@onlineapps/mq-client-core 5.0.0 → 6.0.0

package/src/transports/rabbitmqClient.js

@@ -16,6 +16,7 @@ const {
   AMQP_NOT_FOUND,
   AMQP_PRECONDITION_FAILED,
   TransientPublishError,
+  RecoveryEndedPublishError,
   PermanentPublishError,
   QueueNotFoundError,
   classifyPublishError,
@@ -32,7 +33,8 @@ const {
   CONNECTION_CLOSED_UNEXPECTEDLY,
   connectionClosedUnexpectedly,
   CONSUMER_QUEUE_MISSING,
-  CONSUMER_DEAD_LETTER_ROUTE_MISSING
+  CONSUMER_DEAD_LETTER_ROUTE_MISSING,
+  carryVerdict
 } = require('../utils/errorHandler');
 const { assertLogger } = require('@onlineapps/logger-contract');
 const PublishLayer = require('../layers/PublishLayer');
@@ -125,11 +127,10 @@ const REFUSAL_REPLY_CODES = [403, 530, 406];
  *  - `workflow_id` is the only spelling the envelope contract admits, and a
  *    reader that accepts the camelCase alias is forbidden as such, not merely a
  *    producer that writes it (`docs/biz/70-contracts/workflow-message.md` §2.2,
- *    owner decision `workflow-message-aliases` 001). The alias is still written
- *    today by the gateway's webhook submit, whose removal is its owner's
- *    (`docs/standards/JSON_NAMING_CONVENTION.md` § alias read, `infra/TODO.md`);
- *    a reader that keeps honouring it is what makes the pair impossible to
- *    retire, because nothing then shows which producers still write it.
+ *    owner decision `workflow-message-aliases` 001). No producer in `shared/**`
+ *    or `infra/**` writes the alias (re-measured d.1134: the gateway's headers
+ *    carry `workflow_id` alone, `infra/api_gateway/shared/workflowMessageHeaders.js`),
+ *    and a reader that honoured it would hide the next producer that did.
  *  - a missing id is reported as missing. `'unknown'` is a value, and a log line
  *    carrying it claims a workflow by that name — the same reason
  *    `BaseClient._emitDeadLetterEvent()` resolves an absent id to `null` and
@@ -282,6 +283,9 @@ class RabbitMQClient extends EventEmitter {
     // socket whose channels are still being recreated is not yet usable (d.340).
     // Channels do the same through `channel._alive` (see `_isChannelAlive()`).
     this._connectionAlive = false;
+    // The broker's reason while it blocks this connection (`connection.blocked`), `null` otherwise
+    // (d.1145). Written by `_onConnectionBlocked()` / `_onConnectionUnblocked()`.
+    this._connectionBlockedBy = null;
     this._channel = null; // ConfirmChannel for publish operations
     this._queueChannel = null; // Regular channel for queue operations (assertQueue, checkQueue)
     this._consumerChannel = null; // Dedicated channel for consume operations
@@ -336,6 +340,10 @@ class RabbitMQClient extends EventEmitter {
     // the cycle cap is spent. From that point this client will not try again and
     // it must not report itself as connected.
     this._connectionFatal = false;
+    // The verdict itself — the error `_failFatally()` built, handed to `onFatal` and
+    // `connection:fatal`. Kept so that a later use of this client can carry THE SAME object
+    // as its `cause` (d.1281): one error, however many readers; never a copy.
+    this._connectionFatalError = null;
     // Injected by the owner of this client (service/wrapper). The LIBRARY never
     // ends the process — that decision belongs to whoever owns the lifecycle.
     this._onFatal = this._config.onFatal;
@@ -366,12 +374,14 @@ class RabbitMQClient extends EventEmitter {
     this._publishRetryBaseDelay = this._config.publishRetryBaseDelay;
     this._publishRetryMaxDelay = this._config.publishRetryMaxDelay;
     this._publishRetryBackoffMultiplier = this._config.publishRetryBackoffMultiplier;
-    // ONE number, two consumers, and therefore a name that belongs to neither of
-    // them alone: how long this client waits for an ANSWER from the broker. The
-    // publish confirm waits for it (`_publishOnce`), and so does the whole
-    // teardown of `disconnect()` (d.283 chose deliberately not to invent a second
-    // number for that; the name it inherited then said "publish confirmation",
-    // which was true of one consumer and false of the other).
+    // ONE number, and therefore a name that belongs to none of its consumers
+    // alone: how long this client waits for an ANSWER from the broker. The
+    // publish confirm waits for it (`_publishOnce`), so does the whole teardown
+    // of `disconnect()` (d.283 chose deliberately not to invent a second number
+    // for that; the name it inherited then said "publish confirmation", which was
+    // true of one consumer and false of the other), and so does every request a
+    // channel sends and waits on (`_askBroker()`, conf `mq-broker-answer-budget`
+    // 001, d.1135).
     this._brokerAnswerTimeout = this._config.brokerAnswerTimeout;
     // How long the connect handshake may take before the attempt is abandoned.
     this._connectTimeout = this._config.connectTimeout;
@@ -408,9 +418,12 @@ class RabbitMQClient extends EventEmitter {
     // Health reporting callbacks
     this._healthReportCallback = this._config.healthReportCallback; // (health) => Promise<void>
     this._healthCriticalCallback = this._config.healthCriticalCallback; // (health) => Promise<void>
-    this._criticalHealthShutdown = this._config.criticalHealthShutdown;
-    this._criticalHealthShutdownDelay = this._config.criticalHealthShutdownDelay;
-    this._criticalHealthStartTime = null; // Track when critical health started
+    // When the current critical stretch began — read only by the two log lines that open and
+    // close it ("Critical health detected at", "Health recovered after"). Since d.1275 it arms
+    // nothing: `criticalHealthShutdown` and the `health:shutdown` event it armed are gone
+    // (owner 2026-10-06), because ending the process is the lifecycle owner's decision
+    // (`_failFatally()`), and nothing listened.
+    this._criticalHealthStartTime = null;
 
     // Publish layer (retry + buffer)
     this._publishLayer = new PublishLayer({
@@ -422,6 +435,13 @@ class RabbitMQClient extends EventEmitter {
           ttlMs: this._config.publishBufferTtlMs,
         },
       },
+      // The buffer's expiry clock is THIS client's timer rail (d.1275): its handle sits in
+      // `_activeTimers` like every other timer the client arms, so `disconnect()` ends it and
+      // `timers-have-one-evidence` can see it (d.759e).
+      timers: {
+        setTimeout: (callback, ms) => this._setTimeout(callback, ms),
+        clearTimeout: (handle) => this._clearTimeout(handle),
+      },
     });
 
     // Publish monitor (metriky) — counts only, reports through return values,
@@ -561,11 +581,19 @@ class RabbitMQClient extends EventEmitter {
   /**
    * THE definition of "this client's consumer is attached to that queue".
    *
-   * The tag is the one fact that is about THIS client: the broker gives it to
-   * the attachment it created, and since d.386b / d.605 the entry carries it
-   * only while that attachment exists — a refused re-registration and a cancel
-   * sent by the broker both drop it while the consumer stays TRACKED, because
-   * the next recovery must find it on the list.
+   * Two facts, both about THIS client, and both are needed:
+   *   - the consumer channel is alive (`_isChannelAlive()`, d.260) — an attachment lives
+   *     on that channel and dies with it, while the entry keeps its tag until the
+   *     re-registration on the next channel replaces it;
+   *   - the entry carries a tag: the broker gives it to the attachment it created, and
+   *     since d.386b / d.605 the entry carries it only while that attachment exists — a
+   *     refused re-registration and a cancel sent by the broker both drop it while the
+   *     consumer stays TRACKED, because the next recovery must find it on the list.
+   *
+   * Nothing here asks the broker, and nothing here reads the QUEUE channel. Until d.1275
+   * the health check counted `active` only inside its `checkQueue` loop, so a dead queue
+   * channel or an unanswered probe reported 0 attached for a client whose consumer channel
+   * was alive and receiving (INFRA 531, W224 on the dev scheduler).
    *
    * It is a method rather than an expression repeated twice for the reason
    * `change-discipline.md` § One rail per concern states: until d.613
@@ -580,7 +608,9 @@ class RabbitMQClient extends EventEmitter {
    * @private
    */
   _isConsumerAttached(consumerInfo) {
-    return typeof consumerInfo?.consumerTag === 'string' && consumerInfo.consumerTag !== '';
+    return this._isChannelAlive(this._consumerChannel)
+      && typeof consumerInfo?.consumerTag === 'string'
+      && consumerInfo.consumerTag !== '';
   }
 
   /**
@@ -785,6 +815,71 @@ class RabbitMQClient extends EventEmitter {
       this.emit('error', err);
     });
     connection.on('close', () => this._onConnectionDied());
+    // A broker in a memory or disk alarm blocks a connection that publishes and reads nothing
+    // more from it until the alarm clears; the connection stays alive, so no reconnect — and
+    // no flush — follows (measured d.1143 on the platform's image). amqplib announces the
+    // capability and re-emits both frames (`lib/connect.js`, `lib/channel_model.js`).
+    this._connectionBlockedBy = null;
+    connection.on('blocked', (reason) => this._onConnectionBlocked(connection, reason));
+    connection.on('unblocked', () => this._onConnectionUnblocked(connection));
+  }
+
+  /**
+   * The broker blocked this connection (`connection.blocked`, d.1145).
+   *
+   * Recorded as state — the publish path names it when it refuses (`_publishPathTransient()`)
+   * — and reported once as a warning. A frame of a stale connection (one this client already
+   * replaced) says nothing about the current one and is ignored.
+   *
+   * @param {Object} connection - the amqplib connection that received the frame
+   * @param {string} reason - the broker's reason (RabbitMQ: "low on memory", "low on disk")
+   * @private
+   */
+  _onConnectionBlocked(connection, reason) {
+    if (connection !== this._connection) {
+      return;
+    }
+    this._connectionBlockedBy = String(reason);
+    this._logger.warn(
+      `[RabbitMQClient] The broker blocked this connection (reason: ${this._connectionBlockedBy}) - `
+        + 'Expected: an alarm-free broker. It reads nothing this client sends until the alarm clears: '
+        + 'publishes and every request wait, and end on brokerAnswerTimeout. '
+        + 'Fix: clear the broker alarm (management API /api/health/checks/alarms names it); the buffer '
+        + 're-sends what never left once the broker unblocks the connection.'
+    );
+  }
+
+  /**
+   * The broker unblocked this connection (`connection.unblocked`, d.1145).
+   *
+   * The flush after it is the one rail `PublishLayer.flushBuffered()` with the trigger
+   * `'unblocked'`: only the entries whose frame never left the client are re-sent; the broker
+   * delivers the rest by itself (conf `mq-publish-buffer` 001). A failed flush is reported the
+   * way the flush after a reconnect reports it.
+   *
+   * @param {Object} connection - the amqplib connection that received the frame
+   * @private
+   */
+  _onConnectionUnblocked(connection) {
+    if (connection !== this._connection) {
+      return;
+    }
+    const wasBlockedBy = this._connectionBlockedBy;
+    this._connectionBlockedBy = null;
+    this._logger.warn(
+      `[RabbitMQClient] The broker unblocked this connection (it had been blocked: ${wasBlockedBy === null ? 'no blocked frame seen' : wasBlockedBy}) - `
+        + 're-sending the buffered messages whose frame never left this client.'
+    );
+    this._publishLayer.flushBuffered('unblocked').then(
+      (flushed) => {
+        this._publishMonitor.trackFlushed(flushed);
+        this._logger.info(`[RabbitMQClient] ✓ Flushed ${flushed} buffered messages after the broker unblocked the connection`);
+      },
+      (flushErr) => {
+        this._logger.warn(`[RabbitMQClient] Failed to flush buffered messages after unblocked: ${flushErr.message}`);
+        this.emit('buffer:flush:failed', { error: flushErr.message, bufferSize: this._publishLayer._buffer.size() });
+      }
+    );
   }
 
