@relaycast/engine 8.5.2 → 8.5.4

package/dist/engine/boundedRetention.js

@@ -0,0 +1,204 @@
+import { sql } from 'drizzle-orm';
+import { z } from 'zod';
+import { snowflakeIdLowerBound } from './snowflake.js';
+const DAY_MS = 86_400_000;
+const position = z.array(z.union([z.string(), z.number()]));
+const stateSchema = z.object({
+    next: z.number().int().min(0).max(4),
+    positions: z.record(z.string(), position),
+    highs: z.record(z.string(), position).default({}),
+});
+const tables = [
+    { result: 'messages', name: 'messages', index: 'idx_messages_retention',
+        keys: ['length(id)', 'id'], setting: 'message_ttl_days', fallback: 'messageTtlDays',
+        eligible: 'NOT EXISTS (SELECT 1 FROM messages replies WHERE replies.thread_id = page.id)' },
+    { result: 'deliveries', name: 'deliveries', index: 'idx_deliveries_settled_retention',
+        keys: ['created_at', 'id'], setting: 'delivery_ttl_days', fallback: 'deliveryTtlDays',
+        predicate: "status IN ('acked', 'failed', 'dead_lettered')" },
+    { result: 'messageLogs', name: 'message_logs', index: 'idx_message_logs_retention',
+        keys: ['length(id)', 'id'], setting: 'message_log_ttl_days', fallback: 'messageLogTtlDays' },
+    { result: 'workspaceEvents', name: 'workspace_events', index: 'idx_workspace_events_retention',
+        keys: ['created_at', 'workspace_id', 'seq'], setting: 'workspace_event_ttl_days',
+        fallback: 'workspaceEventTtlDays',
+        eligible: 'EXISTS (SELECT 1 FROM workspace_events hw WHERE hw.workspace_id = page.workspace_id AND hw.seq > page.seq LIMIT 1)' },
+    { result: 'readReceipts', name: 'read_receipts', index: 'idx_read_receipts_retention',
+        keys: ['message_id', 'agent_id'],
+        eligible: 'NOT EXISTS (SELECT 1 FROM messages m WHERE m.id = page.message_id)' },
+];
+/** Project a candidate onto its table's ordered keyset cursor. */
+function key(row, table) {
+    return table.keys.map(k => k === 'length(id)' ? row.id.length : row[k]);
+}
+/** Apply exact workspace policy after the bounded candidate read. */
+function expired(row, table, defaults, nowMs) {
+    if (!row.eligible)
+        return false;
+    if (!table.setting || !table.fallback)
+        return true;
+    const settings = row.retention ? JSON.parse(row.retention) : {};
+    const override = settings[table.setting];
+    const ttl = override === undefined ? defaults[table.fallback] : override;
+    if (ttl == null || !Number.isFinite(ttl) || ttl <= 0)
+        return false;
+    const cutoff = nowMs - ttl * DAY_MS;
+    if (table.keys[0] === 'length(id)') {
+        const bound = snowflakeIdLowerBound(cutoff);
+        return row.id.length < bound.length || (row.id.length === bound.length && row.id < bound);
+    }
+    return row.created_at * 1000 < cutoff;
+}
+/** Construct a bound primary-key predicate without interpolating user SQL. */
+function identity(row, table) {
+    if (table.result === 'workspaceEvents')
+        return sql `(workspace_id = ${row.workspace_id} AND seq = ${row.seq})`;
+    if (table.result === 'readReceipts')
+        return sql `(message_id = ${row.message_id} AND agent_id = ${row.agent_id})`;
+    return sql `id = ${row.id}`;
+}
+/**
+ * Bound candidate reads, not just returned/deleted rows. Persist progress even
+ * when a page contains only retained rows, so disabled TTLs, live receipts and
+ * event high-water marks cannot pin a scan to the beginning forever.
+ *
+ * Each table completes at most one traversal per run; cursors wrap at EOF.
+ * Cursor commits follow successful deletion. A crash can replay a page (safe),
+ * never skip an uncommitted deletion. Hosts should serialize maintenance runs.
+ */
+export async function pruneBounded(db, opts) {
+    const limit = boundedInteger(opts.batchLimit, 200, 200);
+    const rounds = boundedInteger(opts.maxBatches, 5, 5);
+    const started = Date.now();
+    const budget = boundedInteger(opts.maxDurationMs, 10_000, 30_000);
+    const nowMs = (opts.now ?? new Date()).getTime();
+    const defaults = {
+        messageTtlDays: null, deliveryTtlDays: 90, messageLogTtlDays: 90, workspaceEventTtlDays: 30,
+        ...Object.fromEntries(Object.entries(opts.defaults ?? {}).filter(([, value]) => value !== undefined)),
+    };
+    // One small policy aggregate (no workspace-ID bind list), not one history
+    // scan per workspace. The shortest positive TTL provides a safe global index
+    // cutoff; exact per-workspace policy is still checked on each candidate.
+    // This avoids walking millions of recent rows that no policy can expire.
