svelte-realtime 0.5.7 → 0.5.8

package/README.md

@@ -227,6 +227,7 @@ Note: `ctx.user` may contain adapter-injected properties (`__subscriptions`, `re
 
 **Client features**
 - [Batching](#batching)
+- [Volatile RPC (fire-and-forget)](#volatile-rpc-fire-and-forget)
 - [Optimistic updates](#optimistic-updates)
 - [Stream pagination](#stream-pagination)
 - [Undo and redo](#undo-and-redo)
@@ -957,6 +958,8 @@ const [board, column] = await batch(() => [
 
 Each call resolves or rejects independently - one failure does not cancel the others. Batches are limited to 50 calls - enforced both client-side (rejects before sending) and server-side.
 
+A `batch()` containing only one call sends a bare RPC frame (no batch envelope) and the server replies through the normal RPC path - so the defensive "always wrap writes in batch() for symmetry" pattern pays no envelope overhead. Batches of 2+ keep the envelope.
+
 ### Server-side batching
 
 Use `ctx.batch()` inside RPC handlers to publish multiple messages in a single call:
@@ -973,6 +976,59 @@ export const resetBoard = live(async (ctx, boardId) => {
 
 ---
 
+## Volatile RPC (fire-and-forget)
+
+For high-frequency one-way calls where the caller has no reply to await - cursor moves, drag updates, typing indicators, telemetry beacons, heartbeats - use `live.volatile(fn)` server-side + `.fireAndForget(...args)` client-side. The wire frame carries no `id`; the server runs the full handler chain (middleware, guards, rate limits, validation) but does not write a response.
+
+```js
+// src/lib/realtime/cursors.js
+import { live } from 'svelte-realtime';
+
+export const moveCursor = live.volatile(async (ctx, boardId, pos) => {
+  // ctx.publish / ctx.shed / guards all work normally
+  ctx.publish(`board:${boardId}`, 'cursor', pos);
+});
+```
+
+```svelte
+<script>
+  import { moveCursor } from '$live/cursors';
+
+  function onPointerMove(e) {
+    moveCursor.fireAndForget(boardId, { x: e.clientX, y: e.clientY });
+    // returns void synchronously - no Promise, no await
+  }
+</script>
+```
+
+What `.fireAndForget()` skips that a normal RPC does:
+- ID allocation (`_nextId()`)
+- Promise allocation
+- Dedup-Map entry + `queueMicrotask(delete)`
+- Pending-Map entry
+- Timer allocation (per-call 30s timeout)
+- DevTools-pending entry
+
+At 60-120Hz on a single hot path that is 100K+ short-lived heap allocations per second avoided on the client.
+
+**Safety:**
+- **Errors disappear silently from the caller.** A volatile call that fails auth, validation, or throws still runs through metrics (`_recordRpcMetrics`) and server logs - operators see the failure - but the wire carries no reply, so the caller does not. Use `live.volatile()` only when this is the intended contract.
+- **Backpressure drop.** Before send, the client reads `WS.bufferedAmount`; if it exceeds `volatileBackpressureBytes` (default 4 MB, configurable via `configure(...)`), the frame is dropped silently and `__devtools.volatileDropped` ticks. Dev-mode emits a one-shot `console.warn` on first drop per session.
+- **Offline drop.** Volatile calls made while disconnected are silently dropped. They do not enter the offline queue (which is for awaited mutations).
+- **Inside `batch()`.** Throws in dev, no-op in prod. Volatile bypasses batching by design.
+
+**Server-side marker is recommended, not required.** The wire shape (`id` absent) is the actual contract. A `.fireAndForget()` against a plain `live()` handler also works - server processes it, just skips the reply - but dev-mode emits a one-shot warning per such path naming the handler so accidental fire-and-forget surfaces. Mark intentional one-way handlers with `live.volatile()` to silence the warning and document intent. The marker can sit at any depth inside `live.rateLimit` / `live.idempotent` / `live.breaker` / `live.validated` / `live.lock` wrappers (the framework walks `__wrappedFn` to find it).
+
+**When NOT to use `.fireAndForget()`:**
+- The caller needs to know whether the call succeeded -> use the normal awaited RPC.
+- The call needs to be retried on failure -> use `.with({ idempotencyKey })` + normal RPC.
+- The call should survive a disconnect -> use the offline queue via the normal RPC.
+- The call is sometimes one-way, sometimes interesting -> keep the handler `live()` (not `live.volatile()`) and choose at each call site.
+
+**`live.notify` vs `.fireAndForget()`.** Both are fire-and-forget, but they go in opposite directions: `live.notify(target, event, data)` is server -> client (server-initiated push, no client reply expected), while `.fireAndForget(...args)` is client -> server (client-initiated RPC, no server reply emitted). Different surfaces, different use cases.
+
+---
+
 ## Optimistic updates
 
