<!-- task=m-node-provider-execution-liveness-recovery/10+09_stall_recovery plan=7 tag=REVIEW_API milestone-task=bounded-retry -->

# Make Supported-Path Liveness Ownership Unconditional and Prove S05

## For the Implementing Agent

Implement only the two direct fixes below. Run every verification command exactly as written, fill the implementation-owned sections of `CODE_REVIEW-cloud-G10.md` with actual notes and complete raw output, keep the active pair in place, and report ready for review. Finalization belongs to the code-review skill. If blocked, record the exact blocker, attempted commands/output, and resume condition only in implementation-owned evidence fields. Do not ask the user, call user-input tools, create control-plane stop files, classify the next state, archive logs, or write `complete.log`.

## Background

The previous loop restored disabled-semantic endpoint compatibility by routing those requests back to legacy renderers. That removes the only request-local typed-stall recovery owner from a supported product variant and contradicts SDD S05. The named matrix tests also pass without producing a stall, replacement dispatch, or guard terminal, so their green output is not S05 evidence.

## Archive Evidence Snapshot

- The reviewed plan=6 pair is archived in this task directory as `plan_cloud_G08_6.log` and `code_review_cloud_G08_6.log` with verdict `FAIL`.
- Required R1: `openAIResponseRuntimeOwned()` still returns the semantic flag, so disabled-semantic Chat, Responses, and tunnel requests bypass the request runtime; complete one always-on liveness owner, preserve endpoint compatibility inside its adapters, remove owner-selection branches, and synchronize active contracts/specs.
- Required R2: `TestOpenAIStallRecoveryMatrix` and `TestOpenAISemanticGateDisabledCompatibility` exercise only ordinary normalized success responses; replace them with production handler/runtime recovery and guard-terminal matrices that prove SDD S05.
- All eleven verification commands passed on fresh reviewer reruns, but the named tests did not execute the required recovery products. Routing signals are `review_rework_count=4` and `evidence_integrity_failure=true`.

## Finding Resolution Map

| Finding | Mode | Exact Fix / Evidence | Changed or Satisfied Precondition |
|---------|------|----------------------|-----------------------------------|
| Required R1 | `direct-fix` | Make the supported Chat/Responses normalized and tunnel request runtime the unconditional liveness owner in `stream_gate_runtime.go`; carry semantic-disabled compatibility through `stream_gate_release_sink.go` and `responses_stream_gate.go`; remove the guarded legacy owner branches from all listed endpoint call sites; update the three active contracts and three matching specs. | The current code now isolates configured semantic registration from request-local extras, so compatibility can live inside one runtime without activating semantic filters. Existing endpoint tests are deterministic compatibility oracles. |
| Required R2 | `direct-fix` | Replace the two shallow fixtures in `stream_gate_stall_recovery_test.go` with deterministic production handler/runtime matrices for typed-stall recovery, provider selection, identity, shared budget, old-transport close, public terminal, and all zero-recovery guards. | Recovery candidate policy and Edge-confirmed handoff are already implemented by predecessor slices; the archived `09+08_retry_candidate_policy/complete.log` and current production seams provide the required precondition. |

## Analysis

### Files Read

- `apps/edge/internal/openai/stream_gate_runtime.go`
- `apps/edge/internal/openai/stream_gate_release_sink.go`
- `apps/edge/internal/openai/responses_stream_gate.go`
- `apps/edge/internal/openai/chat_completion.go`
- `apps/edge/internal/openai/buffered_sse.go`
- `apps/edge/internal/openai/normalized_sse.go`
- `apps/edge/internal/openai/provider_tunnel.go`
- `apps/edge/internal/openai/chat_handler.go`
- `apps/edge/internal/openai/responses_handler.go`
- `apps/edge/internal/openai/stream_gate_stall_recovery_test.go`
- `apps/edge/internal/openai/cancellation_routes_test.go`
- `apps/edge/internal/openai/chat_stream_reasoning_test.go`
- `apps/edge/internal/openai/provider_tunnel_test.go`
- `apps/edge/internal/openai/provider_tool_validation_test.go`
- `agent-contract/inner/execution-runtime.md`
- `agent-contract/inner/edge-config-runtime-refresh.md`
- `agent-contract/outer/openai-compatible-api.md`
- `agent-spec/runtime/stream-evidence-gate.md`
- `agent-spec/input/openai-compatible-surface.md`
- `agent-spec/runtime/edge-node-execution.md`
- `agent-roadmap/phase/operational-observability-provider-management/milestones/node-provider-execution-liveness-recovery.md`
- `agent-roadmap/sdd/operational-observability-provider-management/node-provider-execution-liveness-recovery/SDD.md`
- `agent-test/local/rules.md`
- `agent-test/local/edge-smoke.md`
- `agent-test/local/platform-common-smoke.md`
- `agent-task/archive/2026/08/m-node-provider-execution-liveness-recovery/09+08_retry_candidate_policy/complete.log`

