freesolo-flash-dev 0.2.28__tar.gz → 0.2.30__tar.gz

{freesolo_flash_dev-0.2.28 → freesolo_flash_dev-0.2.30}/.github/workflows/bake-kernel-cache.yml

@@ -11,8 +11,8 @@ name: flash worker kernel-cache (per-arch)
 # warmup runs INSIDE it so the cache matches the image's pinned torch/triton/fla/liger toolchain.
 #
 # Secrets: RUNPOD_API_KEY (the warmup GPU pod) + HF_TOKEN (the temp dataset that ferries code + the
-# cache artifact) are pulled from Infisical (/flash, prod) via the bootstrap INFISICAL_CLIENT_ID /
-# CLIENT_SECRET / PROJECT_ID repo secrets; the GHCR push uses the default GITHUB_TOKEN. Heavy + paid,
+# cache artifact) are native repo Actions secrets, synced from Infisical (prod:/flash-ci) by the
+# github-ci-flash Secret Sync; the GHCR push uses the default GITHUB_TOKEN. Heavy + paid,
 # but UNGATED: the fingerprint detection in auto-rebake.yml decides WHEN this runs (only on a real
 # kernel-toolchain change), so there is no manual approval step. Invoked by hand (workflow_dispatch)
 # OR automatically by auto-rebake.yml (workflow_call) when the kernel toolchain changed.
@@ -179,38 +179,25 @@ jobs:
         if: steps.gate.outputs.run == 'true'
         run: uv sync --extra server
 
-      - name: Install Infisical CLI
-        if: steps.gate.outputs.run == 'true'
-        run: |
-          curl -1sLf 'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.deb.sh' | sudo -E bash
-          sudo apt-get update && sudo apt-get install -y infisical
-
-      # RUNPOD_API_KEY + HF_TOKEN come from Infisical (/flash, prod) -- mirrors infisical-entrypoint.sh;
-      # the CLI takes the project UUID directly (the secrets-action wants a slug). `env -u
-      # FLASH_CHALK_SPEC` drops any chalk-spec override living in /flash so the bake always warms the
-      # repo-default chalk (the value the fingerprint hashed) -- otherwise the image could be warmed with
-      # one chalk and labeled with another. BASE_IMAGE is digest-pinned so the warm runs inside the EXACT
-      # base the per-arch tag will sit on.
+      # RUNPOD_API_KEY (the warmup GPU pod) + HF_TOKEN (the temp dataset that ferries code/cache) are
+      # native repo Actions secrets, synced from Infisical (prod:/flash-ci) by the github-ci-flash
+      # Secret Sync. No Infisical CLI/login at job time -- Infisical stays the source of truth and
+      # rotations propagate via the sync. FLASH_CHALK_SPEC isn't synced, so bake_kernel_cache.py uses
+      # the repo-default DEFAULT_CHALK_SPEC (the value the fingerprint hashed) automatically. BASE_IMAGE
+      # is digest-pinned so the warm runs inside the EXACT base the per-arch tag will sit on.
       - name: Warm kernels on a RunPod ${{ matrix.sm }} GPU -> build/kernel_cache
         if: steps.gate.outputs.run == 'true'
         env:
-          INFISICAL_CLIENT_ID: ${{ secrets.INFISICAL_CLIENT_ID }}
-          INFISICAL_CLIENT_SECRET: ${{ secrets.INFISICAL_CLIENT_SECRET }}
-          INFISICAL_PROJECT_ID: ${{ secrets.INFISICAL_PROJECT_ID }}
+          RUNPOD_API_KEY: ${{ secrets.RUNPOD_API_KEY }}
+          HF_TOKEN: ${{ secrets.HF_TOKEN }}
           BASE_IMAGE: ${{ steps.base.outputs.ref }}
         run: |
-          INFISICAL_TOKEN="$(infisical login --method=universal-auth \
-            --client-id="$INFISICAL_CLIENT_ID" --client-secret="$INFISICAL_CLIENT_SECRET" \
-            --silent --plain)"
-          export INFISICAL_TOKEN
-          infisical run --projectId "$INFISICAL_PROJECT_ID" --env prod --path /flash -- \
-            env -u FLASH_CHALK_SPEC \
-            uv run python docker/bake_kernel_cache.py \
-              --arch "${{ matrix.arch }}" --sm "${{ matrix.sm }}" \
-              --gpu-type-id "${{ matrix.gpu_type_id }}" \
-              --allowed-cuda "${{ matrix.allowed_cuda }}" \
-              --image "$BASE_IMAGE" \
-              --out build/kernel_cache
+          uv run python docker/bake_kernel_cache.py \
+            --arch "${{ matrix.arch }}" --sm "${{ matrix.sm }}" \
+            --gpu-type-id "${{ matrix.gpu_type_id }}" \
+            --allowed-cuda "${{ matrix.allowed_cuda }}" \
+            --image "$BASE_IMAGE" \
+            --out build/kernel_cache
 
