<!-- task=m-node-provider-execution-liveness-recovery/08+07_health_overlay plan=3 tag=REVIEW_REFACTOR milestone-task=failure-handoff -->

# Complete - m-node-provider-execution-liveness-recovery/08+07_health_overlay

## Completed At

2026-08-05

## Summary

Completed the lease-bound provider health overlay and exact-target recovery fence after four plan artifacts, two required rework reviews, and a final PASS.

## Loop History

| Plan | Review | Verdict | Notes |
|------|--------|---------|-------|
| `plan_cloud_G09_0.log` | `code_review_cloud_G09_0.log` | Not reviewed | The initial packet was replaced by the first implementation loop before an official verdict. |
| `plan_cloud_G09_1.log` | `code_review_cloud_G09_1.log` | FAIL | Required R1 added current-catalog uniqueness and available-observation high-water retention. |
| `plan_cloud_G07_2.log` | `code_review_cloud_G08_2.log` | FAIL | Required R2 found cross-target recovery on a multi-target provider. |
| `plan_cloud_G06_3.log` | `code_review_cloud_G06_3.log` | PASS | Preserved the lowered adapter/target binding while advancing provider observation ordering and recovered only from later exact-target evidence. |

## Implementation / Cleanup

- Validate current reception generation and immutable provider lease identity before applying typed stall health evidence or releasing a terminal.
- Keep generation-scoped runtime health separate from configured provider health and apply it consistently to admission and provider snapshots.
- Resolve CAPABILITIES recovery against exactly one current catalog provider, retain a provider-wide sequence high-water mark, and preserve the lowered adapter/target binding across newer cross-target available evidence.
- Recover and pump queued work only from a strictly newer available observation for the exact binding that lowered the provider.
- Add deterministic coverage for missing/mismatched/stale evidence, catalog ambiguity, available-before-terminal ordering, cross-target no-recovery, exact-target recovery, snapshot projection, and release-once behavior.

## Final Verification

- `go test -count=50 ./apps/edge/internal/service -run '^(TestProviderHealthOverlayCapabilitiesRecoveryRequiresLoweredBinding|TestProviderHealthOverlayCapabilitiesRecoveryRejectsCatalogAmbiguity|TestProviderHealthOverlayCapabilitiesRecoveryPreservesAvailableHighWater|TestProviderHealthOverlayCapabilitiesRecoveryRejectsInconclusiveEvidence|TestProviderHealthOverlayCapabilitiesRecovery)$'` - PASS; the focused recovery suite completed 50 repetitions.
- `go test -count=20 ./apps/edge/internal/service -run '^(TestProviderHealthOverlay|TestReceived.*Failure|Test.*ReleaseOnce)' && go test -count=10 ./apps/node/internal/node ./apps/edge/internal/service -run '^(TestCapabilitiesHealthEvidence|TestProviderHealthOverlayCapabilitiesRecovery)'` - PASS; repeated overlay, release, and Node capability evidence suites completed.
- `go test -count=1 ./packages/go/execution ./apps/node/... ./apps/edge/internal/node ./apps/edge/internal/transport ./apps/edge/internal/bootstrap ./packages/go/streamgate ./apps/edge/internal/openai ./apps/edge/internal/service ./apps/edge/internal/controlplane` - PASS; every selected package completed successfully.
- `go test -race -count=3 ./apps/node/internal/node ./apps/edge/internal/node ./apps/edge/internal/transport ./apps/edge/internal/service` - PASS; no race report or timeout occurred.
- `go vet ./packages/go/execution ./apps/node/... ./apps/edge/internal/node ./apps/edge/internal/transport ./apps/edge/internal/bootstrap ./packages/go/streamgate ./apps/edge/internal/openai ./apps/edge/internal/service ./apps/edge/internal/controlplane` - PASS; no diagnostics.
- `./scripts/e2e-smoke.sh` - PASS; provider-only Node command/cancellation and Edge dispatch/tunnel/queue/reconnect checks completed.
- `(cd scripts && sed -e 's|^SCRIPT_DIR=.*|SCRIPT_DIR="$(pwd)"|' -e 's|TMP_DIR="$(mktemp -d /tmp/iop-provider-capacity-smoke.XXXXXX)"|TMP_DIR="$(mktemp -d "$REPO_ROOT/.tmp/iop-provider-capacity-smoke.XXXXXX")"|' e2e-provider-capacity-smoke.sh | bash)` - PASS; the final provider was available with zero in-flight and queued counters.
- `git diff --check` - PASS; no whitespace errors.
- The unchanged authorized live long-context provider and matching Edge status endpoints were not retried in this repository-fix loop because their inaccessible precondition was already archived and this packet did not change it.

## Remaining Nits

- None.

## Follow-up Work

- None for this task. Milestone-level aggregation remains responsible for combining this contribution with the other `failure-handoff` evidence.
