the caller owns the ctx; stardust just keeps a copy of the pointer. the caller MUST keep that memory valid until stardust_db_subscription_release returns (cancel is not enough), and it must be safe to access from any thread, concurrently with the caller's own code.
it relies on a guarantee from stardust:
After release returns, notify is not running and does not run again.