<!-- task=m-node-provider-execution-liveness-recovery/01_activity_contract plan=5 tag=REVIEW_REVIEW_REVIEW_API milestone-task=activity-contract -->

# PLAN — Prove Queued Provider Timeout Identity

## For the Implementing Agent

> **MANDATORY:** Implement only this review-derived test and evidence checklist. Preserve unrelated user changes and keep edits inside the `activity-contract` slice. Do not modify production behavior unless the new deterministic test exposes a concrete defect. Do not update roadmap state, create another plan, commit, push, archive files, create `complete.log`, or perform the official review. After implementation, fill every implementation-owned section of `CODE_REVIEW-cloud-G06.md` and leave both active files in place.

## Background

The response-stall duration boundary, correlated tunnel rejection, and direct wire-zero ownership now pass focused review. The remaining contract gap is evidence: the Edge tests do not prove that initial and queued provider-pool selection preserve the final provider's identity and timeout when two providers share one adapter, and the inherited final verification was not completed. This follow-up adds only that deterministic matrix and finishes the existing verification record.

## Archive Evidence Snapshot

- Prior plan: `agent-task/m-node-provider-execution-liveness-recovery/01_activity_contract/plan_cloud_G08_4.log`.
- Prior review: `agent-task/m-node-provider-execution-liveness-recovery/01_activity_contract/code_review_cloud_G08_4.log`.
- Prior verdict: FAIL with 2 Required findings, 0 Suggested findings, and 0 Nit findings.
- Passing reviewer checks: the exact duration-boundary packages, Node timeout/tunnel tests, the two existing Edge timeout tests, ten focused Edge repetitions for those existing tests, formatting, and whitespace validation.
- Failing reviewer evidence: no initial/queued/shared-adapter provider-pool matrix exists for the normalized or tunnel wire surface, and several mandatory final verification commands remain unexecuted or lack a terminal result.
- Mandatory carryover: use deterministic queue-state barriers, assert both protobuf and `RunDispatch` identity, repeat the focused matrix, run every inherited final verification command, and report only evidence actually exercised.

## Analysis

### Files Read

- `AGENTS.md`
- `agent-ops/rules/project/rules.md`
- `agent-ops/rules/common/rules-roadmap.md`
- `agent-ops/rules/common/rules-agent-spec.md`
- `agent-ops/rules/project/domain/node/rules.md`
- `agent-ops/rules/project/domain/edge/rules.md`
- `agent-ops/rules/project/domain/platform-common/rules.md`
- `agent-ops/rules/project/domain/testing/rules.md`
- `agent-ops/rules/project/domain/client/rules.md`
- `agent-test/local/rules.md`
- `agent-test/local/node-smoke.md`
- `agent-test/local/edge-smoke.md`
- `agent-test/local/platform-common-smoke.md`
- `agent-test/local/client-smoke.md`
- `agent-roadmap/current.md`
- `agent-roadmap/phase/operational-observability-provider-management/phase.md`
- `agent-roadmap/phase/operational-observability-provider-management/milestones/node-provider-execution-liveness-recovery.md`
- `agent-roadmap/sdd/operational-observability-provider-management/node-provider-execution-liveness-recovery/SDD.md`
- `agent-spec/index.md`
- `agent-spec/runtime/edge-node-execution.md`
- `agent-spec/runtime/provider-pool-config-refresh.md`
- `agent-contract/index.md`
- `agent-contract/inner/execution-runtime.md`
- `agent-contract/inner/edge-node-runtime-wire.md`
- `agent-contract/inner/edge-config-runtime-refresh.md`
- `packages/go/execution/liveness.go`
- `packages/go/execution/liveness_test.go`
- `packages/go/config/provider_stall_timeout_test.go`
- `apps/edge/internal/service/model_queue_types.go`
- `apps/edge/internal/service/model_queue_admission.go`
- `apps/edge/internal/service/provider_resolution.go`
- `apps/edge/internal/service/provider_pool.go`
- `apps/edge/internal/service/provider_tunnel.go`
- `apps/edge/internal/service/run_submit.go`
- `apps/edge/internal/service/provider_stall_timeout_test.go`
- `apps/edge/internal/service/provider_pool_admission_test.go`
- `apps/edge/internal/service/provider_scheduling_advanced_test.go`
- `apps/edge/internal/service/run_dispatch_internal_test.go`
- `apps/edge/internal/service/service_internal_test.go`
- `apps/node/internal/node/runtime_bridge.go`
- `apps/node/internal/node/provider_tunnel_test.go`
- `agent-task/m-node-provider-execution-liveness-recovery/01_activity_contract/PLAN-cloud-G08.md`
- `agent-task/m-node-provider-execution-liveness-recovery/01_activity_contract/CODE_REVIEW-cloud-G08.md`

