@relaybus/mongodb 0.0.0 → 0.2.0

package/dist/index.cjs

@@ -7,46 +7,41 @@ var core = require('@relaybus/core');
 // src/claim-scan.ts
 var ClaimScan = class {
   #keys = /* @__PURE__ */ new Map();
-  /** Why the delivery must wait according to what this scan already knows, if it does. */
-  verdict(orderingId, sequence) {
+  /** Whether an unfinished delivery this scan knows of comes before the delivery with `sequence`. */
+  waits(orderingId, sequence) {
     const known = this.#keys.get(orderingId);
-    if (known?.openSequence !== void 0 && sequence > known.openSequence) {
-      return "open-predecessor";
-    }
-    return known?.leaseHeld === true ? "live-lease" : void 0;
+    return known?.openSequence !== void 0 && sequence > known.openSequence;
+  }
+  /** Whether this scan already learned anything about the key. */
+  knows(orderingId) {
+    return this.#keys.has(orderingId);
   }
   /** Records an unfinished delivery of the key with this sequence. */
   noteOpen(orderingId, sequence) {
     const known = this.#know(orderingId);
     known.openSequence = Math.min(known.openSequence ?? sequence, sequence);
   }
-  /** Records that this scan leased the delivery, which is now unfinished and holds a live lease. */
-  noteClaimed(orderingId, sequence) {
-    this.noteOpen(orderingId, sequence);
-    this.#know(orderingId).leaseHeld = true;
-  }
-  /** Records that a live lease of the key blocks every delivery of it. */
-  noteLeaseHeld(orderingId) {
-    this.#know(orderingId).leaseHeld = true;
-  }
-  /** Remembers a delivery that waited behind an unfinished predecessor. */
-  noteWaiting(orderingId, delivery) {
-    if (delivery.status === "pending") {
-      this.#know(orderingId).waiting.push(delivery._id);
-    }
+  /** Remembers a pending delivery of lane `laneId` that waited behind an unfinished predecessor. */
+  noteWaiting(orderingId, deliveryId, laneId) {
+    const known = this.#know(orderingId);
+    known.waiting.push(deliveryId);
+    known.laneId = laneId;
   }
   /**
    * Ids of the waiting deliveries of every key that accumulated at least
-   * `minimum` of them. Shorter queues stay in the claim index: moving them out
-   * and back would cost more than skipping them.
+   * `minimum` of them, or that lives in one of `handedBack`. Shorter queues
+   * of a lane that stays held remain in the claim index: moving them out and
+   * back would cost more than skipping them. In a lane handed back they are
+   * all its due work, and leaving them ready would make every later claim take
+   * the lane for nothing.
    */
-  waitingBacklogs(minimum) {
-    return [...this.#keys.values()].filter((known) => known.waiting.length >= minimum).flatMap((known) => known.waiting);
+  waitingBacklogs(minimum, handedBack) {
+    return [...this.#keys.values()].filter((known) => known.waiting.length >= minimum || handedBack.has(known.laneId)).flatMap((known) => known.waiting);
   }
   #know(orderingId) {
     let known = this.#keys.get(orderingId);
     if (known === void 0) {
-      known = { openSequence: void 0, leaseHeld: false, waiting: [] };
+      known = { openSequence: void 0, waiting: [], laneId: void 0 };
       this.#keys.set(orderingId, known);
     }
     return known;
@@ -55,21 +50,49 @@ var ClaimScan = class {
 function orderingIdentity(handler, key) {
   return `${handler}\0${key}`;
 }
-function toEventDocument(event, sequence) {
+
+// src/lanes.ts
+var LANE_COUNT = 256;
+var FNV_OFFSET_BASIS = 2166136261;
+var FNV_PRIME = 16777619;
+var utf8 = new TextEncoder();
+function laneOf(key, eventId) {
+  let hash = FNV_OFFSET_BASIS;
+  for (const byte of utf8.encode(key ?? eventId)) {
+    hash = Math.imul(hash ^ byte, FNV_PRIME);
+  }
+  return hash & LANE_COUNT - 1;
+}
+function formatLeaseToken(laneId, epoch, claims) {
+  return `${laneId}:${epoch}:${claims}`;
+}
+var LEASE_TOKEN_PATTERN = /^(\d{1,3}):(\d{1,15}):(\d{1,15})$/;
+function parseLeaseToken(token) {
+  const match = LEASE_TOKEN_PATTERN.exec(token);
+  if (match === null || Number(match[1]) >= LANE_COUNT) {
+    return void 0;
+  }
+  return { laneId: Number(match[1]), epoch: Number(match[2]), claims: Number(match[3]) };
+}
+
+// src/documents.ts
+function toEventDocument(event, sequence, handlers, createdAt) {
   const payloadJson = serializeWellFormed(event.payload, "payload");
   const headersJson = serializeWellFormed(event.headers, "headers");
   return {
     _id: event.id,
     type: event.type,
     source: event.source,
-    key: event.key,
-    sequence,
+    // Fields that are null or 0 are left out: every byte of a new document is written to the oplog too.
+    ...event.key === null ? {} : { key: event.key },
+    ...sequence === null ? {} : { sequence },
     ...payloadJson === void 0 ? {} : { payload: JSON.parse(payloadJson) },
     headers: JSON.parse(headersJson),
-    correlationId: event.correlationId,
-    causationId: event.causationId,
+    ...event.correlationId === null ? {} : { correlationId: event.correlationId },
+    ...event.causationId === null ? {} : { causationId: event.causationId },
     occurredAt: event.occurredAt,
-    revision: 0
+    handlers,
+    createdAt
   };
 }
 var LONE_SURROGATE_ESCAPE = /(?<!\\)(?:\\\\)*\\ud[89a-f][0-9a-f]{2}/i;
@@ -90,11 +113,11 @@ function toEnvelope(document) {
     id: document._id,
     type: document.type,
     source: document.source,
-    key: document.key,
+    key: document.key ?? null,
     payload: document.payload,
     headers: document.headers,
-    correlationId: document.correlationId,
-    causationId: document.causationId,
+    correlationId: document.correlationId ?? null,
+    causationId: document.causationId ?? null,
     occurredAt: document.occurredAt
   };
 }
@@ -105,31 +128,60 @@ function toDeliveryDocument(delivery, event, ordering, now) {
     eventType: event.type,
     handler: delivery.handler,
     ...ordering.key === null || ordering.sequence === null ? {} : { key: ordering.key, sequence: ordering.sequence },
+    laneId: laneOf(ordering.key, event.id),
     status: "pending",
     lane: "ready",
     attempts: 0,
+    // No updatedAt (it equals createdAt): every byte of a new document is written to the oplog too.
     availableAt: delivery.availableAt,
     dueAt: delivery.availableAt,
-    createdAt: now,
-    updatedAt: now
+    createdAt: now
   };
 }
-function toDeliveryRecord(document, event) {
+function toDeliveryRecord(document, event, runningIn) {
   return {
     id: document._id,
     handler: document.handler,
-    status: document.status,
-    attempts: document.attempts,
+    status: runningIn === void 0 ? document.status : "processing",
+    attempts: runningIn === void 0 ? document.attempts : document.attempts + 1,
     availableAt: document.availableAt,
-    leaseOwner: document.leaseOwner ?? null,
-    leaseExpiresAt: document.leaseExpiresAt ?? null,
+    leaseOwner: runningIn === void 0 ? null : runningIn.owner,
+    leaseExpiresAt: runningIn === void 0 ? null : runningIn.leaseExpiresAt,
     lastError: document.lastError === void 0 ? null : toErrorInfo(document.lastError),
     createdAt: document.createdAt,
-    updatedAt: document.updatedAt,
+    updatedAt: document.updatedAt ?? document.createdAt,
     completedAt: document.completedAt ?? null,
     event
   };
 }
+function toCompletedDeliveryRecord(document, event) {
+  return {
+    id: document._id,
+    handler: document.handler,
+    status: "completed",
+    attempts: document.attempts,
+    availableAt: document.availableAt,
+    leaseOwner: null,
+    leaseExpiresAt: null,
+    lastError: null,
+    createdAt: document.createdAt,
+    updatedAt: document.completedAt,
+    completedAt: document.completedAt,
+    event
+  };
+}
+function toCompletedDeliveryDocument(document, completedAt) {
+  return {
+    _id: document._id,
+    eventId: document.eventId,
+    eventType: document.eventType,
+    handler: document.handler,
+    attempts: document.attempts + 1,
+    availableAt: document.availableAt,
+    createdAt: document.createdAt,
+    completedAt
+  };
+}
 function toErrorInfo(error) {
   return error.stack === void 0 ? { name: error.name, message: error.message } : { name: error.name, message: error.message, stack: error.stack };
 }
@@ -167,11 +219,17 @@ var DEFAULT_TRANSACTION_OPTIONS = {
   readPreference: "primary"
 };
 var NAMESPACE_EXISTS = 48;
+var INDEX_NOT_FOUND = 27;
 var DEFAULT_PURGE_BATCH_SIZE = 500;
 var DEFAULT_LIST_LIMIT = 100;
 var MINIMUM_CANDIDATE_BATCH_SIZE = 32;
 var PARK_BACKLOG_THRESHOLD = 32;
 var PARK_UPDATE_CHUNK_SIZE = 1e3;
+var UPGRADE_BATCH_SIZE = 1e3;
+var INITIAL_LANES_PER_ROUND = 4;
+var LANES_PER_CANDIDATE_QUERY = 128;
+var CLAIM_INDEX_KEY = { laneId: 1, dueAt: 1, _id: 1, handler: 1 };
+var OBSOLETE_INDEXES = ["running"];
 var LEASE_FIELDS = { leaseOwner: "", leaseToken: "", leaseExpiresAt: "" };
 var FINISHED_FIELDS = { dueAt: "", lane: "" };
 var MongoEventStore = class {
@@ -180,9 +238,33 @@ var MongoEventStore = class {
   #events;
   #deliveries;
   #keySequences;
+  #lanes;
+  #completions;
+  #completionHistory;
   #transactionOptions;
   #purgeBatchSize;
-  #generateIdentifier;
+  #logger;
+  /**
+   * Identifies this store instance in the lanes it holds. A process that restarts
+   * with the same `leaseOwner` gets a new instance, so it never mistakes the
+   * lanes of its dead predecessor for its own: it waits for their leases to
+   * expire and takes them over like any other worker.
