freesolo-flash-dev 1.2.53__tar.gz → 1.2.59__tar.gz

{freesolo_flash_dev-1.2.53 → freesolo_flash_dev-1.2.59}/CHANGELOG.md

@@ -21,6 +21,17 @@ This file starts at 1.1.35. Earlier releases are not reconstructed here; use
 
 ### Changed
 
+- A RunPod attempt's stall window is now measured from evidence timestamps rather than from when
+  the control plane happened to look at it. The window was seeded from the moment polling started
+  and was reset again by the first status read, and a heartbeat was credited at the time it was
+  read rather than the time it was written. Every one of those is a wall-clock reading, so each
+  reattach handed a worker that was already wedged a complete fresh setup window, and a supervisor
+  that reattached repeatedly could keep a dead worker on a paid GPU until the run's wall deadline.
+  The window is now anchored to the persisted launch, a heartbeat is credited at its own timestamp
+  clamped to that launch, and only a genuine status transition counts as progress. Instance
+  polling (Vast/Lambda) already worked this way; this brings RunPod onto the same rule. A job that
+  is still queued is unaffected: the capacity wait keeps its own exemption, so a worker granted
+  late still gets its full cold-start budget.
 - An attempt's terminal artifacts (its strict marker plus `metrics.json`) are now interpreted by
   one shared protocol instead of being decoded separately by live instance polling and by each
   recovery path. The two decoders disagreed about identical bytes. A marker that could not be tied

{freesolo_flash_dev-1.2.53 → freesolo_flash_dev-1.2.59}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: freesolo-flash-dev
-Version: 1.2.53
+Version: 1.2.59
 Summary: Flash — managed LoRA post-training (SFT/GRPO/OPD) for Freesolo environments, driven by the `flash` CLI
 Project-URL: Homepage, https://github.com/freesolo-co/flash
 Project-URL: Repository, https://github.com/freesolo-co/flash

{freesolo_flash_dev-1.2.53 → freesolo_flash_dev-1.2.59}/flash/core/spec.py

@@ -27,19 +27,7 @@ from uuid import UUID
 
 from flash._internal.diagnostics import SECRET_ENV_KEYS_ENV
 from flash.core.catalog import DEFAULT_MODEL, normalize_algorithm
-
-# `DROPPED_TOP_LEVEL_KEYS` keeps its historical private alias rather than being renamed at its 5 call
-# sites: `flash.runner` re-exports it as a package attribute and `preparation.py` reads it back through
-# `_runner()`, which is the seam the tests patch. Renaming it is a separate change from moving it, and
-# doing both at once would put a live recovery path's patch points inside a refactor whose whole claim
-# is that nothing behavioral moved.
-from flash.core.spec_persistence import (
-    DROPPED_TOP_LEVEL_KEYS as _DROPPED_TOP_LEVEL_KEYS,
-)
 from flash.core.spec_persistence import (
-    REMOVED_PERSISTED_TRAIN_KEYS,
-    announce_dropped_keys,
-    migrated_optimizer_batch,
     opt_float,
     opt_int,
     str_tuple,
@@ -654,10 +642,9 @@ class JobSpec:
         if not isinstance(data, dict):
             raise TypeError("job spec must be an object")
         allowed_top_level = {item.name for item in fields(cls)}
-        unknown_top_level = sorted(set(data) - allowed_top_level - _DROPPED_TOP_LEVEL_KEYS)
+        unknown_top_level = sorted(set(data) - allowed_top_level)
         if unknown_top_level:
             raise ValueError(f"job spec has unknown key(s): {', '.join(unknown_top_level)}")
-        announce_dropped_keys(data)
         env = data.get("environment") or {}
         # Reject stale payloads carrying a local `path`; worker only runs published env ids.
         if isinstance(env, dict) and env.get("path"):
@@ -665,12 +652,7 @@ class JobSpec:
                 "local environment paths are no longer supported; the worker only runs "
                 "published Freesolo environment ids"
             )
-        train = validated_section(
-            data,
-            "train",
-            {item.name for item in fields(TrainSpec)},
-            removed=REMOVED_PERSISTED_TRAIN_KEYS,
-        )
+        train = validated_section(data, "train", {item.name for item in fields(TrainSpec)})
         gpu = validated_section(data, "gpu", {item.name for item in fields(GpuSpec)})
         gpu_type, gpu_type_fallbacks = _parse_persisted_gpu_types(gpu)
         provider, providers = validated_persisted_providers(gpu, gpu_type, gpu_type_fallbacks)
@@ -679,9 +661,8 @@ class JobSpec:
             raise TypeError("project must be a string")
         project = require_project_id(project_raw) if project_raw.strip() else ""
         algorithm = normalize_algorithm(data.get("algorithm", cls.algorithm))
-        # one reading of the optimizer batch for both keys: the rollout spelling changed in 1.1.43
-        # and a persisted spec can still carry the old one.
-        batch_size, prompts_per_step = migrated_optimizer_batch(train, algorithm)
+        batch_size = opt_int(train.get("batch_size"))
+        prompts_per_step = opt_int(train.get("prompts_per_step"))
         return cls(
             model=data.get("model", cls.model),
             model_revision=_model_revision(data.get("model_revision", cls.model_revision)),