### SDD Criteria

- SDD: `agent-roadmap/sdd/operational-observability-provider-management/node-provider-execution-liveness-recovery/SDD.md`; approved and implementation lock released.
- Scenario: S01, milestone task `activity-contract`.
- The production contract is already implemented: direct requests carry zero, provider-pool requests carry the selected provider's effective timeout, and Node validates before execution.
- This packet must prove that the same selected provider owns provider id, served target, adapter, and timeout after both immediate admission and live queue re-resolution on normalized and tunnel wires.
- Watchdog timers, cancellation, retry, health recovery, schemas, and roadmap state remain outside this task.

### Verification Context

- Environment: local Go module `/config/workspace/iop-s1/go.mod`; protobuf and Dart bindings are regenerated only through the existing Make targets.
- No external provider credentials, deployment, migration, destructive action, or user decision is required.
- `net.Pipe` and typed protobuf listeners provide the real Edge-to-Node wire oracle.
- Existing queue helpers demonstrate bounded pending-state polling and runtime-config refresh pumping; fixed sleeps are not required for correctness.
- `make readability-audit` is a ratchet check. Any unrelated retained baseline failure must be recorded exactly, while no new or increased current-slice failure is acceptable.

### Test Coverage Gaps

- `provider_stall_timeout_test.go` contains only candidate normalization and direct wire-zero tests.
- Existing provider-pool tests assert one initially selected timeout but do not distinguish two providers that share one adapter.
- No focused timeout test queues a real normalized or tunnel submission, re-resolves after a runtime-config change, and proves the final winner's timeout on both the protobuf and dispatch metadata.
- The prior implementation record leaves the matrix, full verification, and mandatory evidence checklist incomplete.

### Symbol References

- `apps/edge/internal/service/provider_stall_timeout_test.go:19-100` — current focused coverage stops at candidate normalization and direct normalized/tunnel wire zero.
- `apps/edge/internal/service/provider_resolution.go:279-292,381-475` — provider-owned adapter, execution path, effective timeout, and served target enter each freshly resolved candidate.
- `apps/edge/internal/service/model_queue_admission.go:158-270,340-485` — live candidate refresh, atomic reservation, and queue pumping determine the final admitted candidate.
- `apps/edge/internal/service/run_submit.go:79-152` — normalized provider-pool dispatch rewrites the request and reports the selected candidate.
- `apps/edge/internal/service/provider_tunnel.go:201-293` — tunnel provider-pool dispatch applies the selected candidate immediately before wire construction and reports it through the handle.
- `apps/edge/internal/service/service_internal_test.go:451-884,926-1240` — existing refresh tests show pending-state barriers and live re-resolution after enable/capacity/priority changes.
- `apps/edge/internal/service/provider_pool_admission_test.go:1-617` — provider-pool pending-state helpers and queue assertions are reusable patterns.
- `apps/edge/internal/service/run_dispatch_internal_test.go:1351-1750` — typed `net.Pipe` captures and channel barriers provide deterministic normalized/tunnel wire evidence.
- `agent-contract/inner/edge-node-runtime-wire.md` — direct wire zero and selected-provider ownership are the reviewed inner-wire contract.

### Split Judgment

- Classification: bounded review rework in one focused Edge test file plus its evidence record.
- Cohesion: indivisible. The defect oracle is the four-way product of admission timing (initial/queued) and request surface (normalized/tunnel), with one shared provider-identity invariant.
- Scope remains the existing `01_activity_contract` task and `activity-contract` milestone task. No split child is created.

