<!-- task=m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution plan=6 tag=REVIEW_REFACTOR milestone-task=inventory,decouple,retain-node -->

# Plan - Close Provider Command and D04 Evidence Gaps

## For the Implementing Agent

Implement every checklist item, run the commands exactly as written, and fill all implementation-owned sections in `CODE_REVIEW-cloud-G08.md` with actual notes and stdout/stderr. Keep the active PLAN/CODE_REVIEW files in place and report ready for review. Finalization is review-agent-only. If blocked, record the exact blocker, attempted commands/output, and resume condition only in implementation-owned evidence fields; do not ask the user, call user-input tools, create stop files, classify the next state, archive logs, or write `complete.log`.

## Background

The D04 implementation removed the Agent/CLI boundary and its broad regression suite passes, but review found five contract and evidence defects that prevent closure. Client and Edge provider commands do not consistently enforce the approved selector/allowlist/lifecycle contract, the D04 addendum does not classify affected active surfaces outside the immutable manifest, and the structured audit claims PASS while its own parser rejects five command blocks. This follow-up closes only those defects and produces one trustworthy S01/S03/S04 oracle.

## Archive Evidence Snapshot

- The closing pair is `agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/plan_cloud_G10_5.log` and `agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/code_review_cloud_G10_5.log`; its verdict is FAIL with five Required findings, zero Suggested findings, and zero Nit findings.
- Provider-command defects affect `apps/client/lib/widgets/runtime_panel.dart`, `apps/client/test/runtime_panel_test.dart`, `apps/client/test/support/client_test_harness.dart`, `apps/edge/internal/service/control_command.go`, and `apps/edge/internal/service/run_command_test.go`.
- Evidence defects affect the D04 addendum and digest, `scripts/verify-iop-agent-chronos-boundary.py`, its unit test, and `node-boundary-audit.log`. The closing PLAN's exact `Modified Files Summary` is the frozen source used to derive the independent original-manifest-external active-surface oracle; do not search sibling archives.
- Fresh reviewer evidence passed the focused Go packages, all 42 client tests, `go test -count=1 ./...`, targeted race tests, Control Plane-Edge wire smoke, and local E2E. The approved-SHA verifier passed without the audit and failed with the audit as `nonzero command exits: 03,06,17,22,29`.
- Roadmap scope and approved SDD S01/S03/S04 remain unchanged. Recovery signals are `review_rework_count=2` and `evidence_integrity_failure=true`.

## Analysis

### Files Read

- `agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/PLAN-cloud-G10.md`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/CODE_REVIEW-cloud-G10.md`
- `agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/node-boundary-audit.log`
- `apps/client/lib/widgets/runtime_panel.dart`
- `apps/client/test/runtime_panel_test.dart`
- `apps/client/test/support/client_test_harness.dart`
- `apps/edge/internal/service/control_command.go`
- `apps/edge/internal/service/run_command_test.go`
- `apps/edge/internal/service/run_dispatch_internal_test.go`
- `apps/edge/internal/node/registry.go`
- `scripts/verify-iop-agent-chronos-boundary.py`
- `scripts/verify_iop_agent_chronos_boundary_test.py`
- `scripts/fixtures/iop-agent-chronos-boundary-surface-addendum-v1.tsv`
- `scripts/fixtures/iop-agent-chronos-boundary-surface-addendum-v1.sha256`
- `agent-contract/inner/client-control-plane-wire.md`
- `agent-contract/inner/control-plane-edge-wire.md`
- `agent-spec/control/control-plane-operations.md`
- `agent-spec/runtime/edge-node-execution.md`
- `agent-roadmap/phase/automation-runtime-bridge/milestones/iop-agent-chronos-extraction-decoupling.md`
- `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-chronos-extraction-decoupling/SDD.md`

### SDD Criteria

- SDD: `agent-roadmap/sdd/automation-runtime-bridge/iop-agent-chronos-extraction-decoupling/SDD.md`, status `[approved]`, milestone tasks `inventory,decouple,retain-node`.
- Target scenarios: S01 requires the immutable manifest, exact 137-row delta, and D04 surface addendum to form an effective matrix with every related active asset classified; S03 requires removed-path/reference and clean-build evidence; S04 requires the provider-only Node build, contract/focused regression, and forbidden bridge/API/proto/config/CLI/terminal/workspace evidence.
- Evidence Map rows S01, S03, and S04 at lines 94, 96, and 97 drive checklist items REVIEW_REFACTOR-1 through REVIEW_REFACTOR-4. The final audit must combine the complete matrix, provider-command contract tests, removal scans, clean build, and standard inference evidence before any S03/S04 PASS marker is accepted.

