@serve.zone/dcrouter 32.1.1 → 32.1.3

package/ts/webpush/classes.webpush-manager.ts

@@ -23,11 +23,6 @@ import {
   type IWebPushTransport,
 } from './classes.webpush-transport.js';
 import { WebPushEndpointPolicyError } from './helpers.webpush-endpoint.js';
-import {
-  getWebPushIndexSpecifications,
-  type IWebPushIndexSpecification,
-  type TWebPushIndexCollection,
-} from './webpush-indexes.js';
 
 type IWebPushBinding = plugins.servezoneInterfaces.data.IWebPushBinding;
 type IWebPushCredentialOneTimeSecret =
@@ -148,6 +143,8 @@ const NONTERMINAL_STATES: TWebPushDeliveryState[] = [
   'sending',
   'deferred',
 ];
+/** Non-leased states a delivery worker may claim. `sending` is claimed only on lease expiry. */
+const CLAIMABLE_IDLE_STATES = ['accepted', 'queued', 'deferred'] as const;
 
 function requireNonEmptyString(
   valueArg: unknown,
@@ -477,20 +474,13 @@ function constantTimeDigestEqual(leftArg: string, rightArg: string): boolean {
   return left.length === right.length && plugins.crypto.timingSafeEqual(left, right);
 }
 
+/**
+ * The document ORM reports a violated unique index as its own stable error code, so the
+ * insert races below recover on the declared constraint rather than on a driver error number.
+ */
 function isDuplicateKeyError(errorArg: unknown): boolean {
-  return (errorArg as { code?: unknown })?.code === 11000;
-}
-
-function asBindingDoc(rawArg: unknown): WebPushBindingDoc {
-  return rawArg as WebPushBindingDoc;
-}
-
-function asAdmissionDoc(rawArg: unknown): WebPushAdmissionDoc {
-  return rawArg as WebPushAdmissionDoc;
-}
-
-function asSpoolDoc(rawArg: unknown): WebPushSpoolDoc {
-  return rawArg as WebPushSpoolDoc;
+  return errorArg instanceof plugins.smartdata.SmartdataPersistenceError
+    && errorArg.code === 'unique_conflict';
 }
 
 function toCredentialPublic(
@@ -557,6 +547,10 @@ export function toPublicWebPushDelivery(spoolArg: WebPushSpoolDoc): IWebPushDeli
   };
 }
 
+/**
+ * Terminal transitions scrub every encrypted and lease-scoped member in the same write that
+ * records the outcome. The ORM owns `_updatedAt`, so no write here touches it.
+ */
 export function buildWebPushTerminalUpdate(optionsArg: {
   state: Extract<
     TWebPushDeliveryState,
@@ -565,7 +559,7 @@ export function buildWebPushTerminalUpdate(optionsArg: {
   now: number;
   pushServiceStatusCode?: number;
   errorCode?: string;
-}): Record<string, unknown> {
+}): plugins.smartdata.ISmartdataAtomicUpdate<WebPushSpoolDoc> {
   return {
     $set: {
       state: optionsArg.state,
@@ -574,7 +568,6 @@ export function buildWebPushTerminalUpdate(optionsArg: {
       purgeAt: new Date(optionsArg.now + TERMINAL_RETENTION_MS),
       pushServiceStatusCode: optionsArg.pushServiceStatusCode ?? null,
       errorCode: optionsArg.errorCode ?? null,
-      _updatedAt: new Date(optionsArg.now).toISOString(),
     },
     $unset: {
       subscriptionEnvelope: '',
@@ -587,66 +580,26 @@ export function buildWebPushTerminalUpdate(optionsArg: {
   };
 }
 
-interface IWebPushNativeIndexDescription {
-  name?: string;
-  key?: Record<string, unknown>;
-  unique?: boolean;
-  expireAfterSeconds?: number;
-  partialFilterExpression?: Record<string, unknown>;
-  sparse?: boolean;
-  collation?: Record<string, unknown>;
-  hidden?: boolean;
-}
-
-function canonicalIndexValue(valueArg: unknown): string {
-  if (valueArg === undefined) return 'undefined';
-  return canonicalJson(valueArg);
-}
-
-function assertWebPushIndexMatches(
-  collectionArg: TWebPushIndexCollection,
-  actualArg: IWebPushNativeIndexDescription | undefined,
-  expectedArg: IWebPushIndexSpecification,
-): void {
-  const malformed = (): never => {
-    throw new Error(
-      `Web Push persistence index ${collectionArg}.${expectedArg.name} is missing or malformed`,
-    );
-  };
-  if (!actualArg) {
+/**
+ * The three Web Push collections declare their full index topology on the model, so a divergent
+ * namespace is a configuration failure rather than something to repair at startup: the provider
+ * refuses to serve instead of delivering against an index that no longer enforces its fence.
+ */
+async function assertWebPushCollectionTopology(
+  modelArg: {
+    inspectCollectionTopology(
+      dbArg: plugins.smartdata.SmartdataDb,
+    ): Promise<plugins.smartdata.ISmartdataCollectionTopologyInspection>;
+  },
+  dbArg: plugins.smartdata.SmartdataDb,
+): Promise<void> {
+  const inspection = await modelArg.inspectCollectionTopology(dbArg);
+  if (inspection.status !== 'exact') {
     throw new Error(
-      `Web Push persistence index ${collectionArg}.${expectedArg.name} is missing or malformed`,
+      `Web Push persistence topology for ${inspection.collectionName} is ${inspection.status}`
+      + ` (${inspection.reasonCodes.join(', ') || 'no reason reported'})`,
     );
   }
-  if (actualArg.name !== expectedArg.name) malformed();
-  if (JSON.stringify(actualArg.key) !== JSON.stringify(expectedArg.key)) malformed();
-  if (Boolean(actualArg.unique) !== Boolean(expectedArg.unique)) malformed();
-  if (actualArg.expireAfterSeconds !== expectedArg.expireAfterSeconds) malformed();
-  if (
-    canonicalIndexValue(actualArg.partialFilterExpression)
-    !== canonicalIndexValue(expectedArg.partialFilterExpression)
-  ) {
-    malformed();
-  }
-  if (
-    actualArg.sparse === true
-    || actualArg.collation !== undefined
-    || actualArg.hidden === true
-  ) {
-    malformed();
-  }
-}
-
-function assertWebPushIndexes(
-  collectionArg: TWebPushIndexCollection,
-  actualIndexesArg: IWebPushNativeIndexDescription[],
-): void {
-  const byName = new Map(
-    actualIndexesArg.map((indexArg) => [indexArg.name, indexArg]),
-  );
-  for (const expected of getWebPushIndexSpecifications(collectionArg)) {
-    assertWebPushIndexMatches(collectionArg, byName.get(expected.name), expected);
-  }
 }
 