 Apply changes to a stream store instantly, then roll back if the server call fails.
@@ -3663,8 +3719,8 @@ Import from `svelte-realtime/client`.
 |---|---|
 | `RpcError` | Typed error with `code` field |
 | `UploadHandle<T>` | Type for `live.upload` client handles (thenable + events + cancel) |
-| `batch(fn, options?)` | Group RPC calls into one WebSocket frame |
-| `configure(config)` | Connection hooks, offline queue, upload frame size |
+| `batch(fn, options?)` | Group RPC calls into one WebSocket frame (or send bare frame when only one call was collected) |
+| `configure(config)` | Connection hooks, offline queue, upload frame size, `volatileBackpressureBytes` |
 | `combine(...stores, fn)` | Multi-store composition |
 | `onSignal(userId, callback)` | Listen for point-to-point signals |
 | `onDerived` | Re-exported from adapter: reactive derived topic subscription |

package/client.d.ts

@@ -115,6 +115,31 @@ export function __rpc(path: string): ((...args: any[]) => Promise<any>) & {
 				| { event: string; data: any }
 		): (...callArgs: any[]) => Promise<any>;
 	};
+	/**
+	 * Send a fire-and-forget RPC. Returns `void` synchronously - no Promise,
+	 * no pending entry, no timeout, no devtools-pending. The wire frame is
+	 * `{rpc, args}` with no `id` field; the server runs the full handler
+	 * chain but does not write a response. Errors are silently dropped on
+	 * the wire.
+	 *
+	 * Pair with `live.volatile(fn)` server-side. Use for high-frequency
+	 * one-way RPCs - cursor moves, drag updates, typing indicators,
+	 * telemetry beacons, heartbeats.
+	 *
+	 * Safety:
+	 * - Offline: silent no-op (no offline queue).
+	 * - Backpressure: dropped when `conn.bufferedAmount` exceeds the
+	 *   configured `volatileBackpressureBytes` (default 4 MB);
+	 *   `__devtools.volatileDropped` ticks.
+	 * - Inside `batch()`: throws in dev, no-op in prod.
+	 *
+	 * @example
+	 * ```js
+	 * import { moveCursor } from '$live/cursors';
+	 * moveCursor.fireAndForget('board-1', { x, y });
+	 * ```
+	 */
+	fireAndForget: (...args: any[]) => void;
 };
 
 /**
@@ -548,6 +573,16 @@ export function configure(config: {
 	 * @default 60000
 	 */
 	resumeGraceMs?: number;
+	/**
+	 * `WS.bufferedAmount` threshold (in bytes) at which `.fireAndForget()`
+	 * sends are dropped silently and `__devtools.volatileDropped` ticks.
+	 * Sized for 120Hz cursor + drag traffic; raise it if your app
+	 * legitimately bursts above 4 MB of in-flight volatile traffic,
+	 * lower it on mobile-constrained targets where the OS send buffer
+	 * is tighter.
+	 * @default 4_194_304 (4 MB)
+	 */
+	volatileBackpressureBytes?: number;
 	/** Offline mutation queue configuration. */
 	offline?: {
 		/** Enable queuing RPCs when disconnected. */

package/client.js

@@ -15,6 +15,11 @@ export const empty = readable(undefined);
 
 const _textEncoder = new TextEncoder();
 
+/** Dev-mode flag. True when not running under a Vite production build
+ * (and true under vitest, where `import.meta.env.PROD` is undefined).
+ * Gates dev-only warnings and devtools instrumentation. */
+const _IS_DEV = typeof import.meta === 'undefined' || !import.meta.env || !import.meta.env.PROD;
+
 // - Bounded-by-default capacity caps (client side) -------------------------
 // Existing caps not re-declared (already enforced at their sites):
 //   _historyMax           50    FIFO    per-stream undo/redo
@@ -540,6 +545,70 @@ export function __rpc(path) {
 		return _sendRpc(path, args);
 	};
 
