Token-fenced and requires CancelRequestedAt: the cancelled delivery becomes Discarded now (03 §7, F2).
ProtectedCallrows ClaimedDeliveryRow (0–1).
rows ClaimedDeliveryRow.
rows ExpiredDeadLetterRow: ONLY the deliveries this pass dead-lettered.
ProtectedNewrows LeaseStateRow (0–1): tells Cancelled from Lost after a zero-row ExtendLease.
rows PartitionCandidateRow: visible Pending rows that satisfy the partition rules, oldest first. May return
several rows of one key for Exclusive — the consumer keeps the first per key (03 §7).
The one raw statement, and deliberately not a procedure: it exists so the conformance harness can age rows
without waiting, runs under the developer login, and must never be grantable to a runtime role. Wrapped in the
dialect's affected-row-count form so ExecuteWrite reads it exactly as it reads a procedure.
ProtectedStatementrows BacklogRow (exactly 1): the autoscaler metric (03 §11), each count capped.
ProtectedTableFor the rare raw statement (test-only helpers); never for a queue write.
Consumer calls (03 §7): expire, claim, heartbeat, settle, acknowledge a cancel. The claim rules (single flight per key, Ordered head-of-line, skip-locked scans), the holder fence (ID + LeaseToken + InFlight + no cancel) and the one-clock rule live in the procedures; the mode arguments here select the static predicate arms inside them.