 export class WebPushManager {
@@ -715,24 +668,16 @@ export class WebPushManager {
       parseWebPushKeyRing(hmacKeyRingRaw, 'DCROUTER_WEB_PUSH_HMAC_KEY_RING'),
     );
     this.vapidSubject = validateVapidSubject(vapidSubjectRaw);
-    const bindingCollection = WebPushBindingDoc.getNativeCollection();
-    const admissionCollection = WebPushAdmissionDoc.getNativeCollection();
-    const spoolCollection = WebPushSpoolDoc.getNativeCollection();
-    await bindingCollection.findOne({}, { projection: { _id: 1 } });
-    await admissionCollection.findOne({}, { projection: { _id: 1 } });
-    await spoolCollection.findOne({}, { projection: { _id: 1 } });
-    assertWebPushIndexes(
-      'WebPushBindingDoc',
-      await bindingCollection.listIndexes().toArray(),
-    );
-    assertWebPushIndexes(
-      'WebPushAdmissionDoc',
-      await admissionCollection.listIndexes().toArray(),
-    );
-    assertWebPushIndexes(
-      'WebPushSpoolDoc',
-      await spoolCollection.listIndexes().toArray(),
-    );
+    // Reading each collection proves persistence is reachable and binds the model, which
+    // installs any declared index the namespace is still missing; the topology assertion then
+    // judges what is actually there.
+    const db = DcRouterDb.getInstance().getDb();
+    await WebPushBindingDoc.exists({});
+    await WebPushAdmissionDoc.exists({});
+    await WebPushSpoolDoc.exists({});
+    await assertWebPushCollectionTopology(WebPushBindingDoc, db);
+    await assertWebPushCollectionTopology(WebPushAdmissionDoc, db);
+    await assertWebPushCollectionTopology(WebPushSpoolDoc, db);
     await this.runMaintenanceOnce();
     this.started = true;
     this.ready = true;
@@ -788,19 +733,18 @@ export class WebPushManager {
         'Web Push owner appInstanceId',
       );
     }
-    const rows = await WebPushBindingDoc.getNativeCollection()
-      .find(selector)
-      .sort({ createdAt: 1, id: 1 })
-      .limit(1000)
-      .toArray();
-    return rows.map((rowArg) => toPublicWebPushBinding(asBindingDoc(rowArg)));
+    const cursor = await WebPushBindingDoc.getCursor(selector, {
+      sort: { createdAt: 1, id: 1 },
+      limit: 1000,
+    });
+    const rows = await cursor.toArray();
+    return rows.map((rowArg) => toPublicWebPushBinding(rowArg));
   }
 
   public async getBindingById(idArg: string): Promise<WebPushBindingDoc | null> {
     this.requirePersistenceReady();
     const id = requireOpaqueId(idArg, 'Web Push binding id');
-    const row = await WebPushBindingDoc.getNativeCollection().findOne({ id });
-    return row ? asBindingDoc(row) : null;
+    return await WebPushBindingDoc.getInstance({ id });
   }
 
   public async getBindingByCredentialId(
@@ -808,13 +752,12 @@ export class WebPushManager {
   ): Promise<WebPushBindingDoc | null> {
     this.requirePersistenceReady();
     const credentialId = requireOpaqueId(credentialIdArg, 'Web Push credential id');
-    const row = await WebPushBindingDoc.getNativeCollection().findOne({
+    return await WebPushBindingDoc.getInstance({
       $or: [
         { 'credential.id': credentialId },
         { 'previousCredentials.id': credentialId },
       ],
     });
-    return row ? asBindingDoc(row) : null;
   }
 