   /**
@@ -990,6 +1085,33 @@ class RabbitMQClient extends EventEmitter {
     return error;
   }
 
+  /**
+   * Carry a verdict that is ALREADY written — on the error a caller is about to receive.
+   *
+   * `_markBrokerRefusal()` and `_failFatally()` write the verdict; this does not write
+   * one, it copies `code` and `reason` from a verdict the client produced onto the error
+   * built around it, so the receiver reads it where every receiver reads it: on the error
+   * itself (`BaseClient._consumerRefusal()`, `@onlineapps/service-wrapper` FÁZE 0.3/0.7 read
+   * `error.code`, never a `cause` chain — a reader walking the chain would be a fallback
+   * over a buried marker, `architecture-principles.md` §3). Measured (d.1294, finding of
+   * d.1278/d.1281): the `consume()` refusals built around the recovery verdict kept
+   * `MQ_CONNECTION_FATAL` one `cause` down, so `_consumerRefusal()` wrapped them in a
+   * `ConsumeError` and the lifecycle owner never saw the verdict it ends the process on.
+   *
+   * An error that is not a fatal verdict (a spent cycle carries no code, by contract)
+   * leaves the error untouched.
+   *
+   * @param {Error} error - the error being built for the caller; `cause` already set
+   * @param {Error|null|undefined} verdict - what the recovery produced
+   * @returns {Error} the same error, with the verdict readable on top when there is one
+   * @private
+   */
+  _carryVerdict(error, verdict) {
+    // One body, in `utils/errorHandler.js`: `PublishLayer` and `BaseClient.publish()` carry the
+    // same verdict the same way (d.1300), so the rule is not written three times.
+    return carryVerdict(error, verdict);
+  }
+
   /**
    * A recovery cycle is over and the client is NOT connected, but the broker
    * never refused it — so this is not the end.
@@ -1037,6 +1159,24 @@ class RabbitMQClient extends EventEmitter {
     return standby;
   }
 
+  /**
+   * Whether a recovery cycle may start on this client without the caller's action — the
+   * ONE statement of the three states that forbid it (d.1319): the connection declared lost
+   * (`_connectionFatal`), the caller closed the client (`_closedByCaller`), recovery disabled
+   * by configuration (`reconnectEnabled: false`). Read by `_resumeRecovery()` (may the next use
+   * start a cycle), by `_recoveryEndedForPublish()` (`replayable` — may a `reconnected` still
+   * come to replay a held message) and by every rail that meets a closed connection
+   * (`_requireQueueChannel()`, `cancelConsumer()`, `ack()`/`nack()`: wait for the reconnect, or
+   * say through `_refusalWithoutRecovery()` why none is coming). Until d.1319 the first two
+   * carried their own copy of these three checks.
+   *
+   * @returns {boolean}
+   * @private
+   */
+  _recoveryMayStart() {
+    return !this._connectionFatal && !this._closedByCaller && this._reconnectEnabled === true;
+  }
+
   /**
    * Somebody wants to use a client that is not connected. Start the next
    * recovery cycle if the contract allows one, and say whether a recovery is now
@@ -1053,9 +1193,7 @@ class RabbitMQClient extends EventEmitter {
    */
   _resumeRecovery() {
     if (this._reconnecting) return true;
-    if (this._connectionFatal) return false;
-    if (this._closedByCaller) return false;
-    if (!this._reconnectEnabled) return false;
+    if (!this._recoveryMayStart()) return false;
 
     this._logger.info(
       `[RabbitMQClient] [mq-client-core] Client used while disconnected - starting recovery cycle `
@@ -1163,6 +1301,7 @@ class RabbitMQClient extends EventEmitter {
     fatal.attempts = this._maxReconnectAttempts;
     fatal.cycles = this._reconnectCycles;
     fatal.cause = lastError;
+    this._connectionFatalError = fatal;
 
     // The log line is the RECORD and is unconditional; the two lines below are
     // the NOTIFICATION, and only a caller that is not awaiting needs it.
@@ -1390,6 +1529,8 @@ class RabbitMQClient extends EventEmitter {
    */
   _onConnectionDied() {
     this._connectionAlive = false;
+    // A dead connection is no longer blocked; a new one starts unblocked (d.1145).
+    this._connectionBlockedBy = null;
     this._channel = null;
     this._telemetryChannel = null;
     this._queueChannel = null;
@@ -1437,12 +1578,56 @@ class RabbitMQClient extends EventEmitter {
       return { status: 'absent', error: null };
     }
 
-    const UNANSWERED = Symbol('teardown-budget-spent');
+    const outcome = await this._awaitBrokerAnswer(() => handle.close(), budgetMs);
+
+    if (outcome.status === 'unanswered') {
+      this._logger.warn(
+        `[RabbitMQClient] The broker did not answer the ${what} close within the teardown budget `
+          + `(${this._brokerAnswerTimeout}ms) - `
+          + 'Expected: a close-ok frame for the close this client sent. '
+          + 'Fix: nothing to do here — the teardown stops waiting and drops the socket, so '
+          + 'the teardown ends (disconnect(), or a connect() that failed half-way) and the process '
+          + 'can exit; a broker that never answers a close is a broker-side or network fault, and '
+          + 'the declared brokerAnswerTimeout sets how long this client gives it.'
+      );
+      return { status: 'unanswered', error: null };
+    }
+    if (outcome.status === 'refused') {
+      return { status: 'refused', error: outcome.error };
+    }
+    return { status: 'closed', error: null };
+  }
+
+  /**
+   * Wait for the broker's answer to ONE request, never longer than `budgetMs`.
+   *
+   * THE one clock for "how long does this client wait for the broker to answer" (conf
+   * `mq-broker-answer-budget` 001, d.1135). Its two readers are `_askBroker()` — every
+   * request a channel or the connection sends and waits on — and
+   * `_closeWithinTeardownBudget()`, which asks it for the `close-ok` of a teardown with what
+   * is left of that teardown's budget. The publish confirm keeps its own timer inside the
+   * send callback (`_publishOnce()`), because it is not a promise to race: it is a callback
+   * that also has to be disarmed, counted and attributed.
+   *
+   * `request` is called here, synchronously, so a request that throws before it is sent
+   * reads as a refusal rather than escaping the budget as an exception.
+   *
+   * @param {() => Promise<*>} request - sends the request and answers its reply
+   * @param {number} budgetMs - how long the answer may take
+   * @returns {Promise<{status: 'answered', value: *, pending: Promise<*>}
+   *   |{status: 'refused', error: Error, pending: Promise<*>}
+   *   |{status: 'unanswered', pending: Promise<*>}>} `pending` is the request's own
+   *   promise, for a caller that must deal with an answer arriving after the budget
+   * @private
+   */
+  async _awaitBrokerAnswer(request, budgetMs) {
+    const pending = new Promise((resolve) => resolve(request()));
+    const UNANSWERED = Symbol('broker-answer-budget-spent');
     let deadlineTimer = null;
     const outcome = await Promise.race([
-      handle.close().then(
-        () => ({ status: 'closed', error: null }),
-        (err) => ({ status: 'refused', error: err })
+      pending.then(
+        (value) => ({ status: 'answered', value }),
+        (error) => ({ status: 'refused', error })
       ),
       new Promise((resolve) => {
         deadlineTimer = this._setTimeout(() => resolve(UNANSWERED), budgetMs);
@@ -1451,19 +1636,145 @@ class RabbitMQClient extends EventEmitter {
     this._clearTimeout(deadlineTimer);
 
