<!-- task=m-node-provider-execution-liveness-recovery/08+07_health_overlay plan=1 tag=REFACTOR milestone-task=failure-handoff -->

# Code Review Reference - REFACTOR

> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> The task is NOT complete until every implementation-owned section below is filled in.
> Complete the `Implementation Checklist`; the final checklist item is mandatory before saving.
> Fill implementation-owned sections, then stop with active files in place and report ready for review.
> If implementation is blocked, record the exact blocker, attempted commands/output, and resume condition only in implementation-owned evidence fields.
> Do not ask the user directly, present choices, call user-input tools, create control-plane stop files, or classify the next state.
> Finalization (`Code Review Result`, log rename, `complete.log`, archive moves, `Review-Only Checklist`) is review-agent-only, even after compaction/resume.
> Follow the ownership table at the bottom of this file for which sections you own.

## Overview

date=2026-08-05
task=m-node-provider-execution-liveness-recovery/08+07_health_overlay, plan=1, tag=REFACTOR

## Archive Evidence Snapshot

- Union preparation review archived the unimplemented plan=0 pair as `plan_cloud_G09_0.log` and `code_review_cloud_G09_0.log`; it had no verdict, implementation evidence, or verification output.
- Material ownership finding: reception/binding/fence confirmation must be an Edge handoff fact, not `recovery_eligible`. This replan uses `recovery_handoff=confirmed` only to prove the current binding and local fence; the OpenAI ingress recovery owner still decides commit, cancel, side effects, budget, candidates, and replay eligibility.
- Verification finding: this packet changes provider-pool eligibility and ProviderSnapshot projection, so the testing domain requires live long-context preflight plus the needed scenario as an auxiliary regression in addition to focused S04 evidence.

## For the Review Agent

> **[REVIEW AGENT ONLY]** The finalization steps below are review-agent only. Implementing agents must not execute this section.

Compare implementation of each item against source files and verify that output in `Verification Results` matches code.
Review completion means the following steps are finished:

1. Append verdict and `review_rework_count` / `evidence_integrity_failure` routing signals.
2. Archive `CODE_REVIEW-cloud-G09.md` → `code_review_cloud_G09_1.log` and `PLAN-cloud-G09.md` → `plan_cloud_G09_1.log`.
3. If PASS, write `complete.log` and move active task directory to `agent-task/archive/YYYY/MM/m-node-provider-execution-liveness-recovery/08+07_health_overlay/`. If WARN/FAIL, fully write the next filesystem state required by the code-review skill.
4. If PASS, preserve the first-line `milestone-task` metadata in `complete.log` and report it for runtime aggregation. Roadmap state evaluation belongs to `sync-milestone-workstate`.
5. Check applicable `Review-Only Checklist` items at the final `.log` location before reporting.

---

## Implementation Item Completion

| Item | Status |
|------|---------|
| REFACTOR-1: Apply lease-bound runtime health and terminal handoff | [x] |
| REFACTOR-2: Feed recovery from the bounded status probe | [x] |

## Implementation Checklist

- [x] REFACTOR-1 validates reception plus immutable provider/adapter/target lease identity, sequence-fences runtime unhealthy/recovery transitions, gates admission/snapshots, annotates confirmed bound stalls with the non-approval token `recovery_handoff=confirmed`, and releases valid terminals exactly once.
- [x] REFACTOR-2 turns exact-target CAPABILITIES into fail-closed Session-sequenced health evidence and applies only unambiguous current-generation higher-sequence `available` to overlay recovery.
- [x] Add missing/ambiguous identity, stale/mismatch/sequence, normalized/tunnel release-race, and production-probe recovery fixtures; synchronize contracts/specs without mutating config health.
- [x] Run focused, package, race, vet, provider-only/local-capacity full-cycles, required live long-context preflight/`normal-10` auxiliary regression, and diff verification with fresh output.
- [x] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]** This checklist is used only by the review agent.
> Implementing agents must not modify or check this section.

