experimental-a2 0.19.0 → 0.21.1

package/src/store-postgres.ts

@@ -10,16 +10,34 @@
  *
  * Semantics mirror the sqlite backend: `index` is stored as `idx`,
  * timestamps are epoch milliseconds written from the injected clock —
- * never SQL `now()`. Streams poll by default; an optional direct
- * connection enables LISTEN/NOTIFY for events and presence. Appends serialize per session via
+ * never SQL `now()`, and dispatch state lives on consumer cursors, not on
+ * events. Streams poll by default; an optional direct connection enables
+ * LISTEN/NOTIFY for events and presence. Appends serialize per session via
  * `pg_advisory_xact_lock`, so concurrent writers can't race the index
- * assignment.
+ * assignment, and each runs in one round trip (`a2_batch`, below), so the
+ * lock is held only while the server runs it.
+ *
+ * Lock discipline. Completions lock their cursor first, then the session lock
+ * when they append, or when their cursor goes idle (`completeAttempt`);
+ * everything else that takes the session lock takes it first. Every
+ * operation that locks a cursor row locks it only in the exact state it acts
+ * on (a head, an attempt). Under the session lock, an append never writes a
+ * cursor row that exists: a lane or log cursor's runs are rows keyed by the
+ * head each run started at (its epoch), so starting an idle cursor inserts a
+ * new run and retires the idle row with `skip locked`. An append therefore
+ * never waits on a cursor row, in particular not on one a completion waiting
+ * for the session lock holds, or one a clear left behind.
  */
 
 import { A2Error, supersededAttemptError } from './errors.ts'
 import { idempotentReplay } from './idempotent-replay.ts'
 import { CLEAR_EVENT_TYPE, sessionClearedError } from './session-clear.ts'
-import { decodeReturnedEventIds } from './store-codec.ts'
+import {
+  cursorKeyOf,
+  decodeCause,
+  decodeReturnedEventIds,
+  idleLogCursor,
+} from './store-codec.ts'
 import { pollingStream, defaultSleep, type Sleeper } from './store-polling.ts'
 import { NOTIFY_TIMINGS, nullProtoRecord } from './internal.ts'
 import type { PresencePatch } from './contract.ts'
@@ -27,9 +45,13 @@ import { pollPresence } from './store-presence-polling.ts'
 import {
   postgresNotifications,
   postgresNotificationChannel,
-  POSTGRES_NOTIFICATIONS_SQL,
   type PostgresListenerConnection,
 } from './postgres-notifications.ts'
+import {
+  checkPostgresTriggers,
+  explainingPostgresClient,
+  explainPostgresError,
+} from './postgres-schema.ts'
 import { retryableLazy } from './retryable-lazy.ts'
 import { postgresNotificationScope } from './postgres-notification-scope.ts'
 import { postgresPoolClient } from './postgres-pool.ts'
@@ -43,10 +65,18 @@ import {
   RANDOM_IDS,
   SYSTEM_CLOCK,
   type A2Store,
+  type AppendEvent,
   type Clock,
+  type CompleteAttemptResult,
   type Event,
   type EventCause,
+  type HeadDispatch,
+  type HeadEvent,
+  type HeadRef,
   type IdSource,
+  type ReturnedEvent,
+  type StoreConsumer,
+  type StoredCursor,
   type StoredEvent,
   type StoreStateReadRequest,
   type StoreStateRead,
@@ -92,93 +122,11 @@ export type PostgresStore = A2Store & {
   close(): Promise<void>
 }
 
-const SCHEMA = `
-create table if not exists a2_events (
-  session_id   text    not null,
-  idx          bigint  not null,
-  event_type   text    not null,
-  payload      jsonb   not null,
-  event_id     text    not null,
-  created_at   bigint  not null,
-  cause        jsonb,
-  lane         text,
-  lane_ready   boolean not null default false,
-  processed_at bigint,
-  processed_by_attempt integer,
-  returned_event_ids jsonb,
-  first_claimed_at bigint,
-  last_claimed_at bigint,
-  attempt_count integer not null default 0,
-  failure_count integer not null default 0,
-  last_failed_at bigint,
-  last_failed_attempt integer,
-  last_error   text,
-  failed_at    bigint,
-  claim_holder text,
-  claim_expires_at bigint,
-  primary key (session_id, idx)
-);
-
-create unique index if not exists a2_events_event_id on a2_events (event_id);
-create index if not exists a2_events_unprocessed
-  on a2_events (session_id, idx) where processed_at is null;
-create index if not exists a2_events_lane_pending
-  on a2_events (session_id, lane, idx) where processed_at is null;
-create index if not exists a2_events_dispatch_ready
-  on a2_events (session_id, idx)
-  where lane_ready and processed_at is null and failed_at is null;
-create index if not exists a2_events_claim_expiry
-  on a2_events (session_id, claim_expires_at)
-  where lane_ready and processed_at is null and failed_at is null;
-
-create table if not exists a2_snapshots (
-  session_id   text   not null,
-  reducer_name text   not null,
-  up_to_index  bigint not null,
-  state        jsonb  not null,
-  updated_at   bigint not null,
-  primary key (session_id, reducer_name)
-);
-
-create table if not exists a2_snapshot_history (
-  session_id   text   not null,
-  reducer_name text   not null,
-  up_to_index  bigint not null,
-  state        jsonb  not null,
-  updated_at   bigint not null,
-  primary key (session_id, reducer_name, up_to_index)
-);
-
-create table if not exists a2_snapshot_pins (
-  session_id   text   not null,
-  event_index  bigint not null,
-  reducer_name text   not null,
-  up_to_index  bigint not null,
-  primary key (session_id, event_index, reducer_name, up_to_index)
-);
-
-create index if not exists a2_snapshot_pins_checkpoint
-  on a2_snapshot_pins (session_id, reducer_name, up_to_index);
-
-create table if not exists a2_clears (
-  session_id  text   primary key,
-  clear_index bigint not null
-);
-
-create table if not exists a2_presence (
-  ns          text   not null,
-  participant text   not null,
-  field       text   not null,
-  value       jsonb  not null,
-  seen        bigint not null,
-  at          bigint not null,
-  expires_at  bigint not null,
-  primary key (ns, participant, field)
-);
-`
-
 const asNumber = (value: unknown): number => Number(value) // bigint columns arrive as strings
 
+const asNullableNumber = (value: unknown): number | null =>
+  value === null || value === undefined ? null : asNumber(value)
+
 /**
  * The session's latest clear marker, or 0, as a primary-key subquery. Read
  * it in a statement that runs after the operation's lock: a statement's
@@ -188,86 +136,232 @@ const asNumber = (value: unknown): number => Number(value) // bigint columns arr
 const clearIndexOf = (session: string): string =>
   `coalesce((select clear_index from a2_clears where session_id = ${session}), 0)`
 
+/**
+ * Whether a served consumer has a cursor with a head in the session. A null
+ * `served` array serves every consumer.
+ */
+const pendingIn = (session: string, served: string): string =>
+  `exists(
+     select 1 from a2_cursors pending
+      where pending.session_id = ${session}
+        and pending.head > ${clearIndexOf(session)}
+        and pending.failed_at is null
+        and (${served}::text[] is null or pending.consumer = any(${served}::text[]))
+   )`
+
+/** A fresh head's dispatch columns, for `set` clauses. */
+const FRESH_DISPATCH = `
+  attempt_count = 0, first_claimed_at = null, last_claimed_at = null,
+  claim_holder = null, claim_expires_at = null, failure_count = 0,
+  last_failed_at = null, last_failed_attempt = null, last_error = null,
+  failed_at = null`
+
+/** The head event's columns a claim, dead letter, or listing joins in, prefixed `e_`. */
+const HEAD_COLUMNS = `
+  event.idx as e_idx, event.event_type as e_event_type,
+  event.payload as e_payload, event.event_id as e_event_id,
+  event.created_at as e_created_at, event.cause as e_cause`
+
 const RECLAIM_BATCH = 256
 
-const toDate = (ms: unknown): Date | null =>
-  ms === null || ms === undefined ? null : new Date(asNumber(ms))
+/**
+ * A cursor run reclaim deletes once the session is cleared through `$2`:
+ * one from before the clear, or one a later run of its cursor replaced. A
+ * log cursor's last run stays: it records that the consumer counts from the
+ * marker.
+ */
+const SUPERSEDED_CURSOR = `
+  cur.session_id = $1 and (
+    (cur.epoch < $2 and cur.kind <> 'log')
+    or ((cur.head is null or cur.head <= $2) and exists (
+      select 1 from a2_cursors later
+       where later.session_id = cur.session_id
+         and later.cursor_key = cur.cursor_key
+         and later.consumer = cur.consumer
+         and later.epoch > cur.epoch
+    ))
+  )`
 
-const toCause = (raw: unknown): EventCause | null => {
-  if (raw === null || raw === undefined) return null
-  const value = (typeof raw === 'string' ? JSON.parse(raw) : raw) as {
-    index?: unknown
-    attempt?: unknown
-    batchSize?: unknown
-  }
-  if (
-    !Number.isInteger(value.index) ||
-    Number(value.index) < 1 ||
-    !Number.isInteger(value.attempt) ||
-    Number(value.attempt) < 1
-  ) {
-    throw new TypeError('stored event has an invalid cause')
-  }
-  if (
-    value.batchSize !== undefined &&
-    (!Number.isInteger(value.batchSize) || Number(value.batchSize) < 1)
-  ) {
-    throw new TypeError('stored event has an invalid cause')
-  }
-  return {
-    index: Number(value.index),
-    attempt: Number(value.attempt),
-    ...(value.batchSize === undefined
-      ? {}
-      : { batchSize: Number(value.batchSize) }),
-  }
+/**
+ * A value of `a2_batch`'s one parameter, `$1`: a JSON object the store builds
+ * for each call. JSON null reads as SQL null.
+ */
+const param = {
+  text: (key: string): string => `($1->>'${key}')`,
+  bigint: (key: string): string => `($1->>'${key}')::bigint`,
+  int: (key: string): string => `($1->>'${key}')::int`,
+  boolean: (key: string): string => `($1->>'${key}')::boolean`,
+  jsonb: (key: string): string => `nullif($1->'${key}', 'null'::jsonb)`,
+  /** A JSON array of strings as text[], or null when the value isn't an array. */
+  texts: (key: string): string =>
+    `(case when jsonb_typeof($1->'${key}') = 'array'
+       then array(select jsonb_array_elements_text($1->'${key}')) end)`,
 }
 
-const toStored = (row: Record<string, unknown>): StoredEvent => ({
+/** Every batch names its session. */
+const SESSION = param.text('session')
+
+/**
+ * The next event after `after` a log cursor takes, as a scalar subquery:
+ * `types` is its JSON array, or null for every type but the clear marker
+ * (`clearType`). Each listed type is one probe of `a2_events_types`, so a
+ * consumer of rare types never scans the events it skips.
+ */
+const nextLogHead = ({
+  types,
+  after,
+  clearType = param.text('clearType'),
+}: {
+  types: string
+  after: string
+  clearType?: string
+}): string => `
+  case when ${types} is null then (
+    select event.idx from a2_events event
+     where event.session_id = ${SESSION} and event.idx > ${after}
+       and event.event_type <> ${clearType}
+     order by event.idx limit 1
+  ) else (
+    select min(next.idx)
+      from jsonb_array_elements_text(${types}) as wanted(event_type)
+      cross join lateral (
+        select event.idx from a2_events event
+         where event.session_id = ${SESSION} and event.event_type = wanted.event_type
+           and event.idx > ${after}
+         order by event.idx limit 1
+      ) next
+     where wanted.event_type <> ${clearType}
+  ) end`
+
+/** The latest run of `target`'s cursor, as a lateral subquery. */
+const LATEST_RUN = (target: string): string => `
+  select cur.epoch, cur.position, cur.head from a2_cursors cur
+   where cur.session_id = ${SESSION} and cur.cursor_key = ${target}.cursor_key
+     and cur.consumer = ${target}.consumer
+   order by cur.epoch desc limit 1`
+
+/**
+ * Retires the runs `target` replaces, those idle or superseded by the clear
+ * marker `clearIndex`, skipping any another operation holds: a later reclaim
+ * deletes those.
+ */
+const RETIRE_RUNS = (target: string, clearIndex: string): string => `
+  idle as materialized (
+    select cur.ctid from a2_cursors cur
+      join ${target} on cur.cursor_key = ${target}.cursor_key
+       and cur.consumer = ${target}.consumer
+     where cur.session_id = ${SESSION}
+       and (cur.head is null or cur.head <= ${clearIndex})
+     for update of cur skip locked
+  ), retired as (
+    delete from a2_cursors old using idle where old.ctid = idle.ctid
+  )`
+
+type Row = Record<string, unknown>
+
+const toDate = (ms: unknown): Date | null =>
+  ms === null || ms === undefined ? null : new Date(asNumber(ms))
+
+const toEvent = (row: Row): Event => ({
   id: row['event_id'] as string,
   type: row['event_type'] as string,
   payload: row['payload'],
   index: asNumber(row['idx']),
   sessionId: row['session_id'] as string,
   createdAt: new Date(asNumber(row['created_at'])),
-  cause: toCause(row['cause']),
+})
+
+const toStored = (row: Row): StoredEvent => ({
+  ...toEvent(row),
+  cause: decodeCause(row['cause']),
+})
+
+const toDispatch = (row: Row): HeadDispatch => ({
+  consumer: row['consumer'] as string,
   lane: (row['lane'] as string | null) ?? null,
-  processedAt: toDate(row['processed_at']),
-  processedByAttempt:
-    row['processed_by_attempt'] === null ||
-    row['processed_by_attempt'] === undefined
-      ? null
-      : asNumber(row['processed_by_attempt']),
-  returnedEventIds:
-    row['returned_event_ids'] === null ||
-    row['returned_event_ids'] === undefined
-      ? null
-      : decodeReturnedEventIds(row['returned_event_ids']),
   firstClaimedAt: toDate(row['first_claimed_at']),
   lastClaimedAt: toDate(row['last_claimed_at']),
   attemptCount: asNumber(row['attempt_count']),
+  claimHolder: (row['claim_holder'] as string | null) ?? null,
+  claimExpiresAt: toDate(row['claim_expires_at']),
   failureCount: asNumber(row['failure_count']),
   lastFailedAt: toDate(row['last_failed_at']),
-  lastFailedAttempt:
-    row['last_failed_attempt'] === null ||
-    row['last_failed_attempt'] === undefined
-      ? null
-      : asNumber(row['last_failed_attempt']),
+  lastFailedAttempt: asNullableNumber(row['last_failed_attempt']),
   lastError: (row['last_error'] as string | null) ?? null,
   failedAt: toDate(row['failed_at']),
-  claimHolder: (row['claim_holder'] as string | null) ?? null,
-  claimExpiresAt: toDate(row['claim_expires_at']),
 })
 