     if (outcome === UNANSWERED) {
-      this._logger.warn(
-        `[RabbitMQClient] The broker did not answer the ${what} close within the teardown budget `
-          + `(${this._brokerAnswerTimeout}ms) - `
-          + 'Expected: a close-ok frame for the close this client sent. '
-          + 'Fix: nothing to do here — the teardown stops waiting and drops the socket, so '
-          + 'disconnect() ends and the process can exit; a broker that never answers a close is '
-          + 'a broker-side or network fault, and the declared brokerAnswerTimeout sets how '
-          + 'long this client gives it.'
+      return { status: 'unanswered', pending };
+    }
+    return { ...outcome, pending };
+  }
+
+  /**
+   * Ask the broker one thing and wait for its answer within `brokerAnswerTimeout`.
+   *
+   * ONE rail for every request this client sends and then waits on (conf
+   * `mq-broker-answer-budget` 001, verdict A; d.1135): queue and exchange declarations,
+   * `checkQueue`, `bindQueue`, `purgeQueue`, `deleteQueue`, `basic.consume`, `basic.cancel`,
+   * `basic.qos` and every channel open. Until d.1135 none of them had a limit. A broker in a
+   * memory alarm keeps the connection open and its heartbeats flowing while it answers
+   * nothing — measured by d.1126 on an isolated broker of the platform's image: every one of
+   * these calls still pending after 300 s, settled only when the alarm was cleared; a paused
+   * broker was ended by amqplib's heartbeat after ~90 s. The heartbeat is not part of this
+   * rail: in an alarm it never fires, so only the budget ends the wait.
+   *
+   * The budget is `brokerAnswerTimeout` and never a second number — its declared meaning is
+   * exactly this question (`config/configSchema.js`).
+   *
+   * WHEN THE BUDGET IS SPENT:
+   *   - the channel that carried the request is DISCARDED (`_discardUnansweredChannel()`):
+   *     amqplib queues the requests of one channel behind each other, so every later request
+   *     on it would wait behind the silent one. The next operation opens a fresh channel;
+   *   - a request that OPENS a channel has no channel yet; the one the broker may still open
+   *     later is closed as soon as it arrives, so an alarm does not leak channels;
+   *   - the caller gets `ConnectionError` naming the operation, its target and the budget.
+   *     The publish path translates it into `TransientPublishError`
+   *     (`_publishPathTransient()`), so retry, the buffer and `bufferOnFailure: false` apply
+   *     to it exactly as to any other transient failure.
+   *
+   * A bare `Error('Channel ended, no reply will be forthcoming')` — amqplib's
+   * `_rejectPending()` answering a request whose channel or connection died first, no class,
+   * no `code` — is the same fact ("no answer came") and becomes the same class. It is
+   * recognised by the carrier's STATE, never by the sentence (d.683): no `code`, a plain
+   * `Error`, and a carrier that is dead by the time the rejection arrives (amqplib emits
+   * `close` synchronously before the rejection's handlers run). A numbered refusal is an
+   * ANSWER and passes through untouched, as does anything already typed.
+   *
+   * @param {Object} request
+   * @param {string} request.operation - the request's name, as the message states it
+   * @param {string} request.target - what it is about (queue, exchange, channel)
+   * @param {Object|null} request.channel - the channel carrying it; `null` for a channel
+   *   open, which the connection carries
+   * @param {() => Promise<*>} send - sends the request and answers its reply
+   * @returns {Promise<*>} the broker's answer
+   * @throws {ConnectionError} when no answer came within the budget, or the carrier ended
+   *   before it could
+   * @private
+   */
+  async _askBroker({ operation, target, channel }, send) {
+    const budgetMs = this._brokerAnswerTimeout;
+    const outcome = await this._awaitBrokerAnswer(send, budgetMs);
+
+    if (outcome.status === 'answered') {
+      return outcome.value;
+    }
+
+    if (outcome.status === 'unanswered') {
+      if (channel) {
+        this._discardUnansweredChannel(channel, `${operation} ${target}`);
+      } else {
+        outcome.pending.then(
+          (late) => this._closeLateChannel(late, target),
+          () => {}
+        );
+      }
+      throw new ConnectionError(
+        `[RabbitMQClient] The broker did not answer ${operation} ${target} within brokerAnswerTimeout `
+          + `(${budgetMs}ms) - Expected: an answer to the request this client sent; a broker that `
+          + 'blocks publishers (memory or disk alarm) or is frozen keeps the connection open and '
+          + 'answers nothing. Fix: check the broker for an alarm (management API '
+          + '/api/health/checks/alarms) or a paused node; the channel that carried the request '
+          + 'is discarded and the next operation opens a fresh one. brokerAnswerTimeout is the '
+          + 'one budget for every answer this client waits for.'
       );
-      return { status: 'unanswered', error: null };
     }
 
-    return outcome;
+    const err = outcome.error;
+    const carrierDead = channel ? !this._isChannelAlive(channel) : !this._connectionAlive;
+    const bare = err instanceof Error && err.constructor === Error && err.code === undefined;
+    if (bare && carrierDead) {
+      throw new ConnectionError(
+        `[RabbitMQClient] ${operation} ${target} got no answer: the ${channel ? 'channel' : 'connection'} `
+          + 'carrying it ended before the broker answered - Expected: an answer to the request '
+          + 'this client sent. Fix: nothing is refused — the request never got a reply; run the '
+          + 'operation again once the channel is back (error.cause carries amqplib\'s rejection).',
+        err
+      );
+    }
+    throw err;
+  }
+
+  /**
+   * Take a channel whose request the broker did not answer out of service.
+   *
+   * It is marked dead first (`_isChannelAlive()`, the one liveness source — d.260), then
+   * dropped from whichever slot still holds it — only if it still holds THIS channel, the
+   * same obituary rule the close handlers keep — and then asked to close. The close is not
+   * awaited: it is an answer from the same silent broker. amqplib sends it at once and
+   * ignores every frame but `close-ok` from then on, so a broker that wakes up closes the
+   * channel cleanly (its consumers cancelled, its unacked deliveries requeued) instead of
+   * keeping it open with nobody holding it; its `close` event then reaches the handlers
+   * attached to it, exactly as for any other channel that ends.
+   *
+   * @param {Object} channel - the amqplib channel that carried the unanswered request
+   * @param {string} reason - which request went unanswered, for the post-mortem
+   * @private
+   */
+  _discardUnansweredChannel(channel, reason) {
+    channel._alive = false;
+    channel._closeReason = `No answer from the broker to ${reason} within brokerAnswerTimeout (${this._brokerAnswerTimeout}ms)`;
+    if (this._channel === channel) this._channel = null;
+    if (this._telemetryChannel === channel) this._telemetryChannel = null;
+    if (this._queueChannel === channel) this._queueChannel = null;
+    if (this._consumerChannel === channel) this._consumerChannel = null;
+    channel.close().catch((err) => {
+      this._logger.debug(`[RabbitMQClient] Discarded channel (${reason}) did not close: ${err.message}`);
+    });
+  }
+
+  /**
+   * Close a channel the broker opened after this client stopped waiting for it. Nobody
+   * holds it, so left open it would be a channel on the broker with no owner.
+   *
+   * @param {Object} channel - the late amqplib channel
+   * @param {string} what - which channel was being opened, for the log
+   * @private
+   */
+  _closeLateChannel(channel, what) {
+    this._logger.warn(
+      `[RabbitMQClient] The broker opened the ${what} after brokerAnswerTimeout (${this._brokerAnswerTimeout}ms) - `
+        + 'Expected: nothing to do; the open had already been reported as unanswered. '
+        + 'Fix: none — the late channel is closed now, so it is not left open with no owner.'
+    );
+    channel.close().catch((err) => {
+      this._logger.debug(`[RabbitMQClient] Late ${what} did not close: ${err.message}`);
+    });
   }
 
   /**
@@ -1604,6 +1915,15 @@ class RabbitMQClient extends EventEmitter {
    * Close the connection an abandoned handshake produces, whenever it completes.
    * A handshake that fails after its timeout opened nothing; its error adds
    * nothing to the timeout the caller already received.
+   *
+   * The close waits for the broker's `close-ok` no longer than `brokerAnswerTimeout` — the
+   * one budget every wait on the broker has (conf `mq-broker-answer-budget` 001), on the one
+   * rail the teardown already uses (`_closeWithinTeardownBudget()` → `_awaitBrokerAnswer()`),
+   * and an unanswered close drops the socket (`_dropUnansweredConnection()`) exactly as
+   * `connect()` does for a half-open connection. Until d.1322 this was a bare
+   * `await late.close()`: a broker that never answered it left the late connection, its
+   * socket and its heartbeat alive for the life of the process — the handshake leak of
+   * INFRA wave 5.
    * @private
    * @param {Promise<Object>} connectPromise - the handshake the timeout abandoned
    * @param {string} phase - 'connect' or 'reconnect'
@@ -1615,11 +1935,16 @@ class RabbitMQClient extends EventEmitter {
           `[RabbitMQClient] Handshake completed after the ${phase} timeout (${this._connectTimeout} ms) - `
             + 'closing that connection, nothing in this client owns it'
         );
-        try {
-          await late.close();
-        } catch (closeErr) {
+        const closing = await this._closeWithinTeardownBudget(
+          `abandoned ${phase} handshake`,
+          late,
+          this._brokerAnswerTimeout
+        );
+        if (closing.status === 'unanswered') {
+          this._dropUnansweredConnection(late);
+        } else if (closing.status === 'refused') {
           this._logger.warn(
-            `[RabbitMQClient] Error closing the connection whose handshake outlived the ${phase} timeout: ${closeErr.message}`
+            `[RabbitMQClient] Error closing the connection whose handshake outlived the ${phase} timeout: ${closing.error.message}`
           );
         }
       },
@@ -1698,7 +2023,10 @@ class RabbitMQClient extends EventEmitter {
       this._attachConnectionHandlers(this._connection);
 
       // Use ConfirmChannel to enable publisher confirms for publish operations
-      this._channel = await this._connection.createConfirmChannel();
+      this._channel = await this._askBroker(
+        { operation: 'createConfirmChannel', target: 'publisher channel', channel: null },
+        () => this._connection.createConfirmChannel()
+      );
       
       // Track channel metadata for debugging
       this._channel._createdAt = new Date().toISOString();
@@ -1711,7 +2039,10 @@ class RabbitMQClient extends EventEmitter {
       
       // Create a separate regular channel for queue operations (assertQueue, checkQueue)
       // This avoids RPC reply queue issues with ConfirmChannel.assertQueue()
-      this._queueChannel = await this._connection.createChannel();
+      this._queueChannel = await this._askBroker(
+        { operation: 'createChannel', target: 'queue channel', channel: null },
+        () => this._connection.createChannel()
+      );
       
       // Track channel metadata for debugging
       this._queueChannel._createdAt = new Date().toISOString();
@@ -1724,7 +2055,10 @@ class RabbitMQClient extends EventEmitter {
       
       // Create a dedicated channel for consume operations
       // This prevents channel conflicts between publish (ConfirmChannel) and consume operations
-      this._consumerChannel = await this._connection.createChannel();
+      this._consumerChannel = await this._askBroker(
+        { operation: 'createChannel', target: 'consumer channel', channel: null },
+        () => this._connection.createChannel()
+      );
       
