<!-- task=m-iop-hot-path-one-shot-execution/21+20_hot_smoke_actual plan=3 tag=REVIEW_REVIEW_TEST milestone-task=hot-smoke -->

# Code Review Reference - REVIEW_REVIEW_TEST

> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> The task is NOT complete until every implementation-owned section below is filled in.
> Complete the `Implementation Checklist`; the final checklist item is mandatory before saving.
> Fill implementation-owned sections, then stop with active files in place and report ready for review.
> Execute the plan's selected root cause, scope, files, and dependency decisions as written. Do not choose another owner, narrow/expand the write boundary, or replace a fix with another verification attempt.
> If implementation is blocked, record the exact blocker, attempted commands/output, and resume condition only in implementation-owned evidence fields.
> Do not ask the user directly, present choices, call user-input tools, create control-plane stop files, or classify the next state.
> Finalization (`Code Review Result`, log rename, `complete.log`, archive moves, `Review-Only Checklist`) is review-agent-only, even after compaction/resume.
> Follow the ownership table at the bottom of this file for which sections you own.

## Overview

date=2026-08-05
task=m-iop-hot-path-one-shot-execution/21+20_hot_smoke_actual, plan=3, tag=REVIEW_REVIEW_TEST

## Archive Evidence Snapshot

- `code_review_cloud_G07_2.log` records the current `FAIL`: Required R2 is the production observation reducer mismatch, R4 is the unsupported Pi 0.81.1 `AgentSessionEvent` contract, R5 is empty reserved-directory leakage, and R3 is the still-missing actual 10-case matrix. It records fresh local syntax, self-test, race, exit-fidelity, and diff checks plus all 17 external input names as unset.
- `plan_cloud_G07_2.log` is the superseded implementation packet. Its identity binding and fresh byte-range design remain useful, but its fake observation/Pi fixtures are not production-truthful.
- `agent-task/archive/2026/08/m-iop-hot-path-one-shot-execution/20+17,19_smoke_harness/complete.log` proves only the earlier fake-agent harness baseline; it is not actual S16 evidence.
- Roadmap scope remains `milestone-task=hot-smoke`. No Milestone completion is claimed.

## For the Review Agent

> **[REVIEW AGENT ONLY]** The finalization steps below are review-agent only. Implementing agents must not execute this section.

Compare implementation of each item against source files and verify that output in `Verification Results` matches code.
Review completion means the following steps are finished:

1. Append verdict and `review_rework_count` / `evidence_integrity_failure` routing signals.
2. Archive `CODE_REVIEW-cloud-G09.md` → `code_review_cloud_G09_3.log` and `PLAN-cloud-G09.md` → `plan_cloud_G09_3.log`.
3. If PASS, write `complete.log` and move active task directory to `agent-task/archive/YYYY/MM/m-iop-hot-path-one-shot-execution/21+20_hot_smoke_actual/`. If WARN/FAIL, fully write the next filesystem state required by the code-review skill.
4. If PASS and task group is `m-<milestone-slug>`, preserve the first-line `milestone-task` metadata in `complete.log` and report it for the runtime aggregation event. Roadmap state evaluation belongs to `sync-milestone-workstate`.
5. Check applicable `Review-Only Checklist` items at the final `.log` location before reporting.

---

## Implementation Item Completion

| Item | Status |
|------|---------|
| REVIEW_REVIEW_TEST-1 Close the production observation lifecycle | [x] |
| REVIEW_REVIEW_TEST-2 Consume native Pi JSON events | [x] |
| REVIEW_REVIEW_TEST-3 Enforce workspace cleanup and produce actual evidence | [x] |

## Implementation Checklist

- [x] [REVIEW_REVIEW_TEST-1] Make per-case observation capture parse exact production messages, wait boundedly for a closed lifecycle, reduce attempts into schema stages, and reject missing/foreign/contradictory terminal, cleanup, or orphan records with production-trace controls.
- [x] [REVIEW_REVIEW_TEST-2] Parse installed Pi `AgentSessionEvent` JSON and process-exit cancellation, require scenario-relevant visible stage/tool output, and replace fake Pi OpenAI-choice fixtures with native positive, error, and cancel controls.
- [x] [REVIEW_REVIEW_TEST-3] Treat any reserved request path as artifact presence, add empty-directory survivor coverage, rerun local regression, then execute the matching external preflight/matrix and record the actual manifest or exact blocker without an S16 completion claim.
- [x] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

## Review-Only Checklist

> **[REVIEW AGENT ONLY]** This checklist is used only by the review agent.
> Implementing agents must not modify or check this section.