- [x] Append one verdict of `PASS`, `WARN`, or `FAIL` and verified `review_rework_count`, `evidence_integrity_failure` to `Code Review Result`.
- [x] Verify that verdict, `Dimension Assessment`, and Required/Suggested/Nit classifications match.
- [x] Archive active `CODE_REVIEW-*-G??.md` to `code_review_cloud_G09_1.log`.
- [x] Archive active `PLAN-*-G??.md` to `plan_cloud_G09_1.log`.
- [x] Verify that the Agent-Ops managed block in `.gitignore` unignores `agent-task/**/*.md` and `agent-task/**/*.log` and ignores `agent-roadmap/current.md`.
- [ ] If PASS, write `complete.log` based on `agent-ops/skills/common/code-review/templates/complete-log-template.md` and leave no active `.md` files.
- [ ] If PASS, move active task directory `agent-task/m-node-provider-execution-liveness-recovery/08+07_health_overlay/` to `agent-task/archive/YYYY/MM/m-node-provider-execution-liveness-recovery/08+07_health_overlay/` and update this checklist at the final archive path.
- [ ] If PASS, preserve and report `milestone-task` metadata for runtime aggregation, without modifying roadmap or directly calling `update-roadmap`.
- [ ] If PASS for split work, remove empty active parent `agent-task/m-node-provider-execution-liveness-recovery/` or verify it was kept due to remaining siblings/files.
- [x] If WARN/FAIL, write the next filesystem state matching code-review verdict and do not write `complete.log`.

## Deviations from Plan

- `apps/node/internal/node/run_handler.go` and `apps/node/internal/node/tunnel_handler.go` were added to the modified-file set. Their existing `healthProbeFor` calls passed the registry instance key as the expected adapter type, which makes every named production adapter fail exact identity validation. Both call sites now pass `Capabilities.AdapterName` and `Capabilities.InstanceKey` separately; terminal adapter metadata remains the immutable requested instance key.
- Verification 6 first ran exactly as specified and failed because this execution environment mounts `/tmp` with `noexec`; the generated `fake-provider` binary could not start. The smoke was rerun without changing repository source by streaming the same script through `sed`, replacing only its temporary directory with the executable repository `.tmp` directory. The replacement command and both outputs are recorded below.
- Verification 7 and 8 were executed exactly as specified but could not use the authorized live dev pool: both the configured provider `/v1/models` endpoint and the Edge status endpoint were unreachable. This is the plan-defined `external-execution` verification blocker, not a product-decision blocker and not a weakening of the focused S04 oracle.

## Key Design Decisions

- The runtime health overlay is keyed by `(node_id, connection_generation, provider_id)` and guarded by the same queue mutex as leases/resources. It retains the exact adapter/target binding that lowered health, while config-owned `NodeProviderConf.Health` remains immutable.
- Authoritative reception node/generation and the immutable lease are checked before any correctness transition. Every accepted current terminal releases its own lease through the existing idempotent release path. A validated bound stall gets `provider_id`, validated health, and `recovery_handoff=confirmed`; sequence freshness affects only provider-wide projection, so an out-of-order terminal retains its request-local handoff without rewriting the overlay.
- All validated terminal observations advance one per-provider high-water mark, but only `unavailable` lowers effective health. Request-stalled/available and health-unknown terminal evidence cannot recover an unavailable provider. CAPABILITIES `unknown` and `unavailable` results are complete no-ops; only a strictly newer exact `available` result can recover.
- Runtime-unavailable providers are filtered from immediate and queued admission and project unavailable with zero effective capacity/counters in ProviderSnapshot. A later exact recovery or a newer connection generation restores effective eligibility without mutating config health.
- Node CAPABILITIES uses the existing bounded `ProbeHealth` normalizer and the same transport Session sequence source used by normalized/tunnel stall evidence. Edge validates only stable adapter/target/status/sequence keys and retains the command dispatch generation before offering evidence to the queue.
- Existing one-argument lifecycle/tunnel entry points remain compatibility paths. Production bootstrap uses the reception-aware siblings supplied by the predecessor transport fence.
- Contract/spec indexes were not changed because contract/spec ids, paths, statuses, and existing read triggers remain valid; only the matched contract and living-spec documents required synchronization.

