A sound implementation does not ask users to refresh until it works. Each phase has an input, an output, a timeout, and a terminal state. Pub/Sub usually broadcasts transient events rather than durable history. Consumers use channel epochs and sequence numbers to detect gaps and fetch an authoritative snapshot.
A real-time backend needs coherent semantics for identity, ordering, backpressure, and reconnects. Every message needs a session version, replay rule, and bounded outcome for slow consumers.
Define the system contract first
Write the following choices as reviewable rules instead of scattering them across callbacks and UI conditions. Explicit rules make scaling, compatibility, and diagnosis less dependent on guesswork.
- Establish a new subscription and confirm its starting sequence before releasing the old one; apply events by entityVersion and tolerate duplicates.
- Give state one owner, a version, and terminal states; callbacks may mutate only the version that created them.
- Ship conservative defaults, server-side ceilings, and a rollout switch instead of trusting browser-provided numbers as resource budgets.
The delivery standard for Real-Time Pub/Sub Fanout Under Subscription Changes and Reordering is a usable normal path, convergent failures, bounded resources, and a state users can understand. The result is a production capability that can be explained, degraded safely, and rolled back—not a demo that works once.
What can break that contract
An abnormal path is more than an error banner. It decides how in-flight work stops, how the peer learns the outcome, what residue remains, and whether the next operation inherits it.
- Unsubscribing before the new subscription opens creates a silent gap, while treating Redis arrival order as business order overwrites fresh state after migration.
- Refresh and network change start two recovery paths, and duplicate side effects look like two genuine user actions.
- User or task IDs in metric labels create high-cardinality cost and leak unnecessary identity into diagnostics.
How to test the contract line by line
Build golden cases from known inputs and controlled faults, then align production metrics with those results. Verification extends to production only when signals detect the same degradation early.
- Migrate a live connection, restart a subscriber, and duplicate or swap events during publishing; final snapshot, presence count, and session state must agree.
- Drive the state machine with reordered, duplicate, and delayed messages, proving stale versions are ignored and explicit stop survives recovery.
- Cover direct, relayed, weak-network, background-tab, and mobile paths; do not rely on averages or one successful screenshot.
The release standard is practical: the normal path is fast, abnormal paths converge, recovery never overrides an explicit user decision, and operators can diagnose faults from limited, privacy-safe evidence.