- [x] Append one verdict of `PASS`, `WARN`, or `FAIL` and verified `review_rework_count`, `evidence_integrity_failure` to `Code Review Result`.
- [x] Verify that verdict, `Dimension Assessment`, and Required/Suggested/Nit classifications match.
- [x] Archive active `CODE_REVIEW-*-G??.md` to `code_review_cloud_G09_3.log`.
- [x] Archive active `PLAN-*-G??.md` to `plan_cloud_G09_3.log`.
- [x] Verify that the Agent-Ops managed block in `.gitignore` unignores `agent-task/**/*.md` and `agent-task/**/*.log` and ignores `agent-roadmap/current.md`.
- [ ] If PASS, write `complete.log` based on `agent-ops/skills/common/code-review/templates/complete-log-template.md` and leave no active `.md` files.
- [ ] If PASS, move active task directory `agent-task/m-iop-hot-path-one-shot-execution/21+20_hot_smoke_actual/` to `agent-task/archive/YYYY/MM/m-iop-hot-path-one-shot-execution/21+20_hot_smoke_actual/` and update this checklist at the final archive path.
- [ ] If PASS and task group is `m-<milestone-slug>`, preserve and report `milestone-task` metadata for runtime aggregation, without modifying roadmap or directly calling `update-roadmap`.
- [ ] If PASS for split work, remove empty active parent `agent-task/m-iop-hot-path-one-shot-execution/` or verify it was kept due to remaining siblings/files.
- [x] If WARN/FAIL, write the next filesystem state matching code-review verdict and do not write `complete.log`.

## Deviations from Plan

None. The external matrix stopped at the first required presence-only failure, as directed by the plan, and no S16 completion claim was made.

## Key Design Decisions

- Observation capture now accepts only `msg == "hot_path_observation"`, rejects field-bearing foreign lookalikes, validates the closed production enum/field combinations, and polls for a stable scenario-specific closure. The default bounds are 5 seconds, or 10 seconds for timeout/cancel, followed by a 150 ms quiet window that catches a late contradictory terminal.
- Admitted direct/light requests require their production terminal. Write-unavailable admission closes on its bounded dispatch-rejection reason, matching the fixed manifest projection. Timeout/cancel closes only on the production local caller-cancel/timeout stage plus `ttl_expired` orphan handoff. Successful local/review retries are validated before being collapsed to one manifest stage.
- Pi parsing follows installed Pi 0.81.1 `AgentSessionEvent` records (`agent_start`, assistant message events, `tool_execution_*`, and `agent_end`). A Pi cancellation terminal is synthesized only for harness-owned child-only SIGTERM with exit 143 and no native terminal; a native success/error terminal remains a contradiction in that state.
- Visible evidence must contain scenario-relevant tool progression, including ordered workspace write, review, repair, and cleanup labels where applicable. Fake Pi fixtures now emit native events and cover success, tool error, assistant error, cancellation, old OpenAI-choice rejection, and `agent_end` without a terminal-capable assistant message.
- Workspace evidence treats every descendant of `.iop/job`, including an empty request directory, as a surviving artifact. The negative control proves that an empty reservation prevents a successful cleanup classification.

## Reviewer Checkpoints

- Confirm the observation parser consumes only exact `hot_path_observation` records, waits within a bound for one closed request lifecycle, accepts the production repeated-attempt pass/repair traces, and rejects missing or contradictory terminal/cleanup/orphan evidence.
- Confirm Pi fixtures and parsing use installed Pi `AgentSessionEvent` JSON rather than OpenAI `choices`, reconcile signal exit 143 only with harness-owned child cancellation, and expose scenario-relevant tool/stage events.
- Confirm any surviving reserved `.iop/job/<request-id>` path counts as an artifact, successful cleanup rejects an empty survivor, and timeout cancellation still proves an orphan.
- Confirm identity, exact argv, fixed matrix, schema, redaction, stale/rotation/mixed-log, direct-vs-Make exit, workspace, and child-only cancellation controls remain intact.
- Do not PASS without an actual schema-valid 10-case Claude/Pi manifest from the matching runtime, fresh visible/observation/workspace evidence, and zero redaction matches.

