P1 — misattributed rationale. This constant is the backoff sleep duration (0.5), but the comment justifies it as keeping "the one-shot bound" from being "weakened operationally." The one-shot guarantee (retry exactly once) is enforced structurally by send()'s single except/single retry call — it has nothing to do with this literal; making the backoff env-driven would not change the retry count. This reads as copied from pg_barrier.py:140-141, where the literal annotated is the actual attempt-count bound (_BARRIER_WRITE_ATTEMPTS). Suggest retying the rationale to what this value governs, e.g. "a literal so the pause can't be tuned into a long blocking stall on the enqueue hot path."

P1 — overstated downstream guarantee (flagged independently by 3 reviewers). The claim that a duplicate "is absorbed by the claim_batch / pg_batch_dedup gate downstream" only holds for batch header tasks: claim_batch is invoked from exactly one site, run_batch_with_barrier (pg_barrier.py:896). But send() is the generic enqueue primitive — dispatch.py:154 routes leaf tasks, the barrier header fan-out, and the aggregating callback through it, none of which carry a batch_index, so none are gated. A double-fired callback would aggregate chord results twice. Suggest leading with the real general backstop (the module's at-least-once / idempotent-consumer contract, lines 13-17) and presenting claim_batch as the batch-specific instance, so the comment stays accurate as new non-batch send() call sites appear.

P2 — reused cannot actually establish "the INSERT never reached the server." The flag only distinguishes "cached before this send" from "created during it." The caught OperationalError/InterfaceError can't separate (a) idle reap — INSERT never sent, retry safe — from (b) mid-statement death where the server committed the row but the socket dropped before psycopg2 read RETURNING msg_id → retry double-inserts. Case (b) is precisely the PgBouncer-recycle/failover scenario this feature targets, so it isn't rare on that path. This is acceptable as an at-least-once enqueue, but the docstring currently frames it as near-exactly-once. Either soften the wording ("duplicate possible only on commit-loss; relies on idempotent consumers") or, for the real fix, add a producer dedup key + INSERT ... ON CONFLICT DO NOTHING RETURNING msg_id so the retry collapses to the original. (Capturing reused before the attempt is itself correct — keep that.)

P2 — catch list is narrower than _cursor's own model, and duplicates it. _cursor (line 192-198) explicitly anticipates a server-side termination surfacing as a bare psycopg2.DatabaseError and treats a failed rollback() as proof of death — but this retry catches only (OperationalError, InterfaceError). So a stale death that manifests as a bare DatabaseError gets the conn correctly dropped by _cursor yet is not retried here, silently defeating the feature for that manifestation. Narrow is the right call (must not retry IntegrityError/CheckConstraint), but the gap is undocumented. Also: this tuple is duplicated against _cursor's at line 197 — extract a single _CONN_DEAD_ERRORS: Final = (psycopg2.OperationalError, psycopg2.InterfaceError) referenced by both, so the send/_cursor coupling is enforced by construction, and add a one-line docstring note that a bare DatabaseError is intentionally left to the next call's reconnect.

P2 — WARNING asserts a cause it can't know, mis-steering triage. During a genuine DB outage (not a transient reap) this fires claiming "cached connection likely stale, reconnecting and retrying once" — the wrong diagnosis for an operator scanning WARNINGs mid-incident. Suggest describing the observation, not the conclusion: e.g. "send failed with a connection-level error on a reused cached connection; dropping it and retrying once (stale-reap or DB unavailable)."

P2 — no positive record on a successful retry. For a feature whose primary hazard is a duplicate enqueue, the only log artifact is the pre-retry WARNING; there's no "retry succeeded, msg_id=N" breadcrumb to correlate against or to detect a double-insert after the fact. Capture the returned id and emit an INFO with the resulting msg_id before returning.

P3 — blocking time.sleep(0.5) penalises the common path. The docstring concedes the idle-reap case (the common reason this retry exists) reconnects instantly, so the 0.5s is pure dead time there; it only buys a failover self-heal window. Bounded and one-shot, so low severity, and fine while all callers are synchronous — but a simultaneous failover stales many cached clients at once, each dispatch then blocking 0.5s (a small thundering-herd stall). Worth a note that the sleep penalises the common path to buy failover headroom, and a caveat that this becomes a loop-stall if send() is ever pulled into async context.

P3 — _insert_message drops send()'s keyword-only discipline. send() forces org_id/priority keyword-only via *, and validates priority range; _insert_message takes all four positionally and assumes the range check already ran. Private + only two internal callers, so low risk, but a future direct caller bypasses both guards. Mirror the * boundary (org_id/priority keyword-only) so the helper reads like the public method it serves and can't be miscalled positionally.

P2 — three coverage gaps in the happy-path test. (1) InterfaceError — the more likely stale symptom given conn.closed is a client-side-only flag — is never exercised; all 5 tests use OperationalError/RuntimeError, so narrowing the except to OperationalError alone would re-break the PgBouncer-reap fix yet pass the suite. Parametrize this test over both exception types. (2) The 0.5s backoff fires here but is never asserted (_no_sleep's mock is discarded); deleting the time.sleep line or changing _SEND_RETRY_BACKOFF_SECONDS passes the suite. Add sleep.assert_called_once_with(_SEND_RETRY_BACKOFF_SECONDS). (3) The retry's INSERT params (org_id/priority/message passthrough) are unverified — assert on the fresh cursor's execute.call_args for a send with explicit org_id/priority. A caplog check on the WARNING (precedent at lines 339-351) would round it out.

P3 — third copy of the mock-conn builder. _conn here cleanly de-duplicates within this class (backs all 5 tests — good), but it's now the third file-level copy of the same cur/conn/_CursorCtx/conn.closed=0 shape alongside _mock_conn (line 44) and _owned_client (line 141). Consider folding them into module-level _mock_conn with closed=0 + an execute_side_effect param and delegating. Minor: every call site does dead, _ = self._conn(...) and discards cur, so returning just conn would simplify them — optional if you keep the (conn, cur) convention for consistency. _no_sleep is good as-is.