@@ -124,7 +124,9 @@ const JOB_QUEUE: ObjectDef = {
     updated_at: Field.datetime({ label: 'Updated At', required: false }),
   },
   indexes: [
-    { fields: ['queue', 'status', 'scheduled_for'] },
+    // [#17612] Widened from `['queue','status','scheduled_for']` — verbatim
+    // from `sys-job-queue.object.ts`, which is where the reasoning lives.
+    { fields: ['queue', 'status', 'priority', 'scheduled_for', 'id'] },
     { fields: ['idempotency_key', 'queue'] },
     { fields: ['status'] },
   ],
@@ -168,7 +170,7 @@ const EXPECTED_NAMES: Record<string, string[]> = {
     `sqlite_autoindex_${DELIVERY.name}_1`,
   ].sort(),
   [JOB_QUEUE.name]: [
-    buildIndexName(JOB_QUEUE.name, ['queue', 'status', 'scheduled_for'], false),
+    buildIndexName(JOB_QUEUE.name, ['queue', 'status', 'priority', 'scheduled_for', 'id'], false),
     buildIndexName(JOB_QUEUE.name, ['idempotency_key', 'queue'], false),
     buildIndexName(JOB_QUEUE.name, ['status'], false),
     `sqlite_autoindex_${JOB_QUEUE.name}_1`,
@@ -185,6 +187,18 @@ const EXPECTED_NAMES: Record<string, string[]> = {
 };
 
 const CLAIM_INDEX = buildIndexName(DELIVERY.name, ['status', 'partition_key', 'next_attempt_at'], false);
+/** [#17612] The index `sys_job_queue`'s claim path must be served by, end to end. */
+const JOB_CLAIM_INDEX = buildIndexName(
+  JOB_QUEUE.name,
+  ['queue', 'status', 'priority', 'scheduled_for', 'id'],
+  false,
+);
+/** The shape the remote face provisioned BEFORE #17612 — this file's negative control. */
+const JOB_QUEUE_PRE_17612: ObjectDef['indexes'] = [
+  { fields: ['queue', 'status', 'scheduled_for'] },
+  { fields: ['idempotency_key', 'queue'] },
+  { fields: ['status'] },
+];
 const DEDUP_INDEX = buildIndexName(DELIVERY.name, ['notification_id', 'recipient_id', 'channel'], true);
 
 /** A fresh copy per sync — neither face may see a definition the other one mutated. */
@@ -275,20 +289,27 @@ async function remoteFace(client: Client = createClient({ url: 'file::memory:' }
 }
 
 /** Every statement the driver hands the client, in order, with the call that carried it. */
-function countingClient(inner: Client): { client: Client; calls: Array<{ via: 'execute' | 'batch'; sql: string[] }> } {
-  const calls: Array<{ via: 'execute' | 'batch'; sql: string[] }> = [];
+function countingClient(inner: Client): {
+  client: Client;
+  calls: Array<{ via: 'execute' | 'batch'; sql: string[]; args: unknown[][] }>;
+} {
+  const calls: Array<{ via: 'execute' | 'batch'; sql: string[]; args: unknown[][] }> = [];
   const sqlOf = (s: InStatement) => (typeof s === 'string' ? s : s.sql);
+  // [#17612] The bound values, alongside the text — a captured statement is only
+  // re-runnable (`EXPLAIN QUERY PLAN`) if its placeholders can be filled again.
+  const argsOf = (s: InStatement): unknown[] =>
+    typeof s === 'string' ? [] : Array.isArray(s.args) ? [...s.args] : [];
   const client = new Proxy(inner, {
     get(target, prop) {
       if (prop === 'execute') {
         return (stmt: InStatement, ...rest: unknown[]) => {
-          calls.push({ via: 'execute', sql: [sqlOf(stmt)] });
+          calls.push({ via: 'execute', sql: [sqlOf(stmt)], args: [argsOf(stmt)] });
           return (target.execute as (...a: unknown[]) => unknown).call(target, stmt, ...rest);
         };
       }
       if (prop === 'batch') {
         return (stmts: InStatement[], ...rest: unknown[]) => {
-          calls.push({ via: 'batch', sql: stmts.map(sqlOf) });
+          calls.push({ via: 'batch', sql: stmts.map(sqlOf), args: stmts.map(argsOf) });
           return (target.batch as (...a: unknown[]) => unknown).call(target, stmts, ...rest);
         };
       }
@@ -299,6 +320,34 @@ function countingClient(inner: Client): { client: Client; calls: Array<{ via: 'e
   return { client, calls };
 }
 