## Verification Results

Paste actual stdout/stderr beneath each command. If output is too long, record the exact saved output path and command used to create it. A changed command requires an entry in `Deviations from Plan`.

### REVIEW_REVIEW_TEST-1 — observation lifecycle

```bash
bash -n scripts/e2e-hot-path-agents.sh
TMPDIR=/config/workspace/iop-s0 make test-hot-path-agent-smoke-self-test
```

Expected: exit 0; the self-test reports production retry-trace acceptance and missing/foreign/contradictory lifecycle rejection.

Exit 0. `bash -n` emitted no output. The shared fresh self-test emitted these relevant assertions (the complete output is reproduced under Final local regression):

```text
[e2e-hot-path-agents] assertion PASS: production retry observation traces accepted and reduced
[e2e-hot-path-agents] assertion PASS: post-bound lifecycle timeout rejected before manifest output
[e2e-hot-path-agents] assertion PASS: foreign-message observation lookalike rejected rejected before manifest output
[e2e-hot-path-agents] assertion PASS: unknown production observation event rejected rejected before manifest output
[e2e-hot-path-agents] assertion PASS: missing observation terminal rejected rejected before manifest output
[e2e-hot-path-agents] assertion PASS: duplicate conflicting observation terminals rejected rejected before manifest output
[e2e-hot-path-agents] assertion PASS: late contradictory observation terminal rejected rejected before manifest output
[e2e-hot-path-agents] assertion PASS: cleanup without successful lifecycle rejected rejected before manifest output
[e2e-hot-path-agents] assertion PASS: unexpected observation orphan rejected rejected before manifest output
```

### REVIEW_REVIEW_TEST-2 — native Pi JSON

```bash
bash -n scripts/e2e-hot-path-agents.sh
TMPDIR=/config/workspace/iop-s0 make test-hot-path-agent-smoke-self-test
```

Expected: exit 0; native Pi success/error/cancel, tool ordering, and scenario-relevant visible-event assertions pass.

Exit 0. `bash -n` emitted no output. The shared fresh self-test emitted these relevant assertions:

```text
[e2e-hot-path-agents] assertion PASS: native Pi success and error terminals parsed
[e2e-hot-path-agents] assertion PASS: native Pi signal exit 143 reconciled as cancellation
[e2e-hot-path-agents] assertion PASS: native Pi scenario tool order is visible
[e2e-hot-path-agents] assertion PASS: OpenAI choices lookalike rejected for Pi
[e2e-hot-path-agents] assertion PASS: Pi agent_end without terminal-capable assistant rejected
```

Installed Pi package version read during implementation: `0.81.1`.

### REVIEW_REVIEW_TEST-3 — workspace lifecycle

```bash
bash -n scripts/e2e-hot-path-agents.sh
TMPDIR=/config/workspace/iop-s0 make test-hot-path-agent-smoke-self-test
```

Expected: exit 0; an empty success reservation is rejected and a timeout reservation remains an orphan.

Exit 0. `bash -n` emitted no output. The shared fresh self-test emitted these relevant assertions:

```text
[e2e-hot-path-agents] assertion PASS: light-pass/repair cleanup=removed
[e2e-hot-path-agents] assertion PASS: timeout-cancel cleanup=orphan
[e2e-hot-path-agents] assertion PASS: empty reserved request directory rejected rejected before manifest output
```

### Final local regression

```bash
bash -n scripts/e2e-hot-path-agents.sh
TMPDIR=/config/workspace/iop-s0 make test-hot-path-agent-smoke-self-test
go test -race -count=1 ./packages/go/streamgate ./packages/go/config ./apps/edge/internal/openai ./apps/edge/internal/service
git diff --check
```

Expected: all commands exit 0; Go output is fresh because `-count=1` is required.

Actual results from `/config/workspace/iop-s0`:

```text
$ bash -n scripts/e2e-hot-path-agents.sh
# no stdout/stderr; exit 0

$ TMPDIR=/config/workspace/iop-s0 make test-hot-path-agent-smoke-self-test
./scripts/e2e-hot-path-agents.sh --self-test
[e2e-hot-path-agents] assertion PASS: positive do_run exits 0
[e2e-hot-path-agents] assertion PASS: produced manifest validates against supplied fixture
[e2e-hot-path-agents] assertion PASS: production retry observation traces accepted and reduced
[e2e-hot-path-agents] assertion PASS: native Pi success and error terminals parsed
[e2e-hot-path-agents] assertion PASS: native Pi signal exit 143 reconciled as cancellation
[e2e-hot-path-agents] assertion PASS: native Pi scenario tool order is visible
[e2e-hot-path-agents] assertion PASS: ten unique case ids
[e2e-hot-path-agents] assertion PASS: raw argv/stdout/observation capture deleted
[e2e-hot-path-agents] assertion PASS: observation request ids projected and single per case
[e2e-hot-path-agents] assertion PASS: direct cases terminal=success
[e2e-hot-path-agents] assertion PASS: write-unavailable terminal=provider_error
[e2e-hot-path-agents] assertion PASS: timeout-cancel terminal=cancelled
[e2e-hot-path-agents] assertion PASS: process exit status is captured from wait
[e2e-hot-path-agents] assertion PASS: light-pass/repair cleanup=removed
[e2e-hot-path-agents] assertion PASS: timeout-cancel cleanup=orphan
[e2e-hot-path-agents] assertion PASS: timeout-cancel child_only target
[e2e-hot-path-agents] assertion PASS: redaction matches == 0 on manifest
[e2e-hot-path-agents] assertion PASS: redaction detects leaked sentinel
[e2e-hot-path-agents] assertion PASS: all surviving harness artifacts are redacted
[e2e-hot-path-agents] assertion PASS: workspace digest changes on content-only edit
[e2e-hot-path-agents] assertion PASS: 9-case manifest rejected
[e2e-hot-path-agents] assertion PASS: forbidden-field manifest rejected
[e2e-hot-path-agents] assertion PASS: bad-enum manifest rejected
[e2e-hot-path-agents] assertion PASS: 11-case duplicate manifest rejected
[e2e-hot-path-agents] assertion PASS: distinct-row duplicate id rejected
[e2e-hot-path-agents] assertion PASS: id-agent mismatch rejected
[e2e-hot-path-agents] assertion PASS: id-scenario mismatch rejected
[e2e-hot-path-agents] assertion PASS: terminal-event contradiction rejected
[e2e-hot-path-agents] assertion PASS: cancellation relation mismatch rejected
[e2e-hot-path-agents] assertion PASS: multi-request observation in one case rejected
[e2e-hot-path-agents] assertion PASS: alternate fixture changes acceptance rejected
[e2e-hot-path-agents] assertion PASS: malformed nine-row fixture rejected
[e2e-hot-path-agents] assertion PASS: worktree fingerprint mismatch rejected before invocation
[e2e-hot-path-agents] assertion PASS: claude binary identity mismatch rejected before invocation
[e2e-hot-path-agents] assertion PASS: edge binary identity mismatch rejected before invocation
[e2e-hot-path-agents] assertion PASS: edge config identity mismatch rejected before invocation
[e2e-hot-path-agents] assertion PASS: pi config identity mismatch rejected before invocation
[e2e-hot-path-agents] assertion PASS: base url identity mismatch rejected before invocation
[e2e-hot-path-agents] assertion PASS: scenario alias identity mismatch rejected before invocation
[e2e-hot-path-agents] assertion PASS: fixture identity mismatch rejected before invocation
[e2e-hot-path-agents] assertion PASS: post-bound lifecycle timeout rejected before manifest output
[e2e-hot-path-agents] assertion PASS: stale-only observation rejected rejected before manifest output
[e2e-hot-path-agents] assertion PASS: rotated/truncated observation rejected rejected before manifest output
[e2e-hot-path-agents] assertion PASS: mixed/duplicate request lifecycle rejected rejected before manifest output
[e2e-hot-path-agents] assertion PASS: wrong observation stage lifecycle rejected rejected before manifest output
[e2e-hot-path-agents] assertion PASS: foreign-message observation lookalike rejected rejected before manifest output
[e2e-hot-path-agents] assertion PASS: unknown production observation event rejected rejected before manifest output
[e2e-hot-path-agents] assertion PASS: missing observation terminal rejected rejected before manifest output
[e2e-hot-path-agents] assertion PASS: duplicate conflicting observation terminals rejected rejected before manifest output
[e2e-hot-path-agents] assertion PASS: late contradictory observation terminal rejected rejected before manifest output
[e2e-hot-path-agents] assertion PASS: cleanup without successful lifecycle rejected rejected before manifest output
[e2e-hot-path-agents] assertion PASS: unexpected observation orphan rejected rejected before manifest output
[e2e-hot-path-agents] assertion PASS: immediate exit with no native output rejected before manifest output
[e2e-hot-path-agents] assertion PASS: missing native terminal rejected before manifest output
[e2e-hot-path-agents] assertion PASS: terminal and scenario contradiction rejected before manifest output
[e2e-hot-path-agents] assertion PASS: content-insensitive cleanup contradiction rejected before manifest output
[e2e-hot-path-agents] assertion PASS: empty reserved request directory rejected rejected before manifest output
[e2e-hot-path-agents] assertion PASS: timeout without triggered child cancellation rejected before manifest output
[e2e-hot-path-agents] assertion PASS: OpenAI choices lookalike rejected for Pi
[e2e-hot-path-agents] assertion PASS: Pi agent_end without terminal-capable assistant rejected
[e2e-hot-path-agents] assertion PASS: preflight ok
[e2e-hot-path-agents] self-test PASSED: exact argv, fixed 2x5 matrix, schema rejection,
[e2e-hot-path-agents]   runtime/profile/alias binding mismatch exit 69 before invocation,
[e2e-hot-path-agents]   production retry lifecycle closure and negative observation controls,
[e2e-hot-path-agents]   native Pi success/error/cancel plus tool order, empty-reservation
[e2e-hot-path-agents]   rejection, secret absence, child-only cancellation, cleanup/orphan
[e2e-hot-path-agents]   classification, and full cleanup verified with fake agents/runtime only.

$ go test -race -count=1 ./packages/go/streamgate ./packages/go/config ./apps/edge/internal/openai ./apps/edge/internal/service
ok  	iop/packages/go/streamgate	2.025s
ok  	iop/packages/go/config	1.640s
ok  	iop/apps/edge/internal/openai	13.648s
ok  	iop/apps/edge/internal/service	7.008s

$ git diff --check
# no stdout/stderr; exit 0
```

### External matching-runtime preflight and matrix

Run presence-only checks without printing values:

```bash
test -n "${IOP_HOT_SMOKE_BASE_URL:-}"
test -n "${IOP_HOT_SMOKE_DIRECT_MODEL:-}" && test -n "${IOP_HOT_SMOKE_PASS_MODEL:-}"
test -n "${IOP_HOT_SMOKE_REPAIR_MODEL:-}" && test -n "${IOP_HOT_SMOKE_SLOW_MODEL:-}"
test -n "${IOP_HOT_SMOKE_CLAUDE_BIN:-}" && test -x "$IOP_HOT_SMOKE_CLAUDE_BIN"
test -n "${IOP_HOT_SMOKE_PI_BIN:-}" && test -x "$IOP_HOT_SMOKE_PI_BIN"
test -n "${PI_CODING_AGENT_DIR:-}" && test -d "$PI_CODING_AGENT_DIR"
test -n "${IOP_HOT_SMOKE_PI_PROVIDER:-}"
test -n "${IOP_HOT_SMOKE_EDGE_BIN:-}" && test -x "$IOP_HOT_SMOKE_EDGE_BIN"
test -n "${IOP_HOT_SMOKE_EDGE_CONFIG:-}" && test -f "$IOP_HOT_SMOKE_EDGE_CONFIG"
test -n "${IOP_HOT_SMOKE_RUNTIME_EVIDENCE:-}" && test -f "$IOP_HOT_SMOKE_RUNTIME_EVIDENCE"
test -n "${IOP_HOT_SMOKE_OBSERVATION_FILE:-}" && test -f "$IOP_HOT_SMOKE_OBSERVATION_FILE"
test -n "${IOP_HOT_SMOKE_WORKSPACE_PARENT:-}" && test -d "$IOP_HOT_SMOKE_WORKSPACE_PARENT"
test -n "${IOP_HOT_SMOKE_OUTPUT:-}"
test -n "${IOP_HOT_SMOKE_CLAUDE_SECRET_ENV:-}" && test -n "${!IOP_HOT_SMOKE_CLAUDE_SECRET_ENV:-}"
test -n "${IOP_HOT_SMOKE_PI_SECRET_ENV:-}" && test -n "${!IOP_HOT_SMOKE_PI_SECRET_ENV:-}"
make test-hot-path-agent-smoke-preflight
make test-hot-path-agent-smoke
jq -e '
  .schema_version == "1"
  and ([.cases[].id] == ["claude:direct","claude:light-pass","claude:repair","claude:write-unavailable","claude:timeout-cancel","pi:direct","pi:light-pass","pi:repair","pi:write-unavailable","pi:timeout-cancel"])
  and ([.cases[].outcome] == ["completed","completed","completed","error","cancelled","completed","completed","completed","error","cancelled"])
  and all(.cases[]; (.visible_events | length) > 0 and (.observation | length) > 0)
  and all(.cases[] | select(.scenario == "light-pass" or .scenario == "repair"); any(.visible_events[]; .kind == "tool_use"))
  and (.redaction.matches == 0)
' "$IOP_HOT_SMOKE_OUTPUT"
```

