@fungi.computer/carrier 0.2.1 → 0.2.2

package/README.md

@@ -92,23 +92,6 @@ from the Durable Object alarm.
 
 In a Durable Object, `ctx.storage` is already the SQLite owner.
 
-### Memory outbox for tests
-
-`createMemoryOutbox()` stores encoded string rows in process memory for tests
-and quick starts. It provides `put`, `read`, key-ordered `list(limit, afterKey)`
-and `delete`. Each instance is independent; it is not durable storage. BirdDog’s
-[quick start](https://docs.fungi.computer/bird-dog/quickstart/) uses this
-helper.
-
-```ts
-import { createMemoryOutbox } from "@fungi.computer/carrier/testing";
-
-const outbox = createMemoryOutbox();
-await outbox.put("mail:one", "encoded mail");
-console.log(await outbox.list(1));
-// [{ key: "mail:one", value: "encoded mail" }]
-```
-
 ## Core concepts
 
 **Emails and Messages.** One Email has shared content and an envelope: `from`,
@@ -212,15 +195,18 @@ dead-letter reason. They omit Post addresses and events, email bodies, headers
 and recipient addresses. Delivered Post rows keep only their key and state.
 Email `attempts` counts definite provider rejections, so an accepted or
 ambiguous first dispatch has zero. Post `attempts` counts receiver invocations.
+Carrier's stored Post `attempts` is receipt-only evidence after a terminal
+outcome. While delivery is pending, Watchdog's `attempt_count` is authoritative;
+pending inspection reads that count from Watchdog.
 
 ## Post
 
-Post's ordinary retry policy uses Almanac's shared pure backoff calculation: 2
-seconds initially, doubling to a 5-minute cap, with at most 20 receiver
-attempts. The synchronous and SQL adapters share that default policy; explicit
-SQL retry policies retain their own delays. A SQLite route with `deadlineMs`
-uses its finite lifetime instead of the attempt ceiling. Almanac supplies
-arithmetic only, not a second scheduler or retry owner.
+Watchdog applies Post's ordinary retry policy using Almanac's backoff
+calculation: 2 seconds initially, doubling to a 5-minute cap, with at most 20
+receiver attempts. The synchronous and SQL adapters share that default policy;
+explicit SQL retry policies retain their own delays. A SQLite route with
+`deadlineMs` uses its finite lifetime instead of the attempt ceiling. Almanac
+supplies arithmetic only, not a second scheduler or retry owner.
 
 `@fungi.computer/carrier/post` delivers typed, point-to-point envelopes between
 named Durable Objects. `definePostRoute` pairs each address schema and event
@@ -237,29 +223,27 @@ admission receipt commit together. Keys must identify the producing event across
 all senders to that receiver.
 
 Construct `createPost` with the producer's structural SQLite `owner`, typed
-`routes`, Watchdog's `transactional` projection and `readJob` operation, a
-clock, and a durable `scheduleWake`. Post owns its tables. Call `send` inside
-the same transaction as the producer's state change and durable initial wake. It
-commits the envelope and Watchdog delivery work together. Each producer's events
-reach a named address in order. A pending predecessor holds its successor until
-it is delivered or dead. Replaying the same stable key keeps the existing work
-or its completion receipt. Keep those receipts while the source can replay.
-
-Use `execute` as the Watchdog executor for Post jobs. It records an attempt and
-arms recovery before calling the addressed Durable Object. After the owner ticks
-Watchdog, call `enqueueDue` at a wake to inspect settled jobs and enqueue due
-retries, then tick Watchdog for the newly queued work. Continue its bounded
-pages with the returned cursor. Queued or running jobs stay with Watchdog's
-lifecycle. A missing job or row is an error. After a lost response or failed
-receipt write, a retry carries the same envelope key and the receiver reports
-`duplicate`.
+`routes`, Watchdog's `transactional` projection, a clock, and a durable
+`scheduleWake`. Post owns its tables. Call `send` inside the same transaction as
+the producer's state change and durable initial wake. It commits the envelope
+and Watchdog delivery work together. Each producer's events reach a named
+address in order. A pending predecessor holds its successor until it is
+delivered or dead. Replaying the same stable key keeps the existing work or its
+completion receipt. Keep those receipts while the source can replay.
+
+Wire Watchdog's `retryPolicy` to `post.retryPolicy` and its executor as
+`(job, signal, attempt) => post.execute(job, attempt, signal)`. Watchdog
+reserves the attempt and fallback deadline before receiver I/O. A retry retains
+the same job and envelope key; `wakeState(now)` reports readiness and the next
+deadline. Delivery recovery never borrows the Agent crash budget. A receiver
+must admit repeated keys idempotently after a lost response or receipt write.
 
