What happens when things go wrong

① Chain reorg — prevented, not repaired

A reorg would orphan blocks the indexer already processed — state would silently diverge from the canonical chain. The defense is refreshingly blunt: don't ingest blocks that could still reorg. The feed exposes only a safe head, lagging the chain tip by a finality margin:

// pkg/feed/rpc.go — safeHead
return head - f.finalityLag   // only expose blocks this far behind the tip

The comment notes ~64 blocks for L1: "no realistic reorg lives that long." Set it to 0 and you ingest head-of-chain — and "state silently diverges from the canonical chain after a reorg."

② Indexer crash mid-batch — self-healing by design

A pod dies halfway through writing a block's mutations. Two mechanisms you already know combine:

• Atomic commit (L4): mutations + cursor are one transaction → a half-write rolls back entirely. The graph never reflects a partial block.
• At-least-once delivery (L7): the block was never XACKed → it's redelivered and reprocessed.

③ Redis flushed / restarted — rebuilt from the graph

Redis loses the monitored set, balances, and its cursor. Because all of it is derivable from Memgraph, startup runs a sequence of self-heal steps (cmd/indexer/main.go):

// re-populate Redis state from Neo4j if lost (e.g. Redis flush/restart)
// 1. monitored set  ← all node ids in the graph
// 2. module set     ← from graph nodes
// 3. balance cache  ← HOLDS.quantity_raw (the canonical balances)
// 4. block cursor   ← Memgraph BlockCursor

A subtle ordering dependency worth noticing (this is the kind of detail you came for): the balance reconciler must run before the cursor self-heal. If you healed the cursor first, the Redis and Memgraph cursors would match — masking the drift signal — and the balance rebuild would be skipped even though the cache was empty. Order is load-bearing.

④ Cursor divergence (graph-writer stalls) — the watchdog & graceful pause

This is the most interesting one, and it needs a refinement to your Lesson 4 model. There are really two cursors:

Normally they track closely. But if the graph-writer halts (e.g. a DLQ/halt event), Redis keeps racing ahead while Memgraph stays put. The gap is dangerous: the indexer's in-process accumulators pile up state against a graph that has received none of it.

The cursor watchdog samples that gap. When it exceeds the threshold for N consecutive ticks, it flips a shared watchdogState to paused, and the stream-consumer loop reads that flag before every ReadBatch and short-circuits:

// pkg/indexer/indexer.go — Phase 2 consumer loop
if idx.ingestPaused() {   // watchdog flipped us to paused
    // short-circuit before ReadBatch — stop pulling new blocks
    continue
}

⑤ Dead consumer leaves blocks in-flight — reclaim

A pod dies with entries still in its PEL (Lesson 7). Those blocks are stranded until another consumer takes them over with XAUTOCLAIM — the literal cause of the "99 stuck blocks across two dead indexer pods" war story.