@relaybus/postgres 0.1.0 → 0.2.0

package/dist/index.cjs

@@ -1,13 +1,19 @@
 'use strict';
 
+var crypto = require('crypto');
 var core = require('@relaybus/core');
 var pg = require('pg');
 
 // src/pg-executor.ts
+var FOREIGN_SESSION_ERRORS = /* @__PURE__ */ new Set(["26000", "42P05"]);
 var PgExecutor = class {
   #pool;
-  constructor(pool) {
+  #logger;
+  #names = /* @__PURE__ */ new Map();
+  #preparing = true;
+  constructor(pool, options = {}) {
     this.#pool = pool;
+    this.#logger = options.logger ?? console;
   }
   async transaction(work) {
     const client = await this.#pool.connect();
@@ -22,9 +28,38 @@ var PgExecutor = class {
       throw error;
     }
   }
-  async query(sql, parameters, transaction) {
-    const result = await (transaction ?? this.#pool).query(sql, [...parameters]);
-    return result.rows;
+  async query(sql, parameters, transaction, options) {
+    const queryable = transaction ?? this.#pool;
+    const values = [...parameters];
+    if (options?.prepare !== true || !this.#preparing) {
+      return (await queryable.query(sql, values)).rows;
+    }
+    try {
+      return (await queryable.query({ name: this.#nameOf(sql), text: sql, values })).rows;
+    } catch (error) {
+      if (!FOREIGN_SESSION_ERRORS.has(error.code)) {
+        throw error;
+      }
+      if (this.#preparing) {
+        this.#preparing = false;
+        this.#logger.warn(
+          `[PgExecutor](query) The server does not keep prepared statements per connection, statements are sent unprepared from now on; set preparedStatements: false to skip this check | code=${String(error.code)}`
+        );
+      }
+      if (transaction !== void 0) {
+        throw error;
+      }
+      return (await queryable.query(sql, values)).rows;
+    }
+  }
+  /** `relaybus_` and 24 hex digits of the SHA-256 of the text: well under the 63 bytes of an identifier. */
+  #nameOf(sql) {
+    let name = this.#names.get(sql);
+    if (name === void 0) {
+      name = `relaybus_${crypto.createHash("sha256").update(sql).digest("hex").slice(0, 24)}`;
+      this.#names.set(sql, name);
+    }
+    return name;
   }
   /** A client whose rollback fails is in an unknown state, so it is destroyed instead of reused. */
   async #rollbackAndRelease(client) {
@@ -50,7 +85,9 @@ function quoteIdentifier(value) {
 }
 
 // src/names.ts
+var LANE_COUNT = 256;
 var DEFAULT_SCHEMA = "public";
+var MAXIMUM_CHANNEL_LENGTH = 63;
 var DEFAULT_TABLE_PREFIX = "relaybus_";
 var TABLE_PREFIX_PATTERN = /^[a-z0-9_]*$/;
 function resolvePostgresNames(options = {}) {
@@ -76,34 +113,47 @@ function resolvePostgresNames(options = {}) {
     events: table("events"),
     deliveries: table("deliveries"),
     keySequences: table("key_sequences"),
+    lanes: table("lanes"),
+    lanesTableName: name("lanes"),
+    eventCompletions: table("event_completions"),
+    completions: table("completed_deliveries"),
+    completionHistory: options.completionHistory ?? false,
+    notificationChannel: channelName(`${schema}.${tablePrefix}deliveries`),
     indexes: {
       deliveryEventHandler: index("deliveries_event_handler_unique"),
-      deliveryDue: index("deliveries_due_idx"),
-      deliveryDueUnkeyed: index("deliveries_due_unkeyed_idx"),
-      deliveryHandlerCreated: index("deliveries_handler_created_idx"),
+      deliveryLaneDue: index("deliveries_lane_due_idx"),
+      deliveryKeyPending: index("deliveries_key_pending_idx"),
       eventCreated: index("events_created_idx"),
-      deliveryKeyUnfinished: index("deliveries_key_unfinished_idx"),
-      deliveryKeyProcessing: index("deliveries_key_processing_idx"),
-      deliveryStatusCreated: index("deliveries_status_created_idx"),
       deliveryCompleted: index("deliveries_completed_idx"),
-      deliveryDead: index("deliveries_dead_idx")
+      deliveryDead: index("deliveries_dead_idx"),
+      completionCompleted: index("completed_deliveries_completed_idx"),
+      eventCompletionsCompleted: index("event_completions_completed_idx"),
+      obsolete: [
+        index("deliveries_due_idx"),
+        index("deliveries_due_unkeyed_idx"),
+        index("deliveries_handler_created_idx"),
+        index("deliveries_key_unfinished_idx"),
+        index("deliveries_key_processing_idx"),
+        index("deliveries_status_created_idx")
+      ]
     }
   };
 }
+function channelName(readable) {
+  return readable.length <= MAXIMUM_CHANNEL_LENGTH ? readable : `relaybus_${crypto.createHash("sha256").update(readable).digest("hex").slice(0, 32)}`;
+}
 
 // src/sql-fragments.ts
-function dueAtExpression(alias) {
-  const prefix = alias === void 0 ? "" : `${alias}.`;
-  return `CASE WHEN ${prefix}status = 'pending' THEN ${prefix}available_at ELSE ${prefix}lease_expires_at END`;
-}
 function isoText(expression) {
   return `to_char(${expression} AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')`;
 }
+function laneExpression(keyExpression, eventIdExpression) {
+  return `(hashtextextended(COALESCE(${keyExpression}, ${eventIdExpression}), 0) & ${LANE_COUNT - 1})::smallint`;
+}
 
 // src/schema.ts
 function createPostgresSchemaStatements(options = {}) {
   const names = resolvePostgresNames(options);
-  const unfinished = `status IN ('pending', 'processing')`;
   const statements = [
     `CREATE TABLE IF NOT EXISTS ${names.events} (
   id text PRIMARY KEY,
@@ -116,7 +166,8 @@ function createPostgresSchemaStatements(options = {}) {
   correlation_id text,
   causation_id text,
   occurred_at timestamptz NOT NULL,
-  created_at timestamptz NOT NULL
+  created_at timestamptz NOT NULL,
+  handlers text[] NOT NULL DEFAULT '{}'
 )`,
     `CREATE INDEX IF NOT EXISTS ${names.indexes.eventCreated} ON ${names.events} (created_at, id)`,
     `CREATE TABLE IF NOT EXISTS ${names.keySequences} (
@@ -127,12 +178,11 @@ function createPostgresSchemaStatements(options = {}) {
   id text COLLATE "C" PRIMARY KEY,
   event_id text NOT NULL REFERENCES ${names.events} (id) ON DELETE CASCADE,
   handler text NOT NULL,
+  lane smallint NOT NULL,
+  claims integer NOT NULL DEFAULT 0,
   status text NOT NULL CHECK (status IN ('pending', 'processing', 'completed', 'dead')),
   attempts integer NOT NULL DEFAULT 0,
   available_at timestamptz NOT NULL,
-  lease_owner text,
-  lease_token text,
-  lease_expires_at timestamptz,
   last_error jsonb,
   key text,
   sequence bigint,
@@ -140,26 +190,180 @@ function createPostgresSchemaStatements(options = {}) {
   updated_at timestamptz NOT NULL,
   completed_at timestamptz,
   CONSTRAINT ${names.indexes.deliveryEventHandler} UNIQUE (event_id, handler)
-)`,
-    `CREATE INDEX IF NOT EXISTS ${names.indexes.deliveryDue} ON ${names.deliveries} ((${dueAtExpression()}), id) WHERE ${unfinished}`,
-    `CREATE INDEX IF NOT EXISTS ${names.indexes.deliveryDueUnkeyed} ON ${names.deliveries} ((${dueAtExpression()}), id) WHERE key IS NULL AND ${unfinished}`,
-    `CREATE INDEX IF NOT EXISTS ${names.indexes.deliveryKeyUnfinished} ON ${names.deliveries} (handler, key, sequence) WHERE key IS NOT NULL AND ${unfinished}`,
-    `CREATE INDEX IF NOT EXISTS ${names.indexes.deliveryKeyProcessing} ON ${names.deliveries} (handler, key) WHERE key IS NOT NULL AND status = 'processing'`,
-    `CREATE INDEX IF NOT EXISTS ${names.indexes.deliveryStatusCreated} ON ${names.deliveries} (status, created_at, id)`,
-    `CREATE INDEX IF NOT EXISTS ${names.indexes.deliveryHandlerCreated} ON ${names.deliveries} (handler, created_at, id)`,
+) WITH (autovacuum_vacuum_scale_factor = 0.02, autovacuum_analyze_scale_factor = 0.05)`,
+    upgradeFromVersion010(names),
+    `ALTER TABLE ${names.deliveries} ADD COLUMN IF NOT EXISTS claims integer NOT NULL DEFAULT 0`,
+    `ALTER TABLE ${names.deliveries} SET (autovacuum_vacuum_scale_factor = 0.02, autovacuum_analyze_scale_factor = 0.05)`,
+    ...names.indexes.obsolete.map((index) => `DROP INDEX IF EXISTS ${names.quotedSchema}.${index}`),
+    `CREATE INDEX IF NOT EXISTS ${names.indexes.deliveryLaneDue} ON ${names.deliveries} (lane, available_at, id) WHERE status = 'pending'`,
+    `CREATE INDEX IF NOT EXISTS ${names.indexes.deliveryKeyPending} ON ${names.deliveries} (lane, handler, key, sequence) WHERE key IS NOT NULL AND status = 'pending'`,
     `CREATE INDEX IF NOT EXISTS ${names.indexes.deliveryCompleted} ON ${names.deliveries} (completed_at, id) WHERE status = 'completed'`,
-    `CREATE INDEX IF NOT EXISTS ${names.indexes.deliveryDead} ON ${names.deliveries} (updated_at, id) WHERE status = 'dead'`
+    `CREATE INDEX IF NOT EXISTS ${names.indexes.deliveryDead} ON ${names.deliveries} (updated_at, id) WHERE status = 'dead'`,
+    `CREATE TABLE IF NOT EXISTS ${names.lanes} (
+  lane smallint PRIMARY KEY CHECK (lane >= 0 AND lane < ${LANE_COUNT}),
+  epoch bigint NOT NULL DEFAULT 0,
+  lease_owner text,
+  lease_expires_at timestamptz,
+  in_flight text[] NOT NULL DEFAULT '{}',
+  claim_floor bigint NOT NULL DEFAULT 0
+) WITH (fillfactor = 50)`,
+    `ALTER TABLE ${names.lanes} ADD COLUMN IF NOT EXISTS claim_floor bigint NOT NULL DEFAULT 0`,
+    `CREATE TABLE IF NOT EXISTS ${names.eventCompletions} (
+  event_id text PRIMARY KEY REFERENCES ${names.events} (id) ON DELETE CASCADE,
+  completed_at timestamptz NOT NULL
+)`,
+    `CREATE INDEX IF NOT EXISTS ${names.indexes.eventCompletionsCompleted} ON ${names.eventCompletions} (completed_at, event_id)`,
+    `INSERT INTO ${names.lanes} (lane) SELECT generate_series(0, ${LANE_COUNT - 1})::smallint ON CONFLICT (lane) DO NOTHING`
   ];
+  if (names.completionHistory) {
+    statements.push(
+      `CREATE TABLE IF NOT EXISTS ${names.completions} (
+  id text COLLATE "C" PRIMARY KEY,
+  event_id text NOT NULL REFERENCES ${names.events} (id) ON DELETE CASCADE,
+  handler text NOT NULL,
+  attempts integer NOT NULL,
+  available_at timestamptz NOT NULL,
+  created_at timestamptz NOT NULL,
+  completed_at timestamptz NOT NULL
+)`,
+      `CREATE INDEX IF NOT EXISTS ${names.indexes.completionCompleted} ON ${names.completions} (completed_at, id)`
+    );
+  }
   if (names.schema !== "public") {
     statements.unshift(`CREATE SCHEMA IF NOT EXISTS ${names.quotedSchema}`);
   }
+  statements.push(`COMMENT ON TABLE ${names.lanes} IS '${postgresSchemaMarker(statements)}'`);
   return statements;
 }
+function postgresSchemaMarker(statements) {
+  return `relaybus schema ${crypto.createHash("sha256").update(statements.join(";")).digest("hex").slice(0, 32)}`;
+}
+function upgradeFromVersion010(names) {
+  return `DO $relaybus_upgrade$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM pg_attribute
+    WHERE attrelid = '${names.deliveries}'::regclass AND attname = 'lease_token' AND NOT attisdropped
+  ) THEN
+    ALTER TABLE ${names.events} ADD COLUMN IF NOT EXISTS handlers text[] NOT NULL DEFAULT '{}';
+    UPDATE ${names.events} AS event SET handlers = known.handlers
+    FROM (
+      SELECT event_id, array_agg(handler) AS handlers FROM ${names.deliveries} GROUP BY event_id
+    ) AS known
+    WHERE event.id = known.event_id;
+    ALTER TABLE ${names.deliveries} ADD COLUMN IF NOT EXISTS lane smallint;
+    UPDATE ${names.deliveries} SET lane = ${laneExpression("key", "event_id")} WHERE lane IS NULL;
+    ALTER TABLE ${names.deliveries} ALTER COLUMN lane SET NOT NULL;
+    UPDATE ${names.deliveries} SET status = 'pending' WHERE status = 'processing';
+    ALTER TABLE ${names.deliveries}
+      DROP COLUMN lease_owner, DROP COLUMN lease_token, DROP COLUMN lease_expires_at;
+  END IF;
+END
+$relaybus_upgrade$`;
+}
 function createPostgresSchemaSql(options = {}) {
   return `${createPostgresSchemaStatements(options).join(";\n\n")};
 `;
 }
 
+// src/notification-listener.ts
+var RECONNECT_DELAY_MS = 1e3;
+var NotificationListener = class {
+  #connect;
+  #channel;
+  #listener;
+  #logger;
+  /** Ends the current connection, listening or still starting; undefined while there is none. */
+  #drop;
+  #reconnectTimer;
+  #closed = false;
+  constructor(connect, channel, listener, logger) {
+    this.#connect = connect;
+    this.#channel = channel;
+    this.#listener = listener;
+    this.#logger = logger;
+  }
+  /** Connects and listens. Rejects when that fails; a connection lost later is replaced. */
+  async start() {
+    const connection = await this.#connect();
+    let ended = false;
+    let ending = Promise.resolve();
+    const end = () => {
+      if (!ended) {
+        ended = true;
+        ending = connection.end().catch(() => void 0);
+      }
+      return ending;
+    };
+    if (this.#closed) {
+      await end();
+      return;
+    }
+    this.#drop = end;
+    let listening = false;
+    const onLost = (error) => {
+      if (!listening || ended) {
+        return;
+      }
+      void end();
+      this.#drop = void 0;
+      this.#logger.warn(
+        `[NotificationListener](start) Listening connection lost, opening another | channel=${this.#channel} | error=${error?.message ?? "connection ended"}`
+      );
+      this.#scheduleReconnect();
+    };
+    connection.on("error", onLost);
+    connection.on("end", () => onLost());
+    connection.on("notification", () => this.#listener());
+    try {
+      await connection.query(`LISTEN "${this.#channel}"`);
+    } catch (error) {
+      if (this.#drop === end) {
+        this.#drop = void 0;
+      }
+      await end();
+      if (this.#closed) {
+        return;
+      }
+      throw error;
+    }
+    if (this.#closed) {
+      await end();
+      return;
+    }
+    listening = true;
+  }
+  #scheduleReconnect() {
+    this.#reconnectTimer = setTimeout(() => {
+      this.#reconnectTimer = void 0;
+      this.start().then(
+        () => {
+          if (!this.#closed) {
+            this.#listener();
+          }
+        },
+        (error) => {
+          this.#logger.warn(
+            `[NotificationListener](scheduleReconnect) Listening again failed, retrying | channel=${this.#channel} | error=${error instanceof Error ? error.message : String(error)}`
+          );
+          if (!this.#closed) {
+            this.#scheduleReconnect();
+          }
+        }
+      );
+    }, RECONNECT_DELAY_MS);
+    this.#reconnectTimer.unref();
+  }
+  /** Stops listening for good and ends the connection. */
+  async close() {
+    this.#closed = true;
+    clearTimeout(this.#reconnectTimer);
+    const drop = this.#drop;
+    this.#drop = void 0;
+    await drop?.();
+  }
+};
+
 // src/row-mapping.ts
 function text(row, column) {
   return row[column];
@@ -187,12 +391,27 @@ function mapEventEnvelope(row) {
     occurredAt: new Date(text(row, "event_occurred_at"))
   };
 }
+function formatLeaseToken(lane, epoch, claims) {
+  return `${lane}:${epoch}:${claims}`;
+}
+var LEASE_TOKEN_PATTERN = /^(\d{1,3}):(\d{1,18}):(\d{1,9})$/;
+function parseLeaseToken(token) {
+  const match = LEASE_TOKEN_PATTERN.exec(token);
+  if (match === null || Number(match[1]) >= LANE_COUNT) {
+    return void 0;
+  }
+  return { lane: Number(match[1]), epoch: match[2], claims: Number(match[3]) };
+}
 function mapClaimedDelivery(row, leaseExpiresAt) {
   return {
     deliveryId: text(row, "delivery_id"),
-    leaseToken: text(row, "lease_token"),
+    leaseToken: formatLeaseToken(
+      readCount(row, "lane"),
+      text(row, "epoch"),
+      readCount(row, "claims")
+    ),
     handler: text(row, "handler"),
-    attempt: readCount(row, "attempts"),
+    attempt: readCount(row, "attempt"),
     leaseExpiresAt,
     event: mapEventEnvelope(row)
   };
@@ -215,7 +434,7 @@ function mapDeliveryRecord(row) {
   };
 }
 function mapOldestDueAt(rows) {
-  return rows.length === 0 ? null : new Date(text(rows[0], "oldest_due_at"));
+  return nullableDate(rows[0], "oldest_due_at");
 }
 
 // src/statements.ts
@@ -235,9 +454,12 @@ function countChanged(dml) {
   return `WITH changed AS (${dml} RETURNING 1) SELECT count(*)::int AS count FROM changed`;
 }
 var CLAIM_SCAN_WINDOW = 256;
-var UNFINISHED_PREDICATE = (alias) => `${alias}.status IN ('pending', 'processing')`;
+var LANE_SCAN_WINDOW = 64;
+var LANE_DEPTH_CAP = 16;
+var INITIAL_FREE_LANES = 4;
+var FREE_LANE_SURPLUS = 16;
 var HANDLER_PREDICATE = `delivery.handler = ANY (ARRAY(SELECT jsonb_array_elements_text($2::jsonb)))`;
-var CLEAR_LEASE = "lease_owner = NULL, lease_token = NULL, lease_expires_at = NULL";
+var LANE_LIST = `ARRAY(SELECT jsonb_array_elements_text($4::jsonb)::smallint)`;
 var PostgresStatements = class {
   #names;
   constructor(names) {
@@ -251,318 +473,1131 @@ var PostgresStatements = class {
   get setupLockKey() {
     return `relaybus:${this.#names.schema}`;
   }
+  /**
+   * Whether the lane table carries `marker` as its comment, that is whether the schema statements
+   * that produce that marker already ran. Takes no table lock. Parameters: `[marker]`.