-const toEvent = (row: Record<string, unknown>): Event => ({
-  id: row['event_id'] as string,
-  type: row['event_type'] as string,
-  payload: row['payload'],
-  index: asNumber(row['idx']),
-  sessionId: row['session_id'] as string,
-  createdAt: new Date(asNumber(row['created_at'])),
+const freshDispatch = (
+  consumer: string,
+  lane: string | null,
+): HeadDispatch => ({
+  consumer,
+  lane,
+  firstClaimedAt: null,
+  lastClaimedAt: null,
+  attemptCount: 0,
+  claimHolder: null,
+  claimExpiresAt: null,
+  failureCount: 0,
+  lastFailedAt: null,
+  lastFailedAttempt: null,
+  lastError: null,
+  failedAt: null,
+})
+
+/** A cursor row joined with its head event's `e_` columns. */
+const toHead = (row: Row): HeadEvent => ({
+  ...toStored({
+    session_id: row['session_id'],
+    idx: row['e_idx'],
+    event_type: row['e_event_type'],
+    payload: row['e_payload'],
+    event_id: row['e_event_id'],
+    created_at: row['e_created_at'],
+    cause: row['e_cause'],
+  }),
+  ...toDispatch(row),
 })
 
+/** A cursor run as `cursors()` reports it, given the session's clear marker. */
+const toCursor = (row: Row, clearIndex: number): StoredCursor => {
+  const position = asNumber(row['position'])
+  if (row['kind'] !== 'log' || asNumber(row['epoch']) > clearIndex) {
+    return Object.assign(toDispatch(row), {
+      position,
+      head: asNullableNumber(row['head']),
+    })
+  }
+  // A clear supersedes a log cursor without touching its row: it counts
+  // from the marker, with nothing to run.
+  return Object.assign(
+    freshDispatch(row['consumer'] as string, row['lane'] as string),
+    { position: Math.max(position, clearIndex), head: null },
+  )
+}
+
+const compareText = (a: string, b: string): number =>
+  a < b ? -1 : a > b ? 1 : 0
+
+const byHead = (a: HeadEvent, b: HeadEvent): number =>
+  a.index - b.index || compareText(a.consumer, b.consumer)
+
+/** Consumer, then lane, with concurrent cursors last by head. */
+const byCursor = (a: StoredCursor, b: StoredCursor): number =>
+  compareText(a.consumer, b.consumer) ||
+  (a.lane === null
+    ? b.lane === null
+      ? (a.head ?? 0) - (b.head ?? 0)
+      : 1
+    : b.lane === null
+      ? -1
+      : compareText(a.lane, b.lane))
+
+const servedNames = (
+  consumers: readonly StoreConsumer[] | undefined,
+): string[] | null =>
+  consumers === undefined ? null : consumers.map((consumer) => consumer.name)
+
 const wrap = async <T>(fn: () => Promise<T>): Promise<T> => {
   try {
     return await fn()
@@ -281,37 +375,6 @@ const wrap = async <T>(fn: () => Promise<T>): Promise<T> => {
 
 const jsonb = (value: unknown): string => JSON.stringify(value) ?? 'null'
 
-const initializeSchema = async ({
-  client,
-  listen,
-}: {
-  client: PostgresClient
-  listen: boolean
-}): Promise<void> => {
-  const schema = SCHEMA + (listen ? POSTGRES_NOTIFICATIONS_SQL : '')
-  if (!client.connect) {
-    await client.query(schema)
-    return
-  }
-
-  const conn = await client.connect()
-  try {
-    await conn.query('begin')
-    // `if not exists` does not serialize concurrent catalog writes. Every
-    // serverless isolate takes the same transaction-scoped lock before DDL.
-    await conn.query(
-      "select pg_advisory_xact_lock(hashtext('a2:postgres:schema'))",
-    )
-    await conn.query(schema)
-    await conn.query('commit')
-  } catch (err) {
-    await conn.query('rollback').catch(() => {})
-    throw err
-  } finally {
-    conn.release()
-  }
-}
-
 const loadPg = async () =>
   import('pg').catch(() => {
     throw new A2Error(
@@ -350,20 +413,27 @@ const createListener = ({
     return listenerConnection
   })
 
-/** A dead-lettered event's snapshot pins, and history no pin keeps. */
+type Query = PostgresConnection['query']
+
+/** A finished or dead head's snapshot pins, and history no pin keeps. */
 const releasePins = async ({
   query,
   sessionId,
+  consumer,
+  cursorKey,
   index,
 }: {
-  query: PostgresConnection['query']
+  query: Query
   sessionId: string
+  consumer: string
+  cursorKey: string
   index: number
 }): Promise<void> => {
   await query(
     `delete from a2_snapshot_pins
-      where session_id = $1 and event_index = $2`,
-    [sessionId, index],
+      where session_id = $1 and event_index = $2
+        and consumer = $3 and cursor_key = $4`,
+    [sessionId, index, consumer, cursorKey],
   )
   await query(
     `delete from a2_snapshot_history history
@@ -378,6 +448,925 @@ const releasePins = async ({
   )
 }
 