 `latest(kind, address)` reads the newest staged event or its receipt for that
 recipient without scanning other recipients. A member or operator command can
 call `retry(key)` inside the producer's transaction with its awaited wake. It
-expedites a settled failed attempt or puts a dead letter after current queued
-work, keeping its prepared fact. Queued and running jobs stay with Watchdog, and
-a delivered receipt is never reopened.
+expedites a queued retry without resetting its attempt count, or gives a dead
+letter new work after the current queue while keeping its prepared fact. Queued
+and running jobs stay with Watchdog, and a delivered receipt is never reopened.
 
 A route can prepare a wire fact from its staged intent with
 `prepare: { event: wireSchema, run(address, intent, signal) }`. Preparation and
@@ -276,45 +260,36 @@ dead-letter envelope, its reason and its attempt count. `deadLetters` returns
 `letters` and `nextCursor`, including a continuation through pages that contain
 only receipts.
 
-The same retry and receipt machinery is exported as `makePostOutbox` for a
-string-backed outbox. [BirdDog](../bird-dog/README.md) uses it for agent reply
-delivery. `postOutboxPending` reports whether such an outbox still owes any
-message a delivery attempt; receipts and exhausted dead letters owe nothing. Its
-`nextWakeAt()` reads the earliest owed delivery across the retained rows,
-including future retries. Delivered receipts, exhausted dead letters and
-malformed rows do not request a wake.
-
 ## Post transactions on D1 and PostgreSQL
 
 `@fungi.computer/carrier/post-d1` and `/post-postgres` bind the ordinary Post
 address and event registry to Watchdog's database adapters. These relational
-adapters preserve their existing schema and retry contract and do not support
-route deadlines. Constructing either adapter with a route that sets `deadlineMs`
-throws `PostError` with `reason: "relational-deadline-unsupported"` before
-database access. Use SQLite-backed Post for deadline routes. Apply
-`postD1Schema` or `postPostgresSchema` alongside the matching Watchdog schema
-through your migration tool.
+adapters use the same Watchdog attempt owner and do not support route deadlines.
+Constructing either adapter with a route that sets `deadlineMs` throws
+`PostError` with `reason: "relational-deadline-unsupported"` before database
+access. Use SQLite-backed Post for deadline routes. Apply `postD1Schema` or
+`postPostgresSchema` alongside the matching Watchdog schema through your
+migration tool.
 
 On D1, `post.send(envelope)` returns the envelope and job statements. Include
 both in the same `database.batch` as the producer fact. `sendFromSelect` accepts
 a trusted native SQLite `?NNN`-bound SELECT yielding `post_key`,
-`envelope_json`, `queue_name`, `next_attempt_at` and `job_id`, for conditional
-source facts created inside that batch. PostgreSQL `post.send(client, envelope)`
-writes both rows on the producer's existing transaction client. Neither send API
-commits for the producer. A conflicting replay rolls the whole transaction back.
-
-Wire Watchdog's executor as `(job, signal) => post.execute(job, signal)`.
-`enqueueDue` recovers a bounded page of settled delivery attempts, and the host
-keeps its durable cron or wake. Preparation, bounded receiver calls, response
-parsing and settlement decisions are shared with SQLite Post. Receipts suppress
-source replay, failed attempts retry with the same Post policy, permanent
-refusal or exhaustion becomes a dead letter, and earlier pending mail blocks
-later mail to the same address. A receiver can return `{ status, receipt }` with
-JSON receipt metadata. Post persists it with terminal settlement and exposes it
-on the delivered receipt or dead letter. That is how an email producer can
-record provider acceptance while minting credentials only during delivery. These
-async adapters reject synchronous SQLite receipt hooks rather than run them
-outside a transaction.
+`envelope_json`, `queue_name` and `job_id`, for conditional source facts created
+inside that batch. PostgreSQL `post.send(client, envelope)` writes both rows on
+the producer's existing transaction client. Neither send API commits for the
+producer. A conflicting replay rolls the whole transaction back.
+
+Wire the same `retryPolicy` and three-argument executor as native SQLite Post.
+The host retains its durable cron or wake and ticks Watchdog directly.
+Preparation, bounded receiver calls, response parsing and settlement decisions
+are shared with SQLite Post. Receipts suppress source replay, failed attempts
+retry with the same Post policy, permanent refusal or exhaustion becomes a dead
+letter, and earlier pending mail blocks later mail to the same address. A
+receiver can return `{ status, receipt }` with JSON receipt metadata. Post
+persists it with terminal settlement and exposes it on the delivered receipt or
+dead letter. That is how an email producer can record provider acceptance while
+minting credentials only during delivery. These async adapters reject
+synchronous SQLite receipt hooks rather than run them outside a transaction.
 