### Verification Context

- No external handoff was supplied. Repository-native evidence came from the active PLAN/CODE_REVIEW, approved SDD/contracts/specs, current source/tests, the structured audit, and fresh reviewer commands.
- Preconditions: repository root `/config/workspace/iop-s1`; Go `go1.26.2 linux/arm64`; `go env GOMOD=/config/workspace/iop-s1/go.mod`; Bash, Python 3, `sha256sum`, `rg`, `protoc`, and Flutter are present. The checkout contains user-owned unrelated changes and must not be reset or normalized.
- Fresh successful criteria: focused Edge/Node/config tests, `make client-test` (42 tests), `go test -count=1 ./...`, targeted race tests, `make test-control-plane-edge-wire`, and `make test-e2e`.
- Fresh failing criterion: the boundary verifier using manifest SHA `d8598134dee99d96fc05a045091dd3d8932d4708d2c980c2a78c8b11825d2ccf` and the current audit exits 1 because command blocks 03, 06, 17, 22, and 29 are nonzero. The same verifier without `--audit-log` passes with `manifest_rows=300 delta_rows=137 addendum_rows=2 state_records=12`, proving that its present addendum check is too weak.
- No required verification leaves the checkout. Local E2E scripts own their processes and temporary workspaces. Confidence is high because every Required finding has direct source/contract evidence or a deterministic failing command.

### Test Coverage Gaps

- Client: existing widget tests reject only empty inputs; they do not constrain the provider allowlist or verify command-specific parameters.
- Edge: capabilities has success/error terminal-event assertions, but missing selectors, unsupported commands before `started`, and `transport_status`/`ollama_api` terminal outcomes are untested.
- Inventory: verifier tests cover delta gaps but not an omitted required D04 active surface, addendum row semantics, or addendum worktree successors.
- Audit: parser tests reject nonzero blocks, but no tested recorder guarantees that PASS metadata is emitted only after the fixed command set exits zero.

### Symbol References

No existing public symbol is renamed or removed. New provider-command constants/helpers remain local to `runtime_panel.dart`, `control_command.go`, and the boundary verifier; update all call sites within those files and their tests.

### Split Judgment

Keep one plan. Client/Edge command correctness and S01/S03/S04 evidence are independently testable, but this existing D04 follow-up closes only when one final structured audit proves the effective matrix and provider-only contract together. Explicit allowlists, a literal surface oracle, and deterministic commands make `large_indivisible_context=false`; splitting would duplicate the closing audit and allow a partially trusted milestone result.

### Scope Rationale

Do not add provider commands, change protobuf fields, alter Node command wire types, modify contracts/specs/roadmap, restore CLI/session/workspace behavior, change shared readability baselines, or repair unrelated worktree violations. Do not edit `agent-ops/rules/common/**` or `agent-ops/skills/common/**`. Existing registry single-node fallback remains valid for non-operation callers; enforce explicit selection at the `provider.command` boundary only.

### Final Routing

- `evaluation_mode=isolated-reassessment`; `finalizer=finalize-task-policy.sh`; `finalizer_mode=pair`; all build/review closure fields are true and no capability gap exists.
- Build scores: scope=2, state=1, blast=1, evidence=2, verification=2; grade G08; base `local-fit`; final `recovery-boundary`; cloud; `PLAN-cloud-G08.md`.
- Review scores: scope=2, state=1, blast=1, evidence=2, verification=2; grade G08; `official-review`; cloud; `CODE_REVIEW-cloud-G08.md`; Codex `gpt-5.6-sol` xhigh.
- `large_indivisible_context=false`; matched loop risks: `temporal_state`, `boundary_contract`, `structured_interpretation`, `variant_product`; count=4; risk boundary matched.
- Recovery: `review_rework_count=2`, `evidence_integrity_failure=true`; recovery boundary matched. Evidence trust is restored only by the new all-zero structured audit and its verifier.