freesolo_flash_dev-1.2.59/flash/core/spec_persistence.py

@@ -0,0 +1,123 @@
+"""Decoding rules for PERSISTED job-spec records, as distinct from authored configuration.
+
+`JobSpec` serves four different contracts, and this module owns exactly one of them: reading back
+bytes that were already written to `~/.flash/runs/<run_id>.json`. That is not the same job as
+validating a config a user just wrote, and the two must not be confused:
+
+- authored configuration is parsed by `flash.schema.spec_from_dict`, which is STRICT. an unknown key
+  is a typo in a file the author can still fix, so it fails loudly.
+- a persisted record is parsed by `JobSpec.from_dict`, which applies the looser scalar coercions
+  here. It reads a record this build wrote, in this build's shape; an unknown key is fatal in both.
+
+Serialized-byte warning: `flash/runner/preparation.py::_preparation_digest` sha256-hashes the
+canonical JSON of `to_dict()` and `to_internal_dict()` output. Key ORDER is safe there
+(`sort_keys=True`), but key PRESENCE is not -- adding, dropping, or renaming a key in a decode path
+changes the digest and fails integrity validation for a run whose snapshot was already written.
+
+These functions take plain dicts and return plain dicts and scalars. That is the rule that keeps the
+module importable by `spec.py` rather than the other way round, and it is why `validated_section`
+takes its allowed-key set as an argument instead of reading `fields(TrainSpec)` itself.
+
+What is deliberately NOT here: `_coerce_wandb` and `_parse_persisted_gpu_types` are also called only
+from `JobSpec.from_dict`, so they belong to this contract by usage -- but they construct `WandbSpec`
+and reach `_validated_gpu_type`, which `__post_init__` needs too. Moving them would make this module
+import the dataclasses that import it. The boundary is therefore drawn at "persisted-decoding logic
+that does not depend on the spec types themselves".
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+def validated_section(data: dict[str, Any], name: str, allowed: set[str]) -> dict[str, Any]:
+    """Read one nested block (``[train]``, ``[gpu]``) of a persisted record, rejecting unknown keys.
+
+    A missing block and an explicit null are the same state -- both mean "authored nothing" -- so both
+    normalize to empty rather than one of them raising. An unknown key is fatal.
+    """
+    section = data.get(name)
+    if section is None:
+        section = {}
+    if not isinstance(section, dict):
+        raise TypeError(f"{name} must be an object")
+    unknown = sorted(set(section) - allowed)
+    if unknown:
+        raise ValueError(f"{name} has unknown key(s): {', '.join(unknown)}")
+    return section
+
+
+def validated_persisted_providers(
+    gpu: dict[str, Any], gpu_type: str, gpu_type_fallbacks: tuple[str, ...]
+) -> tuple[str, tuple[str, ...]]:
+    """``(provider, providers)`` from a persisted ``[gpu]`` block, cross-checked against its classes.
+
+    ``GpuSpec.__post_init__`` runs the same both-set check but cannot replace this one: ``allow_empty``
+    here keys off whether the record CARRIED a ``providers`` key, and that presence is exactly what the
+    dataclass has already lost by the time it validates. An explicitly empty preference and an absent
+    one are different states in a stored record.
+    """
+    from flash.providers import PROVIDER_NAMES, validated_provider_preferences
+
+    provider = gpu.get("provider", "")
+    if not isinstance(provider, str):
+        raise TypeError("gpu.provider must be a string")
+    provider = provider.strip().lower()
+    providers = validated_provider_preferences(
+        gpu.get("providers", ()), allow_empty="providers" not in gpu
+    )
+    if provider and providers:
+        raise ValueError("gpu.provider and gpu.providers cannot both be set")
+    if provider or providers or gpu_type:
+        from flash.providers.base import providers_for
+
+        if provider and provider not in PROVIDER_NAMES:
+            raise ValueError(f"unknown gpu.provider {provider!r}")
+        # a hard provider pin must carry every acceptable class. provider preferences stay soft: an
+        # ineligible named provider contributes no candidate, while eligible named or unnamed
+        # configured providers remain available for failover.
+        for candidate in (gpu_type, *gpu_type_fallbacks):
+            if candidate and provider and provider not in providers_for(candidate):
+                raise ValueError(
+                    f"gpu.provider {provider!r} cannot provision gpu.type {candidate!r}"
+                )
+    return provider, providers
+
+
+def str_tuple(value: Any) -> tuple[str, ...]:
+    """Normalize a string-or-list knob to a tuple of strings; a bare string is one element, not iterated."""
+    if value is None:
+        return ()
+    if isinstance(value, str):
+        return (value,) if value else ()
+    return tuple(s for s in (str(x) for x in value) if s)
+
+
+def volume_gb(value: Any, default: int = 100) -> int:
+    """Parse volume size in GB; non-positive / non-numeric / missing values return default."""
+    if isinstance(value, bool):
+        # bool is an int subclass; reject to avoid int(True)==1 becoming a 1 GB volume.
+        return default
+    try:
+        gb = int(value)
+    except (TypeError, ValueError):
+        return default
+    return gb if gb > 0 else default
+
+
+def opt_int(value: Any) -> int | None:
+    """Parse optional int; rejects bools (bool is int subclass — int(True)==1 is a footgun)."""
+    if value is None:
+        return None
+    if isinstance(value, bool):
+        raise TypeError(f"expected a number, got bool {value!r}")
+    return int(value)
+
+
+def opt_float(value: Any) -> float | None:
+    """Parse optional float; rejects bools (mirrors ``opt_int``)."""
+    if value is None:
+        return None
+    if isinstance(value, bool):
+        raise TypeError(f"expected a number, got bool {value!r}")
+    return float(value)

