comq 0.22.0 → 0.23.0

package/discussions/one-parking-queue.md

@@ -0,0 +1,63 @@
+# One parking queue
+
+> Supersedes the parking queue's naming and lifetime in
+> [poison message handling](./poison-message-handling.md), Part 1. Everything else about
+> parking — when a message is parked, what it carries, what is published before what — is
+> unchanged.
+
+Everything a consumer could not process is kept in one queue, `comq.parked`, whatever it was
+consumed from. It is durable, it is declared once per channel beside the retry queues, and comq
+never removes it or what is in it.
+
+A parked message already says where it came from. `x-comq-queue` is the queue it was consumed
+from, `x-comq-exchange` and `x-comq-key` where it was originally published, and all three are
+recorded on the first failure rather than read at parking time. Reading one source's parked
+messages is a match on `x-comq-queue`.
+
+## What this changes
+
+| | before | after |
+|---|---|---|
+| parking queues | one per consumed queue | one |
+| its lifetime | the lifetime of the queue it served | durable, always |
+| what a groupless subscriber parks | went with its connection | kept |
+| scales with | how many queues the connection consumes | nothing |
+
+## Why the queue per source goes
+
+**It was measured.** The cost of this design was worked through when it was made, at 200 source
+queues and 200 parking queues, and accepted. In a deployment of about forty processes the
+parking queues came to 1318 of 2731 queues on the broker — 48 % — and every one of them was
+empty, with no consumer and no message it had ever held. At about 70 KB of broker memory per
+queue, that is the largest single item on a broker that had been blocking publishers on a memory
+alarm.
+
+The count is what makes it grow: one per consumed queue means the broker pays for how widely an
+application is decomposed, forever, whether or not anything ever fails.
+
+**Depth per source survives.** The reason recorded for the queue per source was that depth per
+consumer is how anyone notices a problem. What notices a problem is the `discard` diagnostic,
+which fires per parked message and names the queue it came from. Depth in `comq.parked` still
+says how much is waiting, and `x-comq-queue` still says what for.
+
+**The lifetime rule goes with it.** The parking queue mirrored its source's durability so that a
+durable parking queue would not be left behind an exclusive `amq.gen-*` source — one leaked per
+restart, forever. With a fixed name there is nothing to leak, and the rule that prevented the
+leak was throwing away the evidence it was meant to keep: a groupless subscriber's failures
+vanished with its connection, at the moment there was nobody left to tell.
+
+## Upgrading
+
+`comq.parked.<queue>` queues from an earlier version keep whatever they already hold. comq stops
+declaring them and stops publishing to them, so they are drained and deleted once, by hand.
+
+Nothing is redeclared with different arguments, so no assertion answers `PRECONDITION_FAILED`
+and no broker has to be emptied. During a rollout the processes still on the old version go on
+parking per source and the new ones park in `comq.parked`; both are readable, and both say
+which queue a message came from.
+
+## What comq says about it
+
+That the queue is there, that a message in it names its source, and that comq removes neither.
+What to do with a queue on a broker — a `max-length`, a TTL, an alert on depth — is read off
+those facts by whoever can see the broker.

package/discussions/one-reply-queue.md

@@ -0,0 +1,44 @@
+# One reply queue
+
+An `IO` receives every reply on one queue, `comq.reply..<id>`, whatever it sent the request to.
+
+A reply is found by its `correlationId`. `ReplyEmitter.next` builds one from eight random bytes
+and a counter, and it is unique across processes — it has to be, because a producer's control
+queue sees the requests of every consumer and tells them apart by nothing else. Routing a reply
+reads that identifier and nothing else: the queue it arrived on was never consulted.
+
+## What this changes
+
+| | before | after |
+|---|---|---|
+| reply queues | one per distinct queue or exchange requested | one |
+| its name | `<target>..<id>` | `comq.reply..<id>` |
+| scales with | how widely the caller fans out | nothing |
+
+Both are exclusive, so both go with the connection. A sharded connection holds one per shard, as
+it held one per target per shard before.
+
+## Why the queue per target goes
+
+The count was the caller's to set and the broker's to pay: a connection that requests fifty
+queues held fifty queues and fifty consumers for as long as it lived, whether or not it ever
+requested them again. Nothing bounded it but how widely the application was decomposed.
+
+The name was the argument for it — a queue named after what is being called says, to somebody
+reading the broker, who is waiting on what. It says it of a queue that carries no messages
+between requests, and the same thing is on every message that does pass through: `correlationId`
+identifies the request, and the reply-side handler knows which one it belongs to.
+
+## What is given up
+
+Reading the broker no longer tells you which operations a connection calls. A reply queue names
+its connection instead, and what it is waiting for is in flight rather than on the broker.
+
+## Upgrading
+
+Reply queues are exclusive and are asserted on the first request, so a process on the old
+version and one on the new hold different queues and neither declares the other's. Nothing is
+redeclared, and a rollout needs no order.
+
+A parked request keeps the `replyTo` it was sent with, so one parked by an old process still
+names the queue that process was listening on — which, as before, is gone once that process is.

