@ultimat3/cli 27.6.1 → 27.8.0

package/src/runtime-cache.ts

@@ -8,9 +8,11 @@ import type { CacheTier, PurgeDriver } from '@ultimat3/cache';
 import {
   CacheDriverUnavailableError,
   cdnTier,
+  flushProcessTiers,
   isNoopPurgeDriver,
   lruTier,
   memoTier,
+  purgeEdgeAgain,
   receiveInvalidationBroadcast,
   redisTier,
   registerInvalidationBroadcast,
@@ -18,7 +20,13 @@ import {
   resetTiers,
 } from '@ultimat3/cache';
 import type { AppConfig, CacheTierName } from '@ultimat3/core';
-import { backoffDelay, defineConfig, logger, renderThrowable } from '@ultimat3/core';
+import {
+  backoffDelay,
+  defineConfig,
+  isOutageMilestone,
+  logger,
+  renderThrowable,
+} from '@ultimat3/core';
 import type { Transport, TransportSubscription } from '@ultimat3/realtime/server';
 import type { Env } from './runtime-bindings';
 
@@ -29,6 +37,19 @@ import type { Env } from './runtime-bindings';
  */
 export const CACHE_INVALIDATE_SUBJECT = 'x.cache.invalidate';
 
+/**
+ * "Drop everything you hold in process", on the same subject. An object, where a bust is an array
+ * of wire tags: a replica from before this marker existed parses it, finds no array and ignores
+ * it — its entries wait for their TTL, which is what a lost bust always cost it.
+ */
+export const CACHE_FLUSH_ALL = '{"flush":"all"}';
+
+/**
+ * How many refused wire tags a process keeps for the bus's return. A bound, not a queue: past it
+ * the set is dropped and ONE flush-all is owed instead, so memory does not grow with the outage.
+ */
+export const MAX_DEFERRED_TAGS = 1_024;
+
 export interface CacheTiersOptions {
   readonly env: Env;
   /** Already resolved by the boot — a `cdn` rung is built against a real edge or not at all. */
@@ -152,8 +173,92 @@ export function startCacheTiers(options: CacheTiersOptions): () => Promise<void>
   for (const tier of built) registerTier(tier);
   warnUnnamed(options);
 
