One watcher-owned LOCAL_REPAIR establishes counter 1. A temporary provider-download-only failure forces durable DEGRADED_POOL. A real-time controller tick is tested before due. The already running procd retry service owns the failed due retry while blocked and the successful due retry after byte-for-byte provider config restoration. No synthetic future clock is used.