = false;
-          
+          // This send is unconfirmed from the moment it is handed over until the broker
+          // answers it, the channel dies under it, or amqplib refuses it outright — and
+          // that number is what decides whose answer a close frame is (d.723).
+          sendSettled = this._countSendInFlight(originalChannel);
+
           // Send message with callback
           try {
             originalChannel.sendToQueue(
@@ -3169,14 +4222,45 @@ class RabbitMQClient extends EventEmitter {
               buildAmqpMessageProperties(options, persistent, headers),
               (err, ok) => {
               callbackInvoked = true;
+              // Read BEFORE `disarm()`, which sets it: the question is whether the budget
+              // had already answered the caller, and after `disarm()` nobody can tell.
+              const answeredAlready = settled;
               disarm();
-              
+
               // CRITICAL: the delivery tag belongs to the channel that SENT the
               // message, so that channel's liveness is the whole question. One
               // reading answers it: a channel that was replaced is a channel that
               // died first (`_ensurePublisherChannel()` recreates only a dead one),
               // so identity and `_createdAt` comparisons said nothing this does not.
               if (!this._isChannelAlive(originalChannel)) {
+                // WHY the channel died decides first. A numbered close frame is the
+                // broker's answer about THIS message, and no reconnect changes it
+                // (`_refusedSendPermanent()`, d.685a) — so it is asked before the
+                // reconnect wait below, which would otherwise re-offer a message the
+                // broker will refuse again.
+                const refused = this._refusedSendPermanent(originalChannel, 'queue', queue);
+                if (refused) {
+                  if (answeredAlready) {
+                    this._reportLateSendVerdict(refused, 'queue', queue, queue, options);
+                  } else {
+                    this._logger.error(`[RabbitMQClient] [mq-client-core] [PUBLISH] ${refused.message}`);
+                  }
+                  reject(refused);
+                  return;
+                }
+                // The frame was there but it was about a DIFFERENT send on this channel
+                // (d.723): this message was never answered, so it is republished rather
+                // than dropped on somebody else's refusal.
+                const collateral = this._collateralSendTransient(originalChannel, 'queue', queue);
+                if (collateral) {
+                  if (answeredAlready) {
+                    this._reportLateSendVerdict(collateral, 'queue', queue, queue, options);
+                  } else {
+                    this._logger.warn(`[RabbitMQClient] [mq-client-core] [PUBLISH] ${collateral.message}`);
+                  }
+                  reject(collateral);
+                  return;
+                }
                 // Channel was closed or recreated - delivery tag is invalid
                 this._logger.warn(`[RabbitMQClient] [mq-client-core] [PUBLISH] Channel closed/recreated during publish to queue "${queue}", ignoring callback`);
                 // If we're reconnecting, wait and retry
@@ -3186,12 +4270,20 @@ class RabbitMQClient extends EventEmitter {
                     return this.publish(queue, buffer, options);
                   }).then(resolve).catch(reject);
                 } else {
-                  // Not reconnecting - this is a real error
-                  // We cannot guarantee the message was delivered - must fail
+                  // No reconnect is in flight YET — which says nothing about whether one
+                  // follows. When the connection dies, amqplib closes its channels before
+                  // it announces the connection's own `close` (`lib/connection.js`,
+                  // `toClosed()`), and that announcement is what starts the reconnect, so
+                  // this callback runs before it (d.1134). The sentence therefore states
+                  // what is known here — the channel closed with the confirm outstanding —
+                  // and the classification makes it transient, so the publish path
+                  // retries and buffers it.
                   reject(new PublishError(
-                    `[RabbitMQClient] Channel closed during publish to queue "${queue}" and not reconnecting - message delivery not guaranteed. `
-                      + 'Expected: the channel to stay open until the broker confirms, or a reconnect to be in flight. '
-                      + 'Fix: republish the message — the confirm never arrived, so it may or may not have been stored.',
+                    `[RabbitMQClient] Channel closed during publish to queue "${queue}" before the broker confirmed the message - `
+                      + 'message delivery not guaranteed. '
+                      + 'Expected: the channel to stay open until the broker confirms. '
+                      + 'Fix: republish the message — the confirm never arrived, so it may or may not have been stored; '
+                      + 'error.buffered says whether the buffer holds it for the next reconnect.',
                     queue,
                     null
                   ));
@@ -3200,29 +4292,24 @@ class RabbitMQClient extends EventEmitter {
               }
               
               if (err) {
-                // Check if error is about invalid delivery tag (channel was closed)
-                if (err.message && (err.message.includes('unknown delivery tag') || err.message.includes('PRECONDITION_FAILED'))) {
-                  this._logger.warn(`[RabbitMQClient] [mq-client-core] [PUBLISH] Delivery tag invalid (channel may have been closed) for queue "${queue}"`);
-                  // If we're reconnecting, wait and retry
-                  if (this._reconnecting) {
-                    this._waitForReconnection().then(() => {
-                      // Retry publish after reconnection
-                      return this.publish(queue, buffer, options);
-                    }).then(resolve).catch(reject);
-                  } else {
-                    // Not reconnecting - delivery tag is invalid, message delivery not guaranteed
-                    reject(new PublishError(
-                      `[RabbitMQClient] Delivery tag invalid for queue "${queue}" (channel closed) and not reconnecting - message delivery not guaranteed. `
-                        + 'Expected: the delivery tag to stay valid until the broker confirms, or a reconnect to be in flight. '
-                        + 'Fix: republish the message — the confirm never arrived, so it may or may not have been stored.',
-                      queue,
-                      null
-                    ));
-                  }
-                } else {
-                  this._logger.error(`[RabbitMQClient] [mq-client-core] [PUBLISH] Send callback error for queue "${queue}":`, err.message);
-                  reject(err);
-                }
+                // A confirm callback is handed ONE of three things by amqplib, and this is
+                // the whole list: `null` (the broker confirmed), `new Error('message
+                // nacked')` and `new Error('channel closed')` — composed in
+                // `lib/channel.js` (the `Channel` constructor's confirm listeners) and
+                // `lib/channel_model.js` (`ConfirmChannel.waitForConfirms()`), with no `code` on
+                // either. The callback cannot see WHY the channel died; the channel can,
+                // and the branch above reads it (`_refusedSendPermanent()`, d.685a).
+                //
+                // So there is no delivery-tag case to catch here, and until d.698 one was
+                // written anyway: a substring test for the words a 406 reply text carries.
+                // It matched none of the three, and what it did was not neutral: it
+                // answered with a `PublishError`, which the
+                // classification reads as TRANSIENT, so a message would have been retried
+                // `publishMaxRetries` times and then buffered on the strength of a wording.
+                // The live carrier of that sentence is a 406 close frame on the channel's
+                // `error` event (measured d.693/d.698), never an argument to this callback.
+                this._logger.error(`[RabbitMQClient] [mq-client-core] [PUBLISH] Send callback error for queue "${queue}":`, err.message);
+                reject(err);
               } else {
                 // Structured log: publish confirmed
                 const wfId = workflowIdOf(headers);
@@ -3237,6 +4324,8 @@ class RabbitMQClient extends EventEmitter {
                 resolve();
               }
             });
+            // The frame is written to the channel: `sendToQueue()` returned without throwing.
+            attempt.sent = true;
             
