diff --git a/crates/connetto-client/src/lib.rs b/crates/connetto-client/src/lib.rs
index 8b8b4ad9..b3b47412 100644
--- a/crates/connetto-client/src/lib.rs
+++ b/crates/connetto-client/src/lib.rs
@@ -242,6 +242,9 @@ pub enum ClientError {
     /// meets this keeps working and retries when a transport arrives.
     #[error("not connected: this operation needs a server")]
     NotConnected,
+    /// The client's pump stopped on a fault no reconnect can cure, named here.
+    #[error("the client stopped: {0}")]
+    Stopped(String),
     /// Acquiring or refreshing the access token failed.
     #[error("authentication error: {0}")]
     Auth(String),
@@ -1156,6 +1159,13 @@ pub enum ClientEvent {
         /// Why the server closed the session.
         reason: FatalErrorReason,
     },
+    /// The pump stopped on a fault no reconnect can cure, and said which.
+    /// [`Closed`](Self::Closed) follows, and every live handle's `changed`
+    /// returns [`ClientError::Stopped`] from then on.
+    Stopped {
+        /// The fault, as text.
+        detail: String,
+    },
     /// The connection closed.
     Closed,
     /// The credential was rejected and refresh could not recover it, so the
diff --git a/crates/connetto-client/src/live.rs b/crates/connetto-client/src/live.rs
index ff505695..8a9c2425 100644
--- a/crates/connetto-client/src/live.rs
+++ b/crates/connetto-client/src/live.rs
@@ -25,7 +25,7 @@ use core::task::Poll;
 use core::time::Duration;
 use std::collections::{HashMap, HashSet};
 use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
-use std::sync::{Arc, Mutex as StdMutex, RwLock, Weak};
+use std::sync::{Arc, Mutex as StdMutex, OnceLock, RwLock, Weak};
 
 use connetto_core::messages::{BindValue, SubscriptionSpec};
 use connetto_core::quote_ident;
@@ -654,10 +654,12 @@ fn run_probe(conn: &mut SqliteConnection, probe: &str) -> Result<String, ClientE
 }
 
 /// Subscription ids and the wake signal shared with every [`LiveQuery`], so a
-/// synchronous `Drop` can queue its unsubscribe for the async pump.
+/// synchronous `Drop` can queue its unsubscribe for the async pump, and the
+/// fault that stopped the pump, if one did.
 struct Reaper {
     pending: StdMutex<Vec<String>>,
     wake: Arc<Notify>,
+    stopped: OnceLock<String>,
 }
 
 /// What [`LiveQuery`] and [`LiveValue`] both are underneath: a subscription
@@ -686,10 +688,15 @@ impl LiveHandleCore {
     }
 
     async fn changed(&mut self) -> Result<(), ClientError> {
-        self.changed
-            .changed()
-            .await
-            .map_err(|_| ClientError::Transport("live query driver stopped".to_owned()))
+        if let Some(detail) = self.reaper.stopped.get() {
+            return Err(ClientError::Stopped(detail.clone()));
+        }
+        self.changed.changed().await.map_err(|_| {
+            self.reaper.stopped.get().map_or_else(
+                || ClientError::Transport("live query driver stopped".to_owned()),
+                |detail| ClientError::Stopped(detail.clone()),
+            )
+        })
     }
 }
 
@@ -1389,6 +1396,7 @@ where
             reaper: Arc::new(Reaper {
                 pending: StdMutex::new(Vec::new()),
                 wake: Arc::clone(&wake),
+                stopped: OnceLock::new(),
             }),
             events,
             next_live: AtomicU64::new(1),
@@ -2733,7 +2741,7 @@ where
 /// A transport drop ends the pump, unless a reconnect driver is present, in
 /// which case the pump recovers: backoff, fresh transport, session resume,
 /// re-declared subscriptions. Local faults (session, apply, protocol) stay
-/// terminal either way.
+/// terminal either way and are announced as [`ClientEvent::Stopped`].
 async fn pump<T, F, S>(
     shared: Arc<Shared<T>>,
     alive: Weak<ClientToken>,
@@ -2784,12 +2792,16 @@ async fn pump<T, F, S>(
         let mut state = shared.state.lock().await;
 
         match drain_and_flush(&mut state, &shared, reconnect.is_some()).await {
-            PumpFlow::Proceed => {}
-            PumpFlow::Recover => {
+            Drained::Step => {}
+            Drained::Recover => {
                 needs_recovery = true;
                 continue;
             }
-            PumpFlow::Exit => return,
+            Drained::Fail(err) => {
+                drop(state);
+                pump_fail(&shared, err).await;
+                return;
+            }
         }
 