+  const send = (payload: string): Promise<void> =>
+    options.transport.publish(CACHE_INVALIDATE_SUBJECT, payload);
+  // What the bus refused, kept for its return. A publish with no live connection is refused, not
+  // buffered (`NatsTransport`), so without this a bust made during a two-second NATS restart
+  // reached no peer at all. De-duplicated — a tag is a fact, not an event — and bounded.
+  const deferred = new Set<string>();
+  let flushOwed = false;
+  const defer = (wireTags: readonly string[]): void => {
+    if (flushOwed) return;
+    for (const wire of wireTags) deferred.add(wire);
+    if (deferred.size <= MAX_DEFERRED_TAGS) return;
+    deferred.clear();
+    flushOwed = true;
+  };
+  /**
+   * One pass over what is owed. It is TAKEN before the publish and put back if the bus refuses, so
+   * a bust refused while this publish is in flight is owed afresh rather than cleared by a success
+   * that never carried it — and a flush-all sent before that bust cannot stand in for it.
+   */
+  const settleOnce = async (): Promise<void> => {
+    if (flushOwed) {
+      flushOwed = false;
+      try {
+        await send(CACHE_FLUSH_ALL);
+      } catch (error) {
+        deferred.clear();
+        flushOwed = true;
+        throw error;
+      }
+      return;
+    }
+    if (deferred.size === 0) return;
+    const batch = [...deferred];
+    deferred.clear();
+    try {
+      await send(JSON.stringify(batch));
+    } catch (error) {
+      defer(batch);
+      throw error;
+    }
+    // The edge AGAIN, now that the peers are finally being told. It was purged when the bust ran,
+    // but every peer still held its copy then, and each request one of them answered since handed
+    // the edge the old page back — with no purge left to come. (Each peer purges after its own
+    // delete too; this is the sender's half, and does not depend on hearing its own publish.)
+    await purgeEdgeAgain(batch);
+  };
+  // ONE settle at a time. It is asked for by every reconnect and after every accepted publish,
+  // and two that overlapped both published the same batch (and the same flush-all). A call that
+  // arrives mid-run asks for one more pass instead, which finds whatever the run did not carry.
+  let settling: Promise<void> | undefined;
+  let again = false;
+  const settle = (): Promise<void> => {
+    if (settling !== undefined) {
+      again = true;
+      return settling;
+    }
+    settling = (async (): Promise<void> => {
+      try {
+        do {
+          again = false;
+          await settleOnce();
+        } while (again);
+      } finally {
+        again = false;
+        settling = undefined;
+      }
+    })();
+    return settling;
+  };
+  const settleQuietly = (): void => {
+    void settle().catch((error: unknown) => {
+      logger.warn('cache.broadcast.deferred-failed', { error: broadcastErrorText(error) });
+    });
+  };
+
   registerInvalidationBroadcast(async (wireTags) => {
-    await options.transport.publish(CACHE_INVALIDATE_SUBJECT, JSON.stringify(wireTags));
+    try {
+      await send(JSON.stringify(wireTags));
+    } catch (error) {
+      defer(wireTags);
+      // Still thrown: the report must say the peers have not been told YET.
+      throw error;
+    }
+    // The bus took this one, so it takes what an earlier publish could not — the case no
+    // reconnect announces, a refusal with the connection up.
+    if (flushOwed || deferred.size > 0) settleQuietly();
   });
   // Not awaited HERE: the boot must not block on a subscribe. The PROMISE is held rather than a
   // handle assigned inside a `.then`, because the release ran first whenever `stop()` beat the round
@@ -162,28 +267,60 @@ export function startCacheTiers(options: CacheTiersOptions): () => Promise<void>
   // logged once and never asked again, so the process missed every peer invalidation for its life.
   const released = Promise.withResolvers<undefined>();
   let stopped = false;
+  let subscribed = false;
+  /** Cuts the retry's wait short: the bus coming up is a better signal than a backoff. */
+  let wake: () => void = () => undefined;
   const retryMs = options.subscribeRetryMs ?? defaultSubscribeRetryMs;
+  // This process heard no peer for a window nobody measured — since boot, or since the connection
+  // dropped — so nothing it holds in its own heap is known fresh. One cold cache, never a stale one.
+  const flushDeaf = (source: string): void => {
+    void flushProcessTiers(source);
+  };
   const subscribing = (async (): Promise<TransportSubscription | undefined> => {
     for (let attempt = 1; !stopped; attempt += 1) {
       try {
-        return await options.transport.subscribe(CACHE_INVALIDATE_SUBJECT, (payload: string) => {
-          void applyBroadcast(payload);
-        });
+        const subscription = await options.transport.subscribe(
+          CACHE_INVALIDATE_SUBJECT,
+          (payload: string) => {
+            void applyBroadcast(payload);
+          },
+        );
+        subscribed = true;
+        if (attempt > 1) {
+          // The outage's one closing line, beside the thinned warnings it ends.
+          logger.info('cache.broadcast.subscribe-failed recovered', { after: attempt - 1 });
+          flushDeaf('cache.bus-subscribed');
+        }
+        return subscription;
       } catch (error) {
-        logger.warn('cache.broadcast.subscribe-failed', {
-          error: broadcastErrorText(error),
-          attempt,
-        });
-        await Promise.race([Bun.sleep(retryMs(attempt)), released.promise]);
+        // Attempts 1, 2, 4, 8, …: the dial's own thinning (`NatsTransport`), so an outage is not
+        // one line per retry per pod for as long as it lasts.
+        if (isOutageMilestone(attempt)) {
+          logger.warn('cache.broadcast.subscribe-failed', {
+            error: broadcastErrorText(error),
+            attempt,
+          });
+        }
+        const woken = Promise.withResolvers<undefined>();
+        wake = (): void => woken.resolve(undefined);
+        await Promise.race([Bun.sleep(retryMs(attempt)), released.promise, woken.promise]);
       }
     }
     return undefined;
   })();
+  // The bus is (back) up. The subscription came back with the connection, so from here this
+  // process hears again: drop what it held while deaf, and say what it could not say.
+  const offReconnect = options.transport.onReconnect(() => {
+    wake();
+    if (subscribed) flushDeaf('cache.bus-reconnect');
+    settleQuietly();
+  });
 