       // Track channel metadata for debugging
       this._consumerChannel._createdAt = new Date().toISOString();
@@ -1743,10 +2077,15 @@ class RabbitMQClient extends EventEmitter {
       // Cleanup partially created resources
       this._connectionAlive = false;
       if (this._connection) {
-        try {
-          await this._connection.close();
-        } catch (_) {
-          /* ignore */
+        // Within the one budget (d.1135): a connect that failed because the broker stopped
+        // answering (a channel open above) would otherwise wait for a `close-ok` from that
+        // same silent broker. What the close answers is not the caller's business here —
+        // the failure that brought us into this catch is — so only a close that got no
+        // answer at all is acted on: its socket is dropped, as the teardown does.
+        const halfOpen = this._connection;
+        const closing = await this._closeWithinTeardownBudget('connection', halfOpen, this._brokerAnswerTimeout);
+        if (closing.status === 'unanswered') {
+          this._dropUnansweredConnection(halfOpen);
         }
         this._connection = null;
       }
@@ -1818,10 +2157,17 @@ class RabbitMQClient extends EventEmitter {
 
       const timeout = this._setTimeout(() => {
         done();
+        // The sentence names the lever that is READ (d.1138): the configuration key when
+        // the caller wrote it, the derivation in the constructor otherwise. It named an
+        // environment variable until d.1138 that nothing reads.
+        const budgetSource = this._config.reconnectWaitTimeout === undefined
+          ? 'not set, so derived as max(60000, maxReconnectAttempts × reconnectMaxDelay)'
+          : 'set in the client configuration';
         reject(new ConnectionError(
           `[RabbitMQClient] Reconnection timeout after ${this._reconnectWaitTimeout}ms - `
-            + 'Expected: the broker to accept a new connection within RABBITMQ_RECONNECT_WAIT_TIMEOUT. '
-            + 'Fix: check the broker is up and reachable; raise that timeout only if a longer outage must be survived in-process.'
+            + `Expected: the broker to accept a new connection within reconnectWaitTimeout (${this._reconnectWaitTimeout}ms, ${budgetSource}). `
+            + 'Fix: check the broker is up and reachable; raise reconnectWaitTimeout in the configuration handed to '
+            + 'the client only if a longer outage must be survived in-process.'
         ));
       }, this._reconnectWaitTimeout);
       
@@ -1947,39 +2293,69 @@ class RabbitMQClient extends EventEmitter {
       // process.
       this._logger.warn('[RabbitMQClient] [mq-client-core] Cannot recreate publisher channel: connection is closed (waiting for reconnection)');
 
+      // Every way this branch ends without a channel is ONE class, `RecoveryEndedPublishError`
+      // (B1, owner's decision 2026-10-06, d.1300): the message is held in the buffer and
+      // replayed after the next `reconnected` / `unblocked`, like every other transiently
+      // failed publish — one rail with the retry that waited for a reconnect and saw it fail
+      // (`PublishLayer`). Until d.1300 the wait's ending was thrown raw and the "no recovery"
+      // cases as a `ConnectionError`, so the caller got a `PublishError` with no `buffered` at
+      // all and the message was not held (INFRA-DOCS ID254 point 1). The verdict of a fatal
+      // ending rides on top (`_carryVerdict()`, d.1297); a spent cycle carries no code.
       if (this._resumeRecovery()) {
-        await this._waitForReconnection();
+        try {
+          await this._waitForReconnection();
+        } catch (err) {
+          throw this._recoveryEndedForPublish(role, `the recovery it waited for did not arrive - ${err.message}`, err);
+        }
 
         // After reconnection, try again
         if (this._isChannelAlive(this._sendChannelOf(role))) {
           return; // Channel was recreated during reconnection
         }
-        // If still no channel, connection might have failed - check again
+        // The wait ended on `reconnected`, and the connection is already gone again (its
+        // `close` fired before this continuation ran). Nothing holds that second death as an
+        // object, so there is no cause.
         if (!this._connectionAlive) {
-          throw new ConnectionError(
-            '[RabbitMQClient] Connection reconnection failed - cannot create publisher channel. '
-              + 'Expected: an open connection once the reconnect completed. '
-              + 'Fix: check the broker is reachable; the client spends RABBITMQ_MAX_RECONNECT_ATTEMPTS per cycle and '
-              + 'RABBITMQ_MAX_RECONNECT_CYCLES cycles in all, then emits connection:fatal.'
+          throw this._recoveryEndedForPublish(
+            role,
+            'the recovery it waited for completed, but the connection is not alive any more',
+            null
           );
         }
       } else {
-        // No recovery can be started: the connection is permanently lost (the
-        // broker refused it, or every cycle is spent), the caller ended this
-        // client, or recovery is disarmed by configuration.
-        throw new ConnectionError(
-          '[RabbitMQClient] Connection is closed and no recovery can be started - cannot create publisher channel. '
-            + 'Expected: either an open connection, or a recovery this client is still allowed to run. '
-            + 'Fix: read connection:fatal for which of the two ended it — a broker refusal (credentials, vhost, '
-            + 'topology) or RABBITMQ_MAX_RECONNECT_CYCLES spent; reconnectEnabled: false and disconnect() also '
-            + 'leave the client here, on purpose.'
+        // No recovery can be started: the connection is permanently lost (the broker refused
+        // it, or every cycle is spent), the caller ended this client, or recovery is disarmed
+        // by configuration — the same three states, in the same order, as the consumer path
+        // (`_consumerChannelWithoutRecovery()`, d.1281).
+        if (this._connectionFatal) {
+          const fatal = this._connectionFatalError;
+          throw this._recoveryEndedForPublish(
+            role,
+            `the connection is permanently lost and no recovery may start - ${fatal ? fatal.message : 'the verdict was not recorded'}`,
+            fatal
+          );
+        }
+        if (this._closedByCaller) {
+          throw this._recoveryEndedForPublish(
+            role,
+            'the caller closed this client (disconnect()) and no recovery may start — only an explicit connect() re-arms it',
+            null
+          );
+        }
+        throw this._recoveryEndedForPublish(
+          role,
+          'the connection is closed and recovery is disabled by configuration (reconnectEnabled: false)',
+          null
         );
       }
     }
     
     try {
       // Create new ConfirmChannel
-      const channel = await this._connection.createConfirmChannel();
+      const channel = await this._askBroker(
+        { operation: 'createConfirmChannel', target: `${role} channel`, channel: null },
+        () => this._connection.createConfirmChannel()
+      );
 
       // Track channel metadata for debugging
       channel._createdAt = new Date().toISOString();
@@ -2030,6 +2406,24 @@ class RabbitMQClient extends EventEmitter {
           err
         );
       }
+      // Třetí nosič (d.1135): broker na otevření kanálu neodpověděl v `brokerAnswerTimeout`
+      // (alarm paměti, zmrazený broker) — `_askBroker()` to hlásí `ConnectionError`, jinou
+      // chybu z otevření kanálu tahle třída nenese. Je to týž stav „odpověď nepřišla“, ne
+      // odmítnutí, takže přechodný jako oba nosiče výše. Stojí ZA nimi: spojení, které
+      // odchází, má svou vlastní (přesnější) větu i tehdy, když amqplib odmítnutí složil
+      // `_askBroker()` do `ConnectionError`.
+      if (err instanceof ConnectionError) {
+        this._logger.warn(
+          `[RabbitMQClient] [mq-client-core] Failed to recreate ${role} channel (no answer from the broker): ${msg}`
+        );
+        throw new TransientPublishError(
+          `[RabbitMQClient] ${role} channel cannot be recreated: the broker did not answer the open (transient condition) - `
+            + `Expected: an answer within brokerAnswerTimeout (${this._brokerAnswerTimeout}ms). `
+            + 'Fix: retry the publish; PublishLayer does this on its own and buffers the message meanwhile. '
+            + 'error.cause names the unanswered request.',
+          err
+        );
+      }
 
       // Ostatní chyby považujeme za permanentní problém na úrovni kanálu/spojení.
       throw new PermanentPublishError(
@@ -2062,7 +2456,10 @@ class RabbitMQClient extends EventEmitter {
     
     try {
       // Create new regular channel
-      this._queueChannel = await this._connection.createChannel();
+      this._queueChannel = await this._askBroker(
+        { operation: 'createChannel', target: 'queue channel', channel: null },
+        () => this._connection.createChannel()
+      );
       
       // Track channel metadata for debugging
       this._queueChannel._createdAt = new Date().toISOString();
@@ -2100,6 +2497,16 @@ class RabbitMQClient extends EventEmitter {
    *   d.1003d), never assumed: until d.1003d this branch answered
    *   `_activeConsumers.size` as re-registered, counting a consumer whose
    *   re-registration the broker had refused (tracked, no tag — d.262, d.386b).
+   * @throws {ConnectionError} when the recovery this call waited for did not arrive —
+   *   `cause` is the error that ended the wait, the same object the cycle produced
+   *   (`code: 'MQ_CONNECTION_FATAL'` when it was the last cycle, and `onFatal` has already
+   *   received it — the thrown error then carries that `code` and `reason` on top too
+   *   (`_carryVerdict()`, d.1297); no `code` for a spent cycle — the contract keeps
+   *   `MQ_CONNECTION_STANDBY` inside the client); when the connection is closed and no recovery may start
+   *   (`_consumerChannelWithoutRecovery()`: permanently lost — `cause` is the fatal error
+   *   `onFatal` received; closed by the caller; recovery disabled); when the recovery it
+   *   waited for completed but the connection is not alive; or when the open connection
+   *   refuses the channel.
    */
   async _ensureConsumerChannel() {
     if (this._isChannelAlive(this._consumerChannel)) {
@@ -2113,16 +2520,39 @@ class RabbitMQClient extends EventEmitter {
       this._logger.warn('[RabbitMQClient] [mq-client-core] Cannot recreate consumer channel: connection is closed (reconnection in progress)');
 
       if (!this._resumeRecovery()) {
-        return { reRegistered: 0, failed: this._activeConsumers.size };
+        // No recovery may start, and the caller is told WHY (d.1281, finding of d.1278):
+        // until then this branch answered `{ failed }`, `consume()` went on without a
+        // channel and the caller got the queue-channel rail's "queue channel is not
+        // available … Fix: await client.connect()" — the right fix for one of the three
+        // states and wrong for the other two. The three are the three `_resumeRecovery()`
+        // refuses, asked in its order; the fatal one carries the verdict `onFatal` already
+        // received as `cause` — the same object, so there is no second rail of reporting.
+        throw this._consumerChannelWithoutRecovery();
       }
 