### Scope Rationale

- In scope: deterministic initial and queued provider-pool timeout identity tests, shared-adapter disambiguation, real protobuf capture, `RunDispatch` assertions, repeated focused execution, and all inherited final verification evidence.
- Out of scope: production changes unless the test exposes a concrete defect; schema, watchdog, timers, cancellation, retry, health, queue redesign, transport refactor, roadmap, commit, and push.
- Prefer compact table-driven helpers in the existing timeout test file and existing queue/config APIs. Do not copy large unrelated fixtures.

### Final Routing

- `status=routed`; `evaluation_mode=isolated-reassessment`; `finalizer=finalize-task-policy.sh`; `finalizer_mode=pair`.
- Build closures: `scope_closed=true`, `context_closed=true`, `verification_closed=true`, `evidence_trusted=true`, `ownership_closed=true`, `decision_closed=true`; the reviewed contract, concrete wire oracles, queue barriers, and file ownership close the packet without a capability gap.
- Build score: `scope=1`, `state=2`, `blast=0`, `evidence=1`, `verification=2` -> G06.
- Build signals: `base_route_basis=local-fit`, `large_indivisible_context=false`, loop risks `temporal_state`, `concurrent_consistency`, `boundary_contract`, and `variant_product` (`count=4`), `review_rework_count=3`, `evidence_integrity_failure=false`; risk and recovery boundaries matched.
- Build route: `route_basis=recovery-boundary`, lane `cloud`, file `PLAN-cloud-G06.md`.
- Review closures: `scope_closed=true`, `context_closed=true`, `verification_closed=true`, `evidence_trusted=true`, `ownership_closed=true`, `decision_closed=true`; no capability gap.
- Review score: `scope=1`, `state=2`, `blast=0`, `evidence=1`, `verification=2` -> G06.
- Review route: `route_basis=official-review`, lane `cloud`, adapter/model `codex/gpt-5.6-sol`, reasoning `xhigh`, file `CODE_REVIEW-cloud-G06.md`.

## Implementation Checklist

- [ ] [REVIEW_REVIEW_REVIEW_TEST-1] Add deterministic initial/queued shared-adapter provider identity and timeout evidence on normalized and tunnel surfaces.
- [ ] [REVIEW_REVIEW_REVIEW_VERIFY-1] Run every inherited final verification command and record exact, non-overstated evidence.
- [ ] Fill implementation-owned sections in `CODE_REVIEW-cloud-G06.md` with actual implementation notes and verification output.

### [REVIEW_REVIEW_REVIEW_TEST-1] Prove the final provider on every request surface

**Problem**

The current focused test suite can pass even if queued re-resolution retains the initially preferred provider's timeout or collapses provider identity to the shared adapter key.

**Solution**

- Extend `provider_stall_timeout_test.go` with a compact table-driven matrix covering normalized `SubmitRun` and `SubmitProviderTunnel`, each in immediate and queued admission modes.
- For each surface, configure one ready Node with two provider records that share the same enabled adapter but have distinct provider ids, catalog-served targets, and response-stall timeout values. Use provider types appropriate to the asserted execution surface.
- Make the immediate case select the deterministic lower-id provider and assert its provider id, shared adapter, served target, effective timeout, execution path, and `queue_reason=dispatched` in `RunDispatch` and in the captured protobuf.
- For the queued case, reserve both provider resources through existing queue admission APIs, launch exactly one real provider-pool submission, and wait on an explicit provider-pool pending-state barrier before changing availability.
- Apply a runtime-config refresh that disables the initially preferred provider and gives the alternate provider one available slot. Let the existing refresh pump and live resolver dispatch the waiter; assert the alternate provider id, its distinct served target and timeout, the shared adapter, and `queue_reason=capacity_full` on both dispatch metadata and the real protobuf.
- Bound only failure detection with channel/deadline timeouts. Do not use fixed sleeps to establish ordering. Release synthetic leases and close/settle returned handles so queue state does not leak across cases.
- Keep assertions able to fail independently for provider id, adapter, target, timeout, execution path, queue reason, run/tunnel identity, duplicate wire delivery, and final queue settlement.

