Two changes, one to a fixture and one to the audit. The bootstrap-pipeline receipt polled for phase==bootstrap live. Whether that gauge is observable at all depends on how long bootstrap happens to take: on a small simulator the whole lifecycle finishes in under four seconds and the window closes before the first scrape lands, while a large one holds it open for minutes. The fixture was a function of simulator size rather than of Stream's behavior. It now samples whenever the pipeline has demonstrably moved and proves bootstrap really happened from the cumulative transition counter, which cannot be missed by arriving late. A dispatch-scale kill test was written and then removed rather than weakened. The invariant it chased -- per-repository versus per-batch checkpointing -- is not observable in this harness. Repository completion is coupled to archive-writer durability, and in a 100-repo simulator world the archive flushes once covering the whole corpus, so after_repo_complete at any ordinal finds every repository already durable (checked at both one and two backfill workers), while mid_backfill_download fires before anything is durable. No cut leaves a durable prefix and remaining work at the same time. That is the coupling behaving correctly, not a defect: at production scale, with frequent in-flight flushes, the prefix is partial and the distinction becomes observable. The audit row now says exactly that instead of implying a test could be written here. zig build test (306), ReleaseSafe, differential-oracle, lifecycle oracle 9/9, power-loss oracle 20/20. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>