       try {
         await this._waitForReconnection();
       } catch (err) {
-        this._logger.warn(
-          `[RabbitMQClient] [mq-client-core] Consumer channel waited for a recovery that did not arrive: ${err.message}`
-        );
-        return { reRegistered: 0, failed: this._activeConsumers.size };
+        // The wait's ending is the caller's answer, the way it is on the publisher path
+        // (`_ensurePublisherChannel()` lets it through). Until d.1278 this branch wrote a
+        // WARN line and answered `{ failed }` as if that were an outcome; `consume()` then
+        // went on without a channel and the caller got the queue-channel rail's refusal
+        // ("queue channel is not available … Fix: await client.connect()") — no cause, no
+        // cycle, and the verdict of a fatal cycle reached `onFatal` and nobody else
+        // (INFRA-DOCS ID254). The cause is the SAME object the cycle produced, never a
+        // copy: `onFatal` and this caller hold one error between them, so there is no
+        // second channel of reporting to keep in step.
+        // The verdict rides on top (d.1297): `code`/`reason` of a fatal ending are copied
+        // onto this error, so `BaseClient._consumerRefusal()` lets it through unchanged and
+        // the lifecycle owner reads `error.code` as everywhere else.
+        throw this._carryVerdict(new ConnectionError(
+          `[RabbitMQClient] Cannot recreate the consumer channel: the recovery it waited for did not arrive - ${err.message} `
+            + 'Expected: the recovery to re-establish the connection before a consumer attaches. '
+            + 'Fix: read error.code — MQ_CONNECTION_FATAL ends this client (onFatal has been called; error.cause is '
+            + 'that verdict, error.reason says broker-refused or cycles-spent); a spent cycle carries no code and is '
+            + 'an outage: the next consume(), publish() or performHealthCheck() starts the next cycle.',
+          err
+        ), err);
       }
 
       if (this._isChannelAlive(this._consumerChannel)) {
@@ -2131,13 +2561,27 @@ class RabbitMQClient extends EventEmitter {
         return this._consumerAttachmentCounts();
       }
       if (!this._connectionAlive) {
-        return { reRegistered: 0, failed: this._activeConsumers.size };
+        // The wait ended on `reconnected`, and the connection is already gone again
+        // (its `close` fired before this continuation ran). Nothing holds that second
+        // death as an object here, so there is no `cause`; the sentence says what
+        // happened and what starts the next cycle (d.1281).
+        throw new ConnectionError(
+          '[RabbitMQClient] Cannot recreate the consumer channel: the recovery it waited for completed, '
+            + 'but the connection is not alive any more - '
+            + 'Expected: a live connection at the end of the recovery. '
+            + "Fix: run consume() again — the connection's close handler starts the next recovery cycle; "
+            + 'if it keeps ending here, the broker is dropping the connection right after accepting it '
+            + '(read the broker log).'
+        );
       }
     }
     
     try {
       // Create new regular channel
-      this._consumerChannel = await this._connection.createChannel();
+      this._consumerChannel = await this._askBroker(
+        { operation: 'createChannel', target: 'consumer channel', channel: null },
+        () => this._connection.createChannel()
+      );
       
       // Track channel metadata for debugging
       this._consumerChannel._createdAt = new Date().toISOString();
@@ -2176,6 +2620,104 @@ class RabbitMQClient extends EventEmitter {
     }
   }
 
+  /**
+   * The refusal a consumer gets when the connection is closed and `_resumeRecovery()`
+   * will not start a recovery — one sentence per state, in the order `_resumeRecovery()`
+   * asks them (d.1281).
+   *
+   *   - the connection is permanently lost (`_connectionFatal`): `cause` is THE fatal
+   *     error, the object `_failFatally()` handed to `onFatal` / `connection:fatal`;
+   *   - the caller closed this client (`_closedByCaller`): no cause — `disconnect()` is
+   *     not an error, and only `connect()` undoes it;
+   *   - recovery is disabled by configuration (`reconnectEnabled: false`): no cause.
+   *
+   * @returns {ConnectionError}
+   * @private
+   */
+  _consumerChannelWithoutRecovery() {
+    return this._refusalWithoutRecovery('[RabbitMQClient] Cannot recreate the consumer channel', 'consume');
+  }
+
+  /**
+   * ONE builder of the refusal for "the connection is closed and no recovery may start" —
+   * three states, three sentences, read in `_resumeRecovery()`'s order (d.1281, d.1314).
+   * Every operation that meets a closed connection it cannot wait out says it through this
+   * function: the consumer channel (`_consumerChannelWithoutRecovery()`), the queue-channel
+   * rail (`_requireQueueChannel()`), `cancelConsumer()`, `ack()`/`nack()` — so the verdict of a
+   * lost connection is written on the error once and the same way everywhere, and nothing
+   * advises `connect()` to a client whose owner must end the process instead.
+   *
+   * @param {string} headline - `[RabbitMQClient] Cannot <what>` — what was asked
+   * @param {string} verb - the public operation, named in the `disconnect()` Fix
+   * @returns {ConnectionError} with the fatal verdict carried on top when that is the state
+   * @private
+   */
+  _refusalWithoutRecovery(headline, verb) {
+    if (this._connectionFatal) {
+      const fatal = this._connectionFatalError;
+      return this._carryVerdict(new ConnectionError(
+        `${headline}: the connection is permanently lost and no `
+          + `recovery may start - ${fatal ? fatal.message : 'the verdict was not recorded'} `
+          + 'Expected: a client whose connection was not declared lost. '
+          + 'Fix: this client is over — error.code is MQ_CONNECTION_FATAL and error.cause the verdict onFatal '
+          + '(and connection:fatal) already carried; the owner of the client stops the process so its restart '
+          + 'policy boots a new one against a verified broker.',
+        fatal || undefined
+      ), fatal);
+    }
+    if (this._closedByCaller) {
+      return new ConnectionError(
+        `${headline}: the caller closed this client (disconnect()) `
+          + 'and no recovery may start - '
+          + 'Expected: a client that has not been disconnected. '
+          + `Fix: await client.connect() before ${verb}(); only an explicit connect() re-arms recovery.`
+      );
+    }
+    return new ConnectionError(
+      `${headline}: the connection is closed and recovery is `
+        + 'disabled by configuration (reconnectEnabled: false) - '
+        + 'Expected: either an open connection, or a client allowed to recover one. '
+        + 'Fix: await client.connect() to open a new connection, or run the client with reconnectEnabled: true '
+        + 'so the next consume(), publish() or performHealthCheck() starts a recovery cycle.'
+    );
+  }
+
+  /**
+   * The refusal a publish gets when its send channel cannot be had because the connection
+   * stayed down (B1, d.1300) — one class for every ending of that branch, with the reason in
+   * the sentence and the verdict, when there is one, on top.
+   *
+   * @param {'publisher'|'telemetry'} role - whose channel it was
+   * @param {string} why - what ended it, already including the wait's own sentence when one exists
+   * @param {Error|null} ended - the error that ended the recovery (the fatal verdict is the very
+   *   object `onFatal` received), or null when nothing holds the state as an object
+   * @returns {RecoveryEndedPublishError}
+   * @private
+   */
+  _recoveryEndedForPublish(role, why, ended) {
+    // Whether a `reconnected` can still come on this client without the caller's action —
+    // read from the state AFTER the ending, so a wait that ended fatal answers false. The
+    // three states that refuse `_resumeRecovery()` are exactly the three where it never comes
+    // (d.1301, lead's decision: a hold makes sense only where a reconnect can replay it).
+    const replayable = this._recoveryMayStart();
+    const fix = replayable
+      ? 'Fix: nothing to retry here — PublishLayer holds the message in the buffer (unless the call passed '
+        + 'bufferOnFailure: false) and replays it after the next reconnect or after the broker unblocks the '
+        + 'connection; the next publish(), consume() or performHealthCheck() starts the next recovery cycle. '
+      : 'Fix: this client will not reconnect on its own, so PublishLayer holds nothing (error.buffered === false) — '
+        + 'the caller holds the only copy; the lifecycle owner decides what happens to the process (onFatal), '
+        + 'and only an explicit connect() would open a new connection. ';
+    return this._carryVerdict(new RecoveryEndedPublishError(
+      `[RabbitMQClient] Cannot recreate the ${role} channel: ${why} `
+        + 'Expected: a live connection before the send. '
+        + fix
+        + 'error.code MQ_CONNECTION_FATAL (with error.reason) means this client is over and onFatal has been '
+        + 'called; error.cause is what ended the recovery, when an object exists for it.',
+      ended || undefined,
+      { replayable }
+    ), ended);
+  }
+
   /**
    * Re-register every tracked consumer on the current consumer channel.
    *
@@ -2212,6 +2754,33 @@ class RabbitMQClient extends EventEmitter {
     return { reRegistered, failed };
   }
 
+  /**
+   * The consumer channel, if it is alive — otherwise a refusal that names why.
+   *
+   * The one question every step that is about to use the consumer channel asks
+   * (`_isChannelAlive()`, the one liveness source, d.260). A refusal here is not a broker
+   * verdict: the consumer stays tracked and the next recovery re-attaches it.
+   *
+   * @param {string} action - what was about to happen, as the refusal states it
+   * @param {string} queue - the queue it is about
+   * @returns {Object} the live consumer channel
+   * @throws {ConnectionError} when the channel is dead or gone
+   * @private
+   */
+  _liveConsumerChannel(action, queue) {
+    const channel = this._consumerChannel;
+    if (!this._isChannelAlive(channel)) {
+      throw new ConnectionError(
+        `[RabbitMQClient] Cannot ${action} ${queue}: consumer channel is not available - `
+          + 'Expected: a live consumer channel for the whole re-registration. '
+          + 'Fix: nothing to do by hand — the channel died during the recovery (closed by the broker, or '
+          + 'discarded after brokerAnswerTimeout); the consumer stays tracked and the next channel recreate '
+          + 're-attaches it. Listen for consumer:re-registration:failed to see which ones wait.'
+      );
+    }
+    return channel;
+  }
+
   /**
    * Re-attach ONE tracked consumer on the current consumer channel.
    *
@@ -2235,19 +2804,29 @@ class RabbitMQClient extends EventEmitter {
    */
   async _reRegisterConsumer(queue, consumerInfo) {
     try {
+      // Asked before EACH re-registration, not once per loop (d.1138): a channel that
+      // died after the previous consumer — closed by the broker, or discarded by the
+      // broker-answer budget (d.1135) — leaves the slot empty, and reaching into it was a
+      // TypeError naming a JavaScript accident instead of the channel's state. Asked
+      // before the queue step, so a consumer that cannot be attached declares nothing.
+      this._liveConsumerChannel('re-register the consumer of', queue);
+
       await this._prepareQueueForConsume(queue, {
         durable: consumerInfo.options.durable,
         queueOptions: consumerInfo.options.queueOptions
       });
 