   public async syncBinding(
@@ -843,9 +786,10 @@ export class WebPushManager {
       owner,
       enabled: bindingArg.enabled,
     });
-    const collection = WebPushBindingDoc.getNativeCollection();
-    const byId = requestedId ? await collection.findOne({ id: requestedId }) : null;
-    const byOwner = await collection.findOne({
+    const byId = requestedId
+      ? await WebPushBindingDoc.getInstance({ id: requestedId })
+      : null;
+    const byOwner = await WebPushBindingDoc.getInstance({
       ownerGatewayClientType: owner.gatewayClientType,
       ownerGatewayClientId: owner.gatewayClientId,
       ownerAppInstanceId: owner.appInstanceId,
@@ -856,9 +800,8 @@ export class WebPushManager {
     if (requestedId && byOwner && String(byOwner.id) !== requestedId) {
       throw new plugins.typedrequest.TypedResponseError('Web Push binding identity conflicts with owner');
     }
-    const existingRaw = byId || byOwner;
-    if (existingRaw) {
-      const existing = asBindingDoc(existingRaw);
+    const existing = byId || byOwner;
+    if (existing) {
       this.assertBindingOwner(existing, owner);
       if (
         controllerFenceDecision(existing.controllerFence, controller, requestDigest)
@@ -869,17 +812,16 @@ export class WebPushManager {
       const lifecycleGeneration = requireLifecycleGeneration(existing.lifecycleGeneration);
       if (typeof existing.deletedAt === 'number') {
         await this.scrubDeletedBindingLifecycle(existing);
-        const scrubbedRaw = await collection.findOne({
+        const scrubbed = await WebPushBindingDoc.getInstance({
           id: existing.id,
           lifecycleGeneration,
           deletedAt: existing.deletedAt,
         });
-        if (!scrubbedRaw) {
+        if (!scrubbed) {
           throw new plugins.typedrequest.TypedResponseError(
             'Web Push binding changed concurrently; retry synchronization',
           );
         }
-        const scrubbed = asBindingDoc(scrubbedRaw);
         if (
           controllerFenceDecision(scrubbed.controllerFence, controller, requestDigest)
           === 'replay'
@@ -893,7 +835,7 @@ export class WebPushManager {
         const now = this.now();
         const createdCredential = this.createCredential(scrubbed.id, now);
         const nextLifecycleGeneration = lifecycleGeneration + 1;
-        const reactivated = await collection.updateOne(
+        const reactivated = await WebPushBindingDoc.atomicUpdate(
           {
             id: scrubbed.id,
             mutationRevision: scrubbed.mutationRevision,
@@ -911,7 +853,6 @@ export class WebPushManager {
               lifecycleGeneration: nextLifecycleGeneration,
               controllerFence: createControllerFence(controller, requestDigest, now),
               mutationRevision: scrubbed.mutationRevision + 1,
-              _updatedAt: new Date(now).toISOString(),
             },
             $unset: {
               deletedAt: '',
@@ -924,18 +865,18 @@ export class WebPushManager {
             'Web Push binding changed concurrently; retry synchronization',
           );
         }
-        await WebPushAdmissionDoc.getNativeCollection().deleteMany({
+        await WebPushAdmissionDoc.atomicDeleteMany({
           bindingId: scrubbed.id,
           lifecycleGeneration: { $lt: nextLifecycleGeneration },
         });
-        const refreshed = await collection.findOne({
+        const refreshed = await WebPushBindingDoc.getInstance({
           id: scrubbed.id,
           lifecycleGeneration: nextLifecycleGeneration,
           deletedAt: { $exists: false },
         });
         if (!refreshed) throw new Error('Reactivated Web Push binding disappeared');
         return {
-          binding: toPublicWebPushBinding(asBindingDoc(refreshed)),
+          binding: toPublicWebPushBinding(refreshed),
           credential: createdCredential.oneTime,
         };
       }
@@ -945,13 +886,13 @@ export class WebPushManager {
           lifecycleGeneration,
           'BINDING_DISABLED',
         );
-        const stillDisabled = await collection.findOne({
+        const stillDisabled = await WebPushBindingDoc.exists({
           id: existing.id,
           mutationRevision: existing.mutationRevision,
           lifecycleGeneration,
           enabled: false,
           deletedAt: { $exists: false },
-        }, { projection: { _id: 1 } });
+        });
         if (!stillDisabled) {
           throw new plugins.typedrequest.TypedResponseError(
             'Web Push binding changed concurrently; retry synchronization',
@@ -973,10 +914,7 @@ export class WebPushManager {
         nextCredential.status = bindingArg.enabled ? 'active' : 'disabled';
         nextCredential.updatedAt = now;
       }
-      const update: {
-        $set: Record<string, unknown>;
-        $unset?: Record<string, ''>;
-      } = {
+      const update: plugins.smartdata.ISmartdataAtomicUpdate<WebPushBindingDoc> = {
         $set: {
           enabled: bindingArg.enabled,
           status: bindingArg.enabled ? 'active' : 'disabled',
@@ -985,7 +923,6 @@ export class WebPushManager {
           lifecycleGeneration: nextLifecycleGeneration,
           controllerFence: createControllerFence(controller, requestDigest, now),
           mutationRevision: existing.mutationRevision + 1,
-          _updatedAt: new Date(now).toISOString(),
           ...(lifecycleChanged ? { previousCredentials: [] } : {}),
         },
       };
@@ -994,7 +931,7 @@ export class WebPushManager {
           credentialRotationRecovery: '',
         };
       }
-      const updated = await collection.updateOne(
+      const updated = await WebPushBindingDoc.atomicUpdate(
         {
           id: existing.id,
           mutationRevision: existing.mutationRevision,
@@ -1010,7 +947,7 @@ export class WebPushManager {
         );
       }
       if (lifecycleChanged) {
-        await WebPushAdmissionDoc.getNativeCollection().deleteMany({
+        await WebPushAdmissionDoc.atomicDeleteMany({
           bindingId: existing.id,
           lifecycleGeneration: { $lt: nextLifecycleGeneration },
         });
@@ -1022,10 +959,10 @@ export class WebPushManager {
           bindingArg.enabled ? 'BINDING_LIFECYCLE_CHANGED' : 'BINDING_DISABLED',
         );
       }
-      const refreshed = await collection.findOne({ id: existing.id });
+      const refreshed = await WebPushBindingDoc.getInstance({ id: existing.id });
       if (!refreshed) throw new Error('Synchronized Web Push binding disappeared');
       return {
-        binding: toPublicWebPushBinding(asBindingDoc(refreshed)),
+        binding: toPublicWebPushBinding(refreshed),
         credential,
       };
     }
@@ -1057,13 +994,12 @@ export class WebPushManager {
       await doc.save();
     } catch (error: unknown) {
       if (!isDuplicateKeyError(error)) throw error;
-      const raced = await collection.findOne({
+      const racedBinding = await WebPushBindingDoc.getInstance({
         ownerGatewayClientType: owner.gatewayClientType,
         ownerGatewayClientId: owner.gatewayClientId,
         ownerAppInstanceId: owner.appInstanceId,
       });
-      if (!raced) throw error;
-      const racedBinding = asBindingDoc(raced);
+      if (!racedBinding) throw error;
       this.assertBindingOwner(racedBinding, owner);
       if (
         controllerFenceDecision(racedBinding.controllerFence, controller, requestDigest)
@@ -1116,11 +1052,8 @@ export class WebPushManager {
     } else {
       throw new Error('Delete controller mutation cannot be replayed as synchronization');
     }
-    const refreshedRaw = await WebPushBindingDoc.getNativeCollection().findOne({
-      id: bindingArg.id,
-    });
-    if (!refreshedRaw) throw new Error('Synchronized Web Push binding disappeared');
-    const refreshed = asBindingDoc(refreshedRaw);
+    const refreshed = await WebPushBindingDoc.getInstance({ id: bindingArg.id });
+    if (!refreshed) throw new Error('Synchronized Web Push binding disappeared');
     controllerFenceDecision(refreshed.controllerFence, controllerArg, requestDigestArg);
     return {
       binding: toPublicWebPushBinding(refreshed),
@@ -1143,9 +1076,10 @@ export class WebPushManager {
       id: requestedId ?? null,
       owner,
     });
-    const collection = WebPushBindingDoc.getNativeCollection();
-    const byId = requestedId ? await collection.findOne({ id: requestedId }) : null;
-    const byOwner = await collection.findOne({
+    const byId = requestedId
+      ? await WebPushBindingDoc.getInstance({ id: requestedId })
+      : null;
+    const byOwner = await WebPushBindingDoc.getInstance({
       ownerGatewayClientType: owner.gatewayClientType,
       ownerGatewayClientId: owner.gatewayClientId,
       ownerAppInstanceId: owner.appInstanceId,
@@ -1160,8 +1094,8 @@ export class WebPushManager {
         'Web Push binding identity conflicts with owner',
       );
     }
-    const existingRaw = byId || byOwner;
-    if (!existingRaw) {
+    const binding = byId || byOwner;
+    if (!binding) {
       const now = this.now();
       const id = requestedId ?? plugins.uuid.v4();
       const tombstone = new WebPushBindingDoc();
@@ -1198,7 +1132,6 @@ export class WebPushManager {
       await this.scrubDeletedBindingLifecycle(tombstone);
       return true;
     }
-    const binding = asBindingDoc(existingRaw);
     this.assertBindingOwner(binding, owner);
     if (
       controllerFenceDecision(binding.controllerFence, controller, requestDigest)
@@ -1209,18 +1142,17 @@ export class WebPushManager {
     const lifecycleGeneration = requireLifecycleGeneration(binding.lifecycleGeneration);
     if (typeof binding.deletedAt === 'number') {
       await this.scrubDeletedBindingLifecycle(binding);
-      const scrubbedRaw = await collection.findOne({
+      const scrubbed = await WebPushBindingDoc.getInstance({
         id: binding.id,
         lifecycleGeneration,
         deletedAt: binding.deletedAt,
         enabled: false,
       });
-      if (!scrubbedRaw) {
+      if (!scrubbed) {
         throw new plugins.typedrequest.TypedResponseError(
           'Web Push binding changed concurrently; retry deletion',
         );
       }
-      const scrubbed = asBindingDoc(scrubbedRaw);
       if (
         controllerFenceDecision(scrubbed.controllerFence, controller, requestDigest)
         === 'replay'
@@ -1232,7 +1164,7 @@ export class WebPushManager {
         );
       }
       const now = this.now();
-      const recorded = await collection.updateOne(
+      const recorded = await WebPushBindingDoc.atomicUpdate(
         {
           id: scrubbed.id,
           mutationRevision: scrubbed.mutationRevision,
@@ -1244,7 +1176,6 @@ export class WebPushManager {
             controllerFence: createControllerFence(controller, requestDigest, now),
             updatedAt: now,
             mutationRevision: scrubbed.mutationRevision + 1,
-            _updatedAt: new Date(now).toISOString(),
           },
         },
       );
@@ -1253,10 +1184,10 @@ export class WebPushManager {
           'Web Push binding changed concurrently; retry deletion',
         );
       }
-      const refreshedRaw = await collection.findOne({ id: scrubbed.id });
-      if (!refreshedRaw) throw new Error('Deleted Web Push binding tombstone disappeared');
+      const refreshed = await WebPushBindingDoc.getInstance({ id: scrubbed.id });
+      if (!refreshed) throw new Error('Deleted Web Push binding tombstone disappeared');
       return await this.resumeControllerDeleteReplay(
-        asBindingDoc(refreshedRaw),
+        refreshed,
         controller,
         requestDigest,
       );
@@ -1280,7 +1211,7 @@ export class WebPushManager {
       return scrubbed;
     });
     const deletedLifecycleGeneration = lifecycleGeneration + 1;
-    const result = await WebPushBindingDoc.getNativeCollection().updateOne(
+    const result = await WebPushBindingDoc.atomicUpdate(
       {
         id: binding.id,
         mutationRevision: binding.mutationRevision,
@@ -1299,7 +1230,6 @@ export class WebPushManager {
           controllerFence: createControllerFence(controller, requestDigest, now),
           updatedAt: now,
           mutationRevision: binding.mutationRevision + 1,
-          _updatedAt: new Date(now).toISOString(),
         },
         $unset: {
           credentialRotationRecovery: '',
@@ -1311,7 +1241,7 @@ export class WebPushManager {
         'Web Push binding changed concurrently; retry deletion',
       );
     }
-    const tombstone = await WebPushBindingDoc.getNativeCollection().findOne({
+    const tombstone = await WebPushBindingDoc.getInstance({
       id: binding.id,
       lifecycleGeneration: deletedLifecycleGeneration,
       deletedAt: now,
@@ -1319,7 +1249,7 @@ export class WebPushManager {
     if (!tombstone) {
       throw new Error('Deleted Web Push binding tombstone disappeared');
     }
-    await this.scrubDeletedBindingLifecycle(asBindingDoc(tombstone));
+    await this.scrubDeletedBindingLifecycle(tombstone);
     return true;
   }
 
