saveCursor ran after refreshStaleIdentities in runIngestCycle. The identity refresh makes per-DID network calls and can run long; if the ingest isolate was aborted before the save (e.g. a scheduled-invocation deadline), the cursor never advanced and the next cycle re-drained the same jetstream window indefinitely. Records are durably applied before this point, so the cursor's forward progress is committed first. Identity refresh is idempotent and staleness-driven, so deferring it past the save is safe.