Expected: every command exits 0 against the matching isolated runtime. If blocked, paste the first exact failed command/output, runner identity, missing input name, and resume condition; explicitly state that S16 remains incomplete.

The external verification stopped at the first required presence-only check:

```text
$ test -n "${IOP_HOT_SMOKE_BASE_URL:-}"
# no stdout/stderr; exit 1
```

- Runner identity: current host, `/config/workspace/iop-s0`; branch `feature/iop-hot-path-one-shot-execution`; HEAD `703f3b723202959185c04bb32c2c68383b8d04a0`; Linux `6.10.14-linuxkit`/aarch64; Go `1.26.2`.
- Missing input: `IOP_HOT_SMOKE_BASE_URL`.
- Not run after the first failure: the remaining presence checks, `make test-hot-path-agent-smoke-preflight`, `make test-hot-path-agent-smoke`, and the final manifest `jq` assertion.
- Resume condition: select/start the matching isolated Edge runtime, export all 17 caller-selected inputs without printing their values, regenerate runtime evidence for this exact worktree and binaries/config/profile, then rerun the complete presence checks, preflight, 2x5 matrix, and manifest assertion.
- SDD S16 remains incomplete; no actual Claude/Pi 10-case manifest or completion claim exists in this implementation evidence.

---

> **[IMPLEMENTING AGENT — BEFORE SAVING] Have you filled in every implementation-owned section?**
> If anything is blank, go back and fill it in before saving this file.
> Leave review-agent-only sections unchanged.

## Section Ownership

| Section | Owner | Note |
|---------|-------|------|
| Header comment, Overview, Review Agent Instructions | Fixed at stub creation | Implementing agent must not modify or execute these (archive, complete.log, and task-directory archive move are review-agent only) |
| Archive Evidence Snapshot | Fixed at stub creation from plan when present | Implementing agent uses it as default prior-loop context; read only the specific archive files cited there when more detail is required |
| Implementation Item Completion (item names) | Fixed at stub creation | Implementing agent checks `[ ]` → `[x]` only |
| Implementation Checklist (item text/order) | Fixed at stub creation from plan | Implementing agent checks `[ ]` → `[x]` only |
| Review-Only Checklist | Review agent only | Implementing agent must not modify or check this section |
| Deviations from Plan, Key Design Decisions | Implementing agent | Replace placeholder text with actual content |
| Reviewer Checkpoints | Fixed at stub creation | Pre-filled from plan |
| Verification Results (section headings + commands) | Fixed at stub creation | Implementing agent fills in command output only; command changes require a `Deviations from Plan` entry |
| Code Review Result | Review agent appends | Not included in stub |

## Code Review Result

- Overall Verdict: FAIL
- Dimension Assessment:
  - Correctness: Fail — the timeout/cancel observation closure cannot occur within the harness deadline against the production TTL/sweep contract, and a native Pi JSON error terminal can be rejected solely because Pi exits zero in JSON mode.
  - Completeness: Fail — the required SDD S16 Claude/Pi 10-case matrix was not run and no schema-valid actual manifest exists.
  - Test Coverage: Fail — the timeout and Pi error fakes encode behavior that differs from the production Edge and installed Pi implementations, so the passing self-test does not cover either actual boundary.
  - API Contract: Fail — the harness requires an ingress-triggered 30-minute Edge orphan event within 10 seconds and assumes an installed Pi JSON error exits nonzero.
  - Code Quality: Pass — identity binding, fail-closed input checks, redaction boundaries, native event parsing, and isolated Make targets remain clearly structured.
  - Implementation Deviation: Fail — the fake cancellation lifecycle and Pi error exit status diverge from the production/runtime contracts without recording those incompatibilities.
  - Verification Trust: Fail — fresh source-truth and focused probes contradict the self-test's production-lifecycle and native-Pi compatibility claims.
  - Spec Conformance: Fail — SDD S16 still lacks executable actual timeout/cancel and Pi error evidence, as well as the complete matching-runtime matrix.
- Findings:
  - Required R2 — `scripts/e2e-hot-path-agents.sh:474`, `scripts/e2e-hot-path-agents.sh:533`, and `scripts/e2e-hot-path-agents.sh:579`: timeout/cancel accepts only a final `orphan=ttl_expired` observation and waits at most 10 seconds. Production configures `defaultLogicalRequestTTL = 30 * time.Minute` in `apps/edge/internal/openai/request_coordinator.go:15`, constructs the coordinator with default options in `apps/edge/internal/openai/server.go:111`, and invokes `sweepLogicalRequestTTL` only at later preset ingress boundaries (`apps/edge/internal/openai/request_coordinator_ttl.go:78` and `apps/edge/internal/openai/request_identity_ingress.go:19`). Because `run_case` blocks in `capture_appended_observation` before another matrix case can provide ingress, an actual caller-cancel trace cannot reach the required orphan closure. Close observation capture on the production local-stage `caller_cancel`/`timeout` disposition, derive `cleanup=orphan` from the surviving workspace snapshot and harness-owned child cancellation, update the fake trace to omit the synthetic immediate TTL orphan, and add a regression control that matches the production timing contract.
  - Required R4 — `scripts/e2e-hot-path-agents.sh:684`, `scripts/e2e-hot-path-agents.sh:736`, and `scripts/e2e-hot-path-agents.sh:1538`: the parser correctly projects a Pi `agent_end` whose final assistant has `stopReason=error`, but `derive_case_result` then requires a nonzero child exit while the fake Pi explicitly exits 1. Installed Pi JSON mode streams events but updates `exitCode` from assistant `stopReason` only in text mode (`/config/.npm-global/lib/node_modules/@earendil-works/pi-coding-agent/dist/modes/print-mode.js:81` and `:100`), so a protocol-encoded error can return zero. A fresh focused probe produced `pi_native_error_exit0_rejected=true` and `pi_fake_error_exit1_accepted=true`. Reconcile error terminals with agent-specific process semantics, make the Pi fake reproduce JSON-mode exit zero, and add positive native-error plus contradictory-success controls without weakening Claude/process validation.
  - Required R3 — `agent-task/m-iop-hot-path-one-shot-execution/21+20_hot_smoke_actual/code_review_cloud_G09_3.log:289`: external verification stopped at `test -n "${IOP_HOT_SMOKE_BASE_URL:-}"` with exit 1, so preflight, the actual 2x5 matrix, and the final manifest assertion did not run. After R2 and R4 are fixed, execute the matching isolated runtime flow and attach the schema-valid manifest with fixed ids/outcomes, native visible events, fresh observation/workspace evidence, and zero redaction matches; if the external inputs remain unavailable, preserve the exact blocker without claiming S16 completion.
- Routing Signals: `review_rework_count=3`, `evidence_integrity_failure=true`
- Next Step: Archive the current pair and materialize the direct-fix follow-up pair from the mandatory plan and final-routing workflow. Do not write `complete.log`, create `USER_REVIEW.md`, or update the roadmap while repository-fixable R2/R4 work remains.