         // One cancellable pump step. A wake interrupts the idle wait so lock
@@ -2830,11 +2842,12 @@ async fn pump<T, F, S>(
                 continue;
             }
             PumpFlow::Exit => {
-                // The server ended the session with no driver to resume it, so
-                // the writes made meanwhile are queued for the next run.
-                if let Err(err) = state.conn.flush().await {
-                    tracing::warn!(error = %err, "queueing the last writes at exit failed");
-                }
+                end_unresumed(&mut state, &shared).await;
+                return;
+            }
+            PumpFlow::Fail(err) => {
+                drop(state);
+                pump_fail(&shared, err).await;
                 return;
             }
         }
@@ -2969,8 +2982,63 @@ enum PumpFlow {
     Proceed,
     /// The transport is gone. Recover at the top of the next iteration.
     Recover,
-    /// The pump has ended.
+    /// The session ended with no driver to resume it.
     Exit,
+    /// A fault no reconnect can cure ended the pump.
+    Fail(ClientError),
+}
+
+/// What the pump does once dropped handles are drained and local writes
+/// flushed. A session only ends on a step, so draining never ends the pump.
+enum Drained {
+    /// Take the pump step.
+    Step,
+    /// The transport is gone. Recover at the top of the next iteration.
+    Recover,
+    /// A fault no reconnect can cure ended the pump.
+    Fail(ClientError),
+}
+
+/// Queue the writes made meanwhile for the next run, then end the pump, when
+/// the session ended with no driver to resume it.
+async fn end_unresumed<T>(state: &mut State<T>, shared: &Shared<T>)
+where
+    T: Transport + MaybeSend + 'static,
+    T::Error: core::fmt::Display,
+{
+    if let Err(err) = state.conn.flush().await {
+        tracing::warn!(error = %err, "queueing the last writes at exit failed");
+    }
+    pump_finished(shared);
+}
+
+/// End the pump on a fault, queueing what can be queued, closing the
+/// transport, releasing every live handle with the fault, then announcing it
+/// and `Closed`.
+async fn pump_fail<T>(shared: &Arc<Shared<T>>, err: ClientError)
+where
+    T: Transport + MaybeSend + 'static,
+    T::Error: core::fmt::Display,
+{
+    let detail = err.to_string();
+    tracing::warn!(error = %detail, "the client pump stopped on a fault");
+    // Set before the senders drop, so a woken handle reads the fault.
+    let _ = shared.reaper.stopped.set(detail.clone());
+    let mut state = shared.state.lock().await;
+    if let Err(err) = state.conn.flush().await {
+        tracing::warn!(error = %err, "queueing the last writes at the fault failed");
+    }
+    let _ = state.conn.close().await;
+    // The closed socket is gone, so nothing later sends on it or reads the
+    // connection as live.
+    state.conn.disconnect();
+    state.registry.clear();
+    state.values.clear();
+    state.computed.clear();
+    drop(state);
+    let _ = shared.events.send(ClientEvent::Stopped { detail });
+    let _ = shared.events.send(ClientEvent::Closed);
+    pump_finished(shared);
 }
 