+   */
+  get schemaCurrent() {
+    return `SELECT EXISTS (
+  SELECT 1 FROM pg_catalog.pg_class AS c
+  JOIN pg_catalog.pg_namespace AS n ON n.oid = c.relnamespace
+  JOIN pg_catalog.pg_description AS d
+    ON d.objoid = c.oid AND d.classoid = 'pg_catalog.pg_class'::regclass AND d.objsubid = 0
+  WHERE n.nspname = '${this.#names.schema}' AND c.relname = '${this.#names.lanesTableName}' AND d.description = $1::text
+) AS current`;
+  }
   get setupLock() {
     return "SELECT pg_advisory_xact_lock(hashtextextended($1::text, 0))";
   }
   /**
-   * Reserves sequence numbers per key. Parameters: `[{ key, count }]` as JSON.
-   * Keys are locked in sorted order, so publishers cannot deadlock within one
-   * call (across calls of one transaction they can, see the README); each row lock is held until the publishing transaction ends, which makes
-   * sequence order equal commit order for a key.
+   * Publishes in one statement: reserves the sequences of the keys (`[{ key, count }]` in `$4`, locked in
+   * key order: each row lock is held until the publishing transaction ends, which makes sequence order equal commit order for a key), numbers the keyed events in entry order (`ordinal`), inserts
+   * the events of `$1` that do not exist yet and the deliveries of `$3` that belong to them, and sends one
+   * wake-up notification when a delivery it inserted is due at `$5`. Parameters:
+   * `[eventsJson, createdAt, deliveriesJson, keyCountsJson, now]`. Returns one row per event of `$1`: its
+   * id, its sequence, whether this statement inserted it, and (on every row) how many deliveries it
+   * inserted. Deliveries of events that already existed are left to {@link insertDeliveries}.
+   */
+  get insertFreshEvents() {
+    const events = this.#names.events;
+    return `WITH reserved AS (
+  INSERT INTO ${this.#names.keySequences} AS reserved (key, sequence)
+  SELECT requested.key, requested.count
+  FROM jsonb_to_recordset($4::jsonb) AS requested (key text, count bigint)
+  ORDER BY requested.key
+  ON CONFLICT (key) DO UPDATE SET sequence = reserved.sequence + EXCLUDED.sequence
+  RETURNING reserved.key AS key, reserved.sequence AS sequence
+), incoming AS (
+  SELECT incoming.*,
+    CASE WHEN incoming.key IS NULL THEN NULL ELSE
+      reserved.sequence - count(*) OVER (PARTITION BY incoming.key)
+        + row_number() OVER (PARTITION BY incoming.key ORDER BY incoming.ordinal)
+    END AS sequence
+  FROM jsonb_to_recordset($1::jsonb) AS incoming (
+    ordinal int, id text, type text, source text, key text, payload jsonb, headers jsonb,
+    correlation_id text, causation_id text, occurred_at timestamptz, handlers text[])
+  LEFT JOIN reserved ON reserved.key = incoming.key
+), inserted_events AS (
+  INSERT INTO ${events}
+    (id, type, source, key, sequence, payload, headers, correlation_id, causation_id, occurred_at, created_at, handlers)
+  SELECT incoming.id, incoming.type, incoming.source, incoming.key, incoming.sequence,
+    COALESCE(incoming.payload, 'null'::jsonb), COALESCE(incoming.headers, '{}'::jsonb),
+    incoming.correlation_id, incoming.causation_id, incoming.occurred_at, $2::timestamptz,
+    COALESCE(incoming.handlers, '{}')
+  FROM incoming
+  ORDER BY incoming.id
+  ON CONFLICT (id) DO NOTHING
+  RETURNING id, key, sequence
+), inserted_deliveries AS (
+  INSERT INTO ${this.#names.deliveries}
+    (id, event_id, handler, lane, status, attempts, available_at, key, sequence, created_at, updated_at)
+  SELECT delivery.id, delivery.event_id, delivery.handler, ${laneExpression("event.key", "event.id")}, 'pending', 0,
+    delivery.available_at, event.key, event.sequence, $2::timestamptz, $2::timestamptz
+  FROM jsonb_to_recordset($3::jsonb) AS delivery (id text, event_id text, handler text, available_at timestamptz)
+  JOIN inserted_events AS event ON event.id = delivery.event_id
+  ORDER BY delivery.event_id, delivery.handler
+  ON CONFLICT (event_id, handler) DO NOTHING
+  RETURNING available_at
+), ${this.#wakeUp("inserted_deliveries", "$5")}
+SELECT incoming.id, incoming.sequence::text AS sequence,
+  incoming.id IN (SELECT inserted_events.id FROM inserted_events) AS inserted,
+  (SELECT count(*) FROM inserted_deliveries)::int AS deliveries
+FROM incoming
+WHERE (SELECT count(*) FROM woken) >= 0`;
+  }
+  /** One wake-up notification on {@link PostgresNames.notificationChannel}, outside any publishing transaction. */
+  get notify() {
+    return `SELECT pg_notify('${this.#names.notificationChannel}', '')`;
+  }
+  /**
+   * A CTE `woken` that sends one notification on {@link PostgresNames.notificationChannel} when a row of
+   * `inserted` is due at `now`. PostgreSQL delivers it when the transaction commits, merges the same
+   * notification sent twice in one transaction, and drops it on rollback. The statement must reference
+   * `woken` for it to run.
    */
-  get reserveSequences() {
-    return `INSERT INTO ${this.#names.keySequences} AS reserved (key, sequence)
-SELECT requested.key, requested.count
-FROM jsonb_to_recordset($1::jsonb) AS requested (key text, count bigint)
-ORDER BY requested.key
-ON CONFLICT (key) DO UPDATE SET sequence = reserved.sequence + EXCLUDED.sequence
-RETURNING reserved.key AS key, reserved.sequence::text AS sequence`;
+  #wakeUp(inserted, now) {
+    return `woken AS (
+  SELECT pg_notify('${this.#names.notificationChannel}', '') FROM (
+    SELECT 1 FROM ${inserted} WHERE ${inserted}.available_at <= ${now}::timestamptz LIMIT 1
+  ) AS due
+)`;
   }
-  /** Parameters: `[eventsJson, createdAt]`. Returns the ids that were inserted. */
+  /**
+   * Parameters: `[eventsJson, createdAt]`. Returns the ids that were inserted.
+   * `handlers` is the list of handlers the event gets deliveries for: it
+   * outlives the deliveries, which are deleted when they complete.
+   */
   get insertEvents() {
     return `INSERT INTO ${this.#names.events}
-  (id, type, source, key, sequence, payload, headers, correlation_id, causation_id, occurred_at, created_at)
+  (id, type, source, key, sequence, payload, headers, correlation_id, causation_id, occurred_at, created_at, handlers)
 SELECT incoming.id, incoming.type, incoming.source, incoming.key, incoming.sequence,
   COALESCE(incoming.payload, 'null'::jsonb), COALESCE(incoming.headers, '{}'::jsonb),
-  incoming.correlation_id, incoming.causation_id, incoming.occurred_at, $2::timestamptz
+  incoming.correlation_id, incoming.causation_id, incoming.occurred_at, $2::timestamptz,
+  COALESCE(incoming.handlers, '{}')
 FROM jsonb_to_recordset($1::jsonb) AS incoming (
   id text, type text, source text, key text, sequence bigint, payload jsonb, headers jsonb,
-  correlation_id text, causation_id text, occurred_at timestamptz)
+  correlation_id text, causation_id text, occurred_at timestamptz, handlers text[])
 ORDER BY incoming.id
 ON CONFLICT (id) DO NOTHING
 RETURNING id`;
   }
   /**
-   * Parameters: `[deliveriesJson, createdAt]`. Key and sequence are copied from
-   * the stored event, so a delivery added later to an existing event keeps the
-   * event's position in its key. Returns the ids that were inserted.
+   * Locks events that were not inserted by the current append, in id order, so
+   * that appends adding handlers to the same event run one after the other.
+   * Parameters: `[eventIdsJson]`. `FOR NO KEY UPDATE` conflicts with itself and
+   * not with the foreign key checks of other inserts.
+   */
+  get lockExistingEvents() {
+    return `SELECT id FROM ${this.#names.events}
+WHERE id = ANY (ARRAY(SELECT jsonb_array_elements_text($1::jsonb)))
+ORDER BY id
+FOR NO KEY UPDATE`;
+  }
+  /**
+   * Parameters: `[deliveriesJson, createdAt, insertedEventIdsJson, now]`. Key and
+   * sequence are copied from the stored event, so a delivery added later to an
+   * existing event keeps the event's position in its key and lands in the same
+   * lane. Returns the ids that were inserted.
+   *
+   * The deliveries of events this call just inserted are all new. For an event
+   * that already existed, a handler gets a delivery only if the event does not
+   * list it yet: a completed delivery is deleted, but its handler stays listed,
+   * so a redelivered or republished event never runs a handler twice. The
+   * handlers added to an existing event are appended to its list.
    */
   get insertDeliveries() {
-    return `INSERT INTO ${this.#names.deliveries}
-  (id, event_id, handler, status, attempts, available_at, key, sequence, created_at, updated_at)
-SELECT incoming.id, incoming.event_id, incoming.handler, 'pending', 0, incoming.available_at,
-  event.key, event.sequence, $2::timestamptz, $2::timestamptz
-FROM jsonb_to_recordset($1::jsonb) AS incoming (id text, event_id text, handler text, available_at timestamptz)
-JOIN ${this.#names.events} AS event ON event.id = incoming.event_id
-ORDER BY incoming.event_id, incoming.handler
-ON CONFLICT (event_id, handler) DO NOTHING
-RETURNING id`;
+    const events = this.#names.events;
+    const insertedEvents = `ARRAY(SELECT jsonb_array_elements_text($3::jsonb))`;
+    return `WITH incoming AS (
+  SELECT incoming.id, incoming.event_id, incoming.handler, incoming.available_at
+  FROM jsonb_to_recordset($1::jsonb) AS incoming (id text, event_id text, handler text, available_at timestamptz)
+), fresh AS (
+  SELECT incoming.*, event.key, event.sequence, ${laneExpression("event.key", "event.id")} AS lane
+  FROM incoming
+  JOIN ${events} AS event ON event.id = incoming.event_id
+  WHERE event.id = ANY (${insertedEvents}) OR NOT incoming.handler = ANY (event.handlers)
+), inserted AS (
+  INSERT INTO ${this.#names.deliveries}
+    (id, event_id, handler, lane, status, attempts, available_at, key, sequence, created_at, updated_at)
+  SELECT fresh.id, fresh.event_id, fresh.handler, fresh.lane, 'pending', 0, fresh.available_at,
+    fresh.key, fresh.sequence, $2::timestamptz, $2::timestamptz
+  FROM fresh
+  ORDER BY fresh.event_id, fresh.handler
+  ON CONFLICT (event_id, handler) DO NOTHING
+  RETURNING id, event_id, handler, available_at
+), extended AS (
+  UPDATE ${events} AS event SET handlers = event.handlers || added.handlers
+  FROM (
+    SELECT inserted.event_id, array_agg(inserted.handler) AS handlers FROM inserted
+    WHERE inserted.event_id <> ALL (${insertedEvents}) GROUP BY inserted.event_id
+  ) AS added
+  WHERE event.id = added.event_id
+  RETURNING event.id
+), ${this.#wakeUp("inserted", "$4")}
+SELECT id FROM inserted WHERE (SELECT count(*) FROM woken) >= 0`;
   }
   /**
-   * Fast claim: leases from the first {@link CLAIM_SCAN_WINDOW} due deliveries
-   * in due order, which is everything the claim needs while the front of the
-   * queue is not clogged with blocked followers of busy keys. Parameters:
-   * `[now, handlersJson, limit, leaseOwner, leaseExpiresAt]`.
+   * A claim in one statement, the only one in the common case. Parameters:
+   * `[now, handlersJson, limit, leaseOwner, leaseExpiresAt, generation]`.
+   *
+   * 1. **Held lanes.** The lanes this owner holds under a live lease whose `claim_floor` is exactly the
+   *    generation are locked `FOR NO KEY UPDATE` in lane order. A lane above it was raised by a
+   *    reconciliation, so a statement of a claim whose caller gave up (a client timeout does not cancel
+   *    the statement on the server) and that reaches the server late records nothing; a lane below it was
+   *    taken by such a late statement after the reconciliation, and its listed deliveries were never
+   *    handed out. A lane that another transaction of this owner is changing makes the statement wait;
+   *    the statement then reports `stale` and does nothing (see the `stale` CTE).
+   * 2. **Free lanes**, only when the held lanes yield fewer than `limit`: the free lanes with a due
+   *    delivery (one index probe per free lane) are ranked by their oldest due delivery; the first
+   *    {@link INITIAL_FREE_LANES} that can give something now, and further ones until what they can give
+   *    (estimated from their first {@link LANE_DEPTH_CAP} due deliveries) covers what is still wanted, are locked
+   *    `FOR UPDATE SKIP LOCKED`, so a lane another claimer has is skipped, never waited
+   *    for. A lane that still runs deliveries of an expired lease is left to the transaction of
+   *    {@link takeFreeLanes}, which charges their lost attempts (`takeover_waiting`); so is any lane whose
+   *    locked row differs from what the statement's snapshot saw. A lane that runs nothing and did not
+   *    change cannot have had a delivery written since the snapshot, so its deliveries can be read here.
+   * 3. **Picks** follow the rules of {@link claim}: the fast window of each lane, and for lanes whose
+   *    window filled up while the batch is not full, the heads of all keys (a loose index scan per lane).
+   * 4. **Writes**: one update per lane. A held lane records its picks; a taken lane gets a new epoch, the
+   *    owner, the lease and its picks; a taken lane that yielded nothing is not written. Held lanes that
+   *    picked nothing, run nothing and have no full scan window are freed.
    *
-   * Always returns one row per leased delivery, or a single row whose
-   * `delivery_id` is null when nothing was leased. `window_saturated` says
+   * Always returns one row per picked delivery, or one row whose `delivery_id` is null. `running_ids`
+   * (JSON text) lists the deliveries the held lanes still run, `examined_lanes` the held lanes.
+   */
+  get claimLanes() {
+    return this.#claimLanes(true);
+  }
+  /**
+   * {@link claimLanes} limited to the lanes the owner holds: the same parameters, rows and writes, without
+   * looking at free lanes (`takeover_waiting` and `unexamined_free_lanes` are false). A worker draining a
+   * backlog finds its batch in the lanes it holds; this statement is about half as costly to plan, and
+   * the caller runs {@link claimLanes} after it only when it came up short.
+   */
+  get claimHeldLanes() {
+    return this.#claimLanes(false);
+  }
+  #claimLanes(includeFreeLanes) {
+    const deliveries = this.#names.deliveries;
+    const lanes = this.#names.lanes;
+    const freeLane = (alias) => `(${alias}.lease_expires_at IS NULL OR ${alias}.lease_expires_at <= $1::timestamptz
+      OR (${alias}.lease_owner = $4::text AND ${alias}.claim_floor < $6::bigint))`;
+    const free = includeFreeLanes ? `), free_lanes AS MATERIALIZED (
+  -- The oldest due delivery of each free lane: one index probe per free lane, bounded by the due time,
+  -- so deliveries scheduled for later are never read.
+  SELECT lane.lane, lane.epoch, lane.in_flight, lane.lease_owner, lane.lease_expires_at,
+    oldest.available_at, oldest.id, NOT ${this.#noRunningDelivery("lane")} AS running
+  FROM ${lanes} AS lane
+  CROSS JOIN LATERAL (
+    SELECT delivery.available_at, delivery.id
+    FROM ${deliveries} AS delivery
+    WHERE delivery.lane = lane.lane AND delivery.status = 'pending'
+      AND delivery.available_at <= $1::timestamptz AND ${HANDLER_PREDICATE}
+    ORDER BY delivery.available_at, delivery.id
+    LIMIT 1
+  ) AS oldest
+  WHERE (SELECT count FROM wanted) > 0 AND ${freeLane("lane")}
+  ORDER BY oldest.available_at, oldest.id
+  LIMIT (SELECT count FROM wanted) + ${FREE_LANE_SURPLUS}
+), free_depth AS MATERIALIZED (
+  -- What each candidate lane can give now, from its first due deliveries: unkeyed ones, and of a key its
+  -- lowest one when nothing earlier of the key is pending. Lanes that can give nothing are passed over;
+  -- of the others, the first ${INITIAL_FREE_LANES} are taken, and further ones until they cover what is
+  -- still wanted, so the earliest due work of the free lanes comes first.
