In-process synchronous bus: publishing awaits every consumer so persistence is deterministic for the desktop app. A failing consumer is isolated (its exception is swallowed) so one bad sink never breaks a producer's turn.