2026.09.11 — 2026-09-07

Added

• Close a connection, a session, or an address's consumers (b91c6d88)

  Studio could tell you which consumer was holding up a queue and could list every connection behind it. It could not do the one thing that finding implies. Closing a wedged consumer's connection returns its in-flight messages to the queue so a healthy instance can take them — the most common 3am intervention on an Artemis cluster, and the reason people kept a JMX console open next to Studio.

  The connections, sessions and consumers views gain a row action; the addresses view gains a cluster-wide "close consumers" action. All four preview before they act.

  What to know before you use it:

  • A close by id names a node. This is the one mutating route in Studio that is not a cluster-wide fan-out. A connection identifier is issued by, and meaningful only on, the node that accepted the connection. Only the address-scoped close names a cluster, and it reports per node.
  • A target that has already gone is a success, not an error. Rows come from a cache, so by the time you click, the connection may be gone. The requested state — that connection is not open — holds. Nothing retries: an identifier can be reissued, so a retry may land on a different application.
  • Closing a consumer moves messages. Its in-flight messages return to their queue with an increased delivery count, which can push one past its maximum delivery attempts and into the dead-letter queue. The confirmation states this, with the count where the broker reports it and an explicit "not reported" where it does not.
  • You confirm against the client id, not the connection id. An operator cannot verify that a3f1c9de is the right connection; they can recognise a client id or a remote address. The audit row records the same, read immediately before the close, because afterwards the identifier resolves to nothing.
  • The address-scoped close is capped. It previews per node and is refused above safety.bulk-cap without an explicit override. A node that could not be counted also demands the override: an incomplete total is a floor, not a figure, and passing the cap on the nodes that happened to answer would wave through exactly the close whose blast radius is unknown.

  A new permission, connection:close. Grant it explicitly — no message or queue permission implies it. Authority over a cluster's messages says nothing about authority to disconnect the applications producing them.

  MCP gains connection_action, declared destructive and not idempotent, previewing by default. Its confirmation is the client id the preview returned, so a model that guesses cannot close anything.

  There is deliberately no "close all slow consumers". Slow-consumer detection has false positives by construction, and an operation that selects its own targets from a heuristic turns every one of them into a disconnected production application. Detection informs; you name the target.

  See ADR-0057.