package/discussions/poison-message-handling.md

@@ -7,7 +7,8 @@
 > where it survives a retry.
 >
 > **All three parts are implemented.** Text below is written as a proposal because that is what
-> it was; it describes what the code now does.
+> it was; it describes what the code now does — except for the parking queue's name and
+> lifetime, which [one parking queue](./one-parking-queue.md) supersedes.
 
 When a consumer callback rejects, comq is supposed to retry the message a few times and then
 give up on it. What it actually does is kill the process, and take every other consumer in that

package/docs/headers.md

@@ -26,7 +26,7 @@ the message properties.
 | `x-comq-attempt` | a retried message | Which attempt this delivery is, counting from one. Absent on the first, so read it as `headers?.['x-comq-attempt'] ?? 1`. The last attempt is one more than the number of rungs in the [backoff ladder](../readme.md#retries). |
 | `x-comq-exchange` | a retried or parked message | The exchange it was originally published to. |
 | `x-comq-key` | a retried or parked message | The routing key it was originally published with. |
-| `x-comq-queue` | a parked message | The queue it was consumed from. |
+| `x-comq-queue` | a parked message | The queue it was consumed from. One `comq.parked` queue holds what every source parked, so this is what tells them apart. |
 | `x-comq-reason` | a parked message | The `message` of the exception that ended its attempts. |
 | `x-comq-cause` | a parked message | The `message` of that exception's `cause`, when it has one — a verdict is usually thrown with the failure that prompted it. |
 | `x-comq-at` | a parked message | When it was parked, as `Date.now()`. |

package/features/parking.feature

@@ -0,0 +1,32 @@
+Feature: The parking queue
+
+  What a consumer could not process is kept in one queue, `comq.parked`, whatever it was
+  consumed from. The message says where it came from, so the queue does not have to.
+
+  Background:
+    Given an active connection to the broker
+
+  Scenario: Messages parked from two queues are kept in one
+
+    A queue per source would repeat what every parked message already carries, and
+    would stay on the broker for as long as the broker does.
+
+    Given that events from the `parking_left` exchange are causing exceptions
+    And that events from the `parking_right` exchange are causing exceptions
+    When an event is emitted to the `parking_left` exchange
+    And an event is emitted to the `parking_right` exchange
+    Then a message parked from the `parking_left` exchange is in the parking queue
+    And a message parked from the `parking_right` exchange is in the parking queue
+
+  Scenario: A message parked from a groupless subscription outlives its connection
+
+    A groupless subscriber consumes a queue of its own that the broker removes with the
+    connection. What it could not process is not ephemeral: it is waiting for a person,
+    and there is nobody left to tell.
+
+    Given that groupless events from the `parking_ephemeral` exchange are causing exceptions
+    When an event is emitted to the `parking_ephemeral` exchange
+    And the message is parked
+    And the connection is closed
+    And an active connection to the broker
+    Then a message parked from the `parking_ephemeral` exchange is in the parking queue

package/features/rpc.replies.feature

@@ -0,0 +1,26 @@
+Feature: Reply queues
+
+  A connection consumes its replies from one queue, whatever it sends requests to. The
+  reply is found by its correlation identifier, which is unique across processes, so the
+  queue does not have to name what was called.
+
+  Scenario: One reply queue however many queues are requested
+
+    Given an active connection to the broker
+    And a producer replying `replies_alpha` queue
+    And a producer replying `replies_beta` queue
+    When the consumer sends a request to the `replies_alpha` queue
+    Then the consumer receives the reply
+    When the consumer sends a request to the `replies_beta` queue
+    Then the consumer receives the reply
+    And the broker holds 1 reply queue
+
+  Scenario: One reply queue per shard
+
+    A shard is a broker of its own, and a request published to one is answered on it.
+
+    Given an active sharded connection
+    And a producer replying `replies_sharded` queue
+    When the consumer sends 10 requests to the `replies_sharded` queue
+    Then all replies have been received
+    And each broker holds 1 reply queue