       - name: Free disk space
         if: steps.gate.outputs.run == 'true'

{freesolo_flash_dev-0.2.28 → freesolo_flash_dev-0.2.30}/Dockerfile.worker

@@ -25,9 +25,22 @@ ENV DEBIAN_FRONTEND=noninteractive \
 # JIT on a cold worker writes here too. These ENVs are always set (cheap); whether the dir is
 # pre-populated is what the opt-in bake controls. engine.worker._load_kernel_cache_if_present reads
 # /opt/flash/kernelcache at boot.
+# FLASHINFER_CUBIN_DIR / FLASHINFER_CACHE_DIR / FLASHINFER_WORKSPACE_BASE: FlashInfer's attention-backend
+# cubins (the Blackwell sm120 / B200 rollout attention backend) are NOT bundled in the wheel — flashinfer
+# downloads them from NVIDIA Artifactory on first use. Bake the cubin store + JIT cache into the same
+# persistent kernelcache tree so
+# a baked/volume cache serves them and a cold worker never re-fetches from Artifactory (kernel_warmup
+# also sets these). FLASHINFER_WORKSPACE_BASE is the var flashinfer 0.6.x actually reads to relocate the
+# JIT host-wrapper cache (FLASHINFER_CACHE_DIR is a DERIVED constant there, not an env knob), so set it
+# too — otherwise a B200 path that touches flashinfer before kernel_warmup runs lands the wrapper under
+# the default home workspace and re-JITs instead of using the baked cache.
 ENV TRITON_CACHE_DIR=/opt/flash/kernelcache/triton \
-    TORCHINDUCTOR_CACHE_DIR=/opt/flash/kernelcache/inductor
-RUN mkdir -p /opt/flash/kernelcache/triton /opt/flash/kernelcache/inductor
+    TORCHINDUCTOR_CACHE_DIR=/opt/flash/kernelcache/inductor \
+    FLASHINFER_CUBIN_DIR=/opt/flash/kernelcache/flashinfer_cubin \
+    FLASHINFER_CACHE_DIR=/opt/flash/kernelcache/flashinfer \
+    FLASHINFER_WORKSPACE_BASE=/opt/flash/kernelcache/flashinfer
+RUN mkdir -p /opt/flash/kernelcache/triton /opt/flash/kernelcache/inductor \
+    /opt/flash/kernelcache/flashinfer_cubin /opt/flash/kernelcache/flashinfer
 
 # build-essential for Triton/Inductor (Liger) + any source builds; git for pip VCS installs.
 RUN apt-get update && apt-get install -y --no-install-recommends build-essential git curl \
@@ -39,6 +52,7 @@ RUN pip install --no-cache-dir \
     "trl>=1.6,<1.7" \
     "peft>=0.19" \
     "vllm==0.19.1" \
+    "flashinfer-python==0.6.6" \
     "bitsandbytes>=0.49" \
     "datasets>=4.7,<6" \
     "huggingface_hub>=0.25" \
@@ -187,10 +201,12 @@ fa_ok = False; \
 exec('try:\n import flash_attn\n fa_ok = True\nexcept Exception:\n fa_ok = False'); \
 fa3_ok = False; \
 exec('try:\n import flash_attn_interface\n fa3_ok = True\nexcept Exception:\n fa3_ok = False'); \
+fi_ok = False; \
+exec('try:\n import flashinfer\n fi_ok = True\nexcept Exception:\n fi_ok = False'); \
 cudnn = torch.backends.cudnn.version(); assert cudnn, 'cuDNN not compiled into torch'; \
 ver = lambda n: M.version(n); \
-print('worker stack OK | torch', torch.__version__, '| cudnn', cudnn, '| triton', triton.__version__, '| flash_attn', 'present' if fa_ok else 'ABSENT (SDPA fallback)', '| flash_attn_3', 'present (Hopper FA3)' if fa3_ok else 'ABSENT (SDPA on Hopper)'); \
-[print('  ', d, ver(d)) for d in ['transformers','trl','peft','vllm','datasets','huggingface-hub', \
+print('worker stack OK | torch', torch.__version__, '| cudnn', cudnn, '| triton', triton.__version__, '| flash_attn', 'present' if fa_ok else 'ABSENT (SDPA fallback)', '| flash_attn_3', 'present (Hopper FA3)' if fa3_ok else 'ABSENT (SDPA on Hopper)', '| flashinfer', 'present (B200 MoE/attn)' if fi_ok else 'ABSENT (Triton fused-MoE fallback)'); \
+[print('  ', d, ver(d)) for d in ['transformers','trl','peft','vllm','flashinfer-python','datasets','huggingface-hub', \
 'accelerate','wandb','liger-kernel','flash-linear-attention','bitsandbytes', \
 'hf-transfer','freesolo','runpod']]"
 