+  SELECT runnable.lane,
+    row_number() OVER (ORDER BY runnable.available_at, runnable.id) AS rank,
+    sum(runnable.count) OVER (ORDER BY runnable.available_at, runnable.id ROWS UNBOUNDED PRECEDING) - runnable.count AS due_before
+  FROM (
+    SELECT lane_candidate.lane, lane_candidate.available_at, lane_candidate.id, depth.count
+    FROM free_lanes AS lane_candidate
+    CROSS JOIN LATERAL (
+      -- A full window that shows nothing runnable may hide runnable work behind it: such a lane counts
+      -- once, and the claim looks behind its blocked deliveries.
+      SELECT GREATEST(count(*) FILTER (
+          WHERE due.key IS NULL OR (due.position = 1 AND NOT EXISTS (
+            SELECT 1 FROM ${deliveries} AS earlier
+            WHERE earlier.lane = due.lane AND earlier.handler = due.handler AND earlier.key = due.key
+              AND earlier.status = 'pending' AND earlier.key IS NOT NULL AND earlier.sequence < due.sequence
+          ))
+        ), CASE WHEN count(*) >= ${LANE_DEPTH_CAP} THEN 1 ELSE 0 END) AS count
+      FROM (
+        SELECT window_rows.*,
+          row_number() OVER (PARTITION BY window_rows.handler, window_rows.key ORDER BY window_rows.sequence) AS position
+        FROM (
+          SELECT delivery.lane, delivery.handler, delivery.key, delivery.sequence FROM ${deliveries} AS delivery
+          WHERE delivery.lane = lane_candidate.lane AND delivery.status = 'pending'
+            AND delivery.available_at <= $1::timestamptz AND ${HANDLER_PREDICATE}
+          ORDER BY delivery.available_at, delivery.id
+          LIMIT ${LANE_DEPTH_CAP}
+        ) AS window_rows
+      ) AS due
+    ) AS depth
+    WHERE NOT lane_candidate.running AND depth.count > 0
+  ) AS runnable
+), free_locked AS MATERIALIZED (
+  SELECT lane.lane, lane.epoch, lane.in_flight, lane.lease_owner, lane.lease_expires_at
+  FROM ${lanes} AS lane
+  WHERE lane.lane IN (
+      SELECT chosen.lane FROM free_depth AS chosen
+      WHERE chosen.rank <= ${INITIAL_FREE_LANES} OR chosen.due_before < (SELECT count FROM wanted)
+    )
+    AND ${freeLane("lane")}
+  ORDER BY lane.lane
+  FOR UPDATE SKIP LOCKED
+), free_scope AS MATERIALIZED (
+  -- A lane whose locked row is not the one the snapshot saw changed hands meanwhile: left for a later claim.
+  SELECT locked.lane, locked.epoch + 1 AS epoch, '{}'::text[] AS in_flight
+  FROM free_locked AS locked
+  JOIN free_lanes AS seen ON seen.lane = locked.lane
+  WHERE locked.epoch = seen.epoch AND locked.in_flight = seen.in_flight
+    AND locked.lease_owner IS NOT DISTINCT FROM seen.lease_owner
+    AND locked.lease_expires_at IS NOT DISTINCT FROM seen.lease_expires_at
+), ${this.#candidates("free", "free_scope", null, "(SELECT count FROM wanted)")}` : `), free_lanes AS (
+  SELECT NULL::smallint AS lane, NULL::bigint AS epoch, NULL::text[] AS in_flight, false AS running WHERE false
+), free_scope AS (
+  SELECT NULL::smallint AS lane, NULL::bigint AS epoch WHERE false
+), free_candidates AS (
+  SELECT NULL::text AS id, NULL::smallint AS lane, NULL::timestamptz AS available_at WHERE false
+)`;
+    return `WITH held AS MATERIALIZED (
+  SELECT lane.lane, lane.epoch, lane.in_flight
+  FROM ${lanes} AS lane
+  WHERE lane.lease_owner = $4::text AND lane.lease_expires_at > $1::timestamptz
+    AND lane.claim_floor = $6::bigint
+  ORDER BY lane.lane
+  FOR NO KEY UPDATE
+), stale AS (
+  -- A claim that waited for a lane lock sees the new lane row but reads deliveries with the snapshot it took
+  -- before the wait: whatever changed the lane meanwhile (a reschedule, a release) may also have changed
+  -- deliveries it cannot see. The statement then does nothing and reports it, and the caller runs it again.
+  SELECT EXISTS (
+    SELECT 1 FROM held
+    JOIN ${lanes} AS before ON before.lane = held.lane
+    WHERE before.epoch <> held.epoch OR before.in_flight IS DISTINCT FROM held.in_flight
+  ) AS value
+), held_scope AS MATERIALIZED (
+  SELECT held.lane, held.epoch, held.in_flight FROM held WHERE NOT (SELECT value FROM stale)
+), held_running AS MATERIALIZED (
+  SELECT delivery.handler, delivery.key
+  FROM held_scope
+  CROSS JOIN LATERAL unnest(held_scope.in_flight) AS flying (id)
+  JOIN ${deliveries} AS delivery ON delivery.id = flying.id
+  WHERE delivery.status = 'pending' AND delivery.key IS NOT NULL
+), ${this.#candidates("held", "held_scope", "held_running", "$3::int")}, wanted AS MATERIALIZED (
+  SELECT CASE WHEN (SELECT value FROM stale) THEN 0
+    ELSE $3::int - (SELECT count(*) FROM held_candidates)::int END AS count
+${free}, claim_scope AS MATERIALIZED (
+  SELECT held_scope.lane, held_scope.epoch FROM held_scope
+  UNION ALL
+  SELECT free_scope.lane, free_scope.epoch FROM free_scope
+), picked_rows AS MATERIALIZED (
+  SELECT candidates.available_at AS due_at, delivery.id AS delivery_id, delivery.lane::int AS lane,
+    scope.epoch::text AS epoch, delivery.claims AS claims, delivery.handler, delivery.key AS delivery_key, delivery.sequence::text AS sequence, (delivery.attempts + 1)::int AS attempt,
+    ${eventColumns("event")}
+  FROM (
+    SELECT held_candidates.id, held_candidates.lane, held_candidates.available_at FROM held_candidates
+    UNION ALL
+    SELECT free_candidates.id, free_candidates.lane, free_candidates.available_at FROM free_candidates
+  ) AS candidates
+  JOIN claim_scope AS scope ON scope.lane = candidates.lane
+  JOIN ${deliveries} AS delivery ON delivery.id = candidates.id
+  JOIN ${this.#names.events} AS event ON event.id = delivery.event_id
+), by_lane AS (
+  SELECT picked_rows.lane, array_agg(picked_rows.delivery_id) AS ids FROM picked_rows GROUP BY picked_rows.lane
+), still_running AS (
+  -- The retained ids come from the locked \`held\` rows, not from the lane table: a claim that waited for the lock
+  -- must see the in-flight list the claim before it recorded, which the statement snapshot may not.
+  SELECT held.lane, array_agg(delivery.id) AS ids
+  FROM by_lane
+  JOIN held ON held.lane = by_lane.lane
+  CROSS JOIN LATERAL unnest(held.in_flight) AS flying (id)
+  JOIN ${deliveries} AS delivery ON delivery.id = flying.id AND delivery.status = 'pending'
+  GROUP BY held.lane
+), extended AS (
+  UPDATE ${lanes} AS lane
+  SET in_flight = COALESCE(still_running.ids, '{}') || by_lane.ids,
+      lease_expires_at = GREATEST(lane.lease_expires_at, $5::timestamptz)
+  FROM by_lane
+  JOIN held_scope ON held_scope.lane = by_lane.lane
+  LEFT JOIN still_running ON still_running.lane = by_lane.lane
+  WHERE lane.lane = by_lane.lane
+  RETURNING lane.lane
+), taken AS (
+  UPDATE ${lanes} AS lane
+  SET epoch = free_scope.epoch, lease_owner = $4::text, lease_expires_at = $5::timestamptz,
+      in_flight = by_lane.ids, claim_floor = $6::bigint
+  FROM free_scope
+  JOIN by_lane ON by_lane.lane = free_scope.lane
+  WHERE lane.lane = free_scope.lane
+  RETURNING lane.lane
+), saturated_lanes AS (
+  SELECT held_window.lane FROM held_window GROUP BY held_window.lane HAVING count(*) >= ${LANE_SCAN_WINDOW}
+), freed AS (
+  UPDATE ${lanes} AS lane
+  SET lease_owner = NULL, lease_expires_at = NULL, in_flight = '{}'
+  FROM held
+  WHERE lane.lane = held.lane
+    AND lane.lane NOT IN (SELECT lane FROM by_lane)
+    AND lane.lane NOT IN (SELECT lane FROM saturated_lanes)
+    AND (SELECT count(*) FROM held_window) < ${CLAIM_SCAN_WINDOW}
+    AND NOT (SELECT value FROM stale)
+    AND ${this.#noRunningDelivery("lane")}
+  RETURNING lane.lane
+)
+SELECT (SELECT value FROM stale) AS stale,
+  EXISTS (SELECT 1 FROM free_lanes WHERE free_lanes.running) AS takeover_waiting,
+  (SELECT count(*) FROM free_lanes) = (SELECT count FROM wanted) + ${FREE_LANE_SURPLUS} AS unexamined_free_lanes,
+  (
+    SELECT COALESCE(jsonb_agg(delivery.id), '[]'::jsonb)
+    FROM held
+    CROSS JOIN LATERAL unnest(held.in_flight) AS flying (id)
+    JOIN ${deliveries} AS delivery ON delivery.id = flying.id AND delivery.status = 'pending'
+  )::text AS running_ids,
+  (SELECT COALESCE(jsonb_agg(held.lane), '[]'::jsonb) FROM held)::text AS examined_lanes,
+  picked.*
+FROM (SELECT 1) AS anchor
+LEFT JOIN picked_rows AS picked ON true
+ORDER BY picked.due_at, picked.delivery_id`;
+  }
+  /**
+   * The head (lowest pending sequence) of every key of every wanted handler in the lane `scope.lane`,
+   * as a subquery returning `(id, lane, available_at, handler, key)`. A loose index scan on the
+   * pending-key index hops from key to key of a handler, and after its last key on to the first key of
+   * the next wanted handler, so the cost follows the number of keys, not the number of followers. The
+   * handlers are walked inside the recursion instead of joined to it: a join multiplied the planner's
+   * cost estimate by the handler count, which pushed the claim statements over `jit_above_cost`, and
+   * compiling them took longer than running them.
+   */
+  #keyHeads(scope) {
+    const deliveries = this.#names.deliveries;
+    const pending = `candidate.lane = ${scope}.lane AND candidate.status = 'pending'`;
+    const nextHandler = (after) => `(SELECT min(wanted.handler) FROM jsonb_array_elements_text($2::jsonb) AS wanted (handler)${after === "" ? "" : ` WHERE wanted.handler > ${after}`})`;
+    return `
+    WITH RECURSIVE hops (handler, key) AS (
+      SELECT ${nextHandler("")}, NULL::text
+      UNION ALL
+      SELECT CASE WHEN next.key IS NULL THEN ${nextHandler("hops.handler")} ELSE hops.handler END, next.key
+      FROM hops
+      CROSS JOIN LATERAL (
+        SELECT CASE WHEN hops.key IS NULL
+          THEN (SELECT candidate.key FROM ${deliveries} AS candidate
+                WHERE ${pending} AND candidate.handler = hops.handler AND candidate.key IS NOT NULL
+                ORDER BY candidate.key LIMIT 1)
+          ELSE (SELECT candidate.key FROM ${deliveries} AS candidate
+                WHERE ${pending} AND candidate.handler = hops.handler AND candidate.key > hops.key
+                ORDER BY candidate.key LIMIT 1)
+        END AS key
+        OFFSET 0
+      ) AS next
+      WHERE hops.handler IS NOT NULL
+    )
+    SELECT lowest.id, lowest.lane, lowest.available_at, lowest.handler, lowest.key
+    FROM hops
+    CROSS JOIN LATERAL (
+      SELECT candidate.id, candidate.lane, candidate.available_at, candidate.handler, candidate.key
+      FROM ${deliveries} AS candidate
+      WHERE ${pending} AND candidate.handler = hops.handler AND candidate.key = hops.key
+      ORDER BY candidate.sequence LIMIT 1
+    ) AS lowest
+    WHERE hops.key IS NOT NULL
+  `;
+  }
+  /**
+   * CTEs that pick up to `limit` claimable deliveries from the lanes of the CTE `scope` (columns `lane`,
+   * `epoch`, `in_flight`), named after `prefix`; the result is `<prefix>_candidates (id, lane, available_at)`.
+   * The rules are those of {@link claim}. The fast window reads the first {@link LANE_SCAN_WINDOW} due
+   * deliveries of each lane (at most {@link CLAIM_SCAN_WINDOW} together); of a key, only the lowest sequence
+   * in the window can be its head, so only that one is checked for an earlier pending delivery. Only when
+   * that yields fewer than `limit` are the lanes whose window filled up looked at again with a loose index
+   * scan over the heads of all their keys. `running` names the CTE of the keyed deliveries running in the
+   * lanes, or is null when nothing runs there.
+   */
+  #candidates(prefix, scope, running, limit) {
+    const deliveries = this.#names.deliveries;
+    const notRunning = (alias) => running === null ? "true" : `NOT EXISTS (SELECT 1 FROM ${running} AS running WHERE running.handler = ${alias}.handler AND running.key = ${alias}.key)`;
+    return `${prefix}_window AS MATERIALIZED (
+  SELECT recent.id, recent.lane, recent.available_at, recent.handler, recent.key, recent.sequence
+  FROM ${scope}
+  CROSS JOIN LATERAL (
+    SELECT delivery.id, delivery.lane, delivery.available_at, delivery.handler, delivery.key, delivery.sequence
+    FROM ${deliveries} AS delivery
+    WHERE delivery.lane = ${scope}.lane AND delivery.status = 'pending'
+      AND delivery.available_at <= $1::timestamptz AND ${HANDLER_PREDICATE}
+      AND delivery.id <> ALL (${scope}.in_flight)
+    ORDER BY delivery.available_at, delivery.id
+    LIMIT ${LANE_SCAN_WINDOW}
+  ) AS recent
+  ORDER BY recent.available_at, recent.id
+  LIMIT ${CLAIM_SCAN_WINDOW}
+), ${prefix}_fast AS MATERIALIZED (
+  SELECT picked.id, picked.lane, picked.available_at FROM (
+    SELECT unkeyed.id, unkeyed.lane, unkeyed.available_at FROM ${prefix}_window AS unkeyed WHERE unkeyed.key IS NULL
+    UNION ALL
+    SELECT head.id, head.lane, head.available_at
+    FROM (
+      SELECT DISTINCT ON (keyed.handler, keyed.key) keyed.id, keyed.lane, keyed.available_at, keyed.handler, keyed.key, keyed.sequence
+      FROM ${prefix}_window AS keyed
+      WHERE keyed.key IS NOT NULL
+      ORDER BY keyed.handler, keyed.key, keyed.sequence
+    ) AS head
+    WHERE NOT EXISTS (
+        SELECT 1 FROM ${deliveries} AS earlier
+        WHERE earlier.lane = head.lane AND earlier.handler = head.handler AND earlier.key = head.key
+          AND earlier.status = 'pending' AND earlier.key IS NOT NULL AND earlier.sequence < head.sequence
+      ) AND ${notRunning("head")}
+  ) AS picked
+  ORDER BY picked.available_at, picked.id
+  LIMIT ${limit}
+), ${prefix}_saturated AS MATERIALIZED (
+  SELECT ${scope}.lane, ${scope}.in_flight FROM ${scope}
+  WHERE (SELECT count(*) FROM ${prefix}_fast) < ${limit}
+    AND ((SELECT count(*) FROM ${prefix}_window) >= ${CLAIM_SCAN_WINDOW}
+      OR ${scope}.lane IN (
+        SELECT full_lane.lane FROM ${prefix}_window AS full_lane
+        GROUP BY full_lane.lane HAVING count(*) >= ${LANE_SCAN_WINDOW}
+      ))
+), ${prefix}_heads AS MATERIALIZED (
+  SELECT head.id, head.lane, head.available_at, head.handler, head.key
+  FROM ${prefix}_saturated AS scope
+  CROSS JOIN LATERAL (${this.#keyHeads("scope")}) AS head
+), ${prefix}_keyed AS MATERIALIZED (
+  SELECT heads.id, heads.lane, heads.available_at
+  FROM ${prefix}_heads AS heads
+  JOIN ${prefix}_saturated AS scope ON scope.lane = heads.lane
+  WHERE heads.available_at <= $1::timestamptz AND heads.id <> ALL (scope.in_flight) AND ${notRunning("heads")}
+  ORDER BY heads.available_at, heads.id
+  LIMIT ${limit}
+), ${prefix}_unkeyed AS MATERIALIZED (
+  SELECT recent.id, recent.lane, recent.available_at
+  FROM ${prefix}_saturated AS scope
+  CROSS JOIN LATERAL (
+    SELECT delivery.id, delivery.lane, delivery.available_at
+    FROM ${deliveries} AS delivery
+    WHERE delivery.lane = scope.lane AND delivery.key IS NULL AND delivery.status = 'pending'
+      AND delivery.available_at <= $1::timestamptz AND ${HANDLER_PREDICATE}
+      AND delivery.id <> ALL (scope.in_flight)
+    ORDER BY delivery.available_at, delivery.id
+    LIMIT ${limit}
+  ) AS recent
+  ORDER BY recent.available_at, recent.id
+  LIMIT ${limit}
+), ${prefix}_candidates AS MATERIALIZED (
+  SELECT chosen.id, chosen.lane, chosen.available_at FROM (
+    SELECT fast.id, fast.lane, fast.available_at FROM ${prefix}_fast AS fast
+    UNION
+    SELECT keyed.id, keyed.lane, keyed.available_at FROM ${prefix}_keyed AS keyed
+    UNION
+    SELECT unkeyed.id, unkeyed.lane, unkeyed.available_at FROM ${prefix}_unkeyed AS unkeyed
+  ) AS chosen
+  ORDER BY chosen.available_at, chosen.id
+  LIMIT ${limit}
+)`;
+  }
+  /**
+   * Takes up to `$3` free lanes (no lease, or an expired one) that have a due
+   * delivery of the requested handlers, the ones with the oldest due delivery
+   * first. Parameters: `[now, handlersJson, laneCount, leaseOwner, leaseExpiresAt, generation]`.
