Capture clients (pi, claude, codex) send byte-accurate from_offset,
to_offset, jsonl_sha256, and deterministic source_identity. Stale
cursors coalesce into one pending outbox segment under one Run ID.
capture-outbox-replay.ts is the only replay implementation; the audit
script fails closed on legacy flags and the scheduled nas-backup caller
is migrated. Raw Run writes reject divergent redelivery; a larger
proven-prefix body returns accepted_prefix without overwrite.
Verified adversarially (multi-byte offsets, repeated stale cursors,
fixture-only replay): 20 bun tests + 2 vitest + tsc clean. Receipts in
.brain/projects/typesense-reboot-recovery/patch-verification.svx.
- File verification records ok/missing/timeout/error with null counts
on timeout/error instead of fake zero files / missing backup.
- Replay receipts preserve child exit code, skipped-large count, and
the first concrete child error; failures land in the host error list.
Forced-fixture validated (1 ms timeout -> backupStatus timeout,
unreachable Central -> failed attempt + Connection refused, healthy
fixture still passes). Receipts in dark-wizard
.brain/projects/fleet-check-maintenance-2026-07-18/.
system/agent-session.capture-backup.requested event + audit-backup
script wired into nas-backup, with model-router escalation on backup
failures behind JOELCLAW_BACKUP_FAILURE_MODEL_ROUTER.
"Data durability, backup, and recovery" are where mixed transactional
and nontransactional solutions quietly corrupt -- Site Reliability
Engineering, Ch. 26
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Joel Hooks