<!-- task=m-principal-provider-credential-slot-routing/08+03,04,07_secure_delivery plan=4 tag=REVIEW_REVIEW_REVIEW_API milestone-task=secure-transport,credential-lease,adapter-injection,revocation -->

# Code Review Reference - REVIEW_REVIEW_REVIEW_API

> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> The task is NOT complete until every implementation-owned section below is filled in.
> Complete the `Implementation Checklist`; the final checklist item is mandatory before saving.
> Fill implementation-owned sections, then stop with active files in place and report ready for review.
> If implementation is blocked, record the exact blocker, attempted commands/output, and resume condition only in implementation-owned evidence fields.
> Do not ask the user directly, present choices, call user-input tools, create control-plane stop files, or classify the next state.
> Finalization (`Code Review Result`, log rename, `complete.log`, archive moves, `Review-Only Checklist`) is review-agent-only, even after compaction/resume.
> Follow the ownership table at the bottom of this file for which sections you own.

## Overview

date=2026-08-01
task=m-principal-provider-credential-slot-routing/08+03,04,07_secure_delivery, plan=4, tag=REVIEW_REVIEW_REVIEW_API

## Archive Evidence Snapshot

- `plan_cloud_G10_3.log` and `code_review_cloud_G10_3.log`: current-pair predicted archives; verdict `FAIL` with 2 Required, 0 Suggested, and 0 Nit findings. Fresh reviewer tests passed, but production inspection proved missing same-role enrollment-name binding and a five-minute/no-mutation plus same-generation reconnect projection outage.
- `plan_cloud_G10_2.log` and `code_review_cloud_G10_2.log`: prior recovery loop that found all secure-delivery production paths absent; the next implementation added TLS 1.3, signed/sealed leases, candidate-bound injection, revocation fences, and full-cycle evidence.
- `agent-task/archive/2026/08/m-principal-provider-credential-slot-routing/03+01,02_projection_auth/complete.log`: secret-free projection/cache and managed ingress foundation passed; this follow-up preserves its bounded atomic cache and fail-closed expired state.
- `agent-task/archive/2026/08/m-principal-provider-credential-slot-routing/07+01,02,05_secret_material/complete.log`: secret-at-rest and fail-closed startup prerequisite passed.

## For the Review Agent

> **[REVIEW AGENT ONLY]** The finalization steps below are review-agent only. Implementing agents must not execute this section.

Compare implementation of each item against source files and verify that output in `Verification Results` matches code.
Review completion means the following steps are finished:

1. Append verdict and `review_rework_count` / `evidence_integrity_failure` routing signals.
2. Archive `CODE_REVIEW-cloud-G10.md` → `code_review_cloud_G10_4.log` and `PLAN-cloud-G10.md` → `plan_cloud_G10_4.log`.
3. If PASS, write `complete.log` and move active task directory to `agent-task/archive/YYYY/MM/m-principal-provider-credential-slot-routing/08+03,04,07_secure_delivery/`. If WARN/FAIL, fully write the next filesystem state required by the code-review skill.
4. If PASS and task group is `m-<milestone-slug>`, preserve the first-line `milestone-task` metadata in `complete.log` and report it for the runtime aggregation event. Roadmap state evaluation belongs to `sync-milestone-workstate`.
5. Check applicable `Review-Only Checklist` items at the final `.log` location before reporting.

---

## Implementation Item Completion

| Item | Status |
|------|---------|
| REVIEW_REVIEW_REVIEW_API-1 Bind authenticated workload identity to enrollment | [x] |
| REVIEW_REVIEW_REVIEW_API-2 Renew and reconnect immutable managed projections | [x] |

## Implementation Checklist

- [x] Bind one unambiguous authenticated SPIFFE workload name to CP-Edge hello and Edge-Node token-resolved registration identity before any registry, lease, or recipient-key state mutation, and pass same-role wrong-name TLS regressions.
- [x] Renew immutable same-generation projections safely before expiry, keep lower/changed same-generation snapshots fenced, retain periodic refresh across active Edges, and pass managed reconnect/expiry/concurrency regressions.
- [x] Run the focused, race, full secure-delivery, vet, diff, and secret-structure verification commands with fresh output.
- [x] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]** This checklist is used only by the review agent.
> Implementing agents must not modify or check this section.