+   * The lane gets the owner's `generation` as its `claim_floor`. A lane the owner itself holds under a live
+   * lease with a lower floor was taken by a claim statement that reached the server after its caller gave up
+   * and the owner reconciled (or by an earlier incarnation of the same owner): it is taken over like the lane of a
+   * crashed worker, so its listed deliveries are charged an attempt.
+   *
+   * A taken lane gets a new epoch, which fences everything the previous owner
+   * still holds. Deliveries the previous owner had in flight are the ones whose
+   * attempt was never recorded (a claim writes no delivery row), so each of
+   * them is charged one attempt here: a worker that crashes with a poison
+   * message still runs it into the retry limit. Lanes another claimer has locked
+   * are skipped, never waited for.
+   */
+  get takeFreeLanes() {
+    const deliveries = this.#names.deliveries;
+    const lanes = this.#names.lanes;
+    return `WITH picked AS (
+  -- in_flight is read here, from the locked version of the lane: a settlement that committed after the
+  -- statement took its snapshot has taken its delivery out of the list already and must not be charged again.
+  SELECT free.lane, free.in_flight
+  FROM ${lanes} AS free
+  CROSS JOIN LATERAL (
+    SELECT delivery.available_at, delivery.id
+    FROM ${deliveries} AS delivery
+    WHERE delivery.lane = free.lane AND delivery.status = 'pending'
+      AND delivery.available_at <= $1::timestamptz AND ${HANDLER_PREDICATE}
+    ORDER BY delivery.available_at, delivery.id
+    LIMIT 1
+  ) AS oldest
+  WHERE free.lease_expires_at IS NULL OR free.lease_expires_at <= $1::timestamptz
+    OR (free.lease_owner = $4::text AND free.claim_floor < $6::bigint)
+  ORDER BY oldest.available_at, oldest.id
+  LIMIT $3::int
+  FOR UPDATE OF free SKIP LOCKED
+), charged AS (
+  UPDATE ${deliveries} AS delivery SET attempts = delivery.attempts + 1, claims = delivery.claims + 1
+  FROM (
+    SELECT unnest(picked.in_flight) AS id FROM picked
+  ) AS lost
+  WHERE delivery.id = lost.id AND delivery.status = 'pending'
+  RETURNING delivery.id
+), taken AS (
+  UPDATE ${lanes} AS lane
+  SET epoch = lane.epoch + 1, lease_owner = $4::text, lease_expires_at = $5::timestamptz, in_flight = '{}',
+      claim_floor = $6::bigint
+  FROM picked WHERE lane.lane = picked.lane
+  RETURNING lane.lane, lane.epoch
+)
+SELECT lane::int AS lane, epoch::text AS epoch FROM taken ORDER BY lane`;
+  }
+  /**
+   * Fast claim: picks from the first {@link CLAIM_SCAN_WINDOW} due deliveries of
+   * the given lanes in due order, which is everything the claim needs while the
+   * front of the queue is not clogged with blocked followers of busy keys.
+   * Parameters: `[now, handlersJson, limit, lanesJson]`. The lanes must be held
+   * and locked by the caller.
+   *
+   * Always returns one row per picked delivery, or a single row whose
+   * `delivery_id` is null when nothing was picked. `window_saturated` says
    * whether the window was full: when it is and fewer than `limit` deliveries
-   * were leased, deliveries beyond the window may still be claimable and the
+   * were picked, deliveries beyond the window may still be claimable and the
    * caller runs {@link claimBehindBlockedKeys}. When the window is not
    * saturated every due delivery was examined, so the result is complete.
    *
-   * Candidates are chosen with `FOR UPDATE SKIP LOCKED`, so two claimers never
-   * lock the same row. A keyed delivery is a candidate only when it is the head
-   * of its (handler, key), that is (a) no earlier delivery of that handler and
-   * key is pending or processing, which is the ordering guarantee, and (b) no
-   * other delivery of that handler and key holds a live lease. Rule b covers a
-   * delivery that re-enters the key behind a running one (requeue, or a handler
-   * added to an old event); an expired lease does not count, because its worker
-   * is presumed dead and the key must not stall behind it.
+   * A delivery is a candidate when it is pending, due, and not in flight. A
+   * keyed delivery is a candidate only when it is the head of its (handler,
+   * key), that is (a) no earlier delivery of that handler and key is pending
+   * (an earlier one in flight is still a pending row, which is the ordering
+   * guarantee), and (b) no other delivery of that handler and key is in
+   * flight, which covers a delivery that re-enters the key behind a running one
+   * (requeue, or a handler added to an old event).
    *
-   * Why SKIP LOCKED alone is enough for ordering: only the head of a key can
-   * ever be a candidate, and the head is a single row. Two claimers racing
-   * for it either skip it (the other holds the row lock) or, if the other
-   * already committed, re-check the row's new version (now processing and not
-   * due), which excludes it. Followers stay blocked because their predecessor
-   * remains pending or processing in every snapshot until it completes or is
-   * buried, and that commit happens-before the next claim that sees it.
+   * No row is locked or written here: the lanes' exclusive leases are the
+   * mutual exclusion, so two claimers never see the same lane.
    */
   get claim() {
+    return `WITH ${this.#scopeAndRunning(`SELECT lane.lane, lane.epoch, lane.in_flight FROM ${this.#names.lanes} AS lane WHERE lane.lane = ANY (${LANE_LIST})`)},
+${this.#fastWindow()}
+)
+${this.#pickedRows(`((SELECT count(*) FROM due_window) >= ${CLAIM_SCAN_WINDOW} OR EXISTS (SELECT 1 FROM due_window GROUP BY lane HAVING count(*) >= ${LANE_SCAN_WINDOW}))`)}`;
+  }
+  /** The `due_window` and `candidates` CTEs of the fast claim, up to (not including) the closing parenthesis of `candidates`. */
+  #fastWindow() {
     const deliveries = this.#names.deliveries;
-    return `WITH due_window AS MATERIALIZED (
-  SELECT delivery.id
-  FROM ${deliveries} AS delivery
-  WHERE ${UNFINISHED_PREDICATE("delivery")}
-    AND ${dueAtExpression("delivery")} <= $1::timestamptz
-    AND ${HANDLER_PREDICATE}
-  ORDER BY ${dueAtExpression("delivery")}, delivery.id
+    return `due_window AS MATERIALIZED (
+  SELECT recent.id, recent.lane, recent.available_at
+  FROM scope
+  CROSS JOIN LATERAL (
+    SELECT delivery.id, delivery.lane, delivery.available_at
+    FROM ${deliveries} AS delivery
+    WHERE delivery.lane = scope.lane AND delivery.status = 'pending'
+      AND delivery.available_at <= $1::timestamptz AND ${HANDLER_PREDICATE}
+      AND delivery.id <> ALL (scope.in_flight)
+    ORDER BY delivery.available_at, delivery.id
+    LIMIT ${LANE_SCAN_WINDOW}
+  ) AS recent
+  ORDER BY recent.available_at, recent.id
   LIMIT ${CLAIM_SCAN_WINDOW}
 ), candidates AS MATERIALIZED (
-  SELECT delivery.id, ${dueAtExpression("delivery")} AS due_at
+  SELECT delivery.id, delivery.lane, delivery.available_at
   FROM due_window
   JOIN ${deliveries} AS delivery ON delivery.id = due_window.id
-  WHERE ${UNFINISHED_PREDICATE("delivery")}
-    AND ${dueAtExpression("delivery")} <= $1::timestamptz
-    AND (
-      delivery.key IS NULL
-      OR NOT (
-        EXISTS (
-          SELECT 1 FROM ${deliveries} AS earlier
-          WHERE earlier.key IS NOT NULL AND earlier.handler = delivery.handler AND earlier.key = delivery.key
-            AND ${UNFINISHED_PREDICATE("earlier")}
-            AND earlier.sequence < delivery.sequence
-        )
-        OR ${this.#liveLeaseElsewhere()}
-      )
-    )
-  ORDER BY due_at, delivery.id
-  LIMIT $3::int
-  FOR UPDATE OF delivery SKIP LOCKED
-), ${this.#leaseCandidates()}
-SELECT (SELECT count(*) FROM due_window) >= ${CLAIM_SCAN_WINDOW} AS window_saturated, leased.*
-FROM (SELECT 1) AS anchor
-LEFT JOIN (${this.#leasedRows()}) AS leased ON true
-ORDER BY leased.due_at, leased.delivery_id`;
+  WHERE delivery.key IS NULL OR NOT (${this.#blockedKey("delivery")})
+  ORDER BY delivery.available_at, delivery.id
+  LIMIT $3::int`;
   }
   /**
-   * Slow claim, run when {@link claim} leased too few deliveries from a full
+   * Slow claim, run when {@link claim} picked too few deliveries from a full
    * window: the front of the due queue is mostly followers of blocked keys.
-   * Same parameters, rules and locking as {@link claim}, but heads are found
-   * with `DISTINCT ON (handler, key)` over the unfinished-key index, so the
-   * cost follows the number of unfinished keyed deliveries (one index-only
-   * scan) instead of one probe per due follower.
+   * Same parameters and rules as {@link claim}, but heads are found with
+   * a loose index scan over the pending-key index of each lane (it hops from key
+   * to key), so the cost follows the number of pending keys in the lanes
+   * instead of one probe per due follower.
    */
   get claimBehindBlockedKeys() {
     const deliveries = this.#names.deliveries;
-    return `WITH heads AS MATERIALIZED (
-  SELECT DISTINCT ON (head.handler, head.key) head.id
-  FROM ${deliveries} AS head
-  WHERE head.key IS NOT NULL
-    AND ${UNFINISHED_PREDICATE("head")}
-    AND head.handler = ANY (ARRAY(SELECT jsonb_array_elements_text($2::jsonb)))
-  ORDER BY head.handler, head.key, head.sequence
+    return `WITH ${this.#scopeAndRunning(`SELECT lane.lane, lane.epoch, lane.in_flight FROM ${this.#names.lanes} AS lane WHERE lane.lane = ANY (${LANE_LIST})`)},
+heads AS MATERIALIZED (
+  SELECT head.id, head.lane, head.available_at, head.handler, head.key
+  FROM scope
+  CROSS JOIN LATERAL (${this.#keyHeads("scope")}) AS head
 ), keyed AS MATERIALIZED (
-  SELECT delivery.id, ${dueAtExpression("delivery")} AS due_at
+  SELECT heads.id, heads.lane, heads.available_at
   FROM heads
-  JOIN ${deliveries} AS delivery ON delivery.id = heads.id
-  WHERE ${UNFINISHED_PREDICATE("delivery")}
-    AND ${dueAtExpression("delivery")} <= $1::timestamptz
-    AND NOT ${this.#liveLeaseElsewhere()}
-  ORDER BY due_at, delivery.id
+  JOIN scope ON scope.lane = heads.lane
+  WHERE heads.available_at <= $1::timestamptz AND heads.id <> ALL (scope.in_flight)
+    AND NOT EXISTS (SELECT 1 FROM running WHERE running.handler = heads.handler AND running.key = heads.key)
+  ORDER BY heads.available_at, heads.id
   LIMIT $3::int
-  FOR UPDATE OF delivery SKIP LOCKED
 ), unkeyed AS MATERIALIZED (
-  SELECT delivery.id, ${dueAtExpression("delivery")} AS due_at
-  FROM ${deliveries} AS delivery
-  WHERE delivery.key IS NULL
-    AND ${UNFINISHED_PREDICATE("delivery")}
-    AND ${dueAtExpression("delivery")} <= $1::timestamptz
-    AND ${HANDLER_PREDICATE}
-  ORDER BY due_at, delivery.id
+  SELECT recent.id, recent.lane, recent.available_at
+  FROM scope
+  CROSS JOIN LATERAL (
+    SELECT delivery.id, delivery.lane, delivery.available_at
+    FROM ${deliveries} AS delivery
+    WHERE delivery.lane = scope.lane AND delivery.key IS NULL AND delivery.status = 'pending'
+      AND delivery.available_at <= $1::timestamptz AND ${HANDLER_PREDICATE}
+      AND delivery.id <> ALL (scope.in_flight)
+    ORDER BY delivery.available_at, delivery.id
+    LIMIT $3::int
+  ) AS recent
+  ORDER BY recent.available_at, recent.id
   LIMIT $3::int
-  FOR UPDATE OF delivery SKIP LOCKED
 ), candidates AS MATERIALIZED (
-  SELECT id, due_at FROM (
-    SELECT id, due_at FROM keyed
+  SELECT id, lane, available_at FROM (
+    SELECT id, lane, available_at FROM keyed
     UNION ALL
-    SELECT id, due_at FROM unkeyed
+    SELECT id, lane, available_at FROM unkeyed
   ) AS both_sets
-  ORDER BY due_at, id
+  ORDER BY available_at, id
   LIMIT $3::int
-), ${this.#leaseCandidates()}
-SELECT false AS window_saturated, leased.*
-FROM (SELECT 1) AS anchor
-LEFT JOIN (${this.#leasedRows()}) AS leased ON true
-ORDER BY leased.due_at, leased.delivery_id`;
+)
+${this.#pickedRows("false")}`;
+  }
+  /** The held lanes with their epochs and in-flight ids, and the keyed deliveries running in them. */
+  #scopeAndRunning(scopeQuery) {
+    const deliveries = this.#names.deliveries;
+    return `scope AS MATERIALIZED (
+  ${scopeQuery}
+), running AS MATERIALIZED (
+  SELECT delivery.handler, delivery.key
+  FROM scope
+  CROSS JOIN LATERAL unnest(scope.in_flight) AS flying (id)
+  JOIN ${deliveries} AS delivery ON delivery.id = flying.id
+  WHERE delivery.status = 'pending' AND delivery.key IS NOT NULL
+)`;
+  }
+  /** True when an earlier delivery of the candidate's handler and key is pending, or another one is running. */
+  #blockedKey(alias) {
+    return `EXISTS (
+        SELECT 1 FROM ${this.#names.deliveries} AS earlier
+        WHERE earlier.lane = ${alias}.lane AND earlier.handler = ${alias}.handler AND earlier.key = ${alias}.key
+          AND earlier.status = 'pending' AND earlier.key IS NOT NULL
+          AND earlier.sequence < ${alias}.sequence
+      ) OR ${this.#runningElsewhere(alias)}`;
   }
-  /** True when another delivery of the candidate's handler and key holds a live lease. */
-  #liveLeaseElsewhere() {
+  /** True when a delivery of the candidate's handler and key is in flight. The candidate itself never is. */
+  #runningElsewhere(alias) {
     return `EXISTS (
-          SELECT 1 FROM ${this.#names.deliveries} AS running
-          WHERE running.key IS NOT NULL
-            AND running.handler = delivery.handler AND running.key = delivery.key
-            AND running.status = 'processing' AND running.lease_expires_at > $1::timestamptz
-            AND running.id <> delivery.id
-        )`;
-  }
-  /** The `claimed` CTE: leases every row of `candidates`. */
-  #leaseCandidates() {
-    return `claimed AS (
-  UPDATE ${this.#names.deliveries} AS target
-  SET status = 'processing',
-      attempts = target.attempts + 1,
-      lease_owner = $4::text,
-      lease_token = gen_random_uuid()::text,
-      lease_expires_at = $5::timestamptz,
-      updated_at = $1::timestamptz
+        SELECT 1 FROM running
+        WHERE running.handler = ${alias}.handler AND running.key = ${alias}.key
+      )`;
+  }
+  /** Final SELECT shared by both claims: the picked deliveries with their lane epoch and event. */
+  #pickedRows(saturated) {
+    return `SELECT ${saturated} AS window_saturated, picked.*
+FROM (SELECT 1) AS anchor
+LEFT JOIN (
+  ${this.#pickedRowsSelect()}
+) AS picked ON true
+ORDER BY picked.due_at, picked.delivery_id`;
+  }
+  /** The picked deliveries joined with the lane epoch and their event, as the claim result columns. */
+  #pickedRowsSelect() {
+    return `SELECT candidates.available_at AS due_at, delivery.id AS delivery_id, delivery.lane::int AS lane,
+    scope.epoch::text AS epoch, delivery.claims AS claims, delivery.handler, delivery.key AS delivery_key, delivery.sequence::text AS sequence, (delivery.attempts + 1)::int AS attempt,
+    ${eventColumns("event")}
   FROM candidates
-  WHERE target.id = candidates.id
-  RETURNING target.id, target.event_id, target.handler, target.attempts, target.lease_token, candidates.due_at
-)`;
+  JOIN scope ON scope.lane = candidates.lane
+  JOIN ${this.#names.deliveries} AS delivery ON delivery.id = candidates.id
+  JOIN ${this.#names.events} AS event ON event.id = delivery.event_id`;
   }
-  /** Leased deliveries joined with their events, as the claim result columns. */
-  #leasedRows() {
-    return `SELECT claimed.due_at, claimed.id AS delivery_id, claimed.handler, claimed.attempts::int AS attempts, claimed.lease_token,
-  ${eventColumns("event")}
-FROM claimed
-JOIN ${this.#names.events} AS event ON event.id = claimed.event_id`;
+  /**
+   * Records the deliveries a claim picked in their lanes and frees the lanes it
+   * took or held for nothing. Parameters:
+   * `[pickedJson, idleLanesJson, leaseOwner, leaseExpiresAt]` with
+   * `pickedJson = [{ lane, ids }]`.