   // `resetTiers()` drops the registry AND the broadcast in one call: this boot is the only thing
   // that registers either, and a tier left behind would purge for a process that has stopped.
   return async () => {
     stopped = true;
+    offReconnect();
     released.resolve(undefined);
     (await subscribing)?.unsubscribe();
     resetTiers();
@@ -200,6 +337,13 @@ export function startCacheTiers(options: CacheTiersOptions): () => Promise<void>
  */
 export const broadcastErrorText = (error: unknown): string => renderThrowable(error);
 
+/** `CACHE_FLUSH_ALL`, parsed: a peer had more refused busts than it could keep. */
+const isFlushAll = (parsed: unknown): boolean =>
+  typeof parsed === 'object' &&
+  parsed !== null &&
+  !Array.isArray(parsed) &&
+  Reflect.get(parsed, 'flush') === 'all';
+
 /**
  * A peer's wire tags, applied here. Never throws: a malformed frame or an undeclared tag must not
  * kill the subscriber loop, because that would silently end cross-instance invalidation for the
@@ -208,6 +352,10 @@ export const broadcastErrorText = (error: unknown): string => renderThrowable(er
 async function applyBroadcast(payload: string): Promise<void> {
   try {
     const parsed: unknown = JSON.parse(payload);
+    if (isFlushAll(parsed)) {
+      await flushProcessTiers('cache.broadcast');
+      return;
+    }
     if (!Array.isArray(parsed)) return;
     const wire = parsed.filter((value): value is string => typeof value === 'string');
     if (wire.length > 0) await receiveInvalidationBroadcast(wire);

package/src/runtime-isr-outcome.ts

@@ -2,25 +2,66 @@
 // decided. A returned discriminated outcome, never a throw: the controller's regeneration treats
 // anything thrown as a failure and logs it, and a redirect is an ordinary answer, not a failure.
 
+import { logger } from '@ultimat3/core';
 import type { RedirectIntent, RequestContext, RouteParams } from '@ultimat3/http';
 import { asCtx, takeRedirect } from '@ultimat3/http';
 import type { RenderResult, RouteData, RouteEntry } from '@ultimat3/render';
-import { routeDataFor, routeStatusOf } from '@ultimat3/render';
+import { routeDataFor, routeNoStoreOf, routeStatusOf } from '@ultimat3/render';
 import type { IsrController, IsrEntry } from '@ultimat3/render/server';
-import { isrKey } from '@ultimat3/render/server';
+import { isrKey, isrRequestUrl, undeclaredQuery } from '@ultimat3/render/server';
 
 export type IsrOutcome =
   | { readonly kind: 'page'; readonly result: RenderResult }
   | { readonly kind: 'redirect'; readonly to: RedirectIntent };
 
