@@ -0,0 +1,19 @@
+---
+'@objectstack/service-messaging': patch
+---
+
+perf(service-messaging): an idle notification or HTTP dispatcher tick reads the database twice, instead of 18 and 10 times
+
+Clause-②: yes (widening)
+Metadata-protocol: none
+
+A kernel that mounts messaging runs two delivery dispatchers, and each one ticked against an empty outbox at a fixed price: one claim probe per partition (and, for notifications, one digest probe per partition), plus a visibility-timeout reap that issued its predicate `UPDATE` whether or not any claim had expired. With the default 8 partitions that was 18 statements per notification tick and 10 per HTTP tick, measured at the client on a kernel. A kernel's global `afterUpdate` hook makes the engine read the matched rows before it writes, so the reap cost two statements. At the framework's 30-second idle ceiling an idle tenant kernel read its database 56 times a minute.
+
+An idle tick is now two reads per dispatcher, whatever `partitionCount` is:
+
+- **The reap reads before it writes.** It reads one expired `in_flight` id. Only a hit runs the `UPDATE`, whose predicate is unchanged, so it still returns every claim expired by then to `pending`.
+- **One due-work read gates the partition pass.** Before taking any partition lock, the dispatcher asks the outbox once, across every partition and organization, whether any `pending` row is due. For notifications this covers immediate and batched (digest) rows. If none is due, the tick ends: no lock is taken and no claim or digest probe runs. If one is due, the tick runs the full per-partition pass exactly as before, at the price of one extra read.
+
+`INotificationOutbox` and `IHttpOutbox` gain an optional `hasDueWork({ now })`, with `DueWorkOptions` and `HttpDueWorkOptions` exported for it. Both built-in stores, SQL and memory, implement it. A custom outbox that does not implement it keeps the per-partition probes it had. `partitionCount` and the stored `partition_key` are unchanged.
+
+The public surface widens, and that is all it does: the exported `INotificationOutbox` and `IHttpOutbox` interfaces gain one optional member each (`hasDueWork`), and the package exports two new option types (`DueWorkOptions`, `HttpDueWorkOptions`). No `packages/spec` path changes, and an existing outbox implementation compiles and behaves as before.
@@ -1,17 +1,34 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 
 /**
- * #17610 — what an IDLE `NotificationDispatcher` tick costs the store, and that
- * cutting it keeps every delivery guarantee.
+ * #17610, #28383 — what an IDLE `NotificationDispatcher` tick costs the store,
+ * and that cutting it keeps every delivery guarantee.
  *
  * ## The measurement this pins
  *
  * Before #17610 one tick over an EMPTY outbox issued 32 statements with the
  * default 8 partitions: `claim()` and `claimDigest()` each opened with the
  * environment-wide visibility-timeout reap, in every partition — 16 identical
  * UPDATEs — plus one candidate SELECT each (16). On remote Turso every
- * statement is an HTTP round trip, and the loop never stopped. The reap now
- * runs once per tick, so an idle tick is `1 + 2 × partitionCount` = 17.
+ * statement is an HTTP round trip, and the loop never stopped. #17610 ran the
+ * reap once per tick: `1 + 2 × partitionCount` engine calls, which on a kernel
+ * is 18 statements — the reap's predicate UPDATE is two there, because the
+ * engine reads the matched rows for the per-row `afterUpdate` dispatch before
+ * it writes, and it wrote with nothing to reap.
+ *
+ * #28383 makes an idle tick TWO statements, whatever `partitionCount` is: the
+ * reap reads one expired id before it writes and writes only on a hit, and one
+ * "anything due?" read across every partition gates the per-partition claim
+ * and digest probes.
+ *
+ * ## Counted where cloud counted it
+ *
+ * Two tallies, both pinned: engine calls on the delivery table, and SQL
+ * statements on it, read off the driver's knex `query` events — the client
+ * boundary cloud measured 18 at (#28383). The harness registers one global
+ * no-op `afterUpdate` hook, as a kernel's audit plugin does, so a predicate
+ * UPDATE is the read-then-write pair it is in production; on this harness the
+ * pre-#28383 code measured 18 statements a tick, cloud's figure.
  *
  * ## Why a real engine
  *
@@ -31,9 +48,16 @@
  *  - **"Reap once" could be bought by recovering less.** The recovery leg drives
  *    a real expired claim through ONE tick; its negative leg proves a claim
  *    that has not expired is left alone, so the TTL is still a floor.
+ *  - **"Write only on a hit" could be bought by never writing.** The idle pin
+ *    asserts ZERO reap UPDATEs; the recovery leg asserts the UPDATE does run
+ *    when a claim has expired.
+ *  - **One "anything due?" read could be bought by a predicate that misses a
+ *    kind of row.** A due digest-only outbox, and a deferred row that comes
+ *    due, are each driven through it: both are found when due, and a row
+ *    deferred into the future keeps the tick at two reads.
  */
 