## Reviewer Checkpoints

- Confirm reception identity and full immutable lease binding fence every overlay transition, and confirm `recovery_handoff=confirmed` is only an authority token while ingress retains full eligibility.
- Confirm unavailable/available sequence semantics, config immutability, admission/snapshot projection, and exactly-once release under duplicates/races.
- Confirm CAPABILITIES uses fail-closed `ProbeHealth` plus Session sequence and only exact current higher-sequence available recovers.
- Confirm long-context preflight/`normal-10` is treated as an auxiliary live eligibility/snapshot regression, with any unavailable runner captured as external-execution evidence rather than an S04 oracle.

## Verification Results

> Implementing agent: run each command exactly as written and paste its actual stdout/stderr under `Output`. Record any replacement command and reason in `Deviations from Plan`.

### Verification 1

Command:

```bash
go test -count=1 ./packages/go/execution ./apps/node/... ./apps/edge/internal/node ./apps/edge/internal/transport ./apps/edge/internal/bootstrap ./packages/go/streamgate ./apps/edge/internal/openai ./apps/edge/internal/service ./apps/edge/internal/controlplane
```

Output:

```text
ok  	iop/packages/go/execution	0.017s
ok  	iop/apps/node/cmd/node	0.511s
ok  	iop/apps/node/internal/adapters	0.319s
?   	iop/apps/node/internal/adapters/mock	[no test files]
ok  	iop/apps/node/internal/adapters/ollama	0.168s
ok  	iop/apps/node/internal/adapters/openai_compat	0.313s
ok  	iop/apps/node/internal/adapters/vllm	0.292s
ok  	iop/apps/node/internal/bootstrap	1.932s
ok  	iop/apps/node/internal/node	1.432s
ok  	iop/apps/node/internal/router	0.573s
ok  	iop/apps/node/internal/store	0.125s
ok  	iop/apps/node/internal/transport	5.802s
ok  	iop/apps/edge/internal/node	0.183s
ok  	iop/apps/edge/internal/transport	5.108s
ok  	iop/apps/edge/internal/bootstrap	0.468s
ok  	iop/packages/go/streamgate	0.896s
ok  	iop/apps/edge/internal/openai	7.412s
ok  	iop/apps/edge/internal/service	5.937s
ok  	iop/apps/edge/internal/controlplane	6.598s
```

### Verification 2

Command:

```bash
go test -count=20 ./apps/edge/internal/service -run '^(TestProviderHealthOverlay|TestReceived.*Failure|Test.*ReleaseOnce)' && go test -count=10 ./apps/node/internal/node ./apps/edge/internal/service -run '^(TestCapabilitiesHealthEvidence|TestProviderHealthOverlayCapabilitiesRecovery)'
```

Output:

```text
ok  	iop/apps/edge/internal/service	0.069s
ok  	iop/apps/node/internal/node	0.116s
ok  	iop/apps/edge/internal/service	0.070s
```

### Verification 3

Command:

```bash
go test -race -count=3 ./apps/node/internal/node ./apps/edge/internal/node ./apps/edge/internal/transport ./apps/edge/internal/service
```

Output:

```text
ok  	iop/apps/node/internal/node	5.684s
ok  	iop/apps/edge/internal/node	1.091s
ok  	iop/apps/edge/internal/transport	15.656s
ok  	iop/apps/edge/internal/service	19.169s
```

### Verification 4

Command:

```bash
go vet ./packages/go/execution ./apps/node/... ./apps/edge/internal/node ./apps/edge/internal/transport ./apps/edge/internal/bootstrap ./packages/go/streamgate ./apps/edge/internal/openai ./apps/edge/internal/service ./apps/edge/internal/controlplane
```

Output:

```text
(no output; exit 0)
```

### Verification 5

Command:

```bash
./scripts/e2e-smoke.sh
```

Output:

```text
[e2e] verifying provider-only Node command and cancellation boundary
ok  	iop/apps/node/internal/node	0.037s
[e2e] verifying Edge dispatch, provider tunnel, queue, and reconnect fencing
ok  	iop/apps/edge/internal/service	4.389s
ok  	iop/apps/edge/internal/transport	0.316s
[e2e] provider-only Edge-Node smoke PASSED
```

