<!-- task=m-iop-hot-path-one-shot-execution/16+14,15_terminal_disposition plan=5 tag=REVIEW_REVIEW_REVIEW_API milestone-task=error-cancel -->

# Complete - m-iop-hot-path-one-shot-execution/16+14,15_terminal_disposition

## Completion Time

2026-08-04

## Summary

The downstream Hot Path dispatch now rejects every missing, opposite, dual, or unsupported result shape before buffered or progressive execution, disposes the immutable result ownership exactly once, and closes after four reviewed verdict loops with a final PASS.

## Loop History

| Plan | Review | Verdict | Notes |
|------|--------|---------|-------|
| `plan_cloud_G09_2.log` | `code_review_cloud_G10_2.log` | FAIL | Post-dispatch rejection did not send the required exact `CANCEL_RUN`. |
| `plan_local_G06_3.log` | `code_review_cloud_G06_3.log` | FAIL | Unsupported branches and repeated observations did not share one exact-once disposal owner. |
| `plan_cloud_G07_4.log` | `code_review_cloud_G07_4.log` | FAIL | Missing and opposite handles could bypass disposal, and full-Edge evidence was not trustworthy on the host's `noexec` `/tmp`. |
| `plan_cloud_G07_5.log` | `code_review_cloud_G07_5.log` | PASS | The pre-execution result-shape gate, exhaustive deterministic matrix, and fresh executable-`TMPDIR` verification passed. |

## Implementation and Cleanup

- Added a single downstream result-shape gate that accepts only normalized-plus-run or tunnel-plus-tunnel ownership before execution dispatch.
- Routed every invalid provider-pool result through the existing result-scoped exact-once cancellation and handle-close owner with typed `validation_error` disposition.
- Extended the real-entry-point matrix across buffered/progressive, normalized/tunnel, no-handle/opposite-handle, validation, unsupported, dual-handle, and repeated-observation cases.
- Replaced incomplete task-local command output with the exact fresh reviewer output observed through command completion.

## Final Verification

- `findmnt -no TARGET,OPTIONS /tmp` - PASS; `/tmp` is mounted `noexec`, so the repository-local executable `TMPDIR` is required for the full Edge suite on this host.
- `go test -race -count=1 ./apps/edge/internal/openai -run 'TestHotPath(RejectedDispatch|TerminalDisposition|ActiveStageCancel|CancelCompleteRace|Cleanup)'` - PASS; `ok iop/apps/edge/internal/openai 3.946s`.
- `go test -race -count=1 ./packages/go/streamgate ./packages/go/config ./apps/edge/internal/openai ./apps/edge/internal/service` - PASS; all four packages passed with fresh race execution.
- `TMPDIR=/config/workspace/iop-s0 go test -count=1 ./apps/edge/...` - PASS; all Edge packages passed, including bootstrap integration.
- `go vet ./apps/edge/...` - PASS; no output.
- `gofmt -d apps/edge/internal/openai/hot_path_dispatch.go apps/edge/internal/openai/hot_path_terminal_control_test.go` - PASS; no output.
- `git diff --check` - PASS; no output.

## Remaining Nits

- None.

## Follow-up Work

- None.