             // Set a safety timeout - if callback wasn't invoked and channel closed, retry.
             // A broker confirm can land inside `sendToQueue()` itself, so the
@@ -3257,8 +4346,27 @@ class RabbitMQClient extends EventEmitter {
             }
           } catch (sendErr) {
             disarm();
-            // If channel is closed, try to wait for reconnection and retry
-            if (sendErr.message && (sendErr.message.includes('Channel ended') || sendErr.message.includes('Channel closed'))) {
+            // THE CHANNEL ANSWERS, NOT THE SENTENCE (d.685c). A synchronous throw from
+            // `sendToQueue()` means amqplib refused to send at all, and the one question
+            // that decides what to do with the message is whether the channel it was
+            // handed is still alive: a dead one will be replaced by the reconnect, so the
+            // message is republished over its successor; a live one did accept the call
+            // and failed for its own reason, which no reconnect changes.
+            //
+            // Until this batch the question was asked of the message text
+            // (`includes('Channel ended') || includes('Channel closed')`), which is the
+            // defect d.677 removed from the classification: a wording decided whether a
+            // message was re-offered to the broker. It was also matching a sentence that
+            // cannot arrive here — `'Channel ended, no reply will be forthcoming'` is
+            // built for an RPC awaiting a REPLY (`_rejectPending()`, amqplib
+            // `lib/channel.js`), and a send is not an RPC.
+            //
+            // Measured carrier, live against the dev broker: amqplib invalidates a dead
+            // channel's send methods (`invalidateSend()`, `lib/channel.js`), so
+            // what arrives is its `IllegalOperationError` with `'Channel closed'` — no
+            // code, and `channel._closeError` null. Liveness from the one source
+            // (`_isChannelAlive`, d.260), like the two callbacks above.
+            if (!this._isChannelAlive(originalChannel)) {
               this._logger.warn(`[RabbitMQClient] [mq-client-core] [PUBLISH] Channel closed during sendToQueue, will retry after reconnection`);
               // Wait for reconnection and retry
               if (this._reconnecting) {
@@ -3302,8 +4410,20 @@ class RabbitMQClient extends EventEmitter {
         
         // Use callback-based confirmation - kanály jsou spolehlivé
         const confirmPromise = new Promise((resolve, reject) => {
+          // Assigned once the send is on its way (below). It is declared HERE because the
+          // count has to be released on EVERY ending of this attempt, and the earliest of
+          // them — the confirmation timeout — is armed before the send exists. A send
+          // still counted after its attempt has ended would make the next close frame on
+          // this channel look as if it could be about two messages (d.723).
+          let sendSettled = () => {};
+          // Whether the budget has already answered the caller — read by the callback, so
+          // a verdict that arrives afterwards can be REPORTED instead of handed to a
+          // settled promise (d.801b). The queue leg keeps the same fact in `settled`.
+          let answeredAlready = false;
           // Set timeout for exchange publish confirmation
           const timeout = this._setTimeout(() => {
+            answeredAlready = true;
+            sendSettled();
             reject(new PublishError(
               `[RabbitMQClient] Exchange publish confirmation timeout for exchange "${exchange}" after ${this._brokerAnswerTimeout}ms - `
                 + 'Expected: the broker to confirm the message within brokerAnswerTimeout. '
@@ -3313,14 +4433,79 @@ class RabbitMQClient extends EventEmitter {
             ));
           }, this._brokerAnswerTimeout);
           
-          this._channel.publish(
+          // The channel that SENDS is the channel whose liveness answers the
+          // callback below — read once here, like the queue leg does, because
+          // the member may already hold the replacement by the time the
+          // callback runs.
+          const sendingChannel = this._sendChannelOf(sendRole);
+          // Unconfirmed until answered — the same count the queue leg keeps, and for the
+          // same reason: it is what decides whose answer a close frame is (d.723).
+          sendSettled = this._countSendInFlight(sendingChannel);
+
+          sendingChannel.publish(
             exchange,
             routingKey,
             buffer,
             buildAmqpMessageProperties(options, persistent, headers),
             (err, ok) => {
+            sendSettled();
             this._clearTimeout(timeout);
             if (err) {
+              // THE CONFIRM NEVER CAME. amqplib answers every unconfirmed publish of
+              // a channel that has just closed with a bare `new Error('channel
+              // closed')` (the `Channel` constructor's `'close'` listener, `node_modules/amqplib/lib/channel.js`) — class `Error`,
+              // no code, own properties `stack` and `message`. The broker's own
+              // numbered refusal is NOT what arrives here: it goes to the channel's
+              // `error` event (measured d.677, carrier B1 — a publish through an
+              // exchange nobody declared).
+              //
+              // The queue leg above has read the sending channel's liveness since
+              // long before this batch, which is why a refused send already reached
+              // the classification as this package's own `PublishError` (carrier E1).
+              // This leg had no such reading, so its bare sentinel travelled untouched
+              // and `classifyPublishError()` had to keep its verdict by the sentence.
+              // Now both legs answer the same way, and the sentinel is kept in `cause`
+              // rather than read (d.683).
+              //
+              // A live channel means the broker DID answer — a nack is the measured
+              // case (carrier G, `'message nacked'`, amqplib `lib/channel.js`, the `Channel` constructor's `'nack'` listener) —
+              // and that answer is about this message, so it stays what it was.
+              if (!this._isChannelAlive(sendingChannel)) {
+                // The same question this leg's sibling asks one branch up: did the broker
+                // REFUSE this send, or did the channel merely die under it (d.685a)?
+                const refused = this._refusedSendPermanent(sendingChannel, 'exchange', exchange);
+                if (refused) {
+                  if (answeredAlready) {
+                    this._reportLateSendVerdict(refused, 'exchange', exchange, queue, options);
+                  } else {
+                    this._logger.error(`[RabbitMQClient] [mq-client-core] [PUBLISH] ${refused.message}`);
+                  }
+                  reject(refused);
+                  return;
+                }
+                // Somebody else's refusal closed the channel under this send (d.723) —
+                // never answered, therefore never refused, therefore republished.
+                const collateral = this._collateralSendTransient(sendingChannel, 'exchange', exchange);
+                if (collateral) {
+                  if (answeredAlready) {
+                    this._reportLateSendVerdict(collateral, 'exchange', exchange, queue, options);
+                  } else {
+                    this._logger.warn(`[RabbitMQClient] [mq-client-core] [PUBLISH] ${collateral.message}`);
+                  }
+                  reject(collateral);
+                  return;
+                }
+                this._logger.warn(`[RabbitMQClient] [mq-client-core] [PUBLISH] Channel closed during publish to exchange "${exchange}", classifying as transient`);
+                reject(new PublishError(
+                  `[RabbitMQClient] Channel closed during publish to exchange "${exchange}" - message delivery not guaranteed. `
+                    + 'Expected: the channel to stay open until the broker confirms. '
+                    + 'Fix: republish the message — the confirm never arrived, so it may or may not have been routed; '
+                    + 'read error.cause for what amqplib said.',
+                  exchange,
+                  err
+                ));
+                return;
+              }
               this._logger.error(`[RabbitMQClient] [mq-client-core] [PUBLISH] Exchange publish callback error:`, err.message);
               reject(err);
             } else {
@@ -3328,6 +4513,8 @@ class RabbitMQClient extends EventEmitter {
               resolve();
             }
           });
+          // The frame is written to the channel: `publish()` returned without throwing.
+          attempt.sent = true;
         });
         
         await confirmPromise;
@@ -3338,9 +4525,19 @@ class RabbitMQClient extends EventEmitter {
       // Pokud channel closed, vyhodíme TransientPublishError a necháme PublishLayer řešit retry
       
