@onlineapps/mq-client-core 5.1.0 → 6.0.0

package/src/BaseClient.js

@@ -28,6 +28,7 @@ const {
   SerializationError,
   CONSUMER_QUEUE_MISSING,
   CONSUMER_DEAD_LETTER_ROUTE_MISSING,
+  carryVerdict,
 } = require('./utils/errorHandler');
 
 /**
@@ -110,6 +111,32 @@ const NOT_A_KEY_OF_THIS_CLIENT = Object.freeze({
       'The persistent buffer it fed is gone (see persistentBufferEnabled): it never wrote to '
       + 'Redis at all, so the client injected here was held and never used.',
   }),
+  /**
+   * Removed in d.1275 with the `health:shutdown` event they armed, on the owner's word
+   * (2026-10-06): "volbu i událost ZRUŠIT, žádný slib". After `criticalHealthShutdownDelay`
+   * of critical health the transport emitted `health:shutdown` and logged that it was
+   * "triggering shutdown" — but the library never ends the process (`_failFatally()` says
+   * why), and nothing in the repository listened: `@onlineapps/service-wrapper` dropped its
+   * listener on 2026-09-07, no infra service ever had one (measured 2026-10-06). The four
+   * questions of `change-discipline.md` § Removing are answered in CHANGELOG.md, in the release that removed them.
+   * Refused by name, not ignored: a caller writing `false` to silence the promise needs to
+   * hear that there is no promise left to silence.
+   */
+  criticalHealthShutdown: Object.freeze({
+    key: null,
+    what: 'a shutdown on sustained critical health',
+    consequence:
+      'The client reports critical health (health:critical, healthCriticalCallback) and decides '
+      + 'nothing about the process; the health:shutdown event this key armed reached no listener, '
+      + 'so it was removed. Ending the process is the lifecycle owner\'s decision (onFatal).',
+  }),
+  criticalHealthShutdownDelay: Object.freeze({
+    key: null,
+    what: 'the delay before a shutdown on sustained critical health',
+    consequence:
+      'It timed the health:shutdown event, which is gone (see criticalHealthShutdown): the client '
+      + 'reports critical health on every failing check and decides nothing about the process.',
+  }),
 });
 
 /**
@@ -370,6 +397,9 @@ class BaseClient {
    */
   async connect(options = {}) {
     if (this._connected) return;
+    // An explicit `connect()` builds a NEW transport below, so the verdict of the old one
+    // ends here — like `_closedByCaller` on the transport, it is undone by nothing else (d.1301).
+    this._fatalError = null;
 
     // `host` is the broker URL and carries the account password. It is redacted
     // on the way to the log — the only rail for that is utils/redactCredentials.
@@ -485,6 +515,30 @@ class BaseClient {
     }
   }
 
+  /**
+   * The one guard every operation on the broker runs first (d.1314; the predicate is
+   * d.1301's). It refuses only the two states where "connect()" is true advice — the client
+   * never connected, or the caller closed it with `disconnect()`. After `connection:fatal`
+   * it lets the call through to the transport, which knows that state and answers it with
+   * the verdict on top (`code: 'MQ_CONNECTION_FATAL'`, `reason`, the verdict as `cause`), so
+   * no second sentence about a lost connection is written here. Until d.1314 each of the
+   * eleven operations carried its own copy of this guard, nine of them still advising
+   * `connect()` after the verdict.
+   *
+   * @param {string} op - the public method asking, used in the sentence
+   * @param {string} [tail='.'] - what ends the Fix sentence
+   * @throws {ConnectionError}
+   * @private
+   */
+  _requireUsable(op, tail = '.') {
+    if (!this._transport || (!this._connected && !this._fatalError)) {
+      throw new ConnectionError(
+        `[BaseClient] Cannot ${op}: client is not connected - Expected: connect() to have completed. `
+          + `Fix: await client.connect() before ${op}()${tail}`
+      );
+    }
+  }
+
   /**
    * Publishes a message to the specified queue.
    * @param {string} queue - Target queue name.
@@ -504,12 +558,13 @@ class BaseClient {
    *   only when the buffer holds the message for the next reconnect.
    */
   async publish(queue, message, options = {}) {
-    if (!this._connected || !this._transport) {
-      throw new ConnectionError(
-        '[BaseClient] Cannot publish: client is not connected - Expected: connect() to have completed. '
-          + 'Fix: await client.connect() before publish().'
-      );
-    }
+    // A client whose connection was declared LOST is not "not connected": `connect()` is
+    // exactly what its lifecycle owner must not be told to do (d.1301). The transport still
+    // exists and answers that state itself — a `RecoveryEndedPublishError` with the verdict
+    // on top and `buffered: false` (`_ensurePublisherChannel()`, d.1300/d.1301) — so the call
+    // is let through to it; this guard keeps only the two states where the advice is true:
+    // never connected, and closed by `disconnect()`.
+    this._requireUsable('publish');
 
