<!-- task=m-node-provider-execution-liveness-recovery/07+06_reception_fence plan=3 tag=REFACTOR milestone-task=failure-handoff -->

# Authoritative Reception Identity Fence

## For the Implementing Agent

Implement only this reception-fence producer after the predecessor PASS, run every verification command, and fill all implementation-owned sections of `CODE_REVIEW-cloud-G08.md` with actual notes and raw output. Keep active files in place and report ready for review; finalization belongs to the code-review skill. If blocked, record exact blocker evidence, attempted commands/output, and resume conditions only. Do not ask the user, call user-input tools, create control-plane stop files, classify the next state, archive logs, or write `complete.log`.

## Background

A typed failure is not authoritative merely because its payload names a node. Edge transport must derive node id and connection generation from the actual receiving client and drop stale/unregistered owners before any correctness callback can consume the event.

## Archive Evidence Snapshot

- Refined parent: `plan_cloud_G09_2.log` and `code_review_cloud_G09_2.log` in this directory; unimplemented, no verdict or implementation evidence.
- Fresh review split the stable reception producer from the queue-locked overlay/probe consumer. This child retains parent REFACTOR-1 only.

## Analysis

### Files Read

- `apps/edge/internal/node/registry.go`, `apps/edge/internal/node/registry_test.go`
- `apps/edge/internal/transport/server.go`, `apps/edge/internal/transport/connection_handlers.go`, `apps/edge/internal/transport/server_test.go`
- `apps/edge/internal/bootstrap/runtime.go`, `apps/edge/internal/bootstrap/runtime_refresh_test.go`
- `apps/edge/internal/service/service.go`, `apps/edge/internal/service/provider_tunnel.go`
- `agent-contract/inner/edge-node-runtime-wire.md`, `agent-spec/runtime/edge-node-execution.md`
- `agent-test/local/edge-smoke.md`, `scripts/e2e-smoke.sh`

### SDD Criteria

- SDD: `agent-roadmap/sdd/operational-observability-provider-management/node-provider-execution-liveness-recovery/SDD.md`; status `[승인됨]`; `milestone-task=failure-handoff`.
- S04/Evidence Map S04 requires connection-generation authority to be out-of-band and stale receivers to be rejected. This child supplies that authority token; `08+07_health_overlay` consumes it for binding/transition/release.

### Verification Context

- `06+05_failure_wire_mapping` must PASS first. Registry generations and compare-by-client primitives already exist; focused two-client reconnect tests, package/race/vet checks, and the provider-only reconnect smoke are local evidence.

### Test Coverage Gaps

- Current listener closures retain `*toki.TcpClient` but correctness callbacks receive only the wire message. No fixture proves a stale client cannot invoke lifecycle/tunnel callbacks after reconnect.

### Symbol References

- Transport callback types change internally. Call sites are bootstrap wiring and transport tests. Existing one-argument service handlers remain compatible until the dependent consumer installs reception-aware handlers.

### Split Judgment

- The stable child output is a registry-derived `(node_id, connection_generation)` callback contract with stale-owner drop. Bootstrap may adapt it to existing handlers so this producer independently compiles; the next child consumes the authoritative values and replaces that compatibility delegation.

### Scope Rationale

Do not inspect provider/adapter/target binding, mutate overlay health, release leases, apply probes, choose candidates, or own retry.

### Final Routing

- `evaluation_mode=isolated-reassessment`; finalizer=`finalize-task-policy.sh pair`.
- Build closure true, scores `(2,2,1,1,2)`, grade G08, route `local-fit` -> `PLAN-local-G08.md`.
- Review closure true, scores `(2,2,1,1,2)`, grade G08, route `official-review` -> `CODE_REVIEW-cloud-G08.md` (`codex`, `gpt-5.6-sol`, `xhigh`).
- `large_indivisible_context=false`; positive loop risks: `temporal_state`, `concurrent_consistency`, `boundary_contract` (3). `review_rework_count=0`, `evidence_integrity_failure=false`.

