feat: expose per-role residency over /hive/native-telemetry (HV-3 prerequisite)

[hardcoreerik]

HV-3 (docs/NATIVE_RUNTIME_HIVE_VALIDATION_PLAN.md) asserts that a role's
residency returns to baseline BETWEEN jobs while its VRAM reservation does not --
the documented decoupling between the two. On a headless worker that assertion
was unobservable: the daemon wired NativeTelemetryProvider to
GetReservationSnapshot() alone, so ActiveCount/ConversationsCreated/Status
existed in-process and nowhere else. Same shape of gap HV-2 found and closed for
admission counters, one level down.

The response stays additive. Reservation fields keep their exact top-level
position because Tools/Hv2SchedulingRunner binds them there, and HV-6 re-runs
that driver unattended 3x -- nesting them to make the payload tidier would break
a driver the campaign depends on for no gain.

AdapterRoleResidency.Binding is projected to display names rather than
serialized whole: it carries absolute GGUF/adapter paths and this endpoint is
unauthenticated (same posture as /hive/info). The phase asserts on role, counts
and status; the worker's local filesystem layout is not part of that and does
not need publishing to any caller that can reach the port.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com

Summary by CodeRabbit

• New Features
  • Added a one-shot headless --leave-hive mode with --yes confirmation and clearer operator output.
  • Introduced HV lifecycle runners (HV-3, HV-4, HV-5 telemetry sweep, HV-6 repeatability) that produce JSON/markdown evidence.
• Bug Fixes
  • Enhanced native telemetry with residency details.
  • Improved VRAM reservation/telemetry correctness to prevent double-counting and impossible totals.
  • Added stronger heartbeat and rejection diagnostics, plus per-task unsatisfiable reasons.
• Documentation
  • Updated the native validation plan for new telemetry and runner behavior.
• Chores / Tests
  • Added a warchief batch launcher and improved warchief storage initialization; expanded automated test coverage.

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 5bf4c59f-eb35-4975-949a-bad120e68d85

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

This PR updates native VRAM admission for resident base weights, expands Hive telemetry and diagnostics, adds HV-3–HV-6 validation drivers, introduces recovery and repeatability tooling, and adds hive departure, warchief storage, detached startup, and runtime log exclusions.

Changes

Native runtime admission and validation

Layer / File(s)	Summary
Reuse-aware admission and reservation accounting OrchestratorIDE/Core/Runtime/OrcScheduler.cs, OrchestratorIDE/Core/Runtime/RuntimeOrchestrator.cs, OrchestratorIDE/Core/Runtime/SessionManager.cs	Admission discounts reused base weights, returns the charged footprint, and avoids double-counting live-probed resident models.
Admission regression coverage OrchestratorIDE.UnitTests/RuntimeOrchestratorTests.cs	Native-load-dependent tests validate shared-base admission and physical reservation bounds.
Native telemetry payload OrchestratorIDE.Daemon/HiveService.cs, OrchestratorIDE/Services/Hive/HiveNodeServer.cs	Telemetry adds projected residency while preserving existing top-level payload ordering.
HV-3 lifecycle runner Tools/Hv3LifecycleRunner/*	Adds sequential and concurrent native lifecycle execution, telemetry sampling, checks, and JSON evidence.
Validation plan results docs/NATIVE_RUNTIME_HIVE_VALIDATION_PLAN.md	Records HV-3 prerequisites, fixes, campaign results, and closure status.

Hive diagnostics and failure handling

Layer / File(s)	Summary
Eligibility explanations and task status OrchestratorIDE/Services/Hive/CampaignContracts.cs, HiveTaskBundle.cs, HiveTaskQueue.cs, OrchestratorIDE.UnitTests/*Ineligibility*	Eligibility failures are explained, retained per worker, and exposed as pending-task diagnostics.
Heartbeat and worker error handling OrchestratorIDE/Services/Hive/HiveTaskQueue.cs, HiveWorkerAgent.cs, HiveMeshHeartbeat.cs, related tests	Heartbeat outcomes and rejection bodies are logged, exception chains are retained, and artifact upload failures fail tasks closed.
Authentication and pairing validation OrchestratorIDE.UnitTests/HiveAuthSignRoundTripTests.cs, HivePairingSecretDerivationTests.cs	Signing, verification, query canonicalization, and pairing-secret derivation are covered by tests.

Validation drivers

Layer / File(s)	Summary
HV-4 recovery runner Tools/Hv4RecoveryRunner/*	Adds kill, disconnect, Ollama, cancellation, recovery, telemetry, and evidence phases.
HV-5 telemetry and failure sweep Tools/Hv5TelemetrySweepRunner/*	Adds telemetry consistency, fallback detection, unsatisfiable-task, and execution-failure checks.
HV-6 repeatability runner Tools/Hv6RepeatabilityRunner/*	Runs validation lanes repeatedly, manages fleet context sizes, and aggregates JSON and Markdown results.
HV-4 and HV-6 campaign records docs/NATIVE_RUNTIME_HIVE_VALIDATION_PLAN.md	Documents recovery coverage, limitations, repeatability lanes, and fleet safeguards.

Hive operations

Layer / File(s)	Summary
Warchief storage wiring Tools/SwarmCli/Program.cs	Warchief mode initializes artifact and model content-addressed stores.
Hive departure and startup OrchestratorIDE.Daemon/Program.cs, start-warchief.bat, .gitignore	Adds confirmed hive departure, detached warchief startup, heartbeat diagnostics, and runtime log exclusions.

Estimated code review effort: 5 (Critical) | ~120 minutes

Sequence Diagram(s)

sequenceDiagram
  participant ValidationRunner
  participant Warchief
  participant Worker
  participant NativeTelemetry
  ValidationRunner->>Warchief: Submit validation campaign
  Warchief->>Worker: Assign native work units
  Worker->>Warchief: Send heartbeats and task results
  ValidationRunner->>Warchief: Poll task status
  ValidationRunner->>NativeTelemetry: Fetch native telemetry
  NativeTelemetry-->>ValidationRunner: Return reservations and residency
  ValidationRunner-->>ValidationRunner: Evaluate checks and write evidence

Loading

Possibly related PRs

• hardcoreerik/TheOrc#70: Both modify the native admission enforcement boundary and EnsureAdmitted behavior.
• hardcoreerik/TheOrc#76: Both modify context-aware VRAM estimation in OrcScheduler.
• hardcoreerik/TheOrc#88: Both modify native telemetry wiring and the /hive/native-telemetry payload.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 41.12% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly states the main telemetry change and its HV-3 purpose, matching the PR's primary objective.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/hv3-residency-telemetry

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 7

🧹 Nitpick comments (1)

OrchestratorIDE/Core/Runtime/RuntimeOrchestrator.cs (1)

317-352: 🚀 Performance & Scalability | 🔵 Trivial | 💤 Low value

Estimate is computed twice per admission.

requiredBytes is computed directly via OrcScheduler.EstimateRequiredBytes(...), then _scheduler.TryAdmit(binding, budget, options, reusesBaseWeights) recomputes the identical estimate internally to reach its decision — including re-parsing the GGUF header (GgufMetadataReader.TryRead) and redoing the KV/compute-buffer math, on every single conversation admission. Correctness is unaffected (both calls use the same inputs), but it's avoidable per-request work on what can be a hot path.

Consider having TryAdmit (or an overload) return/accept the pre-computed byte estimate so EnsureAdmitted doesn't pay for the GGUF header parse twice.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@OrchestratorIDE/Core/Runtime/RuntimeOrchestrator.cs` around lines 317 - 352,
Avoid calculating the admission estimate twice in EnsureAdmitted: reuse the
requiredBytes value produced by OrcScheduler.EstimateRequiredBytes when calling
_scheduler.TryAdmit, either by adding an estimate parameter or returning the
estimate from TryAdmit. Preserve the existing admission decision and
returned-byte behavior while ensuring GGUF parsing and KV/compute-buffer
calculations occur only once per admission.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/NATIVE_RUNTIME_HIVE_VALIDATION_PLAN.md`:
- Around line 512-522: The HV-3 verdict’s Outstanding list skips item (b);
update the enumeration in the section around the HV-3 verdict to use the correct
consecutive item labels, preserving the existing descriptions and scope of the
concurrent second-role and forced role recycle items.

In `@OrchestratorIDE.Daemon/HiveService.cs`:
- Around line 232-253: Update the NativeTelemetryProvider reservation projection
in HiveService to default TotalBytes, ReservedBytes, and AvailableBytes to 0
when the reservation snapshot is null, while leaving Reservations nullable.
Preserve the existing telemetry structure and other field mappings.

In `@OrchestratorIDE.Daemon/Program.cs`:
- Line 40: Update the --leave-hive handling in the argument dispatch to use a
strict HiveIdentity load path that does not regenerate or persist an identity
when decryption or deserialization fails. Catch protector/load failures, report
the error, and exit with a non-zero status; preserve the existing behavior for
--show-identity and --pair.
- Around line 66-93: Update the --leave-hive branch to validate arguments before
any confirmation or mutation: require it to be the sole operational mode, allow
only its explicitly supported flags (including --yes), and reject unknown or
mixed-mode arguments with the existing validation behavior. Ensure invalid
invocations return before identity loading or LeaveHive(), while valid
--leave-hive [--yes] flows retain their current confirmation and success
behavior.
- Around line 88-90: Update the --leave-hive flow around HiveIdentity.LeaveHive
and HiveService coordination so hive membership removal cannot occur while the
daemon is using a cached identity. Require the daemon service to be stopped
before persisting the removal, or implement an explicit coordinated IPC/reload
path that refreshes the daemon’s identity before completion.

In `@start-warchief.bat`:
- Around line 4-8: Update the Warchief launch command in start-warchief.bat to
invoke swarmcli.exe through a detached start with a child cmd /c, rather than
directly from the foreground shell. Keep the existing arguments and ensure log
redirection remains inside the detached child command.

In `@Tools/Hv3LifecycleRunner/Program.cs`:
- Around line 179-259: Scope lifecycle telemetry to the roles under test instead
of aggregating all roles. Update EvaluateSequential and its RunSequentialAsync
call site to accept the tested role and derive MaxConversationsCreated and
related liveness values from matching Residency entries. In RunConcurrentAsync,
project ReservationEntry.Role to display-name strings server-side, then filter
peakReserved and peakReservedRoles to primaryRole and secondaryRole before
evaluating admission. Preserve the existing lifecycle checks while ensuring
stale reservations or conversations from other roles cannot affect their
results.

---

Nitpick comments:
In `@OrchestratorIDE/Core/Runtime/RuntimeOrchestrator.cs`:
- Around line 317-352: Avoid calculating the admission estimate twice in
EnsureAdmitted: reuse the requiredBytes value produced by
OrcScheduler.EstimateRequiredBytes when calling _scheduler.TryAdmit, either by
adding an estimate parameter or returning the estimate from TryAdmit. Preserve
the existing admission decision and returned-byte behavior while ensuring GGUF
parsing and KV/compute-buffer calculations occur only once per admission.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: f60cbb46-a5c9-459f-9dc9-1bb6e3823be2

📥 Commits

Reviewing files that changed from the base of the PR and between a00fcb0 and bebe6c0.

📒 Files selected for processing (12)

• .gitignore
• OrchestratorIDE.Daemon/HiveService.cs
• OrchestratorIDE.Daemon/Program.cs
• OrchestratorIDE.UnitTests/RuntimeOrchestratorTests.cs
• OrchestratorIDE/Core/Runtime/OrcScheduler.cs
• OrchestratorIDE/Core/Runtime/RuntimeOrchestrator.cs
• OrchestratorIDE/Core/Runtime/SessionManager.cs
• OrchestratorIDE/Services/Hive/HiveNodeServer.cs
• Tools/Hv3LifecycleRunner/Hv3LifecycleRunner.csproj
• Tools/Hv3LifecycleRunner/Program.cs
• docs/NATIVE_RUNTIME_HIVE_VALIDATION_PLAN.md
• start-warchief.bat

[coderabbitai]

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
rg -n "GetReservationSnapshot" -B2 -A15 --type=cs

Repository: hardcoreerik/TheOrc

Length of output: 157

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== repo files count =="
git ls-files | wc -l

echo "== locate HiveService.cs =="
fd -a 'HiveService.cs|Program.cs' . | sed 's#^\./##'

echo "== search NativeTelemetry/Reservation/TelemetryProvider =="
rg -n "NativeTelemetry|NativeTelemetryProvider|Reservation|Reservations|AvailableBytes|TotalBytes|RejectedAdmissionCount" -S . --glob '!packages/**' --glob '!bin/**' --glob '!obj/**' | head -200

Repository: hardcoreerik/TheOrc

Length of output: 24931

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== HiveService relevant section =="
cat -n OrchestratorIDE.Daemon/HiveService.cs | sed -n '210,260p'

echo "== RuntimeOrchestrator GetReservationSnapshot implementation =="
cat -n OrchestratorIDE/Core/Runtime/RuntimeOrchestrator.cs | sed -n '400,490p'

echo "== Hv3LifecycleRunner NativeTelemetry and TryFetchTelemetryAsync =="
cat -n Tools/Hv3LifecycleRunner/Program.cs | sed -n '300,500p'

echo "== System.Text.Json behavior probe for long null =="
cat >/tmp/json_probe.cs <<'CS'
using System;
using System.Text.Json;

var jsonOk = "{\"TotalBytes\":0}";
var jsonNull = "{\"TotalBytes\":null}";
var modelType = typeof(MyModel);

try
{
    var ok = JsonSerializer.Deserialize<MyModel>(jsonOk);
    Console.WriteLine($"OK: {ok.TotalBytes}");
}
catch (Exception ex)
{
    Console.WriteLine($"OK failed: {ex.GetType().Name}: {ex.Message}");
}

try
{
    var nil = JsonSerializer.Deserialize<MyModel>(jsonNull);
    Console.WriteLine($"NULL: {nil.TotalBytes}");
}
catch (Exception ex)
{
    Console.WriteLine($"NULL failed: {ex.GetType().Name}: {ex.Message}");
}

public sealed class MyModel { public long TotalBytes { get; set; } }
CS

if command -v dotnet >/dev/null 2>&1; then
  dotnet run --project /tmp/json_probe.cs 2>&1 || true
else
  echo "dotnet not available"
fi

Repository: hardcoreerik/TheOrc

Length of output: 20164

---

🌐 Web query:

System.Text.Json Deserialize long null NullableObjectConverter default JSON null long Error JsonException

💡 Result:

In System.Text.Json, attempting to deserialize a JSON null value into a non-nullable value type (such as long) will throw a JsonException because the internal converter for the type cannot map null to a value type [1][2]. To handle this behavior, you have several primary options: 1. Use Nullable Types: The most idiomatic approach is to change your property type from long to long? (Nullable). System.Text.Json automatically handles nulls for nullable types by assigning them a null value [1][2]. This is the recommended solution for most scenarios [3]. 2. Use a Custom Converter: If you must use a non-nullable type but need to support JSON nulls (e.g., to assign a specific default value), you can implement a custom JsonConverter. By default, the serializer skips calling the converter for null values [1][2]. To change this, you must override the HandleNull property to return true in your custom converter [1][2]. Example of a custom converter that handles null: public class LongConverter: JsonConverter { public override bool HandleNull => true; public override long Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options) { if (reader.TokenType == JsonTokenType.Null) { return 0; // Return your desired default value } return reader.GetInt64; } public override void Write(Utf8JsonWriter writer, long value, JsonSerializerOptions options) { writer.WriteNumberValue(value); } } Important Considerations: - Performance: System.Text.Json optimizes performance by skipping calls to custom converters for null values [1][2]. Overriding HandleNull removes this optimization, so it should only be used when necessary [1][2]. - JsonIgnoreCondition: While JsonIgnoreCondition.WhenWritingNull exists to control serialization, there is no built-in JsonIgnoreCondition.WhenReadingNull to ignore nulls during deserialization; the property will either be set to null (if nullable) or throw an exception (if non-nullable) [4][3]. - Migrating from Newtonsoft: Newtonsoft.Json often handles nulls more permissively depending on configuration. If you are migrating, check your existing attributes and settings, as System.Text.Json enforces stricter type safety [5].

Citations:

• 1: https://github.com/dotnet/docs/blob/main/docs/standard/serialization/system-text-json/converters-how-to.md
• 2: https://learn.microsoft.com/en-us/dotnet/standard/serialization/system-text-json/converters-how-to
• 3: System.Text.Json throws when deserializing JSON null into struct properties. dotnet/runtime#83706
• 4: System.Text.Json -> Deserialize Null to Integer Property dotnet/runtime#74008
• 5: https://learn.microsoft.com/en-us/dotnet/standard/serialization/system-text-json/deserialization

---

Default reserved-byte fields before serializing the telemetry snapshot.

RuntimeOrchestrator.GetReservationSnapshot() can return null when there is no scheduler/budget provider or when the provider throws/returns null. In that case, reservation?.TotalBytes, reservation?.ReservedBytes, and reservation?.AvailableBytes become nullable and are written as JSON null; Tools/Hv3LifecycleRunner/Program.cs’s NativeTelemetry has these non-nullable long properties, so TryFetchTelemetryAsync treats the read as Reachable=false and later maps values to -1.

Default these fields to 0 here so the existing non-nullable client DTO remains parseable while preserving the null Reservations shape.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@OrchestratorIDE.Daemon/HiveService.cs` around lines 232 - 253, Update the
NativeTelemetryProvider reservation projection in HiveService to default
TotalBytes, ReservedBytes, and AvailableBytes to 0 when the reservation snapshot
is null, while leaving Reservations nullable. Preserve the existing telemetry
structure and other field mappings.