+    const ttlTables = tables.filter(table => table.setting);
+    const [minimums] = await db.all(sql `SELECT
+    ${sql.join(ttlTables.map(table => sql.raw(`MIN(CASE WHEN json_extract(retention, '$.${table.setting}') > 0 THEN json_extract(retention, '$.${table.setting}') END) AS "${table.result}"`)), sql `, `)} FROM workspaces`);
+    if (!Number.isFinite(nowMs) && [
+        ...Object.values(defaults), ...Object.values(minimums ?? {}),
+    ].some(ttl => typeof ttl === 'number' && Number.isFinite(ttl) && ttl > 0)) {
+        throw new Error('Invalid retention clock: expected a finite Date when a positive TTL is active');
+    }
+    const saved = await db.all(sql `SELECT cursor FROM maintenance_cursors WHERE id = 'retention-v1'`);
+    const parsed = saved[0] ? stateSchema.safeParse(decodeCursor(saved[0].cursor)) : undefined;
+    const state = parsed?.success ? parsed.data : { next: 0, positions: {}, highs: {} };
+    const result = { messages: 0, deliveries: 0, messageLogs: 0, readReceipts: 0, workspaceEvents: 0 };
+    const finished = new Set();
+    for (let step = 0; step < rounds * tables.length && Date.now() - started < budget; step++) {
+        const index = state.next;
+        state.next = (index + 1) % tables.length;
+        if (finished.has(index))
+            continue;
+        const table = tables[index];
+        const cursor = state.positions[table.name];
+        const positiveTtls = table.fallback
+            ? [defaults[table.fallback], minimums?.[table.result]].filter((ttl) => typeof ttl === 'number' && Number.isFinite(ttl) && ttl > 0)
+            : [];
+        if (table.fallback && !positiveTtls.length) {
+            delete state.positions[table.name];
+            delete state.highs[table.name];
+            finished.add(index);
+            await db.run(sql `INSERT INTO maintenance_cursors (id, cursor) VALUES ('retention-v1', ${JSON.stringify(state)})
+        ON CONFLICT(id) DO UPDATE SET cursor = excluded.cursor`);
+            continue;
+        }
+        const columns = sql.raw(table.result === 'readReceipts' ? 'message_id, agent_id'
+            : table.result === 'workspaceEvents' ? 'workspace_id, seq, created_at'
+                : 'id, workspace_id, created_at');
+        // A traversal has a finite end even while new rows keep arriving. Without
+        // this fence the cursor might never wrap to retained rows that later age out.
+        if (!state.highs[table.name]) {
+            const [last] = await db.all(sql `SELECT ${columns}
+        FROM ${sql.raw(table.name)} INDEXED BY ${sql.raw(table.index)}
+        ${table.predicate ? sql `WHERE ${sql.raw(table.predicate)}` : sql ``}
+        ORDER BY ${sql.raw(table.keys.map(k => k + ' DESC').join(', '))} LIMIT 1`);
+            if (last)
+                state.highs[table.name] = key(last, table);
+        }
+        const predicates = [];
+        if (table.predicate)
+            predicates.push(sql.raw(table.predicate));
+        if (table.fallback) {
+            const cutoff = nowMs - Math.min(...positiveTtls) * DAY_MS;
+            if (table.keys[0] === 'length(id)') {
+                const bound = snowflakeIdLowerBound(cutoff);
+                predicates.push(sql `(length(id), id) < (${bound.length}, ${bound})`);
+            }
+            else {
+                predicates.push(sql `created_at < ${Math.ceil(cutoff / 1000)}`);
+            }
+        }
+        if (cursor?.length === table.keys.length) {
+            predicates.push(sql `(${sql.raw(table.keys.join(', '))}) > (${sql.join(cursor.map(v => sql `${v}`), sql `, `)})`);
+        }
+        const high = state.highs[table.name];
+        if (high?.length === table.keys.length) {
+            predicates.push(sql `(${sql.raw(table.keys.join(', '))}) <= (${sql.join(high.map(v => sql `${v}`), sql `, `)})`);
+        }
+        // MATERIALIZED prevents the planner pushing eligibility/TTL checks ahead
+        // of LIMIT. The keyset seek and covering index bound candidate traversal.
+        const page = await db.all(sql `
+      WITH page AS MATERIALIZED (
+        SELECT ${columns}
+        FROM ${sql.raw(table.name)} INDEXED BY ${sql.raw(table.index)}
+        ${predicates.length ? sql `WHERE ${sql.join(predicates, sql ` AND `)}` : sql ``}
+        ORDER BY ${sql.raw(table.keys.join(', '))} LIMIT ${limit}
+      )
+      SELECT page.*, ${sql.raw(table.eligible ?? '1')} AS eligible,
+        ${table.setting ? sql `w.retention` : sql `NULL`} AS retention
+      FROM page
+      ${table.setting ? sql `LEFT JOIN workspaces w ON w.id = page.workspace_id` : sql ``}
+      ORDER BY ${sql.raw(table.keys.map(k => k === 'length(id)' ? 'length(page.id)' : 'page.' + k).join(', '))}
+    `);
+        const removable = page.filter(row => expired(row, table, defaults, nowMs));
+        // Two-key identities need two bindings each; leave room under D1's 100.