@@ -1332,11 +1262,8 @@ export class WebPushManager {
       throw new Error('Applied Web Push delete controller mutation is inconsistent');
     }
     await this.scrubDeletedBindingLifecycle(bindingArg);
-    const refreshedRaw = await WebPushBindingDoc.getNativeCollection().findOne({
-      id: bindingArg.id,
-    });
-    if (!refreshedRaw) throw new Error('Deleted Web Push binding tombstone disappeared');
-    const refreshed = asBindingDoc(refreshedRaw);
+    const refreshed = await WebPushBindingDoc.getInstance({ id: bindingArg.id });
+    if (!refreshed) throw new Error('Deleted Web Push binding tombstone disappeared');
     controllerFenceDecision(refreshed.controllerFence, controllerArg, requestDigestArg);
     if (refreshed.enabled || typeof refreshed.deletedAt !== 'number') {
       throw new Error('Applied Web Push delete controller mutation is inconsistent');
@@ -1413,7 +1340,7 @@ export class WebPushManager {
         createdAt: now,
         expiresAt: now + CREDENTIAL_OVERLAP_MS,
       };
-      const result = await WebPushBindingDoc.getNativeCollection().updateOne(
+      const result = await WebPushBindingDoc.atomicUpdate(
         {
           id: binding.id,
           mutationRevision: binding.mutationRevision,
@@ -1430,7 +1357,6 @@ export class WebPushManager {
             credentialRotationRecovery: recovery,
             updatedAt: now,
             mutationRevision: binding.mutationRevision + 1,
-            _updatedAt: new Date(now).toISOString(),
           },
         },
       );
@@ -1479,14 +1405,13 @@ export class WebPushManager {
         : keyArg
     ));
     nextKeys.push(this.createVapidKey(owner, binding.id, now));
-    const result = await WebPushBindingDoc.getNativeCollection().updateOne(
+    const result = await WebPushBindingDoc.atomicUpdate(
       { id: binding.id, mutationRevision: binding.mutationRevision },
       {
         $set: {
           vapidKeys: nextKeys,
           updatedAt: now,
           mutationRevision: binding.mutationRevision + 1,
-          _updatedAt: new Date(now).toISOString(),
         },
       },
     );
@@ -1647,8 +1572,7 @@ export class WebPushManager {
       canonicalRequest,
       hmacKeyId,
     ).digest;
-    const collection = WebPushSpoolDoc.getNativeCollection();
-    const existing = await collection.findOne({
+    const existing = await WebPushSpoolDoc.getInstance({
       bindingId: context.binding.id,
       lifecycleGeneration,
       credentialId: context.credential.id,
@@ -1656,24 +1580,23 @@ export class WebPushManager {
     });
     if (existing) {
       await this.assertBindingLifecycleActive(context.binding);
-      const spool = asSpoolDoc(existing);
-      if (!constantTimeDigestEqual(spool.requestDigest, requestDigest)) {
+      if (!constantTimeDigestEqual(existing.requestDigest, requestDigest)) {
         throw new plugins.typedrequest.TypedResponseError(
           'Web Push idempotency key conflicts with a different request',
         );
       }
       return {
         accepted: true,
-        spoolItemId: spool.id,
+        spoolItemId: existing.id,
       };
     }
     await this.assertBindingLifecycleActive(context.binding);
     await this.reserveAdmission(context.binding);
-    const nonterminalCount = await collection.countDocuments({
+    const nonterminalCount = await WebPushSpoolDoc.getCount({
       bindingId: context.binding.id,
       lifecycleGeneration,
       state: { $in: NONTERMINAL_STATES },
-    });
+    }, { limit: MAX_NONTERMINAL_ITEMS_PER_BINDING });
     if (nonterminalCount >= MAX_NONTERMINAL_ITEMS_PER_BINDING) {
       throw new plugins.typedrequest.TypedResponseError('Web Push binding queue quota exceeded');
     }
@@ -1730,14 +1653,13 @@ export class WebPushManager {
       await spool.save();
     } catch (error: unknown) {
       if (!isDuplicateKeyError(error)) throw error;
-      const raced = await collection.findOne({
+      const racedSpool = await WebPushSpoolDoc.getInstance({
         bindingId: context.binding.id,
         lifecycleGeneration,
         credentialId: context.credential.id,
         idempotencyKeyDigest,
       });
-      if (!raced) throw error;
-      const racedSpool = asSpoolDoc(raced);
+      if (!racedSpool) throw error;
       if (!constantTimeDigestEqual(racedSpool.requestDigest, requestDigest)) {
         throw new plugins.typedrequest.TypedResponseError(
           'Web Push idempotency key conflicts with a different request',
@@ -1773,12 +1695,12 @@ export class WebPushManager {
     const lifecycleGeneration = requireLifecycleGeneration(
       context.binding.lifecycleGeneration,
     );
-    const row = await WebPushSpoolDoc.getNativeCollection().findOne({
+    const row = await WebPushSpoolDoc.getInstance({
       id: spoolItemId,
       bindingId: context.binding.id,
       lifecycleGeneration,
     });
-    return row ? toPublicWebPushDelivery(asSpoolDoc(row)) : undefined;
+    return row ? toPublicWebPushDelivery(row) : undefined;
   }
 