## Implementation Checklist

- [ ] Restrict the Flutter provider-command UI and dispatch helper to the three provider commands, including operational `ollama_api` method/path parameters, and add exact widget/fake-repository regressions.
- [ ] Require an explicit provider target selector, validate the allowlist before `started`, and emit exactly one terminal event for every started provider command; add all-command success/error regressions.
- [ ] Populate and digest the complete original-manifest-external D04 active-surface addendum, enforce it with an independent literal oracle, and add omission/row/worktree negative tests.
- [ ] Add a fail-closed structured audit recorder, replace the invalid SHA/tombstone/readability commands with the approved scoped command set, and regenerate `node-boundary-audit.log` with every command at exit 0.
- [ ] Run all focused, client, race, wire, full-suite, E2E, matrix, forbidden-reference, audit, and diff verification with fresh output.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [REVIEW_REFACTOR-1] Enforce the Client provider-command allowlist

**Problem:** `apps/client/lib/widgets/runtime_panel.dart:71-137` uses a free-form command `TextField` and accepts every non-empty value. `apps/client/test/runtime_panel_test.dart:297-325` checks only empty-field gating, so the UI contradicts `agent-contract/inner/client-control-plane-wire.md:22` and cannot form a usable `ollama_api` request.

**Solution:** Replace the free-form command controller with a local immutable allowlist and a `DropdownButtonFormField<String>`. Use dialog-local state to show method/path fields only for `ollama_api`; require a non-empty path and default the method to `GET`. Change `_sendProviderCommand` to accept a parameter map, revalidate `parameters['command']` against the same allowlist, and reject incomplete Ollama parameters before `_executeCommand`.

Before (`apps/client/lib/widgets/runtime_panel.dart:96`):

```dart
TextField(
  controller: commandController,
  decoration: const InputDecoration(
    labelText: 'Command Name (parameters.command)',
  ),
)
```

After:

```dart
static const _providerCommands = <String>[
  'capabilities',
  'transport_status',
  'ollama_api',
];

DropdownButtonFormField<String>(
  value: selectedCommand,
  items: _providerCommands
      .map((command) => DropdownMenuItem(value: command, child: Text(command)))
      .toList(),
  onChanged: (command) => setDialogState(() => selectedCommand = command!),
)
```

**Modified Files and Checklist:**

- [ ] `apps/client/lib/widgets/runtime_panel.dart` — add the allowlisted dialog and command-specific validation/parameters.
- [ ] `apps/client/test/runtime_panel_test.dart` — cover selector gating and exact parameters for all offered commands.
- [ ] `apps/client/test/support/client_test_harness.dart` — reject non-allowlisted provider commands and incomplete Ollama requests in the fake boundary.

**Test Strategy:** Write widget regressions named `Client App sends only allowlisted provider commands` and `Client App requires Ollama API path`. Assert the dialog has no arbitrary command input, each selection produces the exact `command` map, `ollama_api` includes normalized `method`/`path`, and invalid/incomplete input never calls the repository.

**Verification:**

```bash
dart format --output=none --set-exit-if-changed apps/client/lib/widgets/runtime_panel.dart apps/client/test/runtime_panel_test.dart apps/client/test/support/client_test_harness.dart
(cd apps/client && flutter test test/runtime_panel_test.dart)
```

Expected: formatting is clean and the focused widget suite passes.

### [REVIEW_REFACTOR-2] Close provider-command validation and event lifecycle

**Problem:** `apps/edge/internal/service/control_command.go:98-111` omits an explicit selector check, so `ResolveReady("")` may select the only ready Node. It emits `started` before allowlist validation, and lines 166-184 return from `transport_status`, `ollama_api`, and unsupported commands without consistently emitting a terminal event.

**Solution:** Define one private allowlist for `capabilities`, `transport_status`, and `ollama_api`. Reject blank selectors and missing/unsupported commands before resolving a Node or emitting `started`. After `started`, route every result through one helper that maps a response/error to exactly one `completed` or `failed` `EdgeCommandEvent`; use it for all three command branches and every post-start failure.

