We're currently updating the last processed sequence before invoking the DCP callback.  In the majority of cases this is harmless, as the metadata won't be persisted unless incrementCheckpoint is called (which happens after the callback).

Similarly, in the case of node failure, the updated sequence will only be in memory and not persisted, so shouldn't cause a problem.

However, there appears to be a corner case associated with pindex rebalance.  When a feed is gracefully closed it will trigger persistence of the metadata when the stream is reopened, which has the potential to pick up an updated sequence associated with the previous pindex (which may include an in-flight sequence update).  If that in-flight update subsequently fails, the DCP checkpoint will have been moved past the mutation.