       // Všechny chyby projdou jednotnou klasifikací do Transient/Permanent/QueueNotFound
-      const classifiedErr = classifyPublishError(err, queue);
-      this.emit('error', classifiedErr);
-      throw classifiedErr;
+      //
+      // A VERDICT ABOUT A MESSAGE GOES ONE WAY: to whoever sent it. Until d.811b this line
+      // also put the classified failure on the client's `error` channel, which is the
+      // channel the rest of this client uses for the CONNECTION. Measured (d.811): it
+      // fired for every classification, transient as well as permanent; nobody read it
+      // (no `.on('error')` on this client anywhere in `shared/**` or `infra/**`, and zero
+      // callers of `onError()` in production code); the concept never asked for it
+      // (`docs/architecture/mq-publish-reliability.md` does not mention the channel); and
+      // the only rail that ever met it had to learn to IGNORE it, because one concurrent
+      // publish failing while the link came back rejected every reconnect waiter
+      // (`_waitForReconnection()`, d.435/d.435b). It made work for another rail instead of
+      // serving a reader.
+      throw classifyPublishError(err, queue);
     }
   }
 
@@ -3359,17 +4556,22 @@ class RabbitMQClient extends EventEmitter {
    * A non-numeric prefetch (the caller asked for none) sets none, and records
    * none: there is nothing to measure utilisation against.
    *
+   * @param {Object} consumerChannel - The consumer channel the caller holds; the
+   *   re-registration hands over the one it has just asked is alive (d.1138)
    * @param {string} queue - Queue name
    * @param {number|null|undefined} prefetch - The consumer's prefetch
    * @returns {Promise<void>}
    * @private
    */
-  async _applyConsumerPrefetch(queue, prefetch) {
+  async _applyConsumerPrefetch(consumerChannel, queue, prefetch) {
     if (typeof prefetch !== 'number') {
       return;
     }
 
-    await this._consumerChannel.prefetch(prefetch);
+    await this._askBroker(
+      { operation: 'prefetch', target: queue, channel: consumerChannel },
+      () => consumerChannel.prefetch(prefetch)
+    );
 
     const tracking = this._prefetchTracking.get(queue);
     if (tracking) {
@@ -3378,7 +4580,11 @@ class RabbitMQClient extends EventEmitter {
       this._prefetchTracking.set(queue, {
         prefetchCount: prefetch,
         inFlight: 0,
-        lastCheck: Date.now()
+        lastCheck: Date.now(),
+        // Which side of the threshold this queue was on when the verdict was last
+        // taken. It is what makes the alarm an EPISODE rather than a line per tick
+        // — see `_checkPrefetchUtilization()`.
+        utilizationHigh: false
       });
     }
 
@@ -3496,7 +4702,7 @@ class RabbitMQClient extends EventEmitter {
     //
     // The ONE queue this demand cannot be made of is the one at the END of a
     // chain: a queue something else dead-letters TO. `workflow.failed` is named
-    // in `x-dead-letter-routing-key` by `workflow.init` and `workflow.control`,
+    // in `x-dead-letter-routing-key` by `workflow.init`,
     // `<service>.dlq` by every business template — and the confirmed topology
     // leaves exactly those without a route of their own, because a dead-letter
     // route on a dead-letter queue is a loop or a chain with no end
@@ -3563,10 +4769,13 @@ class RabbitMQClient extends EventEmitter {
       // If missing, fail-fast. The owning infra service must recreate on startup.
       const queueChannel = await this._requireQueueChannel('checkQueue', queue);
       try {
-        await queueChannel.checkQueue(queue);
+        await this._askBroker(
+          { operation: 'checkQueue', target: queue, channel: queueChannel },
+          () => queueChannel.checkQueue(queue)
+        );
         this._logger.debug(`[RabbitMQClient] [mq-client-core] [CONSUMER] ✓ Infrastructure queue ${queue} exists (consumer will proceed)`);
       } catch (checkErr) {
-        if (checkErr.code === 404) {
+        if (checkErr.code === AMQP_NOT_FOUND) {
           // Typed and coded since d.297: a bare `Error` lost the queue AND the
           // class, so the layer above could not tell "this queue does not exist"
           // from "the policy refused this queue" and told the reader the wrong
@@ -3582,8 +4791,7 @@ class RabbitMQClient extends EventEmitter {
       }
     } else {
       // Business queue (or unknown) — declared on the ONE public rail, the same
-      // `assertQueue()` the publish path's 404 branch (d.281) and
-      // `RecoveryWorker.createQueue()` (d.277b) go through. It ensures the queue
+      // `assertQueue()` every collaborator that declares a queue goes through. It ensures the queue
       // channel, refuses one that is not alive (d.282) and resolves the arguments
       // from `queueConfig.declarationOptions()` — so a declaration made here and a
       // declaration made anywhere else are the same declaration by construction,
@@ -3649,56 +4857,14 @@ class RabbitMQClient extends EventEmitter {
     // `false` = the budget is one attempt, so the first failure rejects into
     // `<svc>.dlq` — exactly what a `permanent` classification already does.
     // `true` or absent = the budget configuration decides. There is no third
-    // meaning, and the combination that would need one is refused below rather
+    // meaning, and the combination that would need one is refused rather
     // than resolved by silently preferring one of the two.
-    if (options.requeueOnError !== undefined && typeof options.requeueOnError !== 'boolean') {
-      throw new ValidationError(
-        '[RabbitMQClient] Invalid requeueOnError - Expected: true or false, got '
-          + `${JSON.stringify(options.requeueOnError)}. Fix: pass consume(queue, handler, `
-          + '{ requeueOnError: false }) to dead-letter on the first failure, or leave it out and '
-          + 'let the delivery budget decide.'
-      );
-    }
-
-    const noRequeue = options.requeueOnError === false;
-
-    if (noRequeue && options.maxAttempts !== undefined && options.maxAttempts !== 1) {
-      throw new ValidationError(
-        '[RabbitMQClient] Contradictory delivery policy - requeueOnError: false means one attempt, '
-          + `but maxAttempts says ${JSON.stringify(options.maxAttempts)}. Expected: one statement about `
-          + 'how many times a handler may run. Fix: drop requeueOnError to keep the budget, or drop '
-          + 'maxAttempts to dead-letter on the first failure.'
-      );
-    }
-
-    const maxAttempts = noRequeue
-      ? 1
-      : options.maxAttempts === undefined
-        ? runtimeCfg.get('maxDeliveryAttempts', this._config.maxDeliveryAttempts)
-        : options.maxAttempts;
-
-    if (!Number.isInteger(maxAttempts) || maxAttempts < 1) {
-      throw new ValidationError(
-        '[RabbitMQClient] Invalid delivery budget - maxAttempts must be an integer >= 1, got '
-          + `${JSON.stringify(maxAttempts)}. Fix: pass consume(queue, handler, { maxAttempts: <integer >= 1> }), `
-          + 'or leave it out and let the module default (defaults.js maxDeliveryAttempts, '
-          + 'env RABBITMQ_MAX_DELIVERY_ATTEMPTS) decide.'
-      );
-    }
-
-    const classify = options.classify === undefined
-      ? deliveryPolicy.defaultClassification
-      : options.classify;
-
-    if (typeof classify !== 'function') {
-      throw new ValidationError(
-        '[RabbitMQClient] Invalid error classifier - classify must be a function returning '
-          + `'transient' or 'permanent', got ${typeof options.classify}. Fix: pass consume(queue, handler, `
-          + '{ classify: (error) => … }), or leave it out and every error is treated as transient.'
-      );
-    }
-
-    const policy = { maxAttempts, classify };
+    // The rules have ONE owner, exported for every consumer's test double
+    // (d.1005): `deliveryPolicy.validateConsumeOptions`.
+    const policy = deliveryPolicy.validateConsumeOptions(
+      options,
+      () => runtimeCfg.get('maxDeliveryAttempts', this._config.maxDeliveryAttempts)
+    );
     const onDeadLetter = options.onDeadLetter;
     if (onDeadLetter !== undefined && typeof onDeadLetter !== 'function') {
       throw new ValidationError(
@@ -3731,7 +4897,7 @@ class RabbitMQClient extends EventEmitter {
       // Set prefetch if provided (on consumer channel). ONE rail, shared with
       // `_reRegisterConsumers()` — prefetch belongs to the consumer, not to the
       // channel that happened to be open when it first attached.
-      await this._applyConsumerPrefetch(queue, prefetch);
+      await this._applyConsumerPrefetch(this._consumerChannel, queue, prefetch);
 