Before (`apps/edge/internal/service/control_command.go:98`):

```go
cmdName := req.GetParameters()["command"]
if cmdName == "" {
    return unsupportedEdgeCommand(req, "missing command parameter for provider.command"), nil
}
onEvent(&iop.EdgeCommandEvent{Phase: "started"})
entry, err := s.ResolveDispatchReady(req.TargetSelector)
```

After:

```go
if strings.TrimSpace(req.GetTargetSelector()) == "" {
    return nil, fmt.Errorf("target_selector is required for provider.command")
}
cmdName := req.GetParameters()["command"]
if _, ok := providerCommandAllowlist[cmdName]; !ok {
    return unsupportedEdgeCommand(req, fmt.Sprintf("unsupported provider.command command %q", cmdName)), nil
}
onEvent(providerCommandEvent(req, "started", fmt.Sprintf("Routing command %s", cmdName)))
```

**Modified Files and Checklist:**

- [ ] `apps/edge/internal/service/control_command.go` — enforce selector/allowlist preconditions and one terminal event per started command.
- [ ] `apps/edge/internal/service/run_command_test.go` — add selector, unsupported/no-start, and all-command terminal-sequence tests.

**Test Strategy:** Add table-driven tests `TestServiceExecuteProviderCommandRequiresExplicitSelector`, `TestServiceExecuteProviderCommandRejectsUnsupportedBeforeStart`, and `TestServiceExecuteProviderCommandTerminalEvents`. Cover single-ready-node fallback prevention, all three allowlisted commands, success/error, exactly `[started, completed|failed]`, and zero Node wire requests for precondition failures.

**Verification:**

```bash
gofmt -d apps/edge/internal/service/control_command.go apps/edge/internal/service/run_command_test.go
go test -count=1 ./apps/edge/internal/service
go test -race -count=1 ./apps/edge/internal/service
```

Expected: no formatting diff; fresh focused and race tests pass.

### [REVIEW_REFACTOR-3] Make the D04 effective matrix complete and fail-closed

**Problem:** `scripts/fixtures/iop-agent-chronos-boundary-surface-addendum-v1.tsv:2-3` contains only supplemental state rows. `scripts/verify-iop-agent-chronos-boundary.py:94-119` checks only disjointness and delta semantics, and `verify_worktree` ignores addendum file rows, so SDD S01 cannot prove that original-manifest-external active D04 surfaces are classified.

**Solution:** Derive a reviewed, sorted literal `D04_REQUIRED_ACTIVE_SURFACES` set from the closing `plan_cloud_G10_5.log` Modified Files Summary by selecting current non-task file paths absent from the original manifest/delta. Populate the addendum with exactly those file rows plus the two state rows, using explicit kind/disposition/action/successor/evidence values, and refresh its sidecar. Validate exact set equality, every addendum row field, and each rewrite successor. Add optional `--surface-plan` cross-checking for this closure so the frozen literal oracle must match the archived D04 affected-path source, while ordinary future verification remains independent of task archives.

Before (`scripts/verify-iop-agent-chronos-boundary.py:102`):

```python
require(not ({row["path"] for row in addendum} & set(manifest_by_path)),
        f"{addendum_path}: overlaps original manifest")
require(not ({row["path"] for row in addendum} & delta_paths),
        f"{addendum_path}: overlaps delta")
```

After:

```python
addendum_files = {row["path"] for row in addendum if row["kind"] == "file"}
require(addendum_files == D04_REQUIRED_ACTIVE_SURFACES,
        f"{addendum_path}: active-surface coverage mismatch")
for row in addendum:
    verify_addendum_row(row)
```

**Modified Files and Checklist:**

- [ ] `scripts/fixtures/iop-agent-chronos-boundary-surface-addendum-v1.tsv` — classify every required active surface plus the two states in sorted canonical form.
- [ ] `scripts/fixtures/iop-agent-chronos-boundary-surface-addendum-v1.sha256` — record the exact refreshed digest.
- [ ] `scripts/verify-iop-agent-chronos-boundary.py` — enforce the literal oracle, optional closing-plan cross-check, row semantics, and addendum worktree state.
- [ ] `scripts/verify_iop_agent_chronos_boundary_test.py` — add omitted-surface, invalid-row, missing-successor, and surface-plan mismatch tests.