+        for (let offset = 0; offset < removable.length; offset += 40) {
+            const chunk = removable.slice(offset, offset + 40);
+            const guard = table.result === 'messages'
+                ? sql `AND NOT EXISTS (SELECT 1 FROM messages replies WHERE replies.thread_id = messages.id)`
+                : table.result === 'readReceipts'
+                    ? sql `AND NOT EXISTS (SELECT 1 FROM messages m WHERE m.id = read_receipts.message_id)`
+                    : table.result === 'workspaceEvents'
+                        ? sql `AND EXISTS (SELECT 1 FROM workspace_events hw WHERE hw.workspace_id = workspace_events.workspace_id AND hw.seq > workspace_events.seq LIMIT 1)`
+                        : table.predicate ? sql `AND ${sql.raw(table.predicate)}` : sql ``;
+            const deleted = await db.all(sql `DELETE FROM ${sql.raw(table.name)}
+        WHERE (${sql.join(chunk.map(row => identity(row, table)), sql ` OR `)}) ${guard}
+        RETURNING 1`);
+            result[table.result] += deleted.length;
+        }
+        if (page.length < limit || JSON.stringify(key(page[page.length - 1], table)) === JSON.stringify(high)) {
+            delete state.positions[table.name];
+            delete state.highs[table.name];
+            finished.add(index);
+        }
+        else {
+            state.positions[table.name] = key(page[page.length - 1], table);
+        }
+        await db.run(sql `INSERT INTO maintenance_cursors (id, cursor) VALUES ('retention-v1', ${JSON.stringify(state)})
+      ON CONFLICT(id) DO UPDATE SET cursor = excluded.cursor`);
+        if (finished.size === tables.length)
+            break;
+    }
+    return result;
+}
+/** Decode advisory scan state; corrupt text restarts a safe traversal. */
+function decodeCursor(raw) {
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Clamp caller tuning to the supported finite maintenance budget. */
+function boundedInteger(value, fallback, maximum) {
+    return value !== undefined && Number.isFinite(value) ? Math.max(1, Math.min(maximum, Math.floor(value))) : fallback;
+}
+//# sourceMappingURL=boundedRetention.js.map

package/dist/engine/boundedRetention.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"boundedRetention.js","sourceRoot":"","sources":["../../src/engine/boundedRetention.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAY,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,MAAM,MAAM,GAAG,UAAU,CAAC;AAC1B,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5D,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAClD,CAAC,CAAC;AAsBH,MAAM,MAAM,GAAY;IACtB,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,wBAAwB;QACrE,IAAI,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,gBAAgB;QACnF,QAAQ,EAAE,+EAA+E,EAAE;IAC7F,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,kCAAkC;QACnF,IAAI,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,iBAAiB;QACrF,SAAS,EAAE,gDAAgD,EAAE;IAC/D,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,4BAA4B;QAChF,IAAI,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,mBAAmB,EAAE;IAC9F,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,gCAAgC;QAC5F,IAAI,EAAE,CAAC,YAAY,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,0BAA0B;QAChF,QAAQ,EAAE,uBAAuB;QACjC,QAAQ,EAAE,oHAAoH,EAAE;IAClI,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,6BAA6B;QACnF,IAAI,EAAE,CAAC,YAAY,EAAE,UAAU,CAAC;QAChC,QAAQ,EAAE,oEAAoE,EAAE;CACnF,CAAC;AAEF,kEAAkE;AAClE,SAAS,GAAG,CAAC,GAAc,EAAE,KAAY;IACvC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAoB,CAAoB,CAAC,CAAC;AAChH,CAAC;AAED,qEAAqE;AACrE,SAAS,OAAO,CAAC,GAAc,EAAE,KAAY,EAAE,QAAqC,EAAE,KAAa;IACjG,IAAI,CAAC,GAAG,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAA+B,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9F,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACzE,IAAI,GAAG,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACnE,MAAM,MAAM,GAAG,KAAK,GAAG,GAAG,GAAG,MAAM,CAAC;IACpC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC5C,OAAO,GAAG,CAAC,EAAE,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,GAAG,CAAC,UAAU,GAAG,IAAI,GAAG,MAAM,CAAC;AACxC,CAAC;AAED,8EAA8E;AAC9E,SAAS,QAAQ,CAAC,GAAc,EAAE,KAAY;IAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,iBAAiB;QAAE,OAAO,GAAG,CAAA,mBAAmB,GAAG,CAAC,YAAY,cAAc,GAAG,CAAC,GAAG,GAAG,CAAC;IAC9G,IAAI,KAAK,CAAC,MAAM,KAAK,cAAc;QAAE,OAAO,GAAG,CAAA,iBAAiB,GAAG,CAAC,UAAU,mBAAmB,GAAG,CAAC,QAAQ,GAAG,CAAC;IACjH,OAAO,GAAG,CAAA,QAAQ,GAAG,CAAC,EAAE,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAY,EAAE,IAAkB;IACjE,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IACjD,MAAM,QAAQ,GAAgC;QAC5C,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,qBAAqB,EAAE,EAAE;QAC3F,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;KACtG,CAAC;IACF,0EAA0E;IAC1E,6EAA6E;IAC7E,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,CAAgC,GAAG,CAAA;MAC9D,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CACvC,4CAA4C,KAAK,CAAC,OAAO,0CAA0C,KAAK,CAAC,OAAO,eAAe,KAAK,CAAC,MAAM,GAAG,CAC/I,CAAC,EAAE,GAAG,CAAA,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI;QAC7B,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;KAC7D,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAqB,GAAG,CAAA,kEAAkE,CAAC,CAAC;IACtH,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,MAAM,KAAK,GAAU,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC3F,MAAM,MAAM,GAAgB,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;IAChH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;QAC1F,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC;QACzB,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;QACzC,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QAClC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ;YACjC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CACnF,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;YAC7D,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;YAC3C,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACnC,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/B,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAA,wEAAwE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;+DACpD,CAAC,CAAC;YAC3D,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,sBAAsB;YAC9E,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,iBAAiB,CAAC,CAAC,CAAC,+BAA+B;gBACpE,CAAC,CAAC,8BAA8B,CAAC,CAAC;QACtC,0EAA0E;QAC1E,8EAA8E;QAC9E,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,CAAY,GAAG,CAAA,UAAU,OAAO;eAClD