+   */
+  #instanceId = core.createUuidV7();
+  /** The last claim of each owner still running on this instance; the next one waits for it. */
+  #claimsInProgress = /* @__PURE__ */ new Map();
+  /**
+   * Claims this instance handed out that are not settled yet, keyed by
+   * {@link leaseKey} (delivery id and exact lease token), with the owner. A
+   * claim is settled when a completion, retry, release or burial of exactly
+   * that lease returned, or, for a completion inside the caller's transaction
+   * (which may still retry or roll back), when a later claim of the owner finds
+   * the delivery gone. After a failed claim, a listed delivery stays listed only
+   * if one of these is its current claim (current lane epoch and claim generation).
+   */
+  #handedOut = /* @__PURE__ */ new Map();
+  /** Owners whose lanes on this instance still need reconciling after a failed claim. */
+  #unreconciledOwners = /* @__PURE__ */ new Set();
   constructor(options) {
     const prefix = options.collectionPrefix ?? "relaybus_";
     assertCollectionPrefix(prefix);
@@ -205,13 +287,19 @@ var MongoEventStore = class {
     this.#events = database.collection(`${prefix}events`, collectionOptions);
     this.#deliveries = database.collection(`${prefix}deliveries`, collectionOptions);
     this.#keySequences = database.collection(`${prefix}key_sequences`, collectionOptions);
+    this.#lanes = database.collection(`${prefix}lanes`, collectionOptions);
+    this.#completions = database.collection(`${prefix}completed_deliveries`, collectionOptions);
+    this.#completionHistory = options.completionHistory ?? false;
     this.#transactionOptions = options.transactionOptions ?? DEFAULT_TRANSACTION_OPTIONS;
     this.#purgeBatchSize = purgeBatchSize;
-    this.#generateIdentifier = options.generateIdentifier ?? (() => core.createUuidV7());
+    this.#logger = options.logger ?? console;
   }
   /**
-   * Verifies the deployment supports transactions and creates the indexes.
-   * Safe to run repeatedly and from several processes.
+   * Verifies the deployment supports transactions, creates the collections and
+   * indexes and seeds the lane documents. Upgrades a 0.1.0 database in place
+   * first (see {@link MongoEventStore.#upgradeFromVersion010}); the seeded lanes
+   * mark the upgrade as done, so later runs skip it. Safe to run repeatedly and
+   * from several processes. Stop 0.1.0 workers before the first run.
    *
    * @throws ConfigurationError when the server is a standalone mongod.
    */
@@ -221,18 +309,27 @@ var MongoEventStore = class {
     if (!supportsTransactions) {
       throw createTransactionsUnsupportedError(void 0);
     }
-    for (const collection of [this.#events, this.#deliveries, this.#keySequences]) {
-      await this.#createCollectionIfMissing(collection.collectionName);
+    const collectionNames = [
+      this.#events.collectionName,
+      this.#deliveries.collectionName,
+      this.#keySequences.collectionName,
+      this.#lanes.collectionName,
+      ...this.#completionHistory ? [this.#completions.collectionName] : []
+    ];
+    for (const name of collectionNames) {
+      await this.#createCollectionIfMissing(name);
     }
+    if (await this.#lanes.countDocuments() < LANE_COUNT) {
+      await this.#upgradeFromVersion010();
+      await this.#seedLanes();
+    }
+    await this.#dropObsoleteIndexes();
     await this.#deliveries.createIndexes([
       // Idempotent appends and lookups by event.
       { key: { eventId: 1, handler: 1 }, name: "event_handler", unique: true },
-      // Claim: due work of a handler in due order. Holds ready deliveries only.
-      {
-        key: { handler: 1, dueAt: 1, _id: 1 },
-        name: "claim",
-        partialFilterExpression: { lane: "ready" }
-      },
+      // Claim: due work of a lane in due order. Holds ready deliveries only. The handler is
+      // last, so a query over many lanes and handlers stays a merge of one scan per lane.
+      { key: CLAIM_INDEX_KEY, name: "claim", partialFilterExpression: { lane: "ready" } },
       // Ordering: unfinished predecessors of a keyed delivery, parked or not.
       {
         key: { handler: 1, key: 1, sequence: 1 },
@@ -245,15 +342,9 @@ var MongoEventStore = class {
         name: "parked",
         partialFilterExpression: { lane: "parked" }
       },
-      // Live leases: a keyed delivery may not start while another of its key is running.
-      {
-        key: { handler: 1, key: 1, dueAt: 1 },
-        name: "running",
-        partialFilterExpression: { status: "processing", key: { $exists: true } }
-      },
       // Statistics: oldest due delivery across handlers.
       { key: { dueAt: 1 }, name: "due", partialFilterExpression: { dueAt: { $exists: true } } },
-      // Purge of completed deliveries.
+      // Purge of completed deliveries left by 0.1.0.
       {
         key: { completedAt: 1 },
         name: "completed",
@@ -266,16 +357,146 @@ var MongoEventStore = class {
       { key: { handler: 1, createdAt: 1 }, name: "handler_created" },
       { key: { eventType: 1, createdAt: 1 }, name: "type_created" }
     ]);
+    await this.#events.createIndexes([
+      { key: { createdAt: 1, _id: 1 }, name: "created" },
+      // Purge of events whose deliveries all completed: they are kept until `completedBefore` passes this.
+      {
+        key: { completedAt: 1, _id: 1 },
+        name: "completed",
+        partialFilterExpression: { completedAt: { $exists: true } }
+      }
+    ]);
+    if (this.#completionHistory) {
+      await this.#completions.createIndexes([
+        { key: { completedAt: 1, _id: 1 }, name: "completed" },
+        { key: { eventId: 1 }, name: "event" },
+        { key: { createdAt: 1, _id: 1 }, name: "created" }
+      ]);
+    }
   }
   async #createCollectionIfMissing(name) {
     try {
       await this.#database.createCollection(name);
     } catch (error) {
-      if (!(typeof error === "object" && error !== null && "code" in error && error.code === NAMESPACE_EXISTS)) {
+      if (!hasErrorCode(error, NAMESPACE_EXISTS)) {
         throw error;
       }
     }
   }
+  /**
+   * Converts the documents of a 0.1.0 database; every step is idempotent, so a
+   * run that crashed is simply repeated. Deliveries that were `processing`
+   * become `pending`, due at once (their attempt stays counted, as a lost lease
+   * would count it). The per-delivery lease fields go, every delivery gets its
+   * lane, and every event learns which handlers it already has deliveries for
+   * and when it was created. Deliveries completed under 0.1.0 stay as
+   * `completed` documents until a purge removes them.
+   */
+  async #upgradeFromVersion010() {
+    const legacy = this.#database.collection(this.#deliveries.collectionName);
+    await legacy.updateMany({ status: "processing" }, [
+      { $set: { status: "pending", lane: "ready", dueAt: "$availableAt" } }
+    ]);
+    await legacy.updateMany(
+      {
+        $or: [
+          { leaseOwner: { $exists: true } },
+          { leaseToken: { $exists: true } },
+          { leaseExpiresAt: { $exists: true } }
+        ]
+      },
+      { $unset: LEASE_FIELDS }
+    );
+    await inBatches(
+      this.#deliveries.find(
+        { laneId: { $exists: false } },
+        { projection: { eventId: 1, key: 1 }, batchSize: UPGRADE_BATCH_SIZE }
+      ),
+      async (documents) => {
+        await this.#deliveries.bulkWrite(
+          documents.map((document) => ({
+            updateOne: {
+              filter: { _id: document._id },
+              update: { $set: { laneId: laneOf(document.key ?? null, document.eventId) } }
+            }
+          })),
+          { ordered: false }
+        );
+      }
+    );
+    await inBatches(
+      this.#events.find(
+        { handlers: { $exists: false } },
+        { projection: { occurredAt: 1 }, batchSize: UPGRADE_BATCH_SIZE }
+      ),
+      async (events) => {
+        const known = new Map(
+          (await this.#deliveries.aggregate([
+            { $match: { eventId: { $in: events.map((event) => event._id) } } },
+            {
+              $group: {
+                _id: "$eventId",
+                handlers: { $addToSet: "$handler" },
+                createdAt: { $min: "$createdAt" }
+              }
+            }
+          ]).toArray()).map((group) => [group._id, group])
+        );
+        await this.#events.bulkWrite(
+          events.map((event) => {
+            const group = known.get(event._id);
+            return {
+              updateOne: {
+                // Only an event nobody converted yet: another process may have finished and subscribed a handler.
+                filter: { _id: event._id, handlers: { $exists: false } },
+                update: {
+                  $set: group === void 0 ? { handlers: [], createdAt: event.occurredAt } : { handlers: group.handlers, createdAt: group.createdAt }
+                }
+              }
+            };
+          }),
+          { ordered: false }
+        );
+      }
+    );
+  }
+  /** Creates the lane documents that do not exist yet. */
+  async #seedLanes() {
+    await this.#lanes.bulkWrite(
+      Array.from({ length: LANE_COUNT }, (_, laneId) => ({
+        updateOne: {
+          filter: { _id: laneId },
+          update: {
+            $setOnInsert: {
+              epoch: 0,
+              owner: null,
+              holder: null,
+              leaseExpiresAt: null,
+              inFlight: [],
+              lost: []
+            }
+          },
+          upsert: true
+        }
+      })),
+      { ordered: false }
+    );
+  }
+  /** Drops the 0.1.0 indexes that no query uses, and a `claim` index with the 0.1.0 key. */
+  async #dropObsoleteIndexes() {
+    for (const index of await this.#deliveries.indexes()) {
+      const obsolete = OBSOLETE_INDEXES.includes(index.name) || index.name === "claim" && Object.keys(index.key).join() !== Object.keys(CLAIM_INDEX_KEY).join();
+      if (obsolete) {
+        try {
+          await this.#deliveries.dropIndex(index.name);
+        } catch (error) {
+          if (!hasErrorCode(error, INDEX_NOT_FOUND)) {
+            throw error;
+          }
+        }
+      }
+    }
+  }
   /**
    * Runs `work` in a transaction on a new session and commits when it resolves.
    *
@@ -304,23 +525,34 @@ var MongoEventStore = class {
       throw error;
     }
   }
+  /**
+   * Writes the entries in `session`. An existing event gets a delivery only for
+   * handlers it does not list yet; the added handlers are appended to its list
+   * together with a `revision` increment, a real write that makes a concurrent
+   * purge of the event conflict with this transaction.