+/**
+ * [#17612] The job-claim SELECT as the driver EMITS it, with its bound values —
+ * driven from `DbQueueAdapter.claimBatch`'s query shape through a throwaway
+ * remote face, so the statement under test is the driver's own rather than a
+ * second copy of it maintained here.
+ */
+async function capturedJobClaim(): Promise<{ sql: string; args: unknown[] }> {
+  const { client, calls } = countingClient(createClient({ url: 'file::memory:' }));
+  const face = await remoteFace(client);
+  await face.driver.initObjects([fresh(JOB_QUEUE)]);
+  calls.length = 0;
+  await face.driver.find(JOB_QUEUE.name, {
+    where: {
+      queue: 'q',
+      status: 'pending',
+      $or: [{ scheduled_for: null }, { scheduled_for: { $lte: '2026-09-14T00:00:00.000Z' } }],
+    },
+    limit: 30,
+    orderBy: [
+      { field: 'priority', order: 'asc' },
+      { field: 'scheduled_for', order: 'asc' },
+    ],
+  } as never);
+  const select = calls.find((c) => /^SELECT\b/i.test(c.sql[0] ?? ''));
+  if (!select) throw new Error('[#17612] no SELECT reached the client — the capture is void');
+  return { sql: select.sql[0]!, args: select.args[0]! };
+}
+
 const INDEX_DDL = /^\s*CREATE\s+(UNIQUE\s+)?INDEX\b/i;
 const INDEX_NAME_READ = /FROM\s+sqlite_master\s+WHERE\s+type\s*=\s*'index'/i;
 
@@ -432,6 +481,43 @@ describe('[#17609] declared object-level indexes land identically on both TursoD
     expect(remotePlan).not.toMatch(/SCAN sys_notification_delivery/);
     expect(remotePlan).toBe(await plan(local.query));
   });
+
+  it('[#17612] serves the job claim query with NO sorter — every ORDER BY term indexed, both faces', async () => {
+    // The statement is CAPTURED from the driver, never retyped: the ORDER BY
+    // the planner sees carries one term `DbQueueAdapter.claimBatch` never
+    // wrote — `id`, the deterministic-paging tie-breaker `SqlDriver.orderKeysFor`
+    // appends to every paged read (ADR-0053 D-A1 / objectstack#4363) — and that
+    // term is exactly why an index stopping at `scheduled_for` still left a
+    // sorter in the plan. A retyped literal would have hidden it.
+    const claim = await capturedJobClaim();
+    expect(claim.sql).toContain('ORDER BY "priority" ASC, "scheduled_for" ASC, "id" ASC');
+
+    const local = await localFace();
+    const remote = await remoteFace();
+    await local.driver.initObjects([fresh(JOB_QUEUE)]);
+    await remote.driver.initObjects([fresh(JOB_QUEUE)]);
+
+    const plan = async (query: Query) =>
+      (await query(`EXPLAIN QUERY PLAN ${claim.sql}`, claim.args)).map((r) => String(r.detail)).join('\n');
+    const remotePlan = await plan(remote.query);
+
+    expect(remotePlan).toContain(`SEARCH ${JOB_QUEUE.name} USING INDEX ${JOB_CLAIM_INDEX} (queue=? AND status=?)`);
+    // ⛔ No sorter at all — not "a cheaper sorter". The whole ORDER BY is index order.
+    expect(remotePlan).not.toMatch(/USE TEMP B-TREE/);
+    expect(remotePlan).not.toMatch(new RegExp(`SCAN ${JOB_QUEUE.name}`));
+    expect(remotePlan).toBe(await plan(local.query));
+
+    // NEGATIVE CONTROL — the SAME statement against the index set this table
+    // carried before #17612. If this reads clean, the assertions above are
+    // measuring nothing.
+    const before = await remoteFace();
+    await before.driver.initObjects([{ ...fresh(JOB_QUEUE), indexes: JOB_QUEUE_PRE_17612!.map((i) => ({ ...i })) }]);
+    const beforePlan = (await before.query(`EXPLAIN QUERY PLAN ${claim.sql}`, claim.args))
+      .map((r) => String(r.detail))
+      .join('\n');
+    expect(beforePlan).toMatch(/USE TEMP B-TREE FOR ORDER BY/);
+    expect(beforePlan).not.toContain(JOB_CLAIM_INDEX);
+  });
 });
 
 describe('[#17609] a declared index the retrofit cannot create is reported at `error`, never forced', () => {
 
