Align recovery delivery with Codex 0.153.4 and preserve bounded qualification evidence

[KeyffMS]

Completed scope

The interrupted upload was recovered from its Git objects, reviewed and completed. Final head: 1d5884f3bf89dfdeb1f113672f070ec0778ac714; verified local and remote tree: 678b85380318f57e3458a4870e3daaae1753f208.

Product and C10

Codex 0.153.4 PostCompact is stateless and accepts universal output fields; model-visible recovery is delivered by SessionStart(source=compact). The product now emits a target-free PostCompact readiness advisory and retains the actual recovery pointer in SessionStart. C10 tests independent startup and after-compaction fixtures, narrowing the second primary-checkout matcher to ^compact$ before bootstrap. Real hook output, actual expected target, lifecycle order, exact model echo, checkpoint validity and source/planning immutability remain required. Value-flow diagnostics contain only comparisons/counts/classifications, never the opaque proof.

The implementation specification, compliance record, baseline description and materialized C10 documentation are synchronized with the pinned source and official hooks reference. The two C10 acceptance assertion strings are unchanged. No new live capability result is asserted.

C09/C10 process observations

Only C09/C10 opt into bounded content-free process observations. On timeout the owned process group/tree is terminated and partial structural progress is retained. Reader/cleanup failures reject even positive output. Unexpected reader exceptions are flagged rather than disappearing in daemon threads. C09's 900-second timeout, compaction trigger, two-cycle/continuation/checkpoint requirements and rejection of incomplete output remain unchanged. This is not a claim that C09's live timeout cause is fixed.

Evidence packaging

Only a deterministic verified inner ZIP is uploaded. Every capability manifest is checked, including the three hidden fixture files. Missing/changed/unlisted files and symlinks are rejected. The temporary source-snapshot workflow has been removed. Extract the inner ZIP when reviewing the downloaded Actions artifact.

Verification

• PR CI #109: success, full hosted matrix.
• Local Python 3.13.5: 67 core tests, OK; 163 distribution/harness tests, OK.
• Executable tests cover actual product hook subprocesses, installation/start/checkpoint/recovery, exact value flow, timeout/descendant cleanup, partial/malformed/oversized streams, reader and cleanup failure rejection, and archive completeness/tampering.
• A newly added unexpected-reader-error test failed against the recovered implementation before its narrow fix and passed afterwards.
• Compilation, prepared C01-C16 hash/structure validation, candidate release checks, deterministic archive checks and whitespace checks passed.
• Local full tree SHA exactly matches the committed Git tree.

Boundaries and next run

C13 runtime is unchanged. Sandbox, approval policy, auth ownership, generator/executor separation and full C01-C16 release requirements are not relaxed. No self-hosted Codex workflow was dispatched.

After merge and post-merge CI: existing PlanAnvil Codex qualification workflow, branch main, mode=recovery (C09/C10/C13). Do not use full yet. C10 now tests the supported delivery channel; C09 may still report a timeout, but its remaining progress and cleanup will be observable.