 `purgeD1Post` and `purgePostgresPost` return parameterized statements selected
 by trusted producer SQL yielding `queue_name`. Compose all of them in the same

package/dist/inspection.js

@@ -70,7 +70,12 @@ export class DeliveryInspectionError extends Error {
         this.code = code;
     }
 }
-const StoredPost = Schema.Struct({ key: Schema.String, value: PostRowSchema });
+const StoredPost = Schema.Struct({
+    key: Schema.String,
+    value: PostRowSchema,
+    attempt_count: Schema.NullOr(Schema.Int),
+    not_before: Schema.NullOr(Schema.Number),
+});
 const StoredEmail = Schema.Struct({
     id: Key,
     status: CarrierStatusSchema,
@@ -141,9 +146,9 @@ export function createDeliveryInspection(sql) {
                 if (!hasTable(sql, "carrier_post_rows"))
                     return { status: "uninitialized" };
                 const rows = Schema.decodeUnknownSync(Schema.Array(StoredPost))(sql
-                    .exec("SELECT key,value FROM carrier_post_rows WHERE key LIKE 'post:%' AND key>? ORDER BY key LIMIT ?", `post:${query.after ?? ""}`, query.limit)
+                    .exec("SELECT p.key,p.value,w.attempt_count,w.not_before FROM carrier_post_rows p LEFT JOIN watchdog_jobs w ON w.job_id=json_extract(p.value,'$.jobId') WHERE p.key LIKE 'post:%' AND p.key>? ORDER BY p.key LIMIT ?", `post:${query.after ?? ""}`, query.limit)
                     .toArray());
-                const records = rows.flatMap(({ key, value }) => {
+                const records = rows.flatMap(({ key, value, attempt_count, not_before }) => {
                     if (query.view === "deadLetters" && value.state !== "dead")
                         return [];
                     const receiptKey = key.slice("post:".length);
@@ -151,13 +156,15 @@ export function createDeliveryInspection(sql) {
                         case "delivered":
                             return [{ key: receiptKey, state: value.state }];
                         case "pending":
+                            if (attempt_count === null || not_before === null)
+                                throw new DeliveryInspectionError("unavailable");
                             return [
                                 {
                                     key: receiptKey,
                                     state: value.state,
                                     kind: value.envelope.kind,
-                                    attempts: value.attempts,
-                                    nextAttemptAt: value.nextAttemptAt,
+                                    attempts: attempt_count,
+                                    nextAttemptAt: not_before,
                                 },
                             ];
                         case "dead":

package/dist/internal/owner.js

@@ -413,7 +413,9 @@ export function openOwner(options) {
                 .exec("SELECT 1 FROM carrier_emails WHERE status IN ('queued','dispatching') LIMIT 1")
                 .toArray().length !== 0);
             return (domainPending ||
-                (yield* watchdog.hasPendingWork.pipe(Effect.mapError(unavailable))));
+                (yield* watchdog
+                    .wakeState(options.now())
+                    .pipe(Effect.mapError(unavailable))).pending);
         }),
     };
 }

package/dist/internal/post-contract.d.ts

@@ -18,11 +18,11 @@ export declare const PostDeliveryResultSchema: Schema.Union<readonly [Schema.Lit
 declare const PostError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
     readonly _tag: "PostError";
 } & Readonly<A>;
-/** Post rejected an unknown route, conflicting key, or unsupported policy. */
+/** Post rejected an unknown route, conflicting key, unsupported policy or store. */
 export declare class PostError extends PostError_base<{
     readonly message: string;
-    readonly reason?: "relational-deadline-unsupported";
+    readonly reason?: "relational-deadline-unsupported" | "pre-scheduler-store";
 }> {
-    constructor(message: string, reason?: "relational-deadline-unsupported");
+    constructor(message: string, reason?: "relational-deadline-unsupported" | "pre-scheduler-store");
 }
 export {};