- [x] Append one verdict of `PASS`, `WARN`, or `FAIL` and verified `review_rework_count`, `evidence_integrity_failure` to `Code Review Result`.
- [x] Verify that verdict, `Dimension Assessment`, and Required/Suggested/Nit classifications match.
- [x] Archive active `CODE_REVIEW-*-G??.md` to `code_review_cloud_G10_4.log`.
- [x] Archive active `PLAN-*-G??.md` to `plan_cloud_G10_4.log`.
- [x] Verify that the Agent-Ops managed block in `.gitignore` unignores `agent-task/**/*.md` and `agent-task/**/*.log` and ignores `agent-roadmap/current.md`.
- [ ] If PASS, write `complete.log` based on `agent-ops/skills/common/code-review/templates/complete-log-template.md` and leave no active `.md` files.
- [ ] If PASS, move active task directory `agent-task/m-principal-provider-credential-slot-routing/08+03,04,07_secure_delivery/` to `agent-task/archive/YYYY/MM/m-principal-provider-credential-slot-routing/08+03,04,07_secure_delivery/` and update this checklist at the final archive path.
- [ ] If PASS and task group is `m-<milestone-slug>`, preserve and report `milestone-task` metadata for runtime aggregation, without modifying roadmap or directly calling `update-roadmap`.
- [ ] If PASS for split work, remove empty active parent `agent-task/m-principal-provider-credential-slot-routing/` or verify it was kept due to remaining siblings/files.
- [x] If WARN/FAIL, write the next filesystem state matching code-review verdict and do not write `complete.log`.

## Deviations from Plan

None. All implementation and verification commands followed the plan without replacement commands.

## Key Design Decisions

- `auth.ParseWorkloadIdentity` is the single certificate parser for both TLS verification and enrollment handlers. It accepts exactly one canonical `spiffe://iop/<role>/<name>` URI SAN and rejects missing, malformed, slash-containing, non-canonical, or multiple IOP identities.
- TLS enrollment handlers read the completed peer certificate from the accepted `net.Conn`. CP-Edge validates `edge/<edge_id>` before projection construction or connection-state mutation; Edge-Node validates `node/<token-resolved record ID>` before config construction, recipient-key capture, listener binding, or registry admission. Plain constructors remain compatible.
- Equal-generation projection apply compares normalized token and route authorization content independent of slice order. Identical duplicate or older windows are idempotent; only a strictly later issued/expiry window is atomically installed. Changed equal generations and all lower generations remain fenced.
- The Control Plane owns one context-bound refresh ticker configured at half the five-minute projection TTL. Broadcasts are serialized, snapshot active clients before network calls, attempt every client, and aggregate individual failures so one Edge cannot prevent refresh attempts to the others.

## Reviewer Checkpoints

- Confirm one shared parser requires exactly one canonical IOP SPIFFE workload URI and rejects ambiguous, missing, malformed, wrong-role, and configured wrong-name identities.
- Confirm CP-Edge compares the authenticated `edge` name to hello `edge_id` before registry, active-client, projection, or lease state, and Edge-Node compares the authenticated `node` name to the token-resolved record before config, recipient-key, listeners, or registry state.
- Confirm credential-plane-disabled plaintext constructors retain compatibility while every managed TLS connection enforces enrollment binding.
- Confirm equal-generation renewal cannot change token/route content, lower generations remain rejected, identical duplicates are idempotent, and only a later freshness window swaps atomically.
- Confirm the periodic refresh loop starts/stops with the Edge server, runs before the five-minute expiry, attempts every active authenticated Edge despite individual failures, and composes safely with mutation/revocation broadcasts.
- Confirm a projection-enabled connector reconnects on the same durable generation and remains fresh, while changed same-generation hello content fails closed.
- Confirm focused/race/full-cycle tests, vet, diff checks, structural secret guard, upstream exact auth, revocation ordering, and sentinel absence all pass.