   public async cancel(
@@ -2015,13 +1937,13 @@ export class WebPushManager {
 
   private async assertBindingLifecycleActive(bindingArg: WebPushBindingDoc): Promise<void> {
     const lifecycleGeneration = requireLifecycleGeneration(bindingArg.lifecycleGeneration);
-    const active = await WebPushBindingDoc.getNativeCollection().findOne({
+    const active = await WebPushBindingDoc.exists({
       id: bindingArg.id,
       lifecycleGeneration,
       enabled: true,
       status: 'active',
       deletedAt: { $exists: false },
-    }, { projection: { _id: 1 } });
+    });
     if (!active) {
       throw new plugins.typedrequest.TypedResponseError(
         'Web Push binding lifecycle changed; retry with current credentials',
@@ -2033,17 +1955,16 @@ export class WebPushManager {
     const bindingId = requireOpaqueId(bindingArg.id, 'Web Push binding id');
     const lifecycleGeneration = requireLifecycleGeneration(bindingArg.lifecycleGeneration);
     await this.assertBindingLifecycleActive(bindingArg);
-    const collection = WebPushAdmissionDoc.getNativeCollection();
     const policy = this.admissionPolicy;
 
     for (let attempt = 0; attempt < MAX_ADMISSION_CAS_ATTEMPTS; attempt++) {
       const now = this.now();
       const purgeAt = new Date(now + policy.longWindowMs * 2);
-      const raw = await collection.findOne({
+      const current = await WebPushAdmissionDoc.getInstance({
         bindingId,
         lifecycleGeneration,
       });
-      if (!raw) {
+      if (!current) {
         const admission = new WebPushAdmissionDoc();
         admission.bindingId = bindingId;
         admission.lifecycleGeneration = lifecycleGeneration;
@@ -2063,7 +1984,7 @@ export class WebPushManager {
         }
       }
 
-      const admission = asAdmissionDoc(raw);
+      const admission = current;
       const admissionGeneration = requireLifecycleGeneration(admission.lifecycleGeneration);
       if (admissionGeneration !== lifecycleGeneration) {
         throw new Error('Web Push admission lifecycle generation is inconsistent');
@@ -2096,7 +2017,7 @@ export class WebPushManager {
         );
       }
 