{freesolo_flash_dev-1.2.53 → freesolo_flash_dev-1.2.59}/flash/providers/runpod/job_execution.py

@@ -18,6 +18,7 @@ from flash.providers._lifecycle.deadline import (
 from flash.providers._lifecycle.poll import (
     PollErrorTracker,
     _attempt_int,
+    heartbeat_progress_ts,
     is_training_heartbeat,
     make_say,
     surface_heartbeat,
@@ -547,6 +548,20 @@ def _classify_queue_state(
     return None
 
 
+def _progress_ts(context: _PollContext, hb_key: tuple) -> float:
+    """The progress this heartbeat proves: its own ts, clamped to [launch, now].
+
+    The companion ``fresh`` flag is deliberately dropped. Its attempt half is already decided by the
+    caller, which returns early on any heartbeat that is not this attempt's, and its ts half is
+    already expressed in the clamp: a heartbeat stamped before launch cannot describe work this
+    attempt did, so it is worth exactly the launch anchor and no more. What remains is the
+    unusable-ts case, where the helper falls back to now; that matches the previous behaviour of
+    treating an untimestamped heartbeat as present-tense progress.
+    """
+    ts, _fresh = heartbeat_progress_ts(hb_key, context.launch_ts, context.current_attempt)
+    return ts
+
+
 def _update_heartbeat(context: _PollContext, state: _PollState) -> None:
     new_key, stage = surface_heartbeat(context.heartbeat_reader, state.last_hb_key, context.say)
     if new_key == state.last_hb_key:
@@ -575,17 +590,29 @@ def _update_heartbeat(context: _PollContext, state: _PollState) -> None:
     hb_ts = new_key[2]
     hb_step = new_key[1]
     is_training_hb = is_training_heartbeat(stage, hb_step)
+    # Credit the heartbeat's OWN timestamp, clamped to [launch, now], never the time we happened to
+    # read it. A heartbeat written long before a reattach and only seen now describes progress that
+    # already happened; paying it out at read time hands a wedged worker a full fresh stall window
+    # on every reattach. `_progress_ts` returns that clamped value, deliberately distinct from the
+    # raw `hb_ts` above, which stays the uploaded-ts bookkeeping the advance checks below compare.
+    # A heartbeat with no usable ts still clamps to now, preserving the existing behaviour that an
+    # untimestamped heartbeat counts as progress. It is computed only where it is used: this loop's
+    # clock is observable through `_jobs.time.time`, so an unused read would be a visible side effect.
+    #
+    # heartbeat ordering is independent of other progress sources. a queue exemption or status
+    # transition may already have advanced `last_progress` beyond this heartbeat's timestamp, so
+    # preserve the newer stall anchor while updating heartbeat-specific bookkeeping.
     if hb_attempt > state.last_hb_attempt:
         # fresh attempt: reset ts baseline and re-derive seen_training_hb so cold-start grace rearms.
         state.last_hb_attempt = hb_attempt
         state.last_hb_ts = hb_ts or 0.0
-        state.last_progress = _jobs.time.time()
+        state.last_progress = max(state.last_progress, _progress_ts(context, new_key))
         state.seen_training_hb = is_training_hb
     elif hb_attempt == state.last_hb_attempt and (hb_ts is None or hb_ts > state.last_hb_ts):
         # gate progress on ts advancing: a stale late upload must not buy a fresh stall window.
         if hb_ts is not None:
             state.last_hb_ts = hb_ts
-        state.last_progress = _jobs.time.time()
+        state.last_progress = max(state.last_progress, _progress_ts(context, new_key))
         if is_training_hb:
             state.seen_training_hb = True
 
