After reading the selected base version, I see two independent maintenance improvements. Improvement A sharpens the promotion boundary for empty responses. The current rule requires every event in a selected response to have a durable terminal outcome, but that condition is vacuously true when a retry returns no events. An empty response's successor should be promotable only when the provider contract supplies a coverage guarantee, such as a certified watermark, a stable snapshot boundary, or a documented rule that empty pages preserve completeness. For example, an empty page certified to cover positions through 700 may advance after its witness is durable, while an empty page carrying only an opaque successor must remain pending because another retry could reveal omitted events. This clarification cannot make an undocumented end-of-stream signal trustworthy and cannot provide completeness when the provider exposes no coverage semantics.
Improvement B adds a recovery procedure for unprovable divergence, where the current version says to recover from a stable boundary or fresh snapshot but does not define the procedure. Freeze advancement at the current cursor and generation, preserve all response witnesses and durable receipts, acquire a provider-supported stable boundary or fresh snapshot, replay into isolated reconciliation state, verify overlap and required payload identity, prove coverage through the restart boundary, and only then atomically install the recovered cursor under a greater generation. If any proof fails, keep the checkpoint frozen. This is independent of Improvement A because it addresses recovery after unverifiable state has already been detected, rather than deciding whether a particular empty response is eligible for promotion. It still cannot recover completeness without a provider-supported boundary or snapshot, and it may require operator intervention or a full rebuild.
These are reasoned amendments derived from the base procedure's invariants and stated limitations. No implementation, provider-contract, fault-injection, or integration tests were executed.