[coderabbitai]

🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

Fail closed when loading an identity for --leave-hive.

HiveIdentity.Load() silently regenerates and persists a new identity when decryption or deserialization fails. With this new --leave-hive path using AesGcmSecretProtector, a GUI-owned DPAPI identity can therefore be overwritten and reported as “not currently in a hive” instead of failing safely. Use a strict load path for this command and return a non-zero error on protector/load failure.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@OrchestratorIDE.Daemon/Program.cs` at line 40, Update the --leave-hive
handling in the argument dispatch to use a strict HiveIdentity load path that
does not regenerate or persist an identity when decryption or deserialization
fails. Catch protector/load failures, report the error, and exit with a non-zero
status; preserve the existing behavior for --show-identity and --pair.

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Reject mixed modes and unknown arguments before leaving the hive.

This branch checks only Contains("--leave-hive") and Contains("--yes"), then returns before the unknown-argument validation. For example, --leave-hive --yes --pair ... or a typo appended to the command still performs the destructive operation and ignores the extra arguments. Validate that --leave-hive is the sole mode and that only its allowed flags are present before calling LeaveHive().

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@OrchestratorIDE.Daemon/Program.cs` around lines 66 - 93, Update the
--leave-hive branch to validate arguments before any confirmation or mutation:
require it to be the sole operational mode, allow only its explicitly supported
flags (including --yes), and reject unknown or mixed-mode arguments with the
existing validation behavior. Ensure invalid invocations return before identity
loading or LeaveHive(), while valid --leave-hive [--yes] flows retain their
current confirmation and success behavior.

[coderabbitai]

🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
rg -n -C 4 'HiveIdentity\.Load|LeaveHive|HiveId' \
  OrchestratorIDE.Daemon OrchestratorIDE

Repository: hardcoreerik/TheOrc

Length of output: 50375

---

🏁 Script executed:

#!/bin/bash
# Locate and inspect the one-shot command and daemon startup/HiveService lifecycle.
set -euo pipefail

printf '--- Program.cs around leave command ---\n'
if [ -f OrchestratorIDE.Daemon/Program.cs ]; then
  nl -ba OrchestratorIDE.Daemon/Program.cs | sed -n '1,140p'
fi

printf '\n--- Find HiveService/startup references ---\n'
rg -n -C 3 'class HiveService|HiveService|StartAsync|StopAsync|BackgroundService|IHostApplicationLifetime|LeaveHive|HiveIdentity\.Load|HiveIdentity\.CreateEphemeral' \
  OrchestratorIDE.Daemon/Program.cs OrchestratorIDE.Daemon OrchestratorIDE/Services 2>/dev/null || true

printf '\n--- Show candidate outlines for service/program files ---\n'
for f in $(git ls-files 'OrchestratorIDE.Daemon/Program.cs' 'OrchestratorIDE.Daemon/**/*.cs' 'OrchestratorIDE/Services/**/*.cs' 2>/dev/null); do
  if rg -q 'HiveService|HiveBeacon|HiveMeshHeartbeat|HiveNodeServer|LeaveHive' "$f"; then
    echo "### $f"
    ast-grep outline "$f" --view compact 2>/dev/null | head -80 || true
  fi
done

Repository: hardcoreerik/TheOrc

Length of output: 248

---

🏁 Script executed:

#!/bin/bash
# Locate and inspect the one-shot command and daemon startup/HiveService lifecycle.
set -euo pipefail

printf '--- Program.cs around leave command ---\n'
if [ -f OrchestratorIDE.Daemon/Program.cs ]; then
  nl -ba OrchestratorIDE.Daemon/Program.cs | sed -n '1,140p'
fi

printf '\n--- Find HiveService/startup references ---\n'
rg -n -C 3 'class HiveService|HiveService|StartAsync|StopAsync|BackgroundService|IHostApplicationLifetime|LeaveHive|HiveIdentity\.Load|HiveIdentity\.CreateEphemeral' \
  OrchestratorIDE.Daemon/Program.cs OrchestratorIDE.Daemon OrchestratorIDE/Services 2>/dev/null || true

printf '\n--- Show candidate outlines for service/program files ---\n'
for f in $(git ls-files 'OrchestratorIDE.Daemon/Program.cs' 'OrchestratorIDE/Services/Hive/HiveBeacon.cs' 'OrchestratorIDE/Services/Hive/HiveNodeServer.cs' 2>/dev/null); do
  echo "### $f"
  ast-grep outline "$f" --view compact 2>/dev/null | head -120 || true
done

Repository: hardcoreerik/TheOrc

Length of output: 248

---

🏁 Script executed:

#!/bin/bash
# Locate and inspect the one-shot command and daemon startup/HiveService lifecycle without dash-starting print format strings.
set -euo pipefail

echo '--- Program.cs around leave command ---'
if [ -f OrchestratorIDE.Daemon/Program.cs ]; then
  nl -ba OrchestratorIDE.Daemon/Program.cs | sed -n '1,160p'
fi

echo
echo '--- Find HiveService/startup references ---'
rg -n -C 3 'class HiveService|HiveService|StartAsync|StopAsync|BackgroundService|IHostApplicationLifetime|LeaveHive|HiveIdentity\.Load|HiveIdentity\.CreateEphemeral' \
  OrchestratorIDE.Daemon/Program.cs OrchestratorIDE.Daemon OrchestratorIDE/Services 2>/dev/null || true

echo
echo '--- Show candidate file summaries ---'
for f in OrchestratorIDE.Daemon/Program.cs OrchestratorIDE/Services/Hive/HiveBeacon.cs OrchestratorIDE/Services/Hive/HiveNodeServer.cs; do
  if [ -f "$f" ]; then
    echo "### $f"
    nl -ba "$f" | sed -n '1,220p'
  fi
done

Repository: hardcoreerik/TheOrc

Length of output: 237

---

🏁 Script executed:

#!/bin/bash
# Locate and inspect the one-shot command and daemon startup/HiveService lifecycle using portable tools.
set -euo pipefail

echo '--- Program.cs around leave command ---'
if [ -f OrchestratorIDE.Daemon/Program.cs ]; then
  awk '{printf "%6d\t%s\n", NR, $0}' OrchestratorIDE.Daemon/Program.cs | sed -n '1,160p'
fi

echo
echo '--- Find HiveService/startup references ---'
rg -n -C 3 'class HiveService|HiveService|StartAsync|StopAsync|BackgroundService|IHostApplicationLifetime|LeaveHive|HiveIdentity\.Load|HiveIdentity\.CreateEphemeral' \
  OrchestratorIDE.Daemon/Program.cs OrchestratorIDE.Daemon OrchestratorIDE/Services 2>/dev/null || true

echo
echo '--- Show candidate file summaries ---'
for f in OrchestratorIDE.Daemon/Program.cs OrchestratorIDE/Services/Hive/HiveBeacon.cs OrchestratorIDE/Services/Hive/HiveNodeServer.cs; do
  if [ -f "$f" ]; then
    echo "### $f"
    awk '{printf "%6d\t%s\n", NR, $0}' "$f" | sed -n '1,220p'
  fi
done

Repository: hardcoreerik/TheOrc

Length of output: 50375

---

🏁 Script executed:

#!/bin/bash
# Inspect HiveService lifecycle and the singleton lock implementation without large output.
set -euo pipefail

echo '--- HiveService lifecycle around service startup/stop ---'
awk '{printf "%6d\t%s\n", NR, $0}' OrchestratorIDE.Daemon/HiveService.cs | sed -n '100,220p'
awk '{printf "%6d\t%s\n", NR, $0}' OrchestratorIDE.Daemon/HiveService.cs | sed -n '280,320p'

echo
echo '--- HiveIdentity locks/load implementation ---'
awk '{printf "%6d\t%s\n", NR, $0}' OrchestratorIDE/Services/Hive/HiveIdentity.cs | sed -n '90,280p'

echo
echo '--- Daemon args handling sequence ---'
awk '{printf "%6d\t%s\n", NR, $0}' OrchestratorIDE.Daemon/Program.cs | sed -n '1,210p'

Repository: hardcoreerik/TheOrc

Length of output: 32833

---

Coordinate with the running daemon before persisting hive membership removal.

--leave-hive resets persistence and the current process’s HiveIdentity instance, but HiveService is started by the same binary, and the daemon can cache that loaded identity for its node server/heartbeat lifecycle. If this runs while the long-running daemon is active, beacons/API pairing checks can still use the old HiveId. Require the daemon service to be stopped, or add an explicit IPC/reload path with cross-process coordination.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@OrchestratorIDE.Daemon/Program.cs` around lines 88 - 90, Update the
--leave-hive flow around HiveIdentity.LeaveHive and HiveService coordination so
hive membership removal cannot occur while the daemon is using a cached
identity. Require the daemon service to be stopped before persisting the
removal, or implement an explicit coordinated IPC/reload path that refreshes the
daemon’s identity before completion.

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Sequential/concurrent lifecycle checks aggregate residency/reservation data across ALL roles instead of the role under test.

Hv3TelemetrySample.MaxConversationsCreated (line 444) takes the Max across every residency entry, not just the role being tested (role in RunSequentialAsync). Since HiveService.cs always pre-binds a second role (Researcher) into residency, any prior run on the same long-lived daemon that already bumped that other role's ConversationsCreated will pin Max to a stale constant — breaking fresh-conversation-per-job's strict-increase check with a false FAIL, or satisfying the workDone/residentFootprintSeen liveness gates without the tested role having done anything (the exact vacuous-pass shape this PR explicitly guards against elsewhere).

The same root cause shows up in RunConcurrentAsync's peakReserved/peakReservedRoles (lines 314-338): it counts every currently-reserved role fleet-wide, not just primaryRole/secondaryRole. A stale reservation from an earlier run could make peakReserved >= 2 trivially true even when this run's secondary role was actually denied — a false PASS on precisely the cross-role admission defect HV-3 exists to catch.

The raw per-sample Residency list (role names, already captured) makes the sequential-side fix straightforward:

🛠️ Proposed fix (sequential phase)

-    private static void EvaluateSequential(
-        string workerId, List<Hv3TelemetrySample> samples, int cycles, Hv3Report report)
+    private static void EvaluateSequential(
+        string workerId, List<Hv3TelemetrySample> samples, int cycles, string role, Hv3Report report)
     {
         var afterCycles = samples.Where(s => s.Stage.StartsWith("after-cycle", StringComparison.Ordinal)).ToList();
+        int RoleConversations(Hv3TelemetrySample s) =>
+            s.Residency.FirstOrDefault(r => string.Equals(r.Role, role, StringComparison.OrdinalIgnoreCase))
+                ?.ConversationsCreated ?? 0;
@@
-        var workDone = afterCycles.Any(s => s.Reachable && s.MaxConversationsCreated > 0);
+        var workDone = afterCycles.Any(s => s.Reachable && RoleConversations(s) > 0);
@@
-        var residentFootprintSeen = afterCycles.Any(s => s.MaxConversationsCreated > 0);
+        var residentFootprintSeen = afterCycles.Any(RoleConversations(s) => s > 0);
@@
-        var created = afterCycles.Select(s => s.MaxConversationsCreated).ToList();
+        var created = afterCycles.Select(RoleConversations).ToList();

And update the call site: EvaluateSequential(w.Id, samples, cycles, role, report);

For the concurrent phase, ReservationEntry.Role is a raw numeric RuntimeRole value while primaryRole/secondaryRole are name strings, so a direct filter isn't possible without a name↔int mapping — consider projecting reservation roles as display-name strings server-side (mirroring what Residency.Role already does) so both sides can filter consistently.

Also applies to: 314-338, 350-359, 443-447

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Tools/Hv3LifecycleRunner/Program.cs` around lines 179 - 259, Scope lifecycle
telemetry to the roles under test instead of aggregating all roles. Update
EvaluateSequential and its RunSequentialAsync call site to accept the tested
role and derive MaxConversationsCreated and related liveness values from
matching Residency entries. In RunConcurrentAsync, project ReservationEntry.Role
to display-name strings server-side, then filter peakReserved and
peakReservedRoles to primaryRole and secondaryRole before evaluating admission.
Preserve the existing lifecycle checks while ensuring stale reservations or
conversations from other roles cannot affect their results.

[hardcoreerik]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 15

🧹 Nitpick comments (8)

Tools/Hv6RepeatabilityRunner/Program.cs (1)

454-474: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

No timeout on a lane child process.

await p.WaitForExitAsync() is unbounded, so a single wedged lane runner hangs the entire unattended 3× campaign with no evidence written. A per-lane cap (cancellation token on WaitForExitAsync plus Kill(entireProcessTree: true), recorded as a TIMEOUT verdict) keeps the remaining rounds meaningful.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Tools/Hv6RepeatabilityRunner/Program.cs` around lines 454 - 474, Update
RunLaneAsync to enforce a per-lane timeout by awaiting WaitForExitAsync with a
cancellation token, and on cancellation kill the child process tree. Record the
timeout as a TIMEOUT verdict while preserving stdout/stderr capture and allowing
the campaign to continue.

Tools/Hv4RecoveryRunner/Program.cs (1)

812-822: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win

New HttpClient per telemetry probe inside 2s/3s polling loops.

WaitForTelemetryGoneAsync/WaitForTelemetryAsync call this every couple of seconds for up to 3 minutes, so each phase burns dozens of disposed handlers and their sockets sit in TIME_WAIT. A single static readonly HttpClient with a 10s timeout would do.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Tools/Hv4RecoveryRunner/Program.cs` around lines 812 - 822, The
TryFetchTelemetryAsync method creates and disposes an HttpClient for every
telemetry probe. Reuse a single static readonly HttpClient configured with the
existing 10-second timeout, and update TryFetchTelemetryAsync to use it while
preserving the current request URL, success-status handling, JSON
deserialization, and null-on-error behavior.

Tools/Hv5TelemetrySweepRunner/Program.cs (1)

256-268: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win

Whole log pulled over ssh with Get-Content -Raw into memory.

Worker logs grow unbounded across an HV-6 campaign; a multi-hundred-MB read per box per round is avoidable by doing the matching remotely (Select-String -Pattern ... -SimpleMatch) and returning only hits plus a line count, keeping the quoted Detail behaviour.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Tools/Hv5TelemetrySweepRunner/Program.cs` around lines 256 - 268, The
log-reachability check around the SSH command currently retrieves the entire
worker log into memory. Update this command to perform the required matching
remotely with PowerShell Select-String using the existing pattern and
SimpleMatch, returning only matching hits plus a line count; preserve the
__MISSING__ handling and the existing quoted Detail behavior for reachable and
missing logs.

docs/NATIVE_RUNTIME_HIVE_VALIDATION_PLAN.md (1)

634-634: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

markdownlint MD040: add a language to these fenced blocks.

text is fine for the evidence excerpts and the lane matrix.

Also applies to: 663-663, 703-703, 735-735, 797-797, 872-872

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/NATIVE_RUNTIME_HIVE_VALIDATION_PLAN.md` at line 634, Update the fenced
code blocks at the referenced sections of the validation plan to specify the
text language, using the existing evidence excerpts and lane matrix content
unchanged.

Source: Linters/SAST tools

OrchestratorIDE/Services/Hive/HiveTaskQueue.cs (1)

569-582: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Orphaned doc comment now sits on the wrong method.

The "Atomically selects and claims the best pending task…" summary belonged to HandleLeaseAsync; the new method was inserted between them, so that text now documents RecordIneligibility (whose own summary explicitly says it does not change dispatch), and HandleLeaseAsync at Line 634 is left undocumented. Move it back down.

📝 Proposed fix

-    /// <summary>
-    /// Atomically selects and claims the best pending task that the worker can execute. This
-    /// removes the Phase 3A GET-next/POST-claim race while leaving those endpoints compatible.
-    /// </summary>
     /// <summary>
     /// Records, per pending campaign unit, why the polling worker could not take it, and logs the

and re-attach it immediately above HandleLeaseAsync.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@OrchestratorIDE/Services/Hive/HiveTaskQueue.cs` around lines 569 - 582, Move
the “Atomically selects and claims the best pending task…” XML summary from
above RecordIneligibility to immediately above HandleLeaseAsync. Keep
RecordIneligibility’s existing documentation as its only summary and preserve
the summary text unchanged.

OrchestratorIDE.UnitTests/HiveUnsatisfiableReasonTests.cs (1)

51-51: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

HiveTaskQueue is IDisposable and starts a 10s watchdog timer — dispose it.

Every test constructs one and drops it, leaking a System.Threading.Timer per case; CheckTimeouts can also tick mid-assertion in a slow run and mutate the seeded entry. using var queue = new HiveTaskQueue(); throughout. Same in HiveHeartbeatBookkeepingTests.cs.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@OrchestratorIDE.UnitTests/HiveUnsatisfiableReasonTests.cs` at line 51, Update
all test methods in HiveUnsatisfiableReasonTests and
HiveHeartbeatBookkeepingTests that instantiate HiveTaskQueue so each declaration
uses a using scope, ensuring the disposable queue and its watchdog timer are
released after the test.

OrchestratorIDE/Services/Hive/HiveWorkerAgent.cs (1)

344-377: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

One rejection-body reader, copied into two classes. HiveWorkerAgent.ReadReasonAsync and HiveMeshHeartbeat.ReadRejectionReasonAsync are the same implementation — same 400-char cap, same JSON error extraction, same raw-body fallback, same swallow. Extract a single shared internal static (alongside HiveAuthMiddleware.Clamp is a natural home) so the newline-sanitisation fix and any future hardening land once instead of twice.

• OrchestratorIDE/Services/Hive/HiveWorkerAgent.cs#L344-L377: delete the local copy and call the shared helper from the three sites that use it.
• OrchestratorIDE/Services/Hive/HiveMeshHeartbeat.cs#L232-L262: delete the local copy, call the shared helper, and apply ReplaceLineEndings(" ") to the fallback inside it.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@OrchestratorIDE/Services/Hive/HiveWorkerAgent.cs` around lines 344 - 377,
Extract the duplicate rejection-body parsing from
HiveWorkerAgent.ReadReasonAsync and HiveMeshHeartbeat.ReadRejectionReasonAsync
into one shared internal static helper near HiveAuthMiddleware.Clamp. Preserve
the 400-character cap, JSON error extraction, exception swallowing, and raw-body
fallback, while applying ReplaceLineEndings(" ") to the fallback; delete both
local implementations and update all three HiveWorkerAgent call sites plus the
HiveMeshHeartbeat call site to use the shared helper. Affected sites:
OrchestratorIDE/Services/Hive/HiveWorkerAgent.cs:344-377 and
OrchestratorIDE/Services/Hive/HiveMeshHeartbeat.cs:232-262.

OrchestratorIDE.UnitTests/CampaignIneligibilityExplanationTests.cs (1)

121-121: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Use HiveExecutionKinds.ContainerPack instead of a hand-typed near-miss literal.

"container-pack" (hyphen) is not the real kind — HiveTaskBundle documents the vocabulary as legacy_agent | native_agent | container_pack. The test passes either way because the worker only advertises NativeAgent, but the literal reads as if it were exercising a real kind and would survive a rename of the constant.

♻️ Proposed change

-            ExecutionKind = "container-pack",
+            ExecutionKind = HiveExecutionKinds.ContainerPack,

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@OrchestratorIDE.UnitTests/CampaignIneligibilityExplanationTests.cs` at line
121, In the test setup containing ExecutionKind, replace the hand-typed
"container-pack" literal with the existing HiveExecutionKinds.ContainerPack
constant. Preserve the test’s other configuration and assertions unchanged.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/NATIVE_RUNTIME_HIVE_VALIDATION_PLAN.md`:
- Around line 811-814: Update the mitigation description near the
HardcoreLaptopMSI scenario to state that Hv4RecoveryRunner.Ssh makes three
connection attempts with 10s, 20s, and 30s timeouts and backoff, rather than
saying the driver retries once.
- Around line 861-870: Correct the HV-2/HV-6 design paragraph to match the
shipped `Hv6RepeatabilityRunner` behavior: describe large-context lanes as
running through a separate `--large-only` invocation, with the context size set
once before round 1 and restored once in `finally`. Remove claims about
per-round standard restoration, lane ordering, mid-campaign switching, telemetry
verification, and recording `NOT-RUN`; state that failed reconfiguration throws
and aborts the run.

In `@OrchestratorIDE.UnitTests/HiveHeartbeatBookkeepingTests.cs`:
- Around line 112-121: Replace the short Task.Delay intervals in the heartbeat
advancement tests, including the loop around HeartbeatCoreAsync and
Heartbeat_ForALiveClaim_AdvancesLastHeartbeat, with a sufficiently long delay or
a clock-controlled approach that guarantees DateTime.UtcNow advances before
asserting Is.GreaterThan(last). Preserve the existing heartbeat outcome and
timestamp advancement assertions.

In `@OrchestratorIDE/Services/Hive/HiveMeshHeartbeat.cs`:
- Around line 232-262: Update ReadRejectionReasonAsync so the non-JSON fallback
sanitizes the trimmed remote response by removing or replacing carriage returns
and newlines before returning it for logging. Preserve the existing truncation,
JSON error extraction, and exception-swallowing behavior.

In `@OrchestratorIDE/Services/Hive/HiveTaskQueue.cs`:
- Around line 1065-1102: Update HandleHeartbeatAsync to delegate heartbeat
validation and timestamping entirely to HeartbeatCoreAsync, removing its own
_claimLock acquisition and duplicated claim/token logic. Map
HeartbeatOutcome.NotClaimed and StaleToken to the existing 409 responses and
status payloads, and map Credited to the alive response, preserving null-body
token behavior through the shared method.
- Around line 79-96: Make the IneligibleFor collection in HiveTaskQueue
concurrent-safe by replacing its Dictionary implementation with
ConcurrentDictionary while preserving the existing case-insensitive key comparer
and public property behavior. Ensure RecordIneligibility, HandleLeaseAsync, and
UnsatisfiableReasonFor continue using it without additional locking.

In `@OrchestratorIDE/Services/Hive/HiveWorkerAgent.cs`:
- Around line 490-506: Update UploadOrFailAsync to preserve an existing
execution failure: before replacing status and errorMsg in its general exception
handler, check whether the task is already failed with a recorded error from
ExecuteNativeRoleTaskAsync. Keep the original error and return the empty
artifact list without overwriting taskResult.ErrorMsg; only record the upload
failure when no earlier execution error exists.
- Around line 687-690: Hoist the HttpClient created in the Hive worker beat
logic out of the while loop so a single client is reused for the job’s entire
loop. Keep its 20-second timeout and continue passing it to the blocking Send
call, while preserving the existing request cadence and cancellation behavior.

In `@start-warchief.bat`:
- Around line 43-50: Update the startup block around the cd /d command to abort
immediately when changing to the required SwarmCLI working directory fails.
Ensure the absolute executable launch does not proceed after a failed directory
change, while preserving the existing working-directory and redirect behavior on
success.

In `@Tools/Hv4RecoveryRunner/Program.cs`:
- Around line 882-894: Update the SSH helper in
Tools/Hv4RecoveryRunner/Program.cs:882-894,
Tools/Hv5TelemetrySweepRunner/Program.cs:652-670, and
Tools/Hv6RepeatabilityRunner/Program.cs:426-450 to start asynchronous stdout and
stderr reads concurrently, enforce each existing timeout, kill the entire
process tree on timeout, and await the reads without blocking indefinitely.
Reuse the HV-4 retry behavior in the HV-5 driver, and extract the shared helper
into a linked source file to keep all three drivers consistent.
- Around line 851-861: Update Ssh and its command handling so retries are based
on an explicit success sentinel rather than empty stdout. Ensure silent
side-effecting commands such as Stop-Process and the
Stop-ScheduledTask/Start-ScheduledTask restart append or otherwise return a
consistent sentinel (as disconnect already does with 'unblocked'), while
preserving retry behavior for genuine failures and avoiding repeated execution
after success.

In `@Tools/Hv5TelemetrySweepRunner/Program.cs`:
- Around line 42-48: Update the FallbackMarkers array to remove the bare "11434"
substring and replace it with a marker anchored to an Ollama URL or host shape,
such as ":11434" or "localhost:11434", while preserving the existing fallback
markers.

In `@Tools/Hv6RepeatabilityRunner/Program.cs`:
- Around line 149-159: The round-loop exception path currently lets
reconfiguration or lane-launch failures escape before reports are written. Add a
catch alongside the existing try/finally around the campaign loop, record the
exception details in report.Error, and then allow execution to continue to the
existing JSON/markdown report-writing flow.
- Around line 75-93: Remove the developer-specific fallback values from the
Fleet initialization in Program, including hostnames, Tailscale addresses, task
names, log paths, checkout directories, and worker IDs. Require these values
through the existing argument flow or an environment/JSON fleet configuration,
and fail loudly with a clear validation error when required fleet settings are
missing; preserve only genuinely safe defaults such as the low-VRAM worker
selection when its prerequisite worker configuration is available.
- Around line 217-241: Update the final verdict calculation in the main runner
flow so report.Passed is true only when all rounds pass and report.FleetRestored
is true. Preserve the existing round-count and round-result checks, ensuring a
failed fleet restore produces the failure summary and nonzero exit code.

---

Nitpick comments:
In `@docs/NATIVE_RUNTIME_HIVE_VALIDATION_PLAN.md`:
- Line 634: Update the fenced code blocks at the referenced sections of the
validation plan to specify the text language, using the existing evidence
excerpts and lane matrix content unchanged.

In `@OrchestratorIDE.UnitTests/CampaignIneligibilityExplanationTests.cs`:
- Line 121: In the test setup containing ExecutionKind, replace the hand-typed
"container-pack" literal with the existing HiveExecutionKinds.ContainerPack
constant. Preserve the test’s other configuration and assertions unchanged.

In `@OrchestratorIDE.UnitTests/HiveUnsatisfiableReasonTests.cs`:
- Line 51: Update all test methods in HiveUnsatisfiableReasonTests and
HiveHeartbeatBookkeepingTests that instantiate HiveTaskQueue so each declaration
uses a using scope, ensuring the disposable queue and its watchdog timer are
released after the test.

In `@OrchestratorIDE/Services/Hive/HiveTaskQueue.cs`:
- Around line 569-582: Move the “Atomically selects and claims the best pending
task…” XML summary from above RecordIneligibility to immediately above
HandleLeaseAsync. Keep RecordIneligibility’s existing documentation as its only
summary and preserve the summary text unchanged.

In `@OrchestratorIDE/Services/Hive/HiveWorkerAgent.cs`:
- Around line 344-377: Extract the duplicate rejection-body parsing from
HiveWorkerAgent.ReadReasonAsync and HiveMeshHeartbeat.ReadRejectionReasonAsync
into one shared internal static helper near HiveAuthMiddleware.Clamp. Preserve
the 400-character cap, JSON error extraction, exception swallowing, and raw-body
fallback, while applying ReplaceLineEndings(" ") to the fallback; delete both
local implementations and update all three HiveWorkerAgent call sites plus the
HiveMeshHeartbeat call site to use the shared helper. Affected sites:
OrchestratorIDE/Services/Hive/HiveWorkerAgent.cs:344-377 and
OrchestratorIDE/Services/Hive/HiveMeshHeartbeat.cs:232-262.

In `@Tools/Hv4RecoveryRunner/Program.cs`:
- Around line 812-822: The TryFetchTelemetryAsync method creates and disposes an
HttpClient for every telemetry probe. Reuse a single static readonly HttpClient
configured with the existing 10-second timeout, and update
TryFetchTelemetryAsync to use it while preserving the current request URL,
success-status handling, JSON deserialization, and null-on-error behavior.

In `@Tools/Hv5TelemetrySweepRunner/Program.cs`:
- Around line 256-268: The log-reachability check around the SSH command
currently retrieves the entire worker log into memory. Update this command to
perform the required matching remotely with PowerShell Select-String using the
existing pattern and SimpleMatch, returning only matching hits plus a line
count; preserve the __MISSING__ handling and the existing quoted Detail behavior
for reachable and missing logs.

In `@Tools/Hv6RepeatabilityRunner/Program.cs`:
- Around line 454-474: Update RunLaneAsync to enforce a per-lane timeout by
awaiting WaitForExitAsync with a cancellation token, and on cancellation kill
the child process tree. Record the timeout as a TIMEOUT verdict while preserving
stdout/stderr capture and allowing the campaign to continue.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: fadaf146-1341-4270-ab3f-3a1da002eef0

📥 Commits

Reviewing files that changed from the base of the PR and between bebe6c0 and 76bb267.

📒 Files selected for processing (21)

• OrchestratorIDE.UnitTests/CampaignIneligibilityExplanationTests.cs
• OrchestratorIDE.UnitTests/HiveAuthSignRoundTripTests.cs
• OrchestratorIDE.UnitTests/HiveHeartbeatBookkeepingTests.cs
• OrchestratorIDE.UnitTests/HivePairingSecretDerivationTests.cs
• OrchestratorIDE.UnitTests/HiveUnsatisfiableReasonTests.cs
• OrchestratorIDE.UnitTests/HiveWorkerErrorChainTests.cs
• OrchestratorIDE/Services/Hive/CampaignContracts.cs
• OrchestratorIDE/Services/Hive/HiveMeshHeartbeat.cs
• OrchestratorIDE/Services/Hive/HiveTaskBundle.cs
• OrchestratorIDE/Services/Hive/HiveTaskQueue.cs
• OrchestratorIDE/Services/Hive/HiveWorkerAgent.cs
• Tools/Hv3LifecycleRunner/Program.cs
• Tools/Hv4RecoveryRunner/Hv4RecoveryRunner.csproj
• Tools/Hv4RecoveryRunner/Program.cs
• Tools/Hv5TelemetrySweepRunner/Hv5TelemetrySweepRunner.csproj
• Tools/Hv5TelemetrySweepRunner/Program.cs
• Tools/Hv6RepeatabilityRunner/Hv6RepeatabilityRunner.csproj
• Tools/Hv6RepeatabilityRunner/Program.cs
• Tools/SwarmCli/Program.cs
• docs/NATIVE_RUNTIME_HIVE_VALIDATION_PLAN.md
• start-warchief.bat

🚧 Files skipped from review as they are similar to previous changes (1)

• Tools/Hv3LifecycleRunner/Program.cs

[coderabbitai]

🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

Consider stripping newlines from the untrusted body before logging.

The non-JSON fallback writes a remote peer's raw response text straight into the log line. Embedded \r\n lets a hostile or merely broken peer forge additional log entries in the very diagnostic an operator is reading. Cheap to neutralise:

🛡️ Proposed fix

-            return body.Trim();
+            return body.Trim().ReplaceLineEndings(" ");

The duplication of this helper with HiveWorkerAgent.ReadReasonAsync is covered separately below.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	/// <summary>
	/// Best-effort read of a peer's rejection reason for logging only. Truncated and
	/// exception-swallowing on purpose — an untrusted remote body on a diagnostic path must never
	/// turn a handled HTTP error into a crash.
	/// </summary>
	private static async Task<string?> ReadRejectionReasonAsync(
	HttpResponseMessage response, CancellationToken ct)
	{
	try
	{
	var body = await response.Content.ReadAsStringAsync(ct).ConfigureAwait(false);
	if (string.IsNullOrWhiteSpace(body)) return null;
	if (body.Length > 400) body = body[..400] + "…";
	try
	{
	using var doc = JsonDocument.Parse(body);
	if (doc.RootElement.ValueKind == JsonValueKind.Object
	&& doc.RootElement.TryGetProperty("error", out var err)
	&& err.ValueKind == JsonValueKind.String)
	return err.GetString();
	}
	catch (JsonException) { /* not JSON — fall through to the raw body */ }
	return body.Trim();
	}
	catch
	{
	return null;
	}
	}
	/// <summary>
	/// Best-effort read of a peer's rejection reason for logging only. Truncated and
	/// exception-swallowing on purpose — an untrusted remote body on a diagnostic path must never
	/// turn a handled HTTP error into a crash.
	/// </summary>
	private static async Task<string?> ReadRejectionReasonAsync(
	HttpResponseMessage response, CancellationToken ct)
	{
	try
	{
	var body = await response.Content.ReadAsStringAsync(ct).ConfigureAwait(false);
	if (string.IsNullOrWhiteSpace(body)) return null;
	if (body.Length > 400) body = body[..400] + "…";
	try
	{
	using var doc = JsonDocument.Parse(body);
	if (doc.RootElement.ValueKind == JsonValueKind.Object
	&& doc.RootElement.TryGetProperty("error", out var err)
	&& err.ValueKind == JsonValueKind.String)
	return err.GetString();
	}
	catch (JsonException) { /* not JSON — fall through to the raw body */ }
	return body.Trim().ReplaceLineEndings(" ");
	}
	catch
	{
	return null;
	}
	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@OrchestratorIDE/Services/Hive/HiveMeshHeartbeat.cs` around lines 232 - 262,
Update ReadRejectionReasonAsync so the non-JSON fallback sanitizes the trimmed
remote response by removing or replacing carriage returns and newlines before
returning it for logging. Preserve the existing truncation, JSON error
extraction, and exception-swallowing behavior.

[coderabbitai]

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Fleet hostnames, Tailscale IPs and local checkout paths are baked in as defaults.

http://100.102.190.112:7078, F:\Ai\OrchestratorIDE-dev, task names, etc. are one developer's environment committed as the fallback for every argument. Anyone running without flags silently targets that fleet. Prefer required arguments (or an env/JSON fleet file) so a missing flag fails loudly instead of resolving to someone else's machines.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Tools/Hv6RepeatabilityRunner/Program.cs` around lines 75 - 93, Remove the
developer-specific fallback values from the Fleet initialization in Program,
including hostnames, Tailscale addresses, task names, log paths, checkout
directories, and worker IDs. Require these values through the existing argument
flow or an environment/JSON fleet configuration, and fail loudly with a clear
validation error when required fleet settings are missing; preserve only
genuinely safe defaults such as the low-VRAM worker selection when its
prerequisite worker configuration is available.

[hardcoreerik]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 3

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (4)

docs/NATIVE_RUNTIME_HIVE_VALIDATION_PLAN.md (1)

795-806: 🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win

Do not claim cross-machine coverage for single-machine lanes.

The heading says “PASS on BOTH machines,” but disconnect and cancel ran only on HardcorePC. The final verdict should distinguish the cross-machine kill/Ollama coverage from the HardcorePC-only lanes.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/NATIVE_RUNTIME_HIVE_VALIDATION_PLAN.md` around lines 795 - 806, Update
the “Results” heading and summary in the validation plan to distinguish lanes
executed on both HardcorePC and HardcoreLaptopMSI from the HardcorePC-only
disconnect and cancel lanes. Preserve the existing PASS outcomes, but explicitly
label kill and ollama as cross-machine coverage and disconnect and cancel as
HardcorePC-only.

OrchestratorIDE.UnitTests/RuntimeOrchestratorTests.cs (1)

261-275: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Derive the test budget from the scheduler’s actual estimates.

Line 265 assumes all context, CUDA, and compute costs fit in 40% of the GGUF size. Smaller valid GGUFs can exceed that allowance, causing the first admission to fail before this test reaches shared-base reuse. Size the synthetic card from fresh and reused estimates instead.

Proposed fix

-        var loaded = false;
-        var totalBytes = (long)(sizeBytes * 1.4);
+        var options = new RuntimeOptions(ContextLength: 2048, GpuLayers: -1);
+        var freshBytes = OrcScheduler.EstimateRequiredBytes(workerBinding, options);
+        var reusedBytes = OrcScheduler.EstimateRequiredBytes(
+            researcherBinding, options, baseWeightsAlreadyResident: true);
+        Assert.That(reusedBytes, Is.GreaterThan(0).And.LessThan(freshBytes));
+
+        var loaded = false;
+        var totalBytes = checked(freshBytes + reusedBytes);
         VramBudget Provider() => new(totalBytes, loaded ? sizeBytes : 0L);
@@
-        var options = new RuntimeOptions(ContextLength: 2048, GpuLayers: -1);

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@OrchestratorIDE.UnitTests/RuntimeOrchestratorTests.cs` around lines 261 -
275, Update the budget setup in the test around Provider and the
RuntimeOptions-based admission flow to derive totalBytes from the scheduler’s
actual fresh and reused estimates, rather than multiplying sizeBytes by 1.4.
Ensure the synthetic VRAM budget admits one fresh model plus the reused-context
increment while still rejecting two full model copies, so the test consistently
exercises shared-base reuse for all valid GGUF sizes.

Tools/Hv6RepeatabilityRunner/Program.cs (2)

367-397: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Retrying the fleet reconfiguration command can re-trigger the worker restart it just performed.

The doc comment above Ssh (Lines 431-439) explicitly calls out this exact risk — "the underlying command also stops/starts a scheduled task, and a spurious retry of THAT is exactly the class of bug that turned a single kill into three in Hv4RecoveryRunner" — but Line 382-389 still hands the combined rewrite+restart+read-back as a single string to the retrying Ssh() helper. If the SSH connection drops after the remote script already stopped/restarted the task but before the local process observed the done-marker (exactly the kind of flakiness this file documents for HardcoreLaptopMSI), Ssh()'s retry will re-run the whole script, restarting the worker again mid-campaign.

Split the non-idempotent "act" step (single best-effort attempt) from the read-only "verify" step (safe to retry).

🛠️ Proposed fix

-            var readBack = await Ssh(ssh,
-                "powershell -NoProfile -Command \"" +
-                $"(Get-Content '{script}') -replace 'NATIVECONTEXTSIZE=\\d+','NATIVECONTEXTSIZE={contextSize}' " +
-                $"| Set-Content '{script}'; " +
-                $"Stop-ScheduledTask -TaskName {task} -ErrorAction SilentlyContinue; Start-Sleep -Seconds 3; " +
-                "Get-Process theorc-warband -ErrorAction SilentlyContinue | Stop-Process -Force; " +
-                $"Start-Sleep -Seconds 2; Start-ScheduledTask -TaskName {task}; Start-Sleep -Seconds 12; " +
-                $"(Select-String -Path '{script}' -Pattern 'NATIVECONTEXTSIZE=(\\d+)').Matches.Groups[1].Value\"");
-
-            var applied = readBack.Trim();
+            // Single best-effort attempt — restarting the worker is NOT safe to silently re-run,
+            // so this must never go through Ssh()'s retry loop.
+            await SshOnce(ssh,
+                "powershell -NoProfile -Command \"" +
+                $"(Get-Content '{script}') -replace 'NATIVECONTEXTSIZE=\\d+','NATIVECONTEXTSIZE={contextSize}' " +
+                $"| Set-Content '{script}'; " +
+                $"Stop-ScheduledTask -TaskName {task} -ErrorAction SilentlyContinue; Start-Sleep -Seconds 3; " +
+                "Get-Process theorc-warband -ErrorAction SilentlyContinue | Stop-Process -Force; " +
+                $"Start-Sleep -Seconds 2; Start-ScheduledTask -TaskName {task}; Start-Sleep -Seconds 12\"",
+                connectTimeoutSec: 30);
+
+            // Read-only — safe to retry.
+            var readBack = await Ssh(ssh,
+                $"powershell -NoProfile -Command \"(Select-String -Path '{script}' " +
+                "-Pattern 'NATIVECONTEXTSIZE=(\\d+)').Matches.Groups[1].Value\"");
+
+            var applied = readBack.Trim();

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Tools/Hv6RepeatabilityRunner/Program.cs` around lines 367 - 397, Update
SetFleetContextSizeAsync so the non-idempotent rewrite and worker restart
command is issued only once, without the retrying Ssh helper; then perform the
read-only NATIVECONTEXTSIZE verification in a separate Ssh call that may retry
safely. Preserve the existing applied-value comparison and failure reporting for
each worker.

---

499-519: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

No timeout on lane child-process execution — a hung lane blocks the whole unattended campaign.

Unlike SshOnce, which enforces a 180s deadline via CancellationTokenSource, await p.WaitForExitAsync() here has none. HV-6 exists specifically to run 3 rounds unattended; if any lane (hv1..hv5) hangs, the entire multi-round run stalls indefinitely with no evidence written until someone notices and kills it manually.

🛠️ Proposed fix

         using var p = Process.Start(psi)!;
         // Read both streams concurrently. Reading one to completion first can deadlock the child
         // once the other pipe's buffer fills, and these lanes are chatty enough to reach it.
         var stdoutTask = p.StandardOutput.ReadToEndAsync();
         var stderrTask = p.StandardError.ReadToEndAsync();
-        await p.WaitForExitAsync();
+        using var cts = new CancellationTokenSource(TimeSpan.FromMinutes(15));
+        try
+        {
+            await p.WaitForExitAsync(cts.Token);
+        }
+        catch (OperationCanceledException)
+        {
+            try { p.Kill(entireProcessTree: true); } catch { /* best-effort */ }
+        }
         var stdout = await stdoutTask;
         var stderr = await stderrTask;
         if (!string.IsNullOrWhiteSpace(stderr)) stdout += "\n[stderr]\n" + stderr;
-        return (p.ExitCode, stdout);
+        return (cts.IsCancellationRequested ? -1 : p.ExitCode, stdout);
     }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Tools/Hv6RepeatabilityRunner/Program.cs` around lines 499 - 519, Update
RunLaneAsync to enforce a finite timeout while awaiting the child process,
matching the existing SshOnce 180-second deadline behavior. Use cancellation or
equivalent timeout handling around p.WaitForExitAsync, ensure a timed-out lane
is terminated and its captured output is still returned or reported, and
preserve the concurrent stdout/stderr draining.

🧹 Nitpick comments (1)

Tools/Hv6RepeatabilityRunner/Program.cs (1)

430-495: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Ssh/SshOnce are duplicated near-verbatim across Hv4RecoveryRunner, Hv5TelemetrySweepRunner, and this file.

Per the cross-file graph context, the same retry/backoff and done-marker parsing logic exists in Tools/Hv4RecoveryRunner/Program.cs and Tools/Hv5TelemetrySweepRunner/Program.cs. This diff's own comment (Lines 431-439) shows fixes are being ported by hand between copies — a shared Tools-level SSH helper library would let a fix land once instead of needing to be replicated (and re-verified) in each runner.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Tools/Hv6RepeatabilityRunner/Program.cs` around lines 430 - 495, Extract the
duplicated Ssh and SshOnce retry, timeout, marker, and output-parsing logic into
a shared helper under Tools, then update Hv4RecoveryRunner,
Hv5TelemetrySweepRunner, and Hv6RepeatabilityRunner to use it. Preserve the
existing retry/backoff behavior, SshDoneMarker handling, stderr draining, and
failure results while removing the near-identical private implementations from
each runner.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/NATIVE_RUNTIME_HIVE_VALIDATION_PLAN.md`:
- Line 937: Update the fenced code block in
NATIVE_RUNTIME_HIVE_VALIDATION_PLAN.md to include the text language identifier
after its opening fence, preserving the block’s contents.
- Around line 957-973: Update the HV-6 verdict in the document to explicitly
retain the unresolved HardcorePC hv3-sequential anomaly as a remaining failure,
alongside the HardcoreLaptopMSI SSH issue. Revise the “Every remaining failure”
statement so it does not attribute all failures solely to HardcoreLaptopMSI, and
preserve the requirement that the [9, 9, 10] anomaly remains open until a rerun
resolves it.

In `@OrchestratorIDE.UnitTests/RuntimeOrchestratorTests.cs`:
- Around line 209-226: Update both GetConversationForBindingAsync calls in the
test to pass explicit RuntimeOptions so EstimateRequiredBytes uses the
context-aware reuse path. After the first call, assert the worker reservation is
greater than sizeBytes, then retain the existing afterReuse >= afterFirstLoad
assertion to verify the ledger does not shrink.

---

Outside diff comments:
In `@docs/NATIVE_RUNTIME_HIVE_VALIDATION_PLAN.md`:
- Around line 795-806: Update the “Results” heading and summary in the
validation plan to distinguish lanes executed on both HardcorePC and
HardcoreLaptopMSI from the HardcorePC-only disconnect and cancel lanes. Preserve
the existing PASS outcomes, but explicitly label kill and ollama as
cross-machine coverage and disconnect and cancel as HardcorePC-only.

In `@OrchestratorIDE.UnitTests/RuntimeOrchestratorTests.cs`:
- Around line 261-275: Update the budget setup in the test around Provider and
the RuntimeOptions-based admission flow to derive totalBytes from the
scheduler’s actual fresh and reused estimates, rather than multiplying sizeBytes
by 1.4. Ensure the synthetic VRAM budget admits one fresh model plus the
reused-context increment while still rejecting two full model copies, so the
test consistently exercises shared-base reuse for all valid GGUF sizes.

In `@Tools/Hv6RepeatabilityRunner/Program.cs`:
- Around line 367-397: Update SetFleetContextSizeAsync so the non-idempotent
rewrite and worker restart command is issued only once, without the retrying Ssh
helper; then perform the read-only NATIVECONTEXTSIZE verification in a separate
Ssh call that may retry safely. Preserve the existing applied-value comparison
and failure reporting for each worker.
- Around line 499-519: Update RunLaneAsync to enforce a finite timeout while
awaiting the child process, matching the existing SshOnce 180-second deadline
behavior. Use cancellation or equivalent timeout handling around
p.WaitForExitAsync, ensure a timed-out lane is terminated and its captured
output is still returned or reported, and preserve the concurrent stdout/stderr
draining.

---

Nitpick comments:
In `@Tools/Hv6RepeatabilityRunner/Program.cs`:
- Around line 430-495: Extract the duplicated Ssh and SshOnce retry, timeout,
marker, and output-parsing logic into a shared helper under Tools, then update
Hv4RecoveryRunner, Hv5TelemetrySweepRunner, and Hv6RepeatabilityRunner to use
it. Preserve the existing retry/backoff behavior, SshDoneMarker handling, stderr
draining, and failure results while removing the near-identical private
implementations from each runner.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: c7cb7bdb-ea14-453f-83e2-8f0d953faf19

📥 Commits

Reviewing files that changed from the base of the PR and between 76bb267 and 20f1a57.

📒 Files selected for processing (9)

• OrchestratorIDE.UnitTests/HiveHeartbeatBookkeepingTests.cs
• OrchestratorIDE.UnitTests/RuntimeOrchestratorTests.cs
• OrchestratorIDE/Core/Runtime/RuntimeOrchestrator.cs
• OrchestratorIDE/Services/Hive/HiveTaskQueue.cs
• Tools/Hv4RecoveryRunner/Program.cs
• Tools/Hv5TelemetrySweepRunner/Program.cs
• Tools/Hv6RepeatabilityRunner/Program.cs
• docs/NATIVE_RUNTIME_HIVE_VALIDATION_PLAN.md
• start-warchief.bat

🚧 Files skipped from review as they are similar to previous changes (6)

• OrchestratorIDE.UnitTests/HiveHeartbeatBookkeepingTests.cs
• start-warchief.bat
• Tools/Hv5TelemetrySweepRunner/Program.cs
• OrchestratorIDE/Services/Hive/HiveTaskQueue.cs
• Tools/Hv4RecoveryRunner/Program.cs
• OrchestratorIDE/Core/Runtime/RuntimeOrchestrator.cs

[coderabbitai]

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Add a language identifier to the fenced block.

Use a lexer such as text after the opening fence so markdownlint MD040 passes.

🧰 Tools

🪛 markdownlint-cli2 (0.23.0)

[warning] 937-937: Fenced code blocks should have a language specified

(MD040, fenced-code-language)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/NATIVE_RUNTIME_HIVE_VALIDATION_PLAN.md` at line 937, Update the fenced
code block in NATIVE_RUNTIME_HIVE_VALIDATION_PLAN.md to include the text
language identifier after its opening fence, preserving the block’s contents.

Source: Linters/SAST tools

[coderabbitai]

🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win

Retain the unresolved HardcorePC HV-3 anomaly in the final verdict.

The table records hv3-sequential as FAIL in R1, and Lines 957-965 attribute it to HardcorePC’s [9, 9, 10] conversation count. Therefore, “every remaining failure” being a HardcoreLaptopMSI SSH issue is inaccurate; keep this internal anomaly explicitly open unless a rerun resolves it.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/NATIVE_RUNTIME_HIVE_VALIDATION_PLAN.md` around lines 957 - 973, Update
the HV-6 verdict in the document to explicitly retain the unresolved HardcorePC
hv3-sequential anomaly as a remaining failure, alongside the HardcoreLaptopMSI
SSH issue. Revise the “Every remaining failure” statement so it does not
attribute all failures solely to HardcoreLaptopMSI, and preserve the requirement
that the [9, 9, 10] anomaly remains open until a rerun resolves it.

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Exercise the reuse estimate rather than legacy admission.

Lines 209 and 218 omit RuntimeOptions; that keeps EstimateRequiredBytes on its legacy full-file-size path for both calls. The ledger would therefore remain unchanged even if the Math.Max floor regressed, so this test does not cover the reported shrink scenario. Pass explicit context options to both calls and assert the first reservation exceeds sizeBytes to prove the context-aware path ran.

Proposed fix

+        var options = new RuntimeOptions(ContextLength: 2048, GpuLayers: -1);
+
-        using (await orchestrator.GetConversationForBindingAsync(workerBinding).ConfigureAwait(false))
+        using (await orchestrator.GetConversationForBindingAsync(workerBinding, options).ConfigureAwait(false))
         {
         }
         var afterFirstLoad = orchestrator.GetReservationSnapshot()!.Reservations
             .Single(r => r.Role == RuntimeRole.Worker).Bytes;
-        Assert.That(afterFirstLoad, Is.GreaterThan(0), "first (fresh) load must reserve something");
+        Assert.That(afterFirstLoad, Is.GreaterThan(sizeBytes),
+            "the fresh context-aware admission must include non-model allocation costs");
 
-        using (await orchestrator.GetConversationForBindingAsync(workerBinding).ConfigureAwait(false))
+        using (await orchestrator.GetConversationForBindingAsync(workerBinding, options).ConfigureAwait(false))
         {
         }

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	using (await orchestrator.GetConversationForBindingAsync(workerBinding).ConfigureAwait(false))
	{
	}
	var afterFirstLoad = orchestrator.GetReservationSnapshot()!.Reservations
	.Single(r => r.Role == RuntimeRole.Worker).Bytes;
	Assert.That(afterFirstLoad, Is.GreaterThan(0), "first (fresh) load must reserve something");
	// Same role, same binding, base weights now resident from the call above -- this is the
	// reuse admission whose returned requiredBytes is smaller than the first call's.
	using (await orchestrator.GetConversationForBindingAsync(workerBinding).ConfigureAwait(false))
	{
	}
	var afterReuse = orchestrator.GetReservationSnapshot()!.Reservations
	.Single(r => r.Role == RuntimeRole.Worker).Bytes;
	Assert.That(afterReuse, Is.GreaterThanOrEqualTo(afterFirstLoad),
	"the role's ledger entry must never shrink within the same generation -- the resident " +
	"base model this role itself loaded has not gone anywhere just because THIS call reused it");
	var options = new RuntimeOptions(ContextLength: 2048, GpuLayers: -1);
	using (await orchestrator.GetConversationForBindingAsync(workerBinding, options).ConfigureAwait(false))
	{
	}
	var afterFirstLoad = orchestrator.GetReservationSnapshot()!.Reservations
	.Single(r => r.Role == RuntimeRole.Worker).Bytes;
	Assert.That(afterFirstLoad, Is.GreaterThan(sizeBytes),
	"the fresh context-aware admission must include non-model allocation costs");
	// Same role, same binding, base weights now resident from the call above -- this is the
	// reuse admission whose returned requiredBytes is smaller than the first call's.
	using (await orchestrator.GetConversationForBindingAsync(workerBinding, options).ConfigureAwait(false))
	{
	}
	var afterReuse = orchestrator.GetReservationSnapshot()!.Reservations
	.Single(r => r.Role == RuntimeRole.Worker).Bytes;
	Assert.That(afterReuse, Is.GreaterThanOrEqualTo(afterFirstLoad),
	"the role's ledger entry must never shrink within the same generation -- the resident " +
	"base model this role itself loaded has not gone anywhere just because THIS call reused it");

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@OrchestratorIDE.UnitTests/RuntimeOrchestratorTests.cs` around lines 209 -
226, Update both GetConversationForBindingAsync calls in the test to pass
explicit RuntimeOptions so EstimateRequiredBytes uses the context-aware reuse
path. After the first call, assert the worker reservation is greater than
sizeBytes, then retain the existing afterReuse >= afterFirstLoad assertion to
verify the ledger does not shrink.