+const lockSession = (query: Query, sessionId: string) =>
+  query('select pg_advisory_xact_lock(hashtext($1))', [sessionId])
+
+/** Whether the session has an event at `index`. */
+const hasEvent = async (
+  query: Query,
+  sessionId: string,
+  index: number,
+): Promise<boolean> =>
+  (
+    await query('select 1 from a2_events where session_id = $1 and idx = $2', [
+      sessionId,
+      index,
+    ])
+  ).rows.length > 0
+
+/**
+ * The attempt-currency fence shared by consumer appends and clears, under
+ * the session lock. The cursor is read locked (`for share` by an append,
+ * `for update` by a clear, which then releases the head): it serializes
+ * with every writer of the cursor (claims, completions, failures), so a
+ * stale read cannot pass the fence against a takeover committing beside
+ * it. The lock is only taken while the head and attempt still match.
+ */
+const assertCurrentCause = async ({
+  query,
+  sessionId,
+  cause,
+  clearIndex,
+  lock,
+}: {
+  query: Query
+  sessionId: string
+  cause: EventCause
+  clearIndex: number
+  lock: 'share' | 'update'
+}): Promise<void> => {
+  if (cause.index <= clearIndex) throw supersededAttemptError(sessionId, cause)
+  const { rows } = await query(
+    `select 1 from a2_cursors
+      where session_id = $1 and cursor_key = $2 and consumer = $3
+        and head = $4 and attempt_count = $5 and failed_at is null
+      for ${lock}`,
+    [
+      sessionId,
+      cursorKeyOf(cause.lane, cause.index),
+      cause.consumer,
+      cause.index,
+      cause.attempt,
+    ],
+  )
+  if (rows.length === 0) throw supersededAttemptError(sessionId, cause)
+}
+
+// ── one-round-trip operations ─────────────────────────────────────────
+//
+// An operation that writes under the session lock runs as one call of
+// `a2_batch` (schema.sql): its statements, in order, in one transaction and
+// one round trip, the lock held only while the server runs them. The function
+// is what makes that correct. A statement's snapshot is taken before any lock
+// it waits for, so a single statement that took the lock would still miss
+// what the lock's last holder committed; inside the function each statement
+// takes its snapshot when it starts. Every statement is a select of jsonb rows
+// reading its values from `$1` (`param`). A row with `abort` fails the call and
+// rolls it back (`abortedBatch`), and one with `stop` ends it there.
+
+const BATCH = 'select r from a2_batch($1::text[], $2::jsonb) as r'
+
+/**
+ * Each statement as a batch sends it, whitespace collapsed: a batch sends all
+ * its statements on every call. They hold no comments or spaced literals, and
+ * they're this module's constants, so the cache stays this size.
+ */
+const compacted = new Map<string, string>()
+const compact = (statement: string): string => {
+  let sent = compacted.get(statement)
+  if (sent === undefined) {
+    // A line comment would swallow the rest of the statement once it's one line.
+    if (statement.includes('--'))
+      throw new TypeError('a batch statement holds a comment')
+    sent = statement.replace(/\s+/g, ' ').trim()
+    compacted.set(statement, sent)
+  }
+  return sent
+}
+
+/** The SQLSTATE `a2_batch` raises an `abort` row with, as its detail. */
+const BATCH_ABORTED = 'A2001'
+
+/** The row an aborted `a2_batch` call raised, from `error` or its cause chain. */
+const abortedBatch = (error: unknown): Row | undefined => {
+  for (let current = error, depth = 0; depth < 5; depth += 1) {
+    if (typeof current !== 'object' || current === null) return undefined
+    const { code, detail, cause } = current as {
+      code?: unknown
+      detail?: unknown
+      cause?: unknown
+    }
+    if (code === BATCH_ABORTED && typeof detail === 'string')
+      return JSON.parse(detail) as Row
+    current = cause
+  }
+  return undefined
+}
+
+const LOCK_SESSION = `
+  select jsonb_build_object('locked', true)
+    from pg_advisory_xact_lock(hashtext(${SESSION}))`
+
+const INDEX = param.bigint('index')
+const CONSUMER = param.text('consumer')
+
+/**
+ * The index before the events this call inserted, the last `count` of the
+ * session's: read under the session lock, after the insert.
+ */
+const INSERTED_AFTER = `(
+  select coalesce(max(idx), 0) - ${param.bigint('count')}
+    from a2_events where session_id = ${SESSION})`
+
+/**
+ * An append's checks, under the session lock: the session's head and pending
+ * state, and what its supplied `ids` say. When every event's id belongs to
+ * this session already, the batch is a retry: it stops with the committed
+ * rows. Some owned, or one in another session, aborts, as does scheduled work
+ * from at or below the clear marker (`origin`). Rows below the marker own no
+ * id.
+ */
+const APPEND_CHECKS = `
+  with boundary as materialized (
+    select coalesce(max(idx), 0) as base,
+           ${clearIndexOf(SESSION)} as clear_index,
+           ${pendingIn(SESSION, param.texts('served'))} as has_pending
+      from a2_events where session_id = ${SESSION}
+  ), owned as materialized (
+    select event.session_id, event.idx, event.event_type, event.payload,
+           event.event_id, event.created_at, event.cause
+      from a2_events event, boundary
+     where event.event_id = any(${param.texts('ids')})
+       and not (event.session_id = ${SESSION}
+                and event.idx < boundary.clear_index)
+  )
+  select case
+    when exists (select 1 from owned where session_id <> ${SESSION}) then
+      jsonb_build_object('abort', 'foreign', 'event_id', (
+        select event_id from owned where session_id <> ${SESSION}
+         order by idx limit 1))
+    when (select count(*) from owned) = ${param.bigint('count')} then
+      jsonb_build_object('stop', 'replay',
+        'has_pending', boundary.has_pending,
+        'events', (select jsonb_agg(to_jsonb(owned) order by owned.idx)
+                     from owned))
+    when exists (select 1 from owned) then
+      jsonb_build_object('abort', 'mixed', 'owned',
+        (select count(*) from owned))
+    when ${param.bigint('origin')} <= boundary.clear_index then
+      jsonb_build_object('abort', 'cleared')
+    else jsonb_build_object('base', boundary.base,
+                            'has_pending', boundary.has_pending)
+  end
+  from boundary`
+
+/**
+ * The attempt-currency fence of a consumer append, under the session lock.
+ * Each cause's cursor is read `for share`: that serializes with every writer
+ * of the cursor (claims, completions, failures), so a stale read cannot pass
+ * the fence against a takeover committing beside it. A row is locked only
+ * while its head and attempt still match. The first cause that fails aborts.
+ */
+const FENCE = `
+  with cause as (
+    select * from jsonb_to_recordset($1->'causes')
+      as cause(ord int, consumer text, cursor_key text, idx bigint, attempt int)
+  ), held as materialized (
+    select cause.ord from cause
+      join a2_cursors cur
+        on cur.session_id = ${SESSION} and cur.cursor_key = cause.cursor_key
+       and cur.consumer = cause.consumer and cur.head = cause.idx
+       and cur.attempt_count = cause.attempt and cur.failed_at is null
+     where cause.idx > ${clearIndexOf(SESSION)}
+     for share of cur
+  )
+  select jsonb_build_object('abort', 'superseded', 'ord', cause.ord)
+    from cause where cause.ord not in (select ord from held)
+   order by cause.ord limit 1`
+
+/**
+ * Frees the `ids` this session's rows below its clear marker hold, so the
+ * batch can take them. It never waits on a row: a reclaim deleting one may
+ * hold it, and one it skips aborts.
+ */
+const REUSE_IDS = `
+  with stale as materialized (
+    select event.idx from a2_events event
+     where event.session_id = ${SESSION}
+       and event.event_id = any(${param.texts('ids')})
+       and event.idx < ${clearIndexOf(SESSION)}
+     order by event.idx
+     for update skip locked
+  ), deleted as (
+    delete from a2_events event using stale
+     where event.session_id = ${SESSION} and event.idx = stale.idx
+    returning event.idx
+  )
+  select jsonb_build_object('abort', 'held')
+   where (select count(*) from deleted) < (
+     select count(*) from a2_events event
+      where event.session_id = ${SESSION}
+        and event.event_id = any(${param.texts('ids')})
+        and event.idx < ${clearIndexOf(SESSION)})`
+
+/** Inserts `events` after the session's head, under the session lock. */
+const INSERT_EVENTS = `
+  with inserted as (
+    insert into a2_events
+      (session_id, idx, event_type, payload, event_id, created_at, cause)
+    select ${SESSION}, base.base + event.ord, event.type,
+           coalesce(event.payload, 'null'::jsonb), event.id,
+           ${param.bigint('now')}, event.cause
+      from (select coalesce(max(idx), 0) as base from a2_events
+             where session_id = ${SESSION}) base,
+           jsonb_to_recordset($1->'events')
+             as event(ord bigint, type text, payload jsonb, id text, cause jsonb)
+    returning 1
+  )
+  select jsonb_build_object('inserted', count(*)) from inserted`
+
+/** A cursor for each concurrent target: the event alone. */
+const START_EVENTS = `
+  with started as (
+    insert into a2_cursors
+      (session_id, consumer, cursor_key, epoch, lane, kind, position, head)
+    select ${SESSION}, target.consumer, '#' || target.idx, target.idx, null,
+           'event', target.idx - 1, target.idx
+      from (
+        select single.consumer, ${INSERTED_AFTER} + single.ord as idx
+          from jsonb_to_recordset($1->'singles')
+            as single(consumer text, ord bigint)
+      ) target
+    on conflict do nothing
+    returning 1
+  )
+  select jsonb_build_object('started', count(*)) from started`
+
+/** Queues each lane target's event in its lane. */
+const QUEUE_LANES = `
+  with queued as (
+    insert into a2_lane_events (session_id, consumer, lane, idx)
+    select ${SESSION}, queued.consumer, queued.lane,
+           ${INSERTED_AFTER} + queued.ord
+      from jsonb_to_recordset($1->'queued')
+        as queued(consumer text, lane text, ord bigint)
+    on conflict do nothing
+    returning 1
+  )
+  select jsonb_build_object('queued', count(*)) from queued`
+
+/**
+ * Starts a run for each lane cursor the batch queues work for that has none
+ * running: one that is idle, superseded by the clear marker, or new. It starts
+ * at the lane's first event in the batch and counts from the marker.
+ */
+const START_LANES = `
+  with boundary as materialized (
+    select ${INSERTED_AFTER} as base, ${clearIndexOf(SESSION)} as clear_index
+  ), target as (
+    select first.consumer, first.cursor_key, first.lane,
+           boundary.base + first.ord as idx
+      from boundary, jsonb_to_recordset($1->'lanes')
+        as first(consumer text, cursor_key text, lane text, ord bigint)
+  ), started as materialized (
+    select target.*, latest.position
+      from target
+      left join lateral (${LATEST_RUN('target')}) latest on true
+     where latest.head is null
+        or latest.head <= (select clear_index from boundary)
+  ), ${RETIRE_RUNS('started', '(select clear_index from boundary)')},
+  inserted as (
+    insert into a2_cursors
+      (session_id, consumer, cursor_key, epoch, lane, kind, position, head)
+    select ${SESSION}, started.consumer, started.cursor_key, started.idx,
+           started.lane, 'lane',
+           greatest(coalesce(started.position, 0),
+                    (select clear_index from boundary)),
+           started.idx
+      from started
+    on conflict do nothing
+    returning 1
+  )
+  select jsonb_build_object('lanes', count(*)) from inserted`
+
+/**
+ * Starts a run for each served log cursor the batch carries types for that
+ * has none running. A missing cursor starts at the batch's first event of its
+ * types, or at the beginning of the log with backfill. One that exists starts
+ * at the next event it takes after its position: a deployment that does not
+ * serve the consumer may have appended some while it was idle. A cursor from
+ * before the clear marker counts from it.
+ */
+const WAKE_LOGS = `
+  with boundary as materialized (
+    select ${INSERTED_AFTER} as base, ${clearIndexOf(SESSION)} as clear_index
+  ), target as (
+    select log.consumer, log.cursor_key, log.lane,
+           boundary.base + log.ord as first, log.types, log.backfill
+      from boundary, jsonb_to_recordset($1->'logs')
+        as log(consumer text, cursor_key text, lane text, ord bigint,
+               types jsonb, backfill boolean)
+  ), woken as materialized (
+    select target.*,
+           case when latest.epoch is not null
+                  then greatest(latest.position,
+                                (select clear_index from boundary))
+                when target.backfill then (select clear_index from boundary)
+                else (select base from boundary) end as position,
+           latest.epoch is not null or target.backfill as resumes
+      from target
+      left join lateral (${LATEST_RUN('target')}) latest on true
+     where latest.head is null
+        or latest.head <= (select clear_index from boundary)
+  ), ${RETIRE_RUNS('woken', '(select clear_index from boundary)')}, run as (
+    select woken.*,
+           case when woken.resumes then coalesce(${nextLogHead({
+             types: 'woken.types',
+             after: 'woken.position',
+           })}, woken.first) else woken.first end as head
+      from woken
+  ), inserted as (
+    insert into a2_cursors
+      (session_id, consumer, cursor_key, epoch, lane, kind, position, head,
+       types)
+    select ${SESSION}, run.consumer, run.cursor_key, run.head, run.lane, 'log',
+           run.position, run.head, run.types
+      from run
+    on conflict do nothing
+    returning 1
+  )
+  select jsonb_build_object('logs', count(*)) from inserted`
+
+/**
+ * The heads a claim may take, up to `through` when there is one, as
+ * `from ... where` for `cur`. `for update` makes a claim racing another wait
+ * and then re-check the row it waited for.
+ */
+const ELIGIBLE = `
+  from a2_cursors cur
+ where cur.session_id = ${SESSION}
+   and cur.head > ${clearIndexOf(SESSION)}
+   and (${param.bigint('through')} is null
+        or cur.head <= ${param.bigint('through')})
+   and cur.failed_at is null
+   and (${param.texts('served')} is null
+        or cur.consumer = any(${param.texts('served')}))
+   and not exists (
+     select 1 from jsonb_to_recordset($1->'excluded')
+       as skip(consumer text, cursor_key text)
+      where skip.consumer = cur.consumer and skip.cursor_key = cur.cursor_key
+   )`
+
+/** A lapsed claim's takeover that spends the last failed attempt dead-letters the head instead. */
+const EXHAUSTED = `(cur.claim_holder is not null
+  and cur.failure_count + 1 >= ${param.int('maxFailures')})`
+
+/**
+ * Claims every eligible head, returning each with its event. A head the claim
+ * waited on may have moved to an event its snapshot predates: that row comes
+ * back without one (`e_idx` null), for `claimAvailable` to read. It stops
+ * there unless one dead-lettered, whose pins `RELEASE_DEAD` then releases, or
+ * none was claimed, for `RETRY_AT`.
+ */
+const CLAIM = `
+  with eligible as materialized (
+    select cur.consumer, cur.cursor_key, cur.epoch
+    ${ELIGIBLE}
+       and (cur.claim_expires_at is null
+            or cur.claim_expires_at <= ${param.bigint('now')})
+     order by cur.head, cur.consumer
+     for update of cur
+  ), claimed as (
+    update a2_cursors cur set
+      attempt_count = cur.attempt_count + 1,
+      failure_count = cur.failure_count
+        + case when cur.claim_holder is null then 0 else 1 end,
+      failed_at = case when ${EXHAUSTED} then ${param.bigint('now')}
+                       else cur.failed_at end,
+      first_claimed_at = case when ${EXHAUSTED} then cur.first_claimed_at
+        else coalesce(cur.first_claimed_at, ${param.bigint('now')}) end,
+      last_claimed_at = case when ${EXHAUSTED} then cur.last_claimed_at
+                             else ${param.bigint('now')} end,
+      claim_holder = case when ${EXHAUSTED} then null
+                          else ${param.text('holder')} end,
+      claim_expires_at = case when ${EXHAUSTED} then null
+                              else ${param.bigint('expiresAt')} end
+      from eligible
+     where cur.session_id = ${SESSION}
+       and cur.cursor_key = eligible.cursor_key
+       and cur.consumer = eligible.consumer
+       and cur.epoch = eligible.epoch
+    returning cur.*
+  ), heads as (
+    select claimed.*, ${HEAD_COLUMNS},
+           ${clearIndexOf(SESSION)} as clear_index,
+           (select coalesce(max(idx), 0) from a2_events
+             where session_id = ${SESSION}) as session_head
+      from claimed
+      left join a2_events event
+        on event.session_id = ${SESSION} and event.idx = claimed.head
+  )
+  select r from (
+    select 0 as ord, to_jsonb(heads) as r from heads
+    union all
+    select 1, jsonb_build_object('stop', 'claimed')
+     where exists (select 1 from heads)
+       and not exists (select 1 from heads where failed_at is not null)
+  ) claim
+  order by ord`
+
+/**
+ * Releases the pins of the heads dead-lettered at `now`, the claim's among
+ * them, in a snapshot after the claim's locks, with the history no other pin
+ * keeps.
+ */
+const RELEASE_DEAD = `
+  with dead as materialized (
+    select cur.consumer, cur.cursor_key, cur.head from a2_cursors cur
+     where cur.session_id = ${SESSION} and cur.head is not null
+       and cur.failed_at = ${param.bigint('now')} and cur.claim_holder is null
+  ), unpinned as (
+    delete from a2_snapshot_pins pin using dead
+     where pin.session_id = ${SESSION} and pin.event_index = dead.head
+       and pin.consumer = dead.consumer and pin.cursor_key = dead.cursor_key
+    returning 1
+  ), unkept as (
+    delete from a2_snapshot_history history
+     where history.session_id = ${SESSION}
+       and exists (select 1 from dead)
+       and not exists (
+         select 1 from a2_snapshot_pins pin
+          where pin.session_id = history.session_id
+            and pin.reducer_name = history.reducer_name
+            and pin.up_to_index = history.up_to_index
+            and not exists (
+              select 1 from dead
+               where pin.event_index = dead.head
+                 and pin.consumer = dead.consumer
+                 and pin.cursor_key = dead.cursor_key)
+       )
+    returning 1
+  )
+  select jsonb_build_object('released', (select count(*) from unpinned))`
+
+/** When nothing was claimed: the earliest live claim or retry hold that blocks a head. */
+const RETRY_AT = `
+  select jsonb_build_object('retry_at', min(cur.claim_expires_at))
+  ${ELIGIBLE}
+     and cur.claim_expires_at > ${param.bigint('now')}`
+
+/** The cursor row `alias` whose head this attempt holds. */
+const heldBy = (alias: string): string => `
+  ${alias}.session_id = ${SESSION}
+  and ${alias}.cursor_key = ${param.text('cursorKey')}
+  and ${alias}.consumer = ${CONSUMER} and ${alias}.head = ${INDEX}
+  and ${alias}.attempt_count = ${param.int('attempt')}
+  and ${alias}.failed_at is null and ${alias}.claim_holder is not null`
+
+/**
+ * Locks the cursor while this attempt holds its head, and stops unless it
+ * does: a completion locks its cursor first. A cleared head is never locked.
+ */
+const HOLD = `
+  with boundary as materialized (
+    select ${clearIndexOf(SESSION)} as clear_index
+  ), held as materialized (
+    select cur.kind from a2_cursors cur, boundary
+     where ${heldBy('cur')} and ${INDEX} > boundary.clear_index
+     for update of cur
+  )
+  select case
+    when ${INDEX} <= boundary.clear_index then
+      jsonb_build_object('stop', 'superseded')
+    when not exists (select 1 from held) then
+      jsonb_build_object('stop', 'unheld')
+    else jsonb_build_object('held', (select kind from held limit 1))
+  end
+  from boundary`
+
+/** A log cursor's types once it moves: the served consumer's (`types`, when `retype`), else its own. */
+const logTypesOf = (cur: string): string =>
+  `(case when ${param.boolean('retype')} then ${param.jsonb('types')}
+         else ${cur}.types end)`
+
+/**
+ * The head cursor `cur` moves to from its head: its lane's next unfinished
+ * event, the next event of a log cursor's types, or none for a concurrent
+ * cursor. The lane's lookup is ordered by its whole key, so the lane's
+ * primary key serves it.
+ */
+const nextHeadOf = (cur: string): string => `
+  case ${cur}.kind
+    when 'lane' then (
+      select lane.idx from a2_lane_events lane
+       where lane.session_id = ${SESSION} and lane.consumer = ${cur}.consumer
+         and lane.lane = ${cur}.lane and not lane.done
+         and lane.idx > ${cur}.head
+       order by lane.consumer, lane.lane, lane.idx limit 1)
+    when 'log' then (${nextLogHead({
+      types: logTypesOf(cur),
+      after: `${cur}.head`,
+    })})
+  end`
+
+/**
+ * Takes the session lock when the held cursor would go idle: a lane or log
+ * cursor with no next head. See `completeAttempt` for why a completion that
+ * moves to a next head needs no lock.
+ */
+const LOCK_IF_IDLE = `
+  select jsonb_build_object('locked',
+           pg_advisory_xact_lock(hashtext(${SESSION}))::text is not null)
+    from a2_cursors cur
+   where ${heldBy('cur')} and cur.kind <> 'event'
+     and (${nextHeadOf('cur')}) is null`
+
+/**
+ * Moves the cursor `target` selects past its head `index`, if its head lies
+ * above the clear marker: marks the lane's event done (with this attempt's
+ * receipt, `receipt`), releases the head's snapshot pins with the history no
+ * other pin keeps, and gives the cursor its next head with fresh dispatch
+ * columns (a log or concurrent cursor keeps the receipt on the run). The
+ * marker and the next head are read in one snapshot, after the cursor's lock.
+ * Without a row it writes nothing, and stops if `stop`.
+ */
+const advance = ({
+  target,
+  receipt,
+  missing,
+}: {
+  target: string
+  receipt: boolean
+  missing: 'stop' | 'abort' | 'continue'
+}): string => `
+  with target as materialized (
+    select cur.* from a2_cursors cur
+     where ${target} and ${INDEX} > ${clearIndexOf(SESSION)}
+     order by cur.cursor_key limit 1
+     for update of cur
+  ), done as (
+    update a2_lane_events lane set done = true${
+      receipt
+        ? `, completed_attempt = ${param.int('attempt')},
+          returned_event_ids = ${param.jsonb('ids')}`
+        : ''
+    }
+      from target
+     where target.kind = 'lane' and lane.session_id = ${SESSION}
+       and lane.consumer = target.consumer and lane.lane = target.lane
+       and lane.idx = target.head
+    returning 1
+  ), unpinned as (
+    delete from a2_snapshot_pins pin using target
+     where pin.session_id = ${SESSION} and pin.event_index = target.head
+       and pin.consumer = target.consumer and pin.cursor_key = target.cursor_key
+    returning 1
+  ), unkept as (
+    delete from a2_snapshot_history history using target
+     where history.session_id = ${SESSION}
+       and not exists (
+         select 1 from a2_snapshot_pins pin
+          where pin.session_id = history.session_id
+            and pin.reducer_name = history.reducer_name
+            and pin.up_to_index = history.up_to_index
+            and not (pin.event_index = target.head
+                     and pin.consumer = target.consumer
+                     and pin.cursor_key = target.cursor_key)
+       )
+    returning 1
+  ), moved as (
+    update a2_cursors cur
+       set position = target.head, head = ${nextHeadOf('target')},
+           ${FRESH_DISPATCH},
+           types = case when target.kind = 'log'
+                        then ${logTypesOf('target')} else cur.types end${
+                          receipt
+                            ? `,
+           completed_idx = case when target.kind = 'lane'
+                                then cur.completed_idx else target.head end,
+           completed_attempt = case when target.kind = 'lane'
+                                    then cur.completed_attempt
+                                    else ${param.int('attempt')} end,
+           returned_event_ids = case when target.kind = 'lane'
+                                     then cur.returned_event_ids
+                                     else ${param.jsonb('ids')} end`
+                            : ''
+                        }
+      from target
+     where cur.session_id = ${SESSION} and cur.cursor_key = target.cursor_key
+       and cur.consumer = target.consumer and cur.epoch = target.epoch
+    returning cur.head
+  )
+  select case when exists (select 1 from moved)
+              then jsonb_build_object('advanced', true)
+              else jsonb_build_object(${
+                missing === 'continue'
+                  ? `'advanced', false`
+                  : `'${missing}', 'superseded'`
+              }) end`
+
+/** Completing a held head, once the cursor's lock is taken. */
+const COMPLETE = advance({
+  target: heldBy('cur'),
+  receipt: true,
+  missing: 'stop',
+})
+
+/**
+ * Completing a held head after appending its events, under the session lock:
+ * the head can't have moved, but if it had, the events must not stand.
+ */
+const COMPLETE_APPENDED = advance({
+  target: heldBy('cur'),
+  receipt: true,
+  missing: 'abort',
+})
+
+/**
+ * A completion's checks before it appends, under the session lock, which the
+ * cursor's lock preceded: a head the clear marker passed meanwhile stops, and
+ * a returned id a live row owns aborts.
+ */
+const RETURN_CHECKS = `
+  select case
+    when ${INDEX} <= ${clearIndexOf(SESSION)} then
+      jsonb_build_object('stop', 'superseded')
+    when exists (
+      select 1 from a2_events event
+       where event.event_id = any(${param.texts('ids')})
+         and not (event.session_id = ${SESSION}
+                  and event.idx < ${clearIndexOf(SESSION)})
+    ) then jsonb_build_object('abort', 'owned')
+    else jsonb_build_object('base', (
+      select coalesce(max(idx), 0) from a2_events
+       where session_id = ${SESSION}))
+  end`
+
+/** The consumer's dead-lettered head at `index`, locked. */
+const deadAt = (alias: string): string => `
+  ${alias}.session_id = ${SESSION} and ${alias}.consumer = ${CONSUMER}
+  and ${alias}.head = ${INDEX} and ${alias}.failed_at is not null`
+
+/**
+ * Locks the dead letter, or stops: the statements after it act only on the
+ * row this one locked.
+ */
+const LOCK_DEAD = `
+  with dead as materialized (
+    select cur.cursor_key from a2_cursors cur
+     where ${deadAt('cur')} and ${INDEX} > ${clearIndexOf(SESSION)}
+     order by cur.cursor_key limit 1
+     for update
+  )
+  select case when exists (select 1 from dead)
+              then jsonb_build_object('redriven', true)
+              else jsonb_build_object('stop', 'alive', 'redriven', false,
+                     'has_pending',
+                     ${pendingIn(SESSION, param.texts('served'))}) end`
+
+/** Clears a dead letter, keeping its claim history and last failure. */
+const RETRY_DEAD = `
+  with target as materialized (
+    select cur.cursor_key, cur.epoch from a2_cursors cur
+     where ${deadAt('cur')} and ${INDEX} > ${clearIndexOf(SESSION)}
+     order by cur.cursor_key limit 1
+     for update of cur
+  ), retried as (
+    update a2_cursors cur set failed_at = null, failure_count = 0
+      from target
+     where cur.session_id = ${SESSION} and cur.cursor_key = target.cursor_key
+       and cur.consumer = ${CONSUMER} and cur.epoch = target.epoch
+    returning 1
+  )
+  select jsonb_build_object('retried', count(*)) from retried`
+
+const SKIP_DEAD = advance({
+  target: deadAt('cur'),
+  receipt: false,
+  missing: 'continue',
+})
+
+const PENDING = `
+  select jsonb_build_object('has_pending',
+           ${pendingIn(SESSION, param.texts('served'))})`
+
+/**
+ * One log cursor as `wakeLog` finds it: the session's head and clear marker,
+ * the cursor's latest run, where a run would start (`start`), and the next
+ * event it takes from there unless the run has a head. `retyped` says whether
+ * the run's types are stale. CTEs, for a `with`.
+ */
+const LOG_CURSOR = `
+  boundary as materialized (
+    select coalesce(max(idx), 0) as session_head,
+           ${clearIndexOf(SESSION)} as clear_index
+      from a2_events where session_id = ${SESSION}
+  ), latest as materialized (
+    select boundary.*, cur.*,
+           case when cur.epoch is not null
+                  then greatest(cur.position, boundary.clear_index)
+                when ${param.boolean('backfill')} then boundary.clear_index
+                else boundary.session_head end as start
+      from boundary
+      left join lateral (
+        select * from a2_cursors cur
+         where cur.session_id = ${SESSION}
+           and cur.cursor_key = ${param.text('cursorKey')}
+           and cur.consumer = ${CONSUMER}
+         order by cur.epoch desc limit 1
+      ) cur on true
+  ), found as materialized (
+    select latest.*,
+           latest.types is distinct from ${param.jsonb('types')} as retyped,
+           case when latest.head > latest.clear_index then null
+                else ${nextLogHead({
+                  types: param.jsonb('types'),
+                  after: 'latest.start',
+                })} end as next_head
+      from latest
+  )`
+
+/**
+ * A run with a head gets no next one: it is left as it is, claim and all,
+ * and so is an idle run with nothing new to take. Only their types change.
+ */
+const KEEPS_RUN = 'found.epoch is not null and found.next_head is null'
+
+/** No run yet, and nothing after the latest clear: none is started. */
+const NO_RUN_NEEDED =
+  'found.epoch is null and found.session_head = found.clear_index'
+
+/** `wakeLog` without the lock: stops when there is nothing to write. */
+const READ_LOG = `
+  with ${LOG_CURSOR}
+  select case when ${KEEPS_RUN} and not found.retyped
+              then jsonb_build_object('stop', 'unchanged',
+                     'cursor', to_jsonb(found))
+              when ${NO_RUN_NEEDED}
+              then jsonb_build_object('stop', 'empty', 'empty', true,
+                     'head', found.session_head)
+              else jsonb_build_object('stale', true) end
+    from found`
+
+/**
+ * `wakeLog` under the session lock. A kept run takes the consumer's types,
+ * unless another operation holds its row: the session lock is held, so this
+ * waits for none. Otherwise a run starts at `start`, retiring the runs it
+ * replaces. One with a head is keyed by it; one with nothing to run is idle
+ * at its position, as a run that finished its last head is, keyed by that
+ * position so the next run, which starts after it, sorts later.
+ */
+const WAKE_LOG = `
+  with ${LOG_CURSOR}, held as materialized (
+    select cur.ctid from a2_cursors cur, found
+     where ${KEEPS_RUN} and found.retyped
+       and cur.session_id = ${SESSION}
+       and cur.cursor_key = ${param.text('cursorKey')}
+       and cur.consumer = ${CONSUMER} and cur.epoch = found.epoch
+       and cur.types is distinct from ${param.jsonb('types')}
+     for update of cur skip locked
+  ), retype as (
+    update a2_cursors cur set types = ${param.jsonb('types')} from held
+     where cur.ctid = held.ctid
+  ), target as (
+    select ${param.text('cursorKey')} as cursor_key, ${CONSUMER} as consumer
+      from found where not (${KEEPS_RUN}) and not (${NO_RUN_NEEDED})
+  ), ${RETIRE_RUNS('target', '(select clear_index from found)')}, started as (
+    insert into a2_cursors
+      (session_id, consumer, cursor_key, epoch, lane, kind, position, head,
+       types)
+    select ${SESSION}, target.consumer, target.cursor_key,
+           coalesce(found.next_head, found.start), ${param.text('lane')}, 'log',
+           found.start, found.next_head, ${param.jsonb('types')}
+      from found, target
+    returning *
+  )
+  select jsonb_build_object(
+           'cursor', coalesce((select to_jsonb(started) from started),
+                              to_jsonb(found)),
+           'head', found.session_head, 'clear_index', found.clear_index,
+           'empty', ${NO_RUN_NEEDED})
+    from found`
+
+/**
+ * The statements that start the cursor work a batch of `events` carries,
+ * with their parameters: each event by its position in the batch, from 1,
+ * since its index is assigned under the lock. `started` says whether it
+ * starts work for a served consumer.
+ */
+const enqueue = (
+  events: readonly AppendEvent[],
+  consumers: readonly StoreConsumer[] | undefined,
+): {
+  statements: (string | false)[]
+  params: Record<string, unknown>
+  started: boolean
+} => {
+  const served = consumers && new Set(consumers.map(({ name }) => name))
+  let started = false
+  const singles: { consumer: string; ord: number }[] = []
+  const queued: { consumer: string; lane: string; ord: number }[] = []
+  const lanes = new Map<
+    string,
+    { consumer: string; cursor_key: string; lane: string; ord: number }
+  >()
+  events.forEach((event, offset) => {
+    const ord = offset + 1
+    for (const target of event.targets ?? []) {
+      if (!served || served.has(target.consumer)) started = true
+      if (target.lane === null) {
+        singles.push({ consumer: target.consumer, ord })
+        continue
+      }
+      queued.push({ consumer: target.consumer, lane: target.lane, ord })
+      const key = cursorKeyOf(target.lane, ord)
+      const first = `${target.consumer}\u0000${key}`
+      if (!lanes.has(first)) {
+        lanes.set(first, {
+          consumer: target.consumer,
+          cursor_key: key,
+          lane: target.lane,
+          ord,
+        })
+      }
+    }
+  })
+  const logs: {
+    consumer: string
+    cursor_key: string
+    lane: string
+    ord: number
+    types: readonly string[] | null
+    backfill: boolean
+  }[] = []
+  for (const consumer of consumers ?? []) {
+    const log = consumer.log
+    if (!log) continue
+    const offset = events.findIndex(
+      (event) =>
+        event.type !== CLEAR_EVENT_TYPE &&
+        (log.types === null || log.types.includes(event.type)),
+    )
+    if (offset === -1) continue
+    logs.push({
+      consumer: consumer.name,
+      cursor_key: cursorKeyOf(log.lane, 0),
+      lane: log.lane,
+      ord: offset + 1,
+      types: log.types,
+      backfill: log.backfill,
+    })
+  }
+  if (logs.length > 0) started = true
+  return {
+    statements: [
+      singles.length > 0 && START_EVENTS,
+      queued.length > 0 && QUEUE_LANES,
+      queued.length > 0 && START_LANES,
+      logs.length > 0 && WAKE_LOGS,
+    ],
+    params: {
+      singles,
+      queued,
+      lanes: [...lanes.values()],
+      logs,
+      clearType: CLEAR_EVENT_TYPE,
+    },
+    started,
+  }
+}
+
+/**
+ * The rows a batch inserted at `base + 1`, as the store returns them.
+ * `events` are what the batch sent.
+ */
+const insertedRows = ({
+  sessionId,
+  events,
+  base,
+  now,
+}: {
+  sessionId: string
+  events: readonly {
+    id: string
+    type: string
+    payload: unknown
+    cause: EventCause | null
+  }[]
+  base: number
+  now: number
+}): StoredEvent[] =>
+  events.map((event, offset) => ({
+    id: event.id,
+    type: event.type,
+    payload: structuredClone(event.payload),
+    index: base + 1 + offset,
+    sessionId,
+    createdAt: new Date(now),
+    cause: event.cause ? { ...event.cause } : null,
+  }))
+
+/** A served log consumer's types, for a cursor that moves past its head. */
+const retypeOf = (
+  consumer: string,
+  consumers: readonly StoreConsumer[] | undefined,
+): { retype: boolean; types: readonly string[] | null } => {
+  const log = consumers?.find(({ name }) => name === consumer)?.log
+  return log
+    ? { retype: true, types: log.types }
+    : { retype: false, types: null }
+}
+
 export function postgres(options: PostgresStoreOptions = {}): PostgresStore {
   const clock = options.clock ?? SYSTEM_CLOCK
   const generateId = options.ids ?? RANDOM_IDS
@@ -417,31 +1406,23 @@ export function postgres(options: PostgresStoreOptions = {}): PostgresStore {
         },
       })
     }
-    try {
-      const listen = Boolean(options.listenConnectionString)
-      const resource = lease.value
-      if (injected) await initializeSchema({ client: resource.client, listen })
-      else
-        await resource.initialize({
-          schema: SCHEMA + (listen ? POSTGRES_NOTIFICATIONS_SQL : ''),
-          run: () => initializeSchema({ client: resource.client, listen }),
-        })
-      return lease
-    } catch (error) {
-      if (!injected) await lease.release().catch(() => {})
-      throw error
-    }
+    return { lease, client: explainingPostgresClient(lease.value.client) }
   })
   const client = async (): Promise<PostgresClient> => {
     if (closed) throw new A2Error('STORE_UNAVAILABLE', 'the store was closed')
-    const lease = await connection.get()
+    const { client: explaining } = await connection.get()
     if (closed) throw new A2Error('STORE_UNAVAILABLE', 'the store was closed')
-    return lease.value.client
+    return explaining
   }
 