### Verification 6

Command:

```bash
./scripts/e2e-provider-capacity-smoke.sh
```

Output:

Initial exact command:

```text
[provider-capacity-smoke] building loopback binaries
[provider-capacity-smoke] ERROR: fake provider did not become ready: http://127.0.0.1:41585/v1/models
[provider-capacity-smoke] FAIL evidence=/tmp/iop-provider-capacity-smoke.hUgMC7
=== fake.log ===
./scripts/e2e-provider-capacity-smoke.sh: line 338: /tmp/iop-provider-capacity-smoke.hUgMC7/fake-provider: Permission denied
```

Environment evidence:

```text
/tmp   rw,nosuid,nodev,noexec,relatime,size=8388608k
-rwxr-xr-x 1 abc abc 67792 Aug  5 16:54 /tmp/iop-exec-probe.zFC0Kh/true
/bin/bash: line 1: /tmp/iop-exec-probe.zFC0Kh/true: Permission denied
```

Replacement command (same script content, executable temp directory only):

```bash
sed -e 's|^SCRIPT_DIR=.*|SCRIPT_DIR="$(pwd)"|' -e 's|TMP_DIR="$(mktemp -d /tmp/iop-provider-capacity-smoke.XXXXXX)"|TMP_DIR="$(mktemp -d "$REPO_ROOT/.tmp/iop-provider-capacity-smoke.XXXXXX")"|' e2e-provider-capacity-smoke.sh | bash
```

Replacement output:

```text
[provider-capacity-smoke] building loopback binaries
[provider-capacity-smoke] metrics=disabled bounded_probe_timeout_sec=2
[provider-capacity-smoke] offline_snapshot_rejected=true
[provider-capacity-smoke] aliases=ornith:35b,ornith-fast queue_observed=true
[provider-capacity-smoke] backend={"calls":2,"active":0,"peak":1}
[provider-capacity-smoke] final_provider=[{"node_id":"ornith-node","connected":true,"providers":[{"id":"ornith-provider","status":"available","health":"available","capacity":1,"in_flight":0,"queued":0,"long_context_capacity":1,"long_in_flight":0,"long_queued":0}]}]
[provider-capacity-smoke] PASS evidence=/config/workspace/iop-s1/.tmp/iop-provider-capacity-smoke.tqMLbO
```