## Implementation Checklist

- [ ] REFACTOR-1 derives authoritative node/generation from the receiving client for RunEvent and tunnel callbacks and drops stale/unregistered receivers before correctness callbacks.
- [ ] Preserve message-only observability fanout and compatibility-delegate the new bootstrap callback shape until the dependent overlay consumer uses its authority values.
- [ ] Add current/stale/unregistered two-client fixtures and run focused, package, race, vet, provider-only reconnect smoke, and diff verification.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [REFACTOR-1] Carry authoritative reception identity

**Problem:** connection handlers capture the receiving client but invoke lifecycle/tunnel callbacks with only the wire payload, so a stale or spoofed identity can reach correctness handling without proving the current owner.

**Solution:** Add an atomic registry lookup returning a cloned entry only when the supplied client is still current. Resolve it at receipt, pass node/generation to internal callbacks, and drop stale/unregistered clients before correctness callbacks. Keep observability fanout message-only. Adapt bootstrap to the new callback shape without consuming identity-dependent queue semantics yet.

**Modified Files and Checklist:**

- [ ] `apps/edge/internal/node/registry.go`: add lock-safe current-owner-by-client lookup.
- [ ] `apps/edge/internal/node/registry_test.go`: prove current success and stale/unregistered rejection across reconnect.
- [ ] `apps/edge/internal/transport/server.go`: type reception-aware lifecycle/tunnel callbacks.
- [ ] `apps/edge/internal/transport/connection_handlers.go`: resolve current owner and fail closed before correctness callbacks.
- [ ] `apps/edge/internal/transport/server_test.go`: assert authoritative node/generation, stale drop, and observability separation.
- [ ] `apps/edge/internal/bootstrap/runtime.go`: adapt service wiring to the reception-aware callback contract while retaining legacy behavior until the consumer child.

**Test Strategy:** Use two clients for one node across reconnect. Only the current client may reach callbacks, payload metadata cannot substitute authority, and observability remains independently message-only.

**Verification:** focused registry/transport/bootstrap tests must execute the new current/stale cases.

## Dependencies and Execution Order

1. `06+05_failure_wire_mapping` must produce `agent-task/m-node-provider-execution-liveness-recovery/06+05_failure_wire_mapping/complete.log`.
2. This child must PASS before `08+07_health_overlay` starts.

## Modified Files Summary

| File | Item |
|------|------|
| `apps/edge/internal/node/registry.go` | REFACTOR-1 |
| `apps/edge/internal/node/registry_test.go` | REFACTOR-1 |
| `apps/edge/internal/transport/server.go` | REFACTOR-1 |
| `apps/edge/internal/transport/connection_handlers.go` | REFACTOR-1 |
| `apps/edge/internal/transport/server_test.go` | REFACTOR-1 |
| `apps/edge/internal/bootstrap/runtime.go` | REFACTOR-1 |
| `agent-task/m-node-provider-execution-liveness-recovery/07+06_reception_fence/CODE_REVIEW-cloud-G08.md` | REFACTOR-1 |

## Final Verification

Fresh Go output is required.

1. `go test -count=1 ./apps/edge/internal/node ./apps/edge/internal/transport ./apps/edge/internal/bootstrap -run 'CurrentOwner|Reception|Lifecycle|Tunnel'` — PASS and new named fixtures execute.
2. `go test -count=1 ./apps/edge/internal/node ./apps/edge/internal/transport ./apps/edge/internal/bootstrap` — PASS.
3. `go test -race -count=3 ./apps/edge/internal/node ./apps/edge/internal/transport ./apps/edge/internal/bootstrap` — PASS with no race report.
4. `go vet ./apps/edge/internal/node ./apps/edge/internal/transport ./apps/edge/internal/bootstrap` — no diagnostics.
5. `./scripts/e2e-smoke.sh` — PASS for provider-only dispatch/tunnel/reconnect fencing.
6. `git diff --check` — no whitespace errors.

After completing all code changes, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.
