@ultimat3/realtime 27.7.0 → 27.8.1

package/README.md

@@ -128,11 +128,11 @@ leaves `joining` on the node's first answer; nothing waits for app traffic.
 
 | State | Entered when | Left when |
 |---|---|---|
-| `joining` | the subscribe is sent (on hold, and again on every reconnect) | the node's answer: a `records` channel's `replay-gap` (a fresh seat) or the `records` frame at a current cursor; an `events` channel's roster — sent on every seat, an empty one from a node with no presence (24.0.0) |
+| `joining` | the subscribe is sent (on hold, and again on every reconnect); or the node refused it with `X_TRANSPORT_UNAVAILABLE` — its bus is away, which is its condition and not its verdict. The heartbeat re-asks every interval | the node's answer: a `records` channel's `replay-gap` (a fresh seat) or the `records` frame at a current cursor; an `events` channel's roster — sent on every seat, an empty one from a node with no presence (24.0.0) |
 | `catching-up` | a `replay-gap`, or a frame in a new epoch: the `catchUp` query is re-read, frames held behind it | the read lands → `live` (the held frames applied in order) |
 | `live` | as above | the socket drops → `offline`; a gap → `catching-up` |
 | `offline` | the page socket closed | it reopens → `joining` |
-| `failed` | the node refused the subscribe (`error()` is the coded refusal), or a catch-up read failed (retried on the client's curve, and on the next open) | a successful retry → `live` |
+| `failed` | the node **decided** against the subscribe — a policy denial, an undeclared channel, a cap (`error()` is the coded refusal; terminal until the socket reopens) — or a catch-up read failed (retried on the client's curve, and on the next open) | a successful retry → `live` |
 
 A channel declared with **neither** `records` nor `events` carries nothing, so nothing answers its
 join and it reads `joining` for as long as it is held.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/realtime",
-  "version": "27.7.0",
+  "version": "27.8.1",
   "description": "Three-tier realtime: channels, live queries, local-first sync — one protocol, one mutator shape",
   "license": "MIT",
   "type": "module",
@@ -40,10 +40,10 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/core": "27.7.0",
-    "@ultimat3/entity": "27.7.0",
-    "@ultimat3/policy": "27.7.0",
-    "@ultimat3/query": "27.7.0",
+    "@ultimat3/core": "27.8.1",
+    "@ultimat3/entity": "27.8.1",
+    "@ultimat3/policy": "27.8.1",
+    "@ultimat3/query": "27.8.1",
     "nats": "2.29.3"
   }
 }

package/src/client-channels.ts

@@ -174,10 +174,21 @@ export class ChannelBook {
     }
   }
 
-  /** The sid a channel is subscribed under — what a refusal `ack` names. */
+  /**
+   * A refusal `ack` naming the sid a channel is subscribed under. `false` when no membership
+   * here answers to it.
+   */
   refused(sid: string, error: unknown): boolean {
     const entry = [...this.#byTopic.values()].find((candidate) => sidOf(candidate) === sid);
     if (entry === undefined) return false;
+    if (isTransientRefusal(error)) {
+      // Not a decision: the node's bus is away, so nothing reaches this seat (or there is none
+      // yet). `joining` — asked, unanswered — and never `failed`: the beat re-asks every interval
+      // and the node's first answer (a roster, a `records` frame, a `replay-gap`) ends it. A read
+      // in flight and a terminal refusal keep their own state.
+      if (entry.state === 'live') this.#set(entry, 'joining');
+      return true;
+    }
     entry.error = error;
     this.#set(entry, 'failed');
     return true;
@@ -361,6 +372,17 @@ export class ChannelBook {
   }
 }
 