+	/**
+	 * Send a fire-and-forget RPC. Returns `void` synchronously - no Promise,
+	 * no pending entry, no timeout, no devtools-pending. The wire frame is
+	 * `{rpc, args}` with no `id` field; the server runs the full handler
+	 * chain (middleware, guards, rate limits, validation) but does not
+	 * write a response. Errors are silently dropped on the wire.
+	 *
+	 * Pair with `live.volatile(fn)` server-side. Use for high-frequency
+	 * one-way RPCs - cursor moves, drag updates, typing indicators,
+	 * telemetry beacons, heartbeats. Skips: `_nextId()`, the Promise
+	 * allocation, the dedup map, the pending Map entry, the timer
+	 * allocation, the devtools-pending entry.
+	 *
+	 * Safety:
+	 * - **Offline:** silent no-op while disconnected. No offline-queue
+	 *   entry. Lossy under disconnect IS the contract.
+	 * - **Backpressure:** if `conn.bufferedAmount` exceeds
+	 *   `volatileBackpressureBytes` (default 4 MB - see `configure(...)`),
+	 *   the send is dropped and the drop counter ticks. Prevents the WS
+	 *   send queue from growing unbounded on a stuck connection.
+	 * - **Inside `batch()`:** dev-mode throws; production no-op. Volatile
+	 *   bypasses batching by design.
+	 *
+	 * @param {...any} args - Arguments forwarded to the handler
+	 * @returns {void}
+	 *
+	 * @example
+	 * ```js
+	 * import { moveCursor } from '$live/cursors';
+	 * moveCursor.fireAndForget('board-1', { x, y });
+	 * ```
+	 */
+	rpcCall.fireAndForget = function fireAndForget(...args) {
+		if (_terminated) return;
+		if (_isOffline) { _volatileDropped++; return; }
+		if (_batchCollector) {
+			if (_IS_DEV) {
+				throw new Error(
+					`[svelte-realtime] '${path}'.fireAndForget() cannot be used inside batch() - volatile RPCs bypass batching.\n  See: https://svti.me/volatile`
+				);
+			}
+			return;
+		}
+		ensureListener();
+		ensureDisconnectListener();
+		const conn = _connect();
+		const cap = _clientConfig.volatileBackpressureBytes || _DEFAULT_VOLATILE_BACKPRESSURE_BYTES;
+		if (typeof conn.bufferedAmount === 'number' && conn.bufferedAmount > cap) {
+			_volatileDropped++;
+			if (__devtools) __devtools.volatileDropped = _volatileDropped;
+			if (_IS_DEV && !_volatileBackpressureWarned) {
+				_volatileBackpressureWarned = true;
+				console.warn(
+					`[svelte-realtime] volatile RPC '${path}' dropped: WS bufferedAmount (${conn.bufferedAmount} bytes) exceeded volatileBackpressureBytes (${cap}). ` +
+					`This warning fires once per session; subsequent drops increment __devtools.volatileDropped silently. ` +
+					`Raise the threshold via configure({ volatileBackpressureBytes }) if your app legitimately bursts above 4 MB of in-flight WS traffic.\n  See: https://svti.me/volatile`
+				);
+			}
+			return;
+		}
+		_devtoolsVolatileSent(path, args);
+		conn.sendQueued({ rpc: path, args });
+	};
+
 	/**
 	 * Attach per-call options. Returns a callable bound to those options.
 	 *
@@ -835,6 +904,23 @@ const _DEFAULT_UPLOAD_HIGH_WATER_MARK = 4 * 1024 * 1024;
 const _DEFAULT_UPLOAD_LOW_WATER_MARK = 1 * 1024 * 1024;
 const _UPLOAD_DRAIN_POLL_MS = 50;
 