package/features/steps/brokers.js

@@ -12,8 +12,13 @@ const IMAGE = 'rabbitmq:4.3-management'
 const USER = 'developer'
 const PASSWORD = 'secret'
 const AMQP_PORT = 5672
+const MANAGEMENT_PORT = 15672
 const BROKERS_AMOUNT = 2
 const HOST_PORTS = [5673, 5674]
+
+// what a scenario reads the topology from: a queue nothing holds open is
+// invisible over AMQP, and its absence is what some of them are about
+const MANAGEMENT_HOST_PORTS = [15673, 15674]
 const HEALTHCHECK_INTERVAL = global.COMQ_TESTING_HEALTHCHECK_INTERVAL ?? 1000
 
 /** @type {import('@testcontainers/rabbitmq').StartedRabbitMQContainer[]} */
@@ -33,7 +38,9 @@ async function startBrokers () {
         })
         .withAutoRemove(false)
         .withName(`comq-rmq-${n}`)
-        .withExposedPorts({ container: AMQP_PORT, host: hostPort })
+        .withExposedPorts(
+          { container: AMQP_PORT, host: hostPort },
+          { container: MANAGEMENT_PORT, host: MANAGEMENT_HOST_PORTS[n] })
         .withHealthCheck({
           test: ['CMD', 'rabbitmq-diagnostics', '-q', 'ping'],
           interval: 5000,
@@ -88,6 +95,22 @@ function getAddress (n = 0) {
   return `localhost:${HOST_PORTS[n]}`
 }
 
+/**
+ * The queues on a broker, by name.
+ *
+ * @param {number} [n]
+ * @returns {Promise<string[]>}
+ */
+async function queues (n = 0) {
+  const authorization = 'Basic ' + Buffer.from(`${USER}:${PASSWORD}`).toString('base64')
+  const url = `http://localhost:${MANAGEMENT_HOST_PORTS[n]}/api/queues/%2F?columns=name`
+  const response = await fetch(url, { headers: { authorization } })
+
+  if (!response.ok) throw new Error(`Cannot read the queues of broker ${n}: ${response.status}`)
+
+  return (await response.json()).map((queue) => queue.name)
+}
+
 /**
  * @param {number} [n]
  */
@@ -129,5 +152,6 @@ module.exports = {
   startBrokers,
   stopBrokers,
   getAddress,
+  queues,
   actions
 }

package/features/steps/parked.js

@@ -1,11 +1,10 @@
 'use strict'
 
 const assert = require('node:assert')
-const amqplib = require('amqplib')
 const { Given, When, Then } = require('@cucumber/cucumber')
 
-const { getAddress, USER, PASSWORD } = require('./brokers')
 const { until, timeout } = require('../../test/helpers')
+const { reading, pick } = require('./parking')
 
 Given('a producer failing every request to the {token} queue',
   /**
@@ -52,18 +51,9 @@ When('the parked request from the {token} queue is answered by hand',
    * @this {comq.features.Context}
    */
   async function (queue) {
-    const connection = await amqplib.connect(`amqp://${USER}:${PASSWORD}@${getAddress(0)}`)
-    const channel = await connection.createChannel()
-
-    try {
-      let parked
-
-      await channel.consume('comq.parked.' + queue, (message) => {
-        parked = message
-        channel.ack(message)
-      })
-
-      await until(() => parked !== undefined)
+    await reading(async (channel) => {
+      const parked = await pick(channel,
+        (one) => one.properties.headers?.['x-comq-queue'] === queue)
 
       assert.notEqual(parked, undefined, `Nothing was parked from ${queue}`)
 
@@ -74,15 +64,14 @@ When('the parked request from the {token} queue is answered by hand',
 
       this.answer = { answered: true, was: JSON.parse(parked.content.toString()) }
 
+      channel.ack(parked)
+
       channel.sendToQueue(replyTo, Buffer.from(JSON.stringify(this.answer)),
         { correlationId, contentType })
 
       // let the frame reach the broker before the connection goes
       await timeout(100)
-    } finally {
-      await channel.close()
-      await connection.close()
-    }
+    })
   })
 
