The in-flight list.

A job moved into active does not pass through — it stays there for the entire duration of the work, and only an explicit acknowledgement removes it. So active is a live record: every job in it is a job a worker has taken and not yet finished. Reading the list answers a question that matters for reliability — what work is in flight right now — without any extra bookkeeping.

This is what makes a crash recoverable. When a worker dies between taking a job and acknowledging it, the job is still in active. Nothing was lost, because nothing removed it. A recovery process reads the set and finds the parked job, exactly because the set is a record of in-flight work and not a transient buffer.

One shared in-flight list works, but it cannot tell which worker holds which job. The classic LIST form gives each worker its own in-flight list: processing:worker1, processing:worker2. A job in processing:worker1 is held by worker 1. When worker 1 dies, a recovery monitor reads worker 1's list, finds the parked jobs, and returns them to the waiting list for another worker — LMOVE processing:worker1 work_queue RIGHT RIGHT. Per-worker lists make the attribution direct: the list name is the worker.

A real engine refines the death signal beyond "how long has the job sat here." EchoMQ scores each member of emq:{queue}:active at its lease deadline on the server clock; a member whose score has passed now is a worker that stopped renewing, and EchoMQ.Jobs.reap/2 returns it to pending. The lease score is the death signal, so EchoMQ needs no per-worker list — the ledger's own score names the deadline. R3.03 is the count-thresholded sweep on top.

A job leaves the in-flight list with one command: LREM active 1 job — remove one occurrence of this job from the list. The discipline is when it runs: only after the work is truly complete. Run it too early — before the side effect is durable — and a crash after the ack but before the effect loses the job for real, because the ledger no longer holds it. Run it after the effect, and a crash before the ack leaves the job parked, recoverable, and redelivered.

That ordering is what makes delivery at-least-once rather than at-most-once. A job is delivered again if the worker died before the ack, and delivered once if the ack landed — never zero times. The cost is that a worker which finished the work and died before the ack redelivers the job, which is why R3.02 makes the consumer idempotent. This dive's job is the ledger and the ack; the redelivery cost is the next module's. Slide the crash point and read where the ack ordering protects the job.

EchoMQ's in-flight list is the emq:{queue}:active sorted set, built by EchoMQ.Keyspace.queue_key(queue, "active"), real in echo/apps/echo_mq. Each member is scored at its lease deadline on the server clock, so the score is both the in-flight marker and the recovery clock. The ack is EchoMQ.Jobs.complete/4: it is token-fenced on the row's attempts value, so only the worker that holds the current lease can retire the job — a worker whose lease was reaped and re-claimed by another worker is refused, and a redelivered completion is a no-op. A crash leaves the id in active, and EchoMQ.Jobs.reap/2 returns any member past its lease score to pending.

A job that stalls repeatedly past EchoMQ.Stalled's max_stalled threshold is not recovered forever: EchoMQ.Stalled.check/3 counts each stall on the row's stalled field and, at the threshold, dead-letters the job to emq:{queue}:dead. From the morgue the completion folds onward to the durable floor — the persistence frontier the echo-persistence course follows, where the bus archive lands in the page engine and replicates off-box. The lease score, the reaper, and the archive are the recovery machinery; this dive teaches the ledger and the ack.