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;UAC3D,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAA,SAAS,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA,EAAE;mBACvD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC;YAC7E,IAAI,IAAI;gBAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,UAAU,GAAU,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,SAAS;YAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QAC/D,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,GAAG,MAAM,CAAC;YAC1D,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC;gBACnC,MAAM,KAAK,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;gBAC5C,UAAU,CAAC,IAAI,CAAC,GAAG,CAAA,uBAAuB,KAAK,CAAC,MAAM,KAAK,KAAK,GAAG,CAAC,CAAC;YACvE,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,IAAI,CAAC,GAAG,CAAA,gBAAgB,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QACD,IAAI,MAAM,EAAE,MAAM,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACzC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAA,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAA,GAAG,CAAC,EAAE,CAAC,EAAE,GAAG,CAAA,IAAI,CAAC,GAAG,CAAC,CAAC;QACjH,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,IAAI,EAAE,MAAM,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAA,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAA,GAAG,CAAC,EAAE,CAAC,EAAE,GAAG,CAAA,IAAI,CAAC,GAAG,CAAC,CAAC;QAChH,CAAC;QACD,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,GAAG,CAAY,GAAG,CAAA;;iBAE3B,OAAO;eACT,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;UAC3D,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAA,SAAS,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAA,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA,EAAE;mBACjE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK;;uBAEzC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,GAAG,CAAC;UAC3C,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAA,aAAa,CAAC,CAAC,CAAC,GAAG,CAAA,MAAM;;QAE9C,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAA,oDAAoD,CAAC,CAAC,CAAC,GAAG,CAAA,EAAE;iBACtE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;KACzG,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;QAC3E,wEAAwE;QACxE,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;YAC7D,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,EAAE,CAAC,CAAC;YACnD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,KAAK,UAAU;gBACvC,CAAC,CAAC,GAAG,CAAA,uFAAuF;gBAC5F,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,cAAc;oBAC/B,CAAC,CAAC,GAAG,CAAA,iFAAiF;oBACxF,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,iBAAiB;wBAClC,CAAC,CAAC,GAAG,CAAA,gJAAgJ;wBACvJ,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAA,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA,EAAE,CAAC;YACnE,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAA,eAAe,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;iBACvD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAA,MAAM,CAAC,KAAK,KAAK;oBAClE,CAAC,CAAC;YAChB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC;QACzC,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACvG,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACnC,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/B,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAA,wEAAwE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;6DACpD,CAAC,CAAC;QAC3D,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM;YAAE,MAAM;IAC7C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,0EAA0E;AAC1E,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;AAC7D,CAAC;AAED,sEAAsE;AACtE,SAAS,cAAc,CAAC,KAAyB,EAAE,QAAgB,EAAE,OAAe;IAClF,OAAO,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACtH,CAAC"}

package/dist/engine/delivery.d.ts

@@ -132,6 +132,7 @@ export declare function ackDeliveriesUpToSeq(db: Db, workspaceId: string, nodeId
     up_to_seq: number;
     acked: number;
 } | null>;
+/** Mark still-queued rows delivered using bounded, explicit ID-index writes. */
 export declare function markDeliveriesDelivered(db: Db, workspaceId: string, deliveryIds: string[]): Promise<number>;
 export interface DeliveryFailureNotice {
     workspace_id: string;
@@ -157,6 +158,7 @@ export interface ExpiredDeliveryBatch {
  */
 export declare function expireDueDeliveryBatch(db: Db, workspaceId: string | undefined, now?: Date): Promise<ExpiredDeliveryBatch>;
 export declare function expireDueDeliveries(db: Db, workspaceId: string | undefined, now?: Date): Promise<DeliveryFailureNotice[]>;
+/** Hydrate bounded resumable redrive windows; empty windows resume next sweep. */
 export declare function fetchDueNodeDeliveryEvents(db: Db, opts?: {
     workspaceId?: string;
     now?: Date;
@@ -188,6 +190,9 @@ export interface NodeDeliveryReplayScope {
     /** Limit replay to identities whose broker-side cursor is ready. */
     agentIds?: readonly string[];
 }
+/** Coalesce identical triggers at the socket owner, including a trailing replay
+ * when readiness/cursors changed during an outstanding drain. This is local
+ * replay coordination, not a global database admission semaphore. */
 export declare function deliverPendingToNode(db: Db, registry: NodeConnectionRegistry, workspaceId: string, nodeId: string, scope?: NodeDeliveryReplayScope): Promise<number>;
 export {};
 //# sourceMappingURL=delivery.d.ts.map

package/dist/engine/delivery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delivery.d.ts","sourceRoot":"","sources":["../../src/engine/delivery.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAA6E,MAAM,iBAAiB,CAAC;AACxH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAMnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEhE,KAAK,EAAE,GAAG,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC;AAEnC,KAAK,WAAW,GAAG,OAAO,UAAU,CAAC,YAAY,CAAC;AAmBlD,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAOD,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C,iBAAS,iBAAiB,CAAC,GAAG,EAAE,WAAW,GAAG;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE;;;;;YAM1C,cAAc;;;;;;;;;;;;;;;;;;;;;;;;EAyBvC;AAGD;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,cAAc,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO;;;;;;;;;;;;;;YAtC9B,cAAc;;;;;;;;;;;;;;;;;;;;;;;;KAwGvC;AA6BD,MAAM,MAAM,gBAAgB,GAAG;IAAE,QAAQ,EAAE,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC;AAEpG;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAYlC;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GACjD,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAsBlC;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE;IAAE,WAAW,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3C,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAsClC;AAsED,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAqC5F;AAED,wBAAsB,uBAAuB,CAC3C,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EAAE,GACpB,OAAO,CAAC,MAAM,CAAC,CAkBjB;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,aAAa,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,KAAK,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,qBAAqB,EAAE,CAAC;CAClC;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC,oBAAoB,CAAC,CAyD/B;AAED,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAElC;AA4ID,wBAAsB,0BAA0B,CAC9C,EAAE,EAAE,EAAE,EACN,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAC9D,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAoGlC;AAED;;;GAGG;AACH,eAAO,MAAM,8BAA8B,mCAA6B,CAAC;AAOzE;;;;;;;;;;GAUG;AACH,wBAAsB,0BAA0B,CAC9C,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GACxC,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAsDlC;AAED,MAAM,WAAW,uBAAuB;IACtC,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B;AAED,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,sBAAsB,EAChC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,KAAK,GAAE,uBAA4B,GAClC,OAAO,CAAC,MAAM,CAAC,CA+EjB"}
+{"version":3,"file":"delivery.d.ts","sourceRoot":"","sources":["../../src/engine/delivery.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAA6E,MAAM,iBAAiB,CAAC;AACxH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAQnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEhE,KAAK,EAAE,GAAG,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC;AAEnC,KAAK,WAAW,GAAG,OAAO,UAAU,CAAC,YAAY,CAAC;AAwBlD,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAOD,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C,iBAAS,iBAAiB,CAAC,GAAG,EAAE,WAAW,GAAG;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE;;;;;YAM1C,cAAc;;;;;;;;;;;;;;;;;;;;;;;;EAyBvC;AAGD;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,cAAc,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO;;;;;;;;;;;;;;YAtC9B,cAAc;;;;;;;;;;;;;;;;;;;;;;;;KAwGvC;AA6BD,MAAM,MAAM,gBAAgB,GAAG;IAAE,QAAQ,EAAE,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC;AAEpG;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAYlC;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GACjD,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAsBlC;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE;IAAE,WAAW,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3C,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAsClC;AAsED,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAqC5F;AAED,gFAAgF;AAChF,wBAAsB,uBAAuB,CAC3C,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EAAE,GACpB,OAAO,CAAC,MAAM,CAAC,CAoBjB;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,aAAa,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,KAAK,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,qBAAqB,EAAE,CAAC;CAClC;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC,oBAAoB,CAAC,CAyD/B;AAED,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAElC;AA4ID,kFAAkF;AAClF,wBAAsB,0BAA0B,CAC9C,EAAE,EAAE,EAAE,EACN,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAC9D,OAAO,CAAC,qBAAqB,EAAE,CAAC,CA+GlC;AAED;;;GAGG;AACH,eAAO,MAAM,8BAA8B,mCAA6B,CAAC;AAOzE;;;;;;;;;;GAUG;AACH,wBAAsB,0BAA0B,CAC9C,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GACxC,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAsDlC;AAED,MAAM,WAAW,uBAAuB;IACtC,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B;AAID;;qEAEqE;AACrE,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,sBAAsB,EAChC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,KAAK,GAAE,uBAA4B,GAClC,OAAO,CAAC,MAAM,CAAC,CAMjB"}

package/dist/engine/delivery.js

@@ -1,11 +1,16 @@
-import { eq, and, not, asc, isNull, inArray, notInArray, lte, gt, sql } from 'drizzle-orm';
+import { eq, and, not, asc, isNull, inArray, notInArray, lte, gt, sql, getTableColumns } from 'drizzle-orm';
 import { deliveries, messages, agents, readReceipts, channelMembers, channels, dmConversations } from '../db/schema.js';
 import { runAtomic } from '../ports/database.js';
 import { isProviderAgentDeliveryReady } from '../ports/realtime.js';
 import { buildDeliverFrame, buildDeliverPayload, buildMessageCreatedEventData, buildThreadReplyEventData, buildDmReceivedEventData, buildGroupDmReceivedEventData } from './deliveryWire.js';
 import { publicMessageMetadata } from './messageMetadata.js';
 import { toIso } from '../lib/serialize.js';
+import { trailingSingleFlight } from '../lib/singleFlight.js';
+import { readNodeRedriveCandidates } from './nodeRedriveCandidates.js';
 import { fetchAttachmentsBatch } from './attachments.js';
+// SQL-wrapped columns retain Drizzle's timestamp/boolean decoders when FROM
+// includes an explicit SQLite INDEXED BY clause rather than a table object.
+const indexedDeliveryColumns = Object.fromEntries(Object.entries(getTableColumns(deliveries)).map(([name, column]) => [name, sql `${column}`.mapWith(column)]));
 const ACTIVE_DELIVERY_STATUSES = ['queued', 'delivered'];
 const TERMINAL_SUCCESS_STATUS = 'acked';
 // Keep expiry work bounded per request and leave ample room under D1's
@@ -276,21 +281,27 @@ export async function ackDeliveriesUpToSeq(db, workspaceId, nodeId, providerName
     const updated = await ackRows(db, workspaceId, agent.id, rows.map((row) => ({ ...row.delivery, channelId: row.channelId })), upToSeq);
     return { agent_id: agent.id, agent_name: agent.name, up_to_seq: upToSeq, acked: updated.length };
 }
+/** Mark still-queued rows delivered using bounded, explicit ID-index writes. */
 export async function markDeliveriesDelivered(db, workspaceId, deliveryIds) {
-    if (deliveryIds.length === 0)
-        return 0;
-    const updated = await db
-        .update(deliveries)
-        .set({
-        status: 'delivered',
-        nextAttemptAt: null,
-        lastDispatchError: null,
-        deliveredAt: new Date(),
-        updatedAt: new Date(),
-    })
-        .where(and(eq(deliveries.workspaceId, workspaceId), inArray(deliveries.id, deliveryIds), eq(deliveries.status, 'queued')))
-        .returning();
-    return updated.length;
+    let count = 0;
+    const ids = [...new Set(deliveryIds)];
+    const now = Math.floor(Date.now() / 1000);
+    // Force primary-key writes too: a bounded replay read is not enough if its
+    // status UPDATE chooses a workspace/status index and scans retained history.