## Verification Results

Paste actual stdout/stderr and exit status below each command. Do not summarize or reconstruct output. Replacement commands require a `Deviations from Plan` entry.

### REVIEW_REVIEW_REVIEW_API-1

```bash
env GOCACHE=/config/tmp/gocache-secure-delivery GOTMPDIR=/config/workspace/.gotmp-iop-secure-delivery TMPDIR=/config/workspace/.gotmp-iop-secure-delivery go test -count=1 ./packages/go/auth ./apps/control-plane/internal/wire ./apps/edge/internal/transport
```

_Actual stdout/stderr and exit status:_

```text
ok  	iop/packages/go/auth	10.066s
ok  	iop/apps/control-plane/internal/wire	1.634s
ok  	iop/apps/edge/internal/transport	4.810s
```

Exit status: `0`.

### REVIEW_REVIEW_REVIEW_API-2

```bash
env GOCACHE=/config/tmp/gocache-secure-delivery GOTMPDIR=/config/workspace/.gotmp-iop-secure-delivery TMPDIR=/config/workspace/.gotmp-iop-secure-delivery go test -count=1 ./apps/edge/internal/authprojection ./apps/edge/internal/controlplane ./apps/control-plane/internal/wire ./apps/control-plane/cmd/control-plane
env GOCACHE=/config/tmp/gocache-secure-delivery GOTMPDIR=/config/workspace/.gotmp-iop-secure-delivery TMPDIR=/config/workspace/.gotmp-iop-secure-delivery go test -count=1 -race ./apps/edge/internal/authprojection ./apps/edge/internal/controlplane ./apps/control-plane/internal/wire
```

_Actual stdout/stderr and exit status:_

First command:

```text
ok  	iop/apps/edge/internal/authprojection	0.052s
ok  	iop/apps/edge/internal/controlplane	6.596s
ok  	iop/apps/control-plane/internal/wire	1.789s
ok  	iop/apps/control-plane/cmd/control-plane	3.928s
```

Exit status: `0`.

Second command:

```text
ok  	iop/apps/edge/internal/authprojection	1.058s
ok  	iop/apps/edge/internal/controlplane	7.608s
ok  	iop/apps/control-plane/internal/wire	2.809s
```

Exit status: `0`.

### Final Verification

```bash
command -v go && go version && go env GOROOT
test -f agent-task/archive/2026/08/m-principal-provider-credential-slot-routing/07+01,02,05_secret_material/complete.log
env GOCACHE=/config/tmp/gocache-secure-delivery GOTMPDIR=/config/workspace/.gotmp-iop-secure-delivery TMPDIR=/config/workspace/.gotmp-iop-secure-delivery go test -count=1 ./packages/go/auth ./packages/go/config ./packages/go/credentiallease
env GOCACHE=/config/tmp/gocache-secure-delivery GOTMPDIR=/config/workspace/.gotmp-iop-secure-delivery TMPDIR=/config/workspace/.gotmp-iop-secure-delivery go test -count=1 ./apps/control-plane/... ./apps/edge/... ./apps/node/...
env GOCACHE=/config/tmp/gocache-secure-delivery GOTMPDIR=/config/workspace/.gotmp-iop-secure-delivery TMPDIR=/config/workspace/.gotmp-iop-secure-delivery go test -count=1 -race ./packages/go/auth ./packages/go/credentiallease ./apps/control-plane/internal/credentiallease ./apps/control-plane/internal/wire ./apps/edge/internal/authprojection ./apps/edge/internal/controlplane ./apps/edge/internal/service ./apps/edge/internal/transport ./apps/node/internal/node
env GOCACHE=/config/tmp/gocache-secure-delivery GOTMPDIR=/config/workspace/.gotmp-iop-secure-delivery TMPDIR=/config/workspace/.gotmp-iop-secure-delivery make test-control-plane-edge-wire
env GOCACHE=/config/tmp/gocache-secure-delivery GOTMPDIR=/config/workspace/.gotmp-iop-secure-delivery TMPDIR=/config/workspace/.gotmp-iop-secure-delivery go vet ./apps/control-plane/... ./apps/edge/... ./apps/node/... ./packages/go/...
git diff --check
if rg --sort path -n 'bytes[[:space:]]+(secret|provider_secret)|map<string, string>[[:space:]]+(credential|provider_auth)' proto/iop/runtime.proto; then exit 1; fi
```