       // CRITICAL: Log before calling amqplib's consume()
       // amqplib's consume() may internally call assertQueue() without parameters if queue doesn't exist
@@ -3786,128 +4952,170 @@ class RabbitMQClient extends EventEmitter {
           }
         });
         
-        // Track in-flight message (increment)
+        // ONE delivery raises this counter once and lowers it once. The
+        // `finally` at the end of this callback is that second half, and since
+        // d.680 it is the ONLY place the counter goes down
+        // (`change-discipline.md` § One rail per concern).
+        //
+        // MEASURED on production (d.680, 2026-09-20, the dispatcher):
+        //
+        //     Prefetch utilization high: queue 'workflow.completed' has 43/5
+        //     messages in-flight (860%)
+        //
+        // — and the number grew with every workflow, never falling. Until d.680
+        // the decrement lived in the branches that settle a message HERE: the
+        // auto-ack, the delivery policy, and the rejection of an unreadable
+        // counter. Every OTHER way a delivery can end left the increment
+        // standing — a handler that settles the message itself (the public
+        // `ack()`/`nack()` set `msg._mqProcessed`, which is exactly what makes
+        // the auto-ack branch stand down), a `noAck` consumer, and the two early
+        // returns taken when the channel died under a running handler.
+        //
+        // Nothing stalled, because the window is enforced by the BROKER and not
+        // by this number. The only casualty was the alarm, which from then on
+        // fired for every delivery whatever the load — the warning that cannot
+        // fail to happen that d.550 removed for prefetch 1, and that
+        // `automation-gates.md` §5 counts as a defect of its own.
+        //
+        // The counter is therefore bound to the DELIVERY, not to the branch that
+        // settles it: it measures what this consumer is holding, and it stops
+        // holding a delivery when this callback returns — whoever settled it,
+        // and however many times.
         const tracking = this._prefetchTracking.get(queue);
         if (tracking) {
           tracking.inFlight++;
           tracking.lastCheck = Date.now();
           this._checkPrefetchUtilization(queue, tracking);
         }
-        
-        // Which attempt this delivery is, read from the header this library
-        // writes (`../config/deliveryPolicy.js`). `null` = the header carries a
-        // value this library never wrote, so the message cannot be bounded and
-        // the handler is NOT run for it; it is rejected below.
-        const attemptsMade = deliveryPolicy.readAttemptsMade(msgHeaders);
-        const attempt = attemptsMade === null ? null : attemptsMade + 1;
-
-        if (attempt === null) {
-          this._logger.error(
-            '[RabbitMQClient] Unreadable delivery counter - the '
-              + `${deliveryPolicy.ATTEMPTS_HEADER} header of a message on "${queue}" holds `
-              + `${JSON.stringify(msgHeaders[deliveryPolicy.ATTEMPTS_HEADER])}, which is not a `
-              + 'non-negative integer. Expected: only this library writes that header. '
-              + 'Fix: the message is rejected into the dead-letter queue unread — reading a '
-              + 'malformed counter as zero would make the redelivery loop unbounded again.',
-            { queue }
-          );
-          await this._rejectDelivery({
-            msg,
-            queue,
-            channelForMsg,
-            noAck,
-            error: new Error(
-              `[RabbitMQClient] Message on "${queue}" carries an unreadable `
-                + `${deliveryPolicy.ATTEMPTS_HEADER} header`
-            ),
-            classification: deliveryPolicy.UNCLASSIFIABLE,
-            attempts: null,
-            maxAttempts: policy.maxAttempts,
-            onDeadLetter
-          });
-          if (tracking) {
-            tracking.inFlight = Math.max(0, tracking.inFlight - 1);
-            tracking.lastCheck = Date.now();
-          }
-          return;
-        }
 