package/dist/internal/post-contract.js

@@ -14,7 +14,7 @@ export const PostDeliveryResultSchema = Schema.Union([
         receipt: Schema.Json,
     }),
 ]);
-/** Post rejected an unknown route, conflicting key, or unsupported policy. */
+/** Post rejected an unknown route, conflicting key, unsupported policy or store. */
 export class PostError extends Data.TaggedError("PostError") {
     constructor(message, reason) {
         super(reason === undefined ? { message } : { message, reason });

package/dist/internal/post-policy.d.ts

@@ -0,0 +1,5 @@
+import type { RetryPolicy } from "@fungi.computer/almanac";
+/** Ordinary receiver allowance retained from BirdDog; deadline routes own their lifetime. */
+export declare const maxDeliveryAttempts = 20;
+/** Retained receiver backoff, now applied by Watchdog. */
+export declare const postRetryPolicy: RetryPolicy;

package/dist/internal/post-policy.js

@@ -0,0 +1,4 @@
+/** Ordinary receiver allowance retained from BirdDog; deadline routes own their lifetime. */
+export const maxDeliveryAttempts = 20;
+/** Retained receiver backoff, now applied by Watchdog. */
+export const postRetryPolicy = { baseMs: 2_000, maxMs: 300_000 };

package/dist/internal/post-sql.d.ts

@@ -1,4 +1,4 @@
-import type { WatchdogRunningJob } from "@fungi.computer/watchdog";
+import type { WatchdogRunningJob, WatchdogAttempt, WatchdogExecutionDecision, WatchdogRetryPolicy } from "@fungi.computer/watchdog";
 import { type PostEnvelope, type PostRegistryRoute, type PostRow } from "../post.js";
 export type Value = string | number | null;
 export type Statement = Readonly<{
@@ -8,7 +8,6 @@ export type Statement = Readonly<{
 export type Row = Record<string, Value>;
 export type PostSql = Readonly<{
     query: (statement: Statement) => Promise<readonly Row[]>;
-    commit: (statements: readonly Statement[], key: string, jobId: string) => Promise<void>;
 }>;
 /** SQL native Carrier runtime configuration; route decisions remain in Post. */
 export type SqlPostOptions<R extends Record<string, PostRegistryRoute>> = Readonly<{
@@ -24,17 +23,13 @@ export type SqlPostOptions<R extends Record<string, PostRegistryRoute>> = Readon
     }>;
     /** Clock shared with the database's Watchdog. */
     now: () => number;
-    /** Arm a durable wake after committed progress. */
-    scheduleWake: (at: number) => Promise<void>;
 }>;
 /** Async inspection and Watchdog executor shared by D1 and PostgreSQL. */
 export type SqlPostRuntime = Readonly<{
-    /** Execute an already claimed Post job through the registered receiver. */
-    execute: (job: WatchdogRunningJob, signal?: AbortSignal) => Promise<Readonly<{
-        kind: "completed";
-    }>>;
-    /** Recover a bounded page of settled attempts into new Watchdog jobs. */
-    enqueueDue: (limit?: number, afterKey?: string) => Promise<string | undefined>;
+    /** Resolve the delivery budget before Watchdog reserves an attempt. */
+    retryPolicy: (job: WatchdogRunningJob) => Promise<WatchdogRetryPolicy>;
+    /** Execute an already claimed Post job with its reserved delivery attempt. */
+    execute: (job: WatchdogRunningJob, attempt: WatchdogAttempt | undefined, signal?: AbortSignal) => Promise<WatchdogExecutionDecision>;
     /** Read one producer receipt or pending envelope. */
     read: (key: string) => Promise<PostRow | undefined>;
 }>;