-      const updated = await collection.updateOne(
+      const updated = await WebPushAdmissionDoc.atomicUpdate(
         {
           bindingId,
           lifecycleGeneration,
@@ -2111,7 +2032,6 @@ export class WebPushManager {
             revision: admission.revision + 1,
             updatedAt: now,
             purgeAt,
-            _updatedAt: new Date(now).toISOString(),
           },
         },
       );
@@ -2129,13 +2049,13 @@ export class WebPushManager {
     lifecycleGenerationArg: number,
   ): Promise<void> {
     const lifecycleGeneration = requireLifecycleGeneration(lifecycleGenerationArg);
-    const active = await WebPushBindingDoc.getNativeCollection().findOne({
+    const active = await WebPushBindingDoc.exists({
       id: bindingIdArg,
       lifecycleGeneration,
       enabled: true,
       status: 'active',
       deletedAt: { $exists: false },
-    }, { projection: { _id: 1 } });
+    });
     if (active) return;
     await this.cancelWithinBinding(
       bindingIdArg,
@@ -2147,7 +2067,9 @@ export class WebPushManager {
       lifecycleGeneration,
       'BINDING_LIFECYCLE_CHANGED',
     );
-    await WebPushAdmissionDoc.getNativeCollection().deleteOne({
+    // `{ bindingId, lifecycleGeneration }` is the collection's declared unique key, so this
+    // deletes exactly the one admission counter that belongs to the drained lifecycle.
+    await WebPushAdmissionDoc.atomicDelete({
       bindingId: bindingIdArg,
       lifecycleGeneration,
     });
@@ -2167,17 +2089,15 @@ export class WebPushManager {
       tombstoneGeneration,
       cancellationErrorCode,
     );
-    const collection = WebPushBindingDoc.getNativeCollection();
     let scrubbed = false;
     for (let attempt = 0; attempt < 4; attempt++) {
-      const currentRaw = await collection.findOne({
+      const current = await WebPushBindingDoc.getInstance({
         id: bindingArg.id,
         lifecycleGeneration: tombstoneGeneration,
         deletedAt: bindingArg.deletedAt,
         enabled: false,
       });
-      if (!currentRaw) return;
-      const current = asBindingDoc(currentRaw);
+      if (!current) return;
       const needsScrub = (
         typeof current.credential?.secretHash === 'string'
         || (current.previousCredentials || []).length > 0
@@ -2210,7 +2130,7 @@ export class WebPushManager {
         delete scrubbedKey.privateKeyEnvelope;
         return scrubbedKey;
       });
-      const result = await collection.updateOne(
+      const result = await WebPushBindingDoc.atomicUpdate(
         {
           id: current.id,
           mutationRevision: current.mutationRevision,
@@ -2225,7 +2145,6 @@ export class WebPushManager {
             vapidKeys,
             updatedAt: now,
             mutationRevision: current.mutationRevision + 1,
-            _updatedAt: new Date(now).toISOString(),
           },
           $unset: {
             credentialRotationRecovery: '',
@@ -2242,7 +2161,7 @@ export class WebPushManager {
         'Web Push binding cleanup changed concurrently; retry deletion',
       );
     }
-    await WebPushAdmissionDoc.getNativeCollection().deleteMany({
+    await WebPushAdmissionDoc.atomicDeleteMany({
       bindingId: bindingArg.id,
       lifecycleGeneration: { $lte: tombstoneGeneration },
     });
@@ -2264,7 +2183,6 @@ export class WebPushManager {
     limitArg = MAINTENANCE_BATCH_SIZE,
   ): Promise<void> {
     const now = this.now();
-    const collection = WebPushBindingDoc.getNativeCollection();
     const batch = await this.selectBindingMaintenanceBatch(
       { 'previousCredentials.validUntil': { $lte: now } },
       this.expiredCredentialOverlapCursor,
@@ -2280,7 +2198,7 @@ export class WebPushManager {
         ),
       );
       if (remaining.length === (binding.previousCredentials || []).length) continue;
-      await collection.updateOne(
+      await WebPushBindingDoc.atomicUpdate(
         {
           id: binding.id,
           mutationRevision: binding.mutationRevision,
@@ -2291,7 +2209,6 @@ export class WebPushManager {
             previousCredentials: remaining,
             updatedAt: now,
             mutationRevision: binding.mutationRevision + 1,
-            _updatedAt: new Date(now).toISOString(),
           },
         },
       );
@@ -2302,7 +2219,6 @@ export class WebPushManager {
     limitArg = MAINTENANCE_BATCH_SIZE,
   ): Promise<void> {
     const now = this.now();
-    const collection = WebPushBindingDoc.getNativeCollection();
     const batch = await this.selectBindingMaintenanceBatch(
       { 'credentialRotationRecovery.expiresAt': { $lte: now } },
       this.expiredCredentialRecoveryCursor,
@@ -2312,7 +2228,7 @@ export class WebPushManager {
     for (const binding of batch.rows) {
       const recovery = binding.credentialRotationRecovery;
       if (!recovery || recovery.expiresAt > now) continue;
-      await collection.updateOne(
+      await WebPushBindingDoc.atomicUpdate(
         {
           id: binding.id,
           mutationRevision: binding.mutationRevision,
@@ -2327,7 +2243,6 @@ export class WebPushManager {
           $set: {
             updatedAt: now,
             mutationRevision: binding.mutationRevision + 1,
-            _updatedAt: new Date(now).toISOString(),
           },
           $unset: {
             credentialRotationRecovery: '',
@@ -2342,8 +2257,6 @@ export class WebPushManager {
     limitArg = MAINTENANCE_BATCH_SIZE,
   ): Promise<void> {
     const now = this.now();
-    const bindingCollection = WebPushBindingDoc.getNativeCollection();
-    const spoolCollection = WebPushSpoolDoc.getNativeCollection();
     const selector: Record<string, unknown> = bindingIdArg
       ? { id: requireOpaqueId(bindingIdArg, 'Web Push binding id') }
       : {
@@ -2353,11 +2266,7 @@ export class WebPushManager {
           ],
         };
     const rows = bindingIdArg
-      ? (await bindingCollection
-          .find(selector)
-          .limit(1)
-          .toArray())
-          .map((rawArg) => asBindingDoc(rawArg))
+      ? await (await WebPushBindingDoc.getCursor(selector, { limit: 1 })).toArray()
       : await (async () => {
           const batch = await this.selectBindingMaintenanceBatch(
             selector,
@@ -2382,7 +2291,7 @@ export class WebPushManager {
           continue;
         }
         if (key.status === 'retired') continue;
-        const pending = await spoolCollection.countDocuments({
+        const pending = await WebPushSpoolDoc.getCount({
           bindingId: binding.id,
           lifecycleGeneration: requireLifecycleGeneration(binding.lifecycleGeneration),
           vapidKeyId: key.id,
@@ -2393,7 +2302,7 @@ export class WebPushManager {
         }
       }
       if (retained.length === binding.vapidKeys.length) continue;
-      await bindingCollection.updateOne(
+      await WebPushBindingDoc.atomicUpdate(
         {
           id: binding.id,
           mutationRevision: binding.mutationRevision,
@@ -2404,7 +2313,6 @@ export class WebPushManager {
             vapidKeys: retained,
             updatedAt: now,
             mutationRevision: binding.mutationRevision + 1,
-            _updatedAt: new Date(now).toISOString(),
           },
         },
       );
@@ -2446,7 +2354,7 @@ export class WebPushManager {
             lifecycleGeneration,
             'BINDING_DISABLED',
           );
-          await WebPushAdmissionDoc.getNativeCollection().deleteMany({
+          await WebPushAdmissionDoc.atomicDeleteMany({
             bindingId: binding.id,
             lifecycleGeneration: { $lt: lifecycleGeneration },
           });
@@ -2481,12 +2389,11 @@ export class WebPushManager {
             { id: { $gt: cursorArg } },
           ],
         };
-    const rows = (await WebPushBindingDoc.getNativeCollection()
-      .find(selector)
-      .sort({ id: 1 })
-      .limit(Math.min(Math.max(Math.floor(limitArg), 1), MAINTENANCE_BATCH_SIZE))
-      .toArray())
-      .map((rawArg) => asBindingDoc(rawArg));
+    const cursor = await WebPushBindingDoc.getCursor(selector, {
+      sort: { id: 1 },
+      limit: Math.min(Math.max(Math.floor(limitArg), 1), MAINTENANCE_BATCH_SIZE),
+    });
+    const rows = await cursor.toArray();
     return {
       rows,
       ...(rows.length > 0 ? { nextCursor: rows[rows.length - 1].id } : {}),
@@ -2526,7 +2433,7 @@ export class WebPushManager {
       beforeLifecycleGeneration,
       errorCodeArg,
     );
-    await WebPushAdmissionDoc.getNativeCollection().deleteMany({
+    await WebPushAdmissionDoc.atomicDeleteMany({
       bindingId: bindingIdArg,
       lifecycleGeneration: { $lt: beforeLifecycleGeneration },
     });
@@ -2547,7 +2454,6 @@ export class WebPushManager {
       beforeLifecycleGenerationArg,
     );
     const deadline = Date.now() + LIFECYCLE_DRAIN_TIMEOUT_MS;
-    const collection = WebPushSpoolDoc.getNativeCollection();
     while (true) {
       await this.requestBindingLifecyclesBeforeCancellation(
         bindingId,
@@ -2563,7 +2469,7 @@ export class WebPushManager {
       ) {
         // Drain every bounded stale-lease batch before checking completion.
       }
-      const remaining = await collection.countDocuments({
+      const remaining = await WebPushSpoolDoc.getCount({
         bindingId,
         lifecycleGeneration: { $lt: beforeLifecycleGeneration },
         state: { $in: NONTERMINAL_STATES },
@@ -2584,8 +2490,7 @@ export class WebPushManager {
     limitArg = MAINTENANCE_BATCH_SIZE,
   ): Promise<number> {
     const now = this.now();
-    const collection = WebPushSpoolDoc.getNativeCollection();
-    const rows = await collection.find({
+    const cursor = await WebPushSpoolDoc.getCursor({
       state: 'sending',
       cancelRequestedAt: { $exists: true },
       $or: [
@@ -2600,14 +2505,13 @@ export class WebPushManager {
         leaseExpiresAt: 1,
         cancelRequestedAt: 1,
       },
-    })
-      .sort({ cancelRequestedAt: 1, id: 1 })
-      .limit(Math.min(Math.max(Math.floor(limitArg), 1), MAINTENANCE_BATCH_SIZE))
-      .toArray();
+      sort: { cancelRequestedAt: 1, id: 1 },
+      limit: Math.min(Math.max(Math.floor(limitArg), 1), MAINTENANCE_BATCH_SIZE),
+    });
+    const rows = await cursor.toArray();
     let finished = 0;
-    for (const raw of rows) {
-      const spool = asSpoolDoc(raw);
-      const result = await collection.updateOne(
+    for (const spool of rows) {
+      const result = await WebPushSpoolDoc.atomicUpdate(
         {
           id: spool.id,
           state: 'sending',
@@ -2640,8 +2544,7 @@ export class WebPushManager {
       beforeLifecycleGenerationArg,
     );
     const now = this.now();
-    const collection = WebPushSpoolDoc.getNativeCollection();
-    const rows = await collection.find({
+    const cursor = await WebPushSpoolDoc.getCursor({
       bindingId,
       lifecycleGeneration: { $lt: beforeLifecycleGeneration },
       state: 'sending',
@@ -2659,11 +2562,12 @@ export class WebPushManager {
         cancelRequestedAt: 1,
         cancelErrorCode: 1,
       },
-    }).limit(MAINTENANCE_BATCH_SIZE).toArray();
+      limit: MAINTENANCE_BATCH_SIZE,
+    });
+    const rows = await cursor.toArray();
     let finished = 0;
-    for (const raw of rows) {
-      const spool = asSpoolDoc(raw);
-      const result = await collection.updateOne(
+    for (const spool of rows) {
+      const result = await WebPushSpoolDoc.atomicUpdate(
         {
           id: spool.id,
           bindingId,
@@ -2706,7 +2610,6 @@ export class WebPushManager {
         'Web Push subscriptionId',
       );
     }
-    const collection = WebPushSpoolDoc.getNativeCollection();
     const lifecycleGenerationSelector = typeof lifecycleGenerationArg === 'number'
       ? requireLifecycleGeneration(lifecycleGenerationArg)
       : lifecycleGenerationArg === undefined
@@ -2719,14 +2622,14 @@ export class WebPushManager {
         : { lifecycleGeneration: lifecycleGenerationSelector }),
       ...targetSelector,
     };
-    const alreadyTerminalCount = await collection.countDocuments({
+    const alreadyTerminalCount = await WebPushSpoolDoc.getCount({
       ...selector,
       state: { $in: TERMINAL_STATES },
     });
     let cancelledCount = 0;
     for (let attempt = 0; attempt < 16; attempt++) {
       const now = this.now();
-      const terminalized = await collection.updateMany(
+      const terminalized = await WebPushSpoolDoc.atomicUpdateMany(
         {
           ...selector,
           state: { $in: ['accepted', 'queued', 'deferred'] },
@@ -2737,7 +2640,7 @@ export class WebPushManager {
           errorCode: errorCodeArg,
         }),
       );
-      const markedSending = await collection.updateMany(
+      const markedSending = await WebPushSpoolDoc.atomicUpdateMany(
         {
           ...selector,
           state: 'sending',
@@ -2748,7 +2651,6 @@ export class WebPushManager {
             cancelRequestedAt: now,
             cancelErrorCode: errorCodeArg,
             updatedAt: now,
-            _updatedAt: new Date(now).toISOString(),
           },
         },
       );
@@ -2764,18 +2666,15 @@ export class WebPushManager {
 