         try {
-          // The handler is told WHICH attempt it is on, so a side effect that
-          // must happen once — the RPC error reply above all — happens on the
-          // last attempt only, instead of once per redelivery. A handler that
-          // takes one argument ignores the second.
-          await onMessage(msg, {
-            attempt,
-            maxAttempts: policy.maxAttempts,
-            isFinalAttempt: attempt >= policy.maxAttempts
-          });
-          // Acknowledge message after successful processing
-          if (!noAck && !msg._mqProcessed) {
-            // Liveness comes from the ONE source the channel handlers set
-            // first-hand (`_isChannelAlive()`, d.260). The reading this
-            // replaced, `channelForMsg.closed`, asked amqplib for a property it
-            // does not define, so it answered "alive" for the channel the
-            // broker had just killed and handed the corpse an `ack`.
-            if (!this._isChannelAlive(channelForMsg)) {
-              this._logger.warn('[RabbitMQClient] [mq-client-core] [CONSUMER] Cannot ack - consumer channel is closed/recreated (message will be requeued by broker)');
-              return;
-            }
-            try {
-              channelForMsg.ack(msg);
-              msg._mqProcessed = true;
-            } catch (ackErr) {
-              const m = ackErr && ackErr.message ? ackErr.message : '';
-              if (m.includes('unknown delivery tag') || m.includes('PRECONDITION_FAILED') || m.includes('Channel closed')) {
-                msg._mqProcessed = true;
-                this._logger.warn('[RabbitMQClient] [mq-client-core] [CONSUMER] Ack failed due to invalid delivery tag / closed channel (message delivery will be handled by broker)', { error: m });
+          // Which attempt this delivery is, read from the header this library
+          // writes (`../config/deliveryPolicy.js`). `null` = the header carries a
+          // value this library never wrote, so the message cannot be bounded and
+          // the handler is NOT run for it; it is rejected below.
+          const attemptsMade = deliveryPolicy.readAttemptsMade(msgHeaders);
+          const attempt = attemptsMade === null ? null : attemptsMade + 1;
+
+          if (attempt === null) {
+            this._logger.error(
+              '[RabbitMQClient] Unreadable delivery counter - the '
+                + `${deliveryPolicy.ATTEMPTS_HEADER} header of a message on "${queue}" holds `
+                + `${JSON.stringify(msgHeaders[deliveryPolicy.ATTEMPTS_HEADER])}, which is not a `
+                + 'non-negative integer. Expected: only this library writes that header. '
+                + 'Fix: the message is rejected into the dead-letter queue unread — reading a '
+                + 'malformed counter as zero would make the redelivery loop unbounded again.',
+              { queue }
+            );
+            await this._rejectDelivery({
+              msg,
+              queue,
+              channelForMsg,
+              noAck,
+              error: new Error(
+                `[RabbitMQClient] Message on "${queue}" carries an unreadable `
+                  + `${deliveryPolicy.ATTEMPTS_HEADER} header`
+              ),
+              classification: deliveryPolicy.UNCLASSIFIABLE,
+              attempts: null,
+              maxAttempts: policy.maxAttempts,
+              onDeadLetter
+            });
+            return;
+          }
+
+          try {
+            // The handler is told WHICH attempt it is on, so a side effect that
+            // must happen once — the RPC error reply above all — happens on the
+            // last attempt only, instead of once per redelivery. A handler that
+            // takes one argument ignores the second.
+            await onMessage(msg, {
+              attempt,
+              maxAttempts: policy.maxAttempts,
+              isFinalAttempt: attempt >= policy.maxAttempts
+            });
+            // Acknowledge message after successful processing
+            if (!noAck && !msg._mqProcessed) {
+              // Liveness comes from the ONE source the channel handlers set
+              // first-hand (`_isChannelAlive()`, d.260). The reading this
+              // replaced, `channelForMsg.closed`, asked amqplib for a property it
+              // does not define, so it answered "alive" for the channel the
+              // broker had just killed and handed the corpse an `ack`.
+              if (!this._isChannelAlive(channelForMsg)) {
+                this._logger.warn('[RabbitMQClient] [mq-client-core] [CONSUMER] Cannot ack - consumer channel is closed/recreated (message will be requeued by broker)');
                 return;
               }
-              throw ackErr;
+              try {
+                channelForMsg.ack(msg);
+                msg._mqProcessed = true;
+              } catch (ackErr) {
+                // A REFUSED CALL IS A CLASS, NOT A SENTENCE (d.698). amqplib replaces a
+                // dead channel's send methods with one that throws its own
+                // `IllegalOperationError` (`invalidateSend()`/`invalidOp()`,
+                // `lib/channel.js`), so that class IS "the channel would not take
+                // this ack" — and it is the only thing `ack()` ever throws.
+                //
+                // The sentence branch this replaced listed `'unknown delivery tag'`,
+                // `'PRECONDITION_FAILED'` and `'Channel closed'`. The first two cannot
+                // arrive: an ack with a tag the broker does not hold does not throw at all
+                // — the broker answers by closing the channel with a 406 frame on its
+                // `error` event (measured live, d.698). The third is only ONE of amqplib's
+                // two wordings, so the other, `'Channel closing'` (`toClosing()`, `:167`),
+                // was rethrown — into the handler's own catch, which republished a RETRY
+                // COPY of a message whose handler had already succeeded.
+                if (ackErr instanceof IllegalOperationError) {
+                  msg._mqProcessed = true;
+                  this._logger.warn('[RabbitMQClient] [mq-client-core] [CONSUMER] Ack refused by a closed/closing channel (message delivery will be handled by broker)', { error: ackErr.message });
+                  return;
+                }
+                throw ackErr;
+              }
+              this._logger.debug('[RabbitMQClient] MSG_ACKED', {
+                workflow_id: wfId,
+                action: 'MSG_ACKED',
+                handler: 'consume',
+                function: 'RabbitMQClient.consume',
+                input: { queue },
+                output: { status: 'acknowledged', queue }
+              });
             }
-            this._logger.debug('[RabbitMQClient] MSG_ACKED', {
-              workflow_id: wfId,
-              action: 'MSG_ACKED',
-              handler: 'consume',
-              function: 'RabbitMQClient.consume',
-              input: { queue },
-              output: { status: 'acknowledged', queue }
+          } catch (handlerErr) {
+            // The dead-letter policy decides what a failed handler costs: one more
+            // attempt (a copy carrying the advanced counter, then an ack of the
+            // original) or a rejection into `<svc>.dlq`. Until 2026-09-11 this
+            // branch was an unconditional `nack(msg, false, true)` with no counter,
+            // so a permanently failing message was redelivered for ever and the DLQ
+            // the topology declares was never reached from the client side
+            // (`docs/governance/confirmations/mq-consumer-contract.md` 002 point 3).
+            await this._applyDeliveryPolicy({
+              msg,
+              queue,
+              channelForMsg,
+              noAck,
+              error: handlerErr,
+              attempt,
+              policy,
+              onDeadLetter
             });
-
-            if (tracking) {
-              tracking.inFlight = Math.max(0, tracking.inFlight - 1);
-              tracking.lastCheck = Date.now();
-            }
           }
-        } catch (handlerErr) {
-          // The dead-letter policy decides what a failed handler costs: one more
-          // attempt (a copy carrying the advanced counter, then an ack of the
-          // original) or a rejection into `<svc>.dlq`. Until 2026-09-11 this
-          // branch was an unconditional `nack(msg, false, true)` with no counter,
-          // so a permanently failing message was redelivered for ever and the DLQ
-          // the topology declares was never reached from the client side
-          // (`docs/governance/confirmations/mq-consumer-contract.md` 002 point 3).
-          await this._applyDeliveryPolicy({
-            msg,
-            queue,
-            channelForMsg,
-            noAck,
-            error: handlerErr,
-            attempt,
-            policy,
-            onDeadLetter
-          });
+        } finally {
           if (tracking) {
             tracking.inFlight = Math.max(0, tracking.inFlight - 1);
             tracking.lastCheck = Date.now();
+            // The verdict is taken on BOTH edges (d.736a). Until this call the
+            // window was measured only while it FILLED, so "the queue came back
+            // under the threshold" was a fact nothing ever stated — measured in
+            // `api_delivery_endpoint`'s log on 2026-09-18: three warnings about
+            // one standing condition in 68 ms, and no line of any kind about its
+            // end. See `_checkPrefetchUtilization()`.
+            this._checkPrefetchUtilization(queue, tracking);
           }
         }
       };
       
-      const consumeResult = await this._consumerChannel.consume(
-        queue,
-        messageHandler,
-        { noAck }
+      const consumerChannel = this._consumerChannel;
+      const consumeResult = await this._askBroker(
+        { operation: 'consume', target: queue, channel: consumerChannel },
+        () => consumerChannel.consume(queue, messageHandler, { noAck })
       );
       
       // Track consumer for auto re-registration if channel closes
@@ -4016,13 +5224,23 @@ class RabbitMQClient extends EventEmitter {
           this._logger.info(
             '[RabbitMQClient] Client was closed by its caller during recovery - closing the re-established connection'
           );
-          try {
-            await revived.close();
-          } catch (closeErr) {
+          // Within the one budget (d.1138, conf `mq-broker-answer-budget` 001): this close
+          // waits for a `close-ok` like every teardown close, and a broker that stopped
+          // answering right now would otherwise hold this round — and `_reconnecting` —
+          // open forever. Unanswered, the socket is dropped the way the teardown drops it.
+          const closing = await this._closeWithinTeardownBudget(
+            'connection re-established after disconnect',
+            revived,
+            this._brokerAnswerTimeout
+          );
+          if (closing.status === 'refused') {
             this._logger.warn(
-              `[RabbitMQClient] Error closing the connection re-established after disconnect: ${closeErr.message}`
+              `[RabbitMQClient] Error closing the connection re-established after disconnect: ${closing.error.message}`
             );
           }
+          if (closing.status === 'unanswered') {
+            this._dropUnansweredConnection(revived);
+          }
           this._connection = null;
           this._connectionAlive = false;
           this._reconnecting = false;
@@ -4069,7 +5287,10 @@ class RabbitMQClient extends EventEmitter {
         
