@ultimat3/notify 23.0.0 → 25.0.0

package/CLAUDE.md

@@ -11,9 +11,9 @@ returns a `job`, which is the whole design.
 
 | Never | Because |
 |---|---|
-| `@ultimat3/mail` | Same tier (4). A `Mailer` is declared **structurally** in `channel-mail.ts` — one method, no dependency — exactly as `@ultimat3/action`'s `PgExecutor` mirrors `@ultimat3/db`. Moving `notify` to tier 5 to legalise the import would put notifications above `render`, `pwa` and `ui` for one channel's transport, and would then need a `cli → notify` edge the way `cli → scraping` does. |
+| `@ultimat3/mail` | Same tier (4). A `Mailer` is declared **structurally** in `channel-mail.ts` — one method, no dependency — exactly as `PgExecutor` (`@ultimat3/core`) mirrors `@ultimat3/db`. Moving `notify` to tier 5 to legalise the import would put notifications above `render`, `pwa` and `ui` for one channel's transport, and would then need a `cli → notify` edge the way `cli → scraping` does. |
 | `@ultimat3/render`, `@ultimat3/ui`, `@ultimat3/ai`, `@ultimat3/mcp`, `@ultimat3/pwa` | Same tier. A notification has no view — the inbox is rendered by the app's page out of `InboxStore.list`, which is data. |
-| `@ultimat3/db`, `@ultimat3/entity` | Legal downward, and deliberately not taken. The two tables this package owns are **DDL constants applied by the boot** (`SQL_NOTIFY_DELIVERIES_TABLE`, `SQL_NOTIFY_INBOX_TABLE`), the way `x_jobs`, `x_idempotency` and `x_audit` are — never `entity()` declarations, which would put framework tables in the app's migration graph and make an app's `x db gen` responsible for them. The Postgres stores take a structural `PgExecutor`, imported as a **type** from `@ultimat3/jobs` rather than re-declared, because a third copy of a one-method interface is a third place to look. |
+| `@ultimat3/db`, `@ultimat3/entity` | Legal downward, and deliberately not taken. The three tables this package owns are **DDL constants applied by the boot** (`SQL_NOTIFY_DELIVERIES_TABLE`, `SQL_NOTIFY_INBOX_TABLE`, `SQL_NOTIFY_DIGESTS_TABLE`), the way `x_jobs`, `x_idempotency` and `x_audit` are — never `entity()` declarations, which would put framework tables in the app's migration graph and make an app's `x db gen` responsible for them. The Postgres stores take a structural `PgExecutor`, imported as a **type** from `@ultimat3/core` (its one declaration; `bun run flight-copies` refuses another, `X_HELPER_COPY`). |
 | `@ultimat3/policy` | A notification is addressed to exactly one person and the audience is `recipients`. There is no row a policy could decide about here. The **inbox read surface** is where authz belongs, and that is the app's query. |
 
 ## What ships, and what must never
@@ -55,7 +55,28 @@ A job body runs **before** its checkpoint lands, so both layers are load-bearing
 `attempt.ts` is the only place a send happens, so there is exactly one implementation of that order.
 The **one at-most-once seam** is a digest flush: `DigestStore.drain` empties the window, and a
 process killed between the drain and its checkpoint loses that batch. It is stated in `digest.ts`
-rather than hidden, and a durable store can close it.
+rather than hidden. `postgresDigestStore` makes the window itself durable and shared — the
+partial unique index `x_notify_digests_open_idx` lets two replicas' first appends collide so ONE
+opens the window and owns the flush; an elapsed open window is sealed and the append retried — but
+its `drain` is still a delete, so the seam is unchanged (`digest-parity.live.test.ts` runs one
+suite against both stores).
+
+**A digest append is ONE STEP PER RECIPIENT, and idempotent per appender** (`As of 2026-10-05`).
+The append pass was one `step.run`, and a step that fails part-way re-runs WHOLE: recipients already
+appended read `opened: false` from the window they had opened and it was never drained, and a window
+they had JOINED could have been drained and deleted by its owner meanwhile, so their event went out
+in a second digest. Now `digest:<channel>:<recipient>` is a step each (the step store is the
+durable fence; one row per recipient, as `deliver:` already writes), and behind it
+`DigestAppend.appender` (`${runId}:${recipient}`) is stored per window — `appended_by text[]`,
+opener first — so an append whose answer was lost, or a run whose step history is gone, gets back
+the window it landed in while that window exists. Two executions of one appender at once (a lapsed
+lease) cannot both join: the `do update` refuses an appender already in the row. Pinned by
+`fanout-digest.test.ts` and `digest-parity.live.test.ts`.
+
+**The audience is deduplicated by `id` once, as it leaves the `open` step** (`As of 2026-10-02`).
+Every per-recipient step is named by the id, so a resolver that named one person twice failed
+`X_STEP_DUPLICATE` part-way through the fan-out, on every retry. Outside the step rather than in it,
+so an `open` checkpointed with duplicates by an earlier version is repaired on replay too.
 
 ## Files
 
@@ -70,8 +91,9 @@ rather than hidden, and a durable store can close it.
 | `ledger.ts` · `ledger-pg.ts` | the delivery ledger, memory and Postgres |
 | `inbox.ts` · `inbox-pg.ts` | the in-app inbox, memory and Postgres |
 | `preferences.ts` · `digest.ts` | the gate and the window, as seams |
+| `digest-pg.ts` | the digest window in Postgres: one row per window, at most one OPEN per slot |
 | `stores.ts` | the one installer for all four |
-| `retention.ts` | the two sweeps, read off the installed seam |
+| `retention.ts` | the three sweeps, read off the installed seam |
 | `errors.ts` | this package's `X_NOTIFY_*` codes and their titles |
 
 One entry point, deliberately: every module runs on the server, so there is no browser half to split
@@ -81,7 +103,7 @@ off.
 `list`/`markRead`** (`As of 2026-09`). `markRead`'s contract is that an id belonging to nobody is
 *simply absent* — the memory store skips it — while the Postgres one bound the caller's ids into
 `any($2::uuid[])`, so one malformed id raised 22P02 out of the store and the nineteen good ids in
-the batch went unmarked. `createPgInboxStore` screens with `isUuid` before binding and answers `0`
+the batch went unmarked. `postgresInboxStore` screens with `isUuid` before binding and answers `0`
 with no round trip when nothing survives; the statement keeps its `::uuid[]` cast and its primary
 key index, which `id::text = any($2)` would have given up. And the memory `list` now sorts
 `(createdAt desc, notifier, key)` — the total order `SQL_NOTIFY_INBOX_PAGE` takes — because
@@ -89,8 +111,8 @@ key index, which `id::text = any($2)` would have given up. And the memory `list`
 can drop one and repeat the other.
 
 **The tail is `(notifier, key)` and never `id`, `As of 2026-09-06`.** Both stores had a tail and
-they were two different total orders: `createPgInboxStore` mints a UUIDv7 that Postgres compares by
-its 16 BYTES, while `createMemoryInboxStore` derives its id from
+they were two different total orders: `postgresInboxStore` mints a UUIDv7 that Postgres compares by
+its 16 BYTES, while `memoryInboxStore` derives its id from
 `JSON.stringify([recipient, notifier, key])` and compares by code point — so equal-`createdAt` rows
 came back one way in dev and the other in production, which is the drop-and-repeat the tail exists
 to prevent, on whichever driver nobody tested against. `(notifier, key)` is unique within a
@@ -108,7 +130,7 @@ it the two would split on exactly the Unicode keys nobody writes a test for.
 