   private async expireDueItems(limitArg: number): Promise<void> {
     const now = this.now();
-    const collection = WebPushSpoolDoc.getNativeCollection();
-    const rows = await collection
-      .find({
-        state: { $in: NONTERMINAL_STATES },
-        expiresAt: { $lte: now },
-      }, {
-        projection: { id: 1, state: 1, leaseToken: 1, leaseExpiresAt: 1 },
-      })
-      .limit(limitArg)
-      .toArray();
-    for (const raw of rows) {
-      const spool = asSpoolDoc(raw);
+    const cursor = await WebPushSpoolDoc.getCursor({
+      state: { $in: NONTERMINAL_STATES },
+      expiresAt: { $lte: now },
+    }, {
+      projection: { id: 1, state: 1, leaseToken: 1, leaseExpiresAt: 1 },
+      limit: limitArg,
+    });
+    const rows = await cursor.toArray();
+    for (const spool of rows) {
       if (
         spool.state === 'sending'
         && typeof spool.leaseExpiresAt === 'number'
@@ -2793,7 +2692,7 @@ export class WebPushManager {
               : { leaseExpiresAt: spool.leaseExpiresAt }),
           }
         : {};
-      await collection.updateOne(
+      await WebPushSpoolDoc.atomicUpdate(
         {
           id: spool.id,
           state: spool.state,
@@ -2811,21 +2710,25 @@ export class WebPushManager {
   private async claimNextItem(): Promise<WebPushSpoolDoc | null> {
     const now = this.now();
     const leaseToken = plugins.uuid.v4();
-    const row = await WebPushSpoolDoc.getNativeCollection().findOneAndUpdate(
+    // One claimable state per `$or` branch: the ORM requires every branch of a write filter to
+    // carry a top-level equality anchor, and `state: { $in: [...] }` anchors nothing. The three
+    // branches match exactly the same documents as the single `$in` did and still ride
+    // `web_push_spool_delivery_scan`.
+    const claimed = await WebPushSpoolDoc.atomicFindOneAndUpdate(
       {
         expiresAt: { $gt: now },
         $or: [
-          {
-            state: { $in: ['accepted', 'queued', 'deferred'] },
+          ...CLAIMABLE_IDLE_STATES.map((stateArg) => ({
+            state: stateArg,
             nextAttemptAt: { $lte: now },
             cancelRequestedAt: { $exists: false },
             $or: [
               { leaseToken: { $exists: false } },
               { leaseExpiresAt: { $lte: now } },
             ],
-          },
+          })),
           {
-            state: 'sending',
+            state: 'sending' as const,
             leaseExpiresAt: { $lte: now },
             cancelRequestedAt: { $exists: false },
           },
@@ -2837,7 +2740,6 @@ export class WebPushManager {
           leaseToken,
           leaseExpiresAt: now + DELIVERY_LEASE_MS,
           updatedAt: now,
-          _updatedAt: new Date(now).toISOString(),
         },
         $inc: { attempts: 1 },
       },
@@ -2846,21 +2748,19 @@ export class WebPushManager {
         returnDocument: 'after',
       },
     );
-    return row ? asSpoolDoc(row) : null;
+    return claimed.status === 'matched' ? claimed.document : null;
   }
 