@@ -702,7 +729,13 @@ def poll_job(
         last_hb_ts=0.0,
         # -1 sentinel < any real attempt; gates out prior-attempt leftover heartbeats
         last_hb_attempt=-1,
-        last_progress=_jobs.time.time(),
+        # Seed from the persisted LAUNCH, not this poll's start. A reattach has been billing since
+        # launch, so a worker already wedged before we attached must not be handed a fresh setup
+        # window by the mere act of looking at it -- that is what let a restart loop keep a dead
+        # worker alive to the absolute deadline. For a job queued from the start this value is
+        # overwritten anyway by the queued exemption in `_classify_stall`, which re-anchors on every
+        # pre-grant poll; it is the ALREADY-PLACED job at poll start where the difference is real.
+        last_progress=launch_ts,
         seen_training_hb=False,
         last_health_probe=0.0,
         unhealthy_timer=_jobs.GraceTimer(),
@@ -741,8 +774,13 @@ def poll_job(
             state.ever_saw_worker = True
         if status != state.last_status:
             say(f"job {handle.job_id}: {status}")
+            # A genuine TRANSITION is progress, so it moves the clock. The FIRST observation is not a
+            # transition -- `last_status` simply starts unset -- and crediting it would throw away the
+            # launch anchor on poll one, which is exactly how a delayed reattach used to win back a
+            # whole setup window before any evidence of progress had been seen.
+            if state.last_status is not None:
+                state.last_progress = _jobs.time.time()
             state.last_status = status
-            state.last_progress = _jobs.time.time()
         terminal = _classify_terminal_status(context, state, provider_status, status)
         if terminal is not None:
             return terminal

{freesolo_flash_dev-1.2.53 → freesolo_flash_dev-1.2.59}/flash/runner/__init__.py

@@ -28,7 +28,6 @@ from flash.adapters.artifacts import MAX_ATTEMPT_ID as MAX_ATTEMPT_ID
 # moved code reads them back through it. an autofix that drops them breaks those tests.
 from flash.core.catalog import ModelInfo, resolve_model  # noqa: F401
 from flash.core.spec import (  # noqa: F401
-    _DROPPED_TOP_LEVEL_KEYS,
     MANAGED_GPU_KEYS,
     TRAINER_BACKEND,
     GpuSpec,
@@ -124,19 +123,11 @@ def _adapter_ref_for_status(status: RunStatus) -> str | None:
     raw_worker = (status.effective_preparation or {}).get("worker_spec")
     if not raw_worker:
         return None
-    # a workload-profile run recorded before #1095 removed the profile job has a managed hf_repo but
-    # never produced an adapter. its worker payload still carries the marker, which JobSpec.from_dict
-    # now drops, so read it off the raw record rather than reviving the field.
-    if isinstance(raw_worker, dict) and raw_worker.get("workload_profile_kind"):
-        return None
     try:
         spec = _internal_spec_from_status(status)
     except Exception:
-        # a status json written by an OLDER plane can carry since-removed spec keys (e.g.
-        # ``gpu.exact_type`` pre-#670), and stored run records are never rewritten. JobSpec.from_dict
-        # is strict, so parsing raises -- and one such record would 500 the whole runs list. same
-        # operational tolerance as _runstatus_from_json: the record stays readable, it just shows no
-        # adapter ref (its spec cannot name one we could resolve).
+        # an unparseable stored spec must not 500 the whole runs list: the record stays readable, it
+        # just shows no adapter ref (its spec cannot name one we could resolve).
         return None
     if not spec.train.hf_repo:
         return None
@@ -805,13 +796,11 @@ from flash.runner.preparation import (  # noqa: E402,F401
     _preparation_digest,
     _prepare_init_from_adapter,
     _prepare_init_from_adapter_inner,
-    _prepared_before_public_alpha,
     _profile_producer_version,
     _require_pinned_profile_environment,
     _require_sft_workload_profile,
     _require_supported_adapter_continuation,
     _resolve_model_revision,
-    _stored_rollout_batch_spelling,
     _validate_effective_spec,
     _warmstart_source_is_authorized,
 )