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
 import { ObjectQL } from '@objectstack/objectql';
 import { SqlDriver } from '@objectstack/driver-sql';
 import { SqlNotificationOutbox, DELIVERY_OBJECT } from './sql-outbox.js';
@@ -52,6 +76,8 @@ let engine: ObjectQL;
 let outbox: SqlNotificationOutbox;
 /** Engine calls against the delivery table, by method. */
 let calls: { update: number; find: number; other: number };
+/** SQL statements the driver sent against the delivery table, in order. */
+let statements: string[];
 /** `recipient` of every send, in order. */
 let sent: string[];
 
@@ -89,7 +115,16 @@ beforeEach(async () => {
     // A real `single` install's Default Organization: the system writes below
     // derive it (ADR-0131 D9), as a fresh NOT NULL tenant column requires (D1).
     await installDefaultOrganization(engine);
+    // A kernel's audit plugin registers a global `afterUpdate`; with one
+    // registered, a predicate UPDATE reads its matched rows before it writes —
+    // the two-statement reap cloud counted.
+    engine.registerHook('afterUpdate', async () => {});
 
+    statements = [];
+    (driver as unknown as { knex: { on(e: 'query', cb: (q: { sql?: unknown }) => void): void } }).knex
+        .on('query', (q) => {
+            if (typeof q.sql === 'string' && q.sql.includes(DELIVERY_OBJECT)) statements.push(q.sql);
+        });
     calls = { update: 0, find: 0, other: 0 };
     sent = [];
     // Count on the engine instance the outbox holds, so the tally is of real
@@ -114,17 +149,58 @@ afterEach(async () => {
     try { await engine?.destroy(); } catch { /* noop */ }
 });
 
-describe('#17610 NotificationDispatcher — idle tick cost', () => {
-    it('an idle tick is 1 + 2 × partitionCount statements: ONE reap, then a claim and a digest probe per partition', async () => {
+describe('#17610 #28383 NotificationDispatcher — idle tick cost', () => {
+    it('an idle tick is TWO statements: the reap\'s expired-claim read and one due-work read, no UPDATE, no partition probe', async () => {
         const d = dispatcher();
         for (let i = 0; i < TICKS; i++) await d.tick();
 
-        // On an empty outbox the only UPDATE a tick issues is the reap. It is
-        // environment-wide, so once per tick is all it can use — and exactly
-        // once, never zero: it is the only crash recovery there is.
-        expect(calls.update).toBe(TICKS);
-        // Before #17610: 2 × PARTITIONS reaps + 2 × PARTITIONS probes = 32 a tick.
-        expect(calls.update + calls.find + calls.other).toBeLessThanOrEqual(TICKS * (1 + 2 * PARTITIONS));
+        // Nothing expired, so the reap reads and never writes; nothing due, so
+        // no partition's claim or digest probe runs.
+        expect(calls).toEqual({ update: 0, find: 2 * TICKS, other: 0 });
+        // At the client: before #28383, 18 a tick on this harness (cloud's
+        // figure); the card's bar is 6.
+        expect(statements).toHaveLength(2 * TICKS);
+        expect(statements.every((sql) => /^select /i.test(sql))).toBe(true);
+    });
+
+    it('a row deferred into the future keeps the tick at two reads, and goes out on the first tick after it comes due', async () => {
+        const d = dispatcher();
+        const enqueuedAt = Date.now();
+        // A retry's backoff, quiet hours and a digest window all defer a row
+        // through `next_attempt_at`.
+        await outbox.enqueue({
+            notificationId: 'n_later', recipientId: 'u_later', channel: 'inbox', payload: { title: 't' },
+            notBefore: enqueuedAt + 60_000,
+        });
+        statements = [];
+        await d.tick();
+        expect(sent).toEqual([]);
+        expect(statements).toHaveLength(2);
+
+        // The store reads `Date.now()` for the due-work read and the claim alike.
+        const clock = vi.spyOn(Date, 'now').mockReturnValue(enqueuedAt + 60_001);
+        try {
+            await d.tick();
+        } finally {
+            clock.mockRestore();
+        }
+        expect(sent).toEqual(['u_later']);
+    });
+
+    it('a due digest-only outbox is found by the one due-work read and collapsed on that tick', async () => {
+        const d = dispatcher();
+        for (const notificationId of ['nd1', 'nd2', 'nd3']) {
+            await outbox.enqueue({
+                notificationId, recipientId: 'u_digest', channel: 'inbox', payload: { title: notificationId },
+                digestKey: 'u_digest|inbox|w1',
+            });
+        }
+
+        await d.tick();
+
+        expect(sent).toEqual(['u_digest']);
+        const rows = await outbox.list();
+        expect(rows.every((r) => r.status === 'success')).toBe(true);
     });
 
     it('rows enqueued after an idle stretch go out on the very next tick — every partition, digests collapsed', async () => {
@@ -165,13 +241,18 @@ describe('#17610 NotificationDispatcher — idle tick cost', () => {
         });
         expect(abandoned?.status).toBe('in_flight');
 
+        calls = { update: 0, find: 0, other: 0 };
+        statements = [];
         await dispatcher().tick();
 