         // Recreate consumer channel and re-register all consumers
         try {
-          this._consumerChannel = await this._connection.createChannel();
+          this._consumerChannel = await this._askBroker(
+            { operation: 'createChannel', target: 'consumer channel', channel: null },
+            () => this._connection.createChannel()
+          );
           this._consumerChannel._createdAt = new Date().toISOString();
           this._consumerChannel._closeReason = null;
           this._consumerChannel._lastOperation = 'Recreated via _reconnectWithBackoff()';
@@ -4079,7 +5300,19 @@ class RabbitMQClient extends EventEmitter {
           // Re-register all consumers - use internal helper to avoid the "channel already open" check
           consumerReRegResult = await this._reRegisterConsumers();
           channelState.consumer = true;
-          this._logger.info('[RabbitMQClient] ✓ Consumer channel recreated');
+          // The same summary rule as `_ensureConsumerChannel()` (d.1003d, d.1003e): a
+          // recovery that left a consumer unattached is not a ✓ line.
+          if (consumerReRegResult.failed > 0) {
+            const unattached = this._unattachedConsumerQueues();
+            this._logger.warn(
+              `[RabbitMQClient] Consumer channel recreated, but ${unattached.length} consumer(s) are not attached: `
+                + `${unattached.join(', ')} (re-registered: ${consumerReRegResult.reRegistered}, failed: ${consumerReRegResult.failed})`
+            );
+          } else {
+            this._logger.info(
+              `[RabbitMQClient] ✓ Consumer channel recreated (re-registered: ${consumerReRegResult.reRegistered}, failed: ${consumerReRegResult.failed})`
+            );
+          }
         } catch (err) {
           this._logger.error('[RabbitMQClient] Failed to recreate consumer channel:', err.message);
           this._consumerChannel = null;
@@ -4108,7 +5341,7 @@ class RabbitMQClient extends EventEmitter {
         // Flush buffered messages po reconnectu
         let bufferFlushResult = { inMemory: 0, flushed: false };
         try {
-          const flushResult = await this._publishLayer.flushBuffered();
+          const flushResult = await this._publishLayer.flushBuffered('reconnected');
           bufferFlushResult = { inMemory: flushResult, flushed: true };
           this._publishMonitor.trackFlushed(bufferFlushResult.inMemory);
           this._logger.info(`[RabbitMQClient] ✓ Flushed ${bufferFlushResult.inMemory} buffered messages after reconnection`);
@@ -4187,7 +5420,7 @@ class RabbitMQClient extends EventEmitter {
    * Attach event handlers to publisher channel
    * @private
    */
-  _attachPublisherChannelHandlers(channel) {
+  _attachPublisherChannelHandlers(channel, role) {
     // One closure, one notification. amqplib announces a broker-side channel
     // death TWICE — `error` first, then `close` (measured against amqplib 0.10.9
     // on the live broker, 2026-09-12: a `checkQueue()` on a missing queue yields
@@ -4200,6 +5433,13 @@ class RabbitMQClient extends EventEmitter {
     // without a preceding `error`. The `error` handler only records WHY the
     // channel is dying, here, for the one notification to carry.
     channel._closeError = null;
+    // The publishes this channel is still carrying, and the snapshot of that number taken
+    // when a close frame arrives — `_closeFrameNamesThisSend()` is the one reader of both
+    // (d.723). Declared here because this is the one place a PUBLISHER channel is
+    // prepared, and a member nobody declared would make that reading answer for
+    // `undefined` instead of for a number.
+    channel._unconfirmedSends = 0;
+    channel._unconfirmedAtCloseFrame = null;
     channel._alive = true;
     channel.on('error', async (err) => {
       channel._alive = false;
@@ -4208,24 +5448,63 @@ class RabbitMQClient extends EventEmitter {
       }
       const reason = `Publisher channel error: ${err.message} (code: ${err.code || 'unknown'})`;
       channel._closeReason = reason;
+      // How many publishes this frame could possibly be an answer about (d.723). Taken
+      // HERE and nowhere else: amqplib emits `error` before `close`, and it is `close`
+      // that rejects the unconfirmed publishes — by the time their callbacks ask, the
+      // count has already been unwound. `_closeFrameNamesThisSend()` reads it.
+      channel._unconfirmedAtCloseFrame = channel._unconfirmedSends;
+      // WHY the channel is dying is recorded FIRST, for every reason there is.
+      //
+      // Since d.685a the publish path answers a refused send from this member
+      // (`_refusedSendPermanent()`), so a branch that returns before writing it leaves the
+      // publish path blind: the send reads a channel that died for no stated reason and
+      // calls it transient — retried `publishMaxRetries` times and then buffered, for a
+      // message the broker refused. The `'unknown delivery tag'` branch below did exactly
+      // that until d.696, and the frame it catches is a NUMBERED refusal like any other
+      // (measured live, d.693: `Error` with `code: 406`, arriving on this very event).
+      // Recording first and branching afterwards changes what the branch DOES in nothing.
+      channel._closeError = err;
 
-      // "unknown delivery tag" errors occur when channel closes during publish
-      // This is expected - the publish callback will handle retry
-      // We still log it but don't try to recreate channel (it's already closing)
-      if (err.message && err.message.includes('unknown delivery tag')) {
-        this._logger.warn(`[RabbitMQClient] [mq-client-core] Publisher channel error (channel closing during publish): ${err.message}`);
+      // A 406 ON THE PUBLISHER CHANNEL IS THE PUBLISH PATH'S BUSINESS, and the CODE is
+      // what says so (d.698).
+      //
+      // The publisher channel is a ConfirmChannel; this client sends no `basic.ack` on it,
+      // so the sentence this branch read until d.698 — `'unknown delivery tag'` — never
+      // reached it. What does reach it is the broker refusing the SEND with 406: a
+      // `user_id` property that is not the authenticated user (measured d.685a, `classId
+      // 60 / methodId 40`). That refusal is already answered where it belongs — the send
+      // reads this very `_closeError` and rejects the caller with a `PermanentPublishError`
+      // (`_refusedSendPermanent()`) — so raising it a second time as a client fault would
+      // report one event twice, once to the publisher and once to everybody.
+      //
+      // Only 406. A `404 NOT-FOUND` says nothing declares the exchange, which no publisher
+      // can fix and no caller of THIS message is the right audience for, and a codeless
+      // death is not an answer about any request at all: both stay raised, below.
+      if (err.code === AMQP_PRECONDITION_FAILED) {
+        this._logger.warn(`[RabbitMQClient] [mq-client-core] Publisher channel refused the send with ${AMQP_PRECONDITION_FAILED} (answered to the publisher): ${err.message}`);
         // Don't try to recreate - channel is already closing
-        // Don't emit error - publish callback will handle retry
+        // Don't emit error - the publish path answers the caller from `_closeError`
         return;
       }
-      
+
       this._logger.error(`[RabbitMQClient] [mq-client-core] ${reason}`);
-      channel._closeError = err;
       // Recovery is NOT started here — one rail, the `close` handler (d.261).
       this.emit('error', err);
     });
     