**Test Strategy:** Extend the verifier unit suite with `test_required_addendum_surface_gap_is_rejected`, `test_invalid_addendum_row_is_rejected`, `test_missing_addendum_successor_is_rejected`, and `test_surface_plan_oracle_mismatch_is_rejected`. Keep the real fixture positive test and exact two-state linkage.

**Verification:**

```bash
python3 scripts/verify_iop_agent_chronos_boundary_test.py
sha256sum -c scripts/fixtures/iop-agent-chronos-boundary-disposition-delta-v1.sha256 scripts/fixtures/iop-agent-chronos-boundary-surface-addendum-v1.sha256
python3 scripts/verify-iop-agent-chronos-boundary.py --manifest scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv --expected-manifest-sha256 d8598134dee99d96fc05a045091dd3d8932d4708d2c980c2a78c8b11825d2ccf --delta scripts/fixtures/iop-agent-chronos-boundary-disposition-delta-v1.tsv --delta-sha256 scripts/fixtures/iop-agent-chronos-boundary-disposition-delta-v1.sha256 --addendum scripts/fixtures/iop-agent-chronos-boundary-surface-addendum-v1.tsv --addendum-sha256 scripts/fixtures/iop-agent-chronos-boundary-surface-addendum-v1.sha256 --state-fixture scripts/fixtures/iop-agent-chronos-transfer-state-v1.json --expected-state-logical-id-sha256 9bce499e286514baeb7ad9bc7c59119a3b5725f69763706dfeba06569d7404b9 --surface-plan agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/plan_cloud_G10_5.log --iop-root . --check-only
```

Expected: all verifier tests and sidecars pass; the verifier reports exact addendum coverage and 12 state records.

### [REVIEW_REFACTOR-4] Regenerate trustworthy S01/S03/S04 audit evidence

**Problem:** `node-boundary-audit.log:1-13` claims PASS while blocks 03, 06, 17, 22, and 29 exit nonzero. The old manifest SHA is wrong, the forbidden scan treats required protobuf tombstones as live symbols, and unrelated repository-wide readability drift is not an S03/S04 oracle.

**Solution:** Add a recorder mode to the existing boundary verifier with one immutable ordered command list. The recorder must capture exact command text, exit code, and stdout/stderr, write FAIL markers and return nonzero if any command fails, and write `clean_build=PASS`, `standard_inference=PASS`, `s03=PASS`, and `s04=PASS` only after all commands exit zero. Use the approved manifest SHA, separate live-symbol absence from required tombstone presence, exclude unrelated readability baseline work, and atomically replace `node-boundary-audit.log`. Unit-test recorder success/failure with an injected runner before running the real matrix.

The recorded matrix must contain these deterministic checks: repository/tool preflight; exact predecessor PASS identity; manifest/delta/addendum digests; verifier unit tests; focused Edge provider tests; client tests; clean local build; Control Plane-Edge wire smoke; local E2E standard inference; fresh full Go suite; targeted Edge race tests; removed path/dependency checks; tombstone-aware live-symbol and generated-accessor checks; Chronos-reference absence; and `git diff --check`.

**Modified Files and Checklist:**

- [ ] `scripts/verify-iop-agent-chronos-boundary.py` — implement and verify the fail-closed recorder mode and fixed command inventory.
- [ ] `scripts/verify_iop_agent_chronos_boundary_test.py` — prove recorder PASS/FAIL marker and exit-code behavior.
- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/node-boundary-audit.log` — regenerate exact all-zero output with approved digests.
- [ ] `agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/CODE_REVIEW-cloud-G08.md` — record actual implementation and verification evidence.

**Test Strategy:** Add `test_audit_recorder_marks_pass_only_after_all_zero` and `test_audit_recorder_preserves_failure_and_returns_nonzero`. The real audit is an integration artifact and must be accepted by the same parser after recording.