+   */
   async append(session, entries, now) {
     assertInTransaction(session, "append");
     const eventIds = [...new Set(entries.map((entry) => entry.event.id))];
     const storedEvents = new Map(
-      (await this.#events.find({ _id: { $in: eventIds } }, { session, projection: { key: 1, sequence: 1 } }).toArray()).map((stored) => [stored._id, stored])
-    );
-    const storedDeliveryKeys = new Set(
-      (await this.#deliveries.find({ eventId: { $in: eventIds } }, { session, projection: { eventId: 1, handler: 1 } }).toArray()).map((stored) => deliveryPairKey(stored.eventId, stored.handler))
+      (await this.#events.find(
+        { _id: { $in: eventIds } },
+        { session, projection: { key: 1, sequence: 1, handlers: 1 } }
+      ).toArray()).map((stored) => [stored._id, stored])
     );
     const appendedEventIds = [];
     const duplicateEventIds = [];
     const newEvents = [];
     const newDeliveries = [];
-    const touchedEventIds = /* @__PURE__ */ new Set();
+    const knownHandlers = /* @__PURE__ */ new Map();
+    const addedHandlers = /* @__PURE__ */ new Map();
     const orderingByEventId = /* @__PURE__ */ new Map();
     for (const [eventId, stored] of storedEvents) {
-      orderingByEventId.set(eventId, { key: stored.key, sequence: stored.sequence });
+      orderingByEventId.set(eventId, {
+        key: stored.key ?? null,
+        sequence: stored.sequence ?? null
+      });
+      knownHandlers.set(eventId, new Set(stored.handlers));
     }
     for (const { event, deliveries } of entries) {
       let ordering = orderingByEventId.get(event.id);
@@ -328,42 +560,49 @@ var MongoEventStore = class {
         const sequence = event.key === null ? null : await this.#nextSequence(event.key, session);
         ordering = { key: event.key, sequence };
         orderingByEventId.set(event.id, ordering);
-        newEvents.push(toEventDocument(event, sequence));
+        knownHandlers.set(event.id, /* @__PURE__ */ new Set());
+        newEvents.push({ event, sequence });
         appendedEventIds.push(event.id);
       } else {
         duplicateEventIds.push(event.id);
       }
+      const handlers = knownHandlers.get(event.id);
       for (const delivery of deliveries) {
-        const pairKey = deliveryPairKey(event.id, delivery.handler);
-        if (storedDeliveryKeys.has(pairKey)) {
+        if (handlers.has(delivery.handler)) {
           continue;
         }
-        storedDeliveryKeys.add(pairKey);
+        handlers.add(delivery.handler);
+        addedHandlers.set(event.id, [...addedHandlers.get(event.id) ?? [], delivery.handler]);
         newDeliveries.push(toDeliveryDocument(delivery, event, ordering, now));
-        if (storedEvents.has(event.id)) {
-          touchedEventIds.add(event.id);
-        }
       }
     }
     if (newEvents.length > 0) {
       await this.#events.bulkWrite(
-        newEvents.map((document) => ({
+        newEvents.map(({ event, sequence }) => {
+          const document = toEventDocument(event, sequence, addedHandlers.get(event.id) ?? [], now);
+          return {
+            updateOne: {
+              filter: { _id: document._id },
+              update: { $setOnInsert: document },
+              upsert: true
+            }
+          };
+        }),
+        { session, ordered: true }
+      );
+    }
+    const extendedEvents = [...addedHandlers].filter(([eventId]) => storedEvents.has(eventId));
+    if (extendedEvents.length > 0) {
+      await this.#events.bulkWrite(
+        extendedEvents.map(([eventId, handlers]) => ({
           updateOne: {
-            filter: { _id: document._id },
-            update: { $setOnInsert: document },
-            upsert: true
+            filter: { _id: eventId },
+            update: { $inc: { revision: 1 }, $push: { handlers: { $each: handlers } } }
           }
         })),
         { session, ordered: true }
       );
     }
-    if (touchedEventIds.size > 0) {
-      await this.#events.updateMany(
-        { _id: { $in: [...touchedEventIds] } },
-        { $inc: { revision: 1 } },
-        { session }
-      );
-    }
     if (newDeliveries.length > 0) {
       await this.#deliveries.bulkWrite(
         newDeliveries.map((document) => ({
@@ -378,86 +617,371 @@ var MongoEventStore = class {
     }
     return { appendedEventIds, duplicateEventIds, appendedDeliveryCount: newDeliveries.length };
   }
+  /**
+   * Claims up to `limit` due deliveries. It claims from the lanes this owner
+   * (and this store instance) holds under a live lease first, then takes free
+   * lanes with due work, a few at a time (4, 8, 16, ...) and the lane with the
+   * oldest due delivery first, so a worker holds only as many lanes as it
+   * needs. It then records the batch with one write per lane and hands back the
+   * lanes that yielded nothing and run nothing. No delivery document is
+   * written, except for the attempt charged to deliveries of a lane taken over
+   * and for parking (see {@link MongoEventStore.#parkDeliveries}).
+   *
+   * Taking a lane is one conditional `findOneAndUpdate` that also moves the
+   * previous owner's in-flight list to the lane's `lost` list; a lane another
+   * claimer took first is skipped, never waited for. Lost deliveries are charged
+   * one attempt before anything is read from the lane, and `lost` is cleared
+   * only after that. Whoever holds the lane next charges a `lost` list it finds
+   * first, so a claim that fails anywhere after the take loses no charge; the
+   * charge of a lost claim is recorded on the delivery, so charging the list
+   * again after a failure before the clear charges nothing twice.
+   * Nothing a failed claim did leaves a delivery listed as running.
+   */
   async claim(request) {
     if (request.handlers.length === 0 || request.limit <= 0) {
       return [];
     }
-    await this.#unparkNextDeliveries(request.handlers);
-    const claimed = [];
-    const scan = new ClaimScan();
-    const candidates = this.#deliveries.find(
-      { handler: { $in: [...request.handlers] }, dueAt: { $lte: request.now }, lane: "ready" },
-      {
-        sort: { dueAt: 1, _id: 1 },
-        batchSize: Math.max(request.limit * 2, MINIMUM_CANDIDATE_BATCH_SIZE)
+    const owner = request.leaseOwner;
+    const previous = this.#claimsInProgress.get(owner) ?? Promise.resolve();
+    const claimed = previous.then(() => this.#claimReconciled(request));
+    const settled = Promise.allSettled([claimed]);
+    this.#claimsInProgress.set(owner, settled);
+    void settled.then(() => {
+      if (this.#claimsInProgress.get(owner) === settled) {
+        this.#claimsInProgress.delete(owner);
       }
-    );
+    });
+    return claimed;
+  }
+  /**
+   * Runs one claim and remembers what it hands out. When the claim fails at any
+   * point, also after its record reached the database without the reply
+   * reaching this process, the lanes this owner holds on this instance are
+   * reconciled: every listed delivery this instance has not handed out, or has
+   * handed out and seen settled, is taken out of them, so nothing stays listed
+   * as running that nobody runs.
+   */
+  async #claimReconciled(request) {
+    const owner = request.leaseOwner;
+    if (this.#unreconciledOwners.has(owner)) {
+      await this.#reconcileLanes(owner);
+      this.#unreconciledOwners.delete(owner);
+    }
     try {
-      for await (const candidate of candidates) {
-        const leased = await this.#claimCandidate(candidate, request, scan);
-        if (leased !== void 0) {
-          claimed.push(leased);
-          if (claimed.length >= request.limit) {
-            break;
+      const claimed = await this.#claimNow(request);
+      for (const delivery of claimed) {
+        const { laneId, epoch } = parseLeaseToken(delivery.leaseToken);
+        this.#handedOut.set(leaseKey(delivery.deliveryId, delivery.leaseToken), {
+          deliveryId: delivery.deliveryId,
+          owner: request.leaseOwner,
+          laneId,
+          epoch
+        });
+      }
+      return claimed;
+    } catch (error) {
+      const [reconciled] = await Promise.allSettled([this.#reconcileLanes(owner)]);
+      if (reconciled.status === "rejected") {
+        this.#unreconciledOwners.add(owner);
+      }
+      throw error;
+    }
+  }
+  /**
+   * Takes every delivery this instance does not run out of the lanes `owner`
+   * holds on it: every listed delivery whose current claim (lane epoch and
+   * claim generation now) was not handed out by this instance, or was settled.
+   * One transaction, and the lanes are written first under their epoch and
+   * holder: a worker taking a lane over meanwhile conflicts with it, so its
+   * claim is never touched. The claim generation of every delivery taken out
+   * moves on, so no lease of those claims (a completion that failed and is
+   * retried later, say) can ever match a later claim of the same delivery.
+   * Registrations of this owner that are not the current claim of a listed
+   * delivery are dropped.
+   */
+  async #reconcileLanes(owner) {
+    await this.transaction(async (session) => {
+      const held = await this.#lanes.find({ owner, holder: this.#instanceId }, { session }).toArray();
+      const listed = held.flatMap((lane) => lane.inFlight);
+      const claimsById = new Map(
+        (await this.#deliveries.find(
+          { _id: { $in: listed }, status: "pending" },
+          { session, projection: { claims: 1 } }
+        ).toArray()).map((document) => [document._id, document.claims ?? 0])
+      );
+      const current = /* @__PURE__ */ new Set();
+      const unclaimed = held.map((lane) => ({
+        lane,
+        ids: lane.inFlight.filter((id) => {
+          const key = leaseKey(id, formatLeaseToken(lane._id, lane.epoch, claimsById.get(id) ?? 0));
+          current.add(key);
+          return !this.#handedOut.has(key);
+        })
+      }));
+      for (const [key, entry] of this.#handedOut) {
+        if (entry.owner === owner && !current.has(key)) {
+          this.#handedOut.delete(key);
+        }
+      }
+      if (held.length === 0) {
+        return;
+      }
+      await this.#lanes.bulkWrite(
+        unclaimed.map(({ lane, ids }) => ({
+          updateOne: {
+            filter: { _id: lane._id, epoch: lane.epoch, holder: this.#instanceId },
+            update: { $pull: { inFlight: { $in: ids } }, $inc: { revision: 1 } }
           }
+        })),
+        { session, ordered: false }
+      );
+      await this.#deliveries.updateMany(
+        { _id: { $in: unclaimed.flatMap((entry) => entry.ids) }, status: "pending" },
+        { $inc: { claims: 1 } },
+        { session }
+      );
+    });
+  }
+  /**
+   * Runs `operation`, which ends the claims of `leases` (completion, retry,
+   * release, burial), and once it returned forgets exactly those leases as
+   * handed out. When it throws, they stay registered: the caller may retry
+   * with the same lease, which must still find its claim.