package/dist/internal/post-sql.js

@@ -1,9 +1,8 @@
 import * as Schema from "effect/Schema";
-import { backoffDelay } from "@fungi.computer/almanac";
 import { defineIdFamily } from "@fungi.computer/cairn";
 import { PostEnvelopeSchema, PostError, } from "../post.js";
 import { deliverPost, postDisposition, deliveryReceipt, } from "./post-execution.js";
-import { maxDeliveryAttempts, postRetryPolicy } from "../post-outbox.js";
+import { maxDeliveryAttempts, postRetryPolicy } from "./post-policy.js";
 const ids = defineIdFamily({
     family: "post",
     version: 1,
@@ -17,17 +16,12 @@ const Stored = Schema.Struct({
     queue_name: Schema.String,
     state: Schema.Literals(["pending", "delivered", "dead"]),
     attempts: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-    next_attempt_at: Schema.Number,
     job_id: Schema.String,
     delivery_json: Schema.NullOr(Schema.String),
     receipt_json: Schema.NullOr(ReceiptJson),
     reason: Schema.NullOr(Schema.Literals(["refused", "exhausted"])),
 });
-const columns = "post_key,envelope_json,queue_name,state,attempts,next_attempt_at,job_id,delivery_json,reason,receipt_json";
-const JobReference = Schema.Struct({
-    source_job: Schema.NullOr(Schema.String),
-});
-const pageSize = Schema.Int.check(Schema.isGreaterThanOrEqualTo(1), Schema.isLessThanOrEqualTo(64));
+const columns = "post_key,envelope_json,queue_name,state,attempts,job_id,delivery_json,reason,receipt_json";
 export function postSchema(postgres) {
     return [
         `CREATE TABLE IF NOT EXISTS carrier_post_rows (
@@ -36,7 +30,6 @@ export function postSchema(postgres) {
       envelope_json TEXT NOT NULL,queue_name TEXT NOT NULL,
       state TEXT NOT NULL DEFAULT 'pending' CHECK(state IN ('pending','delivered','dead')),
       attempts INTEGER NOT NULL DEFAULT 0 CHECK(attempts>=0),
-      next_attempt_at ${postgres ? "DOUBLE PRECISION" : "INTEGER"} NOT NULL,
       job_id TEXT NOT NULL,delivery_json TEXT,
       reason TEXT CHECK(reason IN ('refused','exhausted')),
       receipt_json TEXT,
@@ -44,14 +37,13 @@ export function postSchema(postgres) {
       last_error TEXT CHECK(last_error IS NULL OR length(last_error)<=2048),
       attempt_until ${postgres ? "DOUBLE PRECISION" : "INTEGER"}
     )`,
-        "CREATE INDEX IF NOT EXISTS idx_post_due ON carrier_post_rows(state,next_attempt_at,post_key)",
         "CREATE INDEX IF NOT EXISTS idx_post_address ON carrier_post_rows(queue_name,state,sequence)",
     ];
 }
 export function admitPostSelect(source) {
     return {
-        text: `INSERT INTO carrier_post_rows(post_key,envelope_json,queue_name,next_attempt_at,job_id)
-    SELECT post_key,envelope_json,queue_name,next_attempt_at,job_id FROM (${source.text}) AS admission WHERE true
+        text: `INSERT INTO carrier_post_rows(post_key,envelope_json,queue_name,job_id)
+    SELECT post_key,envelope_json,queue_name,job_id FROM (${source.text}) AS admission WHERE true
     ON CONFLICT(post_key) DO UPDATE SET post_key=NULL
     WHERE carrier_post_rows.envelope_json<>excluded.envelope_json OR carrier_post_rows.queue_name<>excluded.queue_name`,
         values: source.values,
@@ -64,7 +56,7 @@ export function jobSelect(key, postgres, expectedJobId) {
         : "json_object('postKey',post_key)";
     return {
         text: `SELECT job_id,queue_name,'post' AS lane,0 AS priority,${payload} AS payload_json,
-      CAST(NULL AS INTEGER) AS recovery_max FROM carrier_post_rows
+      CAST(NULL AS INTEGER) AS recovery_max,CAST(NULL AS INTEGER) AS recovery_window_ms,CAST(0 AS INTEGER) AS not_before FROM carrier_post_rows
       WHERE post_key=${bind}1 AND state='pending' ${expectedJobId === undefined ? "" : `AND job_id=${bind}2`}`,
         values: expectedJobId === undefined ? [key] : [key, expectedJobId],
     };
@@ -81,12 +73,11 @@ export function preparePost(options, input) {
         key: envelope.key,
         statement: admitPostSelect({
             text: `SELECT CAST($1 AS TEXT) AS post_key,CAST($2 AS TEXT) AS envelope_json,
-      CAST($3 AS TEXT) AS queue_name,CAST($4 AS DOUBLE PRECISION) AS next_attempt_at,CAST($5 AS TEXT) AS job_id`,
+      CAST($3 AS TEXT) AS queue_name,CAST($4 AS TEXT) AS job_id`,
             values: [
                 envelope.key,
                 Schema.encodeSync(EnvelopeJson)(envelope),
                 queue,
-                options.now(),
                 jobId,
             ],
         }),
@@ -121,8 +112,6 @@ function publicRow(stored) {
     return {
         state: "pending",
         envelope: stored.envelope,
-        attempts: stored.attempts,
-        nextAttemptAt: stored.next_attempt_at,
         jobId: stored.job_id,
         delivery: stored.delivery,
     };
@@ -136,14 +125,9 @@ export function openSqlPost(database, options) {
         maxDelayMs: Schema.Int.check(Schema.isGreaterThan(0)),
     }))(options.retry ?? {
         maxAttempts: maxDeliveryAttempts,
-        baseDelayMs: backoffDelay(1, postRetryPolicy),
-        maxDelayMs: backoffDelay(maxDeliveryAttempts, postRetryPolicy),
-    });
-    const delay = (attempt) => backoffDelay(attempt, {