 ## Retention
 
-Both tables are swept by the boot's hourly `x.purge` job, and neither store is handed to it:
+All three tables are swept by the boot's hourly `x.purge` job, and no store is handed to it:
 `setNotifyStores` is an APP's boot line that runs when the app's modules import, after the boot that
 installs the sweep. So `retention.ts` reads the seam **per attempt** — the same shape as
 `purgeAuthLimits()` — and answers `0` for a memory store or none at all, which is a boot that made a
@@ -116,16 +138,24 @@ decision rather than a failure.
 
 | Table | Window | Named where |
 |---|---|---|
-| `x_notify_deliveries` | `PgDeliveryLedgerOptions.windowMs`, default 24 h | beside the statement that reads it. **Never shorter than the app's idempotency window** — a job replayed inside that window against a purged claim claims cleanly and sends twice. Pass `idempotency.windowMs` |
+| `x_notify_deliveries` | `PostgresDeliveryLedgerOptions.windowMs`, default 24 h | beside the statement that reads it. **Never shorter than the app's idempotency window** — a job replayed inside that window against a purged claim claims cleanly and sends twice. Pass `idempotency.windowMs` |
+| `x_notify_digests` | `PostgresDigestStoreOptions.retentionMs`, default 7 days after the window closed | beside the statement that reads it, like the ledger's |
 | `x_notify_inbox` | `notify.inboxReadRetentionMs` / `notify.inboxUnreadRetentionMs` in `AppConfig`, **both absent by default** | the app's `app.config.ts`, because an inbox row is a message a person has not read yet and when it disappears is a product decision (axiom 8) |
 
 `purgeBefore` and `purgeExpired` live on the **Postgres stores' own wider types**
-(`PgInboxStore`, `PgDeliveryLedger`), never on `InboxStore`/`DeliveryLedger`: adding a method to the
-seam every implementation must satisfy is a breaking change for an app that wrote its own, and a
+(`PostgresInboxStore`, `PostgresDeliveryLedger`, `PostgresDigestStore`), never on the seams: adding a method to
+the seam every implementation must satisfy is a breaking change for an app that wrote its own, and a
 heap map bounded by process life has nothing to delete. Exactly the shape `PostgresIdempotencyStore`
 already has.
 
-`packages/cli/src/framework-schema.ts` applies both tables' DDL on every boot, **whether or not that
+`x_notify_digests`: every window is deleted by its own flush's `drain`, or by the next window's
+drain of the same slot (`ends_at <=`). The one neither reaches — a flush that dead-lettered, on a
+slot that never digests again — is the sweep's (`purgeNotifyDigests` → `PostgresDigestStore.purgeExpired`,
+`As of 2026-10-02`): windows CLOSED more than `retentionMs` before the job's clock, default
+`DEFAULT_DIGEST_RETENTION_MS` (7 days, longer than any flush's retries), deleted in batches of
+`DIGEST_PURGE_BATCH` and at most `DIGEST_PURGE_MAX_BATCHES` statements per pass.
+
+`packages/cli/src/framework-schema.ts` applies every notify table's DDL on every boot, **whether or not that
 boot calls `setNotifyStores`** — this file said it did not until 2026-08-27, which is a sentence that
 outlived its fact.
 

package/README.md

@@ -98,9 +98,9 @@ One call, at boot. Whole-object replacement, never a merge.
 ```ts
 import type { PgExecutor } from '@ultimat3/jobs';
 import {
-  createMemoryDigestStore,
-  createPgDeliveryLedger,
-  createPgInboxStore,
+  postgresDeliveryLedger,
+  postgresDigestStore,
+  postgresInboxStore,
   setNotifyStores,
 } from '@ultimat3/notify';
 
@@ -114,9 +114,10 @@ declare const prefs: {
 setNotifyStores({
   // `windowMs` is how long a settled claim is kept. NEVER SHORTER than your idempotency window —
   // a job replayed inside that window against a purged claim claims cleanly and sends twice.
-  ledger: createPgDeliveryLedger({ executor, windowMs: idempotency.windowMs }),
-  inbox: createPgInboxStore({ executor }),
-  digest: createMemoryDigestStore(),
+  ledger: postgresDeliveryLedger({ executor, windowMs: idempotency.windowMs }),
+  inbox: postgresInboxStore({ executor }),
+  // `x_notify_digests`: a window survives a restart and every replica joins the same one.
+  digest: postgresDigestStore({ executor }),
   preferences: {
     // The GATE ships; what it reads never does. Your taxonomy, your quiet hours.
     allows: ({ recipient, notifier: name, channel, ctx }) =>
@@ -127,26 +128,28 @@ setNotifyStores({
 
 | Store | Default | Why |
 |---|---|---|
-| `ledger` | `createMemoryDeliveryLedger()` | one process is genuinely deduped by a heap map, and no ledger at all means a replay sends twice |
+| `ledger` | `memoryDeliveryLedger()` | one process is genuinely deduped by a heap map, and no ledger at all means a replay sends twice |
 | `preferences` | `allowAllPreferences()` | denying by default is a notifier that silently delivers nothing |
 | `inbox` | **none** — `X_NOTIFY_STORE_MISSING` | a message written to nowhere is worse than a refusal |
-| `digest` | **none** — `X_NOTIFY_STORE_MISSING` | same |
+| `digest` | **none** — `X_NOTIFY_STORE_MISSING` | same. `memoryDigestStore()` for one process; `postgresDigestStore({ executor })` keeps a window across a restart and gives two replicas ONE window (a partial unique index on the open one), so exactly one run owns its flush |
 
 `executor` is a structural `{ query(sql, params) }` — `@ultimat3/cli`'s `pgExecutorFor(client)` over
 a `DbClient` is the framework's own. `Bun.sql` does **not** satisfy it.
 
 ## Retention
 
-Both tables grow with traffic, and the boot's hourly `x.purge` job sweeps both — but only against
-the **Postgres** stores. `createPgInboxStore` carries `purgeBefore` and `createPgDeliveryLedger`
-carries `purgeExpired`; the memory ones do not, and a boot that installed a memory store sweeps
-nothing. The methods are on those stores' own wider types (`PgInboxStore`, `PgDeliveryLedger`), not
-on `InboxStore`/`DeliveryLedger`, so an app that wrote its own implementation is unaffected.
+All three tables grow with traffic, and the boot's hourly `x.purge` job sweeps them — but only
+against the **Postgres** stores. `postgresInboxStore` carries `purgeBefore`, `postgresDeliveryLedger`
+and `postgresDigestStore` carry `purgeExpired`; the memory ones do not, and a boot that installed a
+memory store sweeps nothing. The methods are on those stores' own wider types (`PostgresInboxStore`,
+`PostgresDeliveryLedger`, `PostgresDigestStore`), not on the seams, so an app that wrote its own implementation
+is unaffected.
 
 | Table | Window | Default |
 |---|---|---|
-| `x_notify_deliveries` | `createPgDeliveryLedger({ windowMs })` | 24 h. A settled claim ages from its **last** attempt — `settle` moves `at` |
+| `x_notify_deliveries` | `postgresDeliveryLedger({ windowMs })` | 24 h. A settled claim ages from its **last** attempt — `settle` moves `at` |
 | `x_notify_inbox` | `notify.inboxReadRetentionMs` / `notify.inboxUnreadRetentionMs` in `app.config.ts` | **neither** — never swept |
+| `x_notify_digests` | `postgresDigestStore({ retentionMs })` | 7 days after a window CLOSED. A drained window is already gone; this takes one whose flush dead-lettered. Batched: 1,000 rows per statement, at most 50 per pass |
 
 The inbox default is deliberate and is not a missing number. An inbox row is a message a person has
 not read yet, so when it disappears is your decision, not the framework's — which is why the key
@@ -165,7 +168,7 @@ A read row ages from `read_at` and an unread one from `created_at` — ageing a
 ## Channels
 
 ```ts
-import { bulkChannel, channel } from '@ultimat3/notify';
+import { bulkChannel, deliveryChannel } from '@ultimat3/notify';
 