### SDD Criteria

- SDD: `agent-roadmap/sdd/operational-observability-provider-management/node-provider-execution-liveness-recovery/SDD.md`; status `[Approved]`, lock released, no user-review gate.
- Contribution: `milestone-task=bounded-retry`; targeted scenario S05.
- S05 permits replay only for a confirmed, transport-uncommitted, uncancelled, side-effect-safe request with remaining shared fault budget and a recovery owner. Its Evidence Map requires commit-boundary/shared-budget, provider-pool failover, no-owner terminal, new run identity, and bounded dispatch evidence.
- The implementation checklist therefore keeps runtime ownership and the production S05 matrix atomic, and the final verification retains package, race, vet, and local smoke coverage.

### Verification Context

- No separate verification handoff was supplied. Repository-native sources are `agent-test/local/rules.md`, `edge-smoke.md`, `platform-common-smoke.md`, the active plan/review evidence, and the package/smoke commands below.
- All verification runs in `/config/workspace/iop-s1` against the current checkout. The fake vLLM mode and deterministic provider-capacity smoke require no external account, credential, remote runner, device, or live provider.
- Fresh reviewer reruns confirmed all eleven commands execute successfully. The remaining gap is behavioral coverage, not command availability.
- Confidence: high; the owner predicate and shallow fixtures directly expose both findings.

### Test Coverage Gaps

- Disabled-semantic compatibility has one legacy Chat SSE success fixture but no runtime-owned Chat/Responses normalized/tunnel product matrix.
- The recovery matrix never produces `response_stalled`; it has no replacement dispatch, provider avoidance/fallback, identity, budget, close, cancellation, unsafe, missing-snapshot, exhausted, unsupported, or no-owner assertions.
- Existing package suites cover endpoint compatibility and lower-level recovery pieces; they must remain green after the single-owner integration is completed.

### Symbol References

- Remove `openAIResponseRuntimeOwned` after direct runtime entry is established. Current references are in `stream_gate_runtime.go`, `chat_completion.go`, `buffered_sse.go`, `normalized_sse.go`, `provider_tunnel.go`, `chat_handler.go`, and `responses_handler.go`.
- Keep `streamGateSemanticEnabled` only for configured semantic filter selection and capability admission; do not reuse it as a response-owner selector.

### Split Judgment

- Keep one plan. Endpoint compatibility and typed-stall recovery share one response-owner/commit/terminal invariant; separating adapters from production S05 evidence would leave an invalid intermediate state.
- The dependent subtask `10+09_stall_recovery` requires predecessor index 09. It is satisfied by `agent-task/archive/2026/08/m-node-provider-execution-liveness-recovery/09+08_retry_candidate_policy/complete.log`.

### Scope Rationale

- Exclude Node watchdog, typed failure/wire mapping, Edge health overlay, and provider candidate policy; predecessor slices already own and verify them.
- Exclude new configuration keys and protobuf changes. `stream_evidence_gate.enabled` remains the semantic-policy switch; this plan changes only supported response ownership and documentation of that boundary.
- Exclude non-OpenAI ingress surfaces. S05 contribution scope is the supported OpenAI recovery host.

### Final Routing

- `evaluation_mode=isolated-reassessment`; `finalizer=finalize-task-policy.sh`; finalizer mode `pair`.
- Build closures: scope/context/verification/evidence/ownership/decision are closed. Grade scores: scope=2, state=2, blast=2, evidence=2, verification=2; base and final route basis `grade-boundary`; lane `cloud`; grade `G10`; filename `PLAN-cloud-G10.md`.
- Build signals: `large_indivisible_context=false`; matched loop risks `temporal_state`, `concurrent_consistency`, `boundary_contract`, `variant_product`; count=4; `review_rework_count=4`; `evidence_integrity_failure=true`; risk and recovery boundaries matched without replacing the grade basis.
- Review closures are closed. Grade scores: scope=2, state=2, blast=2, evidence=2, verification=2; route basis `official-review`; lane `cloud`; grade `G10`; filename `CODE_REVIEW-cloud-G10.md`; adapter `codex`, model `gpt-5.6-sol`, reasoning `xhigh`.