+   */
+  async #settle(leases, operation) {
+    const result = await operation();
+    for (const lease of leases) {
+      this.#handedOut.delete(leaseKey(String(lease.deliveryId), String(lease.leaseToken)));
+    }
+    return result;
+  }
+  async #claimNow(request) {
+    const [held] = await Promise.all([
+      this.#lanes.find({
+        owner: request.leaseOwner,
+        holder: this.#instanceId,
+        leaseExpiresAt: { $gt: request.now }
+      }).toArray(),
+      this.#unparkNextDeliveries(request.handlers)
+    ]);
+    await this.#chargeLost(held);
+    const scope = new Map(
+      held.map((lane) => [
+        lane._id,
+        {
+          laneId: lane._id,
+          epoch: lane.epoch,
+          listed: lane.inFlight,
+          revision: lane.revision ?? 0
         }
+      ])
+    );
+    const running = this.#findRunning(held.flatMap((lane) => lane.inFlight)).then((documents) => ({
+      ids: new Set(documents.map((document) => document._id)),
+      keys: new Set(
+        documents.flatMap(
+          (document) => document.key === void 0 ? [] : [orderingIdentity(document.handler, document.key)]
+        )
+      )
+    }));
+    const scan = new ClaimScan();
+    const picked = [];
+    const pickFrom = async (lanes) => {
+      for (let offset = 0; offset < lanes.length; offset += LANES_PER_CANDIDATE_QUERY) {
+        if (picked.length < request.limit) {
+          await this.#pickCandidates(
+            lanes.slice(offset, offset + LANES_PER_CANDIDATE_QUERY),
+            request,
+            scan,
+            running,
+            picked
+          );
+        }
+      }
+    };
+    await pickFrom([...scope.values()]);
+    const passed = new Set(scope.keys());
+    for (let laneCount = INITIAL_LANES_PER_ROUND; picked.length < request.limit; laneCount *= 2) {
+      const free = await this.#findFreeLanes(request, laneCount, [...passed]);
+      if (free.length === 0) {
+        break;
+      }
+      for (const laneId of free) {
+        passed.add(laneId);
+      }
+      const taken = await this.#takeLanes(free, request);
+      for (const lane of taken) {
+        scope.set(lane.laneId, lane);
+      }
+      await pickFrom(taken);
+    }
+    const events = await this.#readEnvelopes(picked.map((document) => document.eventId));
+    const runningIds = (await running).ids;
+    const gone = new Set(
+      held.flatMap(
+        (lane) => lane.inFlight.filter((id) => !runningIds.has(id)).map((id) => `${id}\0${lane._id}:${lane.epoch}`)
+      )
+    );
+    for (const [key, entry] of this.#handedOut) {
+      if (entry.owner === request.leaseOwner && gone.has(`${entry.deliveryId}\0${entry.laneId}:${entry.epoch}`)) {
+        this.#handedOut.delete(key);
       }
-    } finally {
-      await candidates.close();
     }
-    await this.#parkDeliveries(scan.waitingBacklogs(PARK_BACKLOG_THRESHOLD));
-    return this.#toClaimedDeliveries(claimed, request.leaseExpiresAt);
+    const { recorded, handedBack } = await this.#recordClaim(scope, picked, runningIds, request);
+    const claimed = await this.#releaseOvertaken(
+      picked.filter((document) => recorded.has(document.laneId)),
+      scope
+    );
+    await this.#parkWaiting(scan.waitingBacklogs(PARK_BACKLOG_THRESHOLD, handedBack));
+    return claimed.map((document) => ({
+      deliveryId: document._id,
+      leaseToken: formatLeaseToken(
+        document.laneId,
+        scope.get(document.laneId).epoch,
+        document.claims ?? 0
+      ),
+      handler: document.handler,
+      attempt: document.attempts + 1,
+      leaseExpiresAt: request.leaseExpiresAt,
+      event: events.get(document.eventId)
+    }));
   }
-  async extendLease(lease, leaseExpiresAt, now) {
-    return this.#updateLeased(lease, void 0, {
-      $set: { leaseExpiresAt, dueAt: leaseExpiresAt, updatedAt: now }
+  /**
+   * Extends the lease of the lane a running delivery belongs to. The lane lease
+   * never shrinks, so a repeated renewal with the same value still holds. An
+   * expired lease nobody took over is still renewed, so `_now` is not needed.
+   */
+  async extendLease(lease, leaseExpiresAt, _now) {
+    const held = parseLeaseToken(lease.leaseToken);
+    if (held === void 0) {
+      return false;
+    }
+    const deliveryId = String(lease.deliveryId);
+    return this.transaction(async (session) => {
+      const running = await this.#deliveries.findOne(ofClaim({ ...held, deliveryId }), {
+        session,
+        projection: { _id: 1 }
+      });
+      if (running === null) {
+        return false;
+      }
+      const renewed = await this.#lanes.updateOne(
+        { _id: held.laneId, epoch: held.epoch, inFlight: deliveryId },
+        { $max: { leaseExpiresAt } },
+        { session }
+      );
+      return renewed.matchedCount === 1;
     });
   }
+  /**
+   * Deletes the delivery (and records it in the completion history, when kept).
+   * With `session` the deletion commits with the caller's transaction; without,
+   * it runs in a transaction of its own. Returns false when the lease was lost.
+   */
   async complete(lease, now, session) {
     if (session !== void 0) {
       assertInTransaction(session, "complete");
     }
-    return this.#updateLeased(lease, session, {
-      $set: { status: "completed", completedAt: now, updatedAt: now },
-      $unset: { ...LEASE_FIELDS, ...FINISHED_FIELDS }
-    });
+    return (await this.#completeLeases([lease], now, session))[0];
   }
+  /**
+   * Completes many leases with a fixed number of round trips, whatever lanes
+   * they belong to: three commands without a completion history, one
+   * transaction with it (see {@link MongoEventStore.#deleteFenced}).
+   * Returns one flag per lease in input order; a lease listed twice completes
+   * once, and a token this store cannot have issued is refused.
+   */
+  completeMany(leases, now) {
+    return this.#completeLeases(leases, now, void 0);
+  }
+  /** Returns a running delivery to pending, due at `availableAt`, and counts the attempt that ended. */
   async reschedule(lease, availableAt, error, now) {
-    return this.#updateLeased(lease, void 0, {
-      $set: {
-        status: "pending",
-        availableAt,
-        dueAt: availableAt,
-        lastError: toErrorInfo(error),
-        updatedAt: now
-      },
-      $unset: LEASE_FIELDS
+    return this.#leaveFlight(lease, {
+      $set: { availableAt, dueAt: availableAt, lastError: toErrorInfo(error), updatedAt: now },
+      $inc: { attempts: 1, claims: 1 }
     });
   }
+  /** Gives a running delivery back without counting the attempt: pending, due `now`. */
   async release(lease, now) {
-    return this.#updateLeased(lease, void 0, {
-      $set: { status: "pending", availableAt: now, dueAt: now, updatedAt: now },
-      $inc: { attempts: -1 },
-      $unset: LEASE_FIELDS
+    return this.#leaveFlight(lease, {
+      $set: { availableAt: now, dueAt: now, updatedAt: now },
+      $inc: { claims: 1 }
     });
   }
+  /** Moves a running delivery to dead and counts the attempt that ended. */
   async bury(lease, error, now) {
-    return this.#updateLeased(lease, void 0, {
+    return this.#leaveFlight(lease, {
       $set: { status: "dead", lastError: toErrorInfo(error), updatedAt: now },
-      $unset: { ...LEASE_FIELDS, ...FINISHED_FIELDS }
+      $unset: FINISHED_FIELDS,
+      $inc: { attempts: 1, claims: 1 }
     });
   }
+  /**
+   * Frees every lane `leaseOwner` holds that runs no delivery, so other workers
+   * need not wait for the lease to expire. Lanes with running deliveries stay leased.
+   */
+  async relinquish(leaseOwner) {
+    const held = await this.#lanes.find({ owner: String(leaseOwner), holder: this.#instanceId }).toArray();
+    const runningIds = new Set(
+      (await this.#findRunning(held.flatMap((lane) => lane.inFlight))).map(
+        (document) => document._id
+      )
+    );
+    const idle = held.filter((lane) => lane.inFlight.every((id) => !runningIds.has(id)));
+    if (idle.length > 0) {
+      await this.#lanes.bulkWrite(
+        idle.map((lane) => freeLane(lane._id, lane.epoch, lane.revision ?? 0, lane.inFlight)),
+        { ordered: false }
+      );
+    }
+  }
+  /**
+   * Lists deliveries in creation order. A delivery is `processing` while its
+   * document exists as `pending` and its lane lists it; its attempt count then
+   * includes the running attempt, and owner and expiry are those of the lane
+   * lease. Completion history records (when kept) are listed as `completed`.
+   */
   async listDeliveries(query) {
-    const filter = {
-      ...query.status === void 0 ? {} : { status: String(query.status) },
+    const status = query.status === void 0 ? void 0 : String(query.status);
+    const common = {
       ...query.handler === void 0 ? {} : { handler: String(query.handler) },
       ...query.eventType === void 0 ? {} : { eventType: String(query.eventType) },
       ...query.eventId === void 0 ? {} : { eventId: String(query.eventId) }
     };
-    const documents = await this.#deliveries.find(filter, { sort: { createdAt: 1, _id: 1 }, limit: query.limit ?? DEFAULT_LIST_LIMIT }).toArray();
-    const events = await this.#readEnvelopes(documents.map((document) => document.eventId));
-    return documents.map((document) => toDeliveryRecord(document, events.get(document.eventId)));
+    const limit = query.limit ?? DEFAULT_LIST_LIMIT;
+    const lanes = await this.#lanes.find({ "inFlight.0": { $exists: true } }, { projection: { epoch: 0 } }).toArray();
+    const listed = lanes.flatMap((lane) => lane.inFlight);
+    const derivedStatuses = /* @__PURE__ */ new Map([
+      ["processing", { status: "pending", _id: { $in: listed } }],
+      ["pending", { status: "pending", _id: { $nin: listed } }]
+    ]);
+    const filter = {
+      ...common,
+      ...status === void 0 ? {} : derivedStatuses.get(status) ?? { status }
+    };
+    const sort = { createdAt: 1, _id: 1 };
+    const documents = await this.#deliveries.find(filter, { sort, limit }).toArray();
+    const history = this.#completionHistory && (status === void 0 || status === "completed") ? await this.#completions.find(common, { sort, limit }).toArray() : [];
+    const events = await this.#readEnvelopes([
+      ...documents.map((document) => document.eventId),
+      ...history.map((document) => document.eventId)
+    ]);
+    const laneById = new Map(lanes.map((lane) => [lane._id, lane]));
+    const records = [
+      ...documents.map((document) => {
+        const lane = laneById.get(document.laneId);
+        const runs = document.status === "pending" && lane?.inFlight.includes(document._id) === true;
+        return toDeliveryRecord(document, events.get(document.eventId), runs ? lane : void 0);
+      }),
+      ...history.map(
+        (document) => toCompletedDeliveryRecord(document, events.get(document.eventId))
+      )
+    ];
+    return records.sort(
+      (left, right) => left.createdAt.getTime() - right.createdAt.getTime() || compareText(left.id, right.id)
+    ).slice(0, limit);
   }
+  /** Moves dead deliveries back to pending with a fresh attempt budget. */
   async requeue(deliveryIds, now) {
     const result = await this.#deliveries.updateMany(
       { _id: { $in: deliveryIds.map(String) }, status: "dead" },
@@ -474,38 +998,93 @@ var MongoEventStore = class {
     );
     return result.modifiedCount;
   }
+  /**
+   * Deletes, in batches of `purgeBatchSize`, dead deliveries last updated before
+   * `deadBefore`, and completion history records (and `completed` documents left
+   * by 0.1.0) completed before `completedBefore`, each batch in one transaction
+   * together with the events it left without any reference. Finally, events
+   * nothing references are deleted: one with a completed delivery once its last
+   * completion is before `completedBefore` (never by `deadBefore` alone), one
+   * that never had a completion (no subscribers, or only dead letters) once it
+   * was created before the earliest given cutoff. The batch step applies the
+   * same rule to events whose last completion is recorded.
