[flip-engineer]

Add a retained-output regression that requires recovery to reach normal EOF and preserve unknown native exit status. It checks spool and checkpoint positions, terminal carry, materialized log position and owed input.

Source: f65d3dd785fb7d56a40bb64271a7f65f52c6de30. The fixture and recovery candidate compile on the self-hosted homelab. The data-only input is 46,123,112 bytes with SHA-256 87020b044a82014a8a4ef8166249be7a6012986f8f232c3868887f09bb521772.

The actual EOF regression fails: recovery exceeds the test's 900-second subprocess limit, and the test returns after 935.013 seconds. Recovery RSS stays near 30 MiB, but cumulative reads exceed 5.34 GB and the native log advances only to approximately 5.47 MB. The isolated test unit has 3.54 GiB peak memory, zero swap and no OOM event. Its own cleanup ends its test processes. The retained data-only spool is unchanged.

Failure output and profiling are preserved at /var/tmp/baton-f65-recovery-main-20261019/eof-test.stderr, eof-test-envelope.txt and perf-10s.data. Replay throughput and normal EOF remain release blockers. This draft records the regression and must be reviewed with the forthcoming replay fix.

Related: #825, #894, #890, #900.

[flip-engineer]

Escalated to the root replay work under #943. The observed EOF failure and read amplification remain open defects. The current read-reuse candidate is being qualified separately; its small fixture measurements do not establish a complete EOF result. Reconcile this regression with that source, run it through normal EOF on the self-hosted homelab, and retain exact custody, cursor and native-identity results. This regression will be reviewed with the runtime correction. This task remains open.

Review disposition recorded 2026-10-19. Completed and validated work proceeds through root review, merge and deployment; remaining work stays assigned for development or escalation.

[flip-engineer]

Root source review is complete. Current main contains this work through merged PR #1088 (3c4f9a0458c922417b1e83f8a0cf4f2fcd52166a). An independent native reviewer traced the retained Codex span/checkpoint, small-frame continuation, monitor-only replay and custody, invalid-checkpoint handling, instance-owner entry, and result/report requirements against current source, tests and documentation.

turn.bend classifies complete retained JSON spans through SQLite and preserves codex-span-v1 state. Current observer code and observer-monitor.py cover cursor commits, latest assistant and failed-terminal data, legacy reopen, metadata ordering, monitor custody, unknown native exit and unread input. The exact escaped-backslash boundary regression is merged in #1148. Root checked that test's 5300-byte fixture and escaped boundary; the focused native observer test has not been rerun here.

This older proposal is superseded by the integrated source. Its truncated JSON-prefix classifier can reject valid escaped input at byte4096 and must remain superseded. Root is closing #1047, #998, #869 and #901 on this source disposition. Replay-throughput work remains open in #1046; exact current-package runtime qualification and installed wake/chat-injection proof remain separate work in #1054 and the active critical package assignment. Closing these obsolete PRs does not claim those delivery results.