   const notifications = options.listenConnectionString
     ? postgresNotificationScope(async () => {
-        await client()
+        const c = await client()
+        const resource = (await connection.get()).lease.value
+        await resource.initialize({
+          key: 'triggers',
+          run: () => checkPostgresTriggers(c),
+        })
         const pg = await loadPg()
         const connectionString = options.listenConnectionString!
         const key = postgresConnectionKey({
@@ -576,9 +1557,7 @@ export function postgres(options: PostgresStoreOptions = {}): PostgresStore {
   const begin = notifications
     ? `begin; set local a2.presence_source = '${instanceId}'`
     : 'begin'
-  const withTx = async <T>(
-    fn: (query: PostgresConnection['query']) => Promise<T>,
-  ): Promise<T> => {
+  const withTx = async <T>(fn: (query: Query) => Promise<T>): Promise<T> => {
     const c = await client()
     if (c.connect) {
       const conn = await c.connect()
@@ -594,12 +1573,16 @@ export function postgres(options: PostgresStoreOptions = {}): PostgresStore {
         conn.release()
       }
     }
-    const resource = (await connection.get()).value
+    const resource = (await connection.get()).lease.value
     return resource.exclusive(async () => {
       const raw = resource.raw
       await raw.query(begin)
       try {
-        const result = await fn((text, values) => raw.query(text, values))
+        const result = await fn((text, values) =>
+          raw.query(text, values).catch((error: unknown) => {
+            throw explainPostgresError(error)
+          }),
+        )
         await raw.query('commit')
         return result
       } catch (err) {
@@ -609,54 +1592,37 @@ export function postgres(options: PostgresStoreOptions = {}): PostgresStore {
     })
   }
 
-  type Query = PostgresConnection['query']
-
   /**
-   * The rows owning `ids`. This session's rows below its clear marker do
-   * not own their ids: they are deleted here so the ids can be reused.
+   * Runs `statements` (the falsy ones dropped) as one `a2_batch` call with
+   * `params`, and the session's id as `session`. Its rows come back in order;
+   * an aborted call throws what `abort` makes of the aborting row.
    */
-  const liveOwnersOf = async ({
-    query,
+  const run = async ({
     sessionId,
-    clearIndex,
-    ids,
+    statements,
+    params,
+    abort = () =>
+      new A2Error('STORE_UNAVAILABLE', 'postgres store operation failed'),
   }: {
-    query: Query
     sessionId: string
-    clearIndex: number
-    ids: readonly string[]
-  }): Promise<Record<string, unknown>[]> => {
-    if (ids.length === 0) return []
-    const { rows } = await query(
-      'select * from a2_events where event_id = any($1::text[]) order by idx',
-      [ids],
-    )
-    const stale = rows.filter(
-      (row) =>
-        row['session_id'] === sessionId && asNumber(row['idx']) < clearIndex,
-    )
-    if (stale.length === 0) return rows
-    // Never wait on a stale row: cleared work holding it may itself be
-    // waiting for the session lock this append holds.
-    const { rows: deleted } = await query(
-      `with stale as materialized (
-         select idx from a2_events
-          where session_id = $1 and event_id = any($2::text[])
-          order by idx
-          for update skip locked
-       )
-       delete from a2_events event using stale
-        where event.session_id = $1 and event.idx = stale.idx
-        returning event.idx`,
-      [sessionId, stale.map((row) => row['event_id'])],
-    )
-    if (deleted.length < stale.length) {
-      throw new A2Error(
-        'STORE_UNAVAILABLE',
-        `an event id being reused is still held by cleared work in session '${sessionId}'`,
-      )
+    statements: readonly (string | false)[]
+    params: Record<string, unknown>
+    abort?: (reason: Row) => Error
+  }): Promise<Row[]> => {
+    const c = await client()
+    try {
+      const { rows } = await c.query(BATCH, [
+        statements.flatMap((statement) =>
+          statement === false ? [] : [compact(statement)],
+        ),
+        jsonb({ ...params, session: sessionId }),
+      ])
+      return rows.map((row) => row['r'] as Row)
+    } catch (error) {
+      const reason = abortedBatch(error)
+      if (reason) throw abort(reason)
+      throw error
     }
-    return rows.filter((row) => !stale.includes(row))
   }
 