+   */
   async purge(request) {
-    const filters = [];
-    if (request.completedBefore !== void 0) {
-      filters.push({ status: "completed", completedAt: { $lt: request.completedBefore } });
+    const total = { deletedDeliveries: 0, deletedEvents: 0 };
+    const steps = [];
+    const { completedBefore, deadBefore } = request;
+    if (completedBefore !== void 0) {
+      steps.push(
+        () => this.#purgeMatching(
+          this.#purgeable(this.#deliveries.collectionName),
+          { status: "completed", completedAt: { $lt: completedBefore } },
+          completedBefore
+        )
+      );
+      if (this.#completionHistory) {
+        steps.push(
+          () => this.#purgeMatching(
+            this.#purgeable(this.#completions.collectionName),
+            { completedAt: { $lt: completedBefore } },
+            completedBefore
+          )
+        );
+      }
     }
-    if (request.deadBefore !== void 0) {
-      filters.push({ status: "dead", updatedAt: { $lt: request.deadBefore } });
+    if (deadBefore !== void 0) {
+      steps.push(
+        () => this.#purgeMatching(
+          this.#purgeable(this.#deliveries.collectionName),
+          { status: "dead", updatedAt: { $lt: deadBefore } },
+          completedBefore
+        )
+      );
     }
-    let deletedDeliveries = 0;
-    let deletedEvents = 0;
-    for (const filter of filters) {
-      const result = await this.#purgeMatching(filter);
-      deletedDeliveries += result.deletedDeliveries;
-      deletedEvents += result.deletedEvents;
+    for (const step of steps) {
+      const result = await step();
+      total.deletedDeliveries += result.deletedDeliveries;
+      total.deletedEvents += result.deletedEvents;
     }
-    return { deletedDeliveries, deletedEvents };
+    const orphanCutoff = [completedBefore, deadBefore].filter((cutoff) => cutoff !== void 0).sort((first, second) => first.getTime() - second.getTime())[0];
+    if (orphanCutoff !== void 0) {
+      total.deletedEvents += await this.#purgeOrphanEvents(orphanCutoff, completedBefore);
+    }
+    return total;
   }
+  /**
+   * Counts by derived status. `pending` excludes running deliveries; `completed`
+   * counts history records and 0.1.0 `completed` documents. `oldestDueAt` is the
+   * oldest instant at which a delivery became claimable: the due time of a
+   * pending delivery nobody runs, or the lease expiry of a lane that still runs
+   * deliveries.
+   */
   async statistics(now) {
-    const statuses = ["pending", "processing", "completed", "dead"];
-    const [pending, processing, completed, dead] = await Promise.all(
-      statuses.map((status) => this.#deliveries.countDocuments({ status }))
-    );
-    const oldestDue = await this.#deliveries.findOne(
-      { dueAt: { $lte: now } },
+    const lanes = await this.#lanes.find({ "inFlight.0": { $exists: true } }, { projection: { inFlight: 1, leaseExpiresAt: 1 } }).toArray();
+    const [stored, dead, legacyCompleted, history, running] = await Promise.all([
+      this.#deliveries.countDocuments({ status: "pending" }),
+      this.#deliveries.countDocuments({ status: "dead" }),
+      this.#deliveries.countDocuments({ status: "completed" }),
+      this.#completionHistory ? this.#completions.countDocuments() : Promise.resolve(0),
+      this.#findRunning(lanes.flatMap((lane) => lane.inFlight))
+    ]);
+    const runningIds = new Set(running.map((document) => document._id));
+    const waiting = await this.#deliveries.findOne(
+      { dueAt: { $lte: now }, _id: { $nin: [...runningIds] } },
       { sort: { dueAt: 1 }, projection: { dueAt: 1 } }
     );
+    const dueTimes = lanes.filter(
+      (lane) => lane.leaseExpiresAt !== null && lane.leaseExpiresAt <= now && lane.inFlight.some((id) => runningIds.has(id))
+    ).map((lane) => lane.leaseExpiresAt.getTime());
+    if (waiting !== null) {
+      dueTimes.push(waiting.dueAt.getTime());
+    }
     return {
-      pending,
-      processing,
-      completed,
+      // The counts are separate reads; a completion between them must not make this negative.
+      pending: Math.max(0, stored - running.length),
+      processing: running.length,
+      completed: legacyCompleted + history,
       dead,
-      oldestDueAt: oldestDue?.dueAt ?? null
+      oldestDueAt: dueTimes.length === 0 ? null : new Date(Math.min(...dueTimes))
     };
   }
   /** Atomically increments the counter of `key`; conflicting appends of the key serialize here. */
@@ -517,92 +1096,376 @@ var MongoEventStore = class {
     );
     return counter.value;
   }
-  async #claimCandidate(candidate, request, scan) {
-    const { key, sequence } = candidate;
-    if (key === void 0) {
-      return this.#lease(candidate, request);
+  /** The listed deliveries that run: those whose document still exists as pending. */
+  async #findRunning(listed) {
+    if (listed.length === 0) {
+      return [];
     }
-    const orderingId = orderingIdentity(candidate.handler, key);
-    const known = scan.verdict(orderingId, sequence);
-    if (known === "open-predecessor") {
-      scan.noteWaiting(orderingId, candidate);
-      return void 0;
+    return this.#deliveries.find(
+      { _id: { $in: [...listed] }, status: "pending" },
+      { projection: { handler: 1, key: 1, laneId: 1 } }
+    ).toArray();
+  }
+  /**
+   * Up to `laneCount` lanes nobody holds under a live lease that have a due,
+   * ready delivery of the requested handlers, the lane with the oldest such
+   * delivery first, leaving out `passed`. One round trip: the oldest delivery
+   * of each lane is one index probe on the server. A lane whose due deliveries
+   * all wait behind an unfinished predecessor is taken at most once: the claim
+   * that hands it back parks them (see {@link ClaimScan.waitingBacklogs}).
+   */
+  async #findFreeLanes(request, laneCount, passed) {
+    const lanes = await this.#lanes.aggregate([
+      {
+        $match: {
+          _id: { $nin: passed },
+          $or: [{ leaseExpiresAt: null }, { leaseExpiresAt: { $lte: request.now } }]
+        }
+      },
+      {
+        $lookup: {
+          from: this.#deliveries.collectionName,
+          localField: "_id",
+          foreignField: "laneId",
+          pipeline: [
+            {
+              $match: {
+                handler: { $in: [...request.handlers] },
+                lane: "ready",
+                dueAt: { $lte: request.now }
+              }
+            },
+            { $sort: { dueAt: 1, _id: 1 } },
+            { $limit: 1 },
+            { $project: { dueAt: 1 } }
+          ],
+          as: "oldest"
+        }
+      },
+      { $unwind: "$oldest" },
+      { $sort: { "oldest.dueAt": 1, "oldest._id": 1 } },
+      { $limit: laneCount },
+      { $project: { _id: 1 } }
+    ]).toArray();
+    return lanes.map((lane) => lane._id);
+  }
+  /**
+   * Takes the lanes with one conditional write each, run in parallel; a lane
+   * taken by someone else meanwhile is skipped. The same write moves the
+   * previous owner's in-flight list to `lost`, which is charged before any
+   * delivery of the lanes is read (see {@link MongoEventStore.#chargeLost}).
+   */
+  async #takeLanes(laneIds, request) {
+    const after = await Promise.all(
+      laneIds.map(
+        (laneId) => this.#lanes.findOneAndUpdate(
+          {
+            _id: laneId,
+            $or: [{ leaseExpiresAt: null }, { leaseExpiresAt: { $lte: request.now } }]
+          },
+          [
+            {
+              $set: {
+                epoch: { $add: ["$epoch", 1] },
+                owner: { $literal: request.leaseOwner },
+                holder: { $literal: this.#instanceId },
+                leaseExpiresAt: { $literal: request.leaseExpiresAt },
+                // Each lost delivery keeps the epoch it was claimed under: the key of its charge.
+                lost: {
+                  $setUnion: [
+                    { $ifNull: ["$lost", []] },
+                    { $map: { input: "$inFlight", in: { id: "$$this", epoch: "$epoch" } } }
+                  ]
+                },
+                inFlight: { $literal: [] }
+              }
+            }
+          ],
+          { returnDocument: "after" }
+        )
+      )
+    );
+    const taken = after.filter((lane) => lane !== null);
+    await this.#chargeLost(taken);
+    return taken.map((lane) => ({
+      laneId: lane._id,
+      epoch: lane.epoch,
+      listed: lane.inFlight,
+      revision: lane.revision ?? 0
+    }));
+  }
+  /**
+   * Charges one attempt to every pending delivery listed in the `lost` lists of
+   * `lanes` (deliveries whose lane was taken while they ran), then clears those
+   * lists under the lanes' current epochs. The charge is a write on each lost
+   * delivery that comes before any read of the lane's deliveries: a completion
+   * of the previous owner deletes the same documents, so the two conflict and
+   * cannot both succeed. The charge also moves the claim generation on, which
+   * fences every lease of the lost claim, and records the lost claim
+   * (`lostAt` = lane and epoch it was claimed under): a holder that charges the
+   * list again after a failure before the clear skips deliveries already
+   * charged for that claim.