-        baseMs: policy.baseDelayMs,
-        maxMs: policy.maxDelayMs,
+        baseDelayMs: postRetryPolicy.baseMs,
+        maxDelayMs: postRetryPolicy.maxMs,
     });
-    const retrySql = Array.from({ length: policy.maxAttempts }, (_, index) => `WHEN ${String(index)} THEN ${String(delay(index + 1))}`).join(" ");
     for (const route of Object.values(options.routes)) {
         // Synchronous owner hooks cannot participate in an asynchronous transaction.
         if (route.recordDelivered !== undefined ||
@@ -152,65 +136,84 @@ export function openSqlPost(database, options) {
             throw new PostError("SQL Post requires transaction-bound receipt projections");
     }
     const query = (text, values = []) => database.query({ text, values });
+    const readStored = async (key) => {
+        const raw = (await query(`SELECT ${columns} FROM carrier_post_rows WHERE post_key=$1`, [key]))[0];
+        return raw === undefined ? undefined : parseStored(raw);
+    };
+    const postKeyOf = (job) => Schema.decodeUnknownSync(Schema.Struct({ postKey: Schema.String }))(job.payload).postKey;
+    // Watchdog owns the attempt generation and lease. The retained ten-second
+    // receiver fence rejects delayed writes from a timed-out preparation/call.
+    const claimed = `post_key=$1 AND job_id=$2 AND state='pending' AND EXISTS (
+    SELECT 1 FROM watchdog_jobs w WHERE w.job_id=carrier_post_rows.job_id
+    AND w.state='running' AND w.attempt_count=$3 AND w.lease_until>$4)`;
     return {
         read: async (key) => {
-            const raw = (await query(`SELECT ${columns} FROM carrier_post_rows WHERE post_key=$1`, [key]))[0];
-            return raw === undefined ? undefined : publicRow(parseStored(raw));
+            const stored = await readStored(key);
+            return stored === undefined ? undefined : publicRow(stored);
         },
-        execute: async (job, signal) => {
-            const { postKey } = Schema.decodeUnknownSync(Schema.Struct({ postKey: Schema.String }))(job.payload);
-            const raw = (await query(`UPDATE carrier_post_rows SET attempts=attempts+1,
-        next_attempt_at=CAST($1 AS DOUBLE PRECISION)+CASE attempts ${retrySql} ELSE ${String(delay(policy.maxAttempts))} END,attempt_until=$2 WHERE post_key=$3 AND job_id=$4 AND state='pending'
-        AND attempts<$5 AND NOT EXISTS (SELECT 1 FROM carrier_post_rows AS earlier
-          WHERE earlier.queue_name=carrier_post_rows.queue_name AND earlier.state='pending'
-          AND earlier.sequence<carrier_post_rows.sequence) RETURNING ${columns}`, [
-                options.now(),
-                options.now() + 10_000,
+        retryPolicy: async (job) => {
+            const row = await readStored(postKeyOf(job));
+            if (row === undefined)
+                throw new PostError("delivery row is missing");
+            return {
+                baseMs: policy.baseDelayMs,
+                maxMs: policy.maxDelayMs,
+                limit: {
+                    maxAttempts: row.state === "pending" && row.job_id === job.jobId
+                        ? policy.maxAttempts
+                        : 0,
+                },
+            };
+        },
+        execute: async (job, reservation, signal) => {
+            if (reservation === undefined)
+                throw new PostError("delivery attempt is missing");
+            const postKey = postKeyOf(job);
+            const current = await readStored(postKey);
+            if (current === undefined)
+                throw new PostError("delivery row is missing");
+            if (current.state !== "pending" || current.job_id !== job.jobId)
+                return { kind: "completed" };
+            const bindings = () => [
                 postKey,
                 job.jobId,
-                policy.maxAttempts,
-            ]))[0];
-            if (raw === undefined)
+                reservation.count,
+                options.now(),
+            ];
+            if (reservation.status === "exhausted") {
+                const settled = await query(`UPDATE carrier_post_rows SET state='dead',reason='exhausted',attempts=$3,attempt_until=NULL,settled_at=$4 WHERE ${claimed} RETURNING post_key`, bindings());
+                if (settled.length !== 1)
+                    throw new PostError("receipt was not committed");
                 return { kind: "completed" };
-            const stored = parseStored(raw);
-            const attempt = publicRow(stored);
+            }
+            const raw = (await query(`UPDATE carrier_post_rows SET attempt_until=$5 WHERE ${claimed} RETURNING ${columns}`, [...bindings(), options.now() + 10_000]))[0];
+            if (raw === undefined)
+                throw new PostError("attempt claim is unavailable");
+            const attempt = publicRow(parseStored(raw));
             if (attempt.state !== "pending")
                 throw new PostError("attempt is not pending");
             const route = options.routes[attempt.envelope.kind];
             if (route === undefined)
                 throw new PostError("unknown address kind");