 // The app's push vendor and its Slack webhook — a channel is where an SDK belongs.
 declare const pushService: {
@@ -174,7 +177,7 @@ declare const pushService: {
 declare const SLACK_URL: string;
 
 // One call per recipient. The retry unit is one address.
-export const push = channel('push', async ({ recipient, event, signal }) => {
+export const push = deliveryChannel('push', async ({ recipient, event, signal }) => {
   await pushService.send(recipient.to ?? '', event.params, { signal });
 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/notify",
-  "version": "23.0.0",
+  "version": "25.0.0",
   "description": "Notifications: one declaration, many channels — fan-out, preference gate, digest window, delivery ledger, in-app inbox",
   "license": "MIT",
   "type": "module",
@@ -28,16 +28,16 @@
     "LICENSE"
   ],
   "engines": {
-    "bun": ">=1.4.0"
+    "bun": ">=1.4.2"
   },
   "scripts": {
     "typecheck": "tsc --noEmit -p tsconfig.json",
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/core": "23.0.0",
-    "@ultimat3/jobs": "23.0.0",
-    "@ultimat3/schema": "23.0.0",
-    "@ultimat3/time": "23.0.0"
+    "@ultimat3/core": "25.0.0",
+    "@ultimat3/jobs": "25.0.0",
+    "@ultimat3/schema": "25.0.0",
+    "@ultimat3/time": "25.0.0"
   }
 }

package/src/channel-in-app.ts

@@ -3,7 +3,7 @@
 // declared where every other delivery is declared, rather than a table that fills itself.
 
 import type { NotifyChannel } from './channel';
-import { channel } from './channel';
+import { deliveryChannel } from './channel';
 import { requireInbox } from './stores';
 
 export interface InAppChannelOptions {
@@ -17,7 +17,7 @@ export const IN_APP_CHANNEL = 'in-app';
 export function inAppChannel<Params = unknown>(
   options: InAppChannelOptions = {},
 ): NotifyChannel<Params> {
-  return channel<Params>(options.name ?? IN_APP_CHANNEL, async ({ recipient, batch }) => {
+  return deliveryChannel<Params>(options.name ?? IN_APP_CHANNEL, async ({ recipient, batch }) => {
     // Every event in the batch, not just the newest: a digest window over an inbox still owes the
     // reader one row per thing that happened. `add` is idempotent on (recipient, notifier, key),
     // so a replayed attempt writes nothing new and does not move an existing row's timestamps.

package/src/channel-mail.ts

@@ -1,6 +1,6 @@
 // Email as a channel, over a STRUCTURAL mailer rather than an import of @ultimat3/mail.
 //
-// That is the tier argument, and it is the same one `@ultimat3/action`'s `PgExecutor` makes about
+// That is the tier argument, and it is the same one `PgExecutor` (`@ultimat3/core`) makes about
 // `@ultimat3/db`. `@ultimat3/mail` is tier 4 and so is this package, so importing it would be a
 // sideways edge — and moving `notify` to tier 5 to legalise it would put notifications above
 // `render`, `pwa` and `ui` for no reason other than one channel's transport. A mailer is a driver
@@ -11,7 +11,7 @@
 //   }) } })
 
 import type { NotifyChannel } from './channel';
-import { channel } from './channel';
+import { deliveryChannel } from './channel';
 import type { NotifyEvent, Recipient } from './notification';
 
 /** What a mailer is handed. Everything a template needs to render, and nothing about transport. */
@@ -55,7 +55,7 @@ export function mailChannel<Params = unknown>(
   options: MailChannelOptions<Params>,
 ): NotifyChannel<Params> {
   const addressOf = options.addressOf ?? ((recipient: Recipient) => recipient.to);
-  return channel<Params>(
+  return deliveryChannel<Params>(
     options.name ?? MAIL_CHANNEL,
     async ({ recipient, batch, ctx, signal }) => {
       const to = addressOf(recipient);

package/src/channel.ts

@@ -51,7 +51,7 @@ export type AnyNotifyChannel<Params = unknown> = NotifyChannel<Params> | BulkNot
  * One recipient per call. The name is durable — it is a column of the delivery ledger — so it is
  * given here rather than derived from a variable name that a bundler may rewrite.
  */
-export function channel<Params = unknown>(
+export function deliveryChannel<Params = unknown>(
   name: string,
   deliver: (args: DeliveryArgs<Params>) => Promise<void> | void,
 ): NotifyChannel<Params> {