### Verification 7

Command:

```bash
./scripts/e2e-long-context-admission-smoke.sh --preflight
```

Output:

```text
[long-admission-smoke] out-dir=/tmp/iop-long-admission-smoke run=20260805T075541Z base_url=http://toki-labs.com:18083/v1
[long-admission-smoke] === PREFLIGHT ===
run=20260805T075541Z
workdir=/config/workspace/iop-s1
base_url=http://toki-labs.com:18083/v1
status_url=http://127.0.0.1:18001/edges/edge-toki-labs-dev/status status_ssh=<direct>
config=configs/edge.yaml

## source state
$ git -C /config/workspace/iop-s1 rev-parse HEAD
170e8d88519260412f412d5f323b7052f4b9ee8e
$ git -C /config/workspace/iop-s1 status --short
warning: could not open directory '.tmp/TestCLIWorkspacePreflightFailuresHelper2007556437/001/inaccessible/': No such file or directory
warning: could not open directory '.tmp/TestCLIWorkspacePreflightFailuresHelper1981458881/001/inaccessible/': No such file or directory
 M agent-contract/inner/edge-config-runtime-refresh.md
 M agent-contract/inner/edge-node-runtime-wire.md
 M agent-contract/inner/execution-runtime.md
 M agent-spec/runtime/edge-node-execution.md
 M agent-spec/runtime/provider-pool-config-refresh.md
 D agent-task/m-node-provider-execution-liveness-recovery/05+04_failure_wire_contract/CODE_REVIEW-cloud-G07.md
 D agent-task/m-node-provider-execution-liveness-recovery/05+04_failure_wire_contract/PLAN-local-G07.md
 D agent-task/m-node-provider-execution-liveness-recovery/05+04_failure_wire_contract/code_review_cloud_G06_0.log
 D agent-task/m-node-provider-execution-liveness-recovery/05+04_failure_wire_contract/code_review_cloud_G07_1.log
 D agent-task/m-node-provider-execution-liveness-recovery/05+04_failure_wire_contract/plan_local_G06_0.log
 D agent-task/m-node-provider-execution-liveness-recovery/05+04_failure_wire_contract/plan_local_G07_1.log
 D agent-task/m-node-provider-execution-liveness-recovery/06+05_failure_wire_mapping/CODE_REVIEW-cloud-G08.md
 D agent-task/m-node-provider-execution-liveness-recovery/06+05_failure_wire_mapping/PLAN-local-G08.md
 D agent-task/m-node-provider-execution-liveness-recovery/07+06_reception_fence/CODE_REVIEW-cloud-G08.md
 D agent-task/m-node-provider-execution-liveness-recovery/07+06_reception_fence/PLAN-local-G08.md
 D agent-task/m-node-provider-execution-liveness-recovery/07+06_reception_fence/code_review_cloud_G08_0.log
 D agent-task/m-node-provider-execution-liveness-recovery/07+06_reception_fence/code_review_cloud_G08_3.log
 D agent-task/m-node-provider-execution-liveness-recovery/07+06_reception_fence/code_review_cloud_G09_1.log
 D agent-task/m-node-provider-execution-liveness-recovery/07+06_reception_fence/code_review_cloud_G09_2.log
 D agent-task/m-node-provider-execution-liveness-recovery/07+06_reception_fence/plan_cloud_G09_1.log
 D agent-task/m-node-provider-execution-liveness-recovery/07+06_reception_fence/plan_cloud_G09_2.log
 D agent-task/m-node-provider-execution-liveness-recovery/07+06_reception_fence/plan_local_G08_0.log
 D agent-task/m-node-provider-execution-liveness-recovery/07+06_reception_fence/plan_local_G08_3.log
 D agent-task/m-node-provider-execution-liveness-recovery/11+06_node_liveness_observability/CODE_REVIEW-cloud-G05.md
 D agent-task/m-node-provider-execution-liveness-recovery/11+06_node_liveness_observability/PLAN-local-G05.md
 D agent-task/m-node-provider-execution-liveness-recovery/11+06_node_liveness_observability/code_review_cloud_G05_0.log
 D agent-task/m-node-provider-execution-liveness-recovery/11+06_node_liveness_observability/code_review_cloud_G05_1.log
 D agent-task/m-node-provider-execution-liveness-recovery/11+06_node_liveness_observability/code_review_cloud_G05_2.log
 D agent-task/m-node-provider-execution-liveness-recovery/11+06_node_liveness_observability/code_review_cloud_G05_3.log
 D agent-task/m-node-provider-execution-liveness-recovery/11+06_node_liveness_observability/plan_local_G05_0.log
 D agent-task/m-node-provider-execution-liveness-recovery/11+06_node_liveness_observability/plan_local_G05_1.log
 D agent-task/m-node-provider-execution-liveness-recovery/11+06_node_liveness_observability/plan_local_G05_2.log
 D agent-task/m-node-provider-execution-liveness-recovery/11+06_node_liveness_observability/plan_local_G05_3.log
 M apps/client/lib/gen/proto/iop/runtime.pb.dart
 M apps/client/lib/gen/proto/iop/runtime.pbjson.dart
 M apps/edge/internal/bootstrap/runtime.go
 M apps/edge/internal/node/registry.go
 M apps/edge/internal/node/registry_test.go
 M apps/edge/internal/service/model_queue_admission.go
 M apps/edge/internal/service/model_queue_release.go
 M apps/edge/internal/service/model_queue_snapshot.go
 M apps/edge/internal/service/model_queue_types.go
 M apps/edge/internal/service/node_command.go
 M apps/edge/internal/service/provider_tunnel.go
 M apps/edge/internal/service/service.go
 M apps/edge/internal/transport/connection_handlers.go
 M apps/edge/internal/transport/server.go
 M apps/edge/internal/transport/server_test.go
 M apps/node/internal/node/command_handler.go
 M apps/node/internal/node/command_test.go
 M apps/node/internal/node/liveness_health_evidence_test.go
 M apps/node/internal/node/liveness_watchdog.go
 M apps/node/internal/node/node.go
 M apps/node/internal/node/run_handler.go
 M apps/node/internal/node/runtime_bridge.go
 M apps/node/internal/node/runtime_bridge_test.go
 M apps/node/internal/node/tunnel_handler.go
 M packages/go/execution/types.go
 M proto/gen/iop/runtime.pb.go
 M proto/iop/runtime.proto
?? agent-task/archive/2026/08/m-node-provider-execution-liveness-recovery/05+04_failure_wire_contract/
?? agent-task/archive/2026/08/m-node-provider-execution-liveness-recovery/06+05_failure_wire_mapping/
?? agent-task/archive/2026/08/m-node-provider-execution-liveness-recovery/07+06_reception_fence/
?? agent-task/archive/2026/08/m-node-provider-execution-liveness-recovery/11+06_node_liveness_observability/
?? agent-task/m-node-provider-execution-liveness-recovery/WORK_LOG.md
?? apps/edge/internal/service/provider_health_overlay_test.go
?? apps/node/internal/node/liveness_observability.go
?? apps/node/internal/node/liveness_observability_test.go
?? scripts/iop.db

## config check
$ go run ./apps/edge/cmd/edge config check --config configs/edge.yaml
OK configs/edge.yaml
config check OK
[long-admission-smoke] endpoint reachability: http://toki-labs.com:18083/v1/models
[long-admission-smoke]   BLOCKER: /models unreachable. exact command:
[long-admission-smoke]     curl -fsS --connect-timeout 10 http://toki-labs.com:18083/v1/models
[long-admission-smoke] status reachability: http://127.0.0.1:18001/edges/edge-toki-labs-dev/status
[long-admission-smoke]   BLOCKER: status unreachable. exact command:
[long-admission-smoke]     curl -fsS --connect-timeout 10 http://127.0.0.1:18001/edges/edge-toki-labs-dev/status
[long-admission-smoke] expected baseline: normal_capacity_total=9 long_slot_total=4
[long-admission-smoke] === PREFLIGHT BLOCKED (see out-dir; blockers are verification blockers, not user-review) ===
[long-admission-smoke] done rc=3 evidence=/tmp/iop-long-admission-smoke
```