**Verification:**

```bash
python3 scripts/verify-iop-agent-chronos-boundary.py --manifest scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv --expected-manifest-sha256 d8598134dee99d96fc05a045091dd3d8932d4708d2c980c2a78c8b11825d2ccf --delta scripts/fixtures/iop-agent-chronos-boundary-disposition-delta-v1.tsv --delta-sha256 scripts/fixtures/iop-agent-chronos-boundary-disposition-delta-v1.sha256 --addendum scripts/fixtures/iop-agent-chronos-boundary-surface-addendum-v1.tsv --addendum-sha256 scripts/fixtures/iop-agent-chronos-boundary-surface-addendum-v1.sha256 --state-fixture scripts/fixtures/iop-agent-chronos-transfer-state-v1.json --expected-state-logical-id-sha256 9bce499e286514baeb7ad9bc7c59119a3b5725f69763706dfeba06569d7404b9 --surface-plan agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/plan_cloud_G10_5.log --iop-root . --record-audit agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/node-boundary-audit.log
python3 scripts/verify-iop-agent-chronos-boundary.py --manifest scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv --expected-manifest-sha256 d8598134dee99d96fc05a045091dd3d8932d4708d2c980c2a78c8b11825d2ccf --delta scripts/fixtures/iop-agent-chronos-boundary-disposition-delta-v1.tsv --delta-sha256 scripts/fixtures/iop-agent-chronos-boundary-disposition-delta-v1.sha256 --addendum scripts/fixtures/iop-agent-chronos-boundary-surface-addendum-v1.tsv --addendum-sha256 scripts/fixtures/iop-agent-chronos-boundary-surface-addendum-v1.sha256 --state-fixture scripts/fixtures/iop-agent-chronos-transfer-state-v1.json --expected-state-logical-id-sha256 9bce499e286514baeb7ad9bc7c59119a3b5725f69763706dfeba06569d7404b9 --surface-plan agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/plan_cloud_G10_5.log --iop-root . --audit-log agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/node-boundary-audit.log --check-only
```

Expected: recorder exits 0, every recorded command has `exit_code=0`, and the verifier reports `boundary_verification=PASS`.

## Modified Files Summary

| File | Item |
|------|------|
| `apps/client/lib/widgets/runtime_panel.dart` | REVIEW_REFACTOR-1 |
| `apps/client/test/runtime_panel_test.dart` | REVIEW_REFACTOR-1 |
| `apps/client/test/support/client_test_harness.dart` | REVIEW_REFACTOR-1 |
| `apps/edge/internal/service/control_command.go` | REVIEW_REFACTOR-2 |
| `apps/edge/internal/service/run_command_test.go` | REVIEW_REFACTOR-2 |
| `scripts/fixtures/iop-agent-chronos-boundary-surface-addendum-v1.tsv` | REVIEW_REFACTOR-3 |
| `scripts/fixtures/iop-agent-chronos-boundary-surface-addendum-v1.sha256` | REVIEW_REFACTOR-3 |
| `scripts/verify-iop-agent-chronos-boundary.py` | REVIEW_REFACTOR-3, REVIEW_REFACTOR-4 |
| `scripts/verify_iop_agent_chronos_boundary_test.py` | REVIEW_REFACTOR-3, REVIEW_REFACTOR-4 |
| `agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/node-boundary-audit.log` | REVIEW_REFACTOR-4 |
| `agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/CODE_REVIEW-cloud-G08.md` | REVIEW_REFACTOR-4 |

