e7762e35e8
cursor>=totalLength is the sole forward-EOF test; a short non-final body is a truncation error, not EOF. Mid-stream forward-load failures now invoke RecoverFromFailedRefill so the scheduler halts instead of a silent false end. Two regression tests pin both paths.