Codex terminal failure and reasoning-summary validation

Codex terminal reconstruction is fail-closed. Accept only reasoning_summary events part.added, part.done, text.delta, and text.done; reject unknown suffixes before mutation. Reconcile every nonempty terminal summary/content part bidirectionally with dense, contiguous, bounded, contradiction-free completed lifecycle state at the same coordinate; reject missing, extra, unfinished, contradictory, oversized, or forged parts. A validated matching output_item.done is completion authority even if seeded text lacks valueDone or partDone. Classify failed/cancelled aliases before requiring repeated metadata: response ID or model may be omitted when established by trusted accumulator state. Resolve identity only from that state, sanitize and account exactly once, and never run recall after failure. Invalid summaries must not leak reconstructed text, callbacks, follow-ups, private fields, or diagnostics.