         // The tick's single reap ran BEFORE its claims, so the same tick took
         // the row back and delivered it.
         expect(sent).toEqual(['u1']);
         const [row] = await outbox.list();
         expect(row).toMatchObject({ status: 'success', attempts: 1 });
+        // The reap's read found the expired claim, so its UPDATE ran — once.
+        const reapWrites = statements.filter((sql) => /^update .* where `status` = \? and `claimed_at` < \?$/i.test(sql));
+        expect(reapWrites).toHaveLength(1);
     });
 
     it('leaves a claim that has NOT expired alone — the TTL is still a floor', async () => {
 
@@ -107,11 +107,16 @@ export interface NotificationDispatcherOptions {
  * reverts to pending after the claim TTL and is re-sent — the inbox channel's
  * receipt write is idempotent-friendly, and downstream channels should be too.
  *
- * ## What an idle tick costs (#17610)
+ * ## What an idle tick costs (#17610, #28383)
  *
- * Against an empty outbox one tick is `1 + 2 × partitionCount` store round
- * trips: ONE visibility-timeout reap for the whole environment, then a claim
- * probe and a digest probe per partition. The reap used to run inside both
+ * Against an empty outbox one tick is TWO reads, whatever `partitionCount`
+ * is: the visibility-timeout reap's "anything expired?" read, and one "anything
+ * due?" read across every partition ({@link INotificationOutbox.hasDueWork}).
+ * Neither finds a row, so neither the reap's UPDATE nor any partition's claim
+ * and digest probe runs. Before #28383 it was `2 + 2 × partitionCount` on a
+ * kernel — the reap's predicate UPDATE (a matched-row read plus the write,
+ * unconditionally), then a claim probe and a digest probe per partition: 18
+ * with the default 8. Before #17610 the reap ran inside both
  * claims of every partition — `2 × partitionCount` identical environment-wide
  * UPDATEs a tick, 16 of the 32 statements a tick issued with the default 8
  * partitions — on a fixed 500 ms interval that never let up, one loop per warm
@@ -217,6 +222,22 @@ export class NotificationDispatcher {
             reapedForTick = true;
         }
 
+        // [#28383] One read across every partition before any partition's two
+        // probes. Most ticks find nothing — an idle kernel's every tick — and
+        // they used to pay a claim probe and a digest probe per partition to
+        // learn it (16 statements with the default 8). `false` ends the tick
+        // here: no partition lock is taken and no claim or digest probe runs.
+        // `true` runs the full pass below exactly as before, so a tick that has
+        // work claims, batches and collapses digests unchanged, for one read
+        // more. Asked AFTER the reap, so a row the reap just returned to
+        // `pending` counts as due. The read is environment-wide and takes no
+        // lock, like the reap: it moves nothing, and the claims it lets through
+        // still run under their partition locks.
+        //
+        // Optional on the outbox contract: a store without it probes every
+        // partition, as before.
+        if (outbox.hasDueWork && !(await outbox.hasDueWork({}))) return 0;
+
         const count = this.opts.partitionCount;
         const offset = stableNodeOffset(this.opts.nodeId, count);
         let claimed = 0;
 
@@ -13,8 +13,9 @@
  * `MessagingService.enqueueHttp()` and `redeliverHttp()` — waking it.
  *
  * Every leg runs on vitest's fake timers, so "when did a tick start" is an
- * exact reading rather than a sleep-and-hope. With one partition the dispatcher
- * issues exactly one `claim()` per tick, so a tick is timestamped there.
+ * exact reading rather than a sleep-and-hope. Every tick opens with exactly one
+ * `reap()` — an idle one claims nothing at all since #28383 — so a tick is
+ * timestamped there, as the notification side's file does.
  */
 
 import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
@@ -23,7 +24,7 @@ import { HttpDispatcher } from './http-dispatcher.js';
 import { DEFAULT_MAX_IDLE_INTERVAL_MS } from './dispatcher.js';
 import { MessagingService } from './messaging-service.js';
 import type { FetchImpl } from './http-sender.js';
-import type { EnqueueHttpInput, HttpAckResult, HttpClaimCredential, HttpClaimOptions, HttpDelivery } from './http-outbox.js';
+import type { EnqueueHttpInput, HttpAckResult, HttpClaimCredential, HttpReapOptions } from './http-outbox.js';
 
 const BASE = 500;
 const CAP = 30_000;
@@ -35,9 +36,9 @@ const silentLogger = { info() {}, warn() {}, error() {} };
 class TickRecordingOutbox extends MemoryHttpOutbox {
     readonly tickStarts: number[] = [];
     readonly retriesDueAt: number[] = [];
-    override async claim(opts: HttpClaimOptions): Promise<HttpDelivery[]> {
+    override async reap(opts: HttpReapOptions): Promise<void> {
         this.tickStarts.push(Date.now());
-        return super.claim(opts);
+        return super.reap(opts);
     }
     override async ack(id: string, result: HttpAckResult, claimed?: HttpClaimCredential): Promise<void> {
         if (!result.success && result.nextRetryAt !== undefined) this.retriesDueAt.push(result.nextRetryAt);