2026.09.11

Added

• Close a connection, a session, or an address's consumers (b91c6d88)

  Studio could tell you which consumer was holding up a queue and could list
  every connection behind it. It could not do the one thing that finding
  implies. Closing a wedged consumer's connection returns its in-flight
  messages to the queue so a healthy instance can take them — the most common
  3am intervention on an Artemis cluster, and the reason people kept a JMX
  console open next to Studio.

  The connections, sessions and consumers views gain a row action; the
  addresses view gains a cluster-wide "close consumers" action. All four
  preview before they act.

  What to know before you use it:

  • A close by id names a node. This is the one mutating route in Studio
    that is not a cluster-wide fan-out. A connection identifier is issued by,
    and meaningful only on, the node that accepted the connection. Only the
    address-scoped close names a cluster, and it reports per node.
  • A target that has already gone is a success, not an error. Rows come
    from a cache, so by the time you click, the connection may be gone. The
    requested state — that connection is not open — holds. Nothing retries: an
    identifier can be reissued, so a retry may land on a different application.
  • Closing a consumer moves messages. Its in-flight messages return to
    their queue with an increased delivery count, which can push one past its
    maximum delivery attempts and into the dead-letter queue. The confirmation
    states this, with the count where the broker reports it and an explicit
    "not reported" where it does not.
  • You confirm against the client id, not the connection id. An operator
    cannot verify that a3f1c9de is the right connection; they can recognise a
    client id or a remote address. The audit row records the same, read
    immediately before the close, because afterwards the identifier resolves to
    nothing.
  • The address-scoped close is capped. It previews per node and is refused
    above safety.bulk-cap without an explicit override. A node that could not
    be counted also demands the override: an incomplete total is a floor, not a
    figure, and passing the cap on the nodes that happened to answer would wave
    through exactly the close whose blast radius is unknown.

  A new permission, connection:close. Grant it explicitly — no message or
  queue permission implies it. Authority over a cluster's messages says nothing
  about authority to disconnect the applications producing them.

  MCP gains connection_action, declared destructive and not idempotent,
  previewing by default. Its confirmation is the client id the preview
  returned, so a model that guesses cannot close anything.

  There is deliberately no "close all slow consumers". Slow-consumer detection
  has false positives by construction, and an operation that selects its own
  targets from a heuristic turns every one of them into a disconnected
  production application. Detection informs; you name the target.

  See ADR-0057.