+   *
+   * A picked lane lists the ids that are still in flight (listed ids whose row
+   * still exists) plus the new ones, and its lease reaches `leaseExpiresAt`.
+   * An idle lane is freed when no delivery of it is in flight, so other workers
+   * need not wait for the lease to expire.
+   */
+  get recordClaim() {
+    const deliveries = this.#names.deliveries;
+    const lanes = this.#names.lanes;
+    return `WITH picked AS (
+  SELECT recorded.lane, recorded.ids
+  FROM jsonb_to_recordset($1::jsonb) AS recorded (lane smallint, ids text[])
+), still_running AS (
+  SELECT lane.lane, array_agg(delivery.id) AS ids
+  FROM picked
+  JOIN ${lanes} AS lane ON lane.lane = picked.lane
+  CROSS JOIN LATERAL unnest(lane.in_flight) AS flying (id)
+  JOIN ${deliveries} AS delivery ON delivery.id = flying.id AND delivery.status = 'pending'
+  GROUP BY lane.lane
+), extended AS (
+  UPDATE ${lanes} AS lane
+  SET in_flight = COALESCE(still_running.ids, '{}') || picked.ids,
+      lease_expires_at = GREATEST(lane.lease_expires_at, $4::timestamptz)
+  FROM picked
+  LEFT JOIN still_running ON still_running.lane = picked.lane
+  WHERE lane.lane = picked.lane
+  RETURNING lane.lane
+), freed AS (
+  UPDATE ${lanes} AS lane
+  SET lease_owner = NULL, lease_expires_at = NULL, in_flight = '{}'
+  WHERE lane.lane = ANY (ARRAY(SELECT jsonb_array_elements_text($2::jsonb)::smallint))
+    AND lane.lease_owner = $3::text
+    AND ${this.#noRunningDelivery("lane")}
+  RETURNING lane.lane
+)
+SELECT (SELECT count(*) FROM extended)::int AS extended, (SELECT count(*) FROM freed)::int AS freed`;
+  }
+  /** True when none of the lane's listed deliveries exists as a pending row. */
+  #noRunningDelivery(laneAlias) {
+    return `NOT EXISTS (
+      SELECT 1 FROM unnest(${laneAlias}.in_flight) AS flying (id)
+      JOIN ${this.#names.deliveries} AS delivery ON delivery.id = flying.id AND delivery.status = 'pending'
+    )`;
+  }
+  /**
+   * Keeps in the in-flight lists of the lanes `$1` holds only the claims in `$2`
+   * (`[{ id, lane, epoch, claims }]`, the ones this store handed out and nobody
+   * settled yet) and takes every other delivery out. That is a batch a claim
+   * recorded but whose answer never arrived: nothing runs it and the lane lease,
+   * renewed by the owner's other deliveries, would keep it away from everybody for
+   * ever. A claim matches only with the lane epoch and the delivery generation it was
+   * handed out with. Parameters: `[leaseOwner, handedOutJson, generation]`; a lane whose `claim_floor` is above
+   * the generation was reconciled by a newer call, so an older (late) reconciliation leaves it alone.
+   * The lanes are locked in lane order first (see the lock order on {@link PostgresStatements}).
+   */
+  get reconcileClaims() {
+    const deliveries = this.#names.deliveries;
+    const handedOut = `jsonb_to_recordset($2::jsonb) AS handed (id text, lane smallint, epoch bigint, claims int)`;
+    const kept = `SELECT 1 FROM ${handedOut} JOIN ${deliveries} AS delivery ON delivery.id = handed.id
+      WHERE handed.id = flying.id AND handed.lane = lane.lane AND handed.epoch = lane.epoch AND delivery.claims = handed.claims`;
+    return `WITH owned AS MATERIALIZED (
+  SELECT lane.lane FROM ${this.#names.lanes} AS lane
+  WHERE lane.lease_owner = $1::text AND lane.claim_floor <= $3::bigint
+  ORDER BY lane.lane
+  FOR NO KEY UPDATE
+)
+UPDATE ${this.#names.lanes} AS lane
+SET in_flight = ARRAY(SELECT flying.id FROM unnest(lane.in_flight) AS flying (id) WHERE EXISTS (${kept})),
+    claim_floor = $3::bigint
+FROM owned
+WHERE lane.lane = owned.lane AND lane.lease_owner = $1::text AND lane.claim_floor <= $3::bigint`;
+  }
+  /**
+   * Frees every lane `$1` holds that has no running delivery, locking them in lane order first.
+   * Parameters: `[leaseOwner]`.
+   */
+  get relinquish() {
+    return `WITH owned AS MATERIALIZED (
+  SELECT lane.lane FROM ${this.#names.lanes} AS lane
+  WHERE lane.lease_owner = $1::text
+  ORDER BY lane.lane
+  FOR NO KEY UPDATE
+)
+UPDATE ${this.#names.lanes} AS lane
+SET lease_owner = NULL, lease_expires_at = NULL, in_flight = '{}'
+FROM owned
+WHERE lane.lane = owned.lane AND lane.lease_owner = $1::text AND ${this.#noRunningDelivery("lane")}`;
   }
-  /** Parameters: `[deliveryId, leaseToken, leaseExpiresAt, now]`. */
+  /**
+   * Extends the lease of the lane a running delivery belongs to; the lane lease
+   * never shrinks. Parameters: `[deliveryId, lane, epoch, claims, leaseExpiresAt]`.
+   */
   get extendLease() {
-    return countChanged(`UPDATE ${this.#names.deliveries}
-SET lease_expires_at = $3::timestamptz, updated_at = $4::timestamptz
-WHERE id = $1::text AND status = 'processing' AND lease_token = $2::text`);
+    return countChanged(`UPDATE ${this.#names.lanes} AS lane
+SET lease_expires_at = GREATEST(lane.lease_expires_at, $5::timestamptz)
+WHERE lane.lane = $2::smallint AND lane.epoch = $3::bigint AND $1::text = ANY (lane.in_flight)
+  AND EXISTS (
+    SELECT 1 FROM ${this.#names.deliveries} AS delivery
+    WHERE delivery.id = $1::text AND delivery.status = 'pending' AND delivery.claims = $4::int
+  )`);
   }
-  /** Parameters: `[deliveryId, leaseToken, now]`. */
+  /**
+   * Deletes the running deliveries whose lane lease is still the one they were
+   * claimed under. Parameters: `[leasesJson, now]` with
+   * `leasesJson = [{ ord, id, lane, epoch, claims }]`. Returns the `ord` of every lease that was completed, so
+   * results are matched to leases and not to delivery ids. A delivery is only deleted by the claim that
+   * is still its current one (`claims`), which makes a stale lease harmless even when the same owner re-claimed
+   * the delivery in the same lane epoch. The event gets a completion time for retention.
+   *
+   * The lane rows are locked `FOR KEY SHARE` first, in lane order, and the lock
+   * is held until the surrounding transaction ends. A claimer that takes the
+   * lane over locks it `FOR UPDATE`, which conflicts with that lock, so it
+   * skips the lane until this completion commits or rolls back: a completion
+   * and a takeover cannot both succeed for one delivery, which is what makes a
+   * transactional handler's writes effectively-once. The weakest lock that
+   * conflicts with a takeover is used on purpose: it does not conflict with the
+   * owner's own claim and heartbeats (plain updates of the lane row), which
+   * would otherwise wait for every completion in progress. With a completion history the deleted rows are copied to
+   * it in the same statement.
+   */
   get complete() {
-    return countChanged(`UPDATE ${this.#names.deliveries}
-SET status = 'completed', completed_at = $3::timestamptz, updated_at = $3::timestamptz, ${CLEAR_LEASE}
-WHERE id = $1::text AND status = 'processing' AND lease_token = $2::text`);
+    const deliveries = this.#names.deliveries;
+    const history = this.#names.completionHistory;
+    return `WITH leases AS (
+  SELECT lease.ord, lease.id, lease.lane, lease.epoch, lease.claims
+  FROM jsonb_to_recordset($1::jsonb) AS lease (ord int, id text, lane smallint, epoch bigint, claims int)
+), fence AS MATERIALIZED (
+  SELECT lane.lane, lane.epoch, lane.in_flight
+  FROM ${this.#names.lanes} AS lane
+  WHERE lane.lane IN (SELECT lane FROM leases)
+  ORDER BY lane.lane
+  FOR KEY SHARE
+), completed AS (
+  DELETE FROM ${deliveries} AS delivery
+  USING leases JOIN fence ON fence.lane = leases.lane AND fence.epoch = leases.epoch
+  WHERE delivery.id = leases.id AND delivery.lane = leases.lane AND delivery.status = 'pending'
+    AND delivery.claims = leases.claims AND leases.id = ANY (fence.in_flight)
+  RETURNING leases.ord, delivery.id, delivery.event_id, delivery.handler, delivery.attempts, delivery.available_at, delivery.created_at
+), stamped AS (
+  INSERT INTO ${this.#names.eventCompletions} (event_id, completed_at)
+  SELECT DISTINCT completed.event_id, $2::timestamptz FROM completed
+  -- Event id order: completions of other handlers of the same events lock these rows too.
+  ORDER BY completed.event_id
+  ON CONFLICT (event_id) DO UPDATE SET completed_at = GREATEST(${this.#names.eventCompletions}.completed_at, EXCLUDED.completed_at)
+  RETURNING event_id
+)${history ? `, archived AS (
+  INSERT INTO ${this.#names.completions} (id, event_id, handler, attempts, available_at, created_at, completed_at)
+  SELECT id, event_id, handler, attempts + 1, available_at, created_at, $2::timestamptz FROM completed
+  RETURNING id
+)` : ""}
+SELECT ord FROM completed`;
   }
-  /** Parameters: `[deliveryId, leaseToken, availableAt, errorJson, now]`. */
+  /**
+   * Returns a running delivery to pending, due at `availableAt`, and takes it
+   * out of the lane's in-flight list. Parameters:
+   * `[deliveryId, lane, epoch, claims, availableAt, errorJson, now]`. The attempt that
+   * just ended is counted.
+   */
   get reschedule() {
-    return countChanged(`UPDATE ${this.#names.deliveries}
-SET status = 'pending', available_at = $3::timestamptz, last_error = $4::jsonb, updated_at = $5::timestamptz, ${CLEAR_LEASE}
-WHERE id = $1::text AND status = 'processing' AND lease_token = $2::text`);
+    return this.#leaveFlight(
+      `SET available_at = $5::timestamptz, last_error = $6::jsonb, attempts = delivery.attempts + 1, claims = delivery.claims + 1, updated_at = $7::timestamptz`
+    );
   }
-  /** Parameters: `[deliveryId, leaseToken, errorJson, now]`. */
+  /** Parameters: `[deliveryId, lane, epoch, claims, errorJson, now]`. The attempt that just ended is counted. */
   get bury() {
-    return countChanged(`UPDATE ${this.#names.deliveries}
-SET status = 'dead', last_error = $3::jsonb, updated_at = $4::timestamptz, ${CLEAR_LEASE}
-WHERE id = $1::text AND status = 'processing' AND lease_token = $2::text`);
+    return this.#leaveFlight(
+      `SET status = 'dead', last_error = $5::jsonb, attempts = delivery.attempts + 1, claims = delivery.claims + 1, updated_at = $6::timestamptz`
+    );
   }
   /**
-   * Gives a leased delivery back without spending its attempt: pending, due
-   * `now`, attempt count decremented. Parameters: `[deliveryId, leaseToken, now]`.
+   * Gives a running delivery back without spending its attempt (an attempt is
+   * only recorded when it ends in failure or a lost lease): pending, due `now`.
+   * Parameters: `[deliveryId, lane, epoch, claims, now]`.
    */
   get release() {
-    return countChanged(`UPDATE ${this.#names.deliveries}
-SET status = 'pending', available_at = $3::timestamptz, attempts = attempts - 1, updated_at = $3::timestamptz, ${CLEAR_LEASE}
-WHERE id = $1::text AND status = 'processing' AND lease_token = $2::text`);
+    return this.#leaveFlight(
+      `SET available_at = $5::timestamptz, claims = delivery.claims + 1, updated_at = $5::timestamptz`
+    );
+  }
+  /**
+   * Applies `assignments` to a running delivery and removes it from its lane's
+   * in-flight list, if the lane still has the caller's epoch. The lane row is
+   * locked first (`FOR NO KEY UPDATE`, which conflicts with a takeover's `FOR UPDATE`), so a takeover cannot interleave. Parameters
+   * `$1`..`$4` are always `[deliveryId, lane, epoch, claims]`; ending a claim bumps `claims`.
+   */
+  #leaveFlight(assignments) {
+    const lanes = this.#names.lanes;
+    return `WITH fence AS MATERIALIZED (
+  SELECT lane.lane FROM ${lanes} AS lane
+  WHERE lane.lane = $2::smallint AND lane.epoch = $3::bigint AND $1::text = ANY (lane.in_flight)
+  FOR NO KEY UPDATE
+), changed AS (
+  UPDATE ${this.#names.deliveries} AS delivery ${assignments}
+  FROM fence
+  WHERE delivery.id = $1::text AND delivery.lane = fence.lane AND delivery.status = 'pending'
+    AND delivery.claims = $4::int
+  RETURNING delivery.id
+), trimmed AS (
+  UPDATE ${lanes} AS lane SET in_flight = array_remove(lane.in_flight, $1::text)
+  FROM changed WHERE lane.lane = $2::smallint
+  RETURNING lane.lane
+)
+SELECT count(*)::int AS count FROM changed`;
   }
-  /** Parameters: `[deliveryIdsJson, now]`. */
+  /** Parameters: `[deliveryIdsJson, now]`. The dead rows are locked in id order first. */
   get requeue() {
-    return countChanged(`UPDATE ${this.#names.deliveries}
+    const deliveries = this.#names.deliveries;
+    return countChanged(`WITH dead AS MATERIALIZED (
+  SELECT delivery.id FROM ${deliveries} AS delivery
+  WHERE delivery.id = ANY (ARRAY(SELECT jsonb_array_elements_text($1::jsonb))) AND delivery.status = 'dead'
+  ORDER BY delivery.id
+  FOR NO KEY UPDATE
+)
+UPDATE ${deliveries} AS delivery
 SET status = 'pending', attempts = 0, available_at = $2::timestamptz, updated_at = $2::timestamptz
-WHERE id = ANY (ARRAY(SELECT jsonb_array_elements_text($1::jsonb))) AND status = 'dead'`);
+FROM dead
+WHERE delivery.id = dead.id AND delivery.status = 'dead'`);
   }
-  /** Builds the filtered, creation-ordered listing. */
+  /**
+   * Builds the filtered, creation-ordered listing. A delivery is `processing`
+   * while its row exists as `pending` and its lane lists its id; its attempt
+   * count, lease owner and lease expiry then come from the claim and the lane.
+   * Records of the completion history (when kept) are listed as `completed`.
+   */
   listDeliveries(query) {
     const parameters = [];
-    const conditions = [];
     const bind = (value) => {
       parameters.push(value);
       return `$${parameters.length}::${typeof value === "number" ? "int" : "text"}`;
     };
-    if (query.status !== void 0) {
-      conditions.push(`delivery.status = ${bind(query.status)}`);
-    }
-    if (query.handler !== void 0) {
-      conditions.push(`delivery.handler = ${bind(query.handler)}`);
-    }
-    if (query.eventType !== void 0) {
-      conditions.push(`event.type = ${bind(query.eventType)}`);
-    }
-    if (query.eventId !== void 0) {
-      conditions.push(`delivery.event_id = ${bind(query.eventId)}`);
-    }
-    const where = conditions.length === 0 ? "" : `WHERE ${conditions.join(" AND ")}`;
+    const filters = {
+      handler: query.handler === void 0 ? void 0 : bind(query.handler),
+      eventType: query.eventType === void 0 ? void 0 : bind(query.eventType),
+      eventId: query.eventId === void 0 ? void 0 : bind(query.eventId),
+      status: query.status === void 0 ? void 0 : bind(query.status)
+    };
     const limit = bind(query.limit ?? DEFAULT_LIST_LIMIT);
-    const sql = `SELECT delivery.id AS delivery_id, delivery.handler, delivery.status, delivery.attempts::int AS attempts,
+    const common = (alias) => [
+      ...filters.handler === void 0 ? [] : [`${alias}.handler = ${filters.handler}`],
+      ...filters.eventType === void 0 ? [] : [`event.type = ${filters.eventType}`],
+      ...filters.eventId === void 0 ? [] : [`${alias}.event_id = ${filters.eventId}`]
+    ];
+    const inFlight = `(delivery.status = 'pending' AND delivery.id = ANY (lane.in_flight))`;
+    const whereCurrent = [
+      ...common("delivery"),
+      ...filters.status === void 0 ? [] : [
+        `(CASE WHEN ${inFlight} THEN 'processing' ELSE delivery.status END) = ${filters.status}`
+      ]
+    ];
+    const current = `SELECT delivery.id AS delivery_id, delivery.handler,
+  CASE WHEN ${inFlight} THEN 'processing' ELSE delivery.status END AS status,
+  (delivery.attempts + CASE WHEN ${inFlight} THEN 1 ELSE 0 END)::int AS attempts,
   ${isoText("delivery.available_at")} AS available_at,
-  delivery.lease_owner,
-  ${isoText("delivery.lease_expires_at")} AS lease_expires_at,
+  CASE WHEN ${inFlight} THEN lane.lease_owner END AS lease_owner,
+  CASE WHEN ${inFlight} THEN ${isoText("lane.lease_expires_at")} END AS lease_expires_at,
   delivery.last_error::text AS last_error,
   ${isoText("delivery.created_at")} AS created_at,
   ${isoText("delivery.updated_at")} AS updated_at,
   ${isoText("delivery.completed_at")} AS completed_at,
   ${eventColumns("event")}
 FROM ${this.#names.deliveries} AS delivery
+JOIN ${this.#names.lanes} AS lane ON lane.lane = delivery.lane
 JOIN ${this.#names.events} AS event ON event.id = delivery.event_id
-${where}
+${whereCurrent.length === 0 ? "" : `WHERE ${whereCurrent.join(" AND ")}`}`;
+    const includeHistory = this.#names.completionHistory && (query.status === void 0 || query.status === "completed");
+    if (!includeHistory) {
+      return {
+        sql: `${current}
 ORDER BY delivery.created_at, delivery.id
-LIMIT ${limit}`;
-    return { sql, parameters };
+LIMIT ${limit}`,
+        parameters
+      };
+    }
+    const history = `SELECT done.id AS delivery_id, done.handler, 'completed' AS status, done.attempts,
+  ${isoText("done.available_at")} AS available_at,
+  NULL AS lease_owner,
+  NULL AS lease_expires_at,
+  NULL AS last_error,
+  ${isoText("done.created_at")} AS created_at,
+  ${isoText("done.completed_at")} AS updated_at,
+  ${isoText("done.completed_at")} AS completed_at,
+  ${eventColumns("event")}
+FROM ${this.#names.completions} AS done
+JOIN ${this.#names.events} AS event ON event.id = done.event_id
+${common("done").length === 0 ? "" : `WHERE ${common("done").join(" AND ")}`}`;
+    return {
+      sql: `SELECT * FROM (
+${current}
+UNION ALL
+${history}
+) AS listed
+ORDER BY created_at, delivery_id
+LIMIT ${limit}`,
+      parameters
+    };
   }
+  /**
+   * Counts of rows by stored status (`pending` includes running deliveries;
+   * `completed` rows exist only after an upgrade from 0.1.0). Each count is
+   * answered from a partial index.