package/src/digest-pg.ts

@@ -0,0 +1,237 @@
+// The Postgres digest store: one row per window, so a `digested` event outlives the process that
+// appended it and every replica coalesces into the same window. `memoryDigestStore` is the
+// same queue of windows in one heap; this is what a deployment with more than one process installs.
+
+import type { PgExecutor } from '@ultimat3/core';
+import { finiteCount, UltimateError } from '@ultimat3/core';
+import type { DigestSlot, DigestStore } from './digest';
+import type { NotifyEvent } from './notification';
+
+/**
+ * Applied by the boot beside `SQL_NOTIFY_DELIVERIES_TABLE` and `SQL_NOTIFY_INBOX_TABLE`, never by
+ * an app migration — a new column is `alter table … add column if not exists`, never an edit here.
+ *
+ * The PARTIAL unique index is the whole concurrency story: at most one OPEN window per slot, so two
+ * replicas appending the first event of a window at once collide on it and exactly one of them
+ * opens the window and owns its flush. A window is SEALED once it has elapsed and an append wanted
+ * a new one; sealed windows wait for their flush and are not indexed, so a slot can hold several.
+ */
+export const SQL_NOTIFY_DIGESTS_TABLE = `
+create table if not exists x_notify_digests (
+  seq        bigint      generated always as identity primary key,
+  recipient  text        not null,
+  notifier   text        not null,
+  channel    text        not null,
+  group_key  text        not null,
+  ends_at    timestamptz not null,
+  sealed     boolean     not null default false,
+  events     jsonb       not null
+);
+
+create unique index if not exists x_notify_digests_open_idx
+  on x_notify_digests (recipient, notifier, channel, group_key) where not sealed;
+
+create index if not exists x_notify_digests_slot_idx
+  on x_notify_digests (recipient, notifier, channel, group_key, ends_at);
+
+create index if not exists x_notify_digests_ends_idx on x_notify_digests (ends_at);
+
+alter table x_notify_digests add column if not exists appended_by text[] not null default '{}';
+`;
+
+/**
+ * Join the open window, or open one — unless this appender (`$8`) already landed in a window of the
+ * slot, which is a replayed step: then that window's answer comes back and nothing is written.
+ * `appended_by[1]` is the opener, so a replay by the opener still reads `opened`, and owns the
+ * flush it owned the first time. `(xmax = 0)` is true for the row this statement INSERTED and false
+ * for one it updated. An open window that has already elapsed is not joined: the `where` on the
+ * `do update` refuses it and no row comes back, which is the store's cue to seal it and try again.
+ * A row written before `appended_by` existed holds `'{}'`, matches no appender, and opens nothing.
+ *
+ * The `any` on the `do update` is for two executions of ONE appender at once (a lapsed lease): both
+ * pass `prior` in their own snapshots, and the loser's conflict re-reads the winner's COMMITTED row.
+ * It refuses to join it twice and no row comes back — the store's next pass then finds it in
+ * `prior`, exactly as it finds an elapsed window sealed.
+ */
+export const SQL_NOTIFY_DIGEST_APPEND = `
+with prior as (
+  select ends_at, coalesce(appended_by[1] = $8::text, false) as opened
+  from x_notify_digests
+  where recipient = $1 and notifier = $2 and channel = $3 and group_key = $4
+    and $8::text = any(appended_by)
+  order by seq
+  limit 1
+), joined as (
+  insert into x_notify_digests (recipient, notifier, channel, group_key, ends_at, events, appended_by)
+  select $1, $2, $3, $4, $6::timestamptz, $5::jsonb, array[$8::text]
+  where not exists (select 1 from prior)
+  on conflict (recipient, notifier, channel, group_key) where not sealed
+  do update set events = x_notify_digests.events || excluded.events,
+    appended_by = x_notify_digests.appended_by || excluded.appended_by
+  where x_notify_digests.ends_at > $7::timestamptz
+    and not ($8::text = any(x_notify_digests.appended_by))
+  returning ends_at, (xmax = 0) as opened
+)
+select ends_at, opened from prior
+union all
+select ends_at, opened from joined
+`;
+
+/** Seal the slot's open window once it has elapsed, so the next append opens a fresh one. */
+export const SQL_NOTIFY_DIGEST_SEAL = `
+update x_notify_digests set sealed = true
+where recipient = $1 and notifier = $2 and channel = $3 and group_key = $4
+  and not sealed and ends_at <= $5
+`;
+
+/**
+ * Take every window closing at or before `$5` — its own and an older one a crashed flush left —
+ * or, with `$5` null, the oldest window alone. Oldest first, by close time and then by the order
+ * the windows were opened in, which is what the memory store's queue answers.
+ */
+export const SQL_NOTIFY_DIGEST_DRAIN = `
+with taken as (
+  delete from x_notify_digests
+  where recipient = $1 and notifier = $2 and channel = $3 and group_key = $4
+    and (
+      ($5::timestamptz is not null and ends_at <= $5)
+      or ($5::timestamptz is null and seq = (
+        select min(seq) from x_notify_digests
+        where recipient = $1 and notifier = $2 and channel = $3 and group_key = $4
+      ))
+    )
+  returning seq, ends_at, events
+)
+select events from taken order by ends_at, seq
+`;
+
+/**
+ * The retention sweep's one statement: windows that CLOSED before `$1`, oldest first, at most `$2`
+ * of them. A window is deleted by its own flush's drain or by the next window's drain of the slot;
+ * this catches the one neither reaches — a flush that dead-lettered on a slot that never digests
+ * again. Bounded per statement, so one pass never holds a lock across the whole table.
+ */
+export const SQL_NOTIFY_DIGESTS_PURGE = `
+delete from x_notify_digests
+where seq in (
+  select seq from x_notify_digests where ends_at < $1 order by ends_at, seq limit $2
+)
+returning seq
+`;
+
+/**
+ * How long a CLOSED window is kept before the sweep may take it: a week. Longer than any retry
+ * schedule a notifier's flush runs on, so the sweep only ever takes a window whose flush is gone.
+ */
+export const DEFAULT_DIGEST_RETENTION_MS = 7 * 24 * 60 * 60 * 1000;
+/** Rows per delete statement. */
+export const DIGEST_PURGE_BATCH = 1000;
+/** Statements per pass: the hourly sweep goes on where this one stopped. */
+export const DIGEST_PURGE_MAX_BATCHES = 50;
+
+/** Each seal answers one elapsed window; more than this in one append is clocks that disagree. */
+const MAX_SEALS = 8;
+
+interface AppendRow {
+  readonly ends_at: Date | string;
+  readonly opened: boolean;
+}
+
+/** `at` round-trips through jsonb as an ISO string; the type promises a `Date`, so it is rebuilt. */
+interface StoredEvent extends Omit<NotifyEvent<unknown>, 'at'> {
+  readonly at: string;
+}
+
+interface DrainRow {
+  readonly events: readonly StoredEvent[];
+}
+
+const slotArgs = (slot: DigestSlot): readonly unknown[] => [
+  slot.recipient,
+  slot.notifier,
+  slot.channel,
+  slot.group,
+];
+
+const epochOf = (value: Date | string): number =>
+  (value instanceof Date ? value : new Date(value)).getTime();
+
+export interface PostgresDigestStoreOptions {
+  readonly executor: PgExecutor;
+  /** How long a closed window is kept. Defaults to `DEFAULT_DIGEST_RETENTION_MS`. */
+  readonly retentionMs?: number | undefined;
+}
+
+/**
+ * The Postgres store's own wider type, exactly as `PostgresDeliveryLedger` is: `purgeExpired` is not on
+ * `DigestStore`, because a heap map bounded by process life has nothing to delete and a new
+ * method on the seam breaks every app that wrote its own store.
+ */
+export interface PostgresDigestStore extends DigestStore {
+  readonly retentionMs: number;
+  /** Delete windows closed more than `retentionMs` before `nowMs` (the job's clock); answer how many. */
+  purgeExpired(nowMs: number): Promise<number>;
+}
+
+export function postgresDigestStore(options: PostgresDigestStoreOptions): PostgresDigestStore {
+  const { executor } = options;
+  const retentionMs = finiteCount(
+    'postgresDigestStore',
+    'retentionMs',
+    options.retentionMs ?? DEFAULT_DIGEST_RETENTION_MS,
+    1,
+  );
+  return {
+    retentionMs,
+    async purgeExpired(nowMs) {
+      // The JOB's clock, as the ledger's sweep: `ends_at` was computed from the appender's clock.
+      const before = new Date(finiteCount('purgeExpired', 'nowMs', nowMs, 0) - retentionMs);
+      let removed = 0;
+      for (let batch = 0; batch < DIGEST_PURGE_MAX_BATCHES; batch += 1) {
+        const rows = await executor.query<{ seq: number }>(SQL_NOTIFY_DIGESTS_PURGE, [
+          before,
+          DIGEST_PURGE_BATCH,
+        ]);
+        removed += rows.length;
+        if (rows.length < DIGEST_PURGE_BATCH) break;
+      }
+      return removed;
+    },
+    async append(input) {
+      const slot = slotArgs(input.slot);
+      const now = input.now;
+      const events = JSON.stringify([input.event]);
+      const endsAt = new Date(now.getTime() + input.windowMs);
+      for (let seals = 0; seals <= MAX_SEALS; seals += 1) {
+        const [row] = await executor.query<AppendRow>(SQL_NOTIFY_DIGEST_APPEND, [
+          ...slot,
+          events,
+          endsAt,
+          now,
+          input.appender,
+        ]);
+        if (row !== undefined) return { opened: row.opened, endsAt: epochOf(row.ends_at) };
+        // No row: the open window elapsed, or this appender's own twin committed it first. The seal
+        // is a no-op on a window still open, and either way the next pass answers from `prior`.
+        await executor.query(SQL_NOTIFY_DIGEST_SEAL, [...slot, now]);
+      }
+      // Reached only when every retry met a window that ANOTHER appender had just opened and that
+      // had already elapsed by this process's clock — two replicas a whole window apart in time.
+      throw new UltimateError({
+        code: 'X_INVARIANT',
+        cause: `the digest window for notifier "${input.slot.notifier}" kept closing before this append could join it (${String(MAX_SEALS)} seals): its ${String(input.windowMs)} ms window is shorter than one append's round trip, or two replicas' clocks are a whole window apart`,
+        fix: 'psql "$DATABASE_URL" -c "select notifier, recipient, ends_at, sealed, now() from x_notify_digests order by ends_at desc limit 10"',
+        meta: { notifier: input.slot.notifier, seals: MAX_SEALS },
+      });
+    },
+    async drain(slot, endsAt) {
+      const rows = await executor.query<DrainRow>(SQL_NOTIFY_DIGEST_DRAIN, [
+        ...slotArgs(slot),
+        endsAt === undefined ? null : new Date(endsAt),
+      ]);
+      return rows.flatMap((row) =>
+        row.events.map((event) => ({ ...event, at: new Date(event.at) })),
+      );
+    },
+  };
+}