+/** Default backpressure threshold for `.fireAndForget()`. When `conn.bufferedAmount`
+ * exceeds this, the volatile send is dropped silently and the drop counter
+ * ticks. Sized for 120Hz cursor + drag traffic (~24 KB/sec per client on
+ * volatile paths): 4 MB gives ~170s of buffer headroom before drops kick
+ * in - healthy demos never trip it; a genuinely dead connection does
+ * before browser OOM. Override via `configure({ volatileBackpressureBytes })`. */
+const _DEFAULT_VOLATILE_BACKPRESSURE_BYTES = 4 * 1024 * 1024;
+
+/** Volatile-send drop counter. Incremented when a `.fireAndForget()` call is
+ * dropped (offline, backpressure, terminated). Exposed to devtools as
+ * `__devtools.volatileDropped`. */
+let _volatileDropped = 0;
+
+/** Dev-warn dedup: one-shot warn when the first volatile backpressure drop
+ * happens, so apps notice in development that they're hitting the cap. */
+let _volatileBackpressureWarned = false;
+
 /** Server-discovered `platform.maxPayloadLength`. Updated whenever an upload
  * response arrives carrying `__cap`. 0 = not yet discovered. */
 let _discoveredUploadMaxFrameSize = 0;
@@ -3363,6 +3449,35 @@ export function batch(fn, options) {
 		return Promise.reject(new RpcError('INVALID_REQUEST', 'Batch exceeds maximum of 50 calls'));
 	}
 
+	const conn = _connect();
+	const effectiveTimeout = _getTimeout();
+
+	// Batch-of-1: send the bare RPC frame instead of wrapping in a batch
+	// envelope. Defensive callers (single writes wrapped in batch() for API
+	// symmetry) should not pay envelope cost or the round-trip of a batch
+	// response. The collected entry's pending entry was created with
+	// timer: null inside the call's __rpc path; attach a per-call timer
+	// here so the single call still times out cleanly.
+	if (collected.length === 1) {
+		const call = collected[0];
+		const _startTime = Date.now();
+		const sleepThreshold = Math.max(effectiveTimeout * 3, 90000);
+		const timer = setTimeout(() => {
+			const entry = pending.get(call.id);
+			if (!entry) return;
+			pending.delete(call.id);
+			if (Date.now() - _startTime > sleepThreshold) {
+				entry.reject(new RpcError('DISCONNECTED', 'Connection interrupted (device sleep)'));
+			} else {
+				entry.reject(new RpcError('TIMEOUT', `RPC '${call.rpc}' timed out after ${Math.round(effectiveTimeout / 1000)}s`));
+			}
+		}, effectiveTimeout);
+		const existing = pending.get(call.id);
+		if (existing) existing.timer = timer;
+		conn.sendQueued(call);
+		return Promise.all(promises);
+	}
+
 	// Set a batch-level timeout (sleep-aware)
 	const _batchStartTime = Date.now();
 	const batchTimer = setTimeout(() => {
@@ -3383,10 +3498,9 @@ export function batch(fn, options) {
 				entry.reject(new RpcError('TIMEOUT', `Batch timed out after 30s`));
 			}
 		}
-	}, _getTimeout());
+	}, effectiveTimeout);
 
 	// Send all calls as one frame
-	const conn = _connect();
 	const payload = { batch: collected };
 	if (options?.sequential) payload.sequential = true;
 	conn.sendQueued(payload);
@@ -3416,7 +3530,7 @@ function _checkArgs(path, args) {
  * @typedef {{ path: string, args: any[], queuedAt: number, resolve: Function, reject: Function, idempotencyKey?: string, timeout?: number }} OfflineEntry
  */
 
-/** @type {{ url?: string, auth?: boolean | string, onConnect?: () => void, onDisconnect?: () => void, timeout?: number, resumeGraceMs?: number, upload?: { frameSize?: number, chunkSize?: number, highWaterMark?: number, lowWaterMark?: number }, offline?: { queue?: boolean, maxQueue?: number, maxAge?: number, replay?: 'sequential' | 'batch' | ((queue: OfflineEntry[]) => OfflineEntry[]), beforeReplay?: (call: { path: string, args: any[], queuedAt: number }) => boolean, onReplayError?: (call: { path: string, args: any[], queuedAt: number }, error: any) => void } }} */
+/** @type {{ url?: string, auth?: boolean | string, onConnect?: () => void, onDisconnect?: () => void, timeout?: number, resumeGraceMs?: number, volatileBackpressureBytes?: number, upload?: { frameSize?: number, chunkSize?: number, highWaterMark?: number, lowWaterMark?: number }, offline?: { queue?: boolean, maxQueue?: number, maxAge?: number, replay?: 'sequential' | 'batch' | ((queue: OfflineEntry[]) => OfflineEntry[]), beforeReplay?: (call: { path: string, args: any[], queuedAt: number }) => boolean, onReplayError?: (call: { path: string, args: any[], queuedAt: number }, error: any) => void } }} */
 let _clientConfig = {};
 