+   */
   get countByStatus() {
-    return `SELECT status, count(*)::text AS count FROM ${this.#names.deliveries} GROUP BY status`;
+    const deliveries = this.#names.deliveries;
+    return ["pending", "dead", "completed"].map(
+      (status) => `SELECT '${status}' AS status, count(*)::text AS count FROM ${deliveries} WHERE status = '${status}'`
+    ).join("\nUNION ALL\n");
+  }
+  /** Deliveries that are running: listed by a lane and still pending as rows. */
+  get countRunning() {
+    return `SELECT count(*)::text AS count
+FROM ${this.#names.lanes} AS lane
+CROSS JOIN LATERAL unnest(lane.in_flight) AS flying (id)
+JOIN ${this.#names.deliveries} AS delivery ON delivery.id = flying.id AND delivery.status = 'pending'`;
   }
-  /** Parameters: `[now]`. */
+  get countCompletionHistory() {
+    return `SELECT count(*)::text AS count FROM ${this.#names.completions}`;
+  }
+  /**
+   * Oldest instant at which a delivery became claimable: `available_at` of a
+   * pending delivery that nobody runs, or the lease expiry of a lane that runs
+   * deliveries. Parameters: `[now]`.
+   */
   get oldestDue() {
-    return `SELECT ${isoText("due_at")} AS oldest_due_at FROM (
-  SELECT ${dueAtExpression("delivery")} AS due_at
-  FROM ${this.#names.deliveries} AS delivery
-  WHERE delivery.status IN ('pending', 'processing') AND ${dueAtExpression("delivery")} <= $1::timestamptz
-  ORDER BY due_at
-  LIMIT 1
-) AS oldest`;
+    const deliveries = this.#names.deliveries;
+    const lanes = this.#names.lanes;
+    return `SELECT ${isoText("min(due.due_at)")} AS oldest_due_at FROM (
+  SELECT waiting.available_at AS due_at
+  FROM ${lanes} AS lane
+  CROSS JOIN LATERAL (
+    SELECT delivery.available_at FROM ${deliveries} AS delivery
+    WHERE delivery.lane = lane.lane AND delivery.status = 'pending'
+      AND delivery.available_at <= $1::timestamptz AND delivery.id <> ALL (lane.in_flight)
+    ORDER BY delivery.available_at LIMIT 1
+  ) AS waiting
+  UNION ALL
+  SELECT lane.lease_expires_at AS due_at
+  FROM ${lanes} AS lane
+  WHERE lane.lease_expires_at <= $1::timestamptz AND NOT ${this.#noRunningDelivery("lane")}
+) AS due`;
   }
   /**
-   * Deletes one bounded batch of purgeable deliveries and returns the event id
-   * of each deleted delivery. Parameters: `[cutoff, batchSize]`.
-   * `FOR UPDATE SKIP LOCKED` keeps purge from waiting on, or being waited on by, anything.
+   * Deletes one bounded batch of purgeable deliveries (or of the completion
+   * history) and returns the event id of each deleted row. Parameters:
+   * `[cutoff, batchSize]`. `FOR UPDATE SKIP LOCKED` keeps purge from waiting
+   * on, or being waited on by, anything.
    */
   purgeCompletedBatch() {
     return this.#purgeBatch(
+      this.#names.deliveries,
       `status = 'completed' AND completed_at < $1::timestamptz`,
       "completed_at"
     );
   }
+  purgeCompletionHistoryBatch() {
+    return this.#purgeBatch(
+      this.#names.completions,
+      `completed_at < $1::timestamptz`,
+      "completed_at"
+    );
+  }
   purgeDeadBatch() {
-    return this.#purgeBatch(`status = 'dead' AND updated_at < $1::timestamptz`, "updated_at");
+    return this.#purgeBatch(
+      this.#names.deliveries,
+      `status = 'dead' AND updated_at < $1::timestamptz`,
+      "updated_at"
+    );
   }
   /**
    * Selects and locks one bounded batch of events created before the cutoff
-   * that no delivery references. Parameters: `[cutoff, batchSize]`. The ids go
-   * through {@link deleteOrphanEvents}, which re-checks under a fresh snapshot.
+   * that no delivery references and that never had a delivery complete (those
+   * are measured from their completion, see {@link lockCompletedOrphanEventsBatch}).
+   * Parameters: `[cutoff, batchSize]`. The ids go through
+   * {@link deleteOrphanEventsWithoutCompletion} or {@link deleteExpiredCompletedOrphanEvents}, which re-check under a fresh snapshot.
    */
   get lockOrphanEventsBatch() {
     return `SELECT event.id FROM ${this.#names.events} AS event
 WHERE event.created_at < $1::timestamptz
-  AND NOT EXISTS (SELECT 1 FROM ${this.#names.deliveries} AS delivery WHERE delivery.event_id = event.id)
+  AND ${this.#unreferenced("event")}
+  AND NOT EXISTS (SELECT 1 FROM ${this.#names.eventCompletions} AS completion WHERE completion.event_id = event.id)
 ORDER BY event.created_at, event.id
 LIMIT $2::int
+FOR UPDATE OF event SKIP LOCKED`;
+  }
+  /**
+   * Like {@link lockOrphanEventsBatch} for events that had a delivery complete:
+   * they go once their last completion is older than the cutoff, however old the
+   * event itself is. Parameters: `[cutoff, batchSize]`.
+   */
+  get lockCompletedOrphanEventsBatch() {
+    return `SELECT event.id FROM ${this.#names.events} AS event
+JOIN ${this.#names.eventCompletions} AS completion ON completion.event_id = event.id
+WHERE completion.completed_at < $1::timestamptz
+  AND ${this.#unreferenced("event")}
+ORDER BY completion.completed_at, event.id
+LIMIT $2::int
 FOR UPDATE OF event SKIP LOCKED`;
   }
   /**
@@ -576,42 +1611,90 @@ WHERE id = ANY (ARRAY(SELECT jsonb_array_elements_text($1::jsonb)))
 FOR UPDATE SKIP LOCKED`;
   }
   /**
-   * Deletes locked events that no delivery references. It must run as a
-   * statement of its own after {@link lockEvents}: it then takes a fresh
-   * snapshot that includes every delivery committed before the lock was
-   * granted, so an event that just gained a delivery is never cascaded away.
-   * Parameters: `[eventIdsJson]`.
+   * Deletes events that no delivery references and whose last completion is older than
+   * `$2`, checked again under the fresh snapshot of this statement: a completion recorded
+   * after the sweep selected the event moves its time and keeps the event. Parameters:
+   * `[eventIdsJson, cutoff]`.
    */
-  get deleteOrphanEvents() {
-    const events = this.#names.events;
-    return countChanged(`DELETE FROM ${events} AS event
+  get deleteExpiredCompletedOrphanEvents() {
+    return countChanged(`DELETE FROM ${this.#names.events} AS event
 WHERE event.id = ANY (ARRAY(SELECT jsonb_array_elements_text($1::jsonb)))
-  AND NOT EXISTS (SELECT 1 FROM ${this.#names.deliveries} AS delivery WHERE delivery.event_id = event.id)`);
+  AND ${this.#unreferenced("event")}
+  AND EXISTS (
+    SELECT 1 FROM ${this.#names.eventCompletions} AS completion
+    WHERE completion.event_id = event.id AND completion.completed_at < $2::timestamptz
+  )`);
   }
-  #purgeBatch(condition, orderColumn) {
-    const deliveries = this.#names.deliveries;
+  /**
+   * Deletes locked events that no delivery references and that never had a delivery complete.
+   * It must run as a statement of its own after {@link lockEvents}: it then takes a fresh
+   * snapshot that includes every delivery committed before the lock was granted, so an event
+   * that just gained a delivery is never cascaded away. Keeps events that had a delivery complete:
+   * deleting dead letters must not shorten the retention of completed work.
+   */
+  get deleteOrphanEventsWithoutCompletion() {
+    return countChanged(`DELETE FROM ${this.#names.events} AS event
+WHERE event.id = ANY (ARRAY(SELECT jsonb_array_elements_text($1::jsonb)))
+  AND ${this.#unreferenced("event")}
+  AND NOT EXISTS (SELECT 1 FROM ${this.#names.eventCompletions} AS completion WHERE completion.event_id = event.id)`);
+  }
+  /** True when no delivery and no completion history record references the event. */
+  #unreferenced(eventAlias) {
+    const history = this.#names.completionHistory ? ` AND NOT EXISTS (SELECT 1 FROM ${this.#names.completions} AS done WHERE done.event_id = ${eventAlias}.id)` : "";
+    return `NOT EXISTS (SELECT 1 FROM ${this.#names.deliveries} AS delivery WHERE delivery.event_id = ${eventAlias}.id)${history}`;
+  }
+  #purgeBatch(table, condition, orderColumn) {
     return `WITH batch AS MATERIALIZED (
-  SELECT id FROM ${deliveries}
+  SELECT id FROM ${table}
   WHERE ${condition}
   ORDER BY ${orderColumn}, id
   LIMIT $2::int
   FOR UPDATE SKIP LOCKED
 ), deleted AS (
-  DELETE FROM ${deliveries} AS delivery USING batch WHERE delivery.id = batch.id RETURNING delivery.event_id
+  DELETE FROM ${table} AS delivery USING batch WHERE delivery.id = batch.id RETURNING delivery.event_id
 )
 SELECT event_id FROM deleted`;
   }
 };
 
 // src/postgres-event-store.ts
+var WAKE_UPS = ["notify", "poll"];
 var DEFAULT_PURGE_BATCH_SIZE = 1e3;
+var INITIAL_LANES_PER_ROUND = 4;
+var MAXIMUM_STALE_CLAIM_ATTEMPTS = 3;
+var NOTIFICATION_INTERVAL_MS = 10;
+function handedOutKey(deliveryId, leaseToken) {
+  return `${deliveryId}\0${leaseToken}`;
+}
 var PostgresEventStore = class {
   #executor;
   #statements;
   #schemaStatements;
   #setupLockKey;
+  #schemaMarker;
   #purgeBatchSize;
+  #completionHistory;
+  #logger;
+  /** Passed with every statement whose text is fixed: asks the executor to prepare it (`preparedStatements`). */
+  #queryOptions;
+  #notifies;
+  /** Every claim handed to a caller and not settled yet, by delivery id and exact lease token. */
+  #handedOut = /* @__PURE__ */ new Map();
+  #unreconciled = /* @__PURE__ */ new Set();
+  #generations = /* @__PURE__ */ new Map();
+  #ownerQueues = /* @__PURE__ */ new Map();
+  /** Owners whose last claim was filled from the lanes they held. */
+  #drainingOwners = /* @__PURE__ */ new Set();
   #ownedPool;
+  /** The `pg` pool behind the store, when it has one: listening for notifications needs a connection of its own. */
+  #pool;
+  #notificationChannel;
+  #lastNotificationAt = Number.NEGATIVE_INFINITY;
+  #trailingNotification;
+  /** Set by `close()`: a transaction that commits afterwards schedules no wake-up. */
+  #closed = false;
+  /** The transactions `transaction` runs right now, and whether one of their appends left its wake-up for after the commit. */
+  #ownTransactions = /* @__PURE__ */ new Map();
   constructor(options) {
     const sources = [options.pool, options.connectionString, options.executor].filter(
       (source) => source !== void 0
@@ -627,13 +1710,30 @@ var PostgresEventStore = class {
         `purgeBatchSize must be a positive integer, received ${String(purgeBatchSize)}`
       );
     }
+    const wakeUp = options.wakeUp ?? "notify";
+    if (!WAKE_UPS.includes(wakeUp)) {
+      throw new core.ConfigurationError(`wakeUp must be 'notify' or 'poll', received ${String(wakeUp)}`);
+    }
+    const preparedStatements = options.preparedStatements ?? true;
+    if (typeof preparedStatements !== "boolean") {
+      throw new core.ConfigurationError(
+        `preparedStatements must be a boolean, received ${String(preparedStatements)}`
+      );
+    }
+    this.#notifies = wakeUp === "notify";
+    this.#queryOptions = preparedStatements ? { prepare: true } : void 0;
     const names = resolvePostgresNames(options);
     this.#statements = new PostgresStatements(names);
     this.#schemaStatements = createPostgresSchemaStatements(options);
     this.#setupLockKey = this.#statements.setupLockKey;
+    this.#schemaMarker = postgresSchemaMarker(this.#schemaStatements.slice(0, -1));
     this.#purgeBatchSize = purgeBatchSize;
+    this.#completionHistory = names.completionHistory;
+    this.#logger = options.logger ?? console;
+    this.#notificationChannel = names.notificationChannel;
     if (options.executor !== void 0) {
       this.#executor = options.executor;
+      this.#pool = void 0;
     } else {
       const pool = options.pool ?? new pg.Pool({ ...options.poolConfig, connectionString: options.connectionString });
       if (options.pool === void 0) {
@@ -645,53 +1745,125 @@ var PostgresEventStore = class {
         });
         this.#ownedPool = pool;
       }
-      this.#executor = new PgExecutor(pool);
+      this.#pool = pool;
+      this.#executor = new PgExecutor(pool, {
+        logger: this.#logger
+      });
     }
   }
   /**
    * Creates the schema, tables and indexes if they do not exist. Safe to call
    * from many processes at once: a transaction-scoped advisory lock serializes
    * the DDL, so racing `CREATE TABLE IF NOT EXISTS` statements cannot collide.
+   * When the lane table already carries the marker of the current statements
+   * ({@link postgresSchemaMarker}) nothing runs and no table is locked, so instances
+   * that start next to running dispatchers cannot deadlock with their claims.
    * Skip it (`setupStore: false`) when a migration tool applies
    * `createPostgresSchemaSql()` instead.
    */
   async setup() {
+    if (await this.#schemaIsCurrent()) {
+      return;
+    }
     await this.#executor.transaction(async (transaction) => {
       await this.#executor.query(this.#statements.setupLock, [this.#setupLockKey], transaction);
+      if (await this.#schemaIsCurrent(transaction)) {
+        return;
+      }
       for (const statement of this.#schemaStatements) {
         await this.#executor.query(statement, [], transaction);
       }
     });
   }
-  transaction(work) {
-    return this.#executor.transaction(work);
+  async #schemaIsCurrent(transaction) {
+    const rows = await this.#executor.query(
+      this.#statements.schemaCurrent,
+      [this.#schemaMarker],
+      transaction
+    );
+    return rows[0]["current"] === true;
+  }
+  async transaction(work) {
+    const own = { wake: false };
+    const result = await this.#executor.transaction(async (transaction) => {
+      this.#ownTransactions.set(transaction, own);
+      try {
+        return await work(transaction);
+      } finally {
+        this.#ownTransactions.delete(transaction);
+      }
+    });
+    if (own.wake) {
+      this.#wakeAfterCommit();
+    }
+    return result;
   }
   /**
-   * Writes the entries in `transaction`. Keyed events reserve their sequence
-   * numbers first (locking the key rows in sorted order, so publishers cannot
-   * deadlock inside one call), then events, then deliveries, each in a single
-   * multi-row statement ordered by primary key. Two transactions that append
-   * keys in opposite order across several calls can still deadlock (40P01);
-   * the database rolls one back and the caller retries.
+   * Writes the entries in `transaction`, normally with one statement
+   * ({@link PostgresStatements.insertFreshEvents}): keyed events reserve their sequence numbers (locking
+   * the key rows in sorted order, so publishers cannot deadlock inside one call), then the new events and
+   * their deliveries are inserted, ordered by primary key, and one notification wakes the dispatchers
+   * when a delivery is due now. Events that already existed get their missing handlers' deliveries in
+   * two more statements. Two transactions that append keys in opposite order across several calls can
+   * still deadlock (40P01); the database rolls one back and the caller retries.
    * A duplicate event id still consumes a sequence number; gaps are harmless
    * because only the order of sequences matters.