+      // …and again after it: the queue step awaits the broker on another channel,
+      // and the consumer channel can die meanwhile.
+      const consumerChannel = this._liveConsumerChannel('re-register the consumer of', queue);
+
       // The consumer's prefetch is re-applied here for the same reason the
       // queue step is: the channel is new, and QoS lives on the channel.
-      await this._applyConsumerPrefetch(queue, consumerInfo.options.prefetch);
+      await this._applyConsumerPrefetch(consumerChannel, queue, consumerInfo.options.prefetch);
 
-      const consumeResult = await this._consumerChannel.consume(
-        queue,
-        consumerInfo.handler,
-        { noAck: consumerInfo.options.noAck }
+      const consumeResult = await this._askBroker(
+        { operation: 'consume', target: queue, channel: consumerChannel },
+        () => consumerChannel.consume(queue, consumerInfo.handler, { noAck: consumerInfo.options.noAck })
       );
       consumerInfo.consumerTag = consumeResult.consumerTag;
       this._logger.info(`[RabbitMQClient] [mq-client-core] ✓ Re-registered consumer for queue: ${queue} (consumerTag: ${consumeResult.consumerTag})`);
@@ -2467,7 +3046,11 @@ class RabbitMQClient extends EventEmitter {
       queues: {
         checked: 0,
         missing: [],
-        noConsumer: []
+        noConsumer: [],
+        // The BROKER's count of consumers on each tracked queue (`checkQueue().consumerCount`
+        // — everybody's, not only this client's), or 'unknown' where the probe did not run
+        // or got no answer. Never 0 for "not asked" (d.1275).
+        consumers: {}
       },
       healthy: true,
       issues: []
@@ -2493,34 +3076,48 @@ class RabbitMQClient extends EventEmitter {
       health.issues.push('Consumer channel is closed or missing');
     }
     
-    // Check tracked consumers - verify queues exist and have active consumers
+    // Which of this client's consumers are attached is THIS client's fact, counted from its
+    // own state — the consumer channel and the tags (`_isConsumerAttached()`, the definition
+    // `getConsumerState()` reads too, d.613). Counted BEFORE the broker is asked and whatever
+    // the broker answers: until d.1275 `active` was incremented only inside the probe loop
+    // below, so a dead queue channel or an unanswered `checkQueue` left it at 0 and the
+    // verdict further down told the operator a consuming client consumed nothing (INFRA 531).
+    for (const [queue, consumerInfo] of this._activeConsumers.entries()) {
+      health.queues.consumers[queue] = 'unknown';
+      if (this._isConsumerAttached(consumerInfo)) {
+        health.consumers.active++;
+      } else {
+        health.consumers.inactive.push(queue);
+      }
+    }
+
+    // The probe only ADDS what the broker knows: does each queue exist, and how many
+    // consumers does it count on it. Where it cannot ask, the count stays 'unknown'.
     if (this.isConnected() && this._isChannelAlive(this._queueChannel)) {
       for (const [queue, consumerInfo] of this._activeConsumers.entries()) {
         health.queues.checked++;
         try {
           // Check if queue exists
           this._trackChannelOperation(this._queueChannel, `checkQueue ${queue}`);
-          const queueInfo = await this._queueChannel.checkQueue(queue);
+          const queueChannel = this._queueChannel;
+          const queueInfo = await this._askBroker(
+            { operation: 'checkQueue', target: queue, channel: queueChannel },
+            () => queueChannel.checkQueue(queue)
+          );
           if (queueInfo) {
-            // Queue exists - is THIS client's consumer attached to it?
-            //
-            // The tag is what answers, because it is the only fact that is about
-            // this client. `checkQueue()` does return `consumerCount` — the
-            // comment that stood here said RabbitMQ offers no way to ask, which
-            // is not true — but that number counts every consumer on the queue,
-            // this client's and everybody else's alike, so it cannot say whether
-            // the one asking is among them. The tag can: it is the name the
-            // broker gave THIS client's attachment, and since d.386b it is set
-            // only while that attachment exists. The question is asked through
-            // `_isConsumerAttached()` — the one definition `getConsumerState()`
-            // now reads too (d.613).
-            if (this._isConsumerAttached(consumerInfo)) {
-              health.consumers.active++;
-            } else {
-              health.consumers.inactive.push(queue);
+            // Queue exists. The broker's `consumerCount` counts every consumer on the
+            // queue, this client's and everybody else's alike, so it is REPORTED, never
+            // used to decide whether the one asking is among them — that is
+            // `_isConsumerAttached()`, counted above.
+            health.queues.consumers[queue] = queueInfo.consumerCount;
+            if (!this._isConsumerAttached(consumerInfo)) {
               health.queues.noConsumer.push(queue);
               health.healthy = false;
-              health.issues.push(`Queue ${queue} has no active consumer (consumerTag missing)`);
+              health.issues.push(
+                this._isChannelAlive(this._consumerChannel)
+                  ? `Queue ${queue} has no active consumer (consumerTag missing)`
+                  : `Queue ${queue} has no active consumer (consumer channel is not alive)`
+              );
             }
           } else {
             health.queues.missing.push(queue);
@@ -2544,12 +3141,15 @@ class RabbitMQClient extends EventEmitter {
     // that is its own verdict — not something a reader infers from two numbers
     // sitting beside the channel findings. The per-queue issues above name WHICH
     // queue lost its consumer, and they do not always exist: when the probe loop
-    // does not run (no connection, or a dead queue channel) the snapshot's only
-    // consumer evidence is `tracked` and `active`, and every issue names a
+    // does not run (no connection, or a dead queue channel) every issue names a
     // channel instead. Measured 2026-09-08 (INFRA-monitoring): the whole account
     // a reader got of a client taking no message off any queue was the line
     // `Health check OK: 0/0 consumers active`.
     //
+    // `active` is this client's own count (above), so the verdict is never the
+    // probe's absence restated: a dead queue channel beside a live consumer
+    // channel is a channel finding, not "no consumer" (d.1275).
+    //
     // `tracked === 0` is a different client, not a lesser failure: a publisher
     // registered no consumer and has none to lose. It stays healthy, and the OK
     // line below says which of the two it is.
@@ -2568,7 +3168,7 @@ class RabbitMQClient extends EventEmitter {
     // Emit health check result
     this.emit('health:check', health);
     
-    // If unhealthy, log and potentially trigger shutdown
+    // If unhealthy, log and report
     if (!health.healthy) {
       this._logger.error(`[RabbitMQClient] [mq-client-core] Health check FAILED:`, health.issues);
       this._logger.error(`[RabbitMQClient] [mq-client-core] Health details:`, JSON.stringify(health, null, 2));
@@ -2597,21 +3197,13 @@ class RabbitMQClient extends EventEmitter {
         }
       }
       
-      // Emit critical health event
+      // Emit critical health event. That is the whole of it: the client REPORTS critical
+      // health and decides nothing about the process. `health:shutdown` and the
+      // `criticalHealthShutdown*` keys that armed it were removed in d.1275 (owner
+      // 2026-10-06) — the event reached no listener anywhere, and the line announcing it
+      // promised a shutdown nobody performed. A lifecycle owner that wants to act on a
+      // sustained critical state reads this event or `healthCriticalCallback`.
       this.emit('health:critical', health);
-      
-      // Check if we should shutdown after delay
-      if (this._criticalHealthShutdown) {
-        const timeSinceCritical = Date.now() - this._criticalHealthStartTime;
-        if (timeSinceCritical >= this._criticalHealthShutdownDelay) {
-          this._logger.error(`[RabbitMQClient] [mq-client-core] Critical health persisted for ${timeSinceCritical}ms (threshold: ${this._criticalHealthShutdownDelay}ms) - triggering shutdown`);
-          this.emit('health:shutdown', health);
-          // Note: Actual shutdown should be handled by the application using this event
-        } else {
-          const remaining = this._criticalHealthShutdownDelay - timeSinceCritical;
-          this._logger.warn(`[RabbitMQClient] [mq-client-core] Critical health will trigger shutdown in ${remaining}ms if not resolved`);
-        }
-      }
     } else {
       // Health is OK - reset critical health tracking
       if (this._criticalHealthStartTime) {
@@ -2854,7 +3446,10 @@ class RabbitMQClient extends EventEmitter {
     const channel = await this._requireQueueChannel('assertQueue', queue);
 