 /** @type {boolean} */
@@ -3440,7 +3554,14 @@ let _replayingQueue = false;
  * window resumes from the retained seq/version/cursor so the server can
  * gap-fill instead of cold-rehydrating. Set to 0 to disable.
  *
- * @param {{ url?: string, auth?: boolean | string, onConnect?: () => void, onDisconnect?: () => void, timeout?: number, resumeGraceMs?: number, offline?: { queue?: boolean, maxQueue?: number, maxAge?: number, replay?: 'sequential' | 'batch' | ((queue: OfflineEntry[]) => OfflineEntry[]), beforeReplay?: (call: { path: string, args: any[], queuedAt: number }) => boolean, onReplayError?: (call: { path: string, args: any[], queuedAt: number }, error: any) => void } }} config
+ * `volatileBackpressureBytes` (default 4 MB) is the `WS.bufferedAmount`
+ * threshold at which `.fireAndForget()` sends are dropped silently and
+ * `__devtools.volatileDropped` increments. Sized for 120Hz cursor + drag
+ * traffic; raise it if your app legitimately bursts above 4 MB of in-flight
+ * volatile traffic, lower it on mobile-constrained targets where the OS
+ * send buffer is tighter.
+ *
+ * @param {{ url?: string, auth?: boolean | string, onConnect?: () => void, onDisconnect?: () => void, timeout?: number, resumeGraceMs?: number, volatileBackpressureBytes?: number, offline?: { queue?: boolean, maxQueue?: number, maxAge?: number, replay?: 'sequential' | 'batch' | ((queue: OfflineEntry[]) => OfflineEntry[]), beforeReplay?: (call: { path: string, args: any[], queuedAt: number }) => boolean, onReplayError?: (call: { path: string, args: any[], queuedAt: number }, error: any) => void } }} config
  */
 export function configure(config) {
 	_clientConfig = config;
@@ -3743,11 +3864,15 @@ const _DEFAULT_REDACT_KEYS = new Set([
 
 const _MAX_STREAM_EVENTS = 20;
 
+const _DEVTOOLS_VOLATILE_MAX = 100;
+
 /**
  * @type {{
  *   history: any[],
  *   streams: Map<string, any>,
  *   pending: Map<string, any>,
+ *   volatile: any[],
+ *   volatileDropped: number,
  *   redactKeys: Set<string>,
  *   paused: boolean
  * } | null}
@@ -3757,11 +3882,37 @@ export const __devtools = (typeof import.meta !== 'undefined' && !import.meta.en
 		history: new Array(50).fill(null),
 		streams: new Map(),
 		pending: new Map(),
+		volatile: new Array(_DEVTOOLS_VOLATILE_MAX).fill(null),
+		volatileDropped: 0,
 		redactKeys: new Set(_DEFAULT_REDACT_KEYS),
 		paused: false
 	}
 	: null;
 
+/** Ring buffer index for the devtools volatile send track. */
+let _devtoolsVolatileIdx = 0;
+let _devtoolsVolatileSeq = 0;
+
+/**
+ * Record a fire-and-forget RPC send for devtools. Send-only - there is no
+ * matching completion event because the wire shape carries no `id` and the
+ * server never replies. Ring buffer is bounded (`_DEVTOOLS_VOLATILE_MAX`,
+ * drop-oldest) so a high-frequency 60-120Hz mover can't anchor unbounded
+ * dev-mode memory.
+ * @param {string} path
+ * @param {any[]} args
+ */
+function _devtoolsVolatileSent(path, args) {
+	if (!__devtools) return;
+	__devtools.volatile[_devtoolsVolatileIdx] = {
+		path,
+		args,
+		time: Date.now(),
+		seq: ++_devtoolsVolatileSeq
+	};
+	_devtoolsVolatileIdx = (_devtoolsVolatileIdx + 1) % _DEVTOOLS_VOLATILE_MAX;
+}
+
 /**
  * Walk a value, replacing matched keys with `'[REDACTED]'`. Caps recursion
  * depth at 5 and array length at 50 so dev-only capture doesn't pin large