   /** Whether `index` is at or below the boundary, read in a fresh statement. */
@@ -676,240 +1642,345 @@ export function postgres(options: PostgresStoreOptions = {}): PostgresStore {
     return index <= asNumber(rows[0]?.['clear_index'])
   }
 
-  /** Insert one event; its lane is ready unless an unfinished lane event of this lifetime precedes it. */
-  const insertEvent = async ({
+  /**
+   * A completion that does not hold its head: a stale attempt, or a retry
+   * after an unknown acknowledgement, which replays the committed children.
+   * Takes no lock.
+   */
+  const settleUnheld = async ({
     query,
-    row,
-    clearIndex,
-    returning = false,
+    sessionId,
+    consumer,
+    lane,
+    index,
+    attempt,
+    events,
   }: {
     query: Query
-    row: {
-      sessionId: string
-      index: number
-      type: string
-      payload: unknown
-      id: string
-      createdAt: number
-      cause: EventCause | null
-      lane: string | null
-      processedAt: number | null
+    sessionId: string
+    consumer: string
+    lane: string | null
+    index: number
+    attempt: number
+    events: readonly ReturnedEvent[]
+  }): Promise<CompleteAttemptResult> => {
+    const superseded: CompleteAttemptResult = { outcome: 'superseded' }
+    // The cursor's latest run, and the run the head belonged to: the latest
+    // one started at or before it. A lane keeps its completions per event;
+    // a log cursor keeps its latest on the run.
+    const { rows: cursorRows } = await query(
+      `select latest.kind, latest.head, covering.completed_idx,
+              covering.completed_attempt, covering.returned_event_ids
+         from (
+           select kind, head from a2_cursors
+            where session_id = $1 and cursor_key = $2 and consumer = $3
+            order by epoch desc limit 1
+         ) latest
+         left join lateral (
+           select completed_idx, completed_attempt, returned_event_ids
+             from a2_cursors
+            where session_id = $1 and cursor_key = $2 and consumer = $3
+              and epoch <= $4
+            order by epoch desc limit 1
+         ) covering on true`,
+      [sessionId, cursorKeyOf(lane, index), consumer, index],
+    )
+    const cursor = cursorRows[0]
+    if (!cursor) {
+      if (await hasEvent(query, sessionId, index)) return superseded
+      // Deleted while this statement ran, after a clear.
+      if (await clearedAt({ query, sessionId, index })) return superseded
+      throw new TypeError(
+        `no event at index ${index} in session '${sessionId}'`,
+      )
     }
-    clearIndex: number
-    returning?: boolean
-  }): Promise<Record<string, unknown> | undefined> => {
-    const { rows } = await query(
-      `insert into a2_events
-         (session_id, idx, event_type, payload, event_id, created_at,
-          cause, lane, lane_ready, processed_at)
-       values (
-         $1, $2, $3, $4::jsonb, $5, $6, $7::jsonb, $8,
-         $8::text is null or not exists (
-           select 1 from a2_events
-            where session_id = $1 and lane = $8 and processed_at is null
-              and idx > $10
-         ),
-         $9
-       )${returning ? ' returning *' : ''}`,
-      [
-        row.sessionId,
-        row.index,
-        row.type,
-        jsonb(row.payload),
-        row.id,
-        row.createdAt,
-        row.cause ? jsonb(row.cause) : null,
-        row.lane,
-        row.processedAt,
-        clearIndex,
-      ],
+    const ids = events.map((event) => event.id)
+    if (new Set(ids).size !== ids.length) {
+      throw new A2Error(
+        'PARTIAL_DUPLICATE_BATCH',
+        'returned event batch contains the same event id more than once',
+      )
+    }
+    if (asNullableNumber(cursor['head']) === index) return superseded
+    let completion: { attempt: number | null; ids: unknown } | undefined
+    if (cursor['kind'] === 'lane') {
+      const { rows } = await query(
+        `select completed_attempt, returned_event_ids from a2_lane_events
+          where session_id = $1 and consumer = $2 and lane = $3 and idx = $4`,
+        [sessionId, consumer, lane, index],
+      )
+      completion = rows[0] && {
+        attempt: asNullableNumber(rows[0]['completed_attempt']),
+        ids: rows[0]['returned_event_ids'],
+      }
+    } else if (asNullableNumber(cursor['completed_idx']) === index) {
+      completion = {
+        attempt: asNullableNumber(cursor['completed_attempt']),
+        ids: cursor['returned_event_ids'],
+      }
+    }
+    if (!completion || completion.attempt !== attempt) return superseded
+    const returnedIds =
+      completion.ids === null || completion.ids === undefined
+        ? null
+        : decodeReturnedEventIds(completion.ids)
+    if (
+      returnedIds === null ||
+      returnedIds.length !== ids.length ||
+      returnedIds.some((id, offset) => id !== ids[offset])
+    ) {
+      throw new A2Error(
+        'PARTIAL_DUPLICATE_BATCH',
+        'completed attempt does not match the returned event batch',
+      )
+    }
+    if (events.length === 0) return { outcome: 'completed', events: [] }
+    const { rows: existing } = await query(
+      `select session_id, idx, event_type, payload, event_id, created_at, cause
+         from a2_events where event_id = any($1::text[])`,
+      [ids],
+    )
+    const byId = new Map(
+      existing.map((row) => [row['event_id'] as string, row]),
+    )
+    const ordered = ids.map((id) => byId.get(id))
+    if (
+      ordered.some((row) => !row) &&
+      (await clearedAt({ query, sessionId, index }))
     )
-    return rows[0]
+      return superseded
+    if (
+      ordered.some((row) => {
+        const cause = row ? decodeCause(row['cause']) : null
+        return (
+          !row ||
+          row['session_id'] !== sessionId ||
+          cause?.consumer !== consumer ||
+          cause.lane !== lane ||
+          cause.index !== index ||
+          cause.attempt !== attempt
+        )
+      })
+    ) {
+      throw new A2Error(
+        'PARTIAL_DUPLICATE_BATCH',
+        'returned event retry does not match the committed batch',
+      )
+    }
+    return {
+      outcome: 'completed',
+      events: idempotentReplay(events, (ordered as Row[]).map(toStored)),
+    }
   }
 
   const store: PostgresStore = {
     async append(sessionId, events, appendOptions) {
+      const consumers = appendOptions?.consumers
+      const served = servedNames(consumers)
       if (events.length === 0) {
-        return wrap(async () => {
-          const c = await client()
-          const { rows } = await c.query(
-            `select exists(
-               select 1 from a2_events
-               where session_id = $1 and processed_at is null
-                 and idx > ${clearIndexOf('$1')}
-             ) as has_pending`,
-            [sessionId],
-          )
-          return {
-            events: [],
-            hasPending: rows[0]?.['has_pending'] === true,
-          }
-        })
-      }
-      return wrap(() =>
-        withTx(async (query) => {
-          // Serialize appends per session — index assignment must not
-          // race across writers. Transaction-scoped, self-releasing.
-          await query('select pg_advisory_xact_lock(hashtext($1))', [sessionId])
-          const { rows: statusRows } = await query(
-            `select coalesce(max(idx), 0) as max,
-                    ${clearIndexOf('$1')} as clear_index,
-                    exists(
-                      select 1 from a2_events pending
-                      where pending.session_id = $1
-                        and pending.processed_at is null
-                        and pending.idx > ${clearIndexOf('$1')}
-                    ) as session_has_pending
-               from a2_events
-              where session_id = $1`,
-            [sessionId],
-          )
-          const base = asNumber(statusRows[0]?.['max'])
-          const clearIndex = asNumber(statusRows[0]?.['clear_index'])
-          const sessionHasPending =
-            statusRows[0]?.['session_has_pending'] === true
-
-          const supplied = events.filter((e) => e.id !== undefined)
-          const suppliedIds = supplied.map((e) => e.id as string)
-          if (new Set(suppliedIds).size !== suppliedIds.length) {
-            throw new A2Error(
-              'PARTIAL_DUPLICATE_BATCH',
-              'batch contains the same event id more than once',
-            )
-          }
-          if (suppliedIds.length > 0) {
-            const existing = await liveOwnersOf({
-              query,
-              sessionId,
-              clearIndex,
-              ids: suppliedIds,
-            })
-            if (existing.length > 0) {
-              const foreign = existing.find(
-                (row) => row['session_id'] !== sessionId,
-              )
-              if (foreign) {
-                throw new A2Error(
-                  'PARTIAL_DUPLICATE_BATCH',
-                  `event id '${String(foreign['event_id'])}' already exists in another session`,
-                )
-              }
-              if (existing.length === events.length) {
-                return {
-                  events: idempotentReplay(events, existing.map(toStored)),
-                  hasPending: sessionHasPending,
-                }
-              }
-              throw new A2Error(
-                'PARTIAL_DUPLICATE_BATCH',
-                `batch mixes ${existing.length} already-appended and ${events.length - existing.length} fresh events`,
-              )
-            }
-          }
-
-          const originIndex = appendOptions?.originIndex
-          if (originIndex !== undefined && originIndex <= clearIndex) {
-            throw sessionClearedError(
-              `scheduled work from event ${originIndex} was cleared in session '${sessionId}'`,
-            )
-          }
-          for (const e of events) {
-            if (e.cause && e.cause.index <= clearIndex)
-              throw supersededAttemptError(sessionId, e.cause)
+        return wrap(async () => {
+          const c = await client()
+          const { rows } = await c.query(
+            `select ${pendingIn('$1', '$2')} as has_pending`,
+            [sessionId, served],
+          )
+          return {
+            events: [],
+            hasPending: rows[0]?.['has_pending'] === true,
           }
-          // Attempt-currency fence: a fresh handler append commits only
-          // while its causal attempt is still the parent's latest
-          // (store.ts `append`). `for update` serializes this read against
-          // a concurrent `claimAvailable` — an unlocked read admits write
-          // skew.
-          const causeIndexes = [
-            ...new Set(
-              events
-                .filter((e) => e.cause !== undefined)
-                .map((e) => e.cause!.index),
+        })
+      }
+      return wrap(async () => {
+        const supplied = events.filter((e) => e.id !== undefined)
+        const suppliedIds = supplied.map((e) => e.id as string)
+        if (new Set(suppliedIds).size !== suppliedIds.length) {
+          throw new A2Error(
+            'PARTIAL_DUPLICATE_BATCH',
+            'batch contains the same event id more than once',
+          )
+        }
+        const now = clock.now().getTime()
+        const rows = events.map((event, offset) => ({
+          ord: offset + 1,
+          id: event.id ?? generateId(),
+          type: event.type,
+          payload: event.payload,
+          cause: event.cause ?? null,
+        }))
+        const causes = [
+          ...new Map(
+            events.flatMap((event) =>
+              event.cause ? [[jsonb(event.cause), event.cause] as const] : [],
             ),
-          ]
-          if (causeIndexes.length > 0) {
-            const { rows: parents } = await query(
-              `select idx, attempt_count, failed_at from a2_events
-                where session_id = $1 and idx = any($2::bigint[])
-                for update`,
-              [sessionId, causeIndexes],
-            )
-            const byIndex = new Map(
-              parents.map((row) => [asNumber(row['idx']), row]),
-            )
-            for (const e of events) {
-              if (!e.cause) continue
-              const parent = byIndex.get(e.cause.index)
-              if (!parent) {
-                throw new TypeError(
-                  `no event at index ${e.cause.index} in session '${sessionId}'`,
+          ).values(),
+        ]
+        const work = enqueue(events, consumers)
+        const originIndex = appendOptions?.originIndex
+        // One round trip, holding the session lock only while the server
+        // runs it: index assignment must not race across writers.
+        const results = await run({
+          sessionId,
+          statements: [
+            LOCK_SESSION,
+            APPEND_CHECKS,
+            causes.length > 0 && FENCE,
+            suppliedIds.length > 0 && REUSE_IDS,
+            INSERT_EVENTS,
+            ...work.statements,
+          ],
+          params: {
+            ...work.params,
+            served,
+            ids: suppliedIds,
+            count: events.length,
+            origin: originIndex ?? null,
+            // Attempt-currency fence: a fresh consumer append commits only
+            // while its causal attempt still owns the cursor's head
+            // (store.ts `append`).
+            causes: causes.map((cause, offset) => ({
+              ord: offset + 1,
+              consumer: cause.consumer,
+              cursor_key: cursorKeyOf(cause.lane, cause.index),
+              idx: cause.index,
+              attempt: cause.attempt,
+            })),
+            events: rows,
+            now,
+          },
+          abort: (reason) => {
+            switch (reason['abort']) {
+              case 'foreign':
+                return new A2Error(
+                  'PARTIAL_DUPLICATE_BATCH',
+                  `event id '${String(reason['event_id'])}' already exists in another session`,
+                )
+              case 'mixed': {
+                const owned = asNumber(reason['owned'])
+                return new A2Error(
+                  'PARTIAL_DUPLICATE_BATCH',
+                  `batch mixes ${owned} already-appended and ${events.length - owned} fresh events`,
                 )
               }
-              if (
-                asNumber(parent['attempt_count']) !== e.cause.attempt ||
-                parent['failed_at'] !== null
-              ) {
-                throw supersededAttemptError(sessionId, e.cause)
-              }
+              case 'cleared':
+                return sessionClearedError(
+                  `scheduled work from event ${originIndex} was cleared in session '${sessionId}'`,
+                )
+              case 'superseded':
+                return supersededAttemptError(
+                  sessionId,
+                  causes[asNumber(reason['ord']) - 1]!,
+                )
+              case 'held':
+                return new A2Error(
+                  'STORE_UNAVAILABLE',
+                  `an event id being reused is still held by cleared work in session '${sessionId}'`,
+                )
+              default:
+                return new A2Error(
+                  'STORE_UNAVAILABLE',
+                  'postgres store operation failed',
+                )
             }
+          },
+        })
+        const checked = results.find(
+          (row) => row['stop'] === 'replay' || 'base' in row,
+        )!
+        if (checked['stop'] === 'replay') {
+          return {
+            events: idempotentReplay(
+              events,
+              (checked['events'] as Row[]).map(toStored),
+            ),
+            hasPending: checked['has_pending'] === true,
           }
+        }
+        return {
+          events: insertedRows({
+            sessionId,
+            events: rows,
+            base: asNumber(checked['base']),
+            now,
+          }),
+          hasPending: checked['has_pending'] === true || work.started,
+        }
+      })
+    },
 