 Then('the caller receives the reply',

package/features/steps/parking.js

@@ -0,0 +1,113 @@
+'use strict'
+
+const assert = require('node:assert')
+const amqplib = require('amqplib')
+const { Given, When, Then } = require('@cucumber/cucumber')
+
+const { getAddress, USER, PASSWORD } = require('./brokers')
+const { timeout } = require('../../test/helpers')
+
+Given('(that )groupless events from the {token} exchange are causing exceptions',
+  /**
+   * @param {string} exchange
+   * @this {comq.features.Context}
+   */
+  async function (exchange) {
+    await this.io.consume(exchange, (payload, properties) => {
+      this.attempts.push(properties.headers?.['x-comq-attempt'] ?? 1)
+
+      throw new Error('Expected exception')
+    })
+  })
+
+When('the connection is closed',
+  /**
+   * @this {comq.features.Context}
+   */
+  async function () {
+    await this.disconnect()
+  })
+
+Then('a message parked from the {token} exchange is in the parking queue',
+  /**
+   * @param {string} exchange
+   * @this {comq.features.Context}
+   */
+  async function (exchange) {
+    await reading(async (channel) => {
+      const message = await pick(channel,
+        (one) => one.properties.headers?.['x-comq-exchange'] === exchange)
+
+      assert.notEqual(message, undefined,
+        `Nothing in '${PARKED}' came from the '${exchange}' exchange`)
+
+      const headers = message.properties.headers
+
+      // a groupless subscriber consumes a name the broker chose, so what is asserted
+      // here is that the message says which queue, not which name that is
+      assert.notEqual(headers['x-comq-queue'], undefined,
+        'The parked message does not name the queue it came from')
+
+      assert.notEqual(headers['x-comq-reason'], undefined, 'The parked message has no reason')
+
+      channel.nack(message, false, true)
+    })
+  })
+
+/**
+ * Runs `read` against a connection of its own, so that what it does to the parking
+ * queue is not what comq is doing to it.
+ *
+ * @param {(channel: import('amqplib').Channel) => Promise<void>} read
+ */
+async function reading (read) {
+  const connection = await amqplib.connect(`amqp://${USER}:${PASSWORD}@${getAddress(0)}`)
+  const channel = await connection.createChannel()
+
+  try {
+    await read(channel)
+  } finally {
+    await channel.close().catch(noop)
+    await connection.close().catch(noop)
+  }
+}
+
+/**
+ * The first message in the parking queue that `matches`, waited for. One queue holds what
+ * every scenario before this one left in it, so everything that does not match is given
+ * back; the match is left unacknowledged, for the caller to take or to return.
+ *
+ * @param {import('amqplib').Channel} channel
+ * @param {(message: import('amqplib').GetMessage) => boolean} matches
+ * @returns {Promise<import('amqplib').GetMessage | undefined>}
+ */
+async function pick (channel, matches) {
+  const deadline = Date.now() + DEADLINE
+
+  do {
+    const taken = []
+
+    let delivery
+
+    while ((delivery = await channel.get(PARKED, { noAck: false })) !== false) taken.push(delivery)
+
+    const match = taken.find(matches)
+
+    for (const one of taken) if (one !== match) channel.nack(one, false, true)
+
+    if (match !== undefined) return match
+
+    await timeout(50)
+  } while (Date.now() < deadline)
+}
+
+const PARKED = 'comq.parked'
+
+/** The ladder the suite runs on is half a second; this is room for it and the broker. */
+const DEADLINE = 5000
+
+function noop () {}
+
+exports.PARKED = PARKED
+exports.reading = reading
+exports.pick = pick

package/features/steps/poison.js

@@ -3,6 +3,7 @@
 const assert = require('node:assert')
 const { until } = require('../../test/helpers')
 const { Then } = require('@cucumber/cucumber')
+const { PARKED, reading, pick } = require('./parking')
 
 Then('the event is attempted {int} time(s)',
   /**
@@ -35,32 +36,29 @@ Then('the parked message is kept, and says it came from the {token} exchange',
    */
   async function (exchange) {
     const queue = exchange + '..exceptions' // the group the throwing consumer uses
-    const parked = 'comq.parked.' + queue
 
-    await this.io.process(parked, (payload, properties) => {
-      this.parked[queue] = { payload, properties }
-    })
-
-    await until(() => this.parked[queue] !== undefined)
+    await reading(async (channel) => {
+      const message = await pick(channel,
+        (one) => one.properties.headers?.['x-comq-queue'] === queue)
 
-    const message = this.parked[queue]
+      assert.notEqual(message, undefined, `Nothing in '${PARKED}' came from ${queue}`)
 
-    assert.notEqual(message, undefined, `Nothing was parked in ${parked}`)
+      const headers = message.properties.headers
 