{freesolo_flash_dev-1.2.53 → freesolo_flash_dev-1.2.59}/flash/runner/costs.py

@@ -88,47 +88,6 @@ def _spec_pinned_to_horizon(spec, steps: int):
     return _replace(spec, train=_replace(spec.train, max_steps=max(1, int(steps))))
 
 
-def _spec_with_legacy_pool_horizon(spec):
-    """``spec`` with a legacy ``[environment.params] max_examples`` restated as ``[train]``, for PRORATION ONLY.
-
-    A run accepted before flash stopped reading that key was quoted from it, and cancelling it now
-    has to answer "what fraction of the accepted work happened" -- a question about the OLD work
-    model, not about what flash would quote today. Without this the full-work reprice raises (no
-    stated pool) while the partial pins ``max_steps`` and prices the uncapped batch, so the fraction
-    dies and the charge falls through to the quote cap: a legacy 10-step run cancelled after ONE
-    step bills 100% of its quote instead of 10%.
-
-    Restating it under ``[train]`` reproduces the horizon the accepted quote was computed from,
-    which is exactly what the ratio needs. Safe here in a way it is not at submit: both sides of
-    ``partial / full`` are repriced through this same shape, so the value only ever sets a fraction
-    between two numbers that share it -- it never becomes a price a customer is quoted, and the
-    result stays capped by the quote they accepted. Specs that state ``[train] max_examples`` or
-    ``max_steps`` already have a horizon and are returned untouched.
-    """
-    from dataclasses import replace as _replace
-
-    if getattr(spec, "algorithm", "") not in ("grpo", "opd"):
-        return spec
-    train = getattr(spec, "train", None)
-    if train is None or int(getattr(train, "max_examples", 0) or 0) > 0:
-        return spec
-    if int(getattr(train, "max_steps", 0) or 0) > 0:
-        return spec
-    params = getattr(getattr(spec, "environment", None), "params", {}) or {}
-    if not isinstance(params, dict):
-        return spec
-    try:
-        legacy_pool = int(params.get("max_examples") or 0)
-    except (TypeError, ValueError, OverflowError):
-        # same unreadable-value cases _env_max_examples guarded: `int(inf)` raises OverflowError,
-        # `int(nan)` ValueError. an unreadable pool is no horizon, so leave the spec alone and let
-        # the caller's own unpriceable-fraction branch handle it.
-        return spec
-    if legacy_pool <= 0:
-        return spec
-    return _replace(spec, train=_replace(train, max_examples=legacy_pool))
-
-
 def charge_usd_for_spec(
     spec,
     *,
@@ -303,9 +262,8 @@ def cancelled_charge_usd(
         # billing retry predicate (cost_usd > 0) can never settle, silently stranding the run
         # unbilled, so the fallback propagates and the caller records the pricing failure.
         return float(fallback)
-    prorated_spec = _spec_with_legacy_pool_horizon(spec)
     partial = runner.charge_usd_for_spec(
-        prorated_spec,
+        spec,
         steps=n,
         fallback=float("nan"),
         provider=provider,
@@ -313,7 +271,7 @@ def cancelled_charge_usd(
         gpu_count=gpu_count,
     )
     full = runner.charge_usd_for_spec(
-        prorated_spec,
+        spec,
         fallback=float("nan"),
         provider=provider,
         gpu_type=gpu_type,

