<!-- task=m-iop-owned-single-request-agent-execution/25+23,24_claude_smoke_qualification plan=23 tag=REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_REVIEW_API milestone-task=workspace-binding,claude-smoke -->

# Repair deterministic plan output and Claude child cardinality

## For the Implementing Agent

Resolve Required R16 and R17 without another provider/model call. Freeze only the supervised Claude child with `CLAUDE_CODE_MAX_RETRIES=0`; make the fake prove it overrides an ambient parent value. Make the Gemini plan stage own a provider-compatible OpenAI `response_format` JSON schema for exactly `plan` and `verification`, while retaining the canonical strict parser. Emit one separate bounded terminal-rejection log at the Anthropic boundary so malformed and validation terminals can be distinguished without raw output. Run local and dev provider-free validation, rebuild only the disposable dev Edge, and stop before any seventh call.

## Background

The sixth guard is consumed as `sole-live-6.rc-69`. One harness invocation admitted two sequential requests because installed Claude retried the first 502 internally. Both requests reached Gemini plan and failed after provider latency. Static terminal mapping and retry behavior identify malformed plan output as the strongest closed explanation; the raw provider body was intentionally not retained.

## Archive Evidence Snapshot

- Prior pair: `plan_cloud_G10_22.log` / `code_review_cloud_G10_22.log`; verdict `FAIL`, Required R16/R17, `review_rework_count=21`, `evidence_integrity_failure=false`.
- Six `.rc-69` guards are immutable. No seventh guard/call is authorized by this repair plan.
- Disposable dev source/runtime roots remain isolated from canonical `/Users/toki/agent-work/iop-dev`.

## Finding Resolution Map

| Finding | Mode | Exact evidence | Changed precondition |
|---|---|---|---|
| R16 | direct code repair | child env, fake assertion, self-test with ambient nonzero parent | One harness child cannot inherit Claude's generic 5xx retry count. |
| R17 | direct code repair | plan-owned JSON schema body tests, strict parser tests, bounded terminal log tests | Gemini receives a supported deterministic output contract and future failure evidence preserves the closed terminal class. |

## Analysis

### Contract Boundary

- The public model, provider identity, credentials, messages, and schema remain Edge-owned; stage/config options cannot override `response_format`.
- Structured output constrains syntax and fields; the existing parser still enforces nonempty semantic values and exact canonical serialization.
- The new log contains only fixed vocabulary (`surface`, terminal kind/error class, HTTP status), never request, provider, workspace, or credential data.

### Verification Boundary

- Local validation uses only fake/model-free tests.
- Dev validation may sync the exact repaired files, rebuild the disposable Edge, and run health/config/catalog/count-token/preflight gates that do not invoke Gemini, Ornith, or Claude.
- Do not create `sole-live-7`, run the harness with `--run`, or publish S12 success artifacts.

### Final Routing

- `evaluation_mode=isolated-reassessment`; `finalizer=finalize-task-policy.sh`; `finalizer_mode=pair`.
- Build `worker/cloud/G10`; review `review/cloud/G10`; `base_route_basis=grade-boundary`; scores `2/2/2/2/2`; `large_indivisible_context=true`.
- Loop risks: `temporal_state`, `concurrent_consistency`, `boundary_contract`, `variant_product`; count 4.
- `review_rework_count=21`, `evidence_integrity_failure=false`.

## Implementation Checklist

- [x] Freeze the Claude child with `CLAUDE_CODE_MAX_RETRIES=0` and prove an ambient nonzero parent cannot pass through.
- [x] Add an Edge-owned plan JSON schema request format that options cannot override.
- [x] Preserve strict plan parsing and add exact request-body/negative tests.
- [x] Add and test a bounded terminal-rejection log that distinguishes malformed from validation.
- [x] Run formatting, focused Go tests, shell self-test, and repository checks required by the dev test rules.
- [x] Sync only changed repair files to the disposable dev source, rebuild Edge, and run provider-free readiness/preflight only.
- [x] Fill implementation-owned review sections and stop for official review without a live call.

## Final Verification

1. `gofmt`, focused OpenAI package tests, and shell syntax/self-test.
2. Contract/spec pointer and diff hygiene checks required by project rules.
3. Disposable dev Edge rebuild plus health/config/catalog/frozen-count-token/harness-preflight checks.
4. Assert ingress and all six guards/artifacts remain unchanged; no seventh call or publication.

After implementation, fill `CODE_REVIEW-cloud-G10.md` and leave the active pair for official review.