@@ -346,9 +346,11 @@ describe('makeFakeEngine().delete conforms to ObjectQL.delete (#4550)', () => {
     // `where: { id: { $in: […] } }` only LOOKS like an id: it is a multi-row
     // predicate, so without `multi` the engine rejects it — the exact case a
     // hand-mirrored `if (opts?.where?.id == null)` waves through, and the reason
-    // the mirror had to go rather than be corrected in place. (This fake's
-    // `matches` is equality-only by design — no fixture here sends an operator
-    // predicate — so what is pinned is the dispatch verdict, not `$in` matching.)
+    // the mirror had to go rather than be corrected in place. (What is pinned
+    // here is the DISPATCH verdict, not `$in` matching: the refusal happens in
+    // `assertEngineDeleteDispatch` before `matches` is ever reached, so it
+    // holds whether or not this fake understands the operator — and since
+    // #17612 it does understand a few, `$in` among them.)
     engine.tables.set('sys_job_queue', [{ id: 'a' }, { id: 'b' }, { id: 'c' }]);
     await expect(
       engine.delete('sys_job_queue', { where: { id: { $in: ['a', 'b'] } } }),
@@ -365,3 +367,108 @@ describe('makeFakeEngine().delete conforms to ObjectQL.delete (#4550)', () => {
     expect(rows()).toHaveLength(3);
   });
 });
+
+/**
+ * [#17612] Head-of-line starvation: the due bound was applied in JS AFTER the
+ * SQL `LIMIT`, so a window full of not-yet-due high-priority rows hid every
+ * already-due row behind them — indefinitely, not just for one tick.
+ *
+ * The numbers below are the reproduction the card carries, re-measured here.
+ * Default `batchSize` is 10, so the candidate window is `10 * 3 = 30`.
+ */
+describe('DbQueueAdapter — the due bound is a predicate, not a post-LIMIT filter', () => {
+  let engine: ReturnType<typeof makeFakeEngine>;
+  let adapter: DbQueueAdapter;
+
+  beforeEach(() => {
+    engine = makeFakeEngine();
+    adapter = new DbQueueAdapter({
+      engine,
+      options: { pollIntervalMs: 60_000, autoStart: false, defaultMaxAttempts: 3 },
+    });
+  });
+
+  /** `n` not-yet-due priority-1 rows, then one already-due priority-100 row. */
+  async function seedStarvation(n: number): Promise<string> {
+    for (let i = 0; i < n; i++) {
+      await adapter.publish('starve', { i }, { priority: 1, delay: 600_000 });
+    }
+    return adapter.publish('starve', { due: true }, { priority: 100 });
+  }
+
+  it('claims the due low-priority row even when the whole candidate window is future-dated work', async () => {
+    const handled: any[] = [];
+    await adapter.subscribe('starve', async (msg) => { handled.push(msg.data); });
+    const dueId = await seedStarvation(30);
+
+    // Was 0 — the 30 priority-1 rows filled the window and the due row was
+    // never a candidate. The queue looked healthy and drained nothing.
+    expect(await adapter.pollOnce()).toBe(1);
+    expect(handled).toEqual([{ due: true }]);
+    expect((engine.tables.get('sys_job_queue') ?? []).find((r: any) => r.id === dueId).status)
+      .toBe('completed');
+  });
+
+  it('CONTROL — one row short of filling the window, the same claim already worked before the fix', async () => {
+    const handled: any[] = [];
+    await adapter.subscribe('starve', async (msg) => { handled.push(msg.data); });
+    await seedStarvation(29);
+
+    // 29 future-dated rows + the due one is exactly 30 = the window, so the due
+    // row rode in on the last slot. This case read 1 before the fix too — which
+    // is what makes the case above a measurement rather than a coincidence.
+    expect(await adapter.pollOnce()).toBe(1);
+    expect(handled).toEqual([{ due: true }]);
+  });
+
+  it('LIMIT now sees the DUE set — the engine hands back one candidate, not a window of thirty', async () => {
+    const claims: Array<{ where: any; limit: number; rows: number }> = [];
+    const inner = engine.find.bind(engine);
+    engine.find = async (table: string, opts: any = {}) => {
+      const rows = await inner(table, opts);
