Bound receive observer lifetime during native stream reads

[flip-engineer]

The receive loop now carries compact checkpoint and delivery state across frames, and the NUL-tail path preserves raw output, the last valid checkpoint, the native UUID, and pending input when recovery cannot safely settle the attempt.

Focused recovery tests passed for the keeper-loss and exit 0 invalid-tail cases. The memory plateau test failed: the candidate did not improve the measured RSS slope over the installed baseline. The same bounded fixture showed linear RSS growth on both builds, so this change is not qualified as a memory fix.

The validated source input is frozen at 57c3361a4d552805b58e68b88eecefcdaff9d3e; test-only updates are at 79b494f0e8d47c957795809ab5e445a12ff6b72c. The runtime test used a separately composed host/SQLite C candidate; it does not establish that the current postrelease source closure was built or deployed.

The operator waived full suites for this emergency work. Full-suite validation, memory-fix qualification, and deployment of the source-derived postrelease candidate remain open.

Tracks #696, #769, and #786.

[flip-engineer]

The original retained cgen-clang-review observer settled at 2026-10-17 07:25:56 UTC after supported cursor-preserving handovers. Its native UUID and raw spool identity were preserved. The temporary watcher recorded session_settled and exited.

The permanent memory fix remains open. Three Luna helpers and the existing DeepSeek implementation/review seats are working on the source build, durability review, and paired memory regression. The proposed List-held representation removes repeated string splitting and joining. Review found that direct turns must retain per-mutation .pending writes; that correction is required. The memory test is also being corrected to wait for confirmed observer consumption before sampling RSS. An initial unbarriered baseline exceeded the 8 MiB bound, but it is only lower-bound evidence.

PR809 merged as 70e755e. Its Linux executable replacement fix passed four remote source-extracted tests. It affects future patched owners and does not resolve the memory leak. Fixed-source build, paired plateau checks, direct interruption durability, deployment, and live verification remain required.

[flip-engineer]

The live failure is now reproduced with a focused retained-stream fixture: a 455,121-byte terminal followed by two batches of 100 small updates added 994,574,336 and 1,486,192,640 cumulative RSS bytes on diagnostic binary e6cb5edeca46602f1eaaef093479e660665e8690422571c554f7bffa9571d338. Both measurements waited for consumed markers. A later marker-window failure is excluded from these measurements.

Commit a85d9c102743bd3320f87e930460a044c5b8f51d removes output-position-only changes from the retained checkpoint predicate. Raw spool offset and reducer state remain atomic. Replay writes public output at the saved output position, and final output truncation preserves the reconstructed end. The patch includes an interruption/replay regression that checks the surviving native identity and exact output count.

The changed checkpoint module passes its source check. Runtime qualification is pending a source-derived receive executable, the crash/replay regression, the terminal-retention reproducer, and the maintained memory gate. This is not yet a deployed memory fix. The broader held-list optimization remains separate from this narrow repair.