<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=35 tag=REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Enforce completion eligibility and mandatory missing-result repair

## For the Implementing Agent

Resolve R36 and R37 together. Do not rely on provider obedience to `tool_choice`. Separate tool-required requests from completion-eligible structured requests in Work, and make Review machine-enforce one successful repair after a model-visible `not_found`. Preserve every finalized live guard and execute exactly one `sole-live-18` only after all gates pass.

## Archive Evidence Snapshot

- Prior pair: `plan_cloud_G10_34.log` / `code_review_cloud_G10_34.log`; verdict `FAIL`, R36/R37, `review_rework_count=33`, `evidence_integrity_failure=false`.
- `sole-live-17.rc-69`: Plan success, Work zero-tool success, Review read `not_found`, Review validation error, cleanup success, no result/manifest, no retry.
- Canonical Work log proves llama.cpp returned the strict completion schema with zero tool calls even while the same request specified `tool_choice=required`.

## Scope

- Modify Work request-mode/runtime enforcement and tests, Review request-mode/runtime enforcement and tests, plus review evidence only.
- Keep quality-gate `not_found` admission, service wire behavior, strict codecs, workspace authority, limits, canonical dev, providers, configs, routes, credentials, and harness unchanged.
- Completion format exists only when Work is eligible to complete; `response_format` remains reserved and server-owned in every mode.
- Review's latest missing result requires a non-inspection repair tool and forbids pass until that repair succeeds.

## Implementation Checklist

- [x] Initial Work and latest-`not_found` Work use `required` without `response_format`; successful-tool continuation uses `auto` with the exact strict response format.
- [x] Work rejects a provider completion before a successful tool result and tests provider noncompliance.
- [x] Review prompt explicitly maps `not_found` to a repair tool, and its next body uses server-owned `required`.
- [x] Review rejects pass or inspection while repair-required, clears the requirement only on successful repair, then returns to `auto`.
- [x] Extend exact body tests and real coordinator positive/negative paths without weakening any prior boundaries.
- [x] Run fresh local formatting, focused/package/race/Edge/build and unchanged harness self-test gates.
- [x] Sync only reviewed source/test files, rebuild/restart only disposable Edge, refresh identities, and pass provider-free gates.
- [x] Execute/finalize exactly one `sole-live-18` and validate full S12 evidence or a closed failure, with no retry.
- [x] Fill every implementation-owned review section.

## Final Verification

1. Format changed Go files and run diff checks.
2. Run focused Work/Review mode tests, OpenAI package, focused race, all Edge tests, Edge build, and harness self-test.
3. Repeat relevant gates on isolated dev, build Darwin arm64 Edge, update exact worktree/binary evidence, and restart only disposable Edge.
4. Require seventeen finalized guards, zero started guards, empty active workspace, no manifest, ingress-stable authenticated preflight, and zero Claude processes.
5. Run one `sole-live-18`; PASS requires ingress 1, Gemini -> ornith-fast -> Gemini, exact LF-terminated result, verifier success, cleanup, one successful terminal, and schema-valid redacted manifest.