+   */
+  async #chargeLost(lanes) {
+    const losing = lanes.filter((lane) => lane.lost.length > 0);
+    if (losing.length === 0) {
+      return;
     }
-    if (known === "live-lease") {
-      return void 0;
+    const lost = losing.flatMap((lane) => lane.lost).sort((left, right) => left.epoch - right.epoch);
+    await this.#deliveries.bulkWrite(
+      lost.map(({ id, epoch }) => ({
+        updateOne: {
+          filter: { _id: id, status: "pending", lostAt: { $not: { $gte: epoch } } },
+          update: { $inc: { attempts: 1, claims: 1 }, $set: { lostAt: epoch } }
+        }
+      })),
+      { ordered: true }
+    );
+    await this.#lanes.bulkWrite(
+      losing.map((lane) => ({
+        updateOne: { filter: { _id: lane._id, epoch: lane.epoch }, update: { $set: { lost: [] } } }
+      })),
+      { ordered: false }
+    );
+  }
+  /**
+   * Adds the claimable candidates of `lanes` to `picked`, in due order, until
+   * `request.limit` is reached. A delivery is a candidate when it is ready, due
+   * and not in flight in its lane. A keyed candidate is claimable only when
+   * (a) no earlier delivery of its handler and key is pending (a running one is
+   * still a pending document) and (b) no other delivery of them runs. Running
+   * deliveries of a key live in the key's lane, which this owner holds, so the
+   * running keys (loaded once from the held lanes) and this claim's own picks
+   * are all of them.
+   *
+   * Candidates are read in pages with a limit, so no cursor is left open, and
+   * the predecessors of the keys of a page are looked up in parallel, one
+   * lookup per key.
+   */
+  async #pickCandidates(lanes, request, scan, running, picked) {
+    const pageSize = Math.max((request.limit - picked.length) * 2, MINIMUM_CANDIDATE_BATCH_SIZE);
+    const filter = {
+      laneId: { $in: lanes.map((lane) => lane.laneId) },
+      handler: { $in: [...request.handlers] },
+      lane: "ready",
+      dueAt: { $lte: request.now },
+      _id: { $nin: lanes.flatMap((lane) => lane.listed) }
+    };
+    let after;
+    for (; ; ) {
+      const [page, { keys }] = await Promise.all([
+        this.#deliveries.find(
+          after === void 0 ? filter : {
+            $and: [
+              filter,
+              {
+                $or: [
+                  { dueAt: { $gt: after.dueAt } },
+                  { dueAt: after.dueAt, _id: { $gt: after._id } }
+                ]
+              }
+            ]
+          },
+          { sort: { dueAt: 1, _id: 1 }, limit: pageSize }
+        ).toArray(),
+        running
+      ]);
+      for (let offset = 0; offset < page.length; ) {
+        const slice = page.slice(offset, offset + request.limit - picked.length);
+        offset += slice.length;
+        await this.#notePredecessors(slice, scan);
+        for (const candidate of slice) {
+          if (isClaimable(candidate, scan, keys)) {
+            picked.push(candidate);
+          }
+        }
+        if (picked.length >= request.limit) {
+          return;
+        }
+      }
+      if (page.length < pageSize) {
+        return;
+      }
+      after = page.at(-1);
+    }
+  }
+  /**
+   * Looks up, in parallel and once per key, whether an unfinished delivery
+   * precedes the earliest candidate of each keyed (handler, key) of `page` that
+   * this claim knows nothing about yet, and tells `scan`. The earliest candidate
+   * is itself unfinished, so every later candidate of its key waits at least for it.
+   */
+  async #notePredecessors(page, scan) {
+    const earliest = /* @__PURE__ */ new Map();
+    for (const candidate of page) {
+      if (candidate.key !== void 0) {
+        const orderingId = orderingIdentity(candidate.handler, candidate.key);
+        const known = earliest.get(orderingId);
+        if (!scan.knows(orderingId) && (known?.sequence ?? Infinity) > candidate.sequence) {
+          earliest.set(orderingId, candidate);
+        }
+      }
     }
-    const predecessor = await this.#findUnfinishedPredecessor(candidate.handler, key, sequence);
-    if (predecessor !== void 0) {
-      scan.noteOpen(orderingId, predecessor);
-      scan.noteWaiting(orderingId, candidate);
-      return void 0;
+    await Promise.all(
+      [...earliest].map(async ([orderingId, candidate]) => {
+        const predecessor = await this.#findUnfinishedPredecessor(
+          candidate.handler,
+          candidate.key,
+          candidate.sequence
+        );
+        scan.noteOpen(orderingId, predecessor ?? candidate.sequence);
+      })
+    );
+  }
+  /**
+   * Records the picks in their lanes, one conditional write per lane and one
+   * round trip for all of them, and frees the lanes that yielded nothing and run
+   * nothing. A picked lane lists its running deliveries plus the new ones (ids
+   * whose documents are gone are pruned) and its lease reaches
+   * `request.leaseExpiresAt`. Returns the lanes whose picks were recorded: every
+   * write is conditional on the claim's epoch, owner and store instance, so a
+   * lane that changed hands, or was handed back by `relinquish`, in the meantime
+   * keeps its deliveries for whoever takes it next.
+   */
+  async #recordClaim(scope, picked, runningIds, request) {
+    const picksByLane = /* @__PURE__ */ new Map();
+    const handedBack = /* @__PURE__ */ new Set();
+    for (const document of picked) {
+      picksByLane.set(document.laneId, [...picksByLane.get(document.laneId) ?? [], document._id]);
     }
-    if (await this.#hasLiveLease(candidate.handler, key, request.now)) {
-      scan.noteLeaseHeld(orderingId);
-      return void 0;
+    const operations = [];
+    for (const lane of scope.values()) {
+      const gone = lane.listed.filter((id) => !runningIds.has(id));
+      const ids = picksByLane.get(lane.laneId);
+      if (ids !== void 0) {
+        operations.push({
+          updateOne: {
+            filter: {
+              _id: lane.laneId,
+              epoch: lane.epoch,
+              owner: request.leaseOwner,
+              holder: this.#instanceId,
+              // A record that reaches the server late (after its claim failed and reconciled)
+              // finds a newer revision and changes nothing.
+              revision: atCount(lane.revision)
+            },
+            update: [
+              {
+                $set: {
+                  inFlight: {
+                    $concatArrays: [
+                      {
+                        $filter: {
+                          input: "$inFlight",
+                          cond: { $not: [{ $in: ["$$this", { $literal: gone }] }] }
+                        }
+                      },
+                      { $literal: ids }
+                    ]
+                  },
+                  leaseExpiresAt: { $max: ["$leaseExpiresAt", request.leaseExpiresAt] },
+                  revision: { $add: [{ $ifNull: ["$revision", 0] }, 1] }
+                }
+              }
+            ]
+          }
+        });
+      } else if (gone.length === lane.listed.length) {
+        operations.push(freeLane(lane.laneId, lane.epoch, lane.revision, gone));
+        handedBack.add(lane.laneId);
+      }
     }
-    const leased = await this.#lease(candidate, request);
-    if (leased === void 0) {
-      return void 0;
+    if (operations.length === 0) {
+      return { recorded: /* @__PURE__ */ new Set(), handedBack };
     }
-    const lateBlocker = await this.#findUnfinishedPredecessor(candidate.handler, key, sequence);
-    if (lateBlocker !== void 0) {
-      await this.#restore(candidate, leased);
-      scan.noteOpen(orderingId, lateBlocker);
-      return void 0;
+    const result = await this.#lanes.bulkWrite(operations, { ordered: false });
+    if (result.matchedCount === operations.length) {
+      return { recorded: new Set(picksByLane.keys()), handedBack };
     }
-    scan.noteClaimed(orderingId, sequence);
-    return leased;
+    const current = await this.#lanes.find(
+      { _id: { $in: [...picksByLane.keys()] } },
+      { projection: { epoch: 1, owner: 1, holder: 1, revision: 1 } }
+    ).toArray();
+    const recorded = new Set(
+      current.filter(
+        (lane) => lane.epoch === scope.get(lane._id).epoch && lane.revision === scope.get(lane._id).revision + 1 && lane.owner === request.leaseOwner && lane.holder === this.#instanceId
+      ).map((lane) => lane._id)
+    );
+    return { recorded, handedBack };
   }
   /**
-   * Takes the delivery with one conditional update that pins the exact state
-   * that was selected, so a competing claimer, a finished lease, a reschedule
-   * or a parking since then makes it match nothing.
+   * Gives back the recorded keyed picks that a delivery requeued during the
+   * claim now precedes, without charging an attempt, and returns the rest. The
+   * claim checked their predecessors before recording them; a dead letter
+   * requeued in between would otherwise wait behind its own successor. Once a
+   * pick is recorded, a later requeue waits for it like for any running delivery.
    */
-  async #lease(candidate, request) {
-    const leased = await this.#deliveries.findOneAndUpdate(
+  async #releaseOvertaken(claimed, scope) {
+    const keyed = claimed.filter((document) => document.key !== void 0);
+    if (keyed.length === 0) {
+      return [...claimed];
+    }
+    const blockers = await this.#deliveries.find(
       {
-        _id: candidate._id,
-        status: candidate.status,
-        lane: "ready",
-        attempts: candidate.attempts,
-        dueAt: candidate.dueAt
+        $or: keyed.map((document) => ({
+          handler: document.handler,
+          key: document.key,
+          sequence: { $lt: document.sequence },
+          dueAt: { $exists: true }
+        }))
       },
-      {
-        $set: {
-          status: "processing",
-          leaseOwner: request.leaseOwner,
-          leaseToken: this.#generateIdentifier(),
-          leaseExpiresAt: request.leaseExpiresAt,
-          dueAt: request.leaseExpiresAt,
-          updatedAt: request.now
-        },
-        $inc: { attempts: 1 }
-      },
-      { returnDocument: "after" }
+      { projection: { handler: 1, key: 1 } }
+    ).toArray();
+    const blocked = new Set(
+      blockers.map((blocker) => orderingIdentity(blocker.handler, blocker.key))
+    );
+    const overtaken = new Set(
+      keyed.filter((document) => blocked.has(orderingIdentity(document.handler, document.key))).map((document) => document._id)
     );
-    return leased ?? void 0;
+    if (overtaken.size === 0) {
+      return [...claimed];
+    }
+    await this.#releasePicks(
+      claimed.filter((document) => overtaken.has(document._id)),
+      scope
+    );
+    return claimed.filter((document) => !overtaken.has(document._id));
   }
-  /** Puts a delivery that was leased a moment ago back exactly as it was selected. */
-  async #restore(selected, leased) {
-    const state = {
-      status: selected.status,
-      attempts: selected.attempts,
-      dueAt: selected.dueAt,
-      updatedAt: selected.updatedAt
-    };
-    await this.#deliveries.updateOne(
-      { _id: leased._id, status: "processing", leaseToken: leased.leaseToken },
-      selected.status === "processing" ? {
-        $set: {
-          ...state,
-          leaseOwner: selected.leaseOwner,
-          leaseToken: selected.leaseToken,
-          leaseExpiresAt: selected.leaseExpiresAt
-        }
-      } : { $set: state, $unset: LEASE_FIELDS }
+  /** Takes recorded picks out of their lanes' in-flight lists again, under the claim's epochs and record revisions. */
+  async #releasePicks(documents, scope) {
+    const idsByLane = /* @__PURE__ */ new Map();
+    for (const document of documents) {
+      idsByLane.set(document.laneId, [...idsByLane.get(document.laneId) ?? [], document._id]);
+    }
+    await Promise.all(
+      [...idsByLane].map(
+        ([laneId, ids]) => this.#lanes.updateOne(
+          // Under the revision the record left: a pull that reaches the server late, after a
+          // reconciliation and a newer claim of the same delivery, matches nothing.