{freesolo_flash_dev-0.2.28 → freesolo_flash_dev-0.2.30}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: freesolo-flash-dev
-Version: 0.2.28
+Version: 0.2.30
 Summary: Flash — managed LoRA post-training (SFT/GRPO) for Freesolo environments, driven by the `flash` CLI
 Project-URL: Homepage, https://github.com/freesolo-co/flash
 Project-URL: Repository, https://github.com/freesolo-co/flash

freesolo_flash_dev-0.2.30/flash/__init__.py

@@ -0,0 +1,13 @@
+"""Flash — managed LoRA post-training: log in with your freesolo key, train."""
+
+from importlib.metadata import version as _dist_version
+
+from flash._channel import DIST_NAME as _DIST_NAME
+
+__all__ = ["__version__"]
+
+# Read from dist metadata so version literal doesn't drift from pyproject (caused a nag loop in 0.2.20).
+try:
+    __version__ = _dist_version(_DIST_NAME)
+except Exception:
+    __version__ = "0+unknown"

freesolo_flash_dev-0.2.30/flash/_channel.py

@@ -0,0 +1,11 @@
+"""Single switch between prod and dev channels; ``scripts/build_dev_dist.py`` rewrites CHANNEL to "dev"."""
+
+from __future__ import annotations
+
+CHANNEL = "dev"
+
+# Must stay in lockstep with [project.scripts] in pyproject.toml.
+CLI_NAME = "flash-dev" if CHANNEL == "dev" else "flash"
+
+# Must stay in lockstep with [project].name in pyproject.toml.
+DIST_NAME = "freesolo-flash-dev" if CHANNEL == "dev" else "freesolo-flash"

{freesolo_flash_dev-0.2.28 → freesolo_flash_dev-0.2.30}/flash/_fileio.py

@@ -9,21 +9,16 @@ from pathlib import Path
 
 
 def read_json_or_empty(path: Path) -> dict:
-    """Parse a JSON object file, returning ``{}`` if it's missing or unreadable."""
+    """Parse a JSON object file, returning ``{}`` on any error or if the root is not a dict."""
     try:
-        return json.loads(path.read_text())
+        data = json.loads(path.read_text())
     except (OSError, ValueError):
         return {}
+    return data if isinstance(data, dict) else {}
 
 
 def secure_json_write(path: Path, data: dict) -> None:
-    """Write ``data`` as JSON with private permissions (the file may hold a secret).
-
-    Creates the parent dir (0700) and opens the file 0600 from the start — never
-    write_text + chmod, which leaves it umask-readable in between. ``O_NOFOLLOW``
-    (where available) refuses to follow a symlink planted at ``path`` so the write
-    can't be redirected to clobber an arbitrary file.
-    """
+    """Write ``data`` as JSON 0600. Opens with O_CREAT|0o600 — never write_text+chmod (TOCTOU). O_NOFOLLOW blocks symlink redirect."""
     path.parent.mkdir(parents=True, exist_ok=True)
     with contextlib.suppress(OSError):
         os.chmod(path.parent, 0o700)

