<!-- task=m-iop-hot-path-one-shot-execution/17+14,15,16_endpoint_error_matrix plan=3 tag=REVIEW_REVIEW_API milestone-task=error-cancel -->

# Complete - m-iop-hot-path-one-shot-execution/17+14,15,16_endpoint_error_matrix

## Completed At

2026-08-04

## Summary

Separated endpoint callback write failures from pre-callback release/runtime failures after two required rework loops; final verdict PASS.

## Loop History

| Plan | Review | Verdict | Notes |
|------|--------|---------|-------|
| `plan_cloud_G09_0.log` | `code_review_cloud_G10_0.log` | SUPERSEDED | The initial pair was reanalyzed before implementation and contains no implementation verdict. |
| `plan_cloud_G09_1.log` | `code_review_cloud_G10_1.log` | FAIL | The endpoint disconnect test bypassed production runtime classification, which still selected `provider_error`. |
| `plan_cloud_G08_2.log` | `code_review_cloud_G09_2.log` | FAIL | The production write path was fixed, but all release preparation errors were incorrectly classified as caller cancellation. |
| `plan_cloud_G07_3.log` | `code_review_cloud_G07_3.log` | PASS | Only endpoint release-callback errors become `caller_cancel/caller_write`; pre-callback failures retain `provider_error/stage_runtime`. |

## Implementation/Cleanup

- Added a private release-callback error marker that preserves its cause through `Unwrap`.
- Narrowed caller-cancel classification to endpoint callback failures while preserving normal stage-runtime classification for identity and other release preparation failures.
- Added production-path positive and negative controls for exact-stage cancellation, wire silence, callback exclusion, and runtime error disposition.

## Final Verification

- `go test -race -count=1 ./apps/edge/internal/openai -run 'TestHotPath(EndpointTerminalMatrix|EndpointDisconnectDuringWriteCancelsActiveStage|NonWriterReleaseFailureRetainsRuntimeDisposition|CancelCompleteRace)|Test(ChatStreamSession|AnthropicNative|StreamChatCompletion)'` - PASS; `iop/apps/edge/internal/openai` completed in 2.082s.
- `go test -race -count=1 ./packages/go/streamgate ./packages/go/config ./apps/edge/internal/openai ./apps/edge/internal/service` - PASS; all four packages passed with fresh race-enabled execution.
- `TMPDIR=/config/workspace/iop-s0 go test -count=1 ./apps/edge/...` - PASS; all Edge packages passed.
- `go vet ./apps/edge/...` - PASS; no output.
- `gofmt -d apps/edge/internal/openai/hot_path_terminal_control.go apps/edge/internal/openai/cancellation_routes_test.go` - PASS; no output.
- `git diff --check` - PASS; no output.
- Credentialed provider, repository edge-node diagnostic, auxiliary E2E smoke, and full-cycle field execution were not run because this task is the deterministic internal S13 classification boundary; live two-protocol smoke remains separately owned by S16/`hot-smoke`.

## Remaining Nits

- None.

## Follow-up Work

- None.