+/**
+ * The one refusal that is the NODE's condition and not its verdict: its bus is away
+ * (`X_TRANSPORT_UNAVAILABLE`). Everything else an `ack` carries — a policy denial, an unknown
+ * channel, a cap — is a decision and terminal. Read off `unknown`: a refusal is the node's data.
+ */
+export function isTransientRefusal(error: unknown): boolean {
+  return (
+    (error as { readonly code?: unknown } | null | undefined)?.code === 'X_TRANSPORT_UNAVAILABLE'
+  );
+}
+
 /** A channel membership's sid is its topic behind this — what the socket engine routes on too. */
 export const CHANNEL_SID_PREFIX = 'channel:';
 

package/src/detach.ts

@@ -15,13 +15,16 @@ import { logger, renderThrowable, reportError } from '@ultimat3/core';
  * with nothing above it to answer. `channel.ts` already imports it for the same reason.
  */
 export function detach(work: Promise<unknown>, operation: string, at?: string): void {
-  void work.catch((error: unknown) => {
-    logger.error(`${operation} failed`, {
-      ...(at === undefined ? {} : { at }),
-      error: renderThrowable(error),
-    });
-    // Nobody is awaiting this, so the log is the only trace it leaves — and a log is not a signal
-    // anyone is paged on. The bus is this node's dependency, never the client's.
-    reportError(error, { source: 'realtime', scope: { operation } });
+  void work.catch((error: unknown) => reportDetached(error, operation, at));
+}
+
+/** What `detach` says of a failure — also `sync-bus-outage.ts`'s answer to one that is no outage. */
+export function reportDetached(error: unknown, operation: string, at?: string): void {
+  logger.error(`${operation} failed`, {
+    ...(at === undefined ? {} : { at }),
+    error: renderThrowable(error),
   });
+  // Nobody is awaiting this, so the log is the only trace it leaves — and a log is not a signal
+  // anyone is paged on. The bus is this node's dependency, never the client's.
+  reportError(error, { source: 'realtime', scope: { operation } });
 }

package/src/nats-lib-client.ts

@@ -118,6 +118,7 @@ class LibNatsClient implements NatsClient {
     payload: Uint8Array,
     options: NatsRequestOptions = {},
   ): Promise<NatsMessage> {
+    this.#assertLive(subject);
     const built = headersOf(options.headers);
     try {
       const reply = await this.#connection.request(subject, payload, {
@@ -140,6 +141,7 @@ class LibNatsClient implements NatsClient {
     payload: Uint8Array,
     options: NatsRequestManyOptions,
   ): Promise<readonly NatsMessage[]> {
+    this.#assertLive(subject);
     const collected: NatsMessage[] = [];
     try {
       const replies = await this.#connection.requestMany(subject, payload, {
@@ -162,6 +164,21 @@ class LibNatsClient implements NatsClient {
     await this.#connection.close();
   }
 
+  /**
+   * A request has an answer to wait for, so one made with no live connection is refused HERE.
+   * The library takes it instead — buffered with its publishes, sent if the reconnect lands and
+   * timed out if it does not — so every presence write on a `sync` node whose bus was away held
+   * its socket's frame lane for the whole request timeout before saying what was already known.
+   * The fake has always refused it (`nats-fake.ts`, `#assertLive`); this is the client agreeing.
+   */
+  #assertLive(subject: string): void {
+    if (this.connected) return;
+    throw unavailable(
+      this.#target,
+      `${subject} was not asked: the client is reconnecting to the bus`,
+    );
+  }
+
   /**
    * The library's own status stream is the only place a drop or a recovery is announced. Nothing
    * awaits it, so it can neither throw nor end the process: a drop reports and flips `connected`,

