<!-- task=m-node-provider-execution-liveness-recovery/02+01_stall_watchdog plan=8 tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API milestone-task=activity-contract,stall-watchdog -->

# Complete - m-node-provider-execution-liveness-recovery/02+01_stall_watchdog

## Completion Date

2026-08-04

## Summary

Completed the Node run/tunnel stall-watchdog slice after nine plan generations, six failed reviews, and a final PASS.

## Loop History

| Plan | Review | Verdict | Notes |
|------|--------|---------|-------|
| `plan_cloud_G08_0.log` | `code_review_cloud_G08_0.log` | N/A | Initial pair was superseded before an official verdict. |
| `plan_cloud_G08_1.log` | `code_review_cloud_G08_1.log` | N/A | Revised pair was superseded before an official verdict. |
| `plan_cloud_G08_2.log` | `code_review_cloud_G08_2.log` | FAIL | Fixed admission leaks, tunnel emission serialization, deterministic lifecycle coverage, and readability regressions. |
| `plan_cloud_G09_3.log` | `code_review_cloud_G09_3.log` | FAIL | Added generation-safe expiry handling and closed confirmed tunnel ownership before terminal publication. |
| `plan_cloud_G08_4.log` | `code_review_cloud_G08_4.log` | FAIL | Closed the receive-before-capture race and made reconnect verification cold-build tolerant. |
| `plan_cloud_G08_5.log` | `code_review_cloud_G08_5.log` | FAIL | Made current-arm identity safe across immediate creation and reset-time fires. |
| `plan_cloud_G08_6.log` | `code_review_cloud_G08_6.log` | FAIL | Identified two tests that still synthesized pre-deadline expiry timestamps. |
| `plan_cloud_G04_7.log` | `code_review_cloud_G04_7.log` | FAIL | Reconfirmed that the two scheduled-current-arm fixture fixes and final evidence were still absent. |
| `plan_cloud_G02_8.log` | `code_review_cloud_G02_8.log` | PASS | Fired and consumed the scheduled current timer arms and restored complete S01/S02 evidence. |

## Implementation and Cleanup

- Added the shared Node normalized-run and raw-tunnel response-stall watchdog with monotonic timer generations, exactly-once terminal fencing, bounded ownership close, and late-output suppression.
- Preserved provider-originated activity resets and existing hard-deadline, cancellation, and transport-disconnect precedence.
- Serialized accepted tunnel frames before stall terminal publication and retained admission, run-manager, adapter, and credential ownership until safe release.
- Corrected the two final manual-clock fixtures to fire and consume their scheduled current arms while preserving duplicate-fence rejection and body-before-terminal ordering.

## Final Verification

- `go test -count=20 ./apps/node/internal/node -run 'Test(AttemptObserverProgressResetsAndFenceIsMonotonic|AttemptObserverCurrentArmSignalSurvivesImmediateFire|RunWatchdogOldArmFireDuringResetYieldsToProgress|TunnelWatchdogOldArmFireDuringResetYieldsToProgress|RunWatchdogStaleExpiryYieldsToProgress|TunnelWatchdogStaleExpiryYieldsToProgress|RunWatchdogStaleExpiryBeforeCaptureYieldsToProgress|TunnelWatchdogStaleExpiryBeforeCaptureYieldsToProgress|TunnelConfirmedFenceClosesOwnershipBeforeTerminal|RunWatchdogLifecycle|TunnelWatchdogLifecycle|TunnelSinkStallClaimSerializesAcceptedFrame|TunnelCredentialFailureReleasesAdmission)$'` - PASS; all 20 iterations completed successfully.
- `go test -count=1 ./packages/go/execution ./apps/node/...` - PASS; all Node and shared execution packages completed successfully.
- `go test -race -count=3 ./packages/go/execution ./apps/node/internal/node ./apps/node/internal/transport` - PASS; all three packages completed without race reports.
- `go test -count=1 ./...` - PASS; the complete Go repository suite completed successfully.
- `./scripts/e2e-smoke.sh` - PASS; provider-only Node and Edge dispatch/tunnel/queue/reconnect smoke completed successfully.
- `IOP_NODE_BIN=<executable-/config/tmp-path> IOP_DEV_RECONNECT_BIND_TIMEOUT=60 ./scripts/dev/edge-node-reconnect-diagnostic.sh` - PASS; registration, three ordered message cycles, command responses, reconnect, payload parity, and terminal ordering passed. The planned `/tmp` binary location was not executable on this host because `/tmp` is mounted `noexec`; the Node log confirmed `Permission denied`, and the same binary source passed from executable `/config/tmp`.
- `go vet ./packages/go/execution ./apps/node/internal/node ./apps/node/internal/transport` - PASS.
- `test -z "$(gofmt -l apps/node/internal/node/liveness_watchdog.go apps/node/internal/node/liveness_watchdog_test.go)"` - PASS.
- `git diff --check` - PASS.
- Touched readability comparison - PASS; no touched function or `node-core-readability` regression.

## Remaining Nits

- None.

## Follow-up Work

- None.