+      if (opts?.orderBy?.[0]?.field === 'priority') {
+        claims.push({ where: opts.where, limit: opts.limit, rows: rows.length });
+      }
+      return rows;
+    };
+
+    await adapter.subscribe('starve', async () => {});
+    await seedStarvation(30);
+    await adapter.pollOnce();
+
+    expect(claims).toHaveLength(1);
+    expect(claims[0].limit).toBe(30);
+    // The over-fetch window is unchanged; what changed is WHICH rows fill it.
+    expect(claims[0].rows).toBe(1);
+    expect(claims[0].where.$or).toEqual([
+      { scheduled_for: null },
+      { scheduled_for: { $lte: expect.any(String) } },
+    ]);
+  });
+
+  it('a row with no `scheduled_for` at all is due — `NULL <= now` is NULL, so it needs its own leg', async () => {
+    const handled: any[] = [];
+    await adapter.subscribe('nulls', async (msg) => { handled.push(msg.data); });
+    await adapter.publish('nulls', { a: 1 });
+    // Not a shape `publish` writes — `sys_job_queue.scheduled_for` is nullable
+    // and a row can reach this table from a migration or a hand-written insert.
+    (engine.tables.get('sys_job_queue') ?? [])[0].scheduled_for = null;
+
+    expect(await adapter.pollOnce()).toBe(1);
+    expect(handled).toEqual([{ a: 1 }]);
+  });
+
+  it('priority still decides the order among DUE rows — the fork this card did NOT take', async () => {
+    const handled: any[] = [];
+    await adapter.subscribe('ordered', async (msg) => { handled.push(msg.data); });
+    await adapter.publish('ordered', { p: 100 }, { priority: 100 });
+    await adapter.publish('ordered', { p: 1 }, { priority: 1 });
+    await adapter.publish('ordered', { p: 50 }, { priority: 50 });
+
+    expect(await adapter.pollOnce()).toBe(3);
+    // Lower number = higher priority (`sys_job_queue.priority`'s own description).
+    // Dropping `priority` from the claim sort — the card's option 2 — would have
+    // made this read in insert order and left the declared field inert.
+    expect(handled).toEqual([{ p: 1 }, { p: 50 }, { p: 100 }]);
+  });
+});
@@ -45,20 +45,33 @@ type Row = Record<string, any>;
  *    (same contract as `db-queue-adapter.test.ts`);
  *  - the Reaper's `delete(table, { where, multi: true })` with a `$lt`
  *    operator, which the row-by-row `where.id` delete of the adapter's own
- *    `purge()` does not exercise.
+ *    `purge()` does not exercise;
+ *  - [#17612] the claim path's `$or` due bound, which `pollOnce()` carries in
+ *    here whether or not a fixture is about it.
  */
 function makeFakeEngine() {
   const tables = new Map<string, Row[]>();
   function matches(row: Row, where: Record<string, any>): boolean {
     for (const [k, v] of Object.entries(where)) {
+      // [#17612] `$or` — the claim path's due bound reaches this fake too, via
+      // the `pollOnce()` these retention fixtures drive. Every OTHER `$` key
+      // stays a loud failure: a double that silently passed an operator it
+      // does not implement is the shape this package refuses.
+      if (k === '$or') {
+        if (!(v as Array<Record<string, any>>).some((leg) => matches(row, leg))) return false;
+        continue;
+      }
       if (k.startsWith('$')) throw new Error(`fake driver: unsupported operator ${k}`);
       if (v && typeof v === 'object' && !Array.isArray(v)) {
-        // NULL-safe like SQL: a row with no value never satisfies `$lt`.
+        // NULL-safe like SQL: a row with no value never satisfies `$lt`/`$lte`.
         if ('$lt' in v && (row[k] == null || !(String(row[k]) < String(v.$lt)))) return false;
+        if ('$lte' in v && (row[k] == null || !(String(row[k]) <= String(v.$lte)))) return false;
         if ('$in' in v && !(v.$in as unknown[]).includes(row[k])) return false;
         continue;
       }
-      if (row[k] !== v) return false;
+      // `where: { k: null }` is IS NULL — an absent column and an explicit null
+      // are the same absence.
+      if (v === null ? row[k] != null : row[k] !== v) return false;
     }
     return true;
   }