It looks like js-sdk is processing the encrypted to-device events in parallel. For each event, it performs the following steps:

• _decryptMessage in crypto/algorithms/olm.js checks all existing sessions to see if it can decrypt the message (there are no existing sessions yet)
• it then calls _olmDevice.createInboundSession to create a new olm session
• createInboundSession then
  • fetches the account from storage,
  • creates a new olm session (session.create_inbound_from)
  • removes the one-time key that was used for the message (account.remove_one_time_keys)
  • re-stores the account to storage

The problem here is that once the first event causes the one-time key to be removed, the other events will fail to create the inbound session, because it doesn't have the key any more. So to fix this, we need to change _decryptMessage to block trying to decrypt the second and third messages until it's done decrypting the first message, so that when it tries to decrypt the second and third messages, it finds the newly-created session rather than trying to create a new session. This blocking probably only needs to be done per-sender (e.g. decrypting a message from alice shouldn't block decrypting from bob) since they'll be using different one-time keys.