     let buffer;
     try {
@@ -566,6 +621,11 @@ class BaseClient {
       if (err && typeof err.sent === 'boolean') {
         failure.sent = err.sent;
       }
+      // The verdict of a lost connection, carried like `buffered` and `sent` (d.1300, the
+      // publish half of d.1297): a publish whose recovery ended fatally reaches the caller
+      // with `code: 'MQ_CONNECTION_FATAL'` and `reason` on the error it catches — where the
+      // lifecycle owner reads them — not two `cause` down.
+      carryVerdict(failure, err);
       throw failure;
     }
   }
@@ -616,12 +676,11 @@ class BaseClient {
    * @throws {ConsumeError} If consumer setup fails.
    */
   async consume(queue, messageHandler, options = {}) {
-    if (!this._connected || !this._transport) {
-      throw new ConnectionError(
-        '[BaseClient] Cannot consume: client is not connected - Expected: connect() to have completed. '
-          + 'Fix: await client.connect() before consume().'
-      );
-    }
+    // Same rule as `publish()` (d.1301): after `connection:fatal` the transport answers with
+    // the verdict on top (`_consumerChannelWithoutRecovery()`, d.1281/d.1297) and
+    // `_consumerRefusal()` lets it through unchanged; the "not connected" advice is kept
+    // for the two states where it is true.
+    this._requireUsable('consume');
 
     // Apply prefetch and noAck overrides if provided
     const { prefetch, noAck } = options;
@@ -899,12 +958,7 @@ class BaseClient {
    * @returns {Promise<Object>}
    */
   async assertQueue(queue, options = {}) {
-    if (!this._connected || !this._transport) {
-      throw new ConnectionError(
-        '[BaseClient] Cannot assertQueue: client is not connected - Expected: connect() to have completed. '
-          + 'Fix: await client.connect() before assertQueue().'
-      );
-    }
+    this._requireUsable('assertQueue');
     if (typeof this._transport.assertQueue !== 'function') {
       throw new Error(
         '[BaseClient] Transport does not support assertQueue(queue, options) - Expected: a transport implementing assertQueue. '
@@ -932,12 +986,7 @@ class BaseClient {
    * @throws {ValidationError} If the name or type cannot declare an exchange.
    */
   async assertExchange(exchange, type, options = {}) {
-    if (!this._connected || !this._transport) {
-      throw new ConnectionError(
-        '[BaseClient] Cannot assertExchange: client is not connected - Expected: connect() to have completed. '
-          + 'Fix: await client.connect() before assertExchange().'
-      );
-    }
+    this._requireUsable('assertExchange');
     return await this._transport.assertExchange(exchange, type, options);
   }
 
@@ -953,12 +1002,7 @@ class BaseClient {
    * @throws {ValidationError} If a name or the pattern cannot form a binding.
    */
   async bindQueue(queue, exchange, pattern) {
-    if (!this._connected || !this._transport) {
-      throw new ConnectionError(
-        '[BaseClient] Cannot bindQueue: client is not connected - Expected: connect() to have completed. '
-          + 'Fix: await client.connect() before bindQueue().'
-      );
-    }
+    this._requireUsable('bindQueue');
     return await this._transport.bindQueue(queue, exchange, pattern);
   }
 
@@ -975,12 +1019,7 @@ class BaseClient {
    * @throws {ValidationError} If this client holds no such consumer.
    */
   async cancelConsumer(consumerTagOrQueue) {
-    if (!this._connected || !this._transport) {
-      throw new ConnectionError(
-        '[BaseClient] Cannot cancelConsumer: client is not connected - Expected: connect() to have completed. '
-          + 'Fix: await client.connect() before cancelConsumer().'
-      );
-    }
+    this._requireUsable('cancelConsumer');
     return await this._transport.cancelConsumer(consumerTagOrQueue);
   }
 