 /// Queue the last writes, close the transport, announce `Closed`, and end
@@ -3030,7 +3098,7 @@ async fn drain_and_flush<T>(
     state: &mut State<T>,
     shared: &Arc<Shared<T>>,
     has_driver: bool,
-) -> PumpFlow
+) -> Drained
 where
     T: Transport + MaybeSend + 'static,
     T::Error: core::fmt::Display,
@@ -3041,27 +3109,25 @@ where
     // nothing re-declares it.
     if let Err(err) = drain_dropped(&mut *state, &shared.reaper).await {
         if is_disconnect(&err) {
-            return PumpFlow::Recover;
+            return Drained::Recover;
         }
-        pump_finished(shared);
-        return PumpFlow::Exit;
+        return Drained::Fail(err);
     }
     // Auto-submit local writes committed since the last step. With no socket
     // this only queues them durably, which must not wait for a server.
     if let Err(err) = state.conn.flush().await {
         if is_disconnect(&err) {
-            return PumpFlow::Recover;
+            return Drained::Recover;
         }
-        pump_finished(shared);
-        return PumpFlow::Exit;
+        return Drained::Fail(err);
     }
     // No socket and a driver to find one, so go and find it. With no driver
     // there is nothing to recover to, so the pump falls through and parks,
     // which keeps device-private queries refreshing with no server at all.
     if has_driver && !state.conn.is_connected() {
-        return PumpFlow::Recover;
+        return Drained::Recover;
     }
-    PumpFlow::Proceed
+    Drained::Step
 }
 
 /// Route one pump step's result. A deliberate close tells the app why and
@@ -3086,7 +3152,6 @@ where
                 PumpFlow::Recover
             } else {
                 let _ = shared.events.send(ClientEvent::Closed);
-                pump_finished(shared);
                 PumpFlow::Exit
             }
         }
@@ -3095,7 +3160,6 @@ where
                 PumpFlow::Recover
             } else {
                 let _ = shared.events.send(ClientEvent::Closed);
-                pump_finished(shared);
                 PumpFlow::Exit
             }
         }
@@ -3121,8 +3185,7 @@ where
             if is_disconnect(&err) {
                 PumpFlow::Recover
             } else {
-                pump_finished(shared);
-                PumpFlow::Exit
+                PumpFlow::Fail(err)
             }
         }
     }
diff --git a/crates/connetto-client/tests/it/main.rs b/crates/connetto-client/tests/it/main.rs
index e53c11ec..b58c0cdc 100644
--- a/crates/connetto-client/tests/it/main.rs
+++ b/crates/connetto-client/tests/it/main.rs
@@ -68,6 +68,9 @@ mod never_synced;
 
 mod offline_start;
 
+#[cfg(feature = "native-auth")]
+mod pump_fault;
+
 mod reconnect_live;
 
 mod residual;
diff --git a/crates/connetto-client/tests/it/pump_fault.rs b/crates/connetto-client/tests/it/pump_fault.rs
new file mode 100644
index 00000000..3f263fab
--- /dev/null
+++ b/crates/connetto-client/tests/it/pump_fault.rs
@@ -0,0 +1,477 @@
+//! A pump that stops on a fault it cannot recover from says why and releases
+//! everything waiting on it.
+
+use connetto_client::{ClientBuilder, ClientError, ClientEvent, ConnettoClient, DataDir};
+use connetto_core::messages::{
+    BulkMessage, ControlMessage, FatalError, FatalErrorReason, HandshakeAck, LivePatch,
+};
+use connetto_core::traits::{IncomingFrame, Transport};
+use diesel::connection::SimpleConnection;
+use diesel::prelude::*;
+use parking_lot::Mutex;
+use std::collections::VecDeque;
+use std::future::ready;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::time::Duration;
+use tempfile::tempdir;
+
+const DDL: &str = "CREATE TABLE items (id INTEGER PRIMARY KEY, label TEXT)";
+const BOUND: Duration = Duration::from_secs(5);
+
+diesel::table! {
+    /// Synced test table.
+    items (id) {
+        /// Item identifier, the primary key
+        id -> Integer,
+        /// Optional item label
+        label -> Nullable<Text>,
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Queryable)]
+struct Item {
+    id: i32,
+    label: Option<String>,
+}
+
+/// A transport handing out queued frames, idling when none are queued, and
+/// recording the subscriptions it was sent and whether it was closed. Once
+/// told to drop, every send fails the way a dead socket does.
+#[derive(Clone, Default)]
+struct Script {
+    frames: Arc<Mutex<VecDeque<IncomingFrame>>>,
+    subscribed: Arc<Mutex<Vec<String>>>,
+    closed: Arc<AtomicBool>,
+    dropped: Arc<AtomicBool>,
+}
+
+/// The failure a send reports once the socket is gone.
+#[derive(Debug, thiserror::Error)]
+#[error("the socket is gone")]
+struct Gone;
+
+impl Script {
+    fn say(&self, frame: IncomingFrame) {
+        self.frames.lock().push_back(frame);
+    }
+
+    fn last_subscribed(&self) -> String {
+        self.subscribed
+            .lock()
+            .last()
+            .cloned()
+            .expect("the client subscribed")
+    }
+
+    /// A send fails once the socket is dropped or closed, as a real one does.
+    fn sent(&self) -> Result<(), Gone> {
+        if self.dropped.load(Ordering::Acquire) || self.closed.load(Ordering::Acquire) {
+            Err(Gone)
+        } else {
+            Ok(())
+        }
+    }
+}
+
+impl Transport for Script {
+    type Error = Gone;
+
+    fn send_control(
+        &mut self,
+        message: ControlMessage,
+    ) -> impl Future<Output = Result<(), Self::Error>> {
+        if let ControlMessage::Subscribe(subscribe) = message {
+            self.subscribed.lock().push(subscribe.sub_id);
+        }
+        ready(self.sent())
+    }
+
+    fn send_bulk(
+        &mut self,
+        _message: BulkMessage,
+    ) -> impl Future<Output = Result<(), Self::Error>> {
+        ready(self.sent())
+    }
+
+    fn recv(&mut self) -> impl Future<Output = Result<Option<IncomingFrame>, Self::Error>> {
+        let frames = Arc::clone(&self.frames);
+        async move {
+            loop {
+                if let Some(frame) = frames.lock().pop_front() {
+                    return Ok(Some(frame));
+                }
+                tokio::task::yield_now().await;
+            }
+        }
+    }
+
+    fn close(&mut self) -> impl Future<Output = Result<(), Self::Error>> {
+        self.closed.store(true, Ordering::Release);
+        ready(Ok(()))
+    }
+}
+
+fn ack() -> IncomingFrame {
+    IncomingFrame::Control(ControlMessage::HandshakeAck(HandshakeAck {
+        connection_id: "script".to_owned(),
+        session_token: "script".to_owned(),
+        resume_token: "script".to_owned(),
+        current_cursor: connetto_core::Cursor::from(Vec::new()),
+        schema_version: None,
+        initial_credits: 64,
+        last_applied_seq: None,
+    }))
+}
+
+async fn client() -> (
+    ConnettoClient<Script>,
+    Script,
+    tempfile::TempDir,
+    tokio::task::JoinHandle<()>,
+) {
+    let dir = tempdir().expect("temp dir");
+    let script = Script::default();
+    script.say(ack());
+    let credential = super::support::held("tester");
+    let key_store = super::support::key_store(&credential).await;
+    let (running, pump) = ClientBuilder::new(
+        super::support::bundle(DDL),
+        super::support::Once::new(script.clone()),
+    )
+    .signed_in(credential)
+    .durable(DataDir::new(dir.path().to_path_buf()), key_store)
+    .connect_with_pump()
+    .await
+    .expect("the builder connects");
+    let pump = tokio::spawn(pump);
+    (running.client().clone(), script, dir, pump)
+}
+
+/// A client built with no reconnect driver, so its pump ends at once when
+/// the server closes the session.
+async fn client_no_driver() -> (
+    ConnettoClient<Script>,
+    Script,
+    tempfile::TempDir,
+    tokio::task::JoinHandle<()>,
+) {
+    let dir = tempdir().expect("temp dir");
+    let script = Script::default();
+    script.say(ack());
+    let credential = super::support::held("tester");
+    let key_store = super::support::key_store(&credential).await;
+    let probe = script.clone();
+    let mut conn = ClientBuilder::new(
+        super::support::bundle(DDL),
+        super::support::Once::new(script.clone()),
+    )
+    .signed_in(credential)
+    .durable(DataDir::new(dir.path().to_path_buf()), key_store)
+    .open_driven()
+    .await
+    .expect("the builder opens the replica");
+    conn.attach(script).await.expect("the handshake completes");
+    let (running, pump) = ConnettoClient::with_pump(conn);
+    let pump = tokio::spawn(pump);
+    (running, probe, dir, pump)
+}
+
+/// Every event up to and including `Closed`.
+async fn until_closed(
+    events: &mut tokio::sync::broadcast::Receiver<ClientEvent>,
+) -> Vec<ClientEvent> {
+    let mut seen = Vec::new();
+    loop {
+        let event = tokio::time::timeout(BOUND, events.recv())
+            .await
+            .expect("the pump announces its end in time")
+            .expect("the event stream stays open");
+        let closed = event == ClientEvent::Closed;
+        seen.push(event);
+        if closed {
+            return seen;
+        }
+    }
+}
+
+/// A live patch whose bytes are not zstd fails to apply, a local fault no
+/// reconnect can cure, so the pump ends. It announces why before `Closed`,
+/// closes the transport, and a handle waiting for its next change is told,
+/// as is one opened after the stop.
+#[tokio::test]
+async fn a_fault_that_stops_the_pump_is_announced_and_releases_waiting_handles() {
+    let (client, script, _dir, _pump) = client().await;
+    let mut events = client.events();
+    let mut query = client
+        .watch::<_, Item>(items::table.order(items::id))
+        .await
+        .expect("watch the synced table");
+    let waiting = tokio::spawn(async move { query.changed().await });
+    tokio::task::yield_now().await;
+    assert!(
+        !waiting.is_finished(),
+        "the handle is waiting before the fault"
+    );
+
+    script.say(IncomingFrame::Bulk(BulkMessage::LivePatch(LivePatch::new(
+        script.last_subscribed(),
+        connetto_core::Cursor::from(vec![0, 0, 0, 0, 0, 0, 1, 0]),
+        b"not a zstd frame".to_vec(),
+    ))));
+
+    let seen = until_closed(&mut events).await;
+    let stopped = seen
+        .iter()
+        .position(|event| matches!(event, ClientEvent::Stopped { .. }));
+    assert_eq!(
+        stopped,
+        Some(seen.len() - 2),
+        "the cause is announced right before Closed, saw {seen:?}"
+    );
+
+    let outcome = tokio::time::timeout(BOUND, waiting)
+        .await
+        .expect("the waiting handle is released in time")
+        .expect("the waiting task completes");
+    assert!(
+        matches!(outcome, Err(ClientError::Stopped(_))),
+        "the waiter learns the pump stopped, got {outcome:?}"
+    );
+    assert!(
+        script.closed.load(Ordering::Acquire),
+        "the transport is closed"
+    );
+
+    // A query the server never saw, so nothing already on the wire serves it.
+    let mut late = client
+        .watch::<_, Item>(items::table.filter(items::id.gt(0)).order(items::id))
+        .await
+        .expect("a watch after the stop still answers locally");
+    let late_outcome = tokio::time::timeout(BOUND, late.changed())
+        .await
+        .expect("a handle opened after the stop is told at once");
+    assert!(
+        matches!(late_outcome, Err(ClientError::Stopped(_))),
+        "got {late_outcome:?}"
+    );
+    tokio::time::timeout(BOUND, client.close())
+        .await
+        .expect("close returns at once after the stop");
+}
+
+/// A table without a primary key is created mid-run, so the next auto-submit
+/// refuses to upload anything. The fault is caught on the drain side, before
+/// the pump step, and still announces the stop, closes the transport, and
+/// releases the live handle.
+#[tokio::test]
+async fn a_local_fault_on_the_drain_side_stops_the_pump_the_same_way() {
+    let (client, script, _dir, _pump) = client().await;
+    let mut events = client.events();
+    let mut query = client
+        .watch::<_, Item>(items::table.order(items::id))
+        .await
+        .expect("watch the synced table");
+
+    client
+        .with_conn(|conn| {
+            diesel::insert_into(items::table)
+                .values((items::id.eq(1), items::label.eq("seeded")))
+                .execute(conn.conn())
+                .expect("write the row")
+        })
+        .await
+        .expect("the write lands locally");
+    client
+        .with_conn(|conn| {
+            SimpleConnection::batch_execute(conn.conn(), "CREATE TABLE loose (label TEXT)")
+                .expect("the application creates its own table");
+        })
+        .await
+        .expect("the table lands locally");
+
+    let seen = until_closed(&mut events).await;
+    let stopped = seen
+        .iter()
+        .position(|event| matches!(event, ClientEvent::Stopped { .. }))
+        .unwrap_or_else(|| panic!("the fault is announced, saw {seen:?}"));
+    assert_eq!(
+        stopped,
+        seen.len() - 2,
+        "the cause is announced right before Closed, saw {seen:?}"
+    );
+    let detail = match &seen[stopped] {
+        ClientEvent::Stopped { detail } => detail.clone(),
+        _ => unreachable!("the position was matched above"),
+    };
+    assert!(
+        detail.contains("loose"),
+        "the refusal names the table, got {detail}"
+    );
+
+    let outcome = tokio::time::timeout(BOUND, query.changed())
+        .await
+        .expect("the handle is released in time")
+        .expect_err("the handle learns the pump stopped");
+    assert!(
+        matches!(outcome, ClientError::Stopped(_)),
+        "got {outcome:?}"
+    );
+    assert!(
+        script.closed.load(Ordering::Acquire),
+        "the transport is closed"
+    );
+    let rows: Vec<Item> = client
+        .with_conn(|conn| {
+            items::table
+                .order(items::id)
+                .load(conn.conn())
+                .expect("the replica answers")
+        })
+        .await
+        .expect("the replica keeps serving the offline half");
+    assert_eq!(rows.len(), 1, "the last rows stay readable");
+    tokio::time::timeout(BOUND, client.close())
+        .await
+        .expect("close returns at once after the stop");
+}
+
+/// Every event up to the driver's first redial, refusing a stop on the way.
+async fn until_reconnecting(events: &mut tokio::sync::broadcast::Receiver<ClientEvent>) {
+    let mut seen = Vec::new();
+    loop {
+        let event = tokio::time::timeout(BOUND, events.recv())
+            .await
+            .unwrap_or_else(|_| panic!("the driver redials in time, saw {seen:?}"))
+            .expect("the event stream stays open");
+        assert!(
+            !matches!(event, ClientEvent::Stopped { .. } | ClientEvent::Closed),
+            "a lost socket is recovered, never a stop, saw {seen:?} then {event:?}"
+        );
+        if matches!(event, ClientEvent::Reconnecting { .. }) {
+            return;
+        }
+        seen.push(event);
+    }
+}
+
+/// The socket dies as a local write is uploaded. That is a transport to go
+/// and find, so the driver redials and the pump never announces a stop.
+#[tokio::test]
+async fn a_socket_lost_while_uploading_a_write_is_recovered() {
+    let (client, script, _dir, _pump) = client().await;
+    let mut events = client.events();
+    script.dropped.store(true, Ordering::Release);
+    client
+        .with_conn(|conn| {
+            diesel::insert_into(items::table)
+                .values((items::id.eq(1), items::label.eq("offline")))
+                .execute(conn.conn())
+                .expect("write the row")
+        })
+        .await
+        .expect("the write lands locally");
+    until_reconnecting(&mut events).await;
+}
+
+/// The server ends the session with no reconnect driver to resume it, so the
+/// pump queues the last writes and ends without announcing a fault. The
+/// replica stays readable, and the end is signalled to `close`.
+#[tokio::test]
+async fn a_server_close_with_no_driver_ends_the_pump_and_keeps_the_replica_readable() {
+    let (client, script, _dir, _pump) = client_no_driver().await;
+    let mut events = client.events();
+    client
+        .with_conn(|conn| {
+            diesel::insert_into(items::table)
+                .values((items::id.eq(1), items::label.eq("kept")))
+                .execute(conn.conn())
+                .expect("write the row")
+        })
+        .await
+        .expect("the write lands locally");
+
+    script.say(IncomingFrame::Control(ControlMessage::FatalError(
+        FatalError::new(FatalErrorReason::ServerShuttingDown),
+    )));
+
+    let seen = until_closed(&mut events).await;
+    assert!(
+        seen.iter()
+            .all(|event| !matches!(event, ClientEvent::Stopped { .. })),
+        "a server close is not a fault, saw {seen:?}"
+    );
+    assert!(
+        matches!(
+            seen[seen.len() - 2],
+            ClientEvent::ServerClosed {
+                reason: FatalErrorReason::ServerShuttingDown
+            }
+        ),
+        "the reason comes right before Closed, saw {seen:?}"
+    );
+    tokio::time::timeout(BOUND, client.close())
+        .await
+        .expect("the pump's end is signalled to close");
+    let rows: Vec<Item> = client
+        .with_conn(|conn| {
+            items::table
+                .order(items::id)
+                .load(conn.conn())
+                .expect("the replica answers")
+        })
+        .await
+        .expect("the replica keeps serving the offline half");
+    assert_eq!(rows.len(), 1, "the last rows stay readable");
+}
+
+/// Dropping every client clone ends the pump with a graceful close, no
+/// fault, so a handle that outlives them learns about it through the watch
+/// sender going away, not through the fault record.
+#[tokio::test]
+async fn a_handle_outliving_every_clone_falls_back_to_the_driver_stop() {
+    let (client, script, _dir, pump) = client().await;
+    let mut events = client.events();
+    let mut query = client
+        .watch::<_, Item>(items::table.order(items::id))
+        .await
+        .expect("watch the synced table");
+    client
+        .with_conn(|conn| {
+            diesel::insert_into(items::table)
+                .values((items::id.eq(1), items::label.eq("kept")))
+                .execute(conn.conn())
+                .expect("write the row")
+        })
+        .await
+        .expect("the write lands locally");
+    // The local write refreshes the watch before the clones go, so the
+    // handle rests on the row when the pump ends.
+    tokio::time::timeout(BOUND, query.changed())
+        .await
+        .expect("the local write refreshes the watch in time")
+        .expect("the refresh signals the handle");
+
+    drop(client);
+    pump.await.expect("the pump task ends");
+
+    let seen = until_closed(&mut events).await;
+    assert!(
+        seen.iter()
+            .all(|event| !matches!(event, ClientEvent::Stopped { .. })),
+        "a graceful close announces no fault, saw {seen:?}"
+    );
+    let outcome = query.changed().await;
+    assert!(
+        matches!(
+            &outcome,
+            Err(ClientError::Transport(detail)) if detail == "live query driver stopped"
+        ),
+        "a faultless end reports the driver stop, got {outcome:?}"
+    );
+    assert_eq!(query.rows().len(), 1, "the last rows stay readable");
+    assert!(
+        script.closed.load(Ordering::Acquire),
+        "the transport is closed"
+    );
+}
diff --git a/docs/architecture/13-client-connection.md b/docs/architecture/13-client-connection.md
index 2cf1ee04..52a538bb 100644
--- a/docs/architecture/13-client-connection.md
+++ b/docs/architecture/13-client-connection.md
@@ -210,6 +210,8 @@ A connection is constructed without a transport and given one later. A builder's
 
 **A subscription can be declared with no server.** It is recorded in the replica and sent on the first connection, so `watch` no longer fails while the transport is down. A pump with no socket parks rather than failing, which is what an idle socket does anyway: treating a missing transport as an error ended the pump on its first step and silently stopped device-private queries refreshing for an application that has no server at all.
 
+**A fault that stops the pump is announced.** A disconnect is the reconnect driver's to recover, while a local fault (an apply, session or protocol error) ends the pump with or without a driver. That end queues the last writes, closes the transport, and emits `ClientEvent::Stopped` with the fault's text followed by `ClientEvent::Closed`, so every wait keyed on `Closed`, a content ticket's among them, settles. Every live handle's `changed()`, pending or called later, returns `ClientError::Stopped`, while its last rows stay readable and `with_conn` keeps serving the replica, the offline half `close()` leaves too.
+
 ## Framework adapters: `connetto-dioxus` and `connetto-yew`
 
 **Built.** Two single-file crates wrap `ConnettoClient`'s live-query API as UI framework hooks.
diff --git a/examples/dioxus-desktop-demo/src/main.rs b/examples/dioxus-desktop-demo/src/main.rs
index efe0a7fc..5a8b0712 100644
--- a/examples/dioxus-desktop-demo/src/main.rs
+++ b/examples/dioxus-desktop-demo/src/main.rs
@@ -620,6 +620,7 @@ fn status_label(event: &ClientEvent) -> Option<String> {
         ClientEvent::ServerClosed { reason } => {
             Some(format!("server closed the connection: {reason:?}"))
         }
+        ClientEvent::Stopped { detail } => Some(format!("the client stopped: {detail}")),
         ClientEvent::Closed => Some("connection closed".to_owned()),
         ClientEvent::AuthenticationRequired => {
             Some("session expired, sign out and sign in again".to_owned())
@@ -1272,6 +1273,11 @@ fn App() -> Element {
                 if let Some(label) = status_label(&event) {
                     status.set(label);
                 }
+                // The stop names its cause, and the `Closed` that follows it
+                // would only replace that.
+                if matches!(event, ClientEvent::Stopped { .. }) {
+                    break;
+                }
             }
         })
     });
diff --git a/examples/dioxus-web-demo/src/main.rs b/examples/dioxus-web-demo/src/main.rs
index 7c98f899..ab176ff6 100644
--- a/examples/dioxus-web-demo/src/main.rs
+++ b/examples/dioxus-web-demo/src/main.rs
@@ -527,6 +527,7 @@ fn status_label(event: &ClientEvent) -> Option<String> {
         ClientEvent::ServerClosed { reason } => {
             Some(format!("server closed the session: {reason:?}"))
         }
+        ClientEvent::Stopped { detail } => Some(format!("the client stopped: {detail}")),
         ClientEvent::Closed => Some("connection closed".to_owned()),
         _ => None,
     }
@@ -777,6 +778,11 @@ fn App() -> Element {
                         if let Some(label) = status_label(&event) {
                             status.set(label);
                         }
+                        // The stop names its cause, and the `Closed` that
+                        // follows it would only replace that.
+                        if matches!(event, ClientEvent::Stopped { .. }) {
+                            break;
+                        }
                     }
                 }
                 Err(err) => status.set(format!("boot failed: {err:?}")),
diff --git a/examples/tauri-leptos-demo/src-tauri/src/lib.rs b/examples/tauri-leptos-demo/src-tauri/src/lib.rs
index eb4d936b..ee288c3b 100644
--- a/examples/tauri-leptos-demo/src-tauri/src/lib.rs
+++ b/examples/tauri-leptos-demo/src-tauri/src/lib.rs
@@ -456,6 +456,7 @@ fn status_label(event: &ClientEvent) -> Option<String> {
             ),
             other => format!("server closed the connection: {other:?}"),
         }),
+        ClientEvent::Stopped { detail } => Some(format!("the client stopped: {detail}")),
         ClientEvent::Closed => Some("connection closed".to_owned()),
         ClientEvent::AuthenticationRequired => {
             Some("session expired, sign out and sign in again".to_owned())
@@ -600,6 +601,11 @@ async fn feed_events(app: AppHandle, core: Arc<Core>, client: ConnettoClient<Ws>
                 view.status = status;
             }
         });
+        // The stop names its cause, and the `Closed` that follows it would
+        // only replace that.
+        if matches!(event, ClientEvent::Stopped { .. }) {
+            break;
+        }
     }
 }
 
diff --git a/examples/yew-web-demo/src/main.rs b/examples/yew-web-demo/src/main.rs
index 65800c96..859ceb83 100644
--- a/examples/yew-web-demo/src/main.rs
+++ b/examples/yew-web-demo/src/main.rs
@@ -484,6 +484,7 @@ fn status_label(event: &ClientEvent) -> Option<String> {
         ClientEvent::ServerClosed { reason } => {
             Some(format!("server closed the session: {reason:?}"))
         }
+        ClientEvent::Stopped { detail } => Some(format!("the client stopped: {detail}")),
         ClientEvent::Closed => Some("connection closed".to_owned()),
         _ => None,
     }
@@ -758,6 +759,11 @@ fn use_boot_window_effect(
                         if let Some(label) = status_label(&event) {
                             status.set(label);
                         }
+                        // The stop names its cause, and the `Closed` that
+                        // follows it would only replace that.
+                        if matches!(event, ClientEvent::Stopped { .. }) {
+                            break;
+                        }
                     }
                 }
                 Err(err) => status.set(format!("boot failed: {err:?}")),