Result: `external-execution` blocker (authorized live provider pool and Edge status endpoint unavailable).

### Verification 8

Command:

```bash
./scripts/e2e-long-context-admission-smoke.sh --scenario normal-10
```

Output:

```text
[long-admission-smoke] out-dir=/tmp/iop-long-admission-smoke run=20260805T075554Z base_url=http://toki-labs.com:18083/v1
[long-admission-smoke] === SCENARIO normal-10 (expect peak in_flight>=9, queued>=1) ===
[long-admission-smoke] normal-10: firing 10 normal request(s) to http://toki-labs.com:18083/v1/chat/completions
label=normal-10 samples=0
peak_in_flight=0
peak_queued=0
peak_long_in_flight=n/a (Control Plane status view does not expose long fields)
peak_long_queued=n/a (Control Plane status view does not expose long fields)
[long-admission-smoke] normal-10: normal http_200=0/10
[long-admission-smoke] normal-10: FAIL normal http_200=0/10 (require 10/10)
[long-admission-smoke] normal-10: FAIL peak peak_in_flight=0 (require peak_in_flight -ge 9)
[long-admission-smoke] normal-10: FAIL peak peak_queued=0 (require peak_queued -ge 1)
[long-admission-smoke] normal-10: FAILED to fetch final status (see /tmp/iop-long-admission-smoke/normal-10_final_20260805T075554Z.json.err)
[long-admission-smoke] done rc=1 evidence=/tmp/iop-long-admission-smoke
```

Result: `external-execution` blocker inherited from Verification 7; no live requests or status samples were possible.