-    channel.on('close', async () => {
+    // PREPENDED, not appended (d.1134). amqplib registers its own `close` listener in the
+    // channel's constructor — the one that answers every unconfirmed publish with the bare
+    // `new Error('channel closed')` (`lib/channel.js`, the `Channel` constructor) — and a
+    // constructor runs before anybody can attach anything, so an appended handler always
+    // ran SECOND. The publish callbacks then read a channel that was still alive, took the
+    // branch meant for a broker answer on a live channel, and the sentinel reached the
+    // classification untyped: permanent, not buffered, not retried — for a message the
+    // broker said nothing about (měřeno d.1126, `320 CONNECTION_FORCED` with a confirm in
+    // flight). `connection.toClosed()` closes every channel before the connection's own
+    // events (`lib/connection.js`), so this handler is the only one that can mark the
+    // channel dead in time. Prepending makes it run before amqplib's own listener — an
+    // order the emitter guarantees, with no timer and no race.
+    channel.prependListener('close', async () => {
       if (this._closedByCaller) {
         return;
       }
@@ -4242,15 +5521,37 @@ class RabbitMQClient extends EventEmitter {
       if (this._channel === channel) {
         this._channel = null;
       }
+      // The same obituary for the other send role (d.724). Without this line a dead
+      // telemetry channel would stay in its member and every later telemetry publish
+      // would be handed a corpse — `_ensurePublisherChannel('telemetry')` recreates only
+      // what it finds cleared.
+      if (this._telemetryChannel === channel) {
+        this._telemetryChannel = null;
+      }
       
       // Only try to recreate if connection is available
       // If connection is closed, reconnection logic will handle channel recreation
+      //
+      // Obnovuje se ROLE, která zemřela (d.1003b): tenhle handler visí na obou send
+      // kanálech a do d.1003b volal `_ensurePublisherChannel()` bez role — po smrti
+      // telemetry kanálu tedy „obnovil" živý publisher (no-op) a telemetry zůstal
+      // prázdný až do příští události.
       if (this._connectionAlive) {
         try {
-          await this._ensurePublisherChannel();
+          await this._ensurePublisherChannel(role);
         } catch (err) {
-          // Ignore errors during channel recreation if connection is closing
-          this._logger.warn(`[RabbitMQClient] [mq-client-core] Failed to recreate publisher channel (connection may be closing): ${err.message}`);
+          // Přechodné selhání obnovy (spojení odchází — d.1000/d.1003) je jen `warn`:
+          // kanál zůstane prázdný a příští publish ho po reconnectu obnoví sám
+          // (`_ensurePublisherChannel()`). Cokoli jiného je nehlášené selhání, a to
+          // má v tomhle klientovi kolej `error` (viz `_reportRecoveryFailure()`) —
+          // do d.1003 ho tenhle catch polykal jako `warn`, takže se o trvale
+          // nepoužitelném kanálu dozvěděl až první, kdo zkusil publikovat.
+          if (err instanceof TransientPublishError) {
+            this._logger.warn(`[RabbitMQClient] [mq-client-core] Failed to recreate ${role} channel (connection may be closing): ${err.message}`);
+          } else {
+            this._logger.error(`[RabbitMQClient] [mq-client-core] Failed to recreate ${role} channel after it closed: ${err.message}`);
+            this.emit('error', err);
+          }
         }
       }
     });
@@ -4305,12 +5606,27 @@ class RabbitMQClient extends EventEmitter {
         try {
           await this._ensureQueueChannel();
         } catch (err) {
-          // If connection is closing, this is expected - don't throw
-          if (err.message && err.message.includes('Connection closed')) {
+          // The connection is going away — amqplib's terminal-state class, measured
+          // live (d.693 step b): `createChannel()` on a closed connection answers
+          // `IllegalOperationError('Connection closed (by client)')`. The class is the
+          // fact; the sentence was only carrying it (d.696).
+          //
+          // It is read from `cause`, because the rail this failure travels wraps it:
+          // `_ensureQueueChannel()` answers with a `ConnectionError` naming the fix and
+          // keeps amqplib's object underneath. One level, and first-hand — that IS the
+          // wrapper's own cause, not a chain walked in hope. The rule itself has one
+          // body, `_connectionIsGoingAway()` (d.1003c), shared with the send and the
+          // consumer channel.
+          //
+          // Anything else is an unannounced failure and goes to `error` (d.1003c) —
+          // until then it was a `warn`, like the transient case. Recovery is NOT added
+          // here: the channel stays cleared and the next queue operation recreates it
+          // (`_requireQueueChannel()`), exactly as before.
+          if (this._connectionIsGoingAway(err.cause)) {
             this._logger.warn(`[RabbitMQClient] [mq-client-core] Queue channel close during connection closure (expected - reconnection will handle)`);
           } else {
-            // Log but don't throw - channel will be recreated on next use or during reconnection
-            this._logger.warn(`[RabbitMQClient] [mq-client-core] Failed to recreate queue channel: ${err.message} (will be recreated on next use)`);
+            this._logger.error(`[RabbitMQClient] [mq-client-core] Failed to recreate queue channel after it closed: ${err.message} (the next queue operation tries again)`);
+            this.emit('error', err);
           }
         }
       } else {
@@ -4365,8 +5681,19 @@ class RabbitMQClient extends EventEmitter {
         try {
           await this._ensureConsumerChannel();
         } catch (err) {
-          // Ignore errors during channel recreation if connection is closing
-          this._logger.warn(`[RabbitMQClient] [mq-client-core] Failed to recreate consumer channel (connection may be closing): ${err.message}`);
+          // Táž kolej jako u send kanálu (d.1003b): selhání, které jen hlásí odcházející
+          // spojení, je `warn` — reconnect kanál obnoví a konzumenty zaregistruje znovu.
+          // Cokoli jiného je nehlášené selhání a jde na `error`; do d.1003b ho tenhle
+          // catch polykal jako `warn`, takže konzumenti tiše přestali dostávat zprávy.
+          // `_ensureConsumerChannel()` odpovídá `ConnectionError` s chybou amqplibu
+          // v `cause` — jeden článek, vlastní příčina obalu (vzor obnovy frontového
+          // kanálu níž, d.696).
+          if (this._connectionIsGoingAway(err.cause)) {
+            this._logger.warn(`[RabbitMQClient] [mq-client-core] Failed to recreate consumer channel (connection may be closing): ${err.message}`);
+          } else {
+            this._logger.error(`[RabbitMQClient] [mq-client-core] Failed to recreate consumer channel after it closed: ${err.message}`);
+            this.emit('error', err);
+          }
         }
       }
     });
@@ -4389,6 +5716,42 @@ class RabbitMQClient extends EventEmitter {
    * The threshold itself is unchanged and no new one is introduced: a window
    * larger than one message is measured exactly as before.
    *
+   * THE VERDICT IS TAKEN ON THE TRANSITION, BOTH WAYS (d.736a). Until this batch
+   * the check ran only while the window FILLED, and it spoke every time it found
+   * the condition standing. MEASURED (`api_delivery_endpoint`, 2026-09-18,
+   * one consumer):
+   *
+   *     08:00:10.928 WARN … queue 'delivery.health.events' has 8/10 … (80%)
+   *     08:00:10.995 WARN … queue 'delivery.health.events' has 8/10 … (80%)
+   *     08:00:10.996 WARN … queue 'delivery.health.events' has 9/10 … (90%)
+   *
+   * — three lines in 68 ms about ONE standing condition, and never a line saying
+   * the queue came back under the threshold. The operator reading that log can
+   * see an alarm start and can never see it end, which makes the line unusable
+   * for the only question it exists to answer.
+   *
+   * The shape is the one the monitoring concept settled the same day: a rail that
+   * says a standing condition ONCE — OPEN states it, everything after it is the
+   * same episode, and the end is a RECORD rather than a second alarm
+   * (`infra/api_monitoring`, `c996215c` telemetry-intake rejections, `1b1c3912`
+   * registry health events; `watchers/alertLifecycle.js`
+   * § closeRecoveredInfrastructureAlerts: "each episode's one message went out
+   * when it opened"). This library keeps no episode store, so its record is the
+   * log: the onset stays a `warn`, the return is one `info`.
+   *
+   * WHAT DOES NOT CHANGE: the callback and the `prefetch:high-utilization` event
+   * still announce the onset, with the same payload — they simply fire once per
+   * episode now. The return gets no callback and no event of its own: both would
+   * be a declaration with no consumer anywhere in this workspace
+   * (`change-discipline.md` § Removing something removes its declaration), while
+   * the log line has a measured reader.
+   *
+   * NO HYSTERESIS is introduced. Monitoring damps a flapping subject with a floor
+   * taken from configuration, and it needs one because a notification stands
+   * behind each of its episodes; here the episode is a log line, and a floor
+   * written into this file would be a number with no owner
+   * (`architecture-principles.md` §2). The edge alone removes the repetition.
+   *
    * @private
    * @param {string} queue - Queue name
    * @param {Object} tracking - Prefetch tracking object
@@ -4399,38 +5762,65 @@ class RabbitMQClient extends EventEmitter {
     }
 