+          {
+            _id: laneId,
+            epoch: scope.get(laneId).epoch,
+            revision: scope.get(laneId).revision + 1
+          },
+          { $pull: { inFlight: { $in: ids } } }
+        )
+      )
     );
   }
+  /**
+   * Parks the waiting backlogs a claim found. Best effort: parking only saves
+   * later claims work, so a failure is logged and the claim still returns its
+   * batch; the next claim that meets the backlog parks it.
+   */
+  async #parkWaiting(deliveryIds) {
+    try {
+      await this.#parkDeliveries(deliveryIds);
+    } catch (error) {
+      this.#logger.warn(
+        `[MongoEventStore](parkWaiting) Parking waiting deliveries failed, a later claim parks them | count=${deliveryIds.length} | error=${String(error)}`
+      );
+    }
+  }
   /** Sequence of the lowest unfinished delivery of the handler and key before `sequence`, if any. */
   async #findUnfinishedPredecessor(handler, key, sequence) {
     const predecessor = await this.#deliveries.findOne(
@@ -611,14 +1474,6 @@ var MongoEventStore = class {
     );
     return predecessor?.sequence;
   }
-  /** Whether some delivery of the handler and key runs under a lease that has not expired. */
-  async #hasLiveLease(handler, key, now) {
-    const running = await this.#deliveries.findOne(
-      { handler, key, status: "processing", dueAt: { $gt: now } },
-      { projection: { _id: 1 } }
-    );
-    return running !== null;
-  }
   /**
    * Parks pending deliveries that waited behind an unfinished predecessor, which
    * removes them from the claim index until their turn. Parking is a hint, not a
@@ -653,82 +1508,220 @@ var MongoEventStore = class {
     if (anyParked === null) {
       return;
     }
-    for (const handler of new Set(handlers)) {
-      let afterKey;
-      for (; ; ) {
-        const lowest = await this.#deliveries.findOne(
+    const lowest = (await Promise.all(
+      [...new Set(handlers)].map(
+        (handler) => this.#deliveries.aggregate([
+          { $match: { handler, lane: "parked" } },
+          { $sort: { handler: 1, key: 1, sequence: 1 } },
           {
-            handler,
-            lane: "parked",
-            ...afterKey === void 0 ? {} : { key: { $gt: afterKey } }
-          },
-          { sort: { key: 1, sequence: 1 }, projection: { key: 1, sequence: 1 } }
-        );
-        if (lowest === null) {
-          break;
-        }
-        afterKey = lowest.key;
-        if (await this.#findUnfinishedPredecessor(handler, afterKey, lowest.sequence) === void 0) {
-          await this.#deliveries.updateOne(
-            { _id: lowest._id, lane: "parked" },
-            { $set: { lane: "ready" } }
-          );
-        }
-      }
+            $group: { _id: "$key", id: { $first: "$_id" }, sequence: { $first: "$sequence" } }
+          }
+        ]).toArray().then((groups) => groups.map((group) => ({ ...group, handler })))
+      )
+    )).flat();
+    const next = await Promise.all(
+      lowest.map(
+        async (parked) => await this.#findUnfinishedPredecessor(parked.handler, parked._id, parked.sequence) === void 0 ? [parked.id] : []
+      )
+    );
+    const ready = next.flat();
+    if (ready.length > 0) {
+      await this.#deliveries.updateMany(
+        { _id: { $in: ready }, lane: "parked" },
+        { $set: { lane: "ready" } }
+      );
     }
   }
-  async #toClaimedDeliveries(leased, leaseExpiresAt) {
-    const events = await this.#readEnvelopes(leased.map((document) => document.eventId));
-    return leased.map((document) => ({
-      deliveryId: document._id,
-      leaseToken: document.leaseToken,
-      handler: document.handler,
-      attempt: document.attempts,
-      leaseExpiresAt,
-      event: events.get(document.eventId)
-    }));
-  }
   async #readEnvelopes(eventIds) {
     const documents = await this.#events.find({ _id: { $in: [...new Set(eventIds)] } }).toArray();
     return new Map(documents.map((document) => [document._id, toEnvelope(document)]));
   }
-  async #updateLeased(lease, session, update) {
-    const result = await this.#deliveries.updateOne(
-      { _id: lease.deliveryId, status: "processing", leaseToken: lease.leaseToken },
-      update,
+  /**
+   * Deletes the delivery of every lease whose lane still has the lease's epoch
+   * and lists the delivery, in one transaction (the caller's, when given).
+   * Returns one flag per lease, in order; a lease listed twice completes once.
+   */
+  async #completeLeases(leases, now, session) {
+    return session === void 0 ? this.#settle(leases, () => this.#completeIssued(leases, now, void 0)) : this.#completeIssued(leases, now, session);
+  }
+  async #completeIssued(leases, now, session) {
+    const parsed = leases.map((lease) => parseLeaseToken(lease.leaseToken));
+    const issued = leases.flatMap(
+      (lease, index) => parsed[index] === void 0 ? [] : [{ deliveryId: String(lease.deliveryId), ...parsed[index] }]
+    );
+    let completed = /* @__PURE__ */ new Set();
+    if (issued.length > 0) {
+      if (session !== void 0) {
+        completed = await this.#deleteCompleted(issued, now, session);
+      } else if (this.#completionHistory) {
+        completed = await this.transaction((own) => this.#deleteCompleted(issued, now, own));
+      } else {
+        completed = await this.#deleteFenced(issued, now);
+      }
+    }
+    return leases.map(
+      (lease, index) => parsed[index] !== void 0 && completed.delete(leaseIdentity({ deliveryId: String(lease.deliveryId), ...parsed[index] }))
+    );
+  }
+  /**
+   * Completion without a transaction, used when no history record has to be
+   * written with the deletion. The deliveries' claim generations are read
+   * first, then the lanes, and a delivery is deleted only if it still has the
+   * lease's generation. A takeover moves the generation of every delivery it
+   * takes from the previous owner on before it reads anything, and so do a
+   * retry, a release and a burial, so:
+   * - a takeover before the delivery read shows up in the lane read (new epoch);
+   * - a takeover between the two reads shows up in the lane read as well;
+   * - a takeover, retry, release or burial after the lane read changed the
+   *   generation, so the delete matches nothing.
+   * A completion and a takeover (or the end of the claim) therefore never both succeed. Two concurrent
+   * completions of the same lease may both report true (the dispatcher never
+   * issues them); one call with a lease listed twice reports it once.
+   */
+  async #deleteFenced(issued, now) {
+    const ids = [...new Set(issued.map((lease) => lease.deliveryId))];
+    const documents = await this.#deliveries.find({ _id: { $in: ids }, status: "pending" }, { projection: { claims: 1, eventId: 1 } }).toArray();
+    const lanes = new Map(
+      (await this.#lanes.find(
+        { _id: { $in: [...new Set(issued.map((lease) => lease.laneId))] } },
+        { projection: { epoch: 1, inFlight: 1 } }
+      ).toArray()).map((lane) => [lane._id, lane])
+    );
+    const fenced = fencedLeases(issued, lanes, documents);
+    if (fenced.length === 0) {
+      return /* @__PURE__ */ new Set();
+    }
+    await this.#markEventsCompleted(fenced, documents, now);
+    const deleted = await this.#deliveries.deleteMany({ $or: fenced.map(ofClaim) });
+    return deleted.deletedCount === fenced.length ? new Set(fenced.map((lease) => leaseIdentity(lease))) : /* @__PURE__ */ new Set();
+  }
+  /**
+   * The transactional part of a completion. The lanes are only read: the
+   * conflict with a takeover comes from the deleted delivery documents, which a
+   * takeover writes before it reads them (see {@link MongoEventStore.#takeLanes}).
+   * So whichever of the two commits second either fails with a write conflict
+   * and is retried against the new state, or waits for the first.
+   */
+  async #deleteCompleted(issued, now, session) {
+    const lanes = new Map(
+      (await this.#lanes.find(
+        { _id: { $in: [...new Set(issued.map((lease) => lease.laneId))] } },
+        { session, projection: { epoch: 1, inFlight: 1 } }
+      ).toArray()).map((lane) => [lane._id, lane])
+    );
+    const documents = await this.#deliveries.find(
+      { _id: { $in: [...new Set(issued.map((lease) => lease.deliveryId))] }, status: "pending" },
+      { session }
+    ).toArray();
+    const fenced = fencedLeases(issued, lanes, documents);
+    if (fenced.length === 0) {
+      return /* @__PURE__ */ new Set();
+    }
+    await this.#markEventsCompleted(fenced, documents, now, session);
+    await this.#deliveries.deleteMany({ $or: fenced.map(ofClaim) }, { session });
+    if (this.#completionHistory) {
+      const completedIds = new Set(fenced.map((lease) => lease.deliveryId));
+      await this.#completions.insertMany(
+        documents.filter((document) => completedIds.has(document._id)).map((document) => toCompletedDeliveryDocument(document, now)),
+        { session }
+      );
+    }
+    return new Set(fenced.map((lease) => leaseIdentity(lease)));
+  }
+  /**
+   * Records `now` as the latest completion of the events of the fenced
+   * deliveries (`$max`, so an earlier clock never moves it back). Written
+   * before the deletion, it can only be later than the real last completion
+   * (when the deletion then fails), which keeps the event longer, never shorter.
