Let's say I have a Kinesis Stream with 4 shards being consumed by a Lambda Function. The stream is continuously receiving events so it would be a high usage scenario. As I have 4 shards I'd have 4 function instances running at the same time (assuming Parallelization Factor=1). Then I publish a new version of the function with some new code. What happens then?
The behavior is most like your first bullet point, but the details can vary.
A number of worker processes in the backend poll the shards for work. Whenever there is work to do, they do a synchronous invoke to the Lambda-API and wait for the response (docs).
The Lambda-API is now responsible for picking an execution context to handle the request. It will do that depending on the function-ARN that you specified in the event source mapping. If you use the "default", i.e., the $latest alias, Lambda will just create an execution context with the latest version of the code (or use an existing one that satisfies the criteria) to run your code.
If you use an alias or a specific version in the function ARN for the event source mapping, the behavior depends on what you pick. If you specify a function version, Lambda will specifically execute that version.
If you specify an alias that does weighted routing to multiple function versions, it will pick any of those versions to handle the request.
tl;dr The behavior depends on the function ARN in the event source mapping, but usually, Lambda will switch to the new version without doing any rolling update logic. It behaves more like a blue-green deployment.