package/src/nats-reports.ts

@@ -0,0 +1,80 @@
+// Single responsibility: where a `NatsTransport`'s background failures go, and how often. A FAULT
+// (a subscriber that threw, a re-subscribe the server refused) is said every time. An OUTAGE (a
+// drop, a refused dial, a client the library gave up on) is one fact however long it lasts: said
+// on its 1st, 2nd, 4th, 8th, … failure and once more when the bus answers again.
+
+import { isOutageMilestone, isUltimateError, logger, renderThrowable } from '@ultimat3/core';
+
+export interface NatsReportsOptions {
+  readonly transport: string;
+  /** The app's own sink. Absent, or throwing, the logger line is written instead. */
+  readonly onError: ((error: unknown, subject: string) => void) | undefined;
+  /**
+   * `'error'` for a process that cannot do its job without the bus (a `sync` node, a replicator);
+   * `'warn'` for one that only publishes — degraded, and still serving.
+   */
+  readonly outageLevel: 'warn' | 'error';
+}
+
+export class NatsReports {
+  readonly #options: NatsReportsOptions;
+  /** Failures of the bus itself since it last answered. */
+  #failures = 0;
+
+  constructor(options: NatsReportsOptions) {
+    this.#options = options;
+  }
+
+  /**
+   * Every background failure lands here or in `outage`. Dropping it when the caller passed no
+   * handler is what turns "no changes arrive" into a debugging session with nothing to read, so
+   * the default emits rather than swallows.
+   */
+  fault(error: unknown, subject: string): void {
+    this.#say(error, subject, 'error');
+  }
+
+  /**
+   * One more failure of the bus itself, thinned and at the level its owner chose. `always` is for
+   * a TRANSITION rather than a retry — the library giving up on a client happens once per client,
+   * and it is the line that says the transport's own re-dial took over.
+   */
+  outage(error: unknown, always = false): void {
+    this.#failures += 1;
+    if (!always && !isOutageMilestone(this.#failures)) return;
+    this.#say(error, this.#options.transport, this.#options.outageLevel, this.#failures);
+  }
+
+  /** The bus answers again: one line saying after how many failures, and the count starts over. */
+  recovered(): void {
+    const after = this.#failures;
+    if (after === 0) return;
+    this.#failures = 0;
+    logger.info('nats transport recovered', { transport: this.#options.transport, after });
+  }
+
+  #say(error: unknown, subject: string, level: 'warn' | 'error', failures?: number): void {
+    const handler = this.#options.onError;
+    if (handler !== undefined) {
+      // Total: the handler is injected, and its throw would land in whatever called this — the
+      // dial loop (started with `void`: an unhandled rejection and no more retries), the
+      // library's status loop, a subscriber's delivery. A reporter that cannot report is not a
+      // reason to stop dialling; the fault falls through to the logger line below.
+      try {
+        handler(error, subject);
+        return;
+      } catch (thrown) {
+        logger.error('nats transport onError threw', { error: renderThrowable(thrown) });
+      }
+    }
+    logger[level]('nats transport error', {
+      transport: this.#options.transport,
+      subject,
+      ...(failures === undefined ? {} : { failures }),
+      code: isUltimateError(error) ? error.code : undefined,
+      // `renderThrowable`, never `String(error)`: this is a reporter, and a throwable that fights
+      // being read makes the report the thing that throws.
+      error: renderThrowable(error),
+    });
+  }
+}

package/src/nats-transport.ts

@@ -13,7 +13,6 @@ import {
   type Clock,
   finiteOption,
   isUltimateError,
-  logger,
   renderThrowable,
   systemClock,
 } from '@ultimat3/core';
@@ -25,6 +24,7 @@ import { DIAL_TIMEOUT_MS, landWithin, type NatsConnectWait } from './nats-dial-w
 import { ensureKvBucket } from './nats-jetstream';
 import { NatsKvSet } from './nats-kv';
 import { openNatsClient } from './nats-open';
+import { NatsReports } from './nats-reports';
 import { NatsSubscriptions } from './nats-subscriptions';
 import { type BackoffPolicy, defaultBackoff, policyDelay, type Rng } from './thundering-herd';
 