+    for (let offset = 0; offset < ids.length; offset += 50) {
+        const page = ids.slice(offset, offset + 50);
+        const updated = await db.all(sql `
+      UPDATE deliveries INDEXED BY idx_deliveries_id_lookup
+      SET status = 'delivered', next_attempt_at = NULL, last_dispatch_error = NULL,
+          delivered_at = ${now}, updated_at = ${now}
+      WHERE workspace_id = ${workspaceId}
+        AND id IN (${sql.join(page.map(id => sql `${id}`), sql `, `)})
+        AND status = 'queued'
+      RETURNING id
+    `);
+        count += updated.length;
+    }
+    return count;
 }
 /**
  * Transition one D1-safe batch of due deliveries and report both the number of
@@ -477,10 +488,13 @@ function fanoutRecordFromDeliveryRow(row) {
 // re-attempts once the node is connected + delivery-ready). Mirrors
 // `WS_NODE_KINDS` in `nodeDeliver.ts`.
 const NODE_REDRIVE_KINDS = ['http_push', 'ws', 'fleet_ws', 'direct_ws'];
+/** Hydrate bounded resumable redrive windows; empty windows resume next sweep. */
 export async function fetchDueNodeDeliveryEvents(db, opts = {}) {
-    const limit = Math.min(Math.max(opts.limit ?? 50, 1), 200);
+    const limit = Number.isFinite(opts.limit) ? Math.min(Math.max(Math.floor(opts.limit), 1), 200) : 50;
     const now = opts.now ?? new Date();
     const nowSeconds = Math.floor(now.getTime() / 1000);
+    if (!Number.isFinite(nowSeconds))
+        throw new Error('Invalid node redrive clock: expected a finite Date');
     const conditions = [
         eq(deliveries.status, 'queued'),
         inArray(deliveries.routeNodeKind, [...NODE_REDRIVE_KINDS]),
@@ -489,9 +503,9 @@ export async function fetchDueNodeDeliveryEvents(db, opts = {}) {
     if (opts.workspaceId) {
         conditions.push(eq(deliveries.workspaceId, opts.workspaceId));
     }
-    const fetchRows = (attemptCondition, queryLimit, orderByRetryAt) => db
+    const fetchRows = (ids) => db
         .select({
-        delivery: deliveries,
+        delivery: indexedDeliveryColumns,
         recipientAgentName: agents.name,
         body: messages.body,
         blocks: messages.blocks,
@@ -508,30 +522,43 @@ export async function fetchDueNodeDeliveryEvents(db, opts = {}) {
         SELECT a.name FROM agents a WHERE a.id = ${messages.agentId}
       )`,
     })
-        .from(deliveries)
+        .from(sql `${deliveries} INDEXED BY idx_deliveries_id_lookup`)
         .innerJoin(agents, eq(deliveries.agentId, agents.id))
         .innerJoin(messages, eq(deliveries.messageId, messages.id))
         .innerJoin(channels, eq(messages.channelId, channels.id))
         .leftJoin(dmConversations, eq(dmConversations.channelId, messages.channelId))
-        .where(and(...conditions, attemptCondition))
-        .orderBy(...(orderByRetryAt ? [asc(deliveries.nextAttemptAt)] : []), asc(deliveries.createdAt), asc(deliveries.id))
-        .limit(queryLimit);
-    // SQLite orders NULL before timestamps, so preserve the former OR query's
-    // ordering by filling the page with never-attempted rows first. Splitting the
-    // branches lets the due-retry half use idx_deliveries_retry_due; a partial
-    // non-NULL index cannot serve an OR that also asks for NULL rows.
-    const neverAttempted = await fetchRows(isNull(deliveries.nextAttemptAt), limit, false);
+        .where(and(...conditions, inArray(deliveries.id, ids), sql `(${deliveries.nextAttemptAt} IS NULL OR ${deliveries.nextAttemptAt} <= ${nowSeconds})`))
+        .orderBy(asc(deliveries.nextAttemptAt), asc(deliveries.createdAt), asc(deliveries.id));
+    // Scan at most one metadata window per lane. Expiry is checked AFTER LIMIT,
+    // and a durable cursor advances past excluded rows instead of repeatedly
+    // scanning the same prefix. Hydration rechecks mutable eligibility by ID.
+    const neverAttempted = await readNodeRedriveCandidates(db, { workspaceId: opts.workspaceId, retry: false, limit, nowSeconds });
     const dueRetries = neverAttempted.length < limit
-        ? await fetchRows(sql `${deliveries.nextAttemptAt} IS NOT NULL AND ${deliveries.nextAttemptAt} <= ${nowSeconds}`, limit - neverAttempted.length, true)
+        ? await readNodeRedriveCandidates(db, { workspaceId: opts.workspaceId, retry: true, limit: limit - neverAttempted.length, nowSeconds })
         : [];
-    const rows = [...neverAttempted, ...dueRetries];
+    const ids = [...neverAttempted, ...dueRetries];
+    const rows = [];
+    for (let offset = 0; offset < ids.length; offset += 50) {
+        rows.push(...await fetchRows(ids.slice(offset, offset + 50)));
+    }
+    // Attachment hydration must respect the same bind budget as delivery rows.