-          const now = clock.now().getTime()
-          const inserted: StoredEvent[] = []
-          for (let i = 0; i < events.length; i += 1) {
-            const e = events[i]!
-            const id = e.id ?? generateId()
-            const index = base + 1 + i
-            // oxlint-disable-next-line no-await-in-loop -- one tx, ordered inserts
-            await insertEvent({
-              query,
-              row: {
-                sessionId,
-                index,
-                type: e.type,
-                payload: e.payload,
-                id,
-                createdAt: now,
-                cause: e.cause ?? null,
-                lane: e.lane ?? null,
-                processedAt: e.settled ? now : null,
-              },
-              clearIndex,
-            })
-            inserted.push({
-              id,
-              type: e.type,
-              payload: structuredClone(e.payload),
-              index,
-              sessionId,
-              createdAt: new Date(now),
-              cause: e.cause ? { ...e.cause } : null,
-              lane: e.lane ?? null,
-              processedAt: e.settled ? new Date(now) : null,
-              processedByAttempt: null,
-              returnedEventIds: null,
-              firstClaimedAt: null,
-              lastClaimedAt: null,
-              attemptCount: 0,
-              failureCount: 0,
-              lastFailedAt: null,
-              lastFailedAttempt: null,
-              lastError: null,
-              failedAt: null,
-              claimHolder: null,
-              claimExpiresAt: null,
-            })
-          }
+    async wakeLog({ sessionId, consumer }) {
+      const { log } = consumer
+      return wrap(async () => {
+        // A read that finds nothing to write needs no lock: the cursor and
+        // the head come from one snapshot. Otherwise the session lock comes
+        // first, as an append takes it: the log and the cursor's runs hold
+        // still, and no cursor row is waited on after.
+        const results = await run({
+          sessionId,
+          statements: [READ_LOG, LOCK_SESSION, WAKE_LOG],
+          params: {
+            cursorKey: cursorKeyOf(log.lane, 0),
+            consumer: consumer.name,
+            lane: log.lane,
+            types: log.types,
+            backfill: log.backfill,
+            clearType: CLEAR_EVENT_TYPE,
+          },
+        })
+        const found = results.at(-1)!
+        // Nothing after the latest clear: a missing cursor stays missing.
+        if (found['empty'] === true) {
+          const head = asNumber(found['head'])
           return {
-            events: inserted,
-            hasPending:
-              sessionHasPending ||
-              events.some((event) => event.settled !== true),
+            cursor: idleLogCursor(consumer.name, log.lane, head),
+            head,
           }
-        }),
-      )
+        }
+        const cursor = found['cursor'] as Row
+        const clearIndex = asNumber(
+          found['stop'] === 'unchanged'
+            ? cursor['clear_index']
+            : found['clear_index'],
+        )
+        return {
+          cursor: toCursor(cursor, clearIndex),
+          head: asNumber(
+            found['stop'] === 'unchanged'
+              ? cursor['session_head']
+              : found['head'],
+          ),
+        }
+      })
+    },
+
+    async cursors(sessionId) {
+      return wrap(async () => {
+        const c = await client()
+        const { rows } = await c.query(
+          `with boundary as materialized (
+             select ${clearIndexOf('$1')} as clear_index
+           )
+           select cur.*, boundary.clear_index
+             from a2_cursors cur, boundary
+            where cur.session_id = $1
+              and (
+                cur.head > boundary.clear_index
+                or (cur.kind <> 'event' and not exists (
+                  select 1 from a2_cursors later
+                   where later.session_id = cur.session_id
+                     and later.cursor_key = cur.cursor_key
+                     and later.consumer = cur.consumer
+                     and later.epoch > cur.epoch
+                ) and (
+                  cur.kind = 'log'
+                  or (cur.head is null and cur.position > boundary.clear_index)
+                ))
+              )`,
+          [sessionId],
+        )
+        return rows
+          .map((row) => toCursor(row, asNumber(row['clear_index'])))
+          .toSorted(byCursor)
+      })
     },
 
     async read(sessionId, opts) {
@@ -928,7 +1999,8 @@ export function postgres(options: PostgresStoreOptions = {}): PostgresStore {
         // Reads start at the latest clear marker.
         conditions.push(`idx >= ${clearIndexOf('$1')}`)
         const { rows } = await c.query(
-          `select * from a2_events where ${conditions.join(' and ')} order by idx`,
+          `select session_id, idx, event_type, payload, event_id, created_at, cause
+             from a2_events where ${conditions.join(' and ')} order by idx`,
           params,
         )
         return rows.map(toStored)
@@ -969,91 +2041,71 @@ export function postgres(options: PostgresStoreOptions = {}): PostgresStore {
       holder,
       ttlMs,
       expiresAtMs,
-      excludeIndexes = [],
+      exclude = [],
+      consumers,
       maxFailures,
+      through,
     }) {
-      return wrap(() =>
-        withTx(async (query) => {
-          const now = clock.now().getTime()
-          const expiresAt = expiresAtMs ?? now + ttlMs
-          // A lapsed claim's takeover that spends the last failed attempt
-          // dead-letters the event instead of claiming it.
-          const exhausted = `(claimed.claim_holder is not null
-               and claimed.failure_count + 1 >= $6::int)`
-          const { rows } = await query(
-            `with eligible as materialized (
-               select event.idx
-                 from a2_events event
-                where event.session_id = $1
-                  and event.processed_at is null
-                  and event.failed_at is null
-                  and event.lane_ready
-                  and event.idx > ${clearIndexOf('$1')}
-                  and (event.claim_expires_at is null or event.claim_expires_at <= $2)
-                  and not (event.idx = any($5::bigint[]))
-                for update of event
-             )
-             update a2_events claimed set
-               attempt_count = claimed.attempt_count + 1,
-               failure_count = claimed.failure_count
-                 + case when claimed.claim_holder is null then 0 else 1 end,
-               failed_at = case when ${exhausted} then $2::bigint else claimed.failed_at end,
-               first_claimed_at = case when ${exhausted}
-                 then claimed.first_claimed_at
-                 else coalesce(claimed.first_claimed_at, $2::bigint) end,
-               last_claimed_at = case when ${exhausted}
-                 then claimed.last_claimed_at else $2::bigint end,
-               claim_holder = case when ${exhausted} then null else $3::text end,
-               claim_expires_at = case when ${exhausted} then null else $4::bigint end
-             from eligible
-             where claimed.session_id = $1 and claimed.idx = eligible.idx
-             returning claimed.*, ${clearIndexOf('$1')} as clear_index`,
-            [
-              sessionId,
-              now,
-              holder,
-              expiresAt,
-              [...excludeIndexes],
-              maxFailures ?? null,
-            ],
+      return wrap(async () => {
+        const now = clock.now().getTime()
+        const results = await run({
+          sessionId,
+          statements: [CLAIM, RELEASE_DEAD, RETRY_AT],
+          params: {
+            now,
+            served: servedNames(consumers),
+            excluded: exclude.map((ref) => ({
+              consumer: ref.consumer,
+              cursor_key: cursorKeyOf(ref.lane, ref.index),
+            })),
+            holder,
+            expiresAt: expiresAtMs ?? now + ttlMs,
+            maxFailures: maxFailures ?? null,
+            through: through ?? null,
+          },
+        })
+        const rows = results.filter((row) => 'e_idx' in row)
+        const unseen = rows.filter((row) => row['e_idx'] === null)
+        if (unseen.length > 0) {
+          // The claim waited on these rows while they moved to events that
+          // committed after its snapshot. A fresh read finds them; one it
+          // doesn't was cleared and reclaimed, and its claim is superseded.
+          const c = await client()
+          const { rows: events } = await c.query(
+            `select ${HEAD_COLUMNS} from a2_events event
+              where event.session_id = $1 and event.idx = any($2::bigint[])`,
+            [sessionId, unseen.map((row) => row['head'])],
           )
-          for (const row of rows) {
-            if (row['failed_at'] !== null)
-              await releasePins({
-                query,
-                sessionId,
-                index: asNumber(row['idx']),
-              })
-          }
-          if (rows.length > 0) {
-            const events = rows
-              .map((row) => {
-                const stored = toStored(row)
-                const clearIndex = asNumber(row['clear_index'])
-                if (clearIndex > 0) stored.clearIndex = clearIndex
-                return stored
-              })
-              .toSorted((a, b) => a.index - b.index)
-            return { outcome: 'claimed', events }
-          }
-          const { rows: activeRows } = await query(
-            `select min(claim_expires_at) as retry_at
-               from a2_events
-              where session_id = $1
-                and processed_at is null
-                and failed_at is null
-                and lane_ready
-                and idx > ${clearIndexOf('$1')}
-                and claim_expires_at > $2
-                and not (idx = any($3::bigint[]))`,
-            [sessionId, now, [...excludeIndexes]],
+          const byIndex = new Map(
+            events.map((event) => [asNumber(event['e_idx']), event]),
           )
-          const retryAt = activeRows[0]?.['retry_at']
-          return retryAt === null || retryAt === undefined
-            ? { outcome: 'settled' }
-            : { outcome: 'busy', retryAt: new Date(asNumber(retryAt)) }
-        }),
-      )
+          for (const row of unseen)
+            Object.assign(row, byIndex.get(asNumber(row['head'])))
+        }
+        const heads = rows.filter((row) => row['e_idx'] !== null)
+        if (heads.length > 0) {
+          const events = heads
+            .map((row) => {
+              const head = toHead(row)
+              const clearIndex = asNumber(row['clear_index'])
+              if (clearIndex > 0) head.clearIndex = clearIndex
+              return head
+            })
+            .toSorted(byHead)
+          return {
+            outcome: 'claimed',
+            events,
+            head: Math.max(
+              ...heads.map((row) => asNumber(row['session_head'])),
+              ...events.map((event) => event.index),
+            ),
+          }
+        }
+        const retryAt = results.at(-1)!['retry_at']
+        return retryAt === null || retryAt === undefined
+          ? { outcome: 'settled' }
+          : { outcome: 'busy', retryAt: new Date(asNumber(retryAt)) }
+      })
     },
 
     async renewClaims({ sessionId, holder, claims, ttlMs, expiresAtMs }) {
@@ -1062,320 +2114,274 @@ export function postgres(options: PostgresStoreOptions = {}): PostgresStore {
         const c = await client()
         const now = clock.now().getTime()
         const expiresAt = expiresAtMs ?? now + ttlMs
-        const indexes = claims.map((claim) => claim.index)
-        const attempts = new Map(
-          claims.map((claim) => [claim.index, claim.attempt]),
+        const ordered = claims.toSorted(
+          (a, b) => a.index - b.index || compareText(a.consumer, b.consumer),
         )
         const { rows } = await c.query(
           `with listed as (
-             select idx, attempt
-               from unnest($3::bigint[], $6::int[]) as listed(idx, attempt)
-           ),
-           renewed as (
-             update a2_events event set claim_expires_at = $1
+             select * from unnest($3::text[], $4::text[], $5::bigint[], $6::int[])
+               with ordinality as listed(consumer, cursor_key, idx, attempt, ord)
+           ), renewed as (
+             update a2_cursors cur set claim_expires_at = $7
                from listed
-              where event.session_id = $2
-                and event.idx = listed.idx
-                and event.idx > ${clearIndexOf('$2')}
-                and event.attempt_count = listed.attempt
-                and event.processed_at is null
-                and event.failed_at is null
-                and event.claim_holder = $4
-                and event.claim_expires_at > $5
-              returning event.idx
+              where cur.session_id = $1
+                and cur.cursor_key = listed.cursor_key
+                and cur.consumer = listed.consumer
+                and cur.head = listed.idx
+                and listed.idx > ${clearIndexOf('$1')}
+                and cur.attempt_count = listed.attempt
+                and cur.failed_at is null
+                and cur.claim_holder = $2
+                and cur.claim_expires_at > $8
+              returning cur.cursor_key, cur.consumer, cur.head
            )
-           select listed.idx, event.attempt_count,
-                  exists(select 1 from renewed where renewed.idx = listed.idx)
-                    as renewed,
-                  listed.idx <= ${clearIndexOf('$2')} as cleared
+           select listed.ord, latest.head, latest.position, latest.attempt_count,
+                  latest.epoch is not null as found,
+                  exists(
+                    select 1 from renewed
+                     where renewed.cursor_key = listed.cursor_key
+                       and renewed.consumer = listed.consumer
+                       and renewed.head = listed.idx
+                  ) as renewed,
+                  listed.idx <= ${clearIndexOf('$1')} as cleared
              from listed
-             left join a2_events event
-               on event.session_id = $2 and event.idx = listed.idx`,
+             left join lateral (
+               select cur.epoch, cur.head, cur.position, cur.attempt_count
+                 from a2_cursors cur
+                where cur.session_id = $1
+                  and cur.cursor_key = listed.cursor_key
+                  and cur.consumer = listed.consumer
+                order by cur.epoch desc limit 1
+             ) latest on true
+            order by listed.ord`,
           [
-            expiresAt,
             sessionId,
-            indexes,
             holder,
+            ordered.map((claim) => claim.consumer),
+            ordered.map((claim) => cursorKeyOf(claim.lane, claim.index)),
+            ordered.map((claim) => claim.index),
+            ordered.map((claim) => claim.attempt),
+            expiresAt,
             now,
-            claims.map((claim) => claim.attempt),
           ],
         )
-        const renewed: number[] = []
-        const superseded: number[] = []
+        const renewed: HeadRef[] = []
+        const superseded: HeadRef[] = []
         for (const row of rows) {
-          const index = asNumber(row['idx'])
-          if (row['renewed'] === true) renewed.push(index)
-          else if (
-            row['cleared'] === true ||
-            (row['attempt_count'] !== null &&
-              asNumber(row['attempt_count']) > (attempts.get(index) ?? 0))
-          ) {
-            superseded.push(index)
+          const { attempt, ...ref } = ordered[asNumber(row['ord']) - 1]!
+          if (row['renewed'] === true) {
+            renewed.push(ref)
+            continue
           }
+          if (row['cleared'] === true) {
+            superseded.push(ref)
+            continue
+          }
+          if (row['found'] !== true) continue
+          const head = asNullableNumber(row['head'])
+          // An event the cursor has not reached yet holds no claim to renew.
+          if (head !== ref.index && asNumber(row['position']) < ref.index)
+            continue
+          if (head !== ref.index || asNumber(row['attempt_count']) > attempt)
+            superseded.push(ref)
         }
-        return {
-          renewed: renewed.toSorted((a, b) => a - b),
-          superseded: superseded.toSorted((a, b) => a - b),
-        }
+        return { renewed, superseded }
       })
     },
 