-    const headers = message.properties.headers
+      assert.notEqual(headers['x-comq-reason'], undefined, 'The parked message has no reason')
 
-    assert.equal(headers['x-comq-queue'], queue, 'The parked message does not name its queue')
-    assert.notEqual(headers['x-comq-reason'], undefined, 'The parked message has no reason')
+      // the message came back through the default exchange on every retry, so this
+      // is only right if the origin was recorded on the first failure
+      assert.equal(headers['x-comq-exchange'], exchange,
+        `The parked message says it came from '${headers['x-comq-exchange']}'`)
 
-    // the message came back through the default exchange on every retry, so this
-    // is only right if the origin was recorded on the first failure
-    assert.equal(headers['x-comq-exchange'], exchange,
-      `The parked message says it came from '${headers['x-comq-exchange']}'`)
+      // absent on a message parked from its first delivery, exactly as a consumer reads it;
+      // derived rather than stated, so it cannot drift from the configured ladder
+      assert.equal(headers['x-comq-attempt'] ?? 1, this.attempts.length,
+        'The parked message did not have as many attempts as the consumer saw')
 
-    // absent on a message parked from its first delivery, exactly as a consumer reads it;
-    // derived rather than stated, so it cannot drift from the configured ladder
-    assert.equal(headers['x-comq-attempt'] ?? 1, this.attempts.length,
-      'The parked message did not have as many attempts as the consumer saw')
+      channel.ack(message)
+    })
   })
 
 Then('{token} has received {int} event(s)',

package/features/steps/replies.js

@@ -0,0 +1,35 @@
+'use strict'
+
+const assert = require('node:assert')
+const { Then } = require('@cucumber/cucumber')
+
+const { queues, BROKERS_AMOUNT } = require('./brokers')
+
+Then('the broker holds {int} reply queue(s)',
+  /**
+   * @param {number} count
+   */
+  async function (count) {
+    await held(0, count)
+  })
+
+Then('each broker holds {int} reply queue(s)',
+  /**
+   * @param {number} count
+   */
+  async function (count) {
+    for (let n = 0; n < BROKERS_AMOUNT; n++) await held(n, count)
+  })
+
+/**
+ * @param {number} broker
+ * @param {number} count
+ */
+async function held (broker, count) {
+  const replies = (await queues(broker)).filter((name) => name.startsWith(PREFIX))
+
+  assert.equal(replies.length, count,
+    `Broker ${broker} holds ${replies.length} reply queue(s): ${replies.join(', ')}`)
+}
+
+const PREFIX = 'comq.reply'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "comq",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "description": "ComQ",
   "author": {
     "name": "Artem Gurtovoi",

package/readme.md

@@ -113,7 +113,8 @@ Send encoded Request message with `replyTo` and `correlationId` properties set a
 return decoded Reply content. The promise stays pending until the Reply arrives, or until the
 [timeout](#timeout) passes.
 
-On the initial call, queues for Requests and Replies are asserted.
+On the initial call, the queue for Requests is asserted, and so is the one this `IO` receives
+every Reply on.
 
 `options` is the encoding, or an object:
 
@@ -550,7 +551,9 @@ requests and are expecting replies.
 - An exchange is asserted as _fanout_ for [Emission](#emission)
   and [Consumption](#consumption), and as _direct_ for [Routing](#routing). One name is one or
   the other: asserting it as both is what the broker refuses.
-- Queues for Replies are _exclusive_ and _auto deleted_.
+- One queue takes every Reply an `IO` receives, `comq.reply..<id>`, _exclusive_ and gone with the
+  connection. A Reply is matched by its `correlationId`, which is unique across processes, so the
+  queue names neither what was called nor what is waiting.
 - A queue [`back`](#addressed-requests) holds is _exclusive_, bound under its Key to a _direct_
   exchange.
 
@@ -558,7 +561,8 @@ comq declares two kinds of queue of its own, for [failed messages](#retries):
 
 - `comq.retry.<delay>`, with a fanout exchange of the same name, one pair per distinct rung of
   the [backoff ladder](#retries), shared by every queue that uses it.
-- `comq.parked.<queue>`, one per consumed queue, declared to live as long as it does.
+- `comq.parked`, one queue for everything parked, whatever it was consumed from, always
+  _durable_.
 
 See [queue assertion options](https://amqp-node.github.io/amqplib/channel_api.html#channel_assertQueue).
 
@@ -638,8 +642,10 @@ verdict's own message.
 