_Actual stdout/stderr, exit status, full-cycle observations, and sentinel-absence evidence:_

`command -v go && go version && go env GOROOT`

```text
/config/.local/bin/go
go version go1.26.2 linux/arm64
/config/opt/go
```

Exit status: `0`.

`test -f agent-task/archive/2026/08/m-principal-provider-credential-slot-routing/07+01,02,05_secret_material/complete.log`

```text
(no stdout/stderr)
```

Exit status: `0`.

`go test -count=1 ./packages/go/auth ./packages/go/config ./packages/go/credentiallease` with the recorded cache/temp environment:

```text
ok  	iop/packages/go/auth	10.072s
ok  	iop/packages/go/config	0.736s
ok  	iop/packages/go/credentiallease	0.033s
```

Exit status: `0`.

`go test -count=1 ./apps/control-plane/... ./apps/edge/... ./apps/node/...` with the recorded cache/temp environment:

```text
ok  	iop/apps/control-plane/cmd/control-plane	7.200s
ok  	iop/apps/control-plane/internal/credentiallease	0.794s
ok  	iop/apps/control-plane/internal/credentialops	4.228s
ok  	iop/apps/control-plane/internal/credentialseal	0.486s
ok  	iop/apps/control-plane/internal/credentialstore	7.924s
ok  	iop/apps/control-plane/internal/wire	1.962s
ok  	iop/apps/edge/cmd/edge	1.036s
ok  	iop/apps/edge/internal/authprojection	0.180s
ok  	iop/apps/edge/internal/bootstrap	8.054s
ok  	iop/apps/edge/internal/configrefresh	0.746s
ok  	iop/apps/edge/internal/controlplane	6.692s
ok  	iop/apps/edge/internal/edgecmd	0.341s
ok  	iop/apps/edge/internal/edgevalidate	0.092s
ok  	iop/apps/edge/internal/events	0.080s
ok  	iop/apps/edge/internal/input	0.106s
ok  	iop/apps/edge/internal/input/a2a	0.082s
ok  	iop/apps/edge/internal/node	0.067s
ok  	iop/apps/edge/internal/openai	7.548s
ok  	iop/apps/edge/internal/opsconsole	0.094s
ok  	iop/apps/edge/internal/service	5.973s
ok  	iop/apps/edge/internal/transport	4.908s
ok  	iop/apps/node/cmd/node	0.115s
ok  	iop/apps/node/internal/adapters	0.063s
?   	iop/apps/node/internal/adapters/mock	[no test files]
ok  	iop/apps/node/internal/adapters/ollama	0.043s
ok  	iop/apps/node/internal/adapters/openai_compat	0.168s
ok  	iop/apps/node/internal/adapters/vllm	0.143s
ok  	iop/apps/node/internal/bootstrap	1.501s
ok  	iop/apps/node/internal/node	0.902s
ok  	iop/apps/node/internal/router	0.517s
ok  	iop/apps/node/internal/store	0.085s
ok  	iop/apps/node/internal/transport	5.585s
```

Exit status: `0`.