-    async completeAttempt({ sessionId, index, attempt, events }) {
-      return wrap(() =>
-        withTx(async (query) => {
-          const { rows: parentRows } = await query(
-            `select boundary.clear_index, parent.*
-               from (select ${clearIndexOf('$1')} as clear_index) boundary
-               left join lateral (
-                 select * from a2_events
-                  where session_id = $1 and idx = $2 and idx > boundary.clear_index
-                  for update
-               ) parent on true`,
-            [sessionId, index],
-          )
-          if (index <= asNumber(parentRows[0]?.['clear_index']))
-            return { outcome: 'superseded' }
-          const parent =
-            parentRows[0]?.['idx'] == null ? undefined : parentRows[0]
-          if (!parent) {
-            // Deleted while this statement waited for its lock, after a clear.
-            if (await clearedAt({ query, sessionId, index }))
-              return { outcome: 'superseded' }
-            throw new TypeError(
-              `no event at index ${index} in session '${sessionId}'`,
-            )
-          }
-          const ids = events.map((event) => event.id)
-          if (new Set(ids).size !== ids.length) {
-            throw new A2Error(
-              'PARTIAL_DUPLICATE_BATCH',
-              'returned event batch contains the same event id more than once',
-            )
-          }
-          if (parent['processed_at'] !== null) {
-            if (asNumber(parent['processed_by_attempt']) !== attempt) {
-              return { outcome: 'superseded' }
-            }
-            const returnedIds =
-              parent['returned_event_ids'] === null ||
-              parent['returned_event_ids'] === undefined
-                ? null
-                : decodeReturnedEventIds(parent['returned_event_ids'])
-            if (
-              returnedIds === null ||
-              returnedIds.length !== ids.length ||
-              returnedIds.some((id, offset) => id !== ids[offset])
-            ) {
-              throw new A2Error(
-                'PARTIAL_DUPLICATE_BATCH',
-                'completed attempt does not match the returned event batch',
-              )
-            }
-            if (events.length === 0) {
-              return { outcome: 'completed', events: [] }
-            }
-            const { rows: existing } = await query(
-              `select * from a2_events
-                where event_id = any($1::text[])`,
-              [ids],
-            )
-            const byId = new Map(
-              existing.map((row) => [row['event_id'] as string, row]),
-            )
-            const ordered = ids.map((id) => byId.get(id))
-            if (
-              ordered.some((row) => !row) &&
-              (await clearedAt({ query, sessionId, index }))
-            )
-              return { outcome: 'superseded' }
-            if (
-              ordered.some((row) => {
-                const cause = row ? toCause(row['cause']) : null
-                return (
-                  !row ||
-                  row['session_id'] !== sessionId ||
-                  cause?.index !== index ||
-                  cause.attempt !== attempt
+    /*
+     * One round trip. The cursor's lock comes first, and only while this
+     * attempt holds the head (`HOLD`): a completion waiting on a write-back
+     * holds nothing a push needs, and a cleared head is never locked. A
+     * completion that returns events then takes the session lock to give them
+     * indexes, as an append does.
+     *
+     * One that returns none takes the session lock only when its lane or log
+     * cursor would go idle (`LOCK_IF_IDLE`), the one case that needs it: an
+     * append that finds a cursor with a head leaves its events to the
+     * cursor's next head, so a cursor going idle must see every append that
+     * committed before, or that work would wait with no head to run it.
+     * Moving to a next head needs no lock, because the head it reads is the
+     * one it would read under the lock:
+     *
+     * - Every insert into `a2_events` and `a2_lane_events` holds the session
+     *   lock through its commit, so they commit in index order: a snapshot
+     *   that sees the next head sees every event before it, and nothing
+     *   committed later lies before it.
+     * - Only a holder of the cursor's lock marks its lane's events done, and
+     *   rows go away only below a clear marker, which `COMPLETE` reads in the
+     *   snapshot it reads the next head in: cleared, it writes nothing. A
+     *   clear that commits after that snapshot puts its marker past the next
+     *   head, which a later append then treats as cleared.
+     *
+     * A concurrent cursor has no next head and no append touches its row, so
+     * it never takes the session lock.
+     */
+    async completeAttempt({
+      sessionId,
+      consumer,
+      lane,
+      index,
+      attempt,
+      events,
+      consumers,
+    }) {
+      return wrap(async () => {
+        const ids = events.map((event) => event.id)
+        const duplicated = new Set(ids).size !== ids.length
+        const cause: EventCause = { consumer, lane, index, attempt }
+        const now = clock.now().getTime()
+        const rows = events.map((event, offset) => ({
+          ord: offset + 1,
+          id: event.id,
+          type: event.type,
+          payload: event.payload,
+          cause,
+        }))
+        const work =
+          events.length > 0 && !duplicated
+            ? enqueue(events, consumers)
+            : undefined
+        const results = await run({
+          sessionId,
+          statements: duplicated
+            ? [HOLD]
+            : work
+              ? [
+                  HOLD,
+                  LOCK_SESSION,
+                  RETURN_CHECKS,
+                  REUSE_IDS,
+                  INSERT_EVENTS,
+                  ...work.statements,
+                  COMPLETE_APPENDED,
+                ]
+              : [HOLD, LOCK_IF_IDLE, COMPLETE],
+          params: {
+            ...work?.params,
+            ...retypeOf(consumer, consumers),
+            cursorKey: cursorKeyOf(lane, index),
+            consumer,
+            index,
+            attempt,
+            ids,
+            count: events.length,
+            events: rows,
+            now,
+            clearType: CLEAR_EVENT_TYPE,
+          },
+          abort: (reason) =>
+            reason['abort'] === 'owned'
+              ? new A2Error(
+                  'PARTIAL_DUPLICATE_BATCH',
+                  'returned event batch contains an already-appended event id',
                 )
-              })
-            ) {
-              throw new A2Error(
-                'PARTIAL_DUPLICATE_BATCH',
-                'returned event retry does not match the committed batch',
-              )
-            }
-            return {
-              outcome: 'completed',
-              events: idempotentReplay(
-                events,
-                (ordered as Record<string, unknown>[]).map(toStored),
-              ),
-            }
-          }
-          if (
-            asNumber(parent['attempt_count']) !== attempt ||
-            parent['claim_holder'] === null ||
-            parent['claim_holder'] === undefined ||
-            parent['failed_at'] !== null
-          ) {
-            return { outcome: 'superseded' }
-          }
-
-          // The parent lock came first; only a statement after the session
-          // lock sees every clear that committed while this one waited.
-          await query('select pg_advisory_xact_lock(hashtext($1))', [sessionId])
-          const { rows: maxRows } = await query(
-            `select coalesce(max(idx), 0) as max, ${clearIndexOf('$1')} as clear_index
-               from a2_events where session_id = $1`,
-            [sessionId],
+              : new A2Error(
+                  'STORE_UNAVAILABLE',
+                  reason['abort'] === 'held'
+                    ? `an event id being reused is still held by cleared work in session '${sessionId}'`
+                    : 'postgres store operation failed',
+                ),
+        })
+        const held = results[0]!
+        if (held['stop'] === 'superseded') return { outcome: 'superseded' }
+        if (held['stop'] === 'unheld') {
+          const c = await client()
+          return settleUnheld({
+            query: (text, values) => c.query(text, values),
+            sessionId,
+            consumer,
+            lane,
+            index,
+            attempt,
+            events,
+          })
+        }
+        if (duplicated) {
+          throw new A2Error(
+            'PARTIAL_DUPLICATE_BATCH',
+            'returned event batch contains the same event id more than once',
           )
-          const clearIndex = asNumber(maxRows[0]?.['clear_index'])
-          if (index <= clearIndex) return { outcome: 'superseded' }
-          if (ids.length > 0) {
-            const existing = await liveOwnersOf({
-              query,
-              sessionId,
-              clearIndex,
-              ids,
-            })
-            if (existing.length > 0) {
-              throw new A2Error(
-                'PARTIAL_DUPLICATE_BATCH',
-                'returned event batch contains an already-appended event id',
-              )
-            }
-          }
-
-          const base = asNumber(maxRows[0]?.['max'])
-          const now = clock.now().getTime()
-          const inserted: StoredEvent[] = []
-          for (let offset = 0; offset < events.length; offset += 1) {
-            const event = events[offset]!
-            const childIndex = base + offset + 1
-            // oxlint-disable-next-line no-await-in-loop -- one tx, ordered inserts
-            const row = await insertEvent({
-              query,
-              row: {
+        }
+        if (results.at(-1)!['stop'] === 'superseded')
+          return { outcome: 'superseded' }
+        const checked = results.find((row) => 'base' in row)
+        return {
+          outcome: 'completed',
+          events: checked
+            ? insertedRows({
                 sessionId,
-                index: childIndex,
-                type: event.type,
-                payload: event.payload,
-                id: event.id,
-                createdAt: now,
-                cause: { index, attempt },
-                lane: event.lane ?? null,
-                processedAt: event.settled ? now : null,
-              },
-              clearIndex,
-              returning: true,
-            })
-            inserted.push(toStored(row!))
-          }
-          await query(
-            `update a2_events set
-               processed_at = $1,
-               processed_by_attempt = $2,
-               returned_event_ids = $5::jsonb,
-               lane_ready = false,
-               claim_holder = null,
-               claim_expires_at = null
-             where session_id = $3 and idx = $4`,
-            [now, attempt, sessionId, index, jsonb(ids)],
-          )
-          await query(
-            `delete from a2_snapshot_pins
-              where session_id = $1 and event_index = $2`,
-            [sessionId, index],
-          )
-          await query(
-            `delete from a2_snapshot_history history
-              where history.session_id = $1
-                and not exists (
-                  select 1 from a2_snapshot_pins pin
-                   where pin.session_id = history.session_id
-                     and pin.reducer_name = history.reducer_name
-                     and pin.up_to_index = history.up_to_index
-                )`,
-            [sessionId],
-          )
-          const parentLane = (parent['lane'] as string | null) ?? null
-          if (parentLane !== null) {
-            await query(
-              `update a2_events set lane_ready = true
-                where session_id = $1
-                  and idx = (
-                    select idx from a2_events
-                     where session_id = $1 and lane = $2 and processed_at is null
-                       and idx > $3
-                     order by idx limit 1
-                  )`,
-              [sessionId, parentLane, clearIndex],
-            )
-          }
-          return { outcome: 'completed', events: inserted }
-        }),
-      )
+                events: rows,
+                base: asNumber(checked['base']),
+                now,
+              })
+            : [],
+        }
+      })
     },
 
     async failAttempt({
       sessionId,
+      consumer,
+      lane,
       index,
       attempt,
       error,
       maxFailures,
       retryAfterMs,
     }) {
-      const now = clock.now().getTime()
       return wrap(() =>
         withTx(async (query) => {
+          const now = clock.now().getTime()
+          const cursorKey = cursorKeyOf(lane, index)
           const { rows } = await query(
             `with current as materialized (
-             select e.* from a2_events e
-             where e.session_id = $1 and e.idx = $2
-               and e.idx > ${clearIndexOf('$1')}
-             for update of e
+             select cur.* from a2_cursors cur
+              where cur.session_id = $1 and cur.cursor_key = $2
+                and cur.consumer = $3 and cur.head = $4
+                and cur.head > ${clearIndexOf('$1')}
+              for update of cur
            ), updated as (
-             update a2_events e set
-               failure_count = e.failure_count + 1,
-               last_error = $4,
-               last_failed_at = $6,
-               last_failed_attempt = $3,
+             update a2_cursors cur set
+               failure_count = cur.failure_count + 1,
+               last_error = $6,
+               last_failed_at = $8,
+               last_failed_attempt = $5,
                failed_at = case
-                 when e.failure_count + 1 >= $5 then $6
-                 else e.failed_at
+                 when cur.failure_count + 1 >= $7 then $8
+                 else cur.failed_at
                end,
                claim_holder = null,
                claim_expires_at = case
-                 when e.failure_count + 1 >= $5 then null
-                 else $7::bigint
+                 when cur.failure_count + 1 >= $7 then null
+                 else $9::bigint
                end
              from current
-             where e.session_id = $1
-               and e.idx = $2
-               and current.processed_at is null
+             where cur.session_id = $1 and cur.cursor_key = $2
+               and cur.consumer = $3 and cur.epoch = current.epoch
+               and current.attempt_count = $5
                and current.failed_at is null
-               and current.attempt_count = $3
                and current.claim_holder is not null
-             returning e.failure_count, e.failed_at
+             returning cur.failure_count, cur.failed_at
            )
            select case
-             when $2 <= ${clearIndexOf('$1')} then 'cleared'
+             when $4 <= ${clearIndexOf('$1')} then 'cleared'
              when not exists (select 1 from current) then 'missing'
              when exists (
                select 1 from updated where failed_at is not null
              ) then 'dead_lettered'
              when exists (select 1 from updated) then 'failed'
              when exists (
-               select 1 from current
-               where processed_at is not null or attempt_count <> $3
+               select 1 from current where attempt_count <> $5
              ) then 'superseded'
-             when exists (
-               select 1 from current where failed_at is not null
-             ) then 'dead_lettered'
              when exists (
                select 1 from current
-                where claim_holder is null and last_failed_attempt = $3
+                where claim_holder is null and last_failed_attempt = $5
+                  and failed_at is null
              ) then 'failed'
+             when exists (
+               select 1 from current where failed_at is not null
+             ) then 'dead_lettered'
              else 'superseded'
            end as outcome,
            coalesce(
@@ -1384,6 +2390,8 @@ export function postgres(options: PostgresStoreOptions = {}): PostgresStore {
            ) as failure_count`,
             [
               sessionId,
+              cursorKey,
+              consumer,
               index,
               attempt,
               error,
@@ -1397,15 +2405,24 @@ export function postgres(options: PostgresStoreOptions = {}): PostgresStore {
             return { outcome: 'superseded', failureCount: 0 }
           }
           if (!row || row['outcome'] === 'missing') {
-            // Deleted while this statement waited for its lock, after a clear.
-            if (await clearedAt({ query, sessionId, index }))
+            const { rows: cursorRows } = await query(
+              `select 1 from a2_cursors
+                where session_id = $1 and cursor_key = $2 and consumer = $3`,
+              [sessionId, cursorKey, consumer],
+            )
+            if (
+              cursorRows.length > 0 ||
+              (await hasEvent(query, sessionId, index)) ||
+              // Deleted while this statement waited for its lock, after a clear.
+              (await clearedAt({ query, sessionId, index }))
+            )
               return { outcome: 'superseded', failureCount: 0 }
             throw new TypeError(
               `no event at index ${index} in session '${sessionId}'`,
             )
           }
           if (row['outcome'] === 'dead_lettered')
-            await releasePins({ query, sessionId, index })
+            await releasePins({ query, sessionId, consumer, cursorKey, index })
           return {
             outcome: row['outcome'] as
               'failed' | 'dead_lettered' | 'superseded',
@@ -1419,80 +2436,47 @@ export function postgres(options: PostgresStoreOptions = {}): PostgresStore {
       return wrap(async () => {
         const c = await client()
         const { rows } = await c.query(
-          `select * from a2_events
-            where session_id = $1
-              and processed_at is null
-              and failed_at is not null
-              and idx > ${clearIndexOf('$1')}
-            order by idx`,
+          `select cur.*, ${HEAD_COLUMNS}
+             from a2_cursors cur
+             join a2_events event
+               on event.session_id = cur.session_id and event.idx = cur.head
+            where cur.session_id = $1
+              and cur.failed_at is not null
+              and cur.head > ${clearIndexOf('$1')}`,
           [sessionId],
         )
-        return rows.map(toStored)
+        return rows.map(toHead).toSorted(byHead)
       })
     },
 
