I tested a prototype against both cases. Compatible operations are replayed correctly after the server snapshot, while edits targeting a deleted block are preserved in a recovery draft. One remaining question is how long those recovery drafts should be retained.

Drift can guarantee bounded write buffering and signal an explicit slow-consumer error once the limit is reached. I agree that disconnecting is safer than silently dropping messages; Rivet can then expose the reason to the channel subscriber.

Confirmed in Rivet: subscription restoration can consume the same resume token twice when the transport reconnects before the previous restoration completes. I’ll add a guard to make token consumption idempotent.