From 478bac2e459ed47f35918e72388a65ce28a949b3 Mon Sep 17 00:00:00 2001
From: zzstoatzz <thrast36@gmail.com>
Date: Tue, 21 Jul 2026 14:40:57 -0500
Subject: [PATCH] preserve durability context across disconnects

---
 build.zig.zon            | 4 ++--
 docs/upstream-harness.md | 6 ++++++
 src/main.zig             | 8 +++++++-
 3 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/build.zig.zon b/build.zig.zon
index 162214d..67773b3 100644
--- a/build.zig.zon
+++ b/build.zig.zon
@@ -5,8 +5,8 @@
     .minimum_zig_version = "0.16.0",
     .dependencies = .{
         .zat = .{
-            .url = "git+https://tangled.org/zat.dev/zat#507f7dbd3526418533729c9e7846884b6213e22c",
-            .hash = "zat-0.3.17-5PuC7qI4CwAQ5D-0qIOl5YehCQMbAqNuYPgvVv1r9zPU",
+            .url = "git+https://tangled.org/zat.dev/zat#3910e37c27631dfa1255dd275bc8c23579ec4cb9",
+            .hash = "zat-0.3.17-5PuC7oQ6CwDLquPh4I7BXfyHv14e0RHa6z3Bm606qJ00",
         },
         .websocket = .{
             .url = "https://github.com/zzstoatzz/websocket.zig/archive/d8e6149.tar.gz",
diff --git a/docs/upstream-harness.md b/docs/upstream-harness.md
index 6c6e46d..ba5fd6d 100644
--- a/docs/upstream-harness.md
+++ b/docs/upstream-harness.md
@@ -165,6 +165,12 @@ for create, update, delete, identity, account, sync, and create_resync rows. It
 also removes an intermediate update to demonstrate comparator detection power,
 requires clean SIGTERM drain, restarts the same data directory, and reconstructs
 the complete archive through planBackfill/getSegment/getBlock/subscribe-v2.
+The production disconnect check additionally terminates and restarts the pinned
+local simulator while the ReleaseSafe binary is ingesting: Stream must retain
+its cursor, reconnect, resume delivery, and then exit cleanly on SIGTERM. The
+archive fallback close is deliberately registered above consumer teardown, so
+an unexpected consumer error cannot invoke the durability hook through freed
+cursor state.
 
 `just differential-oracle-multiseed` adds upstream's restart-chain baseline
 and exact seeded predicate-kill selector. Five distinct simulator worlds drive
diff --git a/src/main.zig b/src/main.zig
index 4f39959..87beb02 100644
--- a/src/main.zig
+++ b/src/main.zig
@@ -242,7 +242,6 @@ pub fn main(init: std.process.Init.Minimal) !void {
     };
     var archive_closed = false;
     defer {
-        if (!archive_closed) archive.close();
         archive.deinit();
     }
     archive.max_segment_bytes = max_segment_bytes;
@@ -431,6 +430,13 @@ pub fn main(init: std.process.Init.Minimal) !void {
         .shutdown = &shutdown_requested,
     };
     defer consumer.deinit();
+    // The archive's durability hook points into consumer. Keep the fallback
+    // close above consumer's deinit in the unwind stack so every error path
+    // flushes while the callback context is still alive.
+    defer if (!archive_closed) {
+        archive.close();
+        archive_closed = true;
+    };
     archive.on_durable_ctx = &consumer;
     archive.on_durable = ingest.Consumer.onArchiveDurable;
     var pipe: pipeline_mod.Pipeline = .{
-- 
2.51.2