@@ -53,6 +53,12 @@ export interface NatsTransportOptions {
   readonly presenceBucket?: 'dial' | 'first-use';
   /** One dial's connect timeout. Default `DIAL_TIMEOUT_MS`. */
   readonly dialTimeoutMs?: number;
+  /**
+   * The level an OUTAGE is logged at. `'error'` (the default) is a process that cannot do its job
+   * without the bus — a `sync` node, a replicator. `'warn'` is one that only publishes: degraded,
+   * and still serving. A subscriber that throws is an `error` under either.
+   */
+  readonly outageLevel?: 'warn' | 'error';
 }
 
 const DEFAULT_ATTEMPTS = 10;
@@ -83,6 +89,8 @@ export class NatsTransport implements Transport {
   /** The last background dial's own refusal, for the cause of a `connect({ withinMs })` that gave up. */
   #lastFailure: string | undefined;
   #wakeRedial: (() => void) | undefined;
+  /** Where background failures go: a fault every time, an outage thinned (`nats-reports.ts`). */
+  readonly #reports: NatsReports;
   readonly #subscriptions = new NatsSubscriptions();
   readonly #reconnectListeners = new Set<() => void>();
 
@@ -91,6 +99,11 @@ export class NatsTransport implements Transport {
     // a container that reports itself healthy on one is a container nothing will ever page about.
     parseNatsUrl(options.url);
     this.#options = options;
+    this.#reports = new NatsReports({
+      transport: this.name,
+      onError: options.onError,
+      outageLevel: options.outageLevel ?? 'error',
+    });
     this.#connect = options.connect ?? openNatsClient;
     this.#backoff = options.backoff ?? defaultBackoff;
     this.#attempts = finiteOption(
@@ -186,7 +199,7 @@ export class NatsTransport implements Transport {
         try {
           handler(decoder.decode(message.payload), message.subject);
         } catch (error) {
-          this.#report(error, message.subject);
+          this.#reports.fault(error, message.subject);
         }
       },
       (call) => this.#translating(`subscribe to ${subject}`, call),
@@ -271,7 +284,7 @@ export class NatsTransport implements Transport {
       // The library retries; the spread is ours, so a cluster restart does not bring every node
       // back on the same millisecond.
       reconnectDelay: () => policyDelay(this.#backoff, ++this.#retries, this.#rng),
-      onError: (error) => this.#report(error, this.name),
+      onError: (error) => this.#reports.outage(error),
       onReconnect: () => this.#recovered(),
       onClosed: () => {
         if (opened === undefined) closedEarly = true;
@@ -324,12 +337,12 @@ export class NatsTransport implements Transport {
     if (this.#closed || this.#client !== client) return;
     this.#client = undefined;
     this.#subscriptions.orphan();
-    this.#report(
+    this.#reports.outage(
       new TransportUnavailableError({
         transport: this.name,
         reason: 'the connection closed once its reconnect budget was spent; re-dialling',
       }),
-      this.name,
+      true,
     );
     void this.#redial();
   }
@@ -353,9 +366,10 @@ export class NatsTransport implements Transport {
         try {
           const client = await this.#dialOnce();
           this.#lastFailure = undefined;
+          this.#reports.recovered();
           // Coded like a first subscribe's refusal; the subscription stays kept for the next client.
           for (const failure of this.#subscriptions.bindAll(client)) {
-            this.#report(
+            this.#reports.fault(
               this.#coded(`re-subscribe to ${failure.subject}`, failure.error),
               failure.subject,
             );
@@ -364,9 +378,9 @@ export class NatsTransport implements Transport {
         } catch (error) {
           if (this.#closed) return;
           this.#lastFailure = renderThrowable(error);
-          // Attempts 1, 2, 4, 8, …: an outage is said at once and then ever more rarely, rather
-          // than once per dial per pod for as long as it lasts.
-          if ((attempt & (attempt - 1)) === 0) this.#report(error, this.name);
+          // Thinned (`#outage`): said at once and then ever more rarely, rather than once per
+          // dial per pod for as long as it lasts.
+          this.#reports.outage(error);
           await this.#pause(policyDelay(this.#backoff, attempt, this.#rng));
         }
       }
@@ -413,10 +427,11 @@ export class NatsTransport implements Transport {
     this.#retries = 0;
     const client = this.#client;
     if (client === undefined) return;
+    this.#reports.recovered();
     // Not awaited: the library calls this from its status loop. The failure has one place to go.
     // A lazy bucket is forgotten instead, and asserted again by whoever next reads `shared`.
     if (this.#lazyBucket) this.#bucketed.delete(client);
-    else void this.#ensureBucket(client).catch((error: unknown) => this.#report(error, this.name));
+    else void this.#ensureBucket(client).catch((error: unknown) => this.#reports.outage(error));
     this.#announce();
   }
 