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svelte-realtime",
-  "version": "0.5.7",
+  "version": "0.5.8",
   "publishConfig": {
     "tag": "latest"
   },
@@ -89,12 +89,12 @@
   "peerDependencies": {
     "@sveltejs/kit": "^2.0.0",
     "svelte": "^4.0.0 || ^5.0.0",
-    "svelte-adapter-uws": "^0.5.1"
+    "svelte-adapter-uws": "^0.5.2"
   },
   "devDependencies": {
     "@playwright/test": "^1.59.1",
     "fast-check": "^4.7.0",
-    "svelte-adapter-uws-extensions": "^0.5.1",
+    "svelte-adapter-uws-extensions": "^0.5.2",
     "vitest": "^4.0.18"
   },
   "keywords": [

package/server.d.ts

@@ -958,6 +958,35 @@ export namespace live {
 	 */
 	function middleware(fn: (ctx: LiveContext<any>, next: () => Promise<any>) => Promise<any>): void;
 
+	/**
+	 * Mark a handler as fire-and-forget (volatile). The server still runs
+	 * the full middleware / guard / rate-limit / validation chain, but does
+	 * NOT write a response frame back. The matching client surface is
+	 * `rpc.fireAndForget(...args)`, which sends a no-id wire frame and
+	 * returns void synchronously.
+	 *
+	 * Use for high-frequency one-way RPCs where the caller has no reply
+	 * to await: cursor moves, drag updates, typing indicators, telemetry
+	 * beacons, heartbeats.
+	 *
+	 * Errors on a volatile call still run through the handler's error
+	 * path (metrics, server logs) but are not transmitted - per the
+	 * fire-and-forget contract.
+	 *
+	 * @param fn - Handler function (ctx, ...args)
+	 *
+	 * @example
+	 * ```js
+	 * export const moveCursor = live.volatile(async (ctx, boardId, pos) => {
+	 *   cursor.update(ctx.ws, `board:${boardId}`, pos, ctx.platform);
+	 * });
+	 *
+	 * // Client:
+	 * moveCursor.fireAndForget('board-1', { x: 100, y: 200 });
+	 * ```
+	 */
+	function volatile<T extends (ctx: LiveContext<any>, ...args: any[]) => any>(fn: T): T;
+
 	/**
 	 * Wrap a stream with a server-side gate predicate.
 	 * If the predicate returns false (or a `Promise` resolving to false),

package/server.js

@@ -2067,6 +2067,62 @@ live.public = function publicMarker(fn) {
 	return fn;
 };
 
+/**
+ * Mark a handler as fire-and-forget (volatile). The server still runs the
+ * full middleware / guard / rate-limit / validation chain, but does NOT
+ * write a response frame back. The client calls the handler via
+ * `.fireAndForget(...args)`, which sends a no-id wire frame and returns
+ * void synchronously.
+ *
+ * Use for high-frequency one-way RPCs where the caller has no reply to
+ * await: cursor moves, drag updates, typing indicators, telemetry beacons,
+ * heartbeats. The handler-level marker is intent + documentation; the wire
+ * shape (no `id` field) is the actual contract, so calling
+ * `.fireAndForget()` on a non-volatile handler also works (server processes
+ * it, just skips the reply). The marker exists so reviewers can see at a
+ * glance that a handler is intentionally one-way and that errors will not
+ * surface to the caller.
+ *
+ * Errors on a volatile call still run through the handler's error path
+ * (metrics, server logs) but are not transmitted - per the fire-and-forget
+ * contract. Pair with `live.rateLimit` + `ctx.shed` for admission control;
+ * shed volatile calls naturally have no caller to inform.
+ *
+ * @param {Function} fn - Handler function (ctx, ...args)
+ * @returns {Function}
+ *
+ * @example
+ * ```js
+ * // src/lib/realtime/cursors.js
+ * import { live } from 'svelte-realtime';
+ *
+ * export const moveCursor = live.volatile(async (ctx, boardId, pos) => {
+ *   cursor.update(ctx.ws, `board:${boardId}`, pos, ctx.platform);
+ * });
+ *
+ * // Client:
+ * import { moveCursor } from '$live/cursors';
+ * moveCursor.fireAndForget('board-1', { x: 100, y: 200 });  // no await, no reply
+ * ```
+ */
+live.volatile = function volatileMarker(fn) {
+	if (typeof fn !== 'function') {
+		throw new Error('[svelte-realtime] live.volatile(fn) requires a handler function');
+	}
+	/** @type {any} */ (fn).__isLive = true;
+	/** @type {any} */ (fn).__volatileRpc = true;
+	return fn;
+};
+
+/**
+ * Dev-mode warn dedup for fire-and-forget calls against non-volatile
+ * handlers. Bounded so a script-driven barrage doesn't anchor unbounded
+ * memory; first 256 distinct paths warn once each, then quiet.
+ * @type {Set<string>}
+ */
+const _volatileWarnSet = new Set();
+const _VOLATILE_WARN_CAP = 256;
+
 /**
  * Wraps a live() function with a sliding window rate limiter.
  *
@@ -6534,7 +6590,20 @@ export function handleRpc(ws, data, platform, options) {
 		return true;
 	}
 