 #### Parked messages
 
-A message that has run out of attempts is published to `comq.parked.<queue>` and acknowledged
-only once the broker confirms it. It is not deleted, and it does not depend on a broker-side
+A message that has run out of attempts is published to `comq.parked` and acknowledged
+only once the broker confirms it. There is one such queue, and it holds what every queue this
+connection consumes could not process — including a groupless subscription's, which the broker
+removes with the connection while what it could not process stays. It is not deleted, and it does not depend on a broker-side
 policy. The [`discard`](#diagnostics) diagnostic event is emitted when it happens, and
 [`retry`](#diagnostics) on every attempt before it.
 
@@ -648,9 +654,12 @@ name where it was originally published, `x-comq-queue` the queue it was consumed
 `x-comq-reason` the exception's message, and `x-comq-at` when it was parked. Its original
 properties are kept as they were.
 
-Parked queues grow until somebody drains them, which is deliberate — the alternative is deleting
-evidence. Alert on [`discard`](#diagnostics), and do not delete `comq.retry.*` or `comq.parked.*`
-queues on a running system.
+A message is found by the queue it names rather than by the queue it is in: `comq.parked` holds
+messages from every source, so reading one source's means matching on `x-comq-queue`.
+
+The queue grows until somebody drains it, which is deliberate — the alternative is deleting
+evidence. Nothing comq does removes it or what it holds. Alert on [`discard`](#diagnostics), and
+do not delete `comq.retry.*` or `comq.parked` on a running system.
 
 > **A parked Request is never answered.** A Consumer awaiting its Reply waits until its
 > [timeout](#timeout), or indefinitely without one, and with a limited prefetch that can deadlock
@@ -734,28 +743,6 @@ Sending Requests, receiving Replies, and emitting Events will still be available
 Keys held by [`back`](#addressed-requests) are withdrawn first, so a call published from then on is
 refused.
 
-### Abandoning
-
-`async IO.abandon(): void`
-
-Stop waiting for Replies.
-
-A [close](#disconnection) waits for every `producer` and `consumer` call to return, and such a
-call may itself be waiting on a Request of its own. Where the answer to that Request is the very
-thing going away — the process it would come from is shutting down alongside this one — the close
-waits for as long as the answer takes.
-
-`IO.abandon()` ends that wait:
-
-- every outstanding Reply is rejected with `Abandoned`, so a caller inside a `producer` or
-  `consumer` is told at once rather than held;
-- a Request made from then on is refused with `Abandoned`, so a callback cannot start another
-  wait on the way out.
-
-The Requests those Replies belonged to were sent and may well be processed; what is given up is
-this side's interest in the answers. It may be called before a close or while one is already under
-way, which is how a close that has begun is told to stop waiting.
-
 ### Disconnection
 
 `async IO.close(): void`
@@ -764,9 +751,6 @@ way, which is how a close that has begun is told to stop waiting.
 2. Wait for any outstanding messages to be processed[^2] and acknowledged.
 3. Close the connection.
 
-Step 2 still runs where the Replies have been [abandoned](#abandoning): each message is processed
-to a verdict and acknowledged, and what was given up is the waiting rather than the drain.
-
 [^2]: Therefore, if the underlying connection is lost, `.close()` will only be completed once the
 connection is [recovered](#connection-tolerance).
 

package/source/.io/ReplyPipe.js

@@ -60,12 +60,25 @@ class ReplyPipe extends EventEmitter {
       ok: { correlationId, replyTo: feedback.queue, ...CONTROL, headers: FLOW }
     }
 
+    // The source is not read until the confirmation is published, and a blocked broker holds the
+    // publish for as long as it stays blocked. A source failing in the meantime — a reply stream
+    // being relayed times out — would raise an `error` nobody listens to. How it failed is not
+    // reported to the consumer anyway: `#pump` ends the stream once it finds the source destroyed.
+    stream.on('error', noop)
+
     channel.diagnose('return', this.#onReturn)
     feedback.on(correlationId, this.#control)
   }
 
   async pipe () {
-    await this.#transmit(control.ok, this.#properties.ok)
+    try {
+      await this.#transmit(control.ok, this.#properties.ok)
+    } catch (exception) {
+      // nobody is going to read the source now
+      this.#interrupt()
+
+      throw exception
+    }
 
     if (this.#closed) return
 
@@ -198,4 +211,6 @@ const CONTROL = { type: 'control', mandatory: true }
 
 const FLOW = { [FLOW_HEADER]: true }
 
+function noop () {}
+
 exports.ReplyPipe = ReplyPipe