package/src/digest.ts

@@ -26,6 +26,13 @@ export interface DigestAppend {
   readonly event: NotifyEvent<unknown>;
   readonly windowMs: number;
   readonly now: Date;
+  /**
+   * Who is appending: the fan-out passes its job's `runId` and the recipient, which a retry keeps.
+   * The append runs inside a step that re-runs WHOLE when any append in it fails, so an appender
+   * that already landed must get the SAME answer back and add nothing — a replay that read
+   * `opened: false` left a window nobody owned, and so nobody ever drained.
+   */
+  readonly appender: string;
 }
 
 export interface DigestBucket {
@@ -65,6 +72,8 @@ const slotKey = (slot: DigestSlot): string =>
 interface OpenBucket {
   endsAt: number;
   readonly events: NotifyEvent<unknown>[];
+  /** Every appender this window took, opener first — what makes a replayed append a no-op. */
+  readonly appenders: string[];
 }
 
 export interface MemoryDigestStore extends DigestStore {
@@ -78,7 +87,7 @@ export interface MemoryDigestStore extends DigestStore {
  * event the earlier window held. A closed window is now sealed under its `endsAt`, and a later
  * append opens the next one beside it.
  */
-export function createMemoryDigestStore(): MemoryDigestStore {
+export function memoryDigestStore(): MemoryDigestStore {
   const slots = new Map<string, OpenBucket[]>();
   return {
     get open(): number {
@@ -90,15 +99,24 @@ export function createMemoryDigestStore(): MemoryDigestStore {
       const id = slotKey(input.slot);
       const at = input.now.getTime();
       const windows = slots.get(id) ?? [];
+      // A replay answers the window it already landed in, sealed or not, and adds nothing.
+      const prior = windows.find((window) => window.appenders.includes(input.appender));
+      if (prior !== undefined) {
+        return Promise.resolve({
+          opened: prior.appenders[0] === input.appender,
+          endsAt: prior.endsAt,
+        });
+      }
       const newest = windows.at(-1);
       // An elapsed window is SEALED — its flush drains it — and never appended to: the event
       // opens the next window, which is one extra delivery rather than a lost one.
       if (newest !== undefined && newest.endsAt > at) {
         newest.events.push(input.event);
+        newest.appenders.push(input.appender);
         return Promise.resolve({ opened: false, endsAt: newest.endsAt });
       }
       const endsAt = at + input.windowMs;
-      windows.push({ endsAt, events: [input.event] });
+      windows.push({ endsAt, events: [input.event], appenders: [input.appender] });
       slots.set(id, windows);
       return Promise.resolve({ opened: true, endsAt });
     },

package/src/errors.ts

@@ -96,7 +96,7 @@ export class NotifyChannelDuplicateError extends UltimateError {
     super({
       code: 'X_NOTIFY_CHANNEL_DUPLICATE',
       cause: `notifier "${input.notifier}" declares the channel "${input.channel}" twice, and the delivery ledger keys on it — the second would be deduped away`,
-      fix: `give the second channel its own name on notifier("${input.notifier}") — channel('${input.channel}-digest', …) — or merge the two deliver entries`,
+      fix: `give the second channel its own name on notifier("${input.notifier}") — deliveryChannel('${input.channel}-digest', …) — or merge the two deliver entries`,
       meta: { notifier: input.notifier, channel: input.channel },
     });
   }
@@ -122,7 +122,7 @@ export class NotifyFanoutTooWideError extends UltimateError {
  * A channel or a window asked for a store nothing installed.
  *
  * The delivery ledger is deliberately NOT one of these: it has a correct-for-one-process default
- * (`createMemoryDeliveryLedger`), the way every other driver seam in this framework does. An inbox
+ * (`memoryDeliveryLedger`), the way every other driver seam in this framework does. An inbox
  * and a digest window have no such default — there is nowhere to put the row — so they refuse.
  */
 export class NotifyStoreMissingError extends UltimateError {
@@ -131,8 +131,8 @@ export class NotifyStoreMissingError extends UltimateError {
       input.store === 'inbox' ? 'a channel that writes the in-app inbox' : 'a digest window';
     const install =
       input.store === 'inbox'
-        ? 'createMemoryInboxStore() }) at boot, or createPgInboxStore({ executor }) to share it across replicas'
-        : 'createMemoryDigestStore() }) at boot';
+        ? 'memoryInboxStore() }) at boot, or postgresInboxStore({ executor }) to share it across replicas'
+        : 'memoryDigestStore() }) at boot';
     super({
       code: 'X_NOTIFY_STORE_MISSING',
       cause: `notifier "${input.notifier}" delivers through ${what} and no ${input.store} store is installed, so the rows have nowhere to go`,
@@ -152,7 +152,7 @@ export class NotifyDigestUnsupportedError extends UltimateError {
     super({
       code: 'X_NOTIFY_DIGEST_UNSUPPORTED',
       cause: `notifier "${input.notifier}" declares a digest window on the bulk channel "${input.channel}", and a window coalesces per recipient where a bulk send has none`,
-      fix: `drop digest from the "${input.channel}" entry on notifier("${input.notifier}") and give it a wait instead, or deliver it through channel('${input.channel}', …) one recipient at a time`,
+      fix: `drop digest from the "${input.channel}" entry on notifier("${input.notifier}") and give it a wait instead, or deliver it through deliveryChannel('${input.channel}', …) one recipient at a time`,
       meta: { notifier: input.notifier, channel: input.channel },
     });
   }

package/src/fanout-digest.ts

@@ -21,7 +21,7 @@ export interface DigestFlush<Params> {
 
 export async function flushDigest<Params>(input: DigestFlush<Params>): Promise<void> {
   const { walk, channel, delivery, allowed } = input;
-  const { plan, event, ctx, step, tally } = walk;
+  const { plan, event, ctx, runId, step, tally } = walk;
   const windowMs = delivery.digestMs ?? 0;
   const digest = requireDigest(plan.name);
   const group = delivery.group?.(event) ?? plan.name;
@@ -32,26 +32,33 @@ export async function flushDigest<Params>(input: DigestFlush<Params>): Promise<v
     group,
   });
 
-  // One step for the whole append pass: appending is what a replayed attempt must NOT redo, or the
-  // same event lands in the digest twice.
-  const opened = await step.run(`digest:${channel.name}`, async () => {
-    // Each owner's OWN window end: two recipients' windows need not close together, and the
-    // drain takes the window it names.
-    const owned: { readonly id: string; readonly endsAt: number }[] = [];
-    let endsAt = 0;
-    for (const recipient of allowed) {
-      const bucket = await digest.append({
+  // ONE STEP PER APPEND, and the step store is the fence: a completed append is never redone, so
+  // the same event never lands in a digest twice. One step for the whole pass re-ran every append
+  // when any one failed, and the window a re-run append had joined may already have been drained
+  // and deleted by its owner — nothing in the store remembered it, so the event went out again in
+  // a second digest. The appender id is the store's own defence behind the step: an append whose
+  // write committed but whose answer was lost, or a run whose step history is gone, gets back the
+  // window it already landed in — `opened` included — for as long as that window exists.
+  // Each owner's OWN window end: two recipients' windows need not close together, and the drain
+  // takes the window it names.
+  const opened: { owned: { readonly id: string; readonly endsAt: number }[]; endsAt: number } = {
+    owned: [],
+    endsAt: 0,
+  };
+  for (const recipient of allowed) {
+    const bucket = await step.run(`digest:${channel.name}:${recipient.id}`, () =>
+      digest.append({
         slot: slotFor(recipient.id),
         event,
         windowMs,
         now: ctx.now(),
-      });
-      if (!bucket.opened) continue;
-      owned.push({ id: recipient.id, endsAt: bucket.endsAt });
-      endsAt = Math.max(endsAt, bucket.endsAt);
-    }
-    return { owned, endsAt };
-  });
+        appender: `${runId}:${recipient.id}`,
+      }),
+    );
+    if (!bucket.opened) continue;
+    opened.owned.push({ id: recipient.id, endsAt: bucket.endsAt });
+    opened.endsAt = Math.max(opened.endsAt, bucket.endsAt);
+  }
 
