1. start() resets envCursor to 0 — new behaviour. A stop+start cycle now
begins rotation cleanly from envs[0] rather than inheriting between-
restart cursor drift.
2. Malformed payload → non-retryable handler error path. Pins that the
deserialise failure goes terminal without invoking the handler.
3. Ack failure after handler success — documents the current behavioural
gap. ack() lives inside processEntry's try, so a Redis blip on ack
routes a successfully-handled entry through the retry/terminal path.
Phase 2's engine-replay handler will need idempotency to absorb the
re-execution, OR ack should be lifted out of the try block.
4. start() idempotency — second call is a no-op (no doubled loop).
5. stop() idempotency — safe to call when never started or twice.
6. Loop-level backoff actually grows on consecutive runOnce failures
and resets on first success. Distinct from per-entry retry attempts
already covered elsewhere; this is the consecutiveErrors counter
that drives backoffMs between ticks.
Also adds org-level fairness analogue of the existing env starvation
test: a light org (1 env, 1 entry) is not starved behind a heavy org
with many envs and many entries. The buffer doesn't track orgs as a
separate axis, so org fairness is an emergent property of env rotation
— the test pins that property explicitly.
Dan Sutton
3daee331ab