{freesolo_flash_dev-1.2.53 → freesolo_flash_dev-1.2.59}/flash/runner/preparation.py

@@ -16,9 +16,7 @@ import json
 import os
 import re
 from dataclasses import replace
-from typing import Any
 
-from flash.core.catalog import normalize_algorithm, samples_on_policy
 from flash.core.spec import JobSpec
 
 
@@ -298,129 +296,17 @@ def _mark_warmstart_source(worker_spec: JobSpec, child_run_id: str) -> None:
         )
 
 
-def _prepared_before_public_alpha(raw_public: object) -> bool:
-    """True when this run's PERSISTED public spec predates ``lora_alpha`` becoming authorable.
-
-    The discriminator is the stored bytes, not this build's serialization: a snapshot prepared
-    before the change hashed a public spec with no alpha key, and its digest can only be reproduced
-    the same way. status.spec is never rewritten, so this answer is stable for the run's life.
-
-    A warm-start spec is excluded even though it also omits alpha -- to_dict() strips rank and alpha
-    for those in every version, so absence there says nothing about when the run was prepared, and
-    treating it as legacy would drop a binding that costs nothing to keep.
-    """
-    if not isinstance(raw_public, dict):
-        return False
-    train = raw_public.get("train")
-    if not isinstance(train, dict) or "lora_alpha" in train:
-        return False
-    return not train.get("init_from_adapter")
-
-
-_ROLLOUT_BATCH_KEYS = ("batch_size", "prompts_per_step")
-
-
-def _stored_rollout_batch_spelling(raw_spec: object) -> dict[str, Any] | None:
-    """How a PERSISTED rollout spec spelled its optimizer batch, or None if it is not one.
-
-    Same discriminator style as ``_prepared_before_public_alpha``: the answer comes from the stored
-    bytes, which are never rewritten, so it is stable for the run's life.
-
-    ``JobSpec.from_dict`` MOVES the pre-1.1.43 ``batch_size`` onto ``prompts_per_step`` when
-    reparsing, so rehashing a persisted spec with today's parse can produce different bytes than
-    were hashed at persist time -- failing integrity validation for exactly the warm-start grpo/opd
-    runs this migration exists to rescue.
-
-    Both keys are reported, rather than just the value there is to migrate. Reporting only the
-    latter conflates snapshots that have nothing to move but still change shape: a mixed-version
-    payload storing both names (the migration drops the old one, so the stored ``batch_size`` still
-    has to be rehashed), one whose legacy value is non-positive (discarded by the parser), and a
-    modern payload (nothing to do). Replaying the stored spelling covers all of them uniformly.
-
-    A key merely holding null reports None; a key genuinely OMITTED is omitted from the reading too,
-    because the two hash differently. Every digest is taken over a serialized ``JobSpec``, which
-    emits both names, so a null was really hashed as null -- while 1.1.40 predates
-    ``prompts_per_step`` entirely and hashed no such key. Each half's reading therefore carries its
-    OWN absence rather than sharing one flag: after a re-persist the worker half is rewritten in the
-    modern shape while ``status.spec`` keeps the legacy one, so the halves genuinely disagree about
-    which keys exist and a single flag would misdescribe one of them.
-
-    This is not a way to forge a batch: the replayed values are the STORED ones, and the digest they
-    are compared against was computed over the ORIGINAL ones, so any tampering still mismatches.
-
-    Only a rollout algorithm is eligible: for sft ``batch_size`` is the current, un-migrated name,
-    which ``from_dict`` leaves alone.
-    """
-    if not isinstance(raw_spec, dict):
-        return None
-    if not samples_on_policy(normalize_algorithm(str(raw_spec.get("algorithm") or ""))):
-        return None
-    train = raw_spec.get("train")
-    if not isinstance(train, dict):
-        return None
-    stored = {key: train.get(key) for key in _ROLLOUT_BATCH_KEYS}
-    # the 1.1.40 shape, read off the bytes themselves: it carried the old name and no new one.
-    # a payload omitting BOTH says nothing about when it was written, and the serializer always
-    # emits both -- so treating that as absence would drop a key that WAS hashed.
-    if "batch_size" in train and "prompts_per_step" not in train:
-        del stored["prompts_per_step"]
-    return stored
-
-
-def _restore_rollout_batch_spelling(payload: dict, stored: dict | None) -> None:
-    """Put the optimizer-batch keys back exactly as the stored payload hashed them.
-