## Implementation Checklist

- [ ] REVIEW_API-1 makes one request runtime the unconditional liveness owner for every supported Chat/Responses normalized and tunnel path, preserves disabled-semantic endpoint compatibility inside that runtime, removes owner-selection branches, and synchronizes active contracts/specs.
- [ ] REVIEW_API-2 replaces the shallow named tests with deterministic production S05 recovery and guard-terminal matrices covering provider choice, new identity, shared budget, old-transport close, safety gates, cancellation, and exactly-once rendering.
- [ ] Run and record every exact final verification command separately after both implementation items are complete.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [REVIEW_API-1] Make the supported response runtime the sole liveness owner

**Problem:** `apps/edge/internal/openai/stream_gate_runtime.go:796-800` still implements `openAIResponseRuntimeOwned()` as `streamGateSemanticEnabled()`. Call sites such as `chat_completion.go:40`, `normalized_sse.go:41`, and `provider_tunnel.go:33` therefore bypass the typed-stall registration whenever semantic policy is disabled. Active contracts repeat this flag-controlled ownership, for example `agent-contract/inner/edge-config-runtime-refresh.md:49`.

**Solution:** Replace the owner selector with direct entry into one request runtime for every supported normalized/tunnel result. Carry a request-start semantic compatibility flag into event sources and release sinks so disabled mode preserves the endpoint-native status, headers, JSON/SSE/tunnel order, validation, reasoning/finish, usage, cancellation, write-failure, and exactly-one-terminal behavior while still registering private typed-stall recovery. Keep configured semantic filters and provider capability admission conditional.

Before:

```go
// stream_gate_runtime.go:796
func (s *Server) openAIResponseRuntimeOwned() bool { return s.streamGateSemanticEnabled() }
```

After:

```go
// Supported call sites enter the request runtime unconditionally.
// semanticEnabled is carried only as request-local policy/compatibility state.
```

**Modified Files and Checklist:**

- [ ] `apps/edge/internal/openai/stream_gate_runtime.go`: separate unconditional ownership from semantic activation and propagate compatibility state.
- [ ] `apps/edge/internal/openai/stream_gate_release_sink.go`: preserve Chat normalized/buffered JSON/SSE compatibility and one terminal in disabled mode.
- [ ] `apps/edge/internal/openai/responses_stream_gate.go`: preserve Responses normalized compatibility and terminal/cancellation behavior.
- [ ] `apps/edge/internal/openai/chat_completion.go`, `apps/edge/internal/openai/buffered_sse.go`, `apps/edge/internal/openai/normalized_sse.go`: remove guarded legacy owner selection and enter the runtime directly.
- [ ] `apps/edge/internal/openai/provider_tunnel.go`: route supported Chat/Responses streaming tunnels through the runtime while preserving native ordering/error behavior.
- [ ] `apps/edge/internal/openai/chat_handler.go`, `apps/edge/internal/openai/responses_handler.go`: keep semantic capability admission conditional and route normalized/tunnel products into the sole runtime owner.
- [ ] `agent-contract/inner/execution-runtime.md`, `agent-contract/inner/edge-config-runtime-refresh.md`, `agent-contract/outer/openai-compatible-api.md`: document always-on supported-host liveness ownership and semantic-only activation.
- [ ] `agent-spec/runtime/stream-evidence-gate.md`, `agent-spec/input/openai-compatible-surface.md`, `agent-spec/runtime/edge-node-execution.md`: synchronize the current supported product boundary and evidence pointers.

**Test Strategy:** Extend `stream_gate_stall_recovery_test.go` with disabled/enabled Chat and Responses normalized/tunnel compatibility products. Retain existing cancellation, validation, reasoning/finish, tunnel ordering/error, usage, and write-failure suites as regression oracles.

**Verification:** Commands 3-7 and 11 must pass after owner selection is removed. A focused substitute does not close this item.

### [REVIEW_API-2] Prove the production S05 lifecycle matrix

**Problem:** `apps/edge/internal/openai/stream_gate_stall_recovery_test.go:145-204` sends only successful `delta` and `complete` events. It proves ordinary handler dispatch, not typed-stall recovery or the S05 guard terminals.

**Solution:** Build deterministic production handler/runtime fixtures for Chat and Responses, normalized and tunnel, semantic false and true. Confirmed/uncommitted/safe rows must assert exactly one replacement dispatch, new run/attempt identity, one shared-budget debit, failed-provider avoidance, allowed same-provider fallback only for exact available evidence, confirmed old-transport close without duplicate cancel, and one public terminal. Guard rows must assert zero recovery for generic/unconfirmed, committed, caller-cancelled, tool/side-effect, missing-snapshot, exhausted, unsupported, and no-owner cases, with sanitized output.

