<!-- task=m-iop-hot-path-one-shot-execution/18+17_observation_schema plan=3 tag=REVIEW_API milestone-task=route-observability -->

# Complete - m-iop-hot-path-one-shot-execution/18+17_observation_schema

## Completion Time

2026-08-04

## Summary

Completed the Hot Path observation schema and server emission boundary after three plan generations and one implementation rework; final verdict: PASS.

## Loop History

| Plan | Review | Verdict | Notes |
|------|--------|---------|-------|
| `plan_local_G06_1.log` | `code_review_cloud_G07_1.log` | SUPERSEDED | Replaced before implementation; no verdict was issued. |
| `plan_local_G06_2.log` | `code_review_cloud_G07_2.log` | FAIL | Collector inputs admitted arbitrary labels, the S15 projection was incomplete, and the failure hook could panic through request isolation. |
| `plan_cloud_G06_3.log` | `code_review_cloud_G06_3.log` | PASS | Closed collector/projection boundaries, complete bounded route and outcome dimensions, and the server-owned failure-isolated seam all passed review. |

## Implementation and Cleanup

- Enforced closed enum validation at every Hot Path collector entry point and retained route, cleanup, orphan, stage, attempt, terminal, and usage evidence through metric-specific bounded label sets.
- Completed the raw-free S15 log projection with bounded request, preset, stage, call, and owner correlation identifiers; invalid enum or secret-sentinel projections never reach the sink.
- Added the server-owned `emitHotPathObservation` seam with race-safe observer snapshots and isolation for sink errors, sink panics, and failure-hook panics while preserving the separate Stream Gate observation sink.
- Added gathered-series, projection-boundary, production failure-isolation, and concurrent observer replacement tests.

## Final Verification

- `TMPDIR=/tmp go test -race -count=1 ./apps/edge/internal/openai -run 'TestHotPath(ObservationProjectionBoundary|MetricProjectionBoundary|ObservationSchema|ObservationRejectsRawValues|MetricLabels)'` - PASS; `ok iop/apps/edge/internal/openai`.
- `TMPDIR=/tmp go test -race -count=1 ./apps/edge/internal/openai -run 'TestHotPath(ObserverProductionFailureIsolation|ObserverFailureIsolation)'` - PASS; `ok iop/apps/edge/internal/openai`.
- `TMPDIR=/tmp go test -race -count=1 ./apps/edge/internal/openai -run 'TestHotPath(ObservationProjectionBoundary|MetricProjectionBoundary|ObserverProductionFailureIsolation|ObservationSchema|ObservationRejectsRawValues|MetricLabels|ObserverFailureIsolation)'` - PASS; `ok iop/apps/edge/internal/openai`.
- `TMPDIR=/tmp go test -race -count=1 ./packages/go/streamgate ./packages/go/config ./apps/edge/internal/openai ./apps/edge/internal/service` - PASS; all four packages passed under the race detector.
- `TMPDIR=/tmp go test -count=1 ./apps/edge/...` - ENVIRONMENT-LIMITED; the only failure was `apps/edge/internal/bootstrap::TestActualNodeReconnectReadyPumpsQueuedWaiterExactlyOnce` because `/tmp` is mounted `noexec`; the target `apps/edge/internal/openai` package passed.
- `TMPDIR=/config/workspace/iop-s0/.edge-smoke-review.zEkvNl go test -count=1 ./apps/edge/...` - PASS; every Edge package passed when the integration-test binary used an executable temporary filesystem, and the temporary directory was removed afterward.
- `go vet ./apps/edge/...` - PASS; no output.
- `gofmt -d apps/edge/internal/openai/hot_path_observation.go apps/edge/internal/openai/hot_path_metrics.go apps/edge/internal/openai/server.go apps/edge/internal/openai/hot_path_observation_test.go` - PASS; no output.
- `git diff --check` - PASS; no output.

## Remaining Nits

- None.

## Follow-up Work

- None.