+   * Inside a transaction it is part of it: the transaction may hold the event
+   * already (a transactional handler that appended to its own event), and a
+   * write from outside would wait for it forever. Deliveries of one event that
+   * complete in concurrent transactions (fan-out to transactional handlers)
+   * therefore conflict on the event document, and one of them retries.
+   */
+  async #markEventsCompleted(fenced, documents, now, session) {
+    const completedIds = new Set(fenced.map((lease) => lease.deliveryId));
+    const eventIds = [
+      ...new Set(
+        documents.filter((document) => completedIds.has(document._id)).map((document) => document.eventId)
+      )
+    ];
+    await this.#events.updateMany(
+      { _id: { $in: eventIds } },
+      { $max: { completedAt: now } },
       session === void 0 ? {} : { session }
     );
-    return result.matchedCount === 1;
   }
   /**
-   * Deletes batches of matching deliveries together with the events no delivery
-   * references any more, each batch in one transaction, so a crash can never
-   * leave an event without deliveries behind. An append adding a delivery to the
-   * same event writes the event document, so the two conflict and one restarts
-   * instead of leaving a delivery without event. A delivery requeued since the
-   * batch was read conflicts with its deletion and is read again.
+   * Applies `update` to a running delivery and takes it out of its lane's
+   * in-flight list, if the lane still has the lease's epoch. One transaction:
+   * the lane write fences the change against a takeover.
    */
-  async #purgeMatching(filter) {
+  async #leaveFlight(lease, update) {
+    const held = parseLeaseToken(lease.leaseToken);
+    if (held === void 0) {
+      return false;
+    }
+    const deliveryId = String(lease.deliveryId);
+    const ofThisClaim = ofClaim({ ...held, deliveryId });
+    return this.#settle([lease], () => this.#leaveFlightNow(held, deliveryId, ofThisClaim, update));
+  }
+  async #leaveFlightNow(held, deliveryId, ofThisClaim, update) {
+    return this.transaction(async (session) => {
+      if (await this.#deliveries.findOne(ofThisClaim, { session, projection: { _id: 1 } }) === null) {
+        return false;
+      }
+      const fence = await this.#lanes.updateOne(
+        { _id: held.laneId, epoch: held.epoch, inFlight: deliveryId },
+        { $pull: { inFlight: deliveryId } },
+        { session }
+      );
+      if (fence.matchedCount === 0) {
+        return false;
+      }
+      const changed = await this.#deliveries.updateOne(ofThisClaim, update, { session });
+      return changed.matchedCount === 1;
+    });
+  }
+  /**
+   * Deletes batches of matching documents (deliveries, or completion history
+   * records) together with the events nothing references any more, each batch
+   * in one transaction, so a crash can never leave an event without deliveries
+   * behind. An append adding a delivery to the same event writes the event
+   * document, so the two conflict and one restarts instead of leaving a delivery
+   * without event. A delivery requeued since the batch was read conflicts with
+   * its deletion and is read again.
+   */
+  async #purgeMatching(collection, filter, completedBefore) {
     let deletedDeliveries = 0;
     let deletedEvents = 0;
     for (; ; ) {
       const step = await this.transaction(async (session) => {
-        const batch = await this.#deliveries.find(filter, { session, projection: { eventId: 1 }, limit: this.#purgeBatchSize }).toArray();
+        const batch = await collection.find(filter, { session, projection: { eventId: 1 }, limit: this.#purgeBatchSize }).toArray();
+        if (batch.length === 0) {
+          return { batchSize: 0, deletedDeliveries: 0, deletedEvents: 0 };
+        }
         const eventIds = [...new Set(batch.map((document) => document.eventId))];
-        const deliveries = await this.#deliveries.deleteMany(
+        const deleted = await collection.deleteMany(
           { _id: { $in: batch.map((document) => document._id) } },
           { session }
         );
-        const stillReferenced = new Set(
-          (await this.#deliveries.find({ eventId: { $in: eventIds } }, { session, projection: { eventId: 1 } }).toArray()).map((document) => document.eventId)
-        );
+        const stillReferenced = await this.#referencedEventIds(eventIds, session);
         const events = await this.#events.deleteMany(
-          { _id: { $in: eventIds.filter((eventId) => !stillReferenced.has(eventId)) } },
+          {
+            _id: { $in: eventIds.filter((eventId) => !stillReferenced.has(eventId)) },
+            // An event a delivery of which completed stays as deduplication record until
+            // `completedBefore` passes its last completion, whatever this batch purged.
+            $or: [
+              { completedAt: { $exists: false } },
+              ...completedBefore === void 0 ? [] : [{ completedAt: { $lt: completedBefore } }]
+            ]
+          },
           { session }
         );
         return {
           batchSize: batch.length,
-          deletedDeliveries: deliveries.deletedCount,
+          deletedDeliveries: deleted.deletedCount,
           deletedEvents: events.deletedCount
         };
       });
@@ -739,9 +1732,154 @@ var MongoEventStore = class {
       }
     }
   }
+  /** A view of a collection that purge deletes from: deliveries or completion history records. */
+  #purgeable(name) {
+    return this.#database.collection(name, {
+      readPreference: "primary",
+      writeConcern: { w: "majority" }
+    });
+  }
+  /** Those of `eventIds` that a delivery or a completion history record references. */
+  async #referencedEventIds(eventIds, session) {
+    const filter = { eventId: { $in: [...eventIds] } };
+    const options = { session, projection: { eventId: 1 } };
+    const references = [
+      ...await this.#deliveries.find(filter, options).toArray(),
+      ...this.#completionHistory ? await this.#completions.find(filter, options).toArray() : []
+    ];
+    return new Set(references.map((reference) => reference.eventId));
+  }
+  /**
+   * Deletes, in batches, events created before `cutoff` that no delivery (or
+   * completion history record) references. Each batch is found and deleted in
+   * one transaction: an append adding a delivery to one of them writes the
+   * event, so it conflicts with the deletion, which then restarts and sees the
+   * delivery. Returns how many events were deleted.
+   */
+  async #purgeOrphanEvents(cutoff, completedBefore) {
+    const references = [
+      this.#deliveries.collectionName,
+      ...this.#completionHistory ? [this.#completions.collectionName] : []
+    ];
+    let deletedEvents = 0;
+    for (; ; ) {
+      const step = await this.transaction(async (session) => {
+        const orphans = await this.#events.aggregate(
+          [
+            {
+              $match: {
+                $or: [
+                  // Never completed (no subscribers, or every delivery dead): by age.
+                  { completedAt: { $exists: false }, createdAt: { $lt: cutoff } },
+                  // Completed: by the time of its last completion, and only under the completed cutoff.
+                  ...completedBefore === void 0 ? [] : [{ completedAt: { $lt: completedBefore } }]
+                ]
+              }
+            },
+            { $sort: { createdAt: 1, _id: 1 } },
+            ...references.flatMap((from) => [
+              {
+                $lookup: {
+                  from,
+                  localField: "_id",
+                  foreignField: "eventId",
+                  pipeline: [{ $limit: 1 }, { $project: { _id: 1 } }],
+                  as: "references"
+                }
+              },
+              { $match: { references: { $size: 0 } } }
+            ]),
+            { $limit: this.#purgeBatchSize },
+            { $project: { _id: 1 } }
+          ],
+          { session }
+        ).toArray();
+        const deleted = await this.#events.deleteMany(
+          { _id: { $in: orphans.map((orphan) => orphan._id) } },
+          { session }
+        );
+        return { found: orphans.length, deleted: deleted.deletedCount };
+      });
+      deletedEvents += step.deleted;
+      if (step.found < this.#purgeBatchSize) {
+        return deletedEvents;
+      }
+    }
+  }
 };
-function deliveryPairKey(eventId, handler) {
-  return `${eventId}\0${handler}`;
+function isClaimable(candidate, scan, blockedKeys) {
+  const { key, sequence } = candidate;
+  if (key === void 0) {
+    return true;
+  }
+  const orderingId = orderingIdentity(candidate.handler, key);
+  if (scan.waits(orderingId, sequence)) {
+    scan.noteWaiting(orderingId, candidate._id, candidate.laneId);
+    return false;
+  }
+  if (blockedKeys.has(orderingId)) {
+    return false;
+  }
+  blockedKeys.add(orderingId);
+  return true;
+}
+function freeLane(laneId, epoch, revision, finished) {
+  return {
+    updateOne: {
+      filter: {
+        _id: laneId,
+        epoch,
+        revision: atCount(revision),
+        inFlight: { $not: { $elemMatch: { $nin: [...finished] } } }
+      },
+      update: {
+        $set: { owner: null, holder: null, leaseExpiresAt: null, inFlight: [] },
+        $inc: { revision: 1 }
+      }
+    }
+  };
+}
+async function inBatches(cursor, work) {
+  let batch = [];
+  for await (const document of cursor) {
+    batch.push(document);
+    if (batch.length === UPGRADE_BATCH_SIZE) {
+      await work(batch);
+      batch = [];
+    }
+  }
+  if (batch.length > 0) {
+    await work(batch);
+  }
+}
+function atCount(count) {
+  return count === 0 ? { $not: { $gt: 0 } } : count;
+}
+function fencedLeases(issued, lanes, documents) {
+  const claimsById = new Map(documents.map((document) => [document._id, document.claims ?? 0]));
+  const fenced = /* @__PURE__ */ new Map();
+  for (const lease of issued) {
+    const lane = lanes.get(lease.laneId);
+    if (claimsById.get(lease.deliveryId) === lease.claims && lane.epoch === lease.epoch && lane.inFlight.includes(lease.deliveryId)) {
+      fenced.set(leaseIdentity(lease), lease);
+    }
+  }
+  return [...fenced.values()];
+}
+function ofClaim(lease) {
+  return { _id: lease.deliveryId, status: "pending", claims: atCount(lease.claims) };
+}
+function leaseKey(deliveryId, leaseToken) {
+  return `${deliveryId}\0${leaseToken}`;
+}
+function leaseIdentity(lease) {
+  return `${lease.deliveryId}\0${formatLeaseToken(lease.laneId, lease.epoch, lease.claims)}`;
+}
+function hasErrorCode(error, code) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === code;
+}
+function compareText(left, right) {
+  return Number(left > right) - Number(left < right);
 }
 function assertInTransaction(session, operation) {
   if (!session.inTransaction()) {