   private async processClaimedItem(spoolArg: WebPushSpoolDoc): Promise<void> {
-    const collection = WebPushSpoolDoc.getNativeCollection();
     const leaseToken = spoolArg.leaseToken;
     if (!leaseToken) return;
     const now = this.now();
-    const current = await collection.findOne({
+    const currentSpool = await WebPushSpoolDoc.getInstance({
       id: spoolArg.id,
       state: 'sending',
       leaseToken,
     });
-    if (!current) return;
-    const currentSpool = asSpoolDoc(current);
+    if (!currentSpool) return;
     if (currentSpool.cancelRequestedAt !== undefined) {
       await this.finishTerminal(currentSpool, 'cancelled', {
         errorCode: currentSpool.cancelErrorCode || 'CANCELLED_BY_APPLICATION',
@@ -2882,20 +2782,19 @@ export class WebPushManager {
       });
       return;
     }
-    const bindingRaw = await WebPushBindingDoc.getNativeCollection().findOne({
+    const binding = await WebPushBindingDoc.getInstance({
       id: currentSpool.bindingId,
       lifecycleGeneration,
       enabled: true,
       status: 'active',
       deletedAt: { $exists: false },
     });
-    if (!bindingRaw) {
+    if (!binding) {
       await this.finishTerminal(currentSpool, 'cancelled', {
         errorCode: 'BINDING_LIFECYCLE_CHANGED',
       });
       return;
     }
-    const binding = asBindingDoc(bindingRaw);
     const vapidKey = binding.vapidKeys.find((keyArg) => (
       keyArg.id === currentSpool.vapidKeyId
       && Boolean(keyArg.privateKeyEnvelope)
@@ -2944,26 +2843,25 @@ export class WebPushManager {
       });
       return;
     }
-    const immediatelyBeforeSend = await collection.findOne({
+    const immediatelyBeforeSendSpool = await WebPushSpoolDoc.getInstance({
       id: currentSpool.id,
       state: 'sending',
       leaseToken,
     });
-    if (!immediatelyBeforeSend) return;
-    const immediatelyBeforeSendSpool = asSpoolDoc(immediatelyBeforeSend);
+    if (!immediatelyBeforeSendSpool) return;
     if (immediatelyBeforeSendSpool.cancelRequestedAt !== undefined) {
       await this.finishTerminal(immediatelyBeforeSendSpool, 'cancelled', {
         errorCode: immediatelyBeforeSendSpool.cancelErrorCode || 'CANCELLED_BY_APPLICATION',
       });
       return;
     }
-    const bindingImmediatelyBeforeSend = await WebPushBindingDoc.getNativeCollection().findOne({
+    const bindingImmediatelyBeforeSend = await WebPushBindingDoc.exists({
       id: currentSpool.bindingId,
       lifecycleGeneration,
       enabled: true,
       status: 'active',
       deletedAt: { $exists: false },
-    }, { projection: { _id: 1 } });
+    });
     if (!bindingImmediatelyBeforeSend) {
       await this.finishTerminal(currentSpool, 'cancelled', {
         errorCode: 'BINDING_LIFECYCLE_CHANGED',
@@ -3058,7 +2956,7 @@ export class WebPushManager {
   ): Promise<void> {
     if (!spoolArg.leaseToken) return;
     const now = this.now();
-    await WebPushSpoolDoc.getNativeCollection().updateOne(
+    await WebPushSpoolDoc.atomicUpdate(
       {
         id: spoolArg.id,
         state: 'sending',
@@ -3081,14 +2979,12 @@ export class WebPushManager {
     },
   ): Promise<void> {
     if (!spoolArg.leaseToken) return;
-    const collection = WebPushSpoolDoc.getNativeCollection();
-    const currentRaw = await collection.findOne({
+    const current = await WebPushSpoolDoc.getInstance({
       id: spoolArg.id,
       state: 'sending',
       leaseToken: spoolArg.leaseToken,
     });
-    if (!currentRaw) return;
-    const current = asSpoolDoc(currentRaw);
+    if (!current) return;
     if (current.cancelRequestedAt !== undefined) {
       await this.finishTerminal(current, 'cancelled', {
         errorCode: current.cancelErrorCode || 'CANCELLED_BY_APPLICATION',
@@ -3111,7 +3007,7 @@ export class WebPushManager {
       );
       return;
     }
-    await collection.updateOne(
+    await WebPushSpoolDoc.atomicUpdate(
       {
         id: current.id,
         state: 'sending',
@@ -3125,7 +3021,6 @@ export class WebPushManager {
           updatedAt: now,
           pushServiceStatusCode: metadataArg.pushServiceStatusCode ?? null,
           errorCode: metadataArg.errorCode,
-          _updatedAt: new Date(now).toISOString(),
         },
         $unset: {
           leaseToken: '',