Provider failure is injected only through a temporary PROVIDER_DOWNLOAD_CMD override. One real local repair establishes a nonzero counter. Retry due time is exercised on the real wall clock with a temporary 120-second retry interval; the running procd service owns both due attempts and no synthetic future epoch is written. Reboot persistence, SLOT_EXHAUSTED, Direct emergency and bootstrap recovery are not tested here.