    */
   async append(transaction, entries, now) {
     const plan = planAppend(entries);
+    if (plan.events.length === 0) {
+      return { appendedEventIds: [], duplicateEventIds: [], appendedDeliveryCount: 0 };
+    }
     const createdAt = now.toISOString();
-    const sequences = await this.#reserveSequences(plan.events, transaction);
+    const wakeAt = this.#wakeAt(plan.deliveries, now, transaction);
+    const handlersByEvent = /* @__PURE__ */ new Map();
+    for (const delivery of plan.deliveries) {
+      handlersByEvent.set(delivery.event_id, [
+        ...handlersByEvent.get(delivery.event_id) ?? [],
+        delivery.handler
+      ]);
+    }
+    const keyCounts = /* @__PURE__ */ new Map();
+    for (const event of plan.events) {
+      if (event.key !== null) {
+        keyCounts.set(event.key, (keyCounts.get(event.key) ?? 0) + 1);
+      }
+    }
+    const fresh = await this.#query(
+      this.#statements.insertFreshEvents,
+      [
+        JSON.stringify(
+          plan.events.map((event, ordinal) => ({
+            ordinal,
+            ...toEventRow(event, null, handlersByEvent.get(event.id) ?? [])
+          }))
+        ),
+        createdAt,
+        JSON.stringify(plan.deliveries),
+        JSON.stringify([...keyCounts].map(([key, count]) => ({ key, count }))),
+        wakeAt
+      ],
+      transaction
+    );
     const insertedEventIds = new Set(
-      plan.events.length === 0 ? [] : (await this.#executor.query(
-        this.#statements.insertEvents,
-        [JSON.stringify(toEventRows(plan.events, sequences)), createdAt],
-        transaction
-      )).map((row) => row["id"])
+      fresh.filter((row) => row["inserted"] === true).map((row) => row["id"])
     );
-    const insertedDeliveries = plan.deliveries.length === 0 ? [] : await this.#executor.query(
-      this.#statements.insertDeliveries,
-      [JSON.stringify(plan.deliveries), createdAt],
-      transaction
+    let appendedDeliveryCount = readCount(fresh[0], "deliveries");
+    const remaining = plan.deliveries.filter(
+      (delivery) => !insertedEventIds.has(delivery.event_id)
     );
+    if (remaining.length > 0) {
+      appendedDeliveryCount += await this.#appendToExistingEvents(
+        transaction,
+        plan,
+        fresh,
+        remaining,
+        handlersByEvent,
+        insertedEventIds,
+        createdAt,
+        wakeAt
+      );
+    }
     const appendedEventIds = [];
     const duplicateEventIds = [];
     for (const { eventId, repeated } of plan.outcomes) {
@@ -699,81 +1871,486 @@ var PostgresEventStore = class {
         eventId
       );
     }
-    return {
-      appendedEventIds,
-      duplicateEventIds,
-      appendedDeliveryCount: insertedDeliveries.length
-    };
+    return { appendedEventIds, duplicateEventIds, appendedDeliveryCount };
+  }
+  /**
+   * The time the publishing statements notify the dispatchers for (deliveries due by then wake them),
+   * or `null` for no notification. An append in a transaction of the caller's always notifies, at its
+   * commit. In a transaction of this store, only the first append within {@link NOTIFICATION_INTERVAL_MS}
+   * does; the others leave the wake-up to {@link #wakeAfterCommit}, which runs once their transaction
+   * committed, so no committed delivery waits for the poll.
+   */
+  #wakeAt(deliveries, now, transaction) {
+    if (!this.#notifies || !deliveries.some((delivery) => Date.parse(delivery.available_at) <= now.getTime())) {
+      return null;
+    }
+    const own = this.#ownTransactions.get(transaction);
+    if (own !== void 0 && Date.now() - this.#lastNotificationAt < NOTIFICATION_INTERVAL_MS) {
+      own.wake = true;
+      return null;
+    }
+    this.#lastNotificationAt = Date.now();
+    return now.toISOString();
+  }
+  /**
+   * Wakes the dispatchers for a committed transaction whose appends sent no notification: at once when
+   * none was sent within {@link NOTIFICATION_INTERVAL_MS}, otherwise once when the interval ends. A
+   * wake-up already scheduled covers this transaction too, since it is sent after this commit. Nothing is
+   * sent once the store is closed or the `pg` pool behind it is ending: no dispatcher can be woken through
+   * it then, and the deliveries are found by polling.
+   */
+  #wakeAfterCommit() {
+    if (this.#trailingNotification !== void 0 || this.#closed) {
+      return;
+    }
+    this.#trailingNotification = setTimeout(
+      () => {
+        this.#trailingNotification = void 0;
+        if (this.#pool?.ending === true) {
+          return;
+        }
+        this.#lastNotificationAt = Date.now();
+        this.#query(this.#statements.notify, []).catch((error) => {
+          this.#logger.error(
+            `[PostgresEventStore](wakeAfterCommit) Waking the dispatchers failed, they find the deliveries when they poll | error=${error instanceof Error ? error.message : String(error)}`
+          );
+        });
+      },
+      Math.max(0, this.#lastNotificationAt + NOTIFICATION_INTERVAL_MS - Date.now())
+    );
+  }
+  /**
+   * Adds the deliveries of events the publishing statement found already stored. An event that already
+   * exists may be getting the same new handler from another transaction at this very moment. Whoever
+   * holds the event decides, so the freshness check of the insert sees what the other transaction
+   * committed, even if its delivery has completed since. An existing event that a purge removed
+   * meanwhile is inserted again (with the sequence reserved for it) instead of being skipped; its id is
+   * added to `insertedEventIds`. Returns how many deliveries were inserted.
+   */
+  async #appendToExistingEvents(transaction, plan, fresh, deliveries, handlersByEvent, insertedEventIds, createdAt, wakeAt) {
+    const sequences = new Map(
+      fresh.map((row) => [row["id"], row["sequence"]])
+    );
+    const reinserted = [];
+    let existing = plan.events.filter((event) => !insertedEventIds.has(event.id)).map(
+      (event) => toEventRow(event, sequences.get(event.id), handlersByEvent.get(event.id) ?? [])
+    );
+    while (existing.length > 0) {
+      const locked = new Set(
+        (await this.#query(
+          this.#statements.lockExistingEvents,
+          [JSON.stringify(existing.map((row) => row.id).sort())],
+          transaction
+        )).map((row) => row["id"])
+      );
+      const gone = existing.filter((row) => !locked.has(row.id));
+      if (gone.length > 0) {
+        const inserted2 = await this.#query(
+          this.#statements.insertEvents,
+          [JSON.stringify(gone), createdAt],
+          transaction
+        );
+        for (const row of inserted2) {
+          insertedEventIds.add(row["id"]);
+          reinserted.push(row["id"]);
+        }
+      }
+      existing = gone.filter((row) => !insertedEventIds.has(row.id));
+    }
+    const inserted = await this.#query(
+      this.#statements.insertDeliveries,
+      [JSON.stringify(deliveries), createdAt, JSON.stringify(reinserted), wakeAt],
+      transaction
+    );
+    return inserted.length;
   }
   /**
-   * Leases up to `limit` due deliveries with `FOR UPDATE SKIP LOCKED`. The fast
-   * statement examines the first due deliveries; only when they are mostly
-   * blocked followers of busy keys does a second statement look at the heads of
-   * all keys. See {@link PostgresStatements.claim} for why that keeps a
-   * (handler, key) strictly one-at-a-time and in order.
+   * Claims up to `limit` due deliveries, normally with one statement
+   * ({@link PostgresStatements.claimLanes}): from the lanes this owner already holds, then from free lanes
+   * it takes in the same statement, recording the batch in the lane rows. A claim that would have to take
+   * over a lane whose previous holder still runs deliveries under an expired lease continues in a
+   * transaction that charges their lost attempts first, taking free lanes a few at a time (4, 8, 16, ...);
+   * so does a claim whose statement kept seeing a lane it holds change under it, and one that came up
+   * short with more free lanes left than it looked at. The step that fails after
+   * the first one has recorded deliveries returns those instead of failing: a recorded delivery nobody
+   * received would be held for a whole lease. See {@link PostgresStatements.claim} for the rules a delivery
+   * must satisfy.
    */
-  async claim(request) {
+  claim(request) {
     if (request.handlers.length === 0 || !(request.limit > 0)) {
-      return [];
+      return Promise.resolve([]);
+    }
+    return this.#serialized(request.leaseOwner, () => this.#claim(request));
+  }
+  /**
+   * Runs `work` after the earlier claims of the same owner on this store settled. The
+   * bookkeeping of what was handed out and the reconciliation of a failed claim need
+   * one claim at a time per owner (the dispatcher claims one batch at a time anyway;
+   * `runOnce` next to a running dispatcher is what this guards against).
+   */
+  #serialized(owner, work) {
+    const previous = this.#ownerQueues.get(owner) ?? Promise.resolve();
+    const run = previous.then(work, work);
+    const tail = run.then(
+      () => void 0,
+      () => void 0
+    );
+    this.#ownerQueues.set(owner, tail);
+    void tail.then(() => {
+      if (this.#ownerQueues.get(owner) === tail) {
+        this.#ownerQueues.delete(owner);
+      }
+    });
+    return run;
+  }
+  async #claim(request) {
+    if (this.#unreconciled.has(request.leaseOwner) && !await this.#reconcile(request.leaseOwner)) {
+      throw new Error(
+        `[PostgresEventStore](claim) Giving back unreturned deliveries still fails, so no claim is made | owner=${request.leaseOwner}`
+      );
+    }
+    const heldFirst = this.#drainingOwners.has(request.leaseOwner);
+    let rows;
+    try {
+      rows = await this.#claimInOneStatement(
+        request,
+        heldFirst ? this.#statements.claimHeldLanes : this.#statements.claimLanes
+      );
+    } catch (error) {
+      await this.#reconcile(request.leaseOwner);
+      throw error;
+    }
+    const heldLanes = new Set(JSON.parse(rows[0]["examined_lanes"]));
+    const claimed = this.#takeClaimed(rows, request.leaseOwner);
+    if (heldFirst && claimed.length < request.limit && rows[0]["stale"] !== true) {
+      try {
+        rows = await this.#claimInOneStatement(
+          { ...request, limit: request.limit - claimed.length },
+          this.#statements.claimLanes
+        );
+      } catch (error) {
+        await this.#reconcile(request.leaseOwner);
+        if (claimed.length === 0) {
+          this.#drainingOwners.delete(request.leaseOwner);
+          throw error;
+        }
+        this.#logger.error(
+          `[PostgresEventStore](claim) Claiming from free lanes failed, returning the deliveries already claimed | claimed=${claimed.length} | error=${error instanceof Error ? error.message : String(error)}`
+        );
+        return this.#handOutInDueOrder(claimed, request, heldLanes);
+      }
+      claimed.push(...this.#takeClaimed(rows, request.leaseOwner));
+    }
+    if (claimed.length < request.limit && (rows[0]["takeover_waiting"] === true || rows[0]["unexamined_free_lanes"] === true || rows[0]["stale"] === true)) {
+      try {
+        const more = await this.#claimMore(request, claimed.length);
+        this.#handOut(more, request.leaseOwner);
+        claimed.push(...more);
+      } catch (error) {
+        await this.#reconcile(request.leaseOwner);
+        if (claimed.length === 0) {
+          throw error;
+        }
+        this.#logger.error(
+          `[PostgresEventStore](claim) Taking more lanes failed, returning the deliveries already claimed | claimed=${claimed.length} | error=${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+    return this.#handOutInDueOrder(claimed, request, heldLanes);
+  }
+  /** The deliveries a claim statement picked, registered as handed out to `leaseOwner`. */
+  #takeClaimed(rows, leaseOwner) {
+    const claimed = rows.filter((row) => row["delivery_id"] !== null);
+    this.#forgetFinished(rows[0], leaseOwner, claimed);
+    this.#handOut(claimed, leaseOwner);
+    return claimed;
+  }
+  #handOutInDueOrder(claimed, request, heldLanes) {
+    if (claimed.length >= request.limit && claimed.every((row) => heldLanes.has(readCount(row, "lane")))) {
+      this.#drainingOwners.add(request.leaseOwner);
+    } else {
+      this.#drainingOwners.delete(request.leaseOwner);
     }
-    const parameters = (limit) => [
+    claimed.sort(compareDue);
+    return claimed.map((row) => mapClaimedDelivery(row, request.leaseExpiresAt));
+  }
+  /**
+   * Runs `statement` ({@link PostgresStatements.claimLanes} or its held-lane form), again when it reports that it waited for a lane lock and
+   * read deliveries with an older snapshot than the lane it got. A held lane is only locked by an
+   * operation of its own owner (another claim, a reschedule), so a few attempts are enough.
+   */
+  async #claimInOneStatement(request, statement) {
+    const parameters = [
       request.now.toISOString(),
       JSON.stringify(request.handlers),
-      limit,
+      request.limit,
       request.leaseOwner,
-      request.leaseExpiresAt.toISOString()
+      request.leaseExpiresAt.toISOString(),
+      this.#generation(request.leaseOwner).toString()
     ];
-    const fastRows = await this.#executor.query(this.#statements.claim, parameters(request.limit));
-    const leased = fastRows.filter((row) => row["delivery_id"] !== null);
-    if (leased.length < request.limit && fastRows[0]["window_saturated"] === true) {
-      leased.push(
-        ...(await this.#executor.query(
-          this.#statements.claimBehindBlockedKeys,
-          parameters(request.limit - leased.length)
-        )).filter((row) => row["delivery_id"] !== null)
-      );
+    let rows = await this.#query(statement, parameters);
+    for (let attempt = 1; attempt < MAXIMUM_STALE_CLAIM_ATTEMPTS && rows[0]["stale"] === true; attempt += 1) {
+      rows = await this.#query(statement, parameters);
     }
-    return leased.map((row) => mapClaimedDelivery(row, request.leaseExpiresAt));
+    return rows;
   }
-  extendLease(lease, leaseExpiresAt, now) {
-    return this.#changed(this.#statements.extendLease, [
-      lease.deliveryId,
-      lease.leaseToken,
-      leaseExpiresAt.toISOString(),
-      now.toISOString()
+  /**
+   * Second step of {@link PostgresEventStore.claim}, in one transaction: takes free lanes a few at a
+   * time, lanes to take over included (their lost attempts are charged first), and records the batch.
+   * `alreadyClaimed` deliveries of the first step are in flight, so they are not picked again.
+   */
+  async #claimMore(request, alreadyClaimed) {
+    const now = request.now.toISOString();
+    const leaseExpiresAt = request.leaseExpiresAt.toISOString();
+    const handlers = JSON.stringify(request.handlers);
+    const generation = this.#generation(request.leaseOwner).toString();
+    return this.#executor.transaction(async (transaction) => {
+      const claimed = [];
+      const remaining = () => request.limit - alreadyClaimed - claimed.length;
+      const takenLanes = /* @__PURE__ */ new Set();
+      for (let laneCount = INITIAL_LANES_PER_ROUND; remaining() > 0; ) {
+        const taken = await this.#query(
+          this.#statements.takeFreeLanes,
+          [now, handlers, laneCount, request.leaseOwner, leaseExpiresAt, generation],
+          transaction
+        );
+        if (taken.length === 0) {
+          break;
+        }
+        const lanes = taken.map((row) => readCount(row, "lane"));
+        for (const lane of lanes) {
+          takenLanes.add(lane);
+        }
+        claimed.push(
+          ...await this.#pickDeliveries(
+            [now, handlers, remaining(), JSON.stringify(lanes)],
+            transaction
+          )
+        );
+        laneCount *= 2;
+      }
+      await this.#recordClaim(claimed, takenLanes, request, transaction);
+      return claimed;
+    });
+  }
+  /**
+   * The generation of the owner's claim statements. It only grows, also across restarts (it starts at the
+   * clock), and a reconciliation moves it up, which fences off every earlier statement still in flight.
+   */
+  #generation(owner, advance = false) {
+    const current = this.#generations.get(owner) ?? BigInt(Date.now());
+    const next = advance ? current + 1n > BigInt(Date.now()) ? current + 1n : BigInt(Date.now()) : current;
+    this.#generations.set(owner, next);
+    return next;
+  }
+  /** Forgets a handed-out lease once the store answered about it (any answer: the claim is over or fenced out). */
+  async #settled(lease, work) {
+    const result = await work;
+    this.#handedOut.delete(handedOutKey(lease.deliveryId, lease.leaseToken));
+    return result;
+  }
+  /** Remembers the claims handed to the caller of `claim` until they are settled. */
+  #handOut(rows, leaseOwner) {
+    for (const row of rows) {
+      const claim = mapClaimedDelivery(row, /* @__PURE__ */ new Date(0));
+      this.#handedOut.set(handedOutKey(claim.deliveryId, claim.leaseToken), {
+        owner: leaseOwner,
+        deliveryId: claim.deliveryId,
+        ...parseLeaseToken(claim.leaseToken)
+      });
+    }
+  }
+  /**
+   * Drops the registrations of the owner's held lanes whose delivery no longer runs there
+   * (completed inside the caller's transaction, deleted, or listed no more). Registrations of
+   * lanes this claim did not see stay: their tokens may still be valid.
+   */
+  #forgetFinished(row, leaseOwner, claimed) {
+    const heldLanes = new Set(JSON.parse(row["examined_lanes"]));
+    const running = /* @__PURE__ */ new Set([
+      ...JSON.parse(row["running_ids"]),
+      ...claimed.map((picked) => picked["delivery_id"])
     ]);
+    for (const [key, entry] of this.#handedOut) {
+      if (entry.owner === leaseOwner && heldLanes.has(entry.lane) && !running.has(entry.deliveryId)) {
+        this.#handedOut.delete(key);
+      }
+    }
+  }
+  /**
+   * After a claim failed, possibly after the database recorded its batch: gives back the recorded
+   * deliveries that were never handed out, keeping exactly the claims handed out and not settled.