@@ -425,7 +440,7 @@ export class NatsTransport implements Transport {
       try {
         listener();
       } catch (error) {
-        this.#report(error, this.name);
+        this.#reports.fault(error, this.name);
       }
     }
   }
@@ -452,33 +467,4 @@ export class NatsTransport implements Transport {
       reason: `${what} was refused: ${renderThrowable(error)}`,
     });
   }
-
-  /**
-   * Every background failure lands here — a lost connection, a throwing subscriber, an exhausted
-   * reconnect. Dropping it when the caller passed no handler is what turns "no changes arrive"
-   * into a debugging session with nothing to read, so the default emits rather than swallows.
-   */
-  #report(error: unknown, subject: string): void {
-    const handler = this.#options.onError;
-    if (handler !== undefined) {
-      // Total: the handler is injected, and its throw would land in whatever called this — the
-      // dial loop (started with `void`: an unhandled rejection and no more retries), the
-      // library's status loop, a subscriber's delivery. A reporter that cannot report is not a
-      // reason to stop dialling; the fault falls through to the logger line below.
-      try {
-        handler(error, subject);
-        return;
-      } catch (thrown) {
-        logger.error('nats transport onError threw', { error: renderThrowable(thrown) });
-      }
-    }
-    logger.error('nats transport error', {
-      transport: this.name,
-      subject,
-      code: isUltimateError(error) ? error.code : undefined,
-      // `renderThrowable`, never `String(error)`: this is a reporter, and a throwable that fights
-      // being read makes the report the thing that throws.
-      error: renderThrowable(error),
-    });
-  }
 }

package/src/presence.ts

@@ -93,6 +93,13 @@ export class PresenceRegistry {
     return this.#ttlMs;
   }
 
+  /** Rooms with a member this node has seen — what the next `sweepAll` will read the bus for. */
+  get rooms(): number {
+    let rooms = 0;
+    for (const members of this.#seen.values()) if (members.size > 0) rooms += 1;
+    return rooms;
+  }
+
   /** Recommended client heartbeat interval: one lost beat must not read as a leave. */
   get heartbeatMs(): number {
     return Math.max(1_000, Math.floor(this.#ttlMs / 3));

package/src/sync-bus-handlers.ts

@@ -14,12 +14,15 @@ import {
   parseEnvelope,
   type SeqGapDetector,
 } from './replicator-envelope';
+import type { BusOutage } from './sync-bus-outage';
 
 export interface SyncBus {
   readonly registry: LiveQueryRegistry;
   readonly hub: ChannelHub;
   readonly gaps: SeqGapDetector;
   readonly producers: ProducerKinds;
+  /** The node's outage: a bus that reconnected has answered. */
+  readonly outage?: Pick<BusOutage, 'answered'> | undefined;
 }
 