-	if (typeof msg.rpc !== 'string' || typeof msg.id !== 'string') return false;
+	if (typeof msg.rpc !== 'string') return false;
+
+	// Volatile (fire-and-forget) RPC: frames with no `id` field signal
+	// "no reply expected". Server runs the full handler chain but skips
+	// the response emit. The wire shape (id absent) is the contract; the
+	// matching client surface is `rpc.fireAndForget(...)` plus the
+	// `live.volatile()` server-side marker.
+	if (msg.id === undefined) {
+		if (msg.rpc.length === 0) return false;
+		_executeVolatileRpc(ws, msg, platform, options);
+		return true;
+	}
+
+	if (typeof msg.id !== 'string') return false;
 
 	// envelope.shape invariant: rpc and id must be non-empty for routing
 	assert(msg.rpc.length > 0 && msg.id.length > 0, 'realtime/handleRpc.envelope.non-empty', { rpcLen: msg.rpc.length, idLen: msg.id.length });
@@ -6555,6 +6624,58 @@ async function _executeRpc(ws, msg, platform, options) {
 	_respond(ws, platform, msg.id, result);
 }
 
+/**
+ * Execute a fire-and-forget RPC. Runs the full handler chain (middleware,
+ * guards, rate limits, validation) but does NOT write a response frame.
+ * `msg.id` is absent on the wire; an internal correlation id is synthesized
+ * so metrics, devtools, and `_executeSingleRpc`'s response shape stay
+ * uniform without leaking onto the wire.
+ *
+ * Dev-mode warns once per non-volatile handler that receives a fire-and-forget
+ * call (bounded by `_VOLATILE_WARN_CAP` distinct paths) so accidental
+ * `.fireAndForget()` calls against handlers that have a meaningful return
+ * value surface in the server log.
+ *
+ * @param {any} ws
+ * @param {{ rpc: string, args?: any[] }} msg
+ * @param {import('svelte-adapter-uws').Platform} platform
+ * @param {{ beforeExecute?: (ws: any, rpcPath: string, args: any[]) => Promise<void> | void, onError?: (path: string, error: unknown, ctx: any) => void }} [options]
+ */
+async function _executeVolatileRpc(ws, msg, platform, options) {
+	if (_IS_DEV) {
+		const path = msg.rpc;
+		const fn = await _resolveRegistryEntry(path);
+		if (fn && !_hasVolatileMarker(fn) && !_volatileWarnSet.has(path)) {
+			if (_volatileWarnSet.size < _VOLATILE_WARN_CAP) _volatileWarnSet.add(path);
+			console.warn(
+				`[svelte-realtime] handler '${path}' received a fire-and-forget call but is not marked live.volatile(). ` +
+				"Errors will be silently dropped (no reply is sent). Wrap the handler with live.volatile() to make this intent explicit.\n  See: https://svti.me/volatile"
+			);
+		}
+	}
+	/** @type {any} */ (msg).id = '__volatile';
+	await _executeSingleRpc(ws, /** @type {any} */ (msg), platform, options);
+	// No _respond - fire-and-forget contract.
+}
+
+/**
+ * Walk the `__wrappedFn` chain produced by `live.rateLimit` / `live.idempotent`
+ * / `live.breaker` / `live.validated` / `live.lock` to find an inner
+ * `__volatileRpc` marker. Lets users wrap a `live.volatile(handler)` core
+ * with any combination of the other markers in any order without tripping
+ * the dev-mode "not marked volatile" warning. Bounded walk (depth 8) so a
+ * pathological cycle cannot loop forever.
+ * @param {any} fn
+ */
+function _hasVolatileMarker(fn) {
+	let cur = fn;
+	for (let i = 0; cur && i < 8; i++) {
+		if (cur.__volatileRpc) return true;
+		cur = cur.__wrappedFn;
+	}
+	return false;
+}
+
 /**
  * Execute a batch of RPC calls. Supports parallel (default) and sequential modes.
  *