### Verification 9

Command:

```bash
git diff --check
```

Output:

```text
(no output; exit 0)
```

---

> **[IMPLEMENTING AGENT — BEFORE SAVING] Have you filled in every implementation-owned section?**
> If anything is blank, go back and fill it in before saving this file.
> Leave review-agent-only sections unchanged.

## Section Ownership

| Section | Owner | Note |
|---------|-------|------|
| Header comment, Overview, Review Agent Instructions | Fixed at stub creation | Implementing agent must not modify or execute these (archive, complete.log, and task-directory archive move are review-agent only) |
| Archive Evidence Snapshot | Fixed at stub creation from plan when present | Implementing agent uses it as default prior-loop context; read only the specific archive files cited there when more detail is required |
| Implementation Item Completion (item names) | Fixed at stub creation | Implementing agent checks `[ ]` → `[x]` only |
| Implementation Checklist (item text/order) | Fixed at stub creation from plan | Implementing agent checks `[ ]` → `[x]` only |
| Review-Only Checklist | Review agent only | Implementing agent must not modify or check this section |
| Deviations from Plan, Key Design Decisions | Implementing agent | Replace placeholder text with actual content |
| Reviewer Checkpoints | Fixed at stub creation | Pre-filled from plan |
| Verification Results (section headings + commands) | Fixed at stub creation | Implementing agent fills in command output only; command changes require a `Deviations from Plan` entry |
| Code Review Result | Review agent appends | Not included in stub |

## Code Review Result

### Overall Verdict

FAIL

### Dimension Assessment

| Dimension | Result | Evidence |
|-----------|--------|----------|
| Correctness | FAIL | CAPABILITIES recovery is not resolved against the current provider catalog and does not retain a higher-sequence available observation before an unavailable overlay exists. |
| Completeness | FAIL | The exact/unambiguous recovery fence required by REFACTOR-2 is incomplete. |
| Test Coverage | FAIL | Existing ambiguity coverage creates two unavailable overlays, but does not cover one unavailable plus one healthy catalog match or available-before-terminal ordering. |
| API Contract | FAIL | Recovery can accept ambiguous current mappings and can let lower-sequence terminal evidence reverse a newer exact available observation. |
| Code Quality | PASS | The overlay and reception-fence implementation is localized and its ownership boundaries are otherwise clear. |
| Implementation Deviation | PASS | The production adapter identity correction and the `/tmp` noexec replacement smoke are justified and recorded with exact evidence. |
| Verification Trust | FAIL | A reviewer rerun of the exact race command timed out in `TestEdgeServerRegistrationFailureReasons`, contradicting the recorded all-PASS output; an immediate targeted race rerun passed, so the contradiction remains transient but unresolved. |
| Spec Conformance | FAIL | SDD S04 requires unambiguous exact recovery and stale-sequence no-op behavior across the current generation. |

### Findings

- **Required R1 — Resolve probe recovery against the current provider catalog and preserve the observation high-water mark** (`apps/edge/internal/service/model_queue_release.go:208`, `apps/edge/internal/service/provider_health_overlay_test.go:399`). `applyProviderProbeEvidence` searches only existing unavailable overlays. If the current Node catalog contains one unavailable provider and one healthy provider with the same adapter/target, the function sees one overlay and incorrectly recovers it even though the CAPABILITIES result is ambiguous. It also discards an exact `available` sequence when no unavailable overlay exists, so a delayed lower-sequence unavailable terminal can create an unavailable overlay and reverse newer evidence. Resolve adapter/target to exactly one provider in the current Node/generation catalog before applying recovery, and retain a per-provider observation high-water mark even when the current effective state is available. Add regressions for both catalog ambiguity and available-sequence-2-before-unavailable-sequence-1 ordering.

### Routing Signals

- `review_rework_count=1`
- `evidence_integrity_failure=true`

### Next Step

Prepare one follow-up packet that directly fixes R1 and reruns focused ordering/ambiguity tests plus the repository verification suite. Preserve the recorded live long-context external-execution blocker without retrying the unchanged inaccessible endpoints during this repository fix.