-            await options.scheduleWake(attempt.nextAttemptAt);
             const evidence = await deliverPost({
                 signal,
                 attempt,
                 route,
                 savePrepared: async (envelope) => {
-                    const saved = await query(`UPDATE carrier_post_rows SET delivery_json=$1
-          WHERE post_key=$2 AND job_id=$3 AND attempts=$4 AND state='pending' AND attempt_until>$5 RETURNING post_key`, [
-                        Schema.encodeSync(EnvelopeJson)(envelope),
-                        postKey,
-                        job.jobId,
-                        attempt.attempts,
-                        options.now(),
-                    ]);
+                    const saved = await query(`UPDATE carrier_post_rows SET delivery_json=$5 WHERE ${claimed} AND attempt_until>$4 RETURNING post_key`, [...bindings(), Schema.encodeSync(EnvelopeJson)(envelope)]);
                     if (saved.length === 0)
                         throw new PostError("preparation superseded");
                 },
             });
-            const disposition = postDisposition(evidence, route, attempt.attempts, policy.maxAttempts);
+            const disposition = postDisposition(evidence, route, reservation.count, policy.maxAttempts);
             if (disposition.state === "keep")
-                return { kind: "completed" };
-            const next = options.now() + delay(attempt.attempts);
+                return { kind: "retry" };
             const receipt = deliveryReceipt(evidence);
-            await query(`UPDATE carrier_post_rows SET state=$1,reason=$2,next_attempt_at=$3,attempt_until=NULL,last_error=$8,receipt_json=$9,settled_at=CASE WHEN $1='pending' THEN NULL ELSE CAST($10 AS DOUBLE PRECISION) END
-        WHERE post_key=$4 AND job_id=$5 AND attempts=$6 AND state='pending' AND attempt_until>$7`, [
+            const settled = await query(`UPDATE carrier_post_rows SET state=$5,reason=$6,attempts=CASE WHEN $5='pending' THEN 0 ELSE $3 END,attempt_until=NULL,last_error=$7,receipt_json=$8,settled_at=CASE WHEN $5='pending' THEN NULL ELSE CAST($4 AS DOUBLE PRECISION) END
+        WHERE ${claimed} AND attempt_until>$4 RETURNING post_key`, [
+                ...bindings(),
                 disposition.state,
                 disposition.state === "dead" ? disposition.reason : null,
-                next,
-                postKey,
-                job.jobId,
-                attempt.attempts,
-                options.now(),
                 evidence.result === "unavailable" &&
                     options.failureDetail !== undefined
                     ? options.failureDetail(evidence.failure).slice(0, 2048)
@@ -218,44 +221,10 @@ export function openSqlPost(database, options) {
                 receipt === undefined
                     ? null
                     : Schema.encodeSync(ReceiptJson)(receipt),
-                options.now(),
             ]);
-            await options.scheduleWake(disposition.state === "pending" ? next : options.now());
-            return { kind: "completed" };
-        },
-        enqueueDue: async (limit = 64, afterKey = "") => {
-            Schema.decodeUnknownSync(pageSize)(limit);
-            const rows = await query(`SELECT ${columns
-                .split(",")
-                .map((column) => `p.${column}`)
-                .join(",")},w.job_id AS source_job
-        FROM carrier_post_rows p LEFT JOIN watchdog_jobs w ON p.job_id=w.job_id
-        WHERE p.state='pending' AND (w.job_id IS NULL OR (w.state='settled' AND p.next_attempt_at<=$1)) AND p.post_key>$2
-        ORDER BY p.post_key LIMIT $3`, [options.now(), afterKey, limit]);
-            let cursor;
-            for (const raw of rows) {
-                if (Schema.decodeUnknownSync(JobReference)(raw).source_job === null)
-                    throw new PostError("delivery job is missing");
-                const row = parseStored(raw);
-                cursor = row.post_key;
-                const nextJobId = ids.work.generate();
-                await database.commit([
-                    {
-                        text: `UPDATE carrier_post_rows SET job_id=$1,state=CASE WHEN attempts>=$2 THEN 'dead' ELSE 'pending' END,
-            reason=CASE WHEN attempts>=$2 THEN 'exhausted' ELSE NULL END,
-            settled_at=CASE WHEN attempts>=$2 THEN CAST($5 AS DOUBLE PRECISION) ELSE NULL END
-            WHERE post_key=$3 AND job_id=$4 AND state='pending' AND next_attempt_at<=$5`,
-                        values: [
-                            nextJobId,
-                            policy.maxAttempts,
-                            row.post_key,
-                            row.job_id,
-                            options.now(),
-                        ],
-                    },
-                ], row.post_key, nextJobId);
-            }
-            return rows.length === limit ? cursor : undefined;
+            if (settled.length !== 1)
+                throw new PostError("receipt was not committed");
+            return { kind: disposition.state === "pending" ? "retry" : "completed" };
         },
     };
 }