package/vite.js

@@ -41,6 +41,11 @@ const PUBLIC_EXPORT_RE = /export\s+const\s+(\w+)\s*=\s*live\.public\s*\(/g;
 // module are intentionally public.
 const PUBLIC_COMMENT_RE = /(?:\/\/|\/\*)\s*realtime-allow-public\b/;
 const IDEMPOTENT_EXPORT_RE = /export\s+const\s+(\w+)\s*=\s*live\.idempotent\s*\(/g;
+// `live.volatile(...)` is the fire-and-forget RPC marker. From the client's
+// perspective the export is a normal RPC stub - the `.fireAndForget()` method
+// is attached by the `__rpc()` factory itself - so the codegen emits the same
+// `__rpc(...)` line as a plain `live()` export.
+const VOLATILE_EXPORT_RE = /export\s+const\s+(\w+)\s*=\s*live\.volatile\s*\(/g;
 
 const _validSegmentReVite = /^[a-zA-Z0-9_]+$/;
 
@@ -1097,7 +1102,7 @@ function _generateClientStubs(filePath, modulePath, dir) {
 	const hasPublicComment = PUBLIC_COMMENT_RE.test(source);
 	// live() and the wrappers that pass through unchanged on the client
 	// (validated/lock/idempotent/rateLimit/public) all emit the same __rpc line.
-	for (const re of [LIVE_EXPORT_RE, VALIDATED_EXPORT_RE, LOCK_EXPORT_RE, IDEMPOTENT_EXPORT_RE, RATE_LIMIT_EXPORT_RE, PUBLIC_EXPORT_RE]) {
+	for (const re of [LIVE_EXPORT_RE, VALIDATED_EXPORT_RE, LOCK_EXPORT_RE, IDEMPOTENT_EXPORT_RE, RATE_LIMIT_EXPORT_RE, PUBLIC_EXPORT_RE, VOLATILE_EXPORT_RE]) {
 		re.lastIndex = 0;
 		while ((match = re.exec(source)) !== null) {
 			const name = match[1];
@@ -1886,8 +1891,8 @@ function _generateRegistry(liveDir, dir, topicsRegistry) {
 		const registered = new Set();
 		let match;
 		// live() and the wrappers that share the plain __register line
-		// (validated/lock/idempotent/rateLimit).
-		for (const re of [LIVE_EXPORT_RE, VALIDATED_EXPORT_RE, LOCK_EXPORT_RE, IDEMPOTENT_EXPORT_RE, RATE_LIMIT_EXPORT_RE]) {
+		// (validated/lock/idempotent/rateLimit/volatile).
+		for (const re of [LIVE_EXPORT_RE, VALIDATED_EXPORT_RE, LOCK_EXPORT_RE, IDEMPOTENT_EXPORT_RE, RATE_LIMIT_EXPORT_RE, VOLATILE_EXPORT_RE]) {
 			re.lastIndex = 0;
 			while ((match = re.exec(source)) !== null) {
 				const name = match[1];
@@ -2381,6 +2386,24 @@ function _generateTypeDeclarations(liveDir, dir) {
 			}
 		}
 
+		// Detect live.volatile() exports - inner handler at arg index 0
+		// (same shape as plain live()). The .fireAndForget(...) method is
+		// attached by the __rpc(...) factory itself, so the generated stub
+		// types as the plain RPC signature; users get the method at runtime.
+		VOLATILE_EXPORT_RE.lastIndex = 0;
+		while ((match = VOLATILE_EXPORT_RE.exec(source)) !== null) {
+			const name = match[1];
+			handledNames.add(name);
+			if (!exports.some(e => e.includes(`export const ${name}:`))) {
+				if (isTS) {
+					const sig = _extractFunctionSignatureFor(source, name, 'live\\.volatile', 0);
+					exports.push(`  export const ${name}: ${sig};`);
+				} else {
+					exports.push(`  export const ${name}: (...args: any[]) => Promise<any>;`);
+				}
+			}
+		}
+
 		// Detect live.room() exports
 		ROOM_EXPORT_RE.lastIndex = 0;
 		while ((match = ROOM_EXPORT_RE.exec(source)) !== null) {