What

Makes the queue server's delivery and schedule workers event-driven instead of fixed-interval pollers, so an idle queue generates zero Postgres traffic and the VM (and Postgres) can scale to zero.

Why

The delivery and schedule workers polled Postgres every 1s, and a 15s depth scrape ran unconditionally. That continuous traffic kept the queue VM's TAP device busy — and, because the queries hit Postgres, kept the Postgres VM busy too — so neither ever reached instd's idle threshold. Of an app's 5 primitive VMs, queue and postgres never scaled to zero even for a completely idle app. (SCHEDULES.md previously documented this as intentional; that stance is reversed here.)

Changes

• Delivery worker (src/ops/delivery.rs): drains due rows, then sleeps until the earliest pending next_attempt_at (or parks if empty), woken in-process when a publish inserts deliveries.
• Schedule worker (src/ops/schedule_worker.rs): fires what's due, then sleeps until the earliest active next_fire_at, capped at KEEPALIVE_CAP (240s, under the 300s light-sleep window so the VM stays awake and fires on time while any schedule is active), woken in-process by /schedules mutations.
• Depth scrape: background loop removed; computed lazily in the /metrics handler.
• Wiring: route handlers poke a tokio::sync::Notify. Primitives run single-instance (max=1), so an in-process signal suffices — no LISTEN/NOTIFY, no extension change, no Postgres republish.
• Wake resilience (src/db.rs): connect/first-query retry with backoff + 30s acquire timeout (mirrors auth's connect_with_retry) so the first query after Postgres deep-sleeps holds while it restores from S3.
• Docs (SCHEDULES.md, ARCHITECTURE.md) updated to the event-driven model.

Verification

• 33 unit + 80 integration tests pass against real Postgres.
• Reworked unsubscribe_cancels_pending to assert the real guarantee (CASCADE-delete of a pending delivery) rather than relying on poll latency — delivery is now immediate.
• Statement-level trace: an idle queue issues 0 Postgres queries over a 12s window (was ~2/s). cargo clippy -D warnings and dprint clean; .sqlx cache regenerated.

🤖 Generated with Claude Code