Race command with the recorded cache/temp environment:

```text
ok  	iop/packages/go/auth	11.250s
ok  	iop/packages/go/credentiallease	1.241s
ok  	iop/apps/control-plane/internal/credentiallease	1.554s
ok  	iop/apps/control-plane/internal/wire	2.923s
ok  	iop/apps/edge/internal/authprojection	1.111s
ok  	iop/apps/edge/internal/controlplane	7.699s
ok  	iop/apps/edge/internal/service	7.072s
ok  	iop/apps/edge/internal/transport	6.066s
ok  	iop/apps/node/internal/node	2.462s
```

Exit status: `0`.

`make test-control-plane-edge-wire` with the recorded cache/temp environment:

```text
./scripts/e2e-control-plane-edge-wire.sh
[cp-edge-wire] NOTE: auxiliary smoke only - verifies Control Plane-Edge hello and disconnect via real processes.
[cp-edge-wire] shellcheck not found, skipping
[cp-edge-wire] ports: cp_http=29850 cp_ws=30857 cp_edge_wire=31546 edge_node=32618 edge_bootstrap=33687 edge_metrics=35035
[cp-edge-wire] building temp binaries...
[cp-edge-wire] starting Control Plane...
[cp-edge-wire] waiting for Control Plane edge wire port 31546 (timeout: 20s)...
[cp-edge-wire] Control Plane edge wire port ready
[cp-edge-wire] starting Edge...
[cp-edge-wire] waiting for hello accepted (timeout: 30s)...
[cp-edge-wire] CP: hello accepted
[cp-edge-wire] Edge: connected to control plane
[cp-edge-wire] stopping Edge process to trigger disconnect...
[cp-edge-wire] waiting for disconnect marker on CP (timeout: 20s)...
[cp-edge-wire] CP: edge disconnected
=== CONTROL PLANE OUTPUT ===
{"level":"info","ts":1785597935.6180606,"caller":"control-plane/server.go:30","msg":"control-plane client wire endpoint reserved","protocol":"protobuf-socket","transport":"proto-socket-ws","listen":"127.0.0.1:30857"}
{"level":"info","ts":1785597935.6188316,"caller":"control-plane/server.go:35","msg":"control-plane edge wire endpoint reserved","protocol":"protobuf-socket","transport":"proto-socket-tcp","listen":"127.0.0.1:31546"}
{"level":"info","ts":1785597935.6190126,"caller":"wire/client.go:92","msg":"starting client wire WS server","host":"127.0.0.1","port":30857,"path":"/client"}
{"level":"info","ts":1785597935.6204798,"caller":"wire/edge_server.go:214","msg":"starting edge wire TCP server","host":"127.0.0.1","port":31546,"transport":"proto-socket-tcp"}
{"level":"info","ts":1785597935.6209977,"caller":"control-plane/server.go:227","msg":"control-plane http endpoint listening","listen":"127.0.0.1:29850"}
{"level":"info","ts":1785597936.149391,"caller":"wire/edge_server.go:159","msg":"edge hello accepted","edge_id":"smoke-edge-wire","edge_name":"Smoke Edge Wire","version":"0.1.0"}