 /**
@@ -123,6 +126,7 @@ export function changeHandler(bus: SyncBus): (payload: string) => void {
  */
 export function reconnectHandler(bus: SyncBus): () => void {
   return () => {
+    bus.outage?.answered();
     bus.gaps.forget();
     const marked = bus.registry.invalidate();
     const channelGaps = bus.hub.invalidate();

package/src/sync-bus-outage.ts

@@ -0,0 +1,62 @@
+// Single responsibility: what a `sync` node says while its bus is away. Without the bus the node
+// cannot do its job — that is an ERROR — but it is ONE fact however many sockets beat into it and
+// however many sweeps fail: said on failures 1, 2, 4, 8, … and once more when the bus answers.
+// Until 2026-10-10 it was `presence.sweep failed` every sweep and one monitor event per refused beat.
+
+import { outageLog, renderThrowable, reportError } from '@ultimat3/core';
+import { reportDetached } from './detach';
+import type { PresenceRegistry } from './presence';
+
+/** The line a node writes while its bus is away; `<event> recovered` when it is back. */
+export const SYNC_BUS_UNAVAILABLE = 'sync.bus_unavailable';
+
+export interface BusOutage {
+  /**
+   * `true` when `error` is the bus being away — counted, and logged + reported only on the
+   * outage's milestones. `false` for anything else, which stays the caller's to report.
+   */
+  refused(error: unknown, operation: string, at?: string): boolean;
+  /** The bus answered: the outage, if there was one, is over. */
+  answered(): void;
+  /** `detach` for work that reaches the bus: an outage is thinned, any other failure is not. */
+  detach(work: Promise<unknown>, operation: string, at?: string): void;
+  /** One presence sweep. A pass that read at least one room is the bus answering. */
+  sweep(presence: PresenceRegistry): void;
+}
+
+const codeOf = (error: unknown): unknown =>
+  typeof error === 'object' && error !== null ? (error as { readonly code?: unknown }).code : null;
+
+export function busOutage(): BusOutage {
+  const log = outageLog({ event: SYNC_BUS_UNAVAILABLE, level: 'error' });
+  const refused = (error: unknown, operation: string, at?: string): boolean => {
+    if (codeOf(error) !== 'X_TRANSPORT_UNAVAILABLE') return false;
+    const said = log.failed({
+      operation,
+      ...(at === undefined ? {} : { at }),
+      error: renderThrowable(error),
+    });
+    // The monitor is thinned with the log: one outage is not one event per socket per beat.
+    if (said) reportError(error, { source: 'realtime', scope: { operation } });
+    return true;
+  };
+  const detached = (work: Promise<unknown>, operation: string, at?: string): void => {
+    void work.catch((error: unknown) => {
+      if (!refused(error, operation, at)) reportDetached(error, operation, at);
+    });
+  };
+  return {
+    refused,
+    answered: () => log.recovered(),
+    detach: detached,
+    sweep(presence) {
+      const rooms = presence.rooms;
+      detached(
+        presence.sweepAll().then(() => {
+          if (rooms > 0) log.recovered();
+        }),
+        'presence.sweep',
+      );
+    },
+  };
+}

package/src/sync-frames.ts

@@ -22,6 +22,8 @@ export interface FrameRouterOptions {
   readonly heartbeatMs?: number | undefined;
   /** Shared with the node, which names a seat's sid when a re-auth drops it. */
   readonly channelSids?: ChannelSids | undefined;
+  /** Told when a presence read or write landed: the bus answered (`sync-bus-outage.ts`). */
+  readonly busAnswered?: (() => void) | undefined;
 }
 
 /**
@@ -73,6 +75,7 @@ export function frameRouter(options: FrameRouterOptions): FrameRouter {
       : beat && (await presence.heartbeat(name, socket.id))
         ? await presence.roster(name)
         : await presence.join(name, { id: socket.id, actorId: socket.actorId });
+    if (presence) options.busAnswered?.();
     // Read, though nothing here can repair it: the next beat re-sends the set, and the log is the
     // only trace a dropped one leaves anywhere.
     if (!socket.send(presenceFrame(name, 'sync', roster.members, roster.total))) {