+    const fetchRedriveAttachments = async (workspaceId, messageIds) => {
+        const attachments = new Map();
+        const uniqueIds = [...new Set(messageIds)];
+        for (let offset = 0; offset < uniqueIds.length; offset += 50) {
+            const page = await fetchAttachmentsBatch(db, workspaceId, uniqueIds.slice(offset, offset + 50));
+            for (const [id, items] of page)
+                attachments.set(id, items);
+        }
+        return attachments;
+    };
     if (!opts.workspaceId && rows.length > 0) {
         const workspaceAttachments = new Map();
         for (const workspaceId of [...new Set(rows.map((row) => row.delivery.workspaceId))]) {
             const workspaceMessageIds = rows
                 .filter((row) => row.delivery.workspaceId === workspaceId)
                 .map((row) => row.delivery.messageId);
-            const batch = await fetchAttachmentsBatch(db, workspaceId, [...new Set(workspaceMessageIds)]);
+            const batch = await fetchRedriveAttachments(workspaceId, workspaceMessageIds);
             for (const [messageId, attachments] of batch)
                 workspaceAttachments.set(messageId, attachments);
         }
@@ -547,7 +574,7 @@ export async function fetchDueNodeDeliveryEvents(db, opts = {}) {
         });
     }
     const attachmentsByMessageId = opts.workspaceId
-        ? await fetchAttachmentsBatch(db, opts.workspaceId, [...new Set(rows.map((row) => row.delivery.messageId))])
+        ? await fetchRedriveAttachments(opts.workspaceId, rows.map((row) => row.delivery.messageId))
         : new Map();
     return rows.map((row) => {
         const pendingRow = row;
@@ -623,78 +650,109 @@ export async function fetchQueuedWsBacklogEvents(db, workspaceId, agentId, opts
         };
     });
 }
-export async function deliverPendingToNode(db, registry, workspaceId, nodeId, scope = {}) {
-    const agentIds = scope.agentIds ? [...new Set(scope.agentIds)] : undefined;
-    if (agentIds?.length === 0)
-        return 0;
-    const nowSeconds = Math.floor(Date.now() / 1000);
-    const conditions = [
-        eq(deliveries.workspaceId, workspaceId),
-        eq(agents.locationType, 'via_node'),
-        eq(agents.locationNodeId, nodeId),
-        inArray(deliveries.status, [...ACTIVE_DELIVERY_STATUSES]),
-        gt(deliveries.seq, agents.deliveryAckSeq),
-        sql `(${deliveries.expiresAt} IS NULL OR ${deliveries.expiresAt} > ${nowSeconds})`,
-    ];
-    if (scope.providerName !== undefined) {
-        conditions.push(eq(agents.providerName, scope.providerName));
-    }
-    if (agentIds) {
-        conditions.push(inArray(agents.id, agentIds));
+const replayFlights = new WeakMap();
+/** Coalesce identical triggers at the socket owner, including a trailing replay
+ * when readiness/cursors changed during an outstanding drain. This is local
+ * replay coordination, not a global database admission semaphore. */
+export function deliverPendingToNode(db, registry, workspaceId, nodeId, scope = {}) {
+    let flights = replayFlights.get(registry);
+    if (!flights) {
+        flights = new Map();
+        replayFlights.set(registry, flights);
     }
-    const rows = await db
-        .select({
-        delivery: deliveries,
-        recipientAgentName: agents.name,
-        recipientProviderName: agents.providerName,
+    const key = JSON.stringify([workspaceId, nodeId, scope.providerName,
+        scope.agentIds ? [...new Set(scope.agentIds)].sort() : null]);
+    return trailingSingleFlight(flights, key, () => replayPendingToNode(db, registry, workspaceId, nodeId, scope));
+}
+/** Drain a finite per-agent high-water mark in ordered, readiness-checked pages. */
+async function replayPendingToNode(db, registry, workspaceId, nodeId, scope = {}) {
+    const wantedIds = scope.agentIds ? new Set(scope.agentIds) : undefined;
+    if (wantedIds?.size === 0)
+        return 0;
+    // Resolve the small node roster first. A delivery-first join lets SQLite
+    // choose the workspace/status index and scan millions of retained rows.
+    const recipients = await db.select({
+        id: agents.id, name: agents.name, providerName: agents.providerName,
         ackSeq: agents.deliveryAckSeq,
-        body: messages.body,
-        blocks: messages.blocks,
-        metadata: messages.metadata,
-        hasAttachments: messages.hasAttachments,
-        threadId: messages.threadId,
-        createdAt: messages.createdAt,
-        channelId: messages.channelId,
-        channelName: channels.name,
-        conversationId: dmConversations.id,
-        dmType: dmConversations.dmType,
-        senderAgentId: messages.agentId,
-        senderAgentName: sql `(
-        SELECT a.name FROM agents a WHERE a.id = ${messages.agentId}
-      )`,
-    })
-        .from(deliveries)
-        .innerJoin(agents, eq(deliveries.agentId, agents.id))
-        .innerJoin(messages, eq(deliveries.messageId, messages.id))
-        .innerJoin(channels, eq(messages.channelId, channels.id))
-        .leftJoin(dmConversations, eq(dmConversations.channelId, messages.channelId))
-        .where(and(...conditions))
-        .orderBy(asc(agents.name), asc(deliveries.seq));
-    const attachmentsByMessageId = await fetchAttachmentsBatch(db, workspaceId, [...new Set(rows.map((row) => row.delivery.messageId))]);
-    const deliveredIds = [];
-    for (const row of rows) {
-        if (!isProviderAgentDeliveryReady(registry, workspaceId, nodeId, row.recipientProviderName, row.delivery.agentId)) {
+    }).from(agents).where(and(eq(agents.workspaceId, workspaceId), eq(agents.locationType, 'via_node'), eq(agents.locationNodeId, nodeId), scope.providerName === undefined ? undefined : eq(agents.providerName, scope.providerName))).orderBy(asc(agents.name));
+    let delivered = 0;
+    for (const recipient of recipients) {
+        if (wantedIds && !wantedIds.has(recipient.id))
+            continue;
+        const ready = () => isProviderAgentDeliveryReady(registry, workspaceId, nodeId, recipient.providerName, recipient.id);
+        if (!ready())
             continue;
+        // Capture a finite high-water mark: arrivals during replay are handled by
+        // live dispatch/the next reconnect, not an indefinitely growing drain.