## Final Verification

Run from `/config/workspace/iop-s1`. Go results must be fresh (`-count=1`); cached output is not acceptable.

```bash
dart format --output=none --set-exit-if-changed apps/client/lib/widgets/runtime_panel.dart apps/client/test/runtime_panel_test.dart apps/client/test/support/client_test_harness.dart
gofmt -d apps/edge/internal/service/control_command.go apps/edge/internal/service/run_command_test.go
(cd apps/client && flutter test test/runtime_panel_test.dart)
go test -count=1 ./apps/edge/internal/service
go test -race -count=1 ./apps/edge/internal/service
python3 scripts/verify_iop_agent_chronos_boundary_test.py
sha256sum -c scripts/fixtures/iop-agent-chronos-boundary-disposition-delta-v1.sha256 scripts/fixtures/iop-agent-chronos-boundary-surface-addendum-v1.sha256
python3 scripts/verify-iop-agent-chronos-boundary.py --manifest scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv --expected-manifest-sha256 d8598134dee99d96fc05a045091dd3d8932d4708d2c980c2a78c8b11825d2ccf --delta scripts/fixtures/iop-agent-chronos-boundary-disposition-delta-v1.tsv --delta-sha256 scripts/fixtures/iop-agent-chronos-boundary-disposition-delta-v1.sha256 --addendum scripts/fixtures/iop-agent-chronos-boundary-surface-addendum-v1.tsv --addendum-sha256 scripts/fixtures/iop-agent-chronos-boundary-surface-addendum-v1.sha256 --state-fixture scripts/fixtures/iop-agent-chronos-transfer-state-v1.json --expected-state-logical-id-sha256 9bce499e286514baeb7ad9bc7c59119a3b5725f69763706dfeba06569d7404b9 --surface-plan agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/plan_cloud_G10_5.log --iop-root . --check-only
make client-test
make test-control-plane-edge-wire
go test -count=1 ./...
make test-e2e
python3 scripts/verify-iop-agent-chronos-boundary.py --manifest scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv --expected-manifest-sha256 d8598134dee99d96fc05a045091dd3d8932d4708d2c980c2a78c8b11825d2ccf --delta scripts/fixtures/iop-agent-chronos-boundary-disposition-delta-v1.tsv --delta-sha256 scripts/fixtures/iop-agent-chronos-boundary-disposition-delta-v1.sha256 --addendum scripts/fixtures/iop-agent-chronos-boundary-surface-addendum-v1.tsv --addendum-sha256 scripts/fixtures/iop-agent-chronos-boundary-surface-addendum-v1.sha256 --state-fixture scripts/fixtures/iop-agent-chronos-transfer-state-v1.json --expected-state-logical-id-sha256 9bce499e286514baeb7ad9bc7c59119a3b5725f69763706dfeba06569d7404b9 --surface-plan agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/plan_cloud_G10_5.log --iop-root . --record-audit agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/node-boundary-audit.log
python3 scripts/verify-iop-agent-chronos-boundary.py --manifest scripts/fixtures/iop-agent-chronos-ownership-manifest.tsv --expected-manifest-sha256 d8598134dee99d96fc05a045091dd3d8932d4708d2c980c2a78c8b11825d2ccf --delta scripts/fixtures/iop-agent-chronos-boundary-disposition-delta-v1.tsv --delta-sha256 scripts/fixtures/iop-agent-chronos-boundary-disposition-delta-v1.sha256 --addendum scripts/fixtures/iop-agent-chronos-boundary-surface-addendum-v1.tsv --addendum-sha256 scripts/fixtures/iop-agent-chronos-boundary-surface-addendum-v1.sha256 --state-fixture scripts/fixtures/iop-agent-chronos-transfer-state-v1.json --expected-state-logical-id-sha256 9bce499e286514baeb7ad9bc7c59119a3b5725f69763706dfeba06569d7404b9 --surface-plan agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/plan_cloud_G10_5.log --iop-root . --audit-log agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/node-boundary-audit.log --check-only
bash -c 'rg --sort path -n "$1" "$2" "$3" "$4"; status=$?; test "$status" -eq 1' _ '7026fedc8b0eb24eab5c4124d3818400f66db5f1d116a71e7781f346fbd256a7' agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/PLAN-cloud-G08.md agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/CODE_REVIEW-cloud-G08.md agent-task/m-iop-agent-chronos-extraction-decoupling/10+09_neutral_execution/node-boundary-audit.log
git diff --check
```

Expected: every command exits 0; no arbitrary provider command can leave the Client; an explicit selector and exactly one terminal outcome gate every started Edge provider command; the addendum exactly matches the independent active-surface oracle; the audit contains only zero exits and is accepted with S01/S03/S04 closure evidence; full regression and E2E remain green.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