     try {
-      return await channel.assertQueue(queue, queueOptions);
+      return await this._askBroker(
+        { operation: 'assertQueue', target: queue, channel },
+        () => channel.assertQueue(queue, queueOptions)
+      );
     } catch (err) {
       // The SAME verdict the consume rail states, through the SAME function
       // (d.582). This is the rail FÁZE 0.8 walks: a service declaring its own
@@ -2953,6 +3548,14 @@ class RabbitMQClient extends EventEmitter {
   async _requireQueueChannel(verb, queue) {
     await this._ensureQueueChannel();
     if (!this._isChannelAlive(this._queueChannel)) {
+      // A connection that is down and will not recover on its own is not "wait for the
+      // reconnect": none is coming. The three states say so through the one builder every rail
+      // uses — the verdict on top for a lost connection (d.1314), the state named for
+      // `disconnect()` and `reconnectEnabled: false` (d.1319). A spent cycle (standby) keeps the
+      // sentence below: the next publish, consume or health check starts the next one.
+      if (!this._connectionAlive && !this._recoveryMayStart()) {
+        throw this._refusalWithoutRecovery(`[RabbitMQClient] Cannot ${verb} ${queue}`, verb);
+      }
       throw new ConnectionError(
         `[RabbitMQClient] Cannot ${verb} ${queue}: queue channel is not available - `
           + 'Expected: an open queue channel after _ensureQueueChannel(). '
@@ -2984,10 +3587,34 @@ class RabbitMQClient extends EventEmitter {
    * @private
    */
   _publishPathTransient(verb, queue, cause) {
+    // The sentence is chosen from this client's STATE, never from the cause's text (d.1145,
+    // finding of d.1143): since d.1135 this refusal also ends a pre-check the broker never
+    // answered, and on the platform's image the connection was then alive and BLOCKED by a
+    // memory alarm — "connection may be closed" sent the reader to a reconnect that was not
+    // coming. `sent` is false on every one of these (no frame was written), which is what the
+    // flush after `unblocked` reads.
+    let state;
+    let fix;
+    if (!this._connectionAlive) {
+      state = 'the connection is closed';
+      fix = 'Fix: nothing to do here — a reconnect restores it; PublishLayer retries and buffers the message meanwhile, '
+        + 'and the buffer re-sends it after the reconnect.';
+    } else if (this._connectionBlockedBy !== null) {
+      state = `the broker has blocked this connection (reason: ${this._connectionBlockedBy}) and answers nothing until it clears the alarm`;
+      fix = 'Fix: clear the broker alarm (management API /api/health/checks/alarms names it); PublishLayer retries and '
+        + 'buffers the message meanwhile, and the buffer re-sends it once the broker unblocks the connection (its frame never left).';
+    } else {
+      // Neither closed nor blocked: the cause says what happened (a request unanswered
+      // within brokerAnswerTimeout, or a channel open the broker refused) — this sentence
+      // does not guess which.
+      state = 'the queue channel is not available on a live, unblocked connection (error.cause names the request '
+        + 'that went unanswered or was refused)';
+      fix = 'Fix: read error.cause; an unanswered request points at a paused or overloaded broker. PublishLayer retries '
+        + 'and buffers the message meanwhile.';
+    }
     return new TransientPublishError(
-      `[RabbitMQClient] Cannot ${verb} ${queue}: queue channel is not available (connection may be closed) - `
-        + `Expected: an open queue channel before ${verb} on the publish path. `
-        + 'Fix: retry the publish after the reconnect; PublishLayer does this on its own and buffers the message meanwhile.',
+      `[RabbitMQClient] Cannot ${verb} ${queue}: ${state} - `
+        + `Expected: an answering broker on an open queue channel before ${verb} on the publish path. ${fix}`,
       cause
     );
   }
@@ -3354,7 +3981,10 @@ class RabbitMQClient extends EventEmitter {
       ...options,
       durable: options.durable !== undefined ? options.durable : this._config.durable
     };
-    return await channel.assertExchange(exchange, type, exchangeOptions);
+    return await this._askBroker(
+      { operation: 'assertExchange', target: exchange, channel },
+      () => channel.assertExchange(exchange, type, exchangeOptions)
+    );
   }
 
   /**
@@ -3398,7 +4028,10 @@ class RabbitMQClient extends EventEmitter {
     }
 
     const channel = await this._requireQueueChannel('bindQueue', `${queue} -> ${exchange}`);
-    return await channel.bindQueue(queue, exchange, pattern);
+    return await this._askBroker(
+      { operation: 'bindQueue', target: `${queue} -> ${exchange}`, channel },
+      () => channel.bindQueue(queue, exchange, pattern)
+    );
   }
 
   /**
@@ -3461,6 +4094,14 @@ class RabbitMQClient extends EventEmitter {
     // its tag named is gone (d.386b). There is nothing to cancel on the broker,
     // and asking anyway is a channel error rather than a cancel, so the caller
     // is told plainly instead of being handed one.
+    // Asked before the tag: on a connection that is down and will not recover the tag is gone
+    // too, and the sentence that matters is the state — the verdict for a lost connection
+    // (d.1314), `disconnect()` or `reconnectEnabled: false` otherwise (d.1319) — not "tracked
+    // but not attached".
+    if (!this._connectionAlive && !this._recoveryMayStart()) {
+      throw this._refusalWithoutRecovery(`[RabbitMQClient] Cannot cancelConsumer ${queue}`, 'cancelConsumer');
+    }
+
     if (info.consumerTag === null || info.consumerTag === undefined) {
       throw new ValidationError(
         `[RabbitMQClient] Cannot cancelConsumer ${queue}: the consumer is tracked but not attached - `
@@ -3481,7 +4122,11 @@ class RabbitMQClient extends EventEmitter {
     }
 
     this._trackChannelOperation(this._consumerChannel, `cancelConsumer ${queue}`);
-    const result = await this._consumerChannel.cancel(info.consumerTag);
+    const consumerChannel = this._consumerChannel;
+    const result = await this._askBroker(
+      { operation: 'cancel', target: queue, channel: consumerChannel },
+      () => consumerChannel.cancel(info.consumerTag)
+    );
     // Dropped only after the broker accepted the cancel: a consumer that is
     // still delivering must stay on the list recovery re-attaches.
     this._activeConsumers.delete(queue);
@@ -3498,7 +4143,10 @@ class RabbitMQClient extends EventEmitter {
    */
   async checkQueue(queue) {
     const channel = await this._requireQueueChannel('checkQueue', queue);
-    return await channel.checkQueue(queue);
+    return await this._askBroker(
+      { operation: 'checkQueue', target: queue, channel },
+      () => channel.checkQueue(queue)
+    );
   }
 
   /**
@@ -3507,7 +4155,10 @@ class RabbitMQClient extends EventEmitter {
    */
   async purgeQueue(queue) {
     const channel = await this._requireQueueChannel('purgeQueue', queue);
-    return await channel.purgeQueue(queue);
+    return await this._askBroker(
+      { operation: 'purgeQueue', target: queue, channel },
+      () => channel.purgeQueue(queue)
+    );
   }
 
   /**
@@ -3517,7 +4168,10 @@ class RabbitMQClient extends EventEmitter {
    */
   async deleteQueue(queue, options = {}) {
     const channel = await this._requireQueueChannel('deleteQueue', queue);
-    return await channel.deleteQueue(queue, options);
+    return await this._askBroker(
+      { operation: 'deleteQueue', target: queue, channel },
+      () => channel.deleteQueue(queue, options)
+    );
   }
 
   /**
@@ -3536,10 +4190,50 @@ class RabbitMQClient extends EventEmitter {
   }
 
   /**
-   * Internal publish implementation - single attempt without retry
+   * One publish attempt, without retry — and, when it fails, whether its frame LEFT THE
+   * CLIENT (d.1145, conf `mq-publish-buffer` 001).
+   *
+   * Every error this attempt throws carries `sent` (boolean): `true` once `sendToQueue()` /
+   * `publish()` on the channel returned without throwing — the frame was written to the
+   * channel — and `false` for everything that failed before that (the pre-check, the channel
+   * ensure, a throwing send). It says nothing about whether the broker stored the frame; it is
+   * what tells a message the broker may still deliver (held in a blocked socket, measured
+   * d.1143) from one it never received. `PublishLayer` folds the attempts of one call into the
+   * fact it writes on its own error and on the buffer entry.
+   *
+   * A nested republish from the confirm path (see `_publishOneAttempt`) may throw an error
+   * that already says `sent: true`; that fact is kept, never lowered.
+   *
+   * @param {string} queue
+   * @param {Buffer} buffer
+   * @param {Object} [options]
+   * @returns {Promise<void>}
+   * @throws {Error} the attempt's failure, with `sent` written on it
    * @private
    */
   async _publishOnce(queue, buffer, options = {}) {
+    const attempt = { sent: false };
+    try {
+      return await this._publishOneAttempt(queue, buffer, options, attempt);
+    } catch (err) {
+      if (err !== null && typeof err === 'object') {
+        err.sent = attempt.sent || err.sent === true;
+      }
+      throw err;
+    }
+  }
+
+  /**
+   * The body of one publish attempt. `attempt.sent` turns `true` the moment the frame is
+   * written to the channel; `_publishOnce()` reads it.
+   *
+   * @param {string} queue
+   * @param {Buffer} buffer
+   * @param {Object} options
+   * @param {{sent: boolean}} attempt - written here, read by `_publishOnce()`
+   * @private
+   */
+  async _publishOneAttempt(queue, buffer, options, attempt) {
     // Whose channel this send goes out on (d.724). Read once, here: the role cannot
     // change inside one attempt, and the channel it names can — so everything below asks
     // `_sendChannelOf(sendRole)` rather than holding a member.
@@ -3620,7 +4314,11 @@ class RabbitMQClient extends EventEmitter {
             }
             throw railErr;
           }
-          await queueChannel.checkQueue(queue);
+          const checkedOn = queueChannel;
+          await this._askBroker(
+            { operation: 'checkQueue', target: queue, channel: checkedOn },
+            () => checkedOn.checkQueue(queue)
+          );
           // Queue exists - proceed to publish
         } catch (checkErr) {
           // If queue doesn't exist (404), this je ERROR – ale rozlišujeme infra vs. non-infra:
@@ -3714,6 +4412,12 @@ class RabbitMQClient extends EventEmitter {
             //   - not already typed — `_publishPathTransient()` above throws into
             //     this same `catch`, and wrapping a verdict in itself would bury the
             //     rail's own sentence one level deeper for no reader.
+            //
+            // Since d.1135 the check goes through `_askBroker()`, so what arrives here
+            // is its `ConnectionError`: either the budget ran out (the channel is then
+            // discarded — dead) or amqplib's bare rejection, folded where it arrived. Both
+            // meet the three conditions unchanged; the bare error sits one level down, in
+            // `cause.cause`.
             throw this._publishPathTransient('checkQueue', queue, checkErr);
           } else {
             // Other error - rethrow
@@ -3844,12 +4548,20 @@ class RabbitMQClient extends EventEmitter {
                     return this.publish(queue, buffer, options);
                   }).then(resolve).catch(reject);
                 } else {
-                  // Not reconnecting - this is a real error
-                  // We cannot guarantee the message was delivered - must fail
+                  // No reconnect is in flight YET — which says nothing about whether one
+                  // follows. When the connection dies, amqplib closes its channels before
+                  // it announces the connection's own `close` (`lib/connection.js`,
+                  // `toClosed()`), and that announcement is what starts the reconnect, so
+                  // this callback runs before it (d.1134). The sentence therefore states
+                  // what is known here — the channel closed with the confirm outstanding —
+                  // and the classification makes it transient, so the publish path
+                  // retries and buffers it.
                   reject(new PublishError(
-                    `[RabbitMQClient] Channel closed during publish to queue "${queue}" and not reconnecting - message delivery not guaranteed. `
-                      + 'Expected: the channel to stay open until the broker confirms, or a reconnect to be in flight. '
-                      + 'Fix: republish the message — the confirm never arrived, so it may or may not have been stored.',
+                    `[RabbitMQClient] Channel closed during publish to queue "${queue}" before the broker confirmed the message - `
+                      + 'message delivery not guaranteed. '
+                      + 'Expected: the channel to stay open until the broker confirms. '
+                      + 'Fix: republish the message — the confirm never arrived, so it may or may not have been stored; '
+                      + 'error.buffered says whether the buffer holds it for the next reconnect.',
                     queue,
                     null
                   ));
@@ -3890,6 +4602,8 @@ class RabbitMQClient extends EventEmitter {
                 resolve();
               }
             });
+            // The frame is written to the channel: `sendToQueue()` returned without throwing.
+            attempt.sent = true;
             