+        const [highWater] = await db.select({ seq: deliveries.seq })
+            .from(deliveries).where(and(eq(deliveries.workspaceId, workspaceId), eq(deliveries.agentId, recipient.id))).orderBy(sql `${deliveries.seq} DESC`).limit(1);
+        if (!highWater)
+            continue;
+        let cursor = recipient.ackSeq;
+        while (cursor < highWater.seq && ready()) {
+            // The literal predicate is essential: SQLite must prove that this
+            // query qualifies for the partial index even with bound parameters.
+            const page = await db.select({ id: sql `${deliveries.id}`, seq: sql `${deliveries.seq}` })
+                .from(sql `${deliveries} INDEXED BY idx_deliveries_agent_active_seq`)
+                .where(and(eq(deliveries.workspaceId, workspaceId), eq(deliveries.agentId, recipient.id), sql `${deliveries.status} IN ('queued', 'delivered')`, gt(deliveries.seq, cursor), lte(deliveries.seq, highWater.seq))).orderBy(asc(deliveries.seq)).limit(50);
+            if (!page.length)
+                break;
+            cursor = page[page.length - 1].seq;
+            // Hydrate only this bounded ID page. Re-check ownership, ACK, expiry and
+            // status here because each await can race a handoff or cumulative ACK.
+            const rows = await db.select({
+                delivery: indexedDeliveryColumns,
+                recipientAgentName: agents.name,
+                recipientProviderName: agents.providerName,
+                ackSeq: agents.deliveryAckSeq,
+                body: messages.body, blocks: messages.blocks, metadata: messages.metadata,
+                hasAttachments: messages.hasAttachments, threadId: messages.threadId,
+                createdAt: messages.createdAt, channelId: messages.channelId,
+                channelName: channels.name, conversationId: dmConversations.id,
+                dmType: dmConversations.dmType, senderAgentId: messages.agentId,
+                senderAgentName: sql `(
+          SELECT a.name FROM agents a WHERE a.id = ${messages.agentId}
+        )`,
+            }).from(sql `${deliveries} INDEXED BY idx_deliveries_id_lookup`)
+                .innerJoin(agents, eq(deliveries.agentId, agents.id))
+                .innerJoin(messages, eq(deliveries.messageId, messages.id))
+                .innerJoin(channels, eq(messages.channelId, channels.id))
+                .leftJoin(dmConversations, eq(dmConversations.channelId, messages.channelId))
+                .where(and(inArray(deliveries.id, page.map(row => row.id)), eq(deliveries.workspaceId, workspaceId), eq(agents.locationType, 'via_node'), eq(agents.locationNodeId, nodeId), eq(agents.id, recipient.id), recipient.providerName === null
+                ? isNull(agents.providerName) : eq(agents.providerName, recipient.providerName), inArray(deliveries.status, [...ACTIVE_DELIVERY_STATUSES]), gt(deliveries.seq, agents.deliveryAckSeq), sql `(${deliveries.expiresAt} IS NULL OR ${deliveries.expiresAt} > ${Math.floor(Date.now() / 1000)})`)).orderBy(asc(deliveries.seq));
+            const attachments = await fetchAttachmentsBatch(db, workspaceId, [...new Set(rows.map(row => row.delivery.messageId))]);
+            const deliveredIds = [];
+            let interrupted = false;
+            for (const row of rows) {
+                if (!ready()) {
+                    interrupted = true;
+                    break;
+                }
+                const { eventType, eventData } = buildRoutableDeliveryEvent(row, attachments.get(row.delivery.messageId) ?? []);
+                const sent = await registry.sendToProvider(workspaceId, nodeId, recipient.providerName, buildDeliverFrame({
+                    delivery_id: row.delivery.id, agent_id: recipient.id,
+                    agent: row.recipientAgentName, msg_id: row.delivery.messageId,
+                    seq: row.delivery.seq, mode: wireMode(row.delivery.mode),
+                    payload: buildDeliverPayload(eventType, eventData),
+                }));
+                // Never send a higher sequence past a failed lower one: a cumulative
+                // ACK for it would make the unsent lower delivery replay-invisible.
+                if (!sent) {
+                    interrupted = true;
+                    break;
+                }
+                deliveredIds.push(row.delivery.id);
+            }
+            await markDeliveriesDelivered(db, workspaceId, deliveredIds);
+            delivered += deliveredIds.length;
+            if (interrupted)
+                break;
         }
-        const attachments = attachmentsByMessageId.get(row.delivery.messageId) ?? [];
-        const { eventType, eventData } = buildRoutableDeliveryEvent(row, attachments);
-        const sent = await registry.sendToProvider(workspaceId, nodeId, row.recipientProviderName, buildDeliverFrame({
-            delivery_id: row.delivery.id,
-            agent_id: row.delivery.agentId,
-            agent: row.recipientAgentName,
-            msg_id: row.delivery.messageId,
-            seq: row.delivery.seq,
-            mode: wireMode(row.delivery.mode),
-            payload: buildDeliverPayload(eventType, eventData),
-        }));
-        if (sent)
-            deliveredIds.push(row.delivery.id);
     }
-    await markDeliveriesDelivered(db, workspaceId, deliveredIds);
-    return deliveredIds.length;
+    return delivered;
 }
 /**
- * Resolve the result of a status-guarded transition: when the write landed,
+ * Resolve a status-guarded transition: when the write landed,
  * report the updated row as changed. When it did not (the row was deleted, or a
  * concurrent ack won the race and the row is now terminal), re-read and return
  * the current state as unchanged — never resurrecting it or emitting an event.