+/** What `load` and `meta` are given; `url` is a string because that is what `ld.*` embeds. */
+type IsrData = { readonly url: string; readonly params: RouteParams } & Record<string, unknown>;
+
 export interface IsrRequest {
   readonly entry: RouteEntry;
-  /** What `load` and `meta` are given; `url` is a string because that is what `ld.*` embeds. */
-  readonly data: { readonly url: string; readonly params: RouteParams } & Record<string, unknown>;
+  /** The request as it arrived. `load`, `meta` and the page get `keyedData`'s narrowing of it. */
+  readonly data: IsrData;
   readonly ctx: RequestContext;
   readonly isr: IsrController;
-  /** The route's whole document for what `load` returned (`runtime-render.ts`'s `documentFrom`). */
-  readonly document: (loaded: RouteData) => Promise<string>;
+  /**
+   * The route's whole document for what `load` returned (`runtime-render.ts`'s `documentFrom`),
+   * rendered AT the data this file hands it — the narrowed URL, never the request's own.
+   */
+  readonly document: (loaded: RouteData, at: IsrData) => Promise<string>;
+}
+
+/** Route files already told, once, about a request whose query they never declared. */
+const toldUndeclared = new Set<string>();
+
+/** Names are the visitor's: a few, cut short, is all a log line needs to name the edit. */
+const NAMED_PARAMS = 5;
+const NAMED_PARAM_CHARS = 40;
+
+/**
+ * The request narrowed to what the route declared it varies on (`revalidate.query`). ONE narrowing
+ * feeds the store key, `load`, `meta` and the page, so a parameter outside the key cannot reach
+ * the document stored under it.
+ *
+ * A route that declared NOTHING still keys on the whole query, and is told so once, the first time
+ * a visitor uses that: every distinct query string is then a render and a stored page of its own.
+ */
+function keyedData(entry: RouteEntry, data: IsrData): IsrData {
+  const url = new URL(data.url);
+  const declared = entry.config.revalidate?.query ?? null;
+  if (declared === null && !toldUndeclared.has(entry.file)) {
+    const minted = undeclaredQuery(url, declared);
+    if (minted.length > 0) {
+      toldUndeclared.add(entry.file);
+      logger.warn('isr.query.undeclared', {
+        route: entry.file,
+        params: minted.slice(0, NAMED_PARAMS).map((name) => name.slice(0, NAMED_PARAM_CHARS)),
+        cause:
+          'the route declares no revalidate.query, so every distinct query string is rendered and stored as its own page',
+        fix: `revalidate: { query: [] }   // in ${entry.file}; or query: ['<name>'] for each parameter the page varies on`,
+      });
+    }
+  }
+  return { ...data, url: isrRequestUrl(url, declared).href };
 }
 
 /**
@@ -54,11 +95,12 @@ function dropPage(isr: IsrController, key: string): void {
  * the request's own (its `load` may have read a cookie), so a request that joined a run whose load
  * redirected decides for itself, exactly as the static single-flight in `appRoutes` does.
  */
-export async function isrOutcome(request: IsrRequest): Promise<IsrOutcome> {
+export async function isrOutcome(arrived: IsrRequest): Promise<IsrOutcome> {
+  const request: IsrRequest = { ...arrived, data: keyedData(arrived.entry, arrived.data) };
   const { entry, data, ctx, isr } = request;
-  // `isrKey(url, locale)`, never `url.pathname`: the query is part of what was rendered — `meta`
-  // reads `data.url` — so two URLs differing only in their query are two documents (#171). The
-  // locale is `ctx.locale`, the one the `locale` stage negotiated for THIS request.
+  // `isrKey(url, locale)`, never `url.pathname`: the DECLARED query is part of what was rendered —
+  // `meta` reads `data.url` — so two URLs differing in it are two documents (#171). The locale is
+  // `ctx.locale`, the one the `locale` stage negotiated for THIS request.
   const key = isrKey(new URL(data.url), asCtx(ctx).locale);
   let decided: RedirectIntent | undefined;
   // `{ html, status }`, never the bare string: the entry stores the status beside the HTML and
@@ -66,8 +108,13 @@ export async function isrOutcome(request: IsrRequest): Promise<IsrOutcome> {
   const served = await isr.serve(key, async () => {
     const loaded = await routeDataFor(entry.config, data);
     const to = takeRedirect(ctx);
-    if (to === undefined)
-      return { html: await request.document(loaded), status: routeStatusOf(loaded) };
+    if (to === undefined) {
+      return {
+        html: await request.document(loaded, data),
+        status: routeStatusOf(loaded),
+        noStore: routeNoStoreOf(loaded),
+      };
+    }
     // Set by THIS request's producer only. On a stale page it runs behind the answer, and when it
     // has already decided by the time `serve` returns, the redirect is still this request's own.
     decided = to;
@@ -88,7 +135,7 @@ async function ownOutcome(request: IsrRequest): Promise<IsrOutcome> {
   const loaded = await routeDataFor(request.entry.config, request.data);
   const to = takeRedirect(request.ctx);
   if (to !== undefined) return { kind: 'redirect', to };
-  const body = await request.document(loaded);
+  const body = await request.document(loaded, request.data);
   return {
     kind: 'page',
     result: {