package/src/sync-node.ts

@@ -27,6 +27,7 @@ import { idleSweepPeriodMs } from './socket-idle';
 import { actorChangeHandler } from './sync-actor-change';
 import { GrantBook, sweepGrants } from './sync-auth';
 import { changeHandler, ProducerKinds, reconnectHandler } from './sync-bus-handlers';
+import { busOutage } from './sync-bus-outage';
 import { ackRefOf, frameRouter } from './sync-frames';
 import {
   clientHeartbeatMs,
@@ -73,6 +74,7 @@ export function syncNode(options: SyncNodeOptions): SyncNode {
   const gaps = new SeqGapDetector();
   // Kept across restarts of the bus subscription: a table's producer kind is a fact of the fleet.
   const producers = new ProducerKinds();
+  const outage = busOutage();
   const channelSids = new ChannelSids();
   let reconnects: (() => void) | null = null;
   /** The re-auth pass in flight, shared by every tick that lands while it runs. */
@@ -145,7 +147,7 @@ export function syncNode(options: SyncNodeOptions): SyncNode {
         const leave = presence.leave(name, socket.id);
         // Detached as well as returned: `detach` attaches the reporting catch, so a caller that
         // awaits this later is awaiting a promise whose rejection is already handled.
-        detach(leave, 'presence.leave', name);
+        outage.detach(leave, 'presence.leave', name);
         leaves.push(leave);
       }
     }
@@ -237,13 +239,14 @@ export function syncNode(options: SyncNodeOptions): SyncNode {
     buildId: options.buildId,
     presence,
     channelSids,
+    busAnswered: outage.answered,
     heartbeatMs: clientHeartbeatMs(presence?.heartbeatMs, sockets.idleTimeoutMs),
   });
 
   /** Everything `start()` does, fenced on the generation it began under — see `started`. */
   const begin = async (): Promise<void> => {
     const run = generation;
-    const bus = { registry: options.registry, hub: options.hub, gaps, producers };
+    const bus = { registry: options.registry, hub: options.hub, gaps, producers, outage };
     const subscription = await options.transport.subscribe(CHANGE_SUBJECT_ALL, changeHandler(bus));
     // A stop or drain ran inside that await: what it released did not include this yet.
     if (run !== generation) {
@@ -255,10 +258,7 @@ export function syncNode(options: SyncNodeOptions): SyncNode {
     // One pass per heartbeat window: a member is swept only once it has actually missed its
     // window, and the interval never holds the process open — shutdown is the drain's job.
     if (presence) {
-      sweeping = setInterval(
-        () => detach(presence.sweepAll(), 'presence.sweep'),
-        presence.heartbeatMs,
-      );
+      sweeping = setInterval(() => outage.sweep(presence), presence.heartbeatMs);
       sweeping.unref();
     }
     // The half-open connection Bun's own `idleTimeout` renews through its ping/pong: a client
@@ -409,7 +409,7 @@ export function syncNode(options: SyncNodeOptions): SyncNode {
           } catch (error) {
             // The ack frame tells the client what it did wrong; the monitor only hears about what
             // this node did wrong. Same rule the HTTP pipeline applies at `status >= 500`.
-            if (!isClientFault(error)) {
+            if (!outage.refused(error, 'sync.frame') && !isClientFault(error)) {
               reportError(error, {
                 source: 'realtime',
                 scope: { operation: 'sync.frame', extra: { socketId: socket.id } },

package/src/transport-env.ts

@@ -165,6 +165,8 @@ export function selectTransport(
     presenceTtlMs,
     // Only a node that serves presence needs the bucket to exist before it can start.
     presenceBucket: use === 'sockets' ? 'dial' : 'first-use',
+    // A publisher without the bus is degraded and still serves; a node that serves FROM it is not.
+    outageLevel: use === 'publish' ? 'warn' : 'error',
     ...(options.clock === undefined ? {} : { clock: options.clock }),
     ...(options.connect === undefined ? {} : { connect: options.connect }),
     ...(options.backoff === undefined ? {} : { backoff: options.backoff }),