Never advance a cursor past pending work

// before: commit the highest sequence any handler touched
cursor = Math.max(cursor, record.seq);
// after: commit only up to the oldest record still waiting for a consumer
pending.add(record.seq);            // when buffered
pending.delete(record.seq);         // when consumed
const safe = pending.size ? Math.min(...pending) - 1 : highestSeen;
saveCursor(safe);