-    async redrive({ sessionId, index, action }) {
-      return wrap(() =>
-        withTx(async (query) => {
-          // Lane promotion must see every append that committed before it,
-          // so a skip takes the session lock first, in append's order. The
-          // row lock serializes both actions with claims and handler appends.
-          if (action === 'skip') {
-            await query('select pg_advisory_xact_lock(hashtext($1))', [
-              sessionId,
-            ])
-          }
-          const { rows } = await query(
-            `select lane from a2_events
-              where session_id = $1 and idx = $2
-                and idx > ${clearIndexOf('$1')}
-                and processed_at is null
-                and failed_at is not null
-              for update`,
-            [sessionId, index],
-          )
-          const row = rows[0]
-          if (row && action === 'retry') {
-            await query(
-              `update a2_events set failed_at = null, failure_count = 0
-                where session_id = $1 and idx = $2`,
-              [sessionId, index],
-            )
-          } else if (row) {
-            await query(
-              `update a2_events set processed_at = $3, lane_ready = false
-                where session_id = $1 and idx = $2`,
-              [sessionId, index, clock.now().getTime()],
-            )
-            const lane = (row['lane'] as string | null) ?? null
-            if (lane !== null) {
-              await query(
-                `update a2_events set lane_ready = true
-                  where session_id = $1
-                    and idx = (
-                      select idx from a2_events
-                       where session_id = $1 and lane = $2 and processed_at is null
-                         and idx > ${clearIndexOf('$1')}
-                       order by idx limit 1
-                    )`,
-                [sessionId, lane],
-              )
-            }
-          }
-          const { rows: status } = await query(
-            `select exists(
-               select 1 from a2_events
-               where session_id = $1 and processed_at is null
-                 and idx > ${clearIndexOf('$1')}
-             ) as has_pending`,
-            [sessionId],
-          )
-          return {
-            redriven: row !== undefined,
-            hasPending: status[0]?.['has_pending'] === true,
-          }
-        }),
-      )
+    async redrive({ sessionId, consumer, index, action, consumers }) {
+      return wrap(async () => {
+        // Lane promotion must see every append that committed before it,
+        // so a skip takes the session lock first, in append's order. The
+        // cursor lock serializes both actions with claims and consumer
+        // appends.
+        const results = await run({
+          sessionId,
+          statements: [
+            action === 'skip' && LOCK_SESSION,
+            LOCK_DEAD,
+            action === 'skip' ? SKIP_DEAD : RETRY_DEAD,
+            PENDING,
+          ],
+          params: {
+            ...retypeOf(consumer, consumers),
+            consumer,
+            index,
+            served: servedNames(consumers),
+            clearType: CLEAR_EVENT_TYPE,
+          },
+        })
+        return {
+          redriven:
+            results.find((row) => 'redriven' in row)?.['redriven'] === true,
+          hasPending: results.at(-1)!['has_pending'] === true,
+        }
+      })
     },
 
     async readState(sessionId, reducerName, stateOptions) {
@@ -1555,39 +2539,65 @@ export function postgres(options: PostgresStoreOptions = {}): PostgresStore {
             headRows[0]?.['up_to_index'] == null ? undefined : headRows[0]
 
           const requestedPins = normalized.flatMap((write) =>
-            (write.pinEventIndexes ?? []).map((eventIndex) => ({
-              eventIndex,
+            (write.pins ?? []).map((pin) => ({
+              eventIndex: pin.index,
+              consumer: pin.consumer,
+              cursorKey: cursorKeyOf(pin.lane, pin.index),
               snapshotIndex: write.index,
             })),
           )
           if (requestedPins.length > 0) {
-            const eventIndexes = [
-              ...new Set(requestedPins.map((pin) => pin.eventIndex)),
+            const heads = [
+              ...new Map(
+                requestedPins.map((pin) => [
+                  `${pin.consumer}\u0000${pin.cursorKey}\u0000${pin.eventIndex}`,
+                  pin,
+                ]),
+              ).values(),
             ]
-            const { rows: events } = await query(
-              `select idx, processed_at, failed_at from a2_events
-                where session_id = $1 and idx = any($2::bigint[]) and idx > $3
-                for update`,
-              [sessionId, eventIndexes, clearIndex],
+            // Held `for share` so a completion or dead letter releasing the
+            // head's pins waits for these to commit, and sees them.
+            const { rows: live } = await query(
+              `select cur.consumer, cur.cursor_key, cur.head
+                 from a2_cursors cur
+                 join unnest($2::text[], $3::text[], $4::bigint[])
+                   as pin(consumer, cursor_key, idx)
+                   on cur.consumer = pin.consumer
+                  and cur.cursor_key = pin.cursor_key
+                  and cur.head = pin.idx
+                where cur.session_id = $1 and cur.head > $5
+                  and cur.failed_at is null
+                order by cur.cursor_key, cur.consumer
+                for share of cur`,
+              [
+                sessionId,
+                heads.map((pin) => pin.consumer),
+                heads.map((pin) => pin.cursorKey),
+                heads.map((pin) => pin.eventIndex),
+                clearIndex,
+              ],
             )
             const unfinished = new Set(
-              events
-                .filter(
-                  (row) =>
-                    row['processed_at'] === null && row['failed_at'] === null,
-                )
-                .map((row) => asNumber(row['idx'])),
+              live.map(
+                (row) =>
+                  `${String(row['consumer'])}\u0000${String(row['cursor_key'])}\u0000${asNumber(row['head'])}`,
+              ),
             )
             const accepted = requestedPins.filter((pin) =>
-              unfinished.has(pin.eventIndex),
+              unfinished.has(
+                `${pin.consumer}\u0000${pin.cursorKey}\u0000${pin.eventIndex}`,
+              ),
             )
             if (accepted.length > 0) {
               await query(
                 `insert into a2_snapshot_pins
-                   (session_id, event_index, reducer_name, up_to_index)
-                 select $1, pin."eventIndex", $2, pin."snapshotIndex"
+                   (session_id, event_index, consumer, cursor_key, reducer_name, up_to_index)
+                 select $1, pin."eventIndex", pin.consumer, pin."cursorKey",
+                        $2, pin."snapshotIndex"
                    from jsonb_to_recordset($3::jsonb) as pin(
                      "eventIndex" bigint,
+                     consumer text,
+                     "cursorKey" text,
                      "snapshotIndex" bigint
                    )
                  on conflict do nothing`,
@@ -1702,9 +2712,7 @@ export function postgres(options: PostgresStoreOptions = {}): PostgresStore {
           // orders writes but never anchors their lifetime.
           const expiresAtMs = clock.now().getTime() + meta.ttlMs
           const applied: Record<string, unknown> = nullProtoRecord()
-          const write = async (
-            query: PostgresConnection['query'],
-          ): Promise<void> => {
+          const write = async (query: Query): Promise<void> => {
             for (const [field, value] of entries) {
               // Field-wise LWW: a stored row with a strictly newer `at`
               // survives; ties go to the incoming write (memory parity).
@@ -1819,7 +2827,7 @@ export function postgres(options: PostgresStoreOptions = {}): PostgresStore {
     async clear({ sessionId, ifLastIndex, cause }) {
       return wrap(() =>
         withTx(async (query) => {
-          await query('select pg_advisory_xact_lock(hashtext($1))', [sessionId])
+          await lockSession(query, sessionId)
           const { rows: headRows } = await query(
             `select coalesce(max(idx), 0) as head,
                     ${clearIndexOf('$1')} as clear_index
@@ -1829,26 +2837,13 @@ export function postgres(options: PostgresStoreOptions = {}): PostgresStore {
           const head = asNumber(headRows[0]?.['head'])
           const clearIndex = asNumber(headRows[0]?.['clear_index'])
           if (cause) {
-            if (cause.index <= clearIndex)
-              throw supersededAttemptError(sessionId, cause)
-            const { rows: parents } = await query(
-              `select attempt_count, failed_at from a2_events
-                where session_id = $1 and idx = $2
-                for update`,
-              [sessionId, cause.index],
-            )
-            const parent = parents[0]
-            if (!parent) {
-              throw new TypeError(
-                `no event at index ${cause.index} in session '${sessionId}'`,
-              )
-            }
-            if (
-              asNumber(parent['attempt_count']) !== cause.attempt ||
-              parent['failed_at'] !== null
-            ) {
-              throw supersededAttemptError(sessionId, cause)
-            }
+            await assertCurrentCause({
+              query,
+              sessionId,
+              cause,
+              clearIndex,
+              lock: 'update',
+            })
           }
           if (ifLastIndex !== undefined && clearIndex === ifLastIndex + 1) {
             return { cleared: true, index: head, clearIndex }
@@ -1860,33 +2855,38 @@ export function postgres(options: PostgresStoreOptions = {}): PostgresStore {
             return { cleared: true, index: head, clearIndex }
           }
           const marker = head + 1
-          const now = clock.now().getTime()
-          await insertEvent({
-            query,
-            row: {
+          await query(
+            `insert into a2_events
+               (session_id, idx, event_type, payload, event_id, created_at, cause)
+             values ($1, $2, $3, 'null'::jsonb, $4, $5, null)`,
+            [
               sessionId,
-              index: marker,
-              type: CLEAR_EVENT_TYPE,
-              payload: null,
-              id: generateId(),
-              createdAt: now,
-              cause: null,
-              lane: null,
-              processedAt: now,
-            },
-            clearIndex,
-          })
-          // Releasing a clearing handler's claim makes a claim waiting on its
-          // row skip it once this commits, instead of re-running the handler.
+              marker,
+              CLEAR_EVENT_TYPE,
+              generateId(),
+              clock.now().getTime(),
+            ],
+          )
+          // Every cursor at or below the marker is superseded by the marker
+          // alone, and reclaim deletes it. Only a clearing consumer's own
+          // cursor is written: releasing its head makes a claim waiting on
+          // the row skip it once this commits, instead of re-running it.
           await query(
             `with released as (
-               update a2_events
-                  set lane_ready = false, claim_holder = null, claim_expires_at = null
-                where session_id = $1 and idx = $3
+               update a2_cursors
+                  set head = null, ${FRESH_DISPATCH}
+                where session_id = $1 and cursor_key = $3 and consumer = $4
+                  and head = $5
              )
              insert into a2_clears (session_id, clear_index) values ($1, $2)
              on conflict (session_id) do update set clear_index = excluded.clear_index`,
-            [sessionId, marker, cause?.index ?? null],
+            [
+              sessionId,
+              marker,
+              cause ? cursorKeyOf(cause.lane, cause.index) : null,
+              cause?.consumer ?? null,
+              cause?.index ?? null,
+            ],
           )
           return { cleared: true, index: marker, clearIndex: marker }
         }),
@@ -1915,6 +2915,26 @@ export function postgres(options: PostgresStoreOptions = {}): PostgresStore {
              ), pins as (
                delete from a2_snapshot_pins pin using deleted
                 where pin.session_id = $1 and pin.event_index = deleted.idx
+             ), lanes as materialized (
+               -- Each lane's queue through the batch, by the lane's own key.
+               select lane.ctid from a2_cursors cur
+                 join a2_lane_events lane
+                   on lane.session_id = cur.session_id
+                  and lane.consumer = cur.consumer and lane.lane = cur.lane
+                where cur.session_id = $1 and cur.kind = 'lane'
+                  and lane.idx <= (select max(idx) from batch)
+                for update of lane skip locked
+             ), gone_lanes as (
+               delete from a2_lane_events target using lanes
+                where target.ctid = lanes.ctid
+             ), singles as materialized (
+               select cur.ctid from a2_cursors cur
+                 join batch on cur.cursor_key = '#' || batch.idx
+                where cur.session_id = $1 and cur.kind = 'event'
+                for update of cur skip locked
+             ), gone_singles as (
+               delete from a2_cursors target using singles
+                where target.ctid = singles.ctid
              )
              select (select count(*) from deleted) as deleted,
                     (select clear_index from boundary) as clear_index`,
@@ -1923,14 +2943,23 @@ export function postgres(options: PostgresStoreOptions = {}): PostgresStore {
           const deleted = asNumber(rows[0]?.['deleted'])
           const clearIndex = asNumber(rows[0]?.['clear_index'])
           if (clearIndex === 0) return { deleted: 0, done: true }
-          if (deleted > 0) return { deleted, done: false }
           const { rows: remaining } = await query(
             'select 1 from a2_events where session_id = $1 and idx < $2 limit 1',
             [sessionId, clearIndex],
           )
-          if (remaining.length > 0) return { deleted: 0, done: false }
+          if (remaining.length > 0) return { deleted, done: false }
+          // Writes serialize with the clear, so none lands below the marker
+          // later: one sweep of what the batches left finishes the session.
           const { rows: swept } = await query(
-            `with pins as materialized (
+            `with lanes as materialized (
+               select ctid from a2_lane_events
+                where session_id = $1 and idx < $2
+                for update skip locked
+             ), cursors as materialized (
+               select cur.ctid from a2_cursors cur
+                where ${SUPERSEDED_CURSOR}
+                for update skip locked
+             ), pins as materialized (
                select ctid from a2_snapshot_pins
                 where session_id = $1 and up_to_index < $2
                 for update skip locked
@@ -1942,6 +2971,12 @@ export function postgres(options: PostgresStoreOptions = {}): PostgresStore {
                select ctid from a2_snapshots
                 where session_id = $1 and up_to_index < $2
                 for update skip locked
+             ), gone_lanes as (
+               delete from a2_lane_events target using lanes
+                where target.ctid = lanes.ctid
+             ), gone_cursors as (
+               delete from a2_cursors target using cursors
+                where target.ctid = cursors.ctid
              ), gone_pins as (
                delete from a2_snapshot_pins target using pins where target.ctid = pins.ctid
              ), gone_history as (
@@ -1950,18 +2985,24 @@ export function postgres(options: PostgresStoreOptions = {}): PostgresStore {
              ), gone_heads as (
                delete from a2_snapshots target using heads where target.ctid = heads.ctid
              )
-             select (select count(*) from a2_snapshot_pins
+             select (select count(*) from a2_lane_events
+                      where session_id = $1 and idx < $2)
+                  + (select count(*) from a2_cursors cur
+                      where ${SUPERSEDED_CURSOR})
+                  + (select count(*) from a2_snapshot_pins
                       where session_id = $1 and up_to_index < $2)
                   + (select count(*) from a2_snapshot_history
                       where session_id = $1 and up_to_index < $2)
                   + (select count(*) from a2_snapshots
                       where session_id = $1 and up_to_index < $2)
+                  - (select count(*) from lanes)
+                  - (select count(*) from cursors)
                   - (select count(*) from pins)
                   - (select count(*) from history)
                   - (select count(*) from heads) as skipped`,
             [sessionId, clearIndex],
           )
-          return { deleted: 0, done: asNumber(swept[0]?.['skipped']) === 0 }
+          return { deleted, done: asNumber(swept[0]?.['skipped']) === 0 }
         }),
       )
     },
@@ -1973,8 +3014,8 @@ export function postgres(options: PostgresStoreOptions = {}): PostgresStore {
         subscription.stop()
       presenceSubscriptions.clear()
       await notifications?.close()
-      const lease = await connection.peek()?.catch(() => undefined)
-      await (injected ?? lease)?.release()
+      const opened = await connection.peek()?.catch(() => undefined)
+      await (injected ?? opened?.lease)?.release()
     },
   }
   if (notifications) {