**Modified files**

- [ ] `apps/edge/internal/service/provider_stall_timeout_test.go`

**Test Strategy**

Required. The focused inventory must name the new matrix; one run and ten repeated runs must pass. Each of the four variants must capture the real protobuf and compare it with the returned `RunDispatch`, not merely inspect candidate structs.

**Verification**

- `go test -count=1 ./apps/edge/internal/service -run 'ResponseStallTimeout|ProviderStallTimeout'`
- `go test -count=10 ./apps/edge/internal/service -run 'ResponseStallTimeout|ProviderStallTimeout'`

### [REVIEW_REVIEW_REVIEW_VERIFY-1] Complete the inherited evidence record

**Problem**

The preceding implementation accurately reported that several mandatory commands were not run or had no captured terminal result, so the activity contract cannot be finalized from that record.

**Solution**

- Run every command in Final Verification against the finished worktree in the listed order and record its exit status plus concise actual output in the active review stub.
- Name the exact tests and four matrix variants that establish immediate/queued, normalized/tunnel, shared-adapter, final-provider wire identity.
- Record unrelated readability baseline failures or transient smoke behavior exactly. Do not relabel a failing command as passing or claim a variant that the test inventory does not contain.
- Confirm generator changes remain limited to expected checked-in bindings, no temporary reviewer-only file remains, formatting is clean, and the diff contains no whitespace errors.

**Modified files**

- [ ] `agent-task/m-node-provider-execution-liveness-recovery/01_activity_contract/CODE_REVIEW-cloud-G06.md`

**Test Strategy**

Required as evidence integrity. Every checked implementation item must map to a named test or captured command result, and every unexecuted or failing command must remain explicit.

**Verification**

- All commands in Final Verification.

## Modified Files Summary

| Path | Action | Checklist |
|---|---|---|
| `apps/edge/internal/service/provider_stall_timeout_test.go` | modify | REVIEW_REVIEW_REVIEW_TEST-1 |
| `agent-task/m-node-provider-execution-liveness-recovery/01_activity_contract/CODE_REVIEW-cloud-G06.md` | update evidence | REVIEW_REVIEW_REVIEW_VERIFY-1 |

## Final Verification

1. `go version && go env GOMOD`
2. `flutter --version`
3. `make proto`
4. `make proto-dart`
5. `make client-test`
6. `go test -count=1 ./packages/go/execution ./packages/go/streamgate ./packages/go/config`
7. `go test -count=1 ./apps/node/internal/node -run 'StallTimeout|ProviderTunnelRequest'`
8. `go test -count=1 ./apps/edge/internal/service -run 'ResponseStallTimeout|ProviderStallTimeout'`
9. `go test -count=10 ./apps/edge/internal/service -run 'ResponseStallTimeout|ProviderStallTimeout'`
10. `go test -count=1 ./packages/go/execution ./apps/node/...`
11. `go test -count=1 ./packages/go/streamgate ./apps/edge/internal/openai ./apps/edge/internal/service ./apps/edge/internal/controlplane`
12. `go test -count=1 ./packages/go/execution ./packages/go/config ./apps/edge/internal/service ./apps/edge/internal/configrefresh ./apps/node/internal/node ./apps/node/internal/router`
13. `go test -race -count=1 ./packages/go/execution ./apps/node/internal/node`
14. `go vet ./packages/go/execution ./packages/go/config ./apps/edge/internal/service ./apps/edge/internal/configrefresh ./apps/node/internal/node ./apps/node/internal/router`
15. `go test -count=1 ./...`
16. `./scripts/e2e-smoke.sh`
17. `IOP_DEV_RECONNECT_BIND_TIMEOUT=45 ./scripts/dev/edge-node-reconnect-diagnostic.sh`
18. `make readability-audit`
19. `gofmt -l packages/go/execution packages/go/config apps/edge/internal/service apps/node/internal/node`
20. `git diff --check`
21. `git diff --stat`