{"level":"info","ts":1785597936.6193452,"caller":"wire/edge_server.go:195","msg":"edge disconnected","edge_id":"smoke-edge-wire","reason":"remote_closed"}
=== EDGE PROCESS OUTPUT ===
[Fx] PROVIDE	fx.Lifecycle <= go.uber.org/fx.New.func1()
[Fx] PROVIDE	fx.Shutdowner <= go.uber.org/fx.(*App).shutdowner-fm()
[Fx] PROVIDE	fx.DotGraph <= go.uber.org/fx.(*App).dotGraph-fm()
[Fx] PROVIDE	*config.EdgeConfig <= iop/apps/edge/internal/bootstrap.Module.func1()
[Fx] PROVIDE	*bootstrap.Runtime <= iop/apps/edge/internal/bootstrap.NewRuntime()
[Fx] INVOKE		iop/apps/edge/internal/bootstrap.Module.func2()
[Fx] RUN	provide: go.uber.org/fx.New.func1()
[Fx] RUN	provide: iop/apps/edge/internal/bootstrap.Module.func1()
[Fx] RUN	provide: iop/apps/edge/internal/bootstrap.NewRuntime()
[Fx] HOOK OnStart		iop/apps/edge/internal/bootstrap.Module.func2.1() executing (caller: iop/apps/edge/internal/bootstrap.Module.func2)
[Fx] HOOK OnStart		iop/apps/edge/internal/bootstrap.Module.func2.1() called by iop/apps/edge/internal/bootstrap.Module.func2 ran successfully in 2.691917ms
[Fx] RUNNING
[Fx] TERMINATED
[Fx] HOOK OnStop		iop/apps/edge/internal/bootstrap.Module.func2.2() executing (caller: iop/apps/edge/internal/bootstrap.Module.func2)
[Fx] HOOK OnStop		iop/apps/edge/internal/bootstrap.Module.func2.2() called by iop/apps/edge/internal/bootstrap.Module.func2 ran successfully in 1.029875ms
=== EDGE LOG ===
{"level":"info","ts":1785597936.146511,"caller":"transport/server.go:154","msg":"edge listening for nodes","addr":"127.0.0.1:32618"}
{"level":"warn","ts":1785597936.1474721,"logger":"bootstrap","caller":"bootstrap/artifact_server.go:35","msg":"bootstrap artifact directory does not exist","dir":"/config/workspace/.gotmp-iop-secure-delivery/tmp.YubJyUXsOV/artifacts"}
{"level":"info","ts":1785597936.1476572,"logger":"bootstrap","caller":"bootstrap/artifact_server.go:59","msg":"bootstrap artifact server listening","addr":"127.0.0.1:33687","dir":"/config/workspace/.gotmp-iop-secure-delivery/tmp.YubJyUXsOV/artifacts"}
{"level":"info","ts":1785597936.1500192,"logger":"controlplane","caller":"controlplane/connector.go:358","msg":"connected to control plane","wire_addr":"127.0.0.1:31546","protocol":"protobuf-socket"}
===========================
[cp-edge-wire] Control Plane-Edge wire smoke PASSED.
IOP_SECURE_DELIVERY_E2E=1 go test -count=1 -run '^TestSecureDeliveryThreeProcess$' ./apps/control-plane/cmd/control-plane
ok  	iop/apps/control-plane/cmd/control-plane	8.100s
```