-    A key absent from ``stored`` was absent from the hashed bytes, so it is removed rather than
-    written -- that is the 1.1.40 shape, which predates ``prompts_per_step``.
-    """
-    if stored is None:
-        return
-    train = payload.get("train")
-    if not isinstance(train, dict):
-        return
-    for key in _ROLLOUT_BATCH_KEYS:
-        if key in stored:
-            train[key] = stored[key]
-        else:
-            train.pop(key, None)
-
-
 def _preparation_digest(
     public_spec: JobSpec,
     worker_spec: JobSpec,
     adapter_identity: dict | None,
-    *,
-    legacy_keys: dict | None = None,
-    legacy_public_keys: dict | None = None,
-    legacy_public_alpha: bool = False,
-    stored_rollout_batch: dict | None = None,
-    stored_public_rollout_batch: dict | None = None,
 ) -> str:
     worker_payload = worker_spec.to_internal_dict()
     public_payload = public_spec.to_dict()
-    # the rollout optimizer batch was renamed `batch_size` -> `prompts_per_step`, and from_dict now
-    # MOVES it when reparsing a persisted spec. Rehash under the spelling the snapshot actually
-    # stored -- including a key it did not have -- so a spec written before or across the rename
-    # still reproduces its digest. Same reason as the omissions and restorations below.
-    #
-    # Each half is restored from ITS OWN stored payload, exactly like legacy_keys vs
-    # legacy_public_keys below. Feeding the worker's spelling to both would overwrite whatever the
-    # public payload held before hashing -- and since the parse DROPS a superseded `batch_size`,
-    # `_validate_effective_spec` cannot see it either, so a tampered public value would be erased
-    # rather than caught. The two halves legitimately differ (the public spec is a stripped view),
-    # so they cannot share one reading -- including which keys they carry at all, which is why each
-    # reading holds its own absence instead of a shared flag. Re-persisting rewrites the worker half
-    # in the modern shape and leaves `status.spec` legacy, so from then on the halves disagree.
-    _restore_rollout_batch_spelling(worker_payload, stored_rollout_batch)
-    _restore_rollout_batch_spelling(public_payload, stored_public_rollout_batch)
-    # ``[environment] pip`` became user-authorable, so to_dict() now emits it where it used to be
-    # stripped, and a pre-upgrade snapshot hashed an environment with no pip key at all. Dropping it
-    # when empty reproduces those bytes without needing to know when the run was prepared: absent
-    # and empty are the same install, so they must hash alike. An authored pip is non-empty and
-    # stays bound, so tampering with the persisted value is still caught.
+    # absent and empty pip are the same install, so they must hash alike.
     if not public_payload["environment"].get("pip"):
         public_payload["environment"].pop("pip", None)
-    # omit empty fields so existing version-1 snapshots keep their historical digest.
+    # omit empty managed fields so the hashed payload carries only what the run actually set.
     for key in (
         "model_revision_auto",
         "gpu_count_auto",
@@ -430,34 +316,6 @@ def _preparation_digest(
     ):
         if not worker_payload.get(key):
             worker_payload.pop(key, None)
-    # Restore since-removed keys the STORED payload carried, for the same reason as the omissions
-    # above: the digest has to reproduce the bytes that were hashed, not today's serialization. A
-    # pre-upgrade snapshot hashed `model_policy` in (to_internal_dict was asdict, so it emitted the
-    # defaulted value), and the field no longer exists -- so rehashing without it mismatches and a
-    # still-valid warm-start or workload-profile run fails integrity validation on recovery. Only
-    # keys registered as historical public removals are honoured. Any field the dataclass still
-    # defines already comes from worker_spec, so replaying its identical stored value cannot forge it.
-    for key, value in (legacy_keys or {}).items():
-        if key in _runner()._DROPPED_TOP_LEVEL_KEYS:
-            worker_payload[key] = value
-    # a dropped key that was USER-AUTHORABLE was hashed on the public side too, not just the worker
-    # side. model_policy never was, so restoring only the worker payload was enough for it;
-    # model_revision and worker_env were, so a pre-upgrade public_spec carried them and the digest
-    # cannot reproduce without them.
-    for key, value in (legacy_public_keys or {}).items():
-        if key in _runner()._DROPPED_TOP_LEVEL_KEYS:
-            public_payload[key] = value
-    