{freesolo_flash_dev-0.2.28 → freesolo_flash_dev-0.2.30}/flash/_logging.py

@@ -1,10 +1,4 @@
-"""Package logging helpers.
-
-Library code logs through the ``flash`` logger and never configures handlers on import (it
-attaches a :class:`logging.NullHandler`), so importing Flash stays silent for downstream
-applications. The CLI calls :func:`configure_logging` to attach a console handler whose
-level is controlled by ``-v/--verbose``.
-"""
+"""Package logging helpers."""
 
 from __future__ import annotations
 
@@ -12,8 +6,7 @@ import logging
 
 _ROOT_NAME = "flash"
 
-# Attach a NullHandler once so "No handlers could be found" warnings never appear and
-# importing the library produces no output unless the app opts in.
+# NullHandler: keep library import silent; app opts in via configure_logging.
 _root = logging.getLogger(_ROOT_NAME)
 if not any(isinstance(h, logging.NullHandler) for h in _root.handlers):
     _root.addHandler(logging.NullHandler())
@@ -29,20 +22,15 @@ def get_logger(name: str | None = None) -> logging.Logger:
 
 
 def configure_logging(verbosity: int = 0, level: int | None = None) -> None:
-    """Attach a console handler to the ``flash`` logger and set its level.
-
-    ``verbosity`` maps repeated ``-v`` flags to levels (0=WARNING, 1=INFO, >=2=DEBUG).
-    An explicit ``level`` overrides the verbosity mapping.
-    """
+    """Attach a console handler to the ``flash`` logger and set its level."""
     if level is None:
         level = {0: logging.WARNING, 1: logging.INFO}.get(verbosity, logging.DEBUG)
 
     logger = logging.getLogger(_ROOT_NAME)
     logger.setLevel(level)
-    # Replace any prior console handler we installed so repeated calls don't stack handlers.
     for h in [h for h in logger.handlers if getattr(h, "_flash_console", False)]:
         logger.removeHandler(h)
-    handler = logging.StreamHandler()  # stderr
+    handler = logging.StreamHandler()
     handler.setLevel(level)
     handler.setFormatter(logging.Formatter("%(levelname)s %(name)s: %(message)s"))
     handler._flash_console = True  # type: ignore[attr-defined]

{freesolo_flash_dev-0.2.28 → freesolo_flash_dev-0.2.30}/flash/_update_check.py

@@ -1,23 +1,4 @@
-"""Background "a new release is available" notice for the `flash` CLI.
-
-The client CLI is pure standard library (no extra deps), so this is too: it queries PyPI
-with ``urllib`` and compares the published version against the installed ``__version__``.
-
-Design constraints that keep it from ever getting in the way:
-
-- **Stays out of the way.** The PyPI lookup runs in a daemon thread (so it overlaps the
-  command) and every failure (offline, timeout, bad JSON) is swallowed. Only the once-a-day
-  refresh waits briefly for that thread; every other command builds the notice from cache with
-  zero network I/O.
-- **Cached once per day.** The latest version is stored in ``~/.flash/update_check.json``;
-  we only hit PyPI when that cache is older than :data:`_CHECK_INTERVAL_S`. The check time is
-  stamped synchronously before the lookup so the daily back-off holds even if the worker thread
-  is killed at process exit before it records a result.
-- **stderr only, TTY only.** The notice prints to stderr (never stdout), so it can't corrupt
-  JSON piped to ``jq`` or captured output, and it's suppressed entirely when stderr isn't a
-  terminal (pipes, redirects, CI, tests). Color is dropped when ``NO_COLOR`` is set.
-- **Opt-out.** Set ``FLASH_NO_UPDATE_CHECK=1`` to disable the check and notice completely.
-"""
+"""Background "a new release is available" notice for the `flash` CLI."""
 
 from __future__ import annotations
 
@@ -39,32 +20,23 @@ from flash.client.config import CONFIG_DIR
 
 logger = get_logger("flash.update_check")
 
-# The PyPI distribution name (== pyproject `name`) and the command that upgrades it. Follows the
-# installed channel (freesolo-flash, or freesolo-flash-dev for the dev build) — see flash/_channel.py.
 PACKAGE_NAME = DIST_NAME
 UPGRADE_COMMAND = f"uv tool upgrade {PACKAGE_NAME}"
 _PYPI_JSON_URL = f"https://pypi.org/pypi/{PACKAGE_NAME}/json"
 
 CACHE_PATH = CONFIG_DIR / "update_check.json"
 