package/dist/post-d1.d.ts

@@ -3,7 +3,7 @@ import { type D1Watchdog } from "@fungi.computer/watchdog/d1";
 import type { PostEnvelope, PostRegistryRoute } from "./post.js";
 import { type SqlPostOptions, type SqlPostRuntime } from "./internal/post-sql.js";
 export type { SqlPostOptions, SqlPostRuntime } from "./internal/post-sql.js";
-/** Trusted SELECT yielding post_key, envelope_json, queue_name, next_attempt_at and job_id. */
+/** Trusted SELECT yielding post_key, envelope_json, queue_name and job_id. */
 export type D1PostSource = Readonly<{
     /** Trusted native SELECT text with SQLite ?NNN bindings. */
     text: string;

package/dist/post-d1.js

@@ -10,12 +10,6 @@ export function createD1Post(options) {
         .bind(...statement.values);
     const runtime = openSqlPost({
         query: async (statement) => (await prepare(statement).all()).results,
-        commit: async (statements, key, jobId) => {
-            await options.database.batch([
-                ...statements.map(prepare),
-                options.watchdog.enqueueFromSelect(jobSelect(key, false, jobId)),
-            ]);
-        },
     }, options);
     return {
         ...runtime,
@@ -35,7 +29,7 @@ export function prepareD1PostAdmission(database, source) {
         database.prepare(admitPostSelect(source).text).bind(...source.values),
         prepareD1Admission(database).enqueueFromSelect({
             text: `SELECT p.job_id,p.queue_name,'post' AS lane,0 AS priority,
-        json_object('postKey',p.post_key) AS payload_json,CAST(NULL AS INTEGER) AS recovery_max
+        json_object('postKey',p.post_key) AS payload_json,CAST(NULL AS INTEGER) AS recovery_max,CAST(NULL AS INTEGER) AS recovery_window_ms,CAST(0 AS INTEGER) AS not_before
         FROM carrier_post_rows p JOIN (${source.text}) AS source ON p.post_key=source.post_key
         WHERE p.state='pending'`,
             values: source.values,

package/dist/post-postgres.js

@@ -32,23 +32,6 @@ export function createPostgresPost(options) {
         query: async (statement) => (await options.database.query(statement.text, [
             ...statement.values,
         ])).rows,
-        commit: async (statements, key, jobId) => {
-            const client = await options.database.connect();
-            try {
-                await client.query("BEGIN");
-                for (const statement of statements)
-                    await client.query(statement.text, [...statement.values]);
-                await enqueue(client, jobSelect(key, true, jobId));
-                await client.query("COMMIT");
-            }
-            catch (error) {
-                await client.query("ROLLBACK");
-                throw error;
-            }
-            finally {
-                client.release();
-            }
-        },
     }, options);
     return {
         ...runtime,