@@ -990,12 +1029,7 @@ class BaseClient {
    * @returns {Promise<Object>}
    */
   async checkQueue(queue) {
-    if (!this._connected || !this._transport) {
-      throw new ConnectionError(
-        '[BaseClient] Cannot checkQueue: client is not connected - Expected: connect() to have completed. '
-          + 'Fix: await client.connect() before checkQueue().'
-      );
-    }
+    this._requireUsable('checkQueue');
     if (typeof this._transport.checkQueue !== 'function') {
       throw new Error(
         '[BaseClient] Transport does not support checkQueue(queue) - Expected: a transport implementing checkQueue. '
@@ -1011,12 +1045,7 @@ class BaseClient {
    * @returns {Promise<Object>}
    */
   async purgeQueue(queue) {
-    if (!this._connected || !this._transport) {
-      throw new ConnectionError(
-        '[BaseClient] Cannot purgeQueue: client is not connected - Expected: connect() to have completed. '
-          + 'Fix: await client.connect() before purgeQueue().'
-      );
-    }
+    this._requireUsable('purgeQueue');
     if (typeof this._transport.purgeQueue !== 'function') {
       throw new Error(
         '[BaseClient] Transport does not support purgeQueue(queue) - Expected: a transport implementing purgeQueue. '
@@ -1033,12 +1062,7 @@ class BaseClient {
    * @returns {Promise<Object>}
    */
   async deleteQueue(queue, options = {}) {
-    if (!this._connected || !this._transport) {
-      throw new ConnectionError(
-        '[BaseClient] Cannot deleteQueue: client is not connected - Expected: connect() to have completed. '
-          + 'Fix: await client.connect() before deleteQueue().'
-      );
-    }
+    this._requireUsable('deleteQueue');
     if (typeof this._transport.deleteQueue !== 'function') {
       throw new Error(
         '[BaseClient] Transport does not support deleteQueue(queue, options) - Expected: a transport implementing deleteQueue. '
@@ -1068,12 +1092,7 @@ class BaseClient {
    * @returns {Promise<void>}
    */
   async ack(msg) {
-    if (!this._connected || !this._transport) {
-      throw new ConnectionError(
-        '[BaseClient] Cannot ack: client is not connected - Expected: connect() to have completed. '
-          + 'Fix: await client.connect() before ack(); a message received before a reconnect can no longer be acked.'
-      );
-    }
+    this._requireUsable('ack', '; a message received before a reconnect can no longer be acked.');
     if (typeof this._transport.ack !== 'function') {
       throw new Error(
         '[BaseClient] Transport does not support ack(msg) - Expected: a transport implementing ack. '
@@ -1095,12 +1114,7 @@ class BaseClient {
    * @returns {Promise<void>}
    */
   async nack(msg, options = {}) {
-    if (!this._connected || !this._transport) {
-      throw new ConnectionError(
-        '[BaseClient] Cannot nack: client is not connected - Expected: connect() to have completed. '
-          + 'Fix: await client.connect() before nack(); a message received before a reconnect can no longer be nacked.'
-      );
-    }
+    this._requireUsable('nack', '; a message received before a reconnect can no longer be nacked.');
     if (typeof this._transport.nack !== 'function') {
       throw new Error(
         '[BaseClient] Transport does not support nack(msg, options) - Expected: a transport implementing nack. '

package/src/buffer/InMemoryBuffer.js

@@ -43,6 +43,10 @@ class InMemoryBuffer {
    * @param {number} options.maxSize - Max messages held; 0 means hold none
    * @param {number} options.ttlMs - How long one message may wait, in ms
    * @param {Object} options.logger - Logger s info/warn/error/debug (povinný)
+   * @param {{setTimeout: Function, clearTimeout: Function}} options.timers - The clock the
+   *   expiry runs on (required, d.1275): `setTimeout(callback, ms)` returns a handle,
+   *   `clearTimeout(handle)` disarms it. The transport hands its own timer rail
+   *   (`_setTimeout()` / `_clearTimeout()`), so `disconnect()` ends this timer too.
    */
   constructor(options = {}) {
     // The logger first, so a caller who forgot it gets the contract message
@@ -71,8 +75,21 @@ class InMemoryBuffer {
           + 'or pass ttlMs explicitly.'
       );
     }
+    if (!options.timers || typeof options.timers.setTimeout !== 'function'
+      || typeof options.timers.clearTimeout !== 'function') {
+      throw new Error(
+        '[InMemoryBuffer] Missing required option - timers is required and has no default here. '
+          + 'Expected: { setTimeout(callback, ms), clearTimeout(handle) } — the clock a held message '
+          + 'expires on at its TTL, rather than whenever the buffer is next touched. '
+          + 'Fix: build this buffer through PublishLayer, which hands it the transport\'s timer rail, '
+          + 'or pass options.timers explicitly.'
+      );
+    }
     this._maxSize = options.maxSize;
     this._ttlMs = options.ttlMs;
+    this._timers = options.timers;
+    /** The one armed expiry timer, aimed at the oldest entry's deadline; null while empty. */
+    this._expiryTimer = null;
 
     /** @type {Array<{queue:string, buffer:Buffer, options:Object, createdAt:number, priority:string, sent:boolean}>} */
     this._items = [];
@@ -112,6 +129,7 @@ class InMemoryBuffer {
       priority,
       sent,
     });
+    this._armExpiry(now);
   }
 
   /**
@@ -143,6 +161,8 @@ class InMemoryBuffer {
     // Zkopírujeme a vyprázdníme interní pole, abychom se vyhnuli reentrancy problémům
     let items = this._items.slice();
     this._items = [];
+    // Nothing is held while the flush runs; a replay that fails re-arms through `add()`.
+    this._armExpiry(now);
 
     if (sentEntries === 'drop') {
       for (const item of items.filter((entry) => entry.sent)) {
@@ -194,6 +214,44 @@ class InMemoryBuffer {
     return this._items.length;
   }
 
+  /**
+   * Aim the one expiry timer at the oldest entry's deadline — or disarm it when nothing is held.
+   *
+   * WHY A TIMER (d.1275, INFRA 531). Until d.1275 expiry ran only inside `add()`, `flush()` and
+   * `size()`. The buffer is emptied by a reconnect or by `unblocked`; an outage of a CHANNEL
+   * alone ends with neither, so an entry outlived its TTL until some unrelated publish touched
+   * the buffer — measured on the dev scheduler at 584 843 ms and 5 267 969 ms against a TTL of
+   * 300 000, and the ERROR line saying the message was lost came that late. The deadline is
+   * the TTL; the line now comes at the deadline.
+   *
+   * One timer, re-aimed on every change, rather than one per entry: entries are FIFO by
+   * `createdAt`, so the oldest one's deadline is the next one that matters. Re-aiming always
+   * clears the previous handle first, so a handle the transport's teardown already swept
+   * (`_clearAllTimers()`) is never trusted to still be armed.
+   *
+   * @param {number} now - the clock reading the caller took
+   * @private
+   */
+  _armExpiry(now) {
+    if (this._expiryTimer !== null) {
+      this._timers.clearTimeout(this._expiryTimer);
+      this._expiryTimer = null;
+    }
+    if (this._items.length === 0) {
+      return;
+    }
+    const oldest = this._items.reduce((min, item) => Math.min(min, item.createdAt), Infinity);
+    // `_cleanupExpired()` drops an entry once its age is MORE than the TTL, so the timer
+    // fires one millisecond past the deadline.
+    const delay = Math.max(0, oldest + this._ttlMs + 1 - now);
+    this._expiryTimer = this._timers.setTimeout(() => {
+      this._expiryTimer = null;
+      const firedAt = Date.now();
+      this._cleanupExpired(firedAt);
+      this._armExpiry(firedAt);
+    }, delay);
+  }
+
   /**
    * Drop the entries older than the TTL — and say, as an ERROR, what was dropped (d.1145, conf
    * `mq-publish-buffer` 001).
@@ -224,13 +282,18 @@ class InMemoryBuffer {
       groups.set(key, group);
     }
     for (const { target, sent, count, oldestMs } of groups.values()) {
+      // `LOST after <ms>` is the phrase an operator greps for, and only a never-sent message
+      // carries it: a sent one may have been delivered by the broker (conf `mq-publish-buffer`
+      // 001 — the two are never folded into one sentence).
       this._logger.error(
-        `[InMemoryBuffer] ${count} buffered message(s) for ${target} expired after the buffer TTL `
-          + `(${this._ttlMs} ms; oldest ${oldestMs} ms), sent=${sent} - `
+        `[InMemoryBuffer] ${count} buffered message(s) for ${target} `
+          + (sent ? `expired after ${oldestMs} ms` : `LOST after ${oldestMs} ms`)
+          + ` (buffer TTL ${this._ttlMs} ms; oldest ${oldestMs} ms), sent=${sent} - `
           + (sent
             ? 'the frame had been sent, so the broker may have delivered it on its own; nothing re-sends it now. '
             : 'the frame never left this client, so the message is LOST; nothing re-sends it now. ')
-          + 'Expected: a reconnect, or the broker unblocking the connection, within publishBufferTtlMs. '
+          + 'Expected: a reconnect, or the broker unblocking the connection, within publishBufferTtlMs '
+          + '(a recovered publisher channel alone replays nothing). '
           + 'Fix: find why the broker stayed away that long (an alarm: management API /api/health/checks/alarms; '
           + 'an outage: the connection log); a message that must survive longer belongs to a caller that keeps '
           + 'it durably and publishes with bufferOnFailure: false.'

package/src/buffer/MessageBuffer.js

@@ -22,6 +22,8 @@ class MessageBuffer {
    * @param {Object} options
    * @param {Object} [options.inMemory] - In-memory buffer options
    * @param {Object} options.logger - Logger s info/warn/error/debug (povinny)
+   * @param {{setTimeout: Function, clearTimeout: Function}} options.timers - The expiry clock,
+   *   passed through unread: `InMemoryBuffer` owns the rule that it is required (d.1275).
    */
   constructor(options = {}) {
     this._logger = assertLogger(
@@ -35,6 +37,7 @@ class MessageBuffer {
       maxSize: options.inMemory?.maxSize,
       ttlMs: options.inMemory?.ttlMs,
       logger: this._logger,
+      timers: options.timers,
     });
 
   }

package/src/config/configSchema.js

@@ -395,19 +395,9 @@ module.exports = {
     healthCriticalCallback: callbackOrNull(
       'Async function (health) => void, or null. Called when a health result is critical.'
     ),
-    criticalHealthShutdown: {
-      type: 'boolean',
-      description:
-        'Whether a sustained critical health result makes the transport emit `health:shutdown`. '
-        + 'Anything other than `false` means enabled. It only arms the event; ending the '
-        + 'process remains the owner\'s decision.',
-    },
-    criticalHealthShutdownDelay: {
-      type: 'integer',
-      minimum: 0,
-      description:
-        'How long health must stay critical before that event is emitted, in milliseconds.',
-    },
+    // NO `criticalHealthShutdown` / `criticalHealthShutdownDelay` since d.1275: the
+    // `health:shutdown` event they armed reached no listener. `BaseClient` refuses both
+    // by name before this schema is applied (`NOT_A_KEY_OF_THIS_CLIENT`).
 
     // ---------------------------------------------------------------------
     // `queueCreationFilter` and `queueCreationCallback` stood here until d.419,

package/src/config/defaultConfig.js

@@ -191,11 +191,9 @@ module.exports = {
   healthReportCallback: null,
   healthCriticalCallback: null,
 
-  // Does critical health end this client, and how long it stays critical first
-  // (ms)? The library only reports; the shutdown it asks for is the owner's
-  // `onFatal` path.
-  criticalHealthShutdown: true,
-  criticalHealthShutdownDelay: 60000,
+  // NO `criticalHealthShutdown` / `criticalHealthShutdownDelay` (removed in d.1275,
+  // refused by name in `BaseClient`): they armed a `health:shutdown` event no one
+  // listened to. Critical health is reported; the process is the owner's.
 
   // `recoveryScope` stood here until d.514, with the two callbacks it filtered
   // (`queueCreationFilter`, `queueCreationCallback`, d.419) one batch ahead of

package/src/config/queueConfig.js

@@ -93,6 +93,28 @@ const INFRASTRUCTURE_PREFIX_LOOKUPS = Object.freeze({
 
 const INFRASTRUCTURE_PREFIXES = Object.freeze(Object.keys(INFRASTRUCTURE_PREFIX_LOOKUPS));
 
+/**
+ * The OBSERVERS' COPIES of a run (d.1336): the queues `monitoring.workflow.fanout` copies a
+ * run's lifecycle events into for a reader that watches the run and is not part of it — the
+ * monitoring consumer's intake, the delivery endpoint's WS feed, the scheduler's end-of-run
+ * watch. A copy whose reader is away dies on its TTL and dead-letters while the run goes on,
+ * so a `message_dlq` from one of them is a lost copy of the run's telemetry, not a lost run;
+ * the monitoring consumer and the scheduler both decide on that (INFRA 559).
+ *
+ * DECLARED, NOT DERIVED — measured on this file: membership cannot be read off an entry. The
+ * binding to the fanout is each consumer's own act at boot (`bindQueueToFanout()`), written on
+ * the entries only as a comment; TTL plus a dead-letter route is what every family here
+ * carries. So the list is written ONCE, here, as `[section, key]` pairs, and every name is
+ * composed by `queueName()` — which refuses an entry this file does not declare, so a release
+ * that dropped one stops the importer instead of shortening the list. A new observer of a run
+ * joins by one line here, beside its declaration below.
+ */
+const WORKFLOW_OBSERVER_COPIES = Object.freeze([
+  ['monitoring', 'workflow'],
+  ['deliveryEvents', 'workflow.events'],
+  ['scheduler', 'workflow.events']
+]);
+
 /** Every section declaring names under one prefix — derived, never a second list. */
 const sectionsForPrefix = (prefix) =>
   Object.keys(SECTION_PREFIXES).filter((section) => SECTION_PREFIXES[section] === prefix);
@@ -725,7 +747,8 @@ module.exports = {
 
     /**
      * monitoring.workflow.fanout - Fanout exchange for workflow events
-     * Publishers send to this exchange; monitoring.workflow + delivery.workflow.events both receive copies.
+     * Publishers send to this exchange; the queues bound to it — the observers' copies of a
+     * run — are listed once, in `WORKFLOW_OBSERVER_COPIES` at the top of this file.
      */
     'workflow.fanout': {
       type: 'exchange',
@@ -1302,6 +1325,17 @@ module.exports = {
     return INFRASTRUCTURE_PREFIXES;
   },
 
+  /**
+   * The names of the observers' copies of a run — `WORKFLOW_OBSERVER_COPIES` above, each
+   * composed by `queueName()`. Published as `topology.workflowObserverCopyQueues`; this is
+   * the one place the list is read from its declaration (d.1336).
+   * @returns {ReadonlyArray<string>} Frozen queue names, in declaration order.
+   * @throws {ValidationError} when a listed entry is not declared in this file.
+   */
+  workflowObserverCopyQueues() {
+    return Object.freeze(WORKFLOW_OBSERVER_COPIES.map(([section, key]) => this.queueName(section, key)));
+  },
+
   /**
    * Check if queue name is an infrastructure queue.
    *

package/src/index.js

@@ -23,6 +23,7 @@ const {
 } = require('./utils/errorHandler');
 const {
   TransientPublishError,
+  RecoveryEndedPublishError,
   PermanentPublishError,
   QueueNotFoundError,
   classifyPublishError,
@@ -87,6 +88,7 @@ module.exports.errorCodes = Object.freeze({
 });
 module.exports.publishErrors = {
   TransientPublishError,
+  RecoveryEndedPublishError,
   PermanentPublishError,
   QueueNotFoundError,
   classifyPublishError,
@@ -139,6 +141,26 @@ module.exports.queueConfig = queueConfig;
  * gone. Frozen, because an importer must not be able to rewrite platform topology.
  */
 module.exports.topology = Object.freeze({
+  /**
+   * The queue every infrastructure service publishes its health checks to and the
+   * registry drains (`docs/standards/queue-ownership.md` § Infrastructure Queue Creation
+   * Order). Declared in `queueConfig` all along; composed here since d.1307, because the
+   * name was carried as a literal one floor up — `@onlineapps/service-common`
+   * `src/defaults.js` `infrastructureHealthQueueName`, which the registry, the health
+   * publisher and the wrapper read and call "the one owner" — so the platform had two
+   * declaring owners of one wire name (finding d.1306). Which side cites this export is
+   * the owner's decision (d.1306 A/B); the export is the step both ways share.
+   */
+  infrastructureHealthChecksQueue: queueConfig.queueName('infrastructure', 'health.checks'),
+  /**
+   * The observers' copies of a run (d.1336, INFRA 559): the queues bound to
+   * `monitoring.workflow.fanout` for a reader that watches the run and is not part of it.
+   * A dead letter from one of them is a lost copy, not a lost run — the monitoring consumer
+   * (`observer_copy`) and the scheduler both decide on that and selected the queues by hand,
+   * twice. Declared once in `queueConfig` (`WORKFLOW_OBSERVER_COPIES`), names composed by
+   * `queueName()`; a frozen array.
+   */
+  workflowObserverCopyQueues: queueConfig.workflowObserverCopyQueues(),
   /** Fanout exchange: registry publishes infrastructure health events here. */
   infrastructureHealthEventsExchange: queueConfig.queueName('infrastructure', 'health.events'),
   /** The monitoring consumer's queue bound to that exchange. */