Group vs separate queue.

There are two honest ways to carry many tenants on a queue.

N separate queues. Each tenant gets its own queue — its own keyspace, its own consumers, its own retention. Isolation is total: a tenant cannot see, starve, or even name another tenant's work. The cost is that nothing balances them. Fairness across tenants now lives outside the queue, in whatever process selects which queue a worker polls next; with N queues and a fixed worker pool, that scheduler is yours to write, and getting it fair is the same rota problem moved up a layer. Every tenant also multiplies the operational surface: N sets of metrics, N pause switches, N retention policies, N things to provision when a tenant is added.

One queue with groups. Every tenant is a lane in one queue — one keyspace, one ring, one set of consumers. The rota that serves the lanes is the cross-tenant scheduler, built into the claim, so fairness is free and there is nothing to write. Per-tenant control is data: a ceiling is a glimit hash field, a pause is a paused set member, a tenant is created by its first job. The cost is the converse of isolation: tenants share storage, failure domain, and retention, so a design that needs those split per tenant cannot use groups.

The group design is not "one queue, no per-tenant levers" — EchoMQ.Lanes gives a full per-tenant operations set inside the one {q} slot:

• A per-tenant concurrency ceiling. EchoMQ.Lanes.limit(conn, q, group, n) caps one tenant's in-flight work without affecting the rest — the glimit/ gactive semaphore.
• Park and unpark one tenant. EchoMQ.Lanes.pause(conn, q, group) and resume/3 hold a single tenant while the others keep running.
• Move work between tenants. EchoMQ.Lanes.reassign(conn, q, job_id, dst_group) moves a pending job from its lane to another in one atomic script; the source group is read from the job row, so the move cannot disagree with what the row records, and the mint-ordered place is kept. There is no numeric per-job priority to set — "matters more now" is a change of lane, not a score.
• Recover one tenant on demand. EchoMQ.Lanes.reap_group(conn, q, group) returns one tenant's expired-lease jobs to its own lane without a queue-wide scan — a crashed tenant re-queues behind its own identity and never jumps the rota.
• Drain one tenant. EchoMQ.Lanes.drain(conn, q, group) empties one lane's pending backlog and drops it from the ring, leaving every sibling lane, the ceiling config, and the in-flight work alone.
• Read one tenant's depth. EchoMQ.Lanes.depth(conn, q, group) is the lane's pending count.

Each of these is one operation against one tenant. The same operations across N separate queues are N queues to enumerate, N connections to address, and a separate scheduler to keep them fair — the per-tenant levers exist, but the cross-tenant balance and the per-tenant cost do not come for free.

The reassign script shows why the group design holds together as one slot. The move is atomic by construction because both lanes share the one {q} hash tag — a cross-queue move is not even expressible:

Moving a job between two separate queues is a two-queue transaction — remove from one, add to the other, atomically, across keys that may live on different slots. Between two lanes of one queue it is a single script on one slot, and the group is outside the braces so the move stays inside the {q} tag. That is the structural payoff: one queue with groups buys per-tenant operations and atomic cross-tenant moves, because everything shares one slot.

So the rule is about what must be split. If tenants need separate storage, separate failure domains, or separate retention, separate queues are correct and the scheduler is the price. If tenants share all of that and what is needed is fairness plus per-tenant levers, one queue with groups is correct — the rota is the scheduler, the levers are data, and a tenant costs one hash field, not one queue.

In codemojex — a Telegram emoji-guessing game on the same stack — rooms share one queue as lanes rather than each holding its own: a room is created by its first guess (emq:{cm}:g:<PLR…>:pending), served its fair turn by the rota, capped by a per-room ceiling, and recoverable on its own — without one queue, one metric, and one pause switch per room of the game. The set of rooms is open and changes constantly, so a lane-per-room costs a hash field where a queue-per-room would cost a queue.

Wiring the per-tenant operations into a control plane at scale — the dashboards, the per-tenant alerts, the operator tooling that drives pause and reassign — is the queue's scaling layer, taught in the EchoMQ course rather than here.