Both cold walkers skipped a manifest-listed segment whose file would not open, then kept emitting from the segments behind it and advanced the subscriber cursor past the gap. The subscriber sees a clean, ordered stream and never learns it is missing durable events. Upstream's walkSealedSegment returns `open seg %d: %w` and leaves the replay cursor untouched. All three open sites now propagate. The caller already disconnects the subscriber on a replay error, so the client reconnects and retries the range instead of silently losing it. Tests delete a manifest-listed segment out from under readSeqBatch and replaySeq and assert both surface FileNotFound and emit nothing at all from the intact later segment. zig build test (296), ReleaseSafe, differential-oracle, cursor-lookback-contract. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>