Before:

```go
// stream_gate_stall_recovery_test.go:150
fake := &fakeRunService{events: bufferedRunEvents(
    &iop.RunEvent{Type: "delta", Delta: "safe output"},
    &iop.RunEvent{Type: "complete"},
)}
```

After:

```go
// Production fixtures emit an Edge-confirmed typed response_stalled terminal,
// capture re-admission/identity/budget/close, and assert the public terminal.
```

**Modified Files and Checklist:**

- [ ] `apps/edge/internal/openai/stream_gate_stall_recovery_test.go`: implement the recovery product and zero-recovery guard matrices through production handlers/runtime adapters.
- [ ] `agent-task/m-node-provider-execution-liveness-recovery/10+09_stall_recovery/CODE_REVIEW-cloud-G10.md`: record implementation decisions and complete raw output for every command.

**Test Strategy:** Replace the bodies of `TestOpenAIStallRecoveryMatrix` and `TestOpenAISemanticGateDisabledCompatibility`; retain lower-level filter/controller/dispatcher tests as separate regressions. Use deterministic fake services, event/tunnel streams, response writers, usage records, and close/cancel counters already available in the package.

**Verification:** Commands 1-3 must pass repeatedly and the named tests must contain and execute every required recovery/guard product rather than only a normal success path.

## Dependencies and Execution Order

1. Predecessor `09+08_retry_candidate_policy` is satisfied by `agent-task/archive/2026/08/m-node-provider-execution-liveness-recovery/09+08_retry_candidate_policy/complete.log`.
2. Complete REVIEW_API-1 and its compatibility products.
3. Complete REVIEW_API-2 against the single-owner runtime.
4. Synchronize contracts/specs and run all final verification commands.

## Modified Files Summary

| File | Item |
|------|------|
| `apps/edge/internal/openai/stream_gate_runtime.go` | REVIEW_API-1 |
| `apps/edge/internal/openai/stream_gate_release_sink.go` | REVIEW_API-1 |
| `apps/edge/internal/openai/responses_stream_gate.go` | REVIEW_API-1 |
| `apps/edge/internal/openai/chat_completion.go` | REVIEW_API-1 |
| `apps/edge/internal/openai/buffered_sse.go` | REVIEW_API-1 |
| `apps/edge/internal/openai/normalized_sse.go` | REVIEW_API-1 |
| `apps/edge/internal/openai/provider_tunnel.go` | REVIEW_API-1 |
| `apps/edge/internal/openai/chat_handler.go` | REVIEW_API-1 |
| `apps/edge/internal/openai/responses_handler.go` | REVIEW_API-1 |
| `apps/edge/internal/openai/stream_gate_stall_recovery_test.go` | REVIEW_API-1, REVIEW_API-2 |
| `agent-contract/inner/execution-runtime.md` | REVIEW_API-1 |
| `agent-contract/inner/edge-config-runtime-refresh.md` | REVIEW_API-1 |
| `agent-contract/outer/openai-compatible-api.md` | REVIEW_API-1 |
| `agent-spec/runtime/stream-evidence-gate.md` | REVIEW_API-1 |
| `agent-spec/input/openai-compatible-surface.md` | REVIEW_API-1 |
| `agent-spec/runtime/edge-node-execution.md` | REVIEW_API-1 |
| `agent-task/m-node-provider-execution-liveness-recovery/10+09_stall_recovery/CODE_REVIEW-cloud-G10.md` | REVIEW_API-2 |

## Final Verification

1. `go test -count=20 ./apps/edge/internal/openai -run '^(TestOpenAIStallRecoveryFilter|TestOpenAIAttemptControllerConfirmedStall|TestOpenAIAttemptDispatcherStalledProvider)$'` — PASS every iteration.
2. `go test -count=10 ./apps/edge/internal/openai -run '^TestOpenAIStallRecoveryMatrix$'` — PASS every production endpoint/path/config/recovery/terminal row.
3. `go test -count=10 ./apps/edge/internal/openai -run '^TestOpenAISemanticGateDisabledCompatibility$'` — PASS every runtime-owned endpoint compatibility row.
4. `go test -count=1 ./packages/go/streamgate ./apps/edge/internal/openai ./apps/edge/internal/service ./apps/edge/internal/controlplane` — PASS.
5. `go test -race -count=3 ./apps/edge/internal/service` — PASS with no race report.
6. `go test -race -count=3 ./apps/edge/internal/openai` — PASS with no race report.
7. `go vet ./packages/go/streamgate ./apps/edge/internal/service ./apps/edge/internal/openai ./apps/edge/internal/controlplane` — no diagnostics.
8. `./scripts/e2e-smoke.sh` — PASS.
9. `IOP_VLLM_MODE=fake ./scripts/e2e-openai-vllm.sh` — PASS.
10. `./scripts/e2e-provider-capacity-smoke.sh` — PASS.
11. `git diff --check` — no whitespace errors.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