-# Re-check PyPI at most once a day; the notice itself is shown on every command from cache.
 _CHECK_INTERVAL_S = 24 * 60 * 60
-# How long the lookup may take, and how long the once-a-day refresh waits for it at the end of a
-# command. Keep the join >= the fetch timeout so the worker thread finishes (and records its
-# result) within the wait instead of being killed at process exit mid-write.
+# join >= fetch timeout so the worker finishes writing before process exit kills it.
 _FETCH_TIMEOUT_S = 1.5
 _JOIN_TIMEOUT_S = 2.0
 
 _OPT_OUT_ENV = "FLASH_NO_UPDATE_CHECK"
 
-# A PEP 440 version only uses this charset. We reject anything else (control chars, ANSI escape
-# sequences, newlines) before printing the value to a terminal, so a poisoned cache or a hostile
-# response can't inject escape codes into the notice. The length bound is just a sanity cap.
+# Reject anything outside the PEP 440 charset before printing — prevents escape-code injection.
 _SAFE_VERSION = re.compile(r"\A[A-Za-z0-9][A-Za-z0-9.+!_-]{0,63}\Z")
 
-# A coarse subset of the PEP 440 grammar: the numeric release plus optional pre/post/dev markers.
-# Enough to order the simple versions this package ships and to spot pre-releases; this is not a
-# full PEP 440 implementation (the stdlib-only client can't depend on `packaging`).
+# Coarse PEP 440 subset; stdlib-only client can't depend on `packaging`.
 _VERSION_RE = re.compile(
     r"""\A\s*v?
         (?P<release>\d+(?:\.\d+)*)
@@ -77,14 +49,12 @@ _VERSION_RE = re.compile(
 
 
 def _enabled() -> bool:
-    """The whole feature is off unless stderr is a TTY and the user hasn't opted out."""
+    """Off unless stderr is a TTY and the user hasn't opted out."""
     if os.environ.get(_OPT_OUT_ENV):
         return False
     try:
         return bool(sys.stderr.isatty())
     except Exception:
-        # stderr may be detached/closed/replaced (e.g. some embedded contexts); any failure
-        # here is treated as "not a TTY" so the check can never crash a command.
         return False
 
 
@@ -97,13 +67,7 @@ def _normalize_release(release: tuple[int, ...]) -> tuple[int, ...]:
 
 
 def _version_key(version: str) -> tuple[tuple[int, ...], int, int]:
-    """A coarse PEP 440 sort key ``(release, final_rank, post)`` where higher means newer.
-
-    The release segment is normalized (``1.0 == 1.0.0``). A pre-release/dev version ranks below
-    the final release of the same number (``final_rank`` 0 vs 1); a post-release ranks above it
-    via ``post``. Epochs and local versions are ignored — the catalog ships only simple versions.
-    Returns an empty release for unparseable input, which compares as "older than everything".
-    """
+    """Sort key ``(release, final_rank, post)`` where higher means newer."""
     match = _VERSION_RE.match(version or "")
     if not match:
         return ((), 1, 0)
@@ -127,19 +91,12 @@ def _is_newer(latest: str, current: str) -> bool:
 
 
 def _clean_version(value: object) -> str | None:
-    """Return ``value`` only if it's a safe, escape-free version string, else ``None``.
-
-    Guards both the PyPI response and the on-disk cache: ``_version_key`` parses just the
-    numeric/marker prefix, so without this an injected suffix (ANSI codes, newlines) could reach
-    the terminal. Non-strings (and anything outside the PEP 440 charset) are rejected.
-    """
+    """Return ``value`` if it's a safe version string, else ``None``."""
     return value if isinstance(value, str) and _SAFE_VERSION.match(value) else None
 
 
 def _read_cache() -> dict:
-    # read_json_or_empty returns whatever the file parses to; a non-object (e.g. ``[]``) would
-    # make the ``.get()`` callers raise, and _check_due runs before main()'s error handling — so
-    # coerce anything that isn't a dict back to an empty one.
+    # Coerce non-dict results (e.g. []) since _check_due runs before main()'s error handling.
     cache = read_json_or_empty(CACHE_PATH)
     return cache if isinstance(cache, dict) else {}
 