   tally.digested += allowed.length - opened.owned.length;
   if (opened.owned.length === 0) return;

package/src/fanout-walk.ts

@@ -21,6 +21,8 @@ export interface Walk<Params> {
   readonly event: NotifyEvent<Params>;
   readonly audience: readonly Recipient[];
   readonly ctx: Ctx;
+  /** The job run's id, which every retry of it keeps — what names this run's digest appends. */
+  readonly runId: string;
   readonly step: StepApi;
   readonly tally: Tally;
 }

package/src/fanout.ts

@@ -22,7 +22,7 @@ export async function runFanout<Params>(
   plan: NotifyPlan<Params>,
   args: JobRunArgs<NotifyPayload<Params>>,
 ): Promise<NotifyReport> {
-  const { input, step, ctx } = args;
+  const { input, step, ctx, runId } = args;
   // One step for BOTH facts, because both must survive a replay: a re-resolved audience would
   // deliver to whoever subscribed during the wait, and a re-read clock would write a different
   // `at` into the inbox on every attempt. Epoch ms rather than a `Date` — a step's return value
@@ -31,7 +31,9 @@ export async function runFanout<Params>(
     at: ctx.now().getTime(),
     recipients: input.recipients ?? [...(await plan.recipientsFor({ input: input.params, ctx }))],
   }));
-  const audience = open.recipients;
+  // Deduplicated on the way OUT of the step rather than inside it, so an `open` checkpointed by an
+  // earlier version — duplicates and all — is repaired on replay too, not only a fresh resolve.
+  const audience = uniqueById(open.recipients);
   if (audience.length > plan.maxRecipients) {
     throw new NotifyFanoutTooWideError({
       notifier: plan.name,
@@ -47,7 +49,7 @@ export async function runFanout<Params>(
     at: new Date(open.at),
   };
   const tally: Tally = { delivered: 0, suppressed: 0, skipped: 0, replayed: 0, digested: 0 };
-  const walk: Walk<Params> = { plan, event, audience, ctx, step, tally };
+  const walk: Walk<Params> = { plan, event, audience, ctx, runId, step, tally };
 
   // `deliveries` is sorted by `waitMs`, so this sleeps the DELTA and never the sum: an in-app
   // channel with no wait fires now even when the email beside it waits an hour.
@@ -62,6 +64,21 @@ export async function runFanout<Params>(
   return { recipients: audience.length, ...tally };
 }
 
+/**
+ * One entry per recipient id, the FIRST kept. Every per-recipient step is named by the id, so a
+ * repeated id was `X_STEP_DUPLICATE` on its second delivery — the fan-out failed part-way, the
+ * recipients after it were never notified, and every retry failed at the same place. One person
+ * named twice by a resolver is still one person, and gets one delivery per channel.
+ */
+function uniqueById(recipients: readonly Recipient[]): Recipient[] {
+  const seen = new Set<string>();
+  return recipients.filter((recipient) => {
+    if (seen.has(recipient.id)) return false;
+    seen.add(recipient.id);
+    return true;
+  });
+}
+
 async function deliverOne<Params>(
   walk: Walk<Params>,
   delivery: ResolvedDelivery<Params>,

package/src/inbox-pg.ts

@@ -1,8 +1,8 @@
 // The shared in-app inbox: one Postgres table, applied by the boot the way `x_jobs` is.
 // Statements are spelled out so an agent can run the exact one it saw in a log.
 
-import { finiteCount, isUuid, uuid } from '@ultimat3/core';
-import type { PgExecutor } from '@ultimat3/jobs';
+import type { PgExecutor } from '@ultimat3/core';
+import { finiteCount, isUuid, uuidV7 } from '@ultimat3/core';
 import type { InboxRow, InboxStore, InboxWrite } from './inbox';
 import { DEFAULT_INBOX_PAGE } from './inbox';
 
@@ -59,7 +59,7 @@ where recipient = $2 and notifier = $3 and key = $4
  * `unique (recipient, notifier, key)`, so the order is total and a bounded page cannot drop or
  * repeat a row when two notifications land in the same millisecond.
  *
- * `collate "C"` and not the column's collation: `createMemoryInboxStore` compares the same two
+ * `collate "C"` and not the column's collation: `memoryInboxStore` compares the same two
  * columns by CODE POINT, and a database initialised under an ICU or a `en_US.UTF-8` collation
  * orders text by locale rules — case-insensitively, ignoring punctuation at the first level — so
  * the two stores would disagree on exactly the Unicode keys nobody writes a test for. `id` was the
@@ -130,7 +130,7 @@ const toRow = (row: InboxDbRow): InboxRow => ({
   readAt: row.read_at === null ? null : asDate(row.read_at),
 });
 
-export interface PgInboxStoreOptions {
+export interface PostgresInboxStoreOptions {
   readonly executor: PgExecutor;
   /**
    * Ids for new rows. A `random = Math.random` default parameter is this repo's injectable seam
@@ -153,16 +153,16 @@ export interface InboxPurgeBefore {
 
 /**
  * The Postgres inbox's own wider type. `purgeBefore` is HERE and not on `InboxStore` for the
- * reason `PgDeliveryLedger.purgeExpired` is not on `DeliveryLedger`: adding a method to the seam
+ * reason `PostgresDeliveryLedger.purgeExpired` is not on `DeliveryLedger`: adding a method to the seam
  * every implementation must satisfy is a breaking change for an app that wrote its own.
  */
-export interface PgInboxStore extends InboxStore {
+export interface PostgresInboxStore extends InboxStore {
   purgeBefore(before: InboxPurgeBefore): Promise<number>;
 }
 
-export function createPgInboxStore(options: PgInboxStoreOptions): PgInboxStore {
+export function postgresInboxStore(options: PostgresInboxStoreOptions): PostgresInboxStore {
   const { executor } = options;
-  const newId = options.newId ?? uuid;
+  const newId = options.newId ?? uuidV7;
   return {
     async add(write: InboxWrite) {
       const rows = await executor.query<InboxDbRow>(SQL_NOTIFY_INBOX_ADD, [
@@ -184,7 +184,7 @@ export function createPgInboxStore(options: PgInboxStoreOptions): PgInboxStore {
       // what a driver does with a `NaN` parameter is the driver's business — the memory store beside
       // it answered `[]` for the same input. `??` cannot see it, because `NaN` is not nullish.
       const limit = finiteCount(
-        'createPgInboxStore',
+        'postgresInboxStore',
         'limit',
         query.limit ?? DEFAULT_INBOX_PAGE,
         0,

package/src/inbox.ts

@@ -69,8 +69,8 @@ const compareText = (a: string, b: string): number => {
  * The tail key both stores order on: `(notifier, key)`, which is unique within a recipient because
  * `add` is idempotent on `(recipient, notifier, key)` and the Postgres table declares that UNIQUE.
  *
- * `id` cannot be it, and that is the whole reason this exists. `createPgInboxStore` mints a UUIDv7
- * and Postgres orders `uuid` by its 16 BYTES; `createMemoryInboxStore` derives its id from
+ * `id` cannot be it, and that is the whole reason this exists. `postgresInboxStore` mints a UUIDv7
+ * and Postgres orders `uuid` by its 16 BYTES; `memoryInboxStore` derives its id from
  * `JSON.stringify([recipient, notifier, key])` and orders it by code point. Two total orders that
  * agree on nothing — so two notifications written in one millisecond came back in one order in dev
  * and the other in production, and a bounded page dropped one and repeated the other on exactly the
@@ -88,7 +88,7 @@ const idOf = (write: { recipient: string; notifier: string; key: string }): stri
  * memory ledger — a ledger that forgets a row starts sending duplicates, where an inbox that
  * forgets one just loses a message nobody was going to read after the restart anyway.
  */
-export function createMemoryInboxStore(): MemoryInboxStore {
+export function memoryInboxStore(): MemoryInboxStore {
   const rows = new Map<string, InboxRow>();
 
   // `(createdAt desc, notifier, key)` — the same TOTAL order `SQL_NOTIFY_INBOX_PAGE` takes, and
@@ -122,18 +122,13 @@ export function createMemoryInboxStore(): MemoryInboxStore {
       return Promise.resolve(row);
     },
     // `async` and not `Promise.resolve`, so a refused `limit` REJECTS here exactly as it does in
-    // `createPgInboxStore`: two drivers behind one interface must not answer one question two ways,
+    // `postgresInboxStore`: two drivers behind one interface must not answer one question two ways,
     // and a sync throw against a rejected promise is a difference a caller can see.
     async list(query) {
       // `slice(0, NaN)` is `[]` — an empty inbox reported as the whole of it — and
       // `slice(0, Infinity)` is every row the recipient ever received, which is the unbounded read
       // `limit`'s own doc forbids. `??` reaches neither: `NaN` is not nullish.
-      const limit = finiteCount(
-        'createMemoryInboxStore',
-        'limit',
-        query.limit ?? DEFAULT_INBOX_PAGE,
-        0,
-      );
+      const limit = finiteCount('memoryInboxStore', 'limit', query.limit ?? DEFAULT_INBOX_PAGE, 0);
       return own(query.recipient)
         .filter((row) => query.unreadOnly !== true || row.readAt === null)
         .slice(0, limit);

package/src/index.ts

@@ -16,7 +16,7 @@ export type {
   DeliveryArgs,
   NotifyChannel,
 } from './channel';
-export { bulkChannel, channel, isBulkChannel } from './channel';
+export { bulkChannel, deliveryChannel, isBulkChannel } from './channel';
 export type { InAppChannelOptions } from './channel-in-app';
 export { IN_APP_CHANNEL, inAppChannel } from './channel-in-app';
 export type { MailChannelOptions, Mailer, NotifyMail } from './channel-mail';
@@ -28,7 +28,13 @@ export type {
   DigestStore,
   MemoryDigestStore,
 } from './digest';
-export { createMemoryDigestStore } from './digest';
+export { memoryDigestStore } from './digest';
+export type { PostgresDigestStore, PostgresDigestStoreOptions } from './digest-pg';
+export {
+  DEFAULT_DIGEST_RETENTION_MS,
+  postgresDigestStore,
+  SQL_NOTIFY_DIGESTS_TABLE,
+} from './digest-pg';
 export type { NotifyErrorCode } from './errors';
 export {
   NOTIFY_ERROR_CODES,
@@ -43,12 +49,10 @@ export {
 // @ultimat3/jobs: a second way to execute a fan-out would bypass the job the factory built, and
 // with it the retry policy, the cancellation and the manifest row.
 export type { InboxQuery, InboxRow, InboxStore, InboxWrite, MemoryInboxStore } from './inbox';
-export { createMemoryInboxStore, DEFAULT_INBOX_PAGE } from './inbox';
-export type { InboxPurgeBefore, PgInboxStore, PgInboxStoreOptions } from './inbox-pg';
+export { DEFAULT_INBOX_PAGE, memoryInboxStore } from './inbox';
+export type { InboxPurgeBefore, PostgresInboxStore, PostgresInboxStoreOptions } from './inbox-pg';
 export {
-  createPgInboxStore,
-  SQL_NOTIFY_INBOX_MARK_READ,
-  SQL_NOTIFY_INBOX_PAGE,
+  postgresInboxStore,
   SQL_NOTIFY_INBOX_TABLE,
 } from './inbox-pg';
 export type {
@@ -57,17 +61,16 @@ export type {
   DeliveryRecord,
   DeliveryStatus,
   MemoryDeliveryLedger,
-  MemoryLedgerOptions,
+  MemoryDeliveryLedgerOptions,
 } from './ledger';
 export {
-  createMemoryDeliveryLedger,
   DELIVERY_STATUSES,
   isDeliveryStatus,
+  memoryDeliveryLedger,
 } from './ledger';
-export type { PgDeliveryLedger, PgDeliveryLedgerOptions } from './ledger-pg';
+export type { PostgresDeliveryLedger, PostgresDeliveryLedgerOptions } from './ledger-pg';
 export {
-  createPgDeliveryLedger,
-  SQL_NOTIFY_CLAIM,
+  postgresDeliveryLedger,
   SQL_NOTIFY_DELIVERIES_TABLE,
 } from './ledger-pg';
 export type { NotifyEvent, Recipient } from './notification';
@@ -87,8 +90,8 @@ export type {
 } from './plan';
 export { toDurationMs } from './plan';
 export type { MemoryPreferenceStore, PreferenceQuery, PreferenceStore } from './preferences';
-export { allowAllPreferences, createMemoryPreferenceStore } from './preferences';
-export { purgeNotifyDeliveries, purgeNotifyInbox } from './retention';
+export { allowAllPreferences, memoryPreferenceStore } from './preferences';
+export { purgeNotifyDeliveries, purgeNotifyDigests, purgeNotifyInbox } from './retention';
 export type { InstalledNotifyStores, NotifyStores } from './stores';
 export {
   notifyStores,

package/src/ledger-pg.ts

@@ -4,8 +4,8 @@
 //
 // Statements are spelled out so an agent can run the exact one it saw in a log.
 
+import type { PgExecutor } from '@ultimat3/core';
 import { finiteCount } from '@ultimat3/core';
-import type { PgExecutor } from '@ultimat3/jobs';
 import type { DeliveryClaim, DeliveryLedger, DeliveryRecord, DeliveryStatus } from './ledger';
 import { isDeliveryStatus } from './ledger';
 
@@ -102,14 +102,14 @@ delete from x_notify_deliveries where at < $1
  */
 const SQL_NOTIFY_DELIVERIES_PURGE_COUNTED = `${SQL_NOTIFY_DELIVERIES_PURGE} returning key`;
 
-export interface PgDeliveryLedgerOptions {
+export interface PostgresDeliveryLedgerOptions {
   readonly executor: PgExecutor;
   /**
    * How long a settled claim is kept. Defaults to `DEFAULT_DELIVERY_WINDOW_MS`.
    *
    * NEVER SHORTER THAN YOUR IDEMPOTENCY WINDOW, and this is the one dangerous direction: a job
    * replayed inside the idempotency window, against a delivery claim that has already been
-   * purged, claims cleanly and sends the notification a second time. `createPgDeliveryLedger({
+   * purged, claims cleanly and sends the notification a second time. `postgresDeliveryLedger({
    * executor, windowMs: idempotency.windowMs })` makes that impossible by construction rather
    * than by two defaults that happen to agree.
    */
@@ -125,15 +125,17 @@ export const DEFAULT_DELIVERY_WINDOW_MS = 24 * 60 * 60 * 1000;
  * seam every implementation must satisfy is a breaking change for an app that wrote its own.
  * Exactly the shape `PostgresIdempotencyStore` already has.
  */
-export interface PgDeliveryLedger extends DeliveryLedger {
+export interface PostgresDeliveryLedger extends DeliveryLedger {
   readonly windowMs: number;
   purgeExpired(nowMs: number): Promise<number>;
 }
 
-export function createPgDeliveryLedger(options: PgDeliveryLedgerOptions): PgDeliveryLedger {
+export function postgresDeliveryLedger(
+  options: PostgresDeliveryLedgerOptions,
+): PostgresDeliveryLedger {
   const { executor } = options;
   const windowMs = finiteCount(
-    'createPgDeliveryLedger',
+    'postgresDeliveryLedger',
     'windowMs',
     options.windowMs ?? DEFAULT_DELIVERY_WINDOW_MS,
     1,

package/src/ledger.ts

@@ -62,7 +62,7 @@ export interface DeliveryLedger {
 const keyOf = (claim: DeliveryClaim): string =>
   JSON.stringify([claim.notifier, claim.key, claim.recipient, claim.channel]);
 
-export interface MemoryLedgerOptions {
+export interface MemoryDeliveryLedgerOptions {
   /**
    * Rows kept before the oldest is evicted. A process-local ledger is a DEV ledger — it forgets
    * on restart and it is private to one replica — so it is bounded rather than allowed to grow
@@ -82,11 +82,11 @@ export interface MemoryDeliveryLedger extends DeliveryLedger {
 
 /**
  * The default, and honest about what it is: one process, no durability. Installed by a test and by
- * `x dev`; a deployment with more than one replica needs `createPgDeliveryLedger`, because a claim
+ * `x dev`; a deployment with more than one replica needs `postgresDeliveryLedger`, because a claim
  * this replica took is invisible to the one that replays the job.
  */
-export function createMemoryDeliveryLedger(
-  options: MemoryLedgerOptions = {},
+export function memoryDeliveryLedger(
+  options: MemoryDeliveryLedgerOptions = {},
 ): MemoryDeliveryLedger {
   // `while (rows.size > max)` is the eviction, so a `max` that is not a number is not a large cap
   // — it is no cap, and this ledger grows into the heap of a process that was told it was bounded.
@@ -94,7 +94,7 @@ export function createMemoryDeliveryLedger(
   // here intact. A floor of 1 because a ledger that keeps zero rows cannot refuse a replay, which
   // is its one job, and it fails at it silently.
   const max = finiteCount(
-    'createMemoryDeliveryLedger',
+    'memoryDeliveryLedger',
     'max',
     options.max ?? DEFAULT_MAX_DELIVERY_RECORDS,
     1,

package/src/preferences.ts

@@ -52,7 +52,7 @@ const optOutKey = (recipient: string, notifier: string, channel: string): string
  * A test double and a dev store, not a product. Real preferences live in the app's own table
  * beside the taxonomy that names them; this exists so the gate can be exercised without one.
  */
-export function createMemoryPreferenceStore(): MemoryPreferenceStore {
+export function memoryPreferenceStore(): MemoryPreferenceStore {
   const denied = new Set<string>();
   return {
     allows(query) {

package/src/retention.ts

@@ -1,16 +1,17 @@
-// The two sweeps over this package's tables, read off the installed seam rather than off a store
+// The three sweeps over this package's tables, read off the installed seam rather than off a store
 // somebody handed the caller. `setNotifyStores` is an APP's boot line and runs after the boot that
 // owns the hourly sweep, so the sweep cannot hold the stores — it can only ask, per attempt, what
 // is installed now. Same shape and the same reason as `purgeAuthLimits()`.
 
-import type { InboxPurgeBefore, PgInboxStore } from './inbox-pg';
-import type { PgDeliveryLedger } from './ledger-pg';
+import type { PostgresDigestStore } from './digest-pg';
+import type { InboxPurgeBefore, PostgresInboxStore } from './inbox-pg';
+import type { PostgresDeliveryLedger } from './ledger-pg';
 import { notifyStores } from './stores';
 
 /**
  * Whether the installed store can delete by age at all.
  *
- * A DECLARED capability check, never duck typing: `PgInboxStore` and `PgDeliveryLedger` widen the
+ * A DECLARED capability check, never duck typing: `PostgresInboxStore` and `PostgresDeliveryLedger` widen the
  * seam their memory siblings satisfy, so "has this method" is exactly "is this the Postgres one".
  * The memory stores deliberately have none — a heap map is bounded by process life, and adding the
  * method to `InboxStore`/`DeliveryLedger` would break every app that wrote its own implementation.
@@ -30,13 +31,13 @@ const purgeable = <T>(store: unknown, method: string): store is T =>
  */
 export async function purgeNotifyInbox(before: InboxPurgeBefore): Promise<number> {
   const store = notifyStores().inbox;
-  if (!purgeable<PgInboxStore>(store, 'purgeBefore')) return 0;
+  if (!purgeable<PostgresInboxStore>(store, 'purgeBefore')) return 0;
   return store.purgeBefore(before);
 }
 
 /**
  * Delete delivery claims past the ledger's own window, and answer how many. The window is the
- * LEDGER's, never this caller's: `createPgDeliveryLedger({ windowMs })` is where an app states it,
+ * LEDGER's, never this caller's: `postgresDeliveryLedger({ windowMs })` is where an app states it,
  * beside the statement that reads it, so there is one number rather than two that can disagree.
  *
  * `nowMs` is the job's clock for the reason `x_rate_limit`'s target states — `at` is written by
@@ -45,6 +46,17 @@ export async function purgeNotifyInbox(before: InboxPurgeBefore): Promise<number
  */
 export async function purgeNotifyDeliveries(nowMs: number): Promise<number> {
   const ledger = notifyStores().ledger;
-  if (!purgeable<PgDeliveryLedger>(ledger, 'purgeExpired')) return 0;
+  if (!purgeable<PostgresDeliveryLedger>(ledger, 'purgeExpired')) return 0;
   return ledger.purgeExpired(nowMs);
 }
+
+/**
+ * Delete digest windows closed longer ago than the store's own `retentionMs`, and answer how many.
+ * A window is normally deleted by a drain; this takes the one whose flush dead-lettered on a slot
+ * that never digests again. Zero for no store or a memory one, for the reason above.
+ */
+export async function purgeNotifyDigests(nowMs: number): Promise<number> {
+  const digest = notifyStores().digest;
+  if (!purgeable<PostgresDigestStore>(digest, 'purgeExpired')) return 0;
+  return digest.purgeExpired(nowMs);
+}

package/src/stores.ts

@@ -9,13 +9,13 @@ import type { DigestStore } from './digest';
 import { NotifyStoreMissingError } from './errors';
 import type { InboxStore } from './inbox';
 import type { DeliveryLedger } from './ledger';
-import { createMemoryDeliveryLedger } from './ledger';
+import { memoryDeliveryLedger } from './ledger';
 import type { PreferenceStore } from './preferences';
 import { allowAllPreferences } from './preferences';
 
 export interface NotifyStores {
   /**
-   * Defaults to `createMemoryDeliveryLedger()`. A default is correct here and nowhere else in this
+   * Defaults to `memoryDeliveryLedger()`. A default is correct here and nowhere else in this
    * interface: one process with one replica is genuinely deduped by a heap map, and the failure
    * mode of having none at all — a replayed attempt sending twice — is worse than the failure mode
    * of a dev default, which is a second send only after a restart.
@@ -39,7 +39,7 @@ export interface InstalledNotifyStores {
 }
 
 const defaults = (): InstalledNotifyStores => ({
-  ledger: createMemoryDeliveryLedger(),
+  ledger: memoryDeliveryLedger(),
   inbox: undefined,
   preferences: allowAllPreferences(),
   digest: undefined,
@@ -51,7 +51,7 @@ let installed: InstalledNotifyStores = defaults();
  * `RuntimeOverrides` exists to refuse, and a merge would hide the second call's omissions. */
 export function setNotifyStores(stores: NotifyStores): void {
   installed = {
-    ledger: stores.ledger ?? createMemoryDeliveryLedger(),
+    ledger: stores.ledger ?? memoryDeliveryLedger(),
     inbox: stores.inbox,
     preferences: stores.preferences ?? allowAllPreferences(),
     digest: stores.digest,