Here's an idea. Because we set a `last_good` value automatically for the last time the connection was successful, would it make sense to have a timer say every `N` minutes firing off per drain. When it fires, it checks whether `last_good` is too far in the past, and if so, it forces a disconnection all the same.

This would entirely decouple the load from the number of messages in the system to the number of drains at every interval, which should easily give us an order of magnitude fewer timers in production.