diff --git a/docs/upstream-harness.md b/docs/upstream-harness.md
index b8a130e..4b89901 100644
--- a/docs/upstream-harness.md
+++ b/docs/upstream-harness.md
@@ -2,7 +2,7 @@
 
 condensed study of `bluesky-social/jetstream`, written 2026-07-08.
 
-**Upstream pin: `f29815c391fc2644f8a3dd36b899fb3697dd1ea6`** (2026-07-20). The
+**Upstream pin: `d4dd2f0127e8934d125b2a26a90fe88239ca98a2`** (2026-08-12). The
 suites below verify against that commit — see lines citing it further down. This
 is the pin most Stream docs share; note `jss-format-v1.md` and `jss-seal-spec.md`
 are instead on `0c45f29` (2026-07-08), 56 commits earlier.
@@ -14,7 +14,7 @@ keep source and check out the pin:
 
 ```
 git clone https://github.com/bluesky-social/jetstream
-git -C jetstream checkout f29815c391fc2644f8a3dd36b899fb3697dd1ea6
+git -C jetstream checkout d4dd2f0127e8934d125b2a26a90fe88239ca98a2
 ```
 
 On the maintainer's machine this sits at `~/github.com/bluesky-social/jetstream`
@@ -187,7 +187,7 @@ checks `listSegments`, `getSegment`, `getBlock`, and `planBackfill`, then runs
 the upstream Go client through whole-segment, DID-filtered block, sentinel-only
 block, bounded-range, and archive-to-live-cutover plans. The client harness
 requires upstream HEAD
-`f29815c391fc2644f8a3dd36b899fb3697dd1ea6`, selects a cached Go 1.26.5
+`d4dd2f0127e8934d125b2a26a90fe88239ca98a2`, selects a cached Go 1.26.5
 toolchain when necessary, and forces `GOTOOLCHAIN=local`, `GOPROXY=off`, and
 `GOSUMDB=off` for the actual Go build and run. `uv` is also forced offline;
 Zig's checksum-pinned dependencies must already be in its global cache. A
@@ -282,7 +282,7 @@ the write path.
 ## pinned differential oracle (2026-07-20)
 
 `just differential-oracle` refuses to run unless the upstream checkout is at
-`f29815c391fc2644f8a3dd36b899fb3697dd1ea6`. A Go overlay places the committed
+`d4dd2f0127e8934d125b2a26a90fe88239ca98a2`. A Go overlay places the committed
 test source inside upstream's `internal/oracle` package, so the receipt directly
 reuses its simulator world, physical JSS reader, event-log comparator,
 independent MST reconstruction, invariant checker, and public archive client.