             // Set a safety timeout - if callback wasn't invoked and channel closed, retry.
             // A broker confirm can land inside `sendToQueue()` itself, so the
@@ -4077,6 +4791,8 @@ class RabbitMQClient extends EventEmitter {
               resolve();
             }
           });
+          // The frame is written to the channel: `publish()` returned without throwing.
+          attempt.sent = true;
         });
         
         await confirmPromise;
@@ -4118,17 +4834,22 @@ class RabbitMQClient extends EventEmitter {
    * A non-numeric prefetch (the caller asked for none) sets none, and records
    * none: there is nothing to measure utilisation against.
    *
+   * @param {Object} consumerChannel - The consumer channel the caller holds; the
+   *   re-registration hands over the one it has just asked is alive (d.1138)
    * @param {string} queue - Queue name
    * @param {number|null|undefined} prefetch - The consumer's prefetch
    * @returns {Promise<void>}
    * @private
    */
-  async _applyConsumerPrefetch(queue, prefetch) {
+  async _applyConsumerPrefetch(consumerChannel, queue, prefetch) {
     if (typeof prefetch !== 'number') {
       return;
     }
 
-    await this._consumerChannel.prefetch(prefetch);
+    await this._askBroker(
+      { operation: 'prefetch', target: queue, channel: consumerChannel },
+      () => consumerChannel.prefetch(prefetch)
+    );
 
     const tracking = this._prefetchTracking.get(queue);
     if (tracking) {
@@ -4326,7 +5047,10 @@ class RabbitMQClient extends EventEmitter {
       // If missing, fail-fast. The owning infra service must recreate on startup.
       const queueChannel = await this._requireQueueChannel('checkQueue', queue);
       try {
-        await queueChannel.checkQueue(queue);
+        await this._askBroker(
+          { operation: 'checkQueue', target: queue, channel: queueChannel },
+          () => queueChannel.checkQueue(queue)
+        );
         this._logger.debug(`[RabbitMQClient] [mq-client-core] [CONSUMER] ✓ Infrastructure queue ${queue} exists (consumer will proceed)`);
       } catch (checkErr) {
         if (checkErr.code === AMQP_NOT_FOUND) {
@@ -4451,7 +5175,7 @@ class RabbitMQClient extends EventEmitter {
       // Set prefetch if provided (on consumer channel). ONE rail, shared with
       // `_reRegisterConsumers()` — prefetch belongs to the consumer, not to the
       // channel that happened to be open when it first attached.
-      await this._applyConsumerPrefetch(queue, prefetch);
+      await this._applyConsumerPrefetch(this._consumerChannel, queue, prefetch);
 
       // CRITICAL: Log before calling amqplib's consume()
       // amqplib's consume() may internally call assertQueue() without parameters if queue doesn't exist
@@ -4666,10 +5390,10 @@ class RabbitMQClient extends EventEmitter {
         }
       };
       
-      const consumeResult = await this._consumerChannel.consume(
-        queue,
-        messageHandler,
-        { noAck }
+      const consumerChannel = this._consumerChannel;
+      const consumeResult = await this._askBroker(
+        { operation: 'consume', target: queue, channel: consumerChannel },
+        () => consumerChannel.consume(queue, messageHandler, { noAck })
       );
       
       // Track consumer for auto re-registration if channel closes
@@ -4778,13 +5502,23 @@ class RabbitMQClient extends EventEmitter {
           this._logger.info(
             '[RabbitMQClient] Client was closed by its caller during recovery - closing the re-established connection'
           );
-          try {
-            await revived.close();
-          } catch (closeErr) {
+          // Within the one budget (d.1138, conf `mq-broker-answer-budget` 001): this close
+          // waits for a `close-ok` like every teardown close, and a broker that stopped
+          // answering right now would otherwise hold this round — and `_reconnecting` —
+          // open forever. Unanswered, the socket is dropped the way the teardown drops it.
+          const closing = await this._closeWithinTeardownBudget(
+            'connection re-established after disconnect',
+            revived,
+            this._brokerAnswerTimeout
+          );
+          if (closing.status === 'refused') {
             this._logger.warn(
-              `[RabbitMQClient] Error closing the connection re-established after disconnect: ${closeErr.message}`
+              `[RabbitMQClient] Error closing the connection re-established after disconnect: ${closing.error.message}`
             );
           }
+          if (closing.status === 'unanswered') {
+            this._dropUnansweredConnection(revived);
+          }
           this._connection = null;
           this._connectionAlive = false;
           this._reconnecting = false;
@@ -4831,7 +5565,10 @@ class RabbitMQClient extends EventEmitter {
         
         // Recreate consumer channel and re-register all consumers
         try {
-          this._consumerChannel = await this._connection.createChannel();
+          this._consumerChannel = await this._askBroker(
+            { operation: 'createChannel', target: 'consumer channel', channel: null },
+            () => this._connection.createChannel()
+          );
           this._consumerChannel._createdAt = new Date().toISOString();
           this._consumerChannel._closeReason = null;
           this._consumerChannel._lastOperation = 'Recreated via _reconnectWithBackoff()';
@@ -4882,7 +5619,7 @@ class RabbitMQClient extends EventEmitter {
         // Flush buffered messages po reconnectu
         let bufferFlushResult = { inMemory: 0, flushed: false };
         try {
-          const flushResult = await this._publishLayer.flushBuffered();
+          const flushResult = await this._publishLayer.flushBuffered('reconnected');
           bufferFlushResult = { inMemory: flushResult, flushed: true };
           this._publishMonitor.trackFlushed(bufferFlushResult.inMemory);
           this._logger.info(`[RabbitMQClient] ✓ Flushed ${bufferFlushResult.inMemory} buffered messages after reconnection`);
@@ -5033,7 +5770,19 @@ class RabbitMQClient extends EventEmitter {
       this.emit('error', err);
     });
     
-    channel.on('close', async () => {
+    // PREPENDED, not appended (d.1134). amqplib registers its own `close` listener in the
+    // channel's constructor — the one that answers every unconfirmed publish with the bare
+    // `new Error('channel closed')` (`lib/channel.js`, the `Channel` constructor) — and a
+    // constructor runs before anybody can attach anything, so an appended handler always
+    // ran SECOND. The publish callbacks then read a channel that was still alive, took the
+    // branch meant for a broker answer on a live channel, and the sentinel reached the
+    // classification untyped: permanent, not buffered, not retried — for a message the
+    // broker said nothing about (měřeno d.1126, `320 CONNECTION_FORCED` with a confirm in
+    // flight). `connection.toClosed()` closes every channel before the connection's own
+    // events (`lib/connection.js`), so this handler is the only one that can mark the
+    // channel dead in time. Prepending makes it run before amqplib's own listener — an
+    // order the emitter guarantees, with no timer and no race.
+    channel.prependListener('close', async () => {
       if (this._closedByCaller) {
         return;
       }
@@ -5216,7 +5965,10 @@ class RabbitMQClient extends EventEmitter {
           // catch polykal jako `warn`, takže konzumenti tiše přestali dostávat zprávy.
           // `_ensureConsumerChannel()` odpovídá `ConnectionError` s chybou amqplibu
           // v `cause` — jeden článek, vlastní příčina obalu (vzor obnovy frontového
-          // kanálu níž, d.696).
+          // kanálu níž, d.696). Od d.1278 i s chybou, kterou skončilo čekání na obnovu
+          // (standby bez `code`, nebo fatální s `MQ_CONNECTION_FATAL`): spojení tehdy
+          // neživé, takže `_connectionIsGoingAway()` odpoví `warn` — standby i fatal už
+          // ohlásily samy sebe na vlastním kanálu, druhé hlášení na `error` sem nepatří.
           if (this._connectionIsGoingAway(err.cause)) {
             this._logger.warn(`[RabbitMQClient] [mq-client-core] Failed to recreate consumer channel (connection may be closing): ${err.message}`);
           } else {
@@ -5645,6 +6397,12 @@ class RabbitMQClient extends EventEmitter {
     if (msg._mqProcessed) {
       return; // Already acked/nacked — idempotent
     }
+    // On a connection that is down and will not recover on its own (lost, `disconnect()`,
+    // `reconnectEnabled: false`) the delivery cannot be settled — the broker has requeued it
+    // already; the caller learns the state, the verdict included (d.1314, d.1319).
+    if (!this._connectionAlive && !this._recoveryMayStart()) {
+      throw this._refusalWithoutRecovery('[RabbitMQClient] Cannot ack', 'ack');
+    }
     if (!this._consumerChannel) {
       throw new ConnectionError(
         '[RabbitMQClient] Cannot ack: consumer channel is not initialized - Expected: an open consumer channel. '
@@ -5687,6 +6445,9 @@ class RabbitMQClient extends EventEmitter {
     if (msg._mqProcessed) {
       return; // Already acked/nacked — idempotent
     }
+    if (!this._connectionAlive && !this._recoveryMayStart()) {
+      throw this._refusalWithoutRecovery('[RabbitMQClient] Cannot nack', 'nack');
+    }
     if (!this._consumerChannel) {
       throw new ConnectionError(
         '[RabbitMQClient] Cannot nack: consumer channel is not initialized - Expected: an open consumer channel. '