@@ -168,21 +125,13 @@ def _fetch_latest_version(timeout: float = _FETCH_TIMEOUT_S) -> str | None:
     except (urllib.error.URLError, OSError, ValueError, TimeoutError) as exc:
         logger.debug("update check: PyPI lookup failed: %s", exc)
         return None
-    # Expected shape is {"info": {"version": ...}}; tolerate anything else (a proxy error page,
-    # ``[]``, ``{"info": null}``, ...) instead of letting a dereference raise into the caller.
     info = payload.get("info") if isinstance(payload, dict) else None
     version = info.get("version") if isinstance(info, dict) else None
     return _clean_version(version)
 
 
 def _stamp_check_time() -> None:
-    """Record "checked just now" (keeping any cached version), synchronously and best-effort.
-
-    Done before the background lookup starts so the daily back-off holds even if the daemon worker
-    is killed at process exit before it records its own result — otherwise a stale/missing cache
-    would make every command re-run (and wait on) the lookup. Never raises (runs before main()'s
-    error handling).
-    """
+    """Record "checked just now" synchronously so the daily back-off holds even if the daemon is killed."""
     with contextlib.suppress(Exception):
         cache = _read_cache()
         cache["checked_at"] = time.time()
@@ -190,11 +139,7 @@ def _stamp_check_time() -> None:
 
 
 def _refresh_cache() -> None:
-    """Fetch from PyPI and persist the version on success; runs in a daemon thread, never raises.
-
-    The attempt time is already stamped by :func:`_stamp_check_time`, so a failed lookup just
-    returns and lets the daily back-off (set there) stand.
-    """
+    """Fetch from PyPI and persist the version; runs in a daemon thread, never raises."""
     try:
         latest = _fetch_latest_version()
         if not latest:
@@ -203,7 +148,7 @@ def _refresh_cache() -> None:
         cache["checked_at"] = time.time()
         cache["pypi_version"] = latest
         secure_json_write(CACHE_PATH, cache)
-    except Exception as exc:  # truly never let a background thread escape
+    except Exception as exc:
         logger.debug("update check: refresh failed: %s", exc)
 
 
@@ -218,7 +163,6 @@ def _red(text: str) -> str:
 def _build_notice() -> str | None:
     """Build the upgrade notice from the cached PyPI version, or ``None`` if up to date."""
     latest = _clean_version(_read_cache().get("pypi_version"))
-    # Only nudge toward stable releases: never advertise a pre-release (rc/dev) as an upgrade.
     if not latest or _is_prerelease(latest) or not _is_newer(latest, __version__):
         return None
     return _red(
@@ -228,38 +172,26 @@ def _build_notice() -> str | None:
 
 
 def maybe_start_update_check() -> threading.Thread | None:
-    """Kick off a background PyPI refresh if one is due. Returns the thread (or ``None``).
-
-    Pass the return value to :func:`emit_update_notice`. No-ops (returns ``None``) when the
-    feature is disabled or the cached check is still fresh, so the common path is free.
-    """
+    """Kick off a background PyPI refresh if one is due; returns the thread (or ``None``)."""
     if not _enabled() or not _check_due(time.time()):
         return None
-    # Stamp the attempt synchronously before spawning the worker, so the daily back-off holds even
-    # if the daemon is killed at process exit before it writes (see _stamp_check_time).
     _stamp_check_time()
     thread = threading.Thread(target=_refresh_cache, name="flash-update-check", daemon=True)
     try:
         thread.start()
     except RuntimeError:
-        # can't spawn a thread (e.g. interpreter shutting down) — skip the check silently.
         return None
     return thread
 
 
 def emit_update_notice(notifier: threading.Thread | None = None) -> None:
-    """Print the upgrade notice (if any) to stderr at the end of a command.
-
-    Briefly waits for an in-flight refresh so a freshly fetched version can be shown the same
-    run; if it doesn't finish in time we just use whatever is already cached.
-    """
+    """Print the upgrade notice (if any) to stderr at the end of a command."""
     if not _enabled():
         return
     if notifier is not None:
         with contextlib.suppress(RuntimeError):
             notifier.join(timeout=_JOIN_TIMEOUT_S)
-    # This runs from main()'s finally block, so it must never raise: a broken pipe
-    # (`flash ... | head`), full disk, or closed stderr would otherwise crash the command.
+    # Must never raise: broken pipe or closed stderr would crash the command.
     with contextlib.suppress(Exception):
         notice = _build_notice()
         if notice: