Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@helm/rayservice/applications/tissue-linear.yaml`:
- Around line 16-18: The ray_actor_options currently reserves a GPU (num_gpus:
1) even though this replica is CPU-only; remove or set num_gpus to 0 in the
ray_actor_options block to avoid claiming GPU MIG slots, and instead use a node
label/custom resource or nodeAffinity for placement if you need GPU-hosted
nodes; note that models/tissue_linear.py explicitly uses CPUExecutionProvider
(lines ~106-109) and embeddings are fetched from the remote virchow2 app, so no
local CUDA is required.
- Line 7: The working_dir currently points to a moving ref
(https://github.com/RationAI/model-service/archive/refs/heads/main.zip); update
the working_dir value in the tissue-linear.yaml to an immutable archive URL (a
release tag or commit SHA zip, e.g.
https://github.com/RationAI/model-service/archive/<COMMIT_SHA>.zip) so the chart
pulls a fixed revision; change the value for the working_dir key and regenerate
any chart lock or documentation that records the pinned revision.

In `@models/tissue_linear.py`:
- Around line 179-186: In root(Request) (models/tissue_linear.py) validate the
decompressed payload length before reshaping: compute expected_size =
self.tile_size * self.tile_size * 3, attempt decompression but constrain or
check output size from self.lz4.decompress, and if the decompressed length !=
expected_size return a 400 (e.g., raise HTTPException(status_code=400) or return
a 400 Response) instead of reshaping; only call np.frombuffer(...).reshape(...)
when the length matches exactly to avoid oversized allocations and malformed
payloads.
- Around line 59-61: Validate the advertised output contract in reconfigure():
check that config["output_tile_size"] == 1 and config["n_channels"] ==
self._num_classes (use the instance attributes output_tile_size and n_channels
and the model property self._num_classes) and raise a clear ValueError if either
check fails so callers (and HeatmapBuilder) fail fast; add the same validation
where the config is parsed/assigned (the other block around the second
assignment of tile_size/output_tile_size/n_channels) to ensure consistency
across reconfigure() and any alternate config path.
- Line 138: Wrap the direct RPC await to
self.foundation_model.predict.remote(tile_tensor) in an async timeout (e.g.,
asyncio.wait_for) with a configurable timeout value and handle
asyncio.TimeoutError: on timeout, cancel the Ray object ref
(ray.cancel(virchow2_output, force=True)), log the timeout including the model
and tile context, and surface a clear error or fallback so the caller (methods
in models/tissue_linear.py that call foundation_model.predict.remote) can fail
fast instead of hanging; make the timeout value configurable via existing
config/constants and ensure the cancel + logging occurs before re-raising or
returning an error response.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@models/tissue_linear.py`:
- Around line 175-183: The current predict() call uses embeddings = await
asyncio.gather(*(self._create_embedding(tile) for tile in tiles)) which will
abort the whole batch if any _create_embedding(tile) raises; change to use
asyncio.gather(..., return_exceptions=True), iterate the results to detect
exceptions per index, log/record the failing tile index and exception, and
either skip that tile or substitute a default embedding (e.g., zeros of the same
shape) before creating batch = np.stack(...). Ensure you only pass the resulting
valid/substituted embeddings into session.run({self.input_name: batch}) and
preserve mapping from output logits to the original tile indices (so output_name
results align with non-failed tiles). Do not change _create_embedding()’s
no-timeout call to self.foundation_model.predict.remote(tile_tensor).

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@models/tissue_linear.py`:
- Around line 107-113: After creating the ONNX session in the TissueLinear
initializer (the block that sets self.session, self.input_name, self.output_name
and self._num_classes), validate the model's input dimension matches the
expected 2560 Virchow2 embedding width by reading
self.session.get_inputs()[0].shape[-1], converting to int, and raising a clear
exception (or failing fast) if it does not equal 2560; this prevents silent
initialization of a model that emits 7 classes but accepts the wrong input width
and avoids later runtime failures in session.run().

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Duplicate comments:
In `@models/tissue_linear.py`:
- Around line 153-159: The code decompresses request body data and immediately
reshapes it without validating the payload size, which can cause 500 errors on
malformed payloads or force unexpected memory allocations. After decompressing
the data via self.lz4.decompress, calculate the expected byte size as
self.tile_size * self.tile_size * 3 and validate that the decompressed data
length matches this expected size before calling np.frombuffer and reshape. If
the size validation fails, raise an appropriate error (like ValueError) with a
descriptive message indicating the size mismatch.

---

Nitpick comments:
In `@models/tissue_linear.py`:
- Around line 126-128: Add an inline comment above or on the line containing
patch_tokens = virchow2_output[:, 5:] to document the magic number 5, explaining
that it skips Virchow2's class token (CLS) and 4 register tokens (reg1, reg2,
reg3, reg4) to extract only the patch tokens. This will help future maintainers
understand the token layout offset without needing to consult external Virchow2
documentation.