<!-- task=m-openai-compatible-output-validation-filters/03_repeat_guard_s07_remote_evidence plan=5 tag=REVIEW_OFR-S07-STALE-LEASE-5 -->

# Settle the stale OneXPlayer lease before one isolated S07 run

## For the Implementing Agent

Filling every implementation-owned section in `CODE_REVIEW-cloud-G10.md` is mandatory. Execute this packet once within its mutation and invocation limits, record actual sanitized output and exit status, leave the active PLAN/CODE_REVIEW pair in place, and stop for official review.

If a preflight fails, record the exact blocker, attempted command/output, mutation count, invocation count, and resume condition in implementation-owned evidence fields. Do not ask the user, call user-input tools, create control-plane stop files, classify the next state, archive logs, write `complete.log`, or modify roadmap state.

This packet authorizes exactly one stop and one session-independent `Win32_Process.Create` launch of only the OneXPlayer `iop-node.exe` process after the bounded stale-lease gate passes. It leaves Lemonade, the loaded model, the Edge, the Control Plane, configuration, credentials, and every other Node untouched. After both providers return healthy and idle, it authorizes at most one new caller-owned foreground S07 invocation. Neither the Node generation reset nor the model invocation may be retried.

## Background

The pinned Control Plane image now exposes the current provider-snapshot contract and all four nodes are connected, but the S07 launch gate remains blocked by `onexplayer-lemonade capacity=3, in_flight=1, queued=0`. Fresh review probes found no S07 harness, found both Windows stacks ready, and found no OneXPlayer stream-gate activity after the latest request reached `release_committed` and `terminal_committed`. The unchanged lease is therefore stale Edge accounting, not an active S07 request. Disconnecting and reconnecting only the OneXPlayer Node creates the generation boundary implemented by `model_queue_release.go`, after which the packet may proceed only if the Control Plane reports both selected providers idle.

## Archive Evidence Snapshot

- `plan_cloud_G08_0.log` / `code_review_cloud_G08_0.log`: authentication blocker; `invocation_count=0`.
- `plan_cloud_G08_1.log` / `code_review_cloud_G08_1.log`: one consumed incomplete invocation; no accepted summary.
- `user_review_1.log`: resolved authorization/replan boundary and zero-provider-snapshot diagnosis.
- `plan_cloud_G09_2.log` / `code_review_cloud_G09_2.log`: no-change Edge apply left provider snapshots absent; `invocation_count=0`.
- `plan_cloud_G10_3.log` / `code_review_cloud_G10_3.log`: the rebuilt image came from the wrong sibling checkout and still exposed no provider snapshots; `invocation_count=0`.
- `plan_cloud_G10_4.log` / `code_review_cloud_G10_4.log`: the pinned image and current status contract were restored, but OneXPlayer remained at `in_flight=1`; three latest OneXPlayer correlations were terminal, the harness was absent, and `invocation_count=0`.
- Preserve all existing `/tmp/iop-repeat-guard-live/repeat-guard-task-03-*` artifacts. The only new result path is `/tmp/iop-repeat-guard-live/repeat-guard-task-03-plan-5`.

## Roadmap Targets

- Milestone: `agent-roadmap/phase/knowledge-tool-optimization-extension/milestones/openai-compatible-output-validation-filters.md`
- Milestone link: [Milestone document](agent-roadmap/phase/knowledge-tool-optimization-extension/milestones/openai-compatible-output-validation-filters.md)
- Task ids:
  - `repeat-guard`: rolling content/history/action repetition detection and safe continuation
- Completion mode: check-on-pass

## Analysis

### Files Read

- `apps/edge/internal/service/model_queue_release.go`
- `apps/edge/internal/service/provider_tunnel.go`
- `apps/edge/internal/service/status_provider.go`
- `apps/edge/internal/openai/provider_tunnel.go`
- `apps/edge/internal/openai/stream_gate_vertical_slice_test.go`
- `apps/edge/internal/service/queue_reservation_test.go`
- `agent-contract/inner/control-plane-edge-wire.md`
- `agent-contract/inner/edge-config-runtime-refresh.md`
- `agent-contract/inner/edge-node-runtime-wire.md`
- `agent-contract/outer/openai-compatible-api.md`
- `agent-spec/runtime/stream-evidence-gate.md`
- `agent-spec/runtime/provider-pool-config-refresh.md`
- `agent-spec/control/control-plane-operations.md`
- `agent-spec/runtime/edge-node-execution.md`
- `agent-spec/input/openai-compatible-surface.md`
- `agent-roadmap/phase/knowledge-tool-optimization-extension/PHASE.md`
- `agent-roadmap/phase/knowledge-tool-optimization-extension/milestones/openai-compatible-output-validation-filters.md`
- `agent-roadmap/sdd/knowledge-tool-optimization-extension/openai-compatible-output-validation-filters/SDD.md`
- `agent-test/local/rules.md`
- `agent-test/local/edge-smoke.md`
- `agent-test/dev/node-smoke.md`
- `agent-test/dev/edge-smoke.md`
- `agent-task/m-openai-compatible-output-validation-filters/03_repeat_guard_s07_remote_evidence/plan_cloud_G10_4.log`
- `agent-task/m-openai-compatible-output-validation-filters/03_repeat_guard_s07_remote_evidence/code_review_cloud_G10_4.log`

### SDD Criteria

- SDD status is `[승인됨]` and its lock is `해제`.
- S03/S04 define deterministic repeat-guard continuation and safe-stop behavior. S07 requires a dev `ornith:35b`, `stream=true`, capacity+1 smoke for at least three runs and accepts either a sanitized fingerprint/offset or `not_reproduced`.
- This packet closes only the remaining S07 live-evidence gap with one 5-concurrent x 3-run invocation, 15 provider-response ids, 15 Edge correlation ids, three capacity rows, accepted result classification, idle cleanup, and raw-free evidence.
- PASS reports only `repeat-guard`; it does not claim the broader `ops-evidence` row.

### Verification Context

- Runner/workdir: `ssh toki@toki-labs.com`, `/Users/toki/agent-work/iop-dev`, Darwin/arm64, login zsh. OneXPlayer is `r0bin@192.168.0.59`; RTX5090 uses `iop-dev-rtx5090`.
- Source remains clean at feature HEAD `750cb1d1cb88066a10d3c703c99f1326306d8e15`; `stream_gate_vertical_slice_test.go` SHA-256 is `46261bb3a3000e00c27c419682f741c64c31c849d0aa30cbc024ed4531e7bfa6`.
- The active Control Plane container is healthy and labeled `iop.source.repo=iop-dev`, `iop.source.head=750cb1d1cb88066a10d3c703c99f1326306d8e15`; its binary contains the `provider_snapshots` contract.
- Reviewer sampling found four connected nodes on three consecutive checks. OneXPlayer stayed `capacity=3, in_flight=1, queued=0`; RTX5090 stayed `capacity=1, in_flight=0, queued=0`.
- The latest OneXPlayer stream-gate activity is correlation `req.manual-1785372720434474000`, ending with `release_committed` and `terminal_committed` at timestamp `1785372836.4734988`. No later OneXPlayer observation was present.
- Direct OneXPlayer status reports one Node process and a ready, healthy, model-loaded, publicly listening, Edge-connected provider stack. The S07 harness is absent. Together with the terminal Edge lifecycle, that is sufficient bounded evidence that the retained lease is stale.
- The current OneXPlayer Node command is `"C:\Users\r0bin\iop-field\iop-node.exe" serve --config "C:\Users\r0bin\iop-field\node.yaml"`. The packet reproduces only that command through `Win32_Process.Create`.
- `model_queue_release.go` settles leases by Node generation during disconnect. Focused tests `TestModelQueueNodeDisconnectReleasesInflight`, `TestDisconnectFencesOnlyMatchingGeneration`, and `TestDisconnectSettlesOldLeaseWhenNewGenerationAlreadyReserved` verify the relevant invariant before the remote mutation.
- Credential handling remains host-local: decrypt token ref `toki-dev-pi` only inside `set +x`, never print the token, token hash, or Authorization header.
- `/tmp/iop-repeat-guard-live/repeat-guard-task-03-plan-5` is absent. There is no plan-4 model artifact because plan 4 stopped before invocation.

### Test Coverage Gaps

- Deterministic tests cover generation-scoped disconnect settlement, repeat detection, observation correlation/quiescence, capacity evidence, authentication injection, SSE validation, result classification, and raw-free summary generation.
- No local test proves that the current live OneXPlayer lease will settle across its real Node generation. The bounded one-process restart plus post-reconnect status gate closes that operational boundary.
- Only the existing `TestDevRepeatGuardOrnithSmoke` closes the probabilistic S07 capacity/cardinality/cleanup gap. Synthetic summaries, degraded capacity, detached processes, and retries are not accepted.

### Symbol References

- `(*Service).releaseModelQueueProviderLeasesForNodeGeneration` in `apps/edge/internal/service/model_queue_release.go`
- `TestModelQueueNodeDisconnectReleasesInflight` in `apps/edge/internal/service/model_queue_admission_test.go`
- `TestDisconnectFencesOnlyMatchingGeneration` and `TestDisconnectSettlesOldLeaseWhenNewGenerationAlreadyReserved` in `apps/edge/internal/service/queue_reservation_test.go`
- `TestDevRepeatGuardOrnithSmoke` in `apps/edge/internal/openai/stream_gate_vertical_slice_test.go`

### Split Judgment

Keep the generation reset and S07 run in one packet. The one-use model invocation is valid only against the idle provider generation proven immediately after reconnect, so splitting would sever the evidence invariant.

### Scope Rationale

- The only workspace write is implementation evidence in `CODE_REVIEW-cloud-G10.md`.
- Remote mutation is limited to one OneXPlayer `iop-node.exe` stop, one `Win32_Process.Create`, and the fresh plan-5 harness artifact.
- Lemonade, the loaded model, Control Plane, Edge, configuration, credentials, source, other Nodes, prior artifacts, roadmap, and sibling checkouts are excluded.

### Final Routing

- `evaluation_mode=isolated-reassessment`; finalizer `finalize-task-policy.sh`, mode `pair`.
- Build closures and review closures are complete. Scores `2/2/2/2/2` route both build and official review to cloud G10.
- Build basis is `grade-boundary`; review basis is `official-review`.
- `large_indivisible_context=false`; matched loop risks are `temporal_state`, `concurrent_consistency`, `boundary_contract`, and `structured_interpretation`.
- Recovery signals are `review_rework_count=5` and `evidence_integrity_failure=false`; risk and recovery boundaries match.
- Canonical files are `PLAN-cloud-G10.md` and `CODE_REVIEW-cloud-G10.md`; review adapter `codex`, model `gpt-5.6-sol`, reasoning effort `xhigh`.

## Implementation Checklist

- [ ] [REVIEW_OFR-S07-STALE-LEASE-5-1] Revalidate the bounded stale-lease evidence, pass the focused generation-settlement tests, then stop and recreate only the OneXPlayer Node process exactly once and require a new connected generation with both selected providers healthy and idle at capacities `3+1`.
- [ ] [REVIEW_OFR-S07-STALE-LEASE-5-2] Only after the generation/status gate passes, start exactly one caller-owned foreground 5-concurrent x 3-run S07 invocation on the fresh plan-5 path, validate the raw-free summary and idle cleanup, and preserve every prior artifact.
- [ ] Fill implementation-owned sections in CODE_REVIEW-*-G??.md with actual implementation notes and verification output.

### [REVIEW_OFR-S07-STALE-LEASE-5-1] Settle the stale OneXPlayer Node generation

#### Problem

The live provider snapshot is blocked at OneXPlayer `in_flight=1` even though the latest OneXPlayer lifecycle is terminal, both provider stacks are ready, and no S07 harness exists. S07 must not launch against that retained lease.

#### Solution

- Revalidate the exact terminal correlation, absence of later OneXPlayer observations, absent harness, unchanged `in_flight=1` snapshot, current source/image identity, and fresh plan-5 path.
- Run the three focused generation-settlement tests before any remote mutation.
- Require exactly one matching OneXPlayer Node process and its expected command line.
- Stop that process once, wait eight seconds for the Edge disconnect boundary, and launch the identical command exactly once through `Win32_Process.Create`. Do not touch Lemonade or the loaded model.
- Require a different Node PID, direct provider readiness, all four nodes reconnected, and both selected providers healthy/idle at capacities `3+1`.
- If any pre-mutation gate fails, do not mutate and report `node_stop_count=0 node_create_count=0 invocation_count=0`. Once the stop executes, neither stop nor create may be retried.

#### Modified Files and Checklist

- [ ] `agent-task/m-openai-compatible-output-validation-filters/03_repeat_guard_s07_remote_evidence/CODE_REVIEW-cloud-G10.md` - record stale-lease proof, focused tests, exact stop/create counts, old/new PID distinction, and post-reconnect provider gate.
- [ ] No source/config/Control Plane/Edge/Lemonade/model/other-Node/credential/roadmap mutation.

#### Test Strategy

Run only the existing focused service tests that prove disconnect release and generation fencing. Then verify the real remote boundary through current status; do not use a no-op config refresh or broader runtime restart as a substitute.

#### Verification

Bounded read-only stale-lease and identity gate:

```bash
ssh -o BatchMode=yes -o ConnectTimeout=15 r0bin@192.168.0.59 \
  'powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:/Users/r0bin/iop-field/remote-llm-toggle.ps1 -Action Status' |
  jq -e '.success == true and .state.ready == true and .state.health == "ok" and .state.model_loaded == true and .state.node_running == true and (.state.node_pids | length) == 1 and .state.edge_connected == true'

ssh -o BatchMode=yes -o ConnectTimeout=15 iop-dev-rtx5090 \
  'powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:/Users/r0bin/iop-field/remote-llm-toggle.ps1 -Action Status' |
  jq -e '.success == true and .state.ready == true and .state.health == "ok" and .state.model_loaded == true and .state.edge_connected == true'

ssh -o BatchMode=yes -o ConnectTimeout=15 toki@toki-labs.com '/bin/zsh -lc "exec /bin/zsh -s"' <<'REMOTE'
set -euo pipefail
set +x
cd /Users/toki/agent-work/iop-dev
expected_head=750cb1d1cb88066a10d3c703c99f1326306d8e15
expected_corr=req.manual-1785372720434474000
expected_test_hash=46261bb3a3000e00c27c419682f741c64c31c849d0aa30cbc024ed4531e7bfa6
artifact_dir=/tmp/iop-repeat-guard-live/repeat-guard-task-03-plan-5
edge_log=build/dev-runtime/bin/logs/edge.log
status_file=$(/usr/bin/mktemp -t iop-repeat-stale-status.XXXXXX)
last_file=$(/usr/bin/mktemp -t iop-repeat-stale-last.XXXXXX)
trap '/bin/rm -f "$status_file" "$last_file"' EXIT

test "$(git rev-parse HEAD)" = "$expected_head"
test -z "$(git status --porcelain)"
test "$(/usr/bin/shasum -a 256 apps/edge/internal/openai/stream_gate_vertical_slice_test.go | /usr/bin/awk '{print $1}')" = "$expected_test_hash"
test ! -e "$artifact_dir"
! /usr/bin/pgrep -fl '[T]estDevRepeatGuardOrnithSmoke|[r]epeat-guard-task-03-plan-5' >/dev/null

container=$(docker ps --filter publish=18001 --format '{{.ID}}' | /usr/bin/head -1)
test -n "$container"
test "$(docker inspect --format '{{index .Config.Labels "iop.source.repo"}}' "$container")" = iop-dev
test "$(docker inspect --format '{{index .Config.Labels "iop.source.head"}}' "$container")" = "$expected_head"
test "$(docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}none{{end}}' "$container")" = healthy
test "$(docker exec "$container" sh -c 'strings /usr/local/bin/control-plane | grep -c provider_snapshots || true')" -ge 1

/usr/bin/tail -n 180000 "$edge_log" |
  /usr/bin/jq -s '
    [.[] | select(.actual_provider == "onexplayer-lemonade" and .observation_kind != null)] |
    sort_by(.ts) | last |
    {ts, correlation_id, observation_kind}
  ' >"$last_file"
/usr/bin/jq -e --arg corr "$expected_corr" '
  .correlation_id == $corr and
  .observation_kind == "terminal_committed" and
  ((now - .ts) >= 60)
' "$last_file" >/dev/null

for sample in 1 2 3; do
  /usr/bin/curl -fsS http://127.0.0.1:18001/edges/edge-toki-labs-dev/status >"$status_file"
  /usr/bin/jq -e '
    def provider($id): first(.nodes[]?.provider_snapshots[]? | select(.id == $id));
    ((.nodes // []) | length == 4) and
    (all(.nodes[]; .connected == true)) and
    (provider("onexplayer-lemonade").capacity == 3) and
    (provider("onexplayer-lemonade").health == "healthy") and
    (provider("onexplayer-lemonade").in_flight == 1) and
    (provider("onexplayer-lemonade").queued == 0) and
    (provider("rtx5090-lemonade").capacity == 1) and
    (provider("rtx5090-lemonade").health == "healthy") and
    (provider("rtx5090-lemonade").in_flight == 0) and
    (provider("rtx5090-lemonade").queued == 0)
  ' "$status_file" >/dev/null
  /bin/sleep 1
done

print -r -- "stale_lease_gate=PASS latest_correlation=$expected_corr latest_kind=terminal_committed samples=3 onex_in_flight=1 harness=absent source=unchanged image=pinned node_stop_count=0 node_create_count=0 invocation_count=0"
REMOTE
```

Focused generation-settlement tests:

```bash
ssh -o BatchMode=yes -o ConnectTimeout=15 toki@toki-labs.com \
  'cd /Users/toki/agent-work/iop-dev && go test -count=1 ./apps/edge/internal/service -run "^(TestModelQueueNodeDisconnectReleasesInflight|TestDisconnectFencesOnlyMatchingGeneration|TestDisconnectSettlesOldLeaseWhenNewGenerationAlreadyReserved)$"'
```

Expected: all read-only predicates and three focused tests pass before any mutation. A changed latest correlation, an active harness, a non-terminal lifecycle, or a non-stable status blocks the restart.

Single OneXPlayer Node generation reset:

```bash
ssh -o BatchMode=yes -o ConnectTimeout=15 r0bin@192.168.0.59 \
  'powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command -' <<'POWERSHELL'
$ErrorActionPreference = 'Stop'
$exe = 'C:\Users\r0bin\iop-field\iop-node.exe'
$config = 'C:\Users\r0bin\iop-field\node.yaml'
$workdir = 'C:\Users\r0bin\iop-field'
$commandLine = '"C:\Users\r0bin\iop-field\iop-node.exe" serve --config "C:\Users\r0bin\iop-field\node.yaml"'

$nodeProcesses = @(Get-CimInstance Win32_Process -Filter "Name='iop-node.exe'" | Where-Object {
  $_.ExecutablePath -eq $exe -and $_.CommandLine -like '*iop-field\node.yaml*'
})
if ($nodeProcesses.Count -ne 1) {
  throw "expected exactly one matching iop-node.exe process"
}
$oldPid = [uint32]$nodeProcesses[0].ProcessId

Stop-Process -Id $oldPid -Force
$deadline = (Get-Date).AddSeconds(20)
do {
  Start-Sleep -Milliseconds 250
  $oldStillPresent = Get-CimInstance Win32_Process -Filter "ProcessId=$oldPid" -ErrorAction SilentlyContinue
} while ($null -ne $oldStillPresent -and (Get-Date) -lt $deadline)
if ($null -ne $oldStillPresent) {
  throw "old iop-node.exe process did not stop"
}

Start-Sleep -Seconds 8
$created = Invoke-CimMethod -ClassName Win32_Process -MethodName Create -Arguments @{
  CommandLine = $commandLine
  CurrentDirectory = $workdir
}
if ([uint32]$created.ReturnValue -ne 0) {
  throw "Win32_Process.Create failed with return value $($created.ReturnValue)"
}
$newPid = [uint32]$created.ProcessId
if ($newPid -eq $oldPid) {
  throw "new process reused the old pid unexpectedly"
}

$deadline = (Get-Date).AddSeconds(20)
do {
  Start-Sleep -Milliseconds 250
  $newProcess = Get-CimInstance Win32_Process -Filter "ProcessId=$newPid" -ErrorAction SilentlyContinue
} while ($null -eq $newProcess -and (Get-Date) -lt $deadline)
if ($null -eq $newProcess) {
  throw "new iop-node.exe process did not remain present"
}

[pscustomobject]@{
  success = $true
  old_pid = $oldPid
  new_pid = $newPid
  stop_count = 1
  create_count = 1
  launch_method = 'Win32_Process.Create'
} | ConvertTo-Json -Compress
POWERSHELL

ssh -o BatchMode=yes -o ConnectTimeout=15 toki@toki-labs.com '/bin/zsh -lc "exec /bin/zsh -s"' <<'REMOTE'
set -euo pipefail
set +x
status_file=$(/usr/bin/mktemp -t iop-repeat-reconnect-status.XXXXXX)
trap '/bin/rm -f "$status_file"' EXIT

connected=0
for attempt in {1..60}; do
  if /usr/bin/curl -fsS http://127.0.0.1:18001/edges/edge-toki-labs-dev/status >"$status_file" &&
     /usr/bin/jq -e '
       def provider($id): first(.nodes[]?.provider_snapshots[]? | select(.id == $id));
       ((.nodes // []) | length == 4) and
       (all(.nodes[]; .connected == true)) and
       (provider("onexplayer-lemonade").capacity == 3) and
       (provider("onexplayer-lemonade").health == "healthy") and
       (provider("onexplayer-lemonade").in_flight == 0) and
       (provider("onexplayer-lemonade").queued == 0) and
       (provider("rtx5090-lemonade").capacity == 1) and
       (provider("rtx5090-lemonade").health == "healthy") and
       (provider("rtx5090-lemonade").in_flight == 0) and
       (provider("rtx5090-lemonade").queued == 0)
     ' "$status_file" >/dev/null; then
    connected=1
    break
  fi
  /bin/sleep 1
done
test "$connected" = 1
print -r -- 'node_generation_gate=PASS nodes=4 providers=3+1_idle onex_in_flight=0 node_stop_count=1 node_create_count=1 invocation_count=0'
REMOTE

ssh -o BatchMode=yes -o ConnectTimeout=15 r0bin@192.168.0.59 \
  'powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:/Users/r0bin/iop-field/remote-llm-toggle.ps1 -Action Status' |
  jq -e '.success == true and .state.ready == true and .state.health == "ok" and .state.model_loaded == true and .state.node_running == true and (.state.node_pids | length) == 1 and .state.edge_connected == true'
```

Expected: exactly one old Node PID is stopped and one different PID is created through `Win32_Process.Create`; the Control Plane then reports four connected nodes and idle `3+1` capacity. Any failure after the stop is consumed and must not be retried.

### [REVIEW_OFR-S07-STALE-LEASE-5-2] Run one attached S07 invocation and verify cleanup

#### Problem

No accepted S07 live summary exists. Earlier attempts either never invoked the model or produced no acceptable full-capacity evidence.

#### Solution

- Recheck the pinned source, image labels, current binary contract, fresh plan-5 path, absent harness, protected SOPS authentication, and healthy/idle `3+1` provider state.
- Start `TestDevRepeatGuardOrnithSmoke` once in the same foreground SSH shell. Do not detach, background, timeout-retry, or choose another artifact path.
- Record exact terminal Go output and exit status. Any exit after `remote_live_start` consumes the invocation.
- On exit 0, validate `summary.json` without printing it, require all cardinalities/capacity rows/result classification, prove both providers idle, prove the harness absent, and preserve source and prior artifacts.

#### Modified Files and Checklist

- [ ] `agent-task/m-openai-compatible-output-validation-filters/03_repeat_guard_s07_remote_evidence/CODE_REVIEW-cloud-G10.md` - record the single foreground invocation and sanitized summary/cleanup evidence.
- [ ] No source/config/Control Plane/Edge/Node/provider/credential/roadmap mutation after the generation gate.

#### Test Strategy

Use only the existing five-concurrent, three-run, two-provider `TestDevRepeatGuardOrnithSmoke` contract. Do not accept synthetic summaries, degraded capacity, detached processes, or retries.

#### Verification

Foreground invocation:

```bash
ssh -o BatchMode=yes -o ConnectTimeout=15 toki@toki-labs.com '/bin/zsh -lc "exec /bin/zsh -s"' <<'REMOTE'
set -euo pipefail
set +x
cd /Users/toki/agent-work/iop-dev

expected_head=750cb1d1cb88066a10d3c703c99f1326306d8e15
expected_test_hash=46261bb3a3000e00c27c419682f741c64c31c849d0aa30cbc024ed4531e7bfa6
artifact_dir=/tmp/iop-repeat-guard-live/repeat-guard-task-03-plan-5
secret=/Users/toki/.config/iop/secrets/dev-openai-toki.sops.yaml
age_key=/Users/toki/.config/sops/age/keys.txt
status_file=$(/usr/bin/mktemp -t iop-repeat-live-status.XXXXXX)
api_key=''
cleanup() {
  /bin/rm -f -- "$status_file"
  unset api_key
}
trap cleanup EXIT

test "$(git rev-parse HEAD)" = "$expected_head"
test -z "$(git status --porcelain)"
test "$(/usr/bin/shasum -a 256 apps/edge/internal/openai/stream_gate_vertical_slice_test.go | /usr/bin/awk '{print $1}')" = "$expected_test_hash"
test ! -e "$artifact_dir"
! /usr/bin/pgrep -fl '[T]estDevRepeatGuardOrnithSmoke|[r]epeat-guard-task-03-plan-5' >/dev/null

container=$(docker ps --filter publish=18001 --format '{{.ID}}' | /usr/bin/head -1)
test -n "$container"
test "$(docker inspect --format '{{index .Config.Labels "iop.source.repo"}}' "$container")" = iop-dev
test "$(docker inspect --format '{{index .Config.Labels "iop.source.head"}}' "$container")" = "$expected_head"
test "$(docker exec "$container" sh -c 'strings /usr/local/bin/control-plane | grep -c provider_snapshots || true')" -ge 1

test -x /opt/homebrew/bin/sops
test -r "$age_key"
test -r "$secret"
test "$(/usr/bin/stat -f %Lp "$secret")" = 600
api_key=$(SOPS_AGE_KEY_FILE="$age_key" /opt/homebrew/bin/sops decrypt --extract '["tokens"]["toki-dev-pi"]' "$secret")
test -n "$api_key"

/usr/bin/curl -fsS http://127.0.0.1:18001/edges/edge-toki-labs-dev/status >"$status_file"
/usr/bin/jq -e '
  def provider($id): first(.nodes[]?.provider_snapshots[]? | select(.id == $id));
  ((.nodes // []) | length == 4) and
  (all(.nodes[]; .connected == true)) and
  (provider("onexplayer-lemonade").capacity == 3) and
  (provider("onexplayer-lemonade").health == "healthy") and
  (provider("onexplayer-lemonade").in_flight == 0) and
  (provider("onexplayer-lemonade").queued == 0) and
  (provider("rtx5090-lemonade").capacity == 1) and
  (provider("rtx5090-lemonade").health == "healthy") and
  (provider("rtx5090-lemonade").in_flight == 0) and
  (provider("rtx5090-lemonade").queued == 0)
' "$status_file" >/dev/null

http_status=$(
  {
    print -r -- 'silent'
    print -r -- 'show-error'
    print -r -- 'output = "/dev/null"'
    print -r -- "header = \"Authorization: Bearer $api_key\""
  } | /usr/bin/curl --config - --write-out '%{http_code}' http://127.0.0.1:18083/v1/models
)
test "$http_status" = 200
/bin/rm -f -- "$status_file"

print -r -- 'remote_live_start invocation_count=1 ownership=foreground artifact=plan-5'
IOP_OPENAI_API_KEY="$api_key" \
IOP_OPENAI_BASE_URL=http://127.0.0.1:18083 \
IOP_OPENAI_MODEL=ornith:35b \
IOP_OPENAI_SMOKE_CONCURRENCY=5 \
IOP_OPENAI_SMOKE_RUNS=3 \
IOP_OPENAI_SMOKE_PROMPT_FILE=/tmp/iop-repeat-guard-live/repeat-prompt.txt \
IOP_OPENAI_SMOKE_ARTIFACT_DIR="$artifact_dir" \
IOP_OPENAI_SMOKE_OBSERVATION_FILE=/tmp/iop-repeat-guard-live/edge-observations.jsonl \
IOP_OPENAI_SMOKE_STATUS_URL=http://127.0.0.1:18001/edges/edge-toki-labs-dev/status \
IOP_OPENAI_SMOKE_PROVIDER_IDS=onexplayer-lemonade,rtx5090-lemonade \
"$(command -v go)" test -timeout 90m -count=1 -v ./apps/edge/internal/openai -run '^TestDevRepeatGuardOrnithSmoke$'
REMOTE
```

Expected: authentication returns HTTP 200 and the SSH session stays attached until the single Go invocation exits. Any non-zero exit after `remote_live_start` is consumed and must not be retried.

Sanitized summary and cleanup:

```bash
ssh -o BatchMode=yes -o ConnectTimeout=15 toki@toki-labs.com '/bin/zsh -lc "exec /bin/zsh -s"' <<'REMOTE'
set -euo pipefail
set +x
cd /Users/toki/agent-work/iop-dev
summary=/tmp/iop-repeat-guard-live/repeat-guard-task-03-plan-5/summary.json
status_file=$(/usr/bin/mktemp -t iop-repeat-cleanup.XXXXXX)
trap '/bin/rm -f "$status_file"' EXIT

test -f "$summary"
/usr/bin/jq -e '
  (.model == "ornith:35b") and (.concurrency == 5) and (.runs == 3) and
  ((.provider_responses | length) == 15) and
  (([.provider_responses[].provider_response_id] | unique | length) == 15) and
  ((.lifecycles | length) == 15) and
  (([.lifecycles[].correlation_id] | unique | length) == 15) and
  ((.capacity_runs | length) == 3) and
  (all(.capacity_runs[];
    (.configured_capacity == 4) and (.peak_in_flight == 4) and
    (.peak_queued >= 1) and (.final_in_flight == 0) and (.final_queued == 0))) and
  ((.result == "not_reproduced") or
    ((.result == "reproduced") and
     any(.lifecycles[];
       (.result == "reproduced") and
       ((.fingerprint // "") | length > 0) and
       (.offset >= 0))))
' "$summary" >/dev/null
result_evidence=$(/usr/bin/jq -r '
  if .result == "reproduced" then
    first(.lifecycles[] |
      select(.result == "reproduced") |
      "result=reproduced fingerprint=\(.fingerprint) offset=\(.offset)")
  else
    "result=not_reproduced"
  end
' "$summary")

/usr/bin/curl -fsS http://127.0.0.1:18001/edges/edge-toki-labs-dev/status >"$status_file"
/usr/bin/jq -e '
  def provider($id): first(.nodes[]?.provider_snapshots[]? | select(.id == $id));
  (provider("onexplayer-lemonade").in_flight == 0) and
  (provider("onexplayer-lemonade").queued == 0) and
  (provider("rtx5090-lemonade").in_flight == 0) and
  (provider("rtx5090-lemonade").queued == 0)
' "$status_file" >/dev/null
! /usr/bin/pgrep -fl '[T]estDevRepeatGuardOrnithSmoke|[r]epeat-guard-task-03-plan-5' >/dev/null
test "$(git rev-parse HEAD)" = 750cb1d1cb88066a10d3c703c99f1326306d8e15
test -z "$(git status --porcelain)"
test -d /tmp/iop-repeat-guard-live/repeat-guard-task-03-plan-1
test -d /tmp/iop-repeat-guard-live/repeat-guard-task-03-direct-2
print -r -- "remote_cleanup=PASS $result_evidence invocation_count=1 provider_responses=15 edge_correlations=15 capacity_runs=3 configured_capacity=4 peak_in_flight=4 queued_pressure=present providers=idle harness=absent source=unchanged prior_artifacts=preserved"
REMOTE
```

Expected: exit 0 and only the sanitized cleanup PASS line. Do not print `summary.json`, raw SSE, prompt, output, status payload, token, or token hash.

## Modified Files Summary

| File | Items |
|------|-------|
| `agent-task/m-openai-compatible-output-validation-filters/03_repeat_guard_s07_remote_evidence/CODE_REVIEW-cloud-G10.md` | REVIEW_OFR-S07-STALE-LEASE-5-1, REVIEW_OFR-S07-STALE-LEASE-5-2 |

## Dependencies and Execution Order

1. Revalidate the exact stale-lease snapshot, source/image identity, absent harness, and fresh plan-5 path.
2. Run the three focused generation-settlement tests.
3. If either pre-mutation gate fails, stop with zero mutations and zero model invocations.
4. Stop and recreate only the OneXPlayer Node process exactly once; never retry either action.
5. Require direct provider readiness, four connected nodes, and idle `3+1` provider snapshots.
6. Only then authenticate and start the S07 Go test once in the foreground.
7. Validate the raw-free summary, cleanup, source identity, artifact preservation, and secret hygiene; fill the active review and stop for official review.

## Final Verification

PASS requires the bounded stale-lease gate; current clean source/image identity; three fresh generation-settlement tests; exactly one OneXPlayer Node stop and one `Win32_Process.Create`; a different live Node PID; no Lemonade/model/Edge/Control Plane/other-Node mutation; four connected nodes; healthy/idle OneXPlayer and RTX5090 capacities `3+1`; protected SOPS authentication HTTP 200; exactly one attached foreground invocation exiting 0; 15 unique provider responses; 15 unique Edge correlations; three capacity rows with configured 4, peak in-flight 4, and queue pressure; an accepted sanitized `reproduced` fingerprint/offset or `not_reproduced` result; idle providers; absent harness; unchanged source; preserved old artifacts; and no raw secret/output in tracked files.

Run local workspace hygiene after recording remote evidence:

```bash
git diff --check
git status --short
git grep -nE 'sk-[A-Za-z0-9_-]{16,}|Authorization: Bearer [^$]' -- . \
  ':(exclude)agent-task/archive/**' \
  ':(exclude)agent-task/m-openai-compatible-output-validation-filters/03_repeat_guard_s07_remote_evidence/*.log'
```

Expected: `git diff --check` exits 0; status preserves unrelated user changes; grep finds no new raw credential or live response material in the active plan/review pair.

**After completing all verification, fill implementation-owned sections in `CODE_REVIEW-*-G??.md`.**