     if (tracking.prefetchCount <= 1) {
-      return; // One-message window: 0 % or 100 %, and 100 % is the working state.
+      // One-message window: 0 % or 100 %, and 100 % is the working state. There is
+      // no condition to stand, so an episode carried over from a larger window
+      // (the prefetch of a re-registered consumer can change) ends here — silently,
+      // because what it was measured against no longer exists.
+      tracking.utilizationHigh = false;
+      return;
     }
 
     const utilization = tracking.inFlight / tracking.prefetchCount;
-    
-    if (utilization >= this._prefetchUtilizationThreshold) {
-      const message = `Prefetch utilization high: queue '${queue}' has ${tracking.inFlight}/${tracking.prefetchCount} messages in-flight (${Math.round(utilization * 100)}%, threshold: ${Math.round(this._prefetchUtilizationThreshold * 100)}%)`;
-      this._logger.warn(`[RabbitMQClient] [mq-client-core] ⚠️ ${message}`);
-      
-      // Call alert callback if provided
-      if (this._prefetchAlertCallback) {
-        try {
-          this._prefetchAlertCallback(queue, utilization, tracking.inFlight, tracking.prefetchCount);
-        } catch (alertErr) {
-          this._logger.error(`[RabbitMQClient] [mq-client-core] Prefetch alert callback error:`, alertErr.message);
-        }
+    const high = utilization >= this._prefetchUtilizationThreshold;
+
+    if (high === tracking.utilizationHigh) {
+      return; // The same condition as at the last verdict — it has already been said.
+    }
+
+    tracking.utilizationHigh = high;
+
+    const state = `queue '${queue}' has ${tracking.inFlight}/${tracking.prefetchCount} messages in-flight (${Math.round(utilization * 100)}%, threshold: ${Math.round(this._prefetchUtilizationThreshold * 100)}%)`;
+
+    if (!high) {
+      // The end of the episode: a record, not an alarm.
+      this._logger.info(`[RabbitMQClient] [mq-client-core] Prefetch utilization back below threshold: ${state}`);
+      return;
+    }
+
+    const message = `Prefetch utilization high: ${state}`;
+    this._logger.warn(`[RabbitMQClient] [mq-client-core] ⚠️ ${message}`);
+
+    // Call alert callback if provided
+    if (this._prefetchAlertCallback) {
+      try {
+        this._prefetchAlertCallback(queue, utilization, tracking.inFlight, tracking.prefetchCount);
+      } catch (alertErr) {
+        this._logger.error(`[RabbitMQClient] [mq-client-core] Prefetch alert callback error:`, alertErr.message);
       }
-      
-      // Emit event for external listeners
-      this.emit('prefetch:high-utilization', {
-        queue,
-        utilization,
-        inFlight: tracking.inFlight,
-        prefetchCount: tracking.prefetchCount,
-        threshold: this._prefetchUtilizationThreshold,
-        timestamp: new Date().toISOString()
-      });
     }
+
+    // Emit event for external listeners
+    this.emit('prefetch:high-utilization', {
+      queue,
+      utilization,
+      inFlight: tracking.inFlight,
+      prefetchCount: tracking.prefetchCount,
+      threshold: this._prefetchUtilizationThreshold,
+      timestamp: new Date().toISOString()
+    });
   }
 
   /**
    * Start periodic prefetch monitoring
+   *
+   * WHAT IS LEFT FOR THIS TICK TO SAY since d.736a: the verdict is taken on both
+   * edges of every delivery (`consume()`), and `_checkPrefetchUtilization()` returns
+   * in silence when the condition is the one already announced — so a tick that sees
+   * the same `inFlight` and the same `prefetchCount` says nothing. It speaks only
+   * where the verdict changed without a delivery in between, and the one quantity
+   * that can move that way is `prefetchCount`: a consumer re-registered with a
+   * different window (`_applyConsumerPrefetch()`).
+   *
    * @private
    */
   _startPrefetchMonitoring() {
@@ -4438,7 +5828,7 @@ class RabbitMQClient extends EventEmitter {
       return; // Already started
     }
     
-    this._prefetchCheckTimer = setInterval(() => {
+    this._prefetchCheckTimer = this._setInterval(() => {
       const now = Date.now();
       for (const [queue, tracking] of this._prefetchTracking.entries()) {
         // Only check if we have recent activity (within last 30s)
@@ -4457,7 +5847,7 @@ class RabbitMQClient extends EventEmitter {
    */
   _stopPrefetchMonitoring() {
     if (this._prefetchCheckTimer) {
-      clearInterval(this._prefetchCheckTimer);
+      this._clearInterval(this._prefetchCheckTimer);
       this._prefetchCheckTimer = null;
     }
   }
@@ -4736,10 +6126,12 @@ class RabbitMQClient extends EventEmitter {
       this._consumerChannel.ack(msg);
       msg._mqProcessed = true;
     } catch (err) {
-      const m = err && err.message ? err.message : '';
-      if (m.includes('unknown delivery tag') || m.includes('PRECONDITION_FAILED') || m.includes('Channel closed')) {
+      // The same reading as the auto-ack inside `consume()` — see the note there (d.698).
+      // amqplib's terminal-state class is the only thing `ack()` throws; anything else
+      // reaching this catch came from outside amqplib and is a defect that must be heard.
+      if (err instanceof IllegalOperationError) {
         msg._mqProcessed = true;
-        this._logger.warn('[RabbitMQClient] [mq-client-core] Cannot ack - consumer channel is closed/recreated (delivery tag invalid)', { error: m });
+        this._logger.warn('[RabbitMQClient] [mq-client-core] Cannot ack - consumer channel is closed/closing (the broker returns the unacked delivery)', { error: err.message });
         return;
       }
       this.emit('error', err);
@@ -4777,10 +6169,10 @@ class RabbitMQClient extends EventEmitter {
       this._consumerChannel.nack(msg, false, requeue);
       msg._mqProcessed = true;
     } catch (err) {
-      const m = err && err.message ? err.message : '';
-      if (m.includes('unknown delivery tag') || m.includes('PRECONDITION_FAILED') || m.includes('Channel closed')) {
+      // The same reading as `ack()` above (d.698): the class amqplib refuses a call with.
+      if (err instanceof IllegalOperationError) {
         msg._mqProcessed = true;
-        this._logger.warn('[RabbitMQClient] [mq-client-core] Cannot nack - consumer channel is closed/recreated (delivery tag invalid)', { error: m });
+        this._logger.warn('[RabbitMQClient] [mq-client-core] Cannot nack - consumer channel is closed/closing (the broker returns the unacked delivery)', { error: err.message });
         return;
       }
       this.emit('error', err);