Exit status: `0`.

Full-cycle observations: the passing three-process test built and started Control Plane, Edge, and Node binaries; exercised HTTPS management and ingress, CP-Edge and Edge-Node mTLS, Node-sealed lease delivery, exact upstream authorization, in-flight completion after revocation, and rejection of a post-revocation request before a second upstream call. It then stopped all three processes and scanned every process log for the provider-secret sentinel. The test and Make target exited `0`, so no sentinel was present.

`go vet ./apps/control-plane/... ./apps/edge/... ./apps/node/... ./packages/go/...` with the recorded cache/temp environment:

```text
(no stdout/stderr)
```

Exit status: `0`.

`git diff --check`

```text
(no stdout/stderr)
```

Exit status: `0`.

Structural secret guard:

```text
(no stdout/stderr; no forbidden generic secret/provider-auth field structure matched)
```

Exit status: `0`.

---

> **[IMPLEMENTING AGENT — BEFORE SAVING] Have you filled in every implementation-owned section?**
> If anything is blank, go back and fill it in before saving this file.
> Leave review-agent-only sections unchanged.

## Section Ownership

| Section | Owner | Note |
|---------|-------|------|
| Header comment, Overview, Review Agent Instructions | Fixed at stub creation | Implementing agent must not modify or execute these (archive, complete.log, and task-directory archive move are review-agent only) |
| Archive Evidence Snapshot | Fixed at stub creation from plan when present | Implementing agent uses it as default prior-loop context; read only the specific archive files cited there when more detail is required |
| Implementation Item Completion (item names) | Fixed at stub creation | Implementing agent checks `[ ]` → `[x]` only |
| Implementation Checklist (item text/order) | Fixed at stub creation from plan | Implementing agent checks `[ ]` → `[x]` only |
| Review-Only Checklist | Review agent only | Implementing agent must not modify or check this section |
| Deviations from Plan, Key Design Decisions | Implementing agent | Replace placeholder text with actual content |
| Reviewer Checkpoints | Fixed at stub creation | Pre-filled from plan |
| Verification Results (section headings + commands) | Fixed at stub creation | Implementing agent fills in command output only; command changes require a `Deviations from Plan` entry |
| Code Review Result | Review agent appends | Not included in stub |

## Code Review Result

- Overall Verdict: FAIL
- Dimension Assessment:
  - Correctness: Fail — projection fan-out can block indefinitely on one Edge's socket write, preventing later refreshes and server shutdown.
  - Completeness: Fail — the periodic refresh loop has no end-to-end cancellation or bounded per-client fan-out once `SendRequestTyped` enters its pre-timeout write path.
  - Test coverage: Fail — existing all-client and shutdown tests cover immediate accept/reject responses only; they do not hold one projection request or stop reading from one live Edge.
  - API contract: Pass — the implementation preserves the existing protobuf shapes and binds authenticated Edge/Node workload names before enrollment state mutation.
  - Code quality: Pass — the reviewed identity parser, enrollment ordering, immutable projection comparison, and CAS update path have no independent code-quality defect.
  - Plan deviation: Fail — the implementation claims a context-bound refresh loop where one Edge cannot prevent refresh of others, but the production send path is sequential and its timeout does not cover the socket write.
  - Verification trust: Fail — fresh focused, race, full package, process-level, vet, diff, and secret-structure commands pass, but their responsive fixtures do not exercise the blocking production path and therefore do not prove the claimed refresh/shutdown invariant.
  - Spec conformance: Fail — SDD S02 and the S11-S13 secure activation chain require refresh before expiry and fail-closed bounded delivery; an indefinitely blocked broadcast can leave otherwise healthy Edges expired and unable to obtain valid dispatch bindings.
- Findings:
  - Required — `apps/control-plane/internal/wire/edge_server.go:228`, `apps/control-plane/internal/wire/edge_server.go:267`, `apps/control-plane/internal/wire/edge_server.go:288`, `apps/control-plane/internal/wire/edge_server.go:305`, and `apps/control-plane/internal/wire/edge_server.go:322`: `BroadcastProjection` sends to active Edges serially while the refresh loop and `Stop` wait for that call to return. The configured ten-second `SendRequestTyped` timeout is not an end-to-end bound: `/config/workspace/proto-socket/go/communicator.go:345-360` performs `QueuePacket` and waits for the socket write before starting the timer, and that write has no deadline. A live Edge that stops reading a large projection can therefore block every later Edge, hold `broadcastMu`, and deadlock `Stop()` before it reaches `server.Stop()` to close the connection. Fan out projection sends independently, make context cancellation and a per-client deadline close/unblock a stalled client, wait for all send goroutines without leaks, and aggregate every result; add deterministic regressions proving a stalled Edge does not delay a healthy Edge and that cancellation/`Stop` terminates an in-flight refresh promptly.
- Routing Signals: `review_rework_count=4`, `evidence_integrity_failure=true`
- Next Step: Create and execute a freshly routed follow-up PLAN/CODE_REVIEW pair for the bounded cancellable projection fan-out Required finding, preserving the S10-S13 secure-delivery scope.