+   * A failure is remembered and retried before the owner's next claim: other deliveries keep
+   * renewing the lane, so an unreturned one would otherwise never be recovered.
+   */
+  async #reconcile(leaseOwner) {
+    const generation = this.#generation(leaseOwner, true);
+    const handedOut = [...this.#handedOut.values()].filter((entry) => entry.owner === leaseOwner).map(({ deliveryId, lane, epoch, claims }) => ({ id: deliveryId, lane, epoch, claims }));
+    try {
+      await this.#query(this.#statements.reconcileClaims, [
+        leaseOwner,
+        JSON.stringify(handedOut),
+        generation.toString()
+      ]);
+      this.#unreconciled.delete(leaseOwner);
+      return true;
+    } catch (error) {
+      this.#unreconciled.add(leaseOwner);
+      this.#logger.error(
+        `[PostgresEventStore](reconcile) Giving back unreturned deliveries failed, it is retried before the next claim | owner=${leaseOwner} | error=${error instanceof Error ? error.message : String(error)}`
+      );
+      return false;
+    }
+  }
+  /** Fast claim, then the slow one when the fast window was full of blocked followers. */
+  async #pickDeliveries(parameters, transaction) {
+    const limit = parameters[2];
+    const fastRows = await this.#query(this.#statements.claim, parameters, transaction);
+    const picked = fastRows.filter((row) => row["delivery_id"] !== null);
+    if (picked.length < limit && fastRows[0]["window_saturated"] === true) {
+      const slowRows = await this.#query(
+        this.#statements.claimBehindBlockedKeys,
+        parameters,
+        transaction
+      );
+      const pickedIds = new Set(picked.map((row) => row["delivery_id"]));
+      picked.push(
+        ...slowRows.filter(
+          (row) => row["delivery_id"] !== null && !pickedIds.has(row["delivery_id"])
+        )
+      );
+      const seenKeys = /* @__PURE__ */ new Set();
+      const kept = [...picked].sort((left, right) => compareSequence(left, right)).filter((row) => {
+        if (row["delivery_key"] === null) {
+          return true;
+        }
+        const group = `${row["handler"]}\0${row["delivery_key"]}`;
+        return !seenKeys.has(group) && Boolean(seenKeys.add(group));
+      });
+      kept.sort(compareDue);
+      return kept.slice(0, limit);
+    }
+    return picked;
   }
-  complete(lease, now, transaction) {
-    return this.#changed(
-      this.#statements.complete,
-      [lease.deliveryId, lease.leaseToken, now.toISOString()],
+  /** Writes the picked ids into their lane rows and frees the lanes that picked nothing. */
+  async #recordClaim(claimed, lanes, request, transaction) {
+    const idsByLane = /* @__PURE__ */ new Map();
+    for (const row of claimed) {
+      const lane = readCount(row, "lane");
+      idsByLane.set(lane, [...idsByLane.get(lane) ?? [], row["delivery_id"]]);
+    }
+    const idleLanes = [...lanes].filter((lane) => !idsByLane.has(lane));
+    if (idsByLane.size === 0 && idleLanes.length === 0) {
+      return;
+    }
+    await this.#query(
+      this.#statements.recordClaim,
+      [
+        JSON.stringify([...idsByLane].map(([lane, ids]) => ({ lane, ids }))),
+        JSON.stringify(idleLanes),
+        request.leaseOwner,
+        request.leaseExpiresAt.toISOString()
+      ],
       transaction
     );
   }
+  extendLease(lease, leaseExpiresAt) {
+    return this.#whenIssued(
+      lease,
+      (held) => this.#changed(this.#statements.extendLease, [
+        lease.deliveryId,
+        held.lane,
+        held.epoch,
+        held.claims,
+        leaseExpiresAt.toISOString()
+      ])
+    );
+  }
+  async complete(lease, now, transaction) {
+    return (await this.#completeLeases([lease], now, transaction))[0];
+  }
+  completeMany(leases, now) {
+    return this.#completeLeases(leases, now, void 0);
+  }
   reschedule(lease, availableAt, error, now) {
-    return this.#changed(this.#statements.reschedule, [
-      lease.deliveryId,
-      lease.leaseToken,
-      availableAt.toISOString(),
-      JSON.stringify(error),
-      now.toISOString()
-    ]);
+    return this.#settled(
+      lease,
+      this.#whenIssued(
+        lease,
+        (held) => this.#changed(this.#statements.reschedule, [
+          lease.deliveryId,
+          held.lane,
+          held.epoch,
+          held.claims,
+          availableAt.toISOString(),
+          JSON.stringify(error),
+          now.toISOString()
+        ])
+      )
+    );
   }
   bury(lease, error, now) {
-    return this.#changed(this.#statements.bury, [
-      lease.deliveryId,
-      lease.leaseToken,
-      JSON.stringify(error),
-      now.toISOString()
-    ]);
+    return this.#settled(
+      lease,
+      this.#whenIssued(
+        lease,
+        (held) => this.#changed(this.#statements.bury, [
+          lease.deliveryId,
+          held.lane,
+          held.epoch,
+          held.claims,
+          JSON.stringify(error),
+          now.toISOString()
+        ])
+      )
+    );
   }
   /** Returns a leased delivery to pending, due now, without counting the attempt. */
   release(lease, now) {
-    return this.#changed(this.#statements.release, [
-      lease.deliveryId,
-      lease.leaseToken,
-      now.toISOString()
-    ]);
+    return this.#settled(
+      lease,
+      this.#whenIssued(
+        lease,
+        (held) => this.#changed(this.#statements.release, [
+          lease.deliveryId,
+          held.lane,
+          held.epoch,
+          held.claims,
+          now.toISOString()
+        ])
+      )
+    );
+  }
+  /**
+   * Calls `listener` soon after a transaction that published deliveries due at once commits, in any
+   * process: `append` sends one `pg_notify` per call (merged per transaction, none for delayed
+   * deliveries), and this listens with `LISTEN` on a connection of its own, opened with the settings of
+   * the store's pool (one connection more than the pool's `max`). A lost connection is replaced after a
+   * second. Resolves with `undefined` for a store built on an `executor`, which has no connection of its
+   * own to listen on, and with `wakeUp: 'poll'`: polling then finds new deliveries (and the bus still
+   * wakes its own dispatcher).
+   */
+  async watchNewDeliveries(listener) {
+    if (this.#pool === void 0 || !this.#notifies) {
+      return void 0;
+    }
+    const options = this.#pool.options;
+    const watcher = new NotificationListener(
+      async () => {
+        const client = new pg.Client(options);
+        await client.connect();
+        return client;
+      },
+      this.#notificationChannel,
+      listener,
+      this.#logger
+    );
+    await watcher.start();
+    return () => watcher.close();
+  }
+  /** Frees the lanes `leaseOwner` holds that run no delivery, so other workers need not wait for the lease to expire. */
+  async relinquish(leaseOwner) {
+    await this.#query(this.#statements.relinquish, [leaseOwner]);
   }
   async listDeliveries(query) {
     const statement = this.#statements.listDeliveries(query);
@@ -781,7 +2358,7 @@ var PostgresEventStore = class {
     return rows.map(mapDeliveryRecord);
   }
   async requeue(deliveryIds, now) {
-    const rows = await this.#executor.query(this.#statements.requeue, [
+    const rows = await this.#query(this.#statements.requeue, [
       JSON.stringify(deliveryIds),
       now.toISOString()
     ]);
@@ -799,16 +2376,31 @@ var PostgresEventStore = class {
   async purge(request) {
     const total = { deletedDeliveries: 0, deletedEvents: 0 };
     const batches = [
-      [this.#statements.purgeCompletedBatch(), request.completedBefore],
-      [this.#statements.purgeDeadBatch(), request.deadBefore]
+      [
+        this.#statements.purgeCompletedBatch(),
+        request.completedBefore,
+        this.#statements.deleteOrphanEventsWithoutCompletion
+      ],
+      [
+        this.#statements.purgeDeadBatch(),
+        request.deadBefore,
+        this.#statements.deleteOrphanEventsWithoutCompletion
+      ]
     ];
-    for (const [sql, cutoff] of batches) {
+    if (this.#completionHistory) {
+      batches.push([
+        this.#statements.purgeCompletionHistoryBatch(),
+        request.completedBefore,
+        this.#statements.deleteOrphanEventsWithoutCompletion
+      ]);
+    }
+    for (const [sql, cutoff, deleteOrphans] of batches) {
       if (cutoff === void 0) {
         continue;
       }
       let deletedInBatch = this.#purgeBatchSize;
       while (deletedInBatch === this.#purgeBatchSize) {
-        const batch = await this.#purgeBatch(sql, cutoff);
+        const batch = await this.#purgeBatch(sql, cutoff, deleteOrphans);
         deletedInBatch = batch.deletedDeliveries;
         total.deletedDeliveries += batch.deletedDeliveries;
         total.deletedEvents += batch.deletedEvents;
@@ -816,69 +2408,116 @@ var PostgresEventStore = class {
     }
     const orphanCutoff = [request.completedBefore, request.deadBefore].filter((cutoff) => cutoff !== void 0).sort((first, second) => first.getTime() - second.getTime())[0];
     if (orphanCutoff !== void 0) {
-      total.deletedEvents += await this.#purgeOrphanEvents(orphanCutoff);
+      total.deletedEvents += await this.#purgeOrphanEvents(
+        this.#statements.lockOrphanEventsBatch,
+        this.#statements.deleteOrphanEventsWithoutCompletion,
+        orphanCutoff,
+        false
+      );
+    }
+    if (request.completedBefore !== void 0) {
+      total.deletedEvents += await this.#purgeOrphanEvents(
+        this.#statements.lockCompletedOrphanEventsBatch,
+        this.#statements.deleteExpiredCompletedOrphanEvents,
+        request.completedBefore,
+        true
+      );
     }
     return total;
   }
   async statistics(now) {
-    const counts = {
-      pending: 0,
-      processing: 0,
-      completed: 0,
-      dead: 0
-    };
-    for (const row of await this.#executor.query(this.#statements.countByStatus, [])) {
-      counts[row["status"]] = readCount(row, "count");
+    const stored = { pending: 0, dead: 0, completed: 0 };
+    for (const row of await this.#query(this.#statements.countByStatus, [])) {
+      stored[row["status"]] = readCount(row, "count");
+    }
+    const [running] = await this.#query(this.#statements.countRunning, []);
+    const processing = readCount(running, "count");
+    let completed = stored["completed"];
+    if (this.#completionHistory) {
+      const [history] = await this.#query(this.#statements.countCompletionHistory, []);
+      completed += readCount(history, "count");
     }
-    const oldestDue = await this.#executor.query(this.#statements.oldestDue, [now.toISOString()]);
-    return { ...counts, oldestDueAt: mapOldestDueAt(oldestDue) };
+    const oldestDue = await this.#query(this.#statements.oldestDue, [now.toISOString()]);
+    return {
+      // The counts come from separate statements; a delivery that finishes in between must not make this negative.
+      pending: Math.max(0, stored["pending"] - processing),
+      processing,
+      completed,
+      dead: stored["dead"],
+      oldestDueAt: mapOldestDueAt(oldestDue)
+    };
   }
   /** Ends the pool this store created from `connectionString`. Pools and executors you passed in stay open. */
   async close() {
+    this.#closed = true;
+    clearTimeout(this.#trailingNotification);
+    this.#trailingNotification = void 0;
     const pool = this.#ownedPool;
     this.#ownedPool = void 0;
     await pool?.end();
   }
-  async #changed(sql, parameters, transaction) {
-    const rows = await this.#executor.query(sql, parameters, transaction);
+  /** Runs a statement of {@link PostgresStatements} whose text never changes, prepared when `preparedStatements` is on. */
+  #query(sql, parameters, transaction) {
+    return this.#executor.query(sql, parameters, transaction, this.#queryOptions);
+  }
+  async #changed(sql, parameters) {
+    const rows = await this.#query(sql, parameters);
     return readCount(rows[0], "count") > 0;
   }
-  async #reserveSequences(events, transaction) {
-    const counts = /* @__PURE__ */ new Map();
-    for (const event of events) {
-      if (event.key !== null) {
-        counts.set(event.key, (counts.get(event.key) ?? 0) + 1);
+  /** Runs `operation` for a lease this store issued; any other token cannot be held. */
+  async #whenIssued(lease, operation) {
+    const held = parseLeaseToken(lease.leaseToken);
+    return held !== void 0 && await operation(held);
+  }
+  /**
+   * Deletes the delivery of every lease that is still the current claim of its
+   * delivery. Returns one flag per lease, in order. Results are matched to leases
+   * by position, so two leases of one delivery (a stale and a current one) get
+   * their own answers; a lease listed twice completes once, at its first position.
+   */
+  async #completeLeases(leases, now, transaction) {
+    const issued = [];
+    const seen = /* @__PURE__ */ new Set();
+    leases.forEach((lease, ord) => {
+      const held = parseLeaseToken(lease.leaseToken);
+      const identity = `${lease.deliveryId}\0${lease.leaseToken}`;
+      if (held !== void 0 && !seen.has(identity)) {
+        seen.add(identity);
+        issued.push({ ord, id: lease.deliveryId, ...held });
+      }
+    });
+    const completed = /* @__PURE__ */ new Set();
+    if (issued.length > 0) {
+      const rows = await this.#query(
+        this.#statements.complete,
+        [JSON.stringify(issued), now.toISOString()],
+        transaction
+      );
+      for (const row of rows) {
+        completed.add(readCount(row, "ord"));
       }
     }
-    const firstSequences = /* @__PURE__ */ new Map();
-    if (counts.size === 0) {
-      return firstSequences;
-    }
-    const requested = [...counts].map(([key, count]) => ({ key, count }));
-    const rows = await this.#executor.query(
-      this.#statements.reserveSequences,
-      [JSON.stringify(requested)],
-      transaction
-    );
-    for (const row of rows) {
-      const key = row["key"];
-      firstSequences.set(key, BigInt(row["sequence"]) - BigInt(counts.get(key)) + 1n);
+    if (transaction === void 0) {
+      for (const lease of leases) {
+        this.#handedOut.delete(handedOutKey(lease.deliveryId, lease.leaseToken));
+      }
     }
-    return firstSequences;
+    return leases.map((_, ord) => completed.has(ord));
   }
-  async #purgeOrphanEvents(cutoff) {
+  async #purgeOrphanEvents(lockStatement, deleteStatement, cutoff, recheckCutoff) {
     let deletedEvents = 0;
     let removedInBatch = this.#purgeBatchSize;
     while (removedInBatch === this.#purgeBatchSize) {
       removedInBatch = await this.#executor.transaction(async (transaction) => {
-        const locked = await this.#executor.query(
-          this.#statements.lockOrphanEventsBatch,
+        const locked = await this.#query(
+          lockStatement,
           [cutoff.toISOString(), this.#purgeBatchSize],
           transaction
         );
-        const removed = await this.#executor.query(
-          this.#statements.deleteOrphanEvents,
-          [JSON.stringify(locked.map((row) => row["id"]))],
+        const ids = JSON.stringify(locked.map((row) => row["id"]));
+        const removed = await this.#query(
+          deleteStatement,
+          recheckCutoff ? [ids, cutoff.toISOString()] : [ids],
           transaction
         );
         return readCount(removed[0], "count");
@@ -887,9 +2526,9 @@ var PostgresEventStore = class {
     }
     return deletedEvents;
   }
-  async #purgeBatch(sql, cutoff) {
+  async #purgeBatch(sql, cutoff, deleteOrphans) {
     return this.#executor.transaction(async (transaction) => {
-      const deleted = await this.#executor.query(
+      const deleted = await this.#query(
         sql,
         [cutoff.toISOString(), this.#purgeBatchSize],
         transaction
@@ -900,13 +2539,9 @@ var PostgresEventStore = class {
       const eventIds = JSON.stringify([
         ...new Set(deleted.map((row) => row["event_id"]))
       ]);
-      const locked = await this.#executor.query(
-        this.#statements.lockEvents,
-        [eventIds],
-        transaction
-      );
-      const removed = await this.#executor.query(
-        this.#statements.deleteOrphanEvents,
+      const locked = await this.#query(this.#statements.lockEvents, [eventIds], transaction);
+      const removed = await this.#query(
+        deleteOrphans,
         [JSON.stringify(locked.map((row) => row["id"]))],
         transaction
       );
@@ -942,28 +2577,31 @@ function planAppend(entries) {
   }
   return { events, deliveries, outcomes };
 }
-function toEventRows(events, firstSequences) {
-  const nextSequences = new Map(firstSequences);
-  return events.map((event) => {
-    let sequence = null;
-    if (event.key !== null) {
-      const next = nextSequences.get(event.key);
-      nextSequences.set(event.key, next + 1n);
-      sequence = next.toString();
-    }
-    return {
-      id: event.id,
-      type: event.type,
-      source: event.source,
-      key: event.key,
-      sequence,
-      payload: event.payload,
-      headers: event.headers,
-      correlation_id: event.correlationId,
-      causation_id: event.causationId,
-      occurred_at: event.occurredAt.toISOString()
-    };
-  });
+function toEventRow(event, sequence, handlers) {
+  return {
+    id: event.id,
+    type: event.type,
+    source: event.source,
+    key: event.key,
+    sequence,
+    payload: event.payload,
+    headers: event.headers,
+    correlation_id: event.correlationId,
+    causation_id: event.causationId,
+    occurred_at: event.occurredAt.toISOString(),
+    handlers
+  };
+}
+function compareSequence(left, right) {
+  const first = BigInt(left["sequence"] ?? 0);
+  const second = BigInt(right["sequence"] ?? 0);
+  return Number(first > second) - Number(first < second);
+}
+function compareDue(left, right) {
+  return compareText(left["due_at"], right["due_at"]) || compareText(left["delivery_id"], right["delivery_id"]);
+}
+function compareText(left, right) {
+  return Number(left > right) - Number(left < right);
 }
 
 exports.PgExecutor = PgExecutor;