package/src/runtime-isr.ts

@@ -2,6 +2,7 @@
 // and handed back with the detach the boot puts on its stop list. One function for `x dev` and the
 // container, so neither can build a controller `invalidateTags` never reaches (plan 101, s2-con #1).
 
+import { describePages, RouteModeInvalidError } from '@ultimat3/render';
 import type { IsrController, IsrStore } from '@ultimat3/render/server';
 import { isrController } from '@ultimat3/render/server';
 
@@ -18,10 +19,16 @@ export interface AttachedIsr {
 export function attachedIsr(options: {
   readonly buildId: string;
   readonly store?: IsrStore;
+  /** `isrController`'s own; a test turns the cooldown off rather than waiting one out. */
+  readonly failureCooldownMs?: number;
 }): AttachedIsr {
+  if (options.store !== undefined) assertPurgeSafe(options.store);
   const isr = isrController({
     buildId: options.buildId,
     ...(options.store === undefined ? {} : { store: options.store }),
+    ...(options.failureCooldownMs === undefined
+      ? {}
+      : { failureCooldownMs: options.failureCooldownMs }),
   });
   const detach = isr.attach();
   let released = false;
@@ -34,3 +41,19 @@ export function attachedIsr(options: {
     },
   };
 }
+
+/**
+ * A store the deployment supplied is one other processes may write. Under `onInvalidate: 'purge'`
+ * a replica that began a render before the purge, and has not heard of it yet, writes the purged
+ * page back unless the STORE refuses the write (`IsrStore.tagFence`) — its own fence only knows
+ * the busts it was told about. Refused here, by route, rather than left to happen in production.
+ */
+function assertPurgeSafe(store: IsrStore): void {
+  if (store.tagFence !== undefined) return;
+  const purging = describePages().find((route) => route.revalidateOnInvalidate === 'purge');
+  if (purging === undefined) return;
+  throw new RouteModeInvalidError(
+    `${purging.file} declares revalidate.onInvalidate: 'purge', and the runtime's isrStore has no tagFence — a replica whose render began before a purge would write the purged page back into it`,
+    'tagFence: { sample, bump, setIfCurrent }   // implement IsrTagFence on the isrStore in apps/web/runtime.ts (setIfCurrent atomic in the store), or drop isrStore to keep one memory store per replica',
+  );
+}

package/src/runtime-render.ts

@@ -45,6 +45,7 @@ import {
   streamResult,
 } from '@ultimat3/render/server';
 import type { DocumentOptions } from './document-options';
+import { routeQuery } from './isr-query-guard';
 import {
   type NavigationDocumentHead,
   navigationMetaOf,
@@ -193,7 +194,7 @@ export async function routeBody(
       data,
       params: ctx.params,
       url: ctx.url,
-      query: Object.fromEntries(url.searchParams) as Readonly<Record<string, string>>,
+      query: routeQuery(entry, url),
     },
     entry.file,
     { islands },
@@ -486,8 +487,8 @@ async function renderIsr(
   options: DevRenderOptions,
   isr: IsrController,
 ): Promise<Rendered> {
-  const document = (loaded: RouteData): Promise<string> =>
-    documentFrom(entry, data, loaded, options);
+  const document = (loaded: RouteData, at: DevRouteData): Promise<string> =>
+    documentFrom(entry, at, loaded, options);
   const outcome = await isrOutcome({ entry, data, ctx, isr, document });
   if (outcome.kind === 'redirect') return { respond: () => loadRedirect(entry, outcome.to) };
   return { respond: () => responseOf(outcome.result) };

package/src/runtime-services.ts

@@ -10,6 +10,7 @@ import { isNoopPurgeDriver, selectPurgeDriver } from '@ultimat3/cache';
 import {
   isLocal,
   type RealtimeConfig,
+  type Role,
   registerReadinessCheck,
   renderThrowable,
   resolveEnvironment,
@@ -26,14 +27,14 @@ import {
   resetMailDriver,
   setMailDriver,
 } from '@ultimat3/mail';
-import type { Transport, TransportSelection } from '@ultimat3/realtime/server';
-import { selectTransport, setChannelTransport } from '@ultimat3/realtime/server';
+import type { BusUse, Transport } from '@ultimat3/realtime/server';
 import type { Storage } from '@ultimat3/storage';
 import { defineStorage, localDriver, s3Driver, usesDevStorageSecret } from '@ultimat3/storage';
 import { loadAppConfig } from './app-config-load';
 import { LocalDiskUnsafeError, StorageUnwritableError } from './errors';
 import { msg } from './messages';
 import type { DevServices, Env } from './runtime-bindings';
+import { selectBus } from './runtime-bus';
 import { cacheTiersOf, startCacheTiers } from './runtime-cache';
 import { type WorkerConfig, workerConfigOf } from './runtime-jobs';
 import { selectAppMailDriver } from './runtime-mail';
@@ -74,6 +75,13 @@ export interface RunningServices {
   readonly mailDetail: string;
   /** Same rule as `mailDetail`: the env key that selected the bus, never the url behind it. */
   readonly transportDetail: string;
+  /**
+   * What this process does with the bus, which decided whether the boot waited for it
+   * (`runtime-bus.ts`). Optional for the reason `workerConfig` is: a hand-built runtime has none.
+   */
+  readonly busUse?: BusUse;
+  /** `x dev` booted without a bus its `sync` role needs: that role waits for it (`role-sync.ts`). */
+  readonly busTolerated?: boolean;
   /**
    * What the sync role must give `PresenceRegistry`. It travels with the transport because the KV
    * bucket's age limit was derived from it — a registry given a longer TTL than the bucket honours
@@ -278,14 +286,6 @@ function probedReadinessCheck(name: string, probe: () => Promise<unknown>): () =
   });
 }
 
-/** A transport that says whether it is connected. NATS does; the in-process bus has nothing to be. */
-interface ConnectableTransport {
-  readonly connected: boolean;
-}
-
-const saysConnected = (transport: Transport): transport is Transport & ConnectableTransport =>
-  typeof (transport as Partial<ConnectableTransport>).connected === 'boolean';
-
 /**
  * Release what has already started, newest first, and return every failure instead of throwing on
  * the first: a step that rejects must not skip the ones after it, or one transport that will not
@@ -324,6 +324,13 @@ export async function startServices(
   overrides?: RuntimeOverrides,
   /** `'verify'` for a serving role on an external database — `runtime-queue.ts`'s `SchemaMode`. */
   schema: SchemaMode = 'apply',
+  /**
+   * The roles this process will start, which decide whether the boot waits for the bus: only a
+   * `sync` node or a replicator does (`runtime-bus.ts`). Unset is the strictest reading.
+   */
+  roles?: readonly Role[],
+  /** `x dev`: a bus the realtime roles need is waited for in the background, never refused. */
+  dev = false,
 ): Promise<RunningServices> {
   // The app's config is loaded ONCE, here, first, and every section below is read out of that one
   // validated object — mail's `retainMime` is the first reader, so it is loaded before mail.
@@ -341,13 +348,13 @@ export async function startServices(
   // service starts, rather than quietly keeping the in-process bus. Which transport, which KV
   // bucket and which presence TTL is `@ultimat3/realtime`'s decision, and it is the same call a
   // `ROLE=sync` container makes, so this process cannot resolve the bus differently from the
-  // container it stands in for.
+  // container it stands in for. What the bus is USED for is the roles' (`runtime-bus.ts`).
   const realtime = realtimeConfigOf(config);
   // Fourth: `pwa.push` and its VAPID pair (`runtime-push.ts`). Resolving the pair reads env and
   // signs one probe — a deploy with no keys, or two halves of different pairs, refuses here.
   const push = await selectWebPush(config, env);
   const workerConfig = workerConfigOf(config, env);
-  const bus: TransportSelection = selectTransport(env, realtime);
+  const bus = selectBus({ env, realtime, roles, override: overrides?.transport, dev });
   // `env`, not the ambient one: this function is HANDED the boot's environment and every other
   // reader here already uses it, so a queue that asked `process.env` would decide the standby from
   // a different answer than the middleware that routes to it.
@@ -405,28 +412,14 @@ export async function startServices(
     // before `sync`, `worker` and `scheduler` start. The chart's `readinessProbe` and the container
     // healthcheck both route on it, so a replica whose pool was gone kept taking traffic.
     started.push(probedReadinessCheck('database', () => db.ping()));
-    // Dialled here rather than at selection: an unreachable bus must fail at `x dev`, not on the
-    // first change nobody receives, and the socket is a resource the unwind below has to release.
-    // A supplied transport is already connected and is NOT closed here: whoever built it owns its
-    // socket, which is why the override skips both halves rather than only the dial.
-    let transport = overrides?.transport;
-    if (transport === undefined) {
-      await bus.connect();
-      started.push(() => bus.transport.close());
-      transport = bus.transport;
-    }
-    // The bus an app's own code publishes a channel event on (`publishChannelEvent`), in EVERY
-    // role: the hub is the `sync` role's, so a job or an action reached none, and an events-only
-    // channel — the one kind that needs no replicator — could be fed by nothing but a socket.
-    started.push(setChannelTransport(transport));
-    // Only a transport that can be disconnected gets a check. `NatsTransport.connected` is a
-    // synchronous getter over the client's own state, so no probe is needed; the in-process bus
-    // has nothing to lose a connection to, and a check that can only answer `true` is a number in
-    // `registered` that means nothing.
-    if (saysConnected(transport)) {
-      const connectable = transport;
-      started.push(registerReadinessCheck('transport', () => connectable.connected));
-    }
+    // Dialled here rather than at selection: the socket is a resource the unwind below has to
+    // release. AWAITED only by a process that cannot work without the bus — a `sync` node, a
+    // replicator — where an unreachable one must fail the boot, not the first change nobody
+    // receives. Every other role dials in the background and boots regardless; the channel bus and
+    // the `transport` readiness check are installed either way (`runtime-bus.ts`).
+    const running = await bus.start();
+    started.push(() => running.stop());
+    const transport = running.transport;
     // Before `loadApp` for the auth limiters' reason: `pushSubscribe()` is declared when the app's
     // modules import, and reads this runtime per call.
     if (push !== undefined) started.push(await installAppWebPush(push, executor));
@@ -467,9 +460,9 @@ export async function startServices(
       // table: three readers of one executor, resolved once. `startWeb` is what an override
       // replaces it at.
       rateLimitStore,
-      // The env key that selected the bus — or the honest answer that no env key did, because a
-      // boot line reading `NATS_URL` over a transport the host handed in is a lie a script parses.
-      transportDetail: overrides?.transport === undefined ? bus.detail : 'runtime override',
+      transportDetail: running.detail,
+      busUse: bus.use,
+      busTolerated: bus.tolerant,
       presenceTtlMs: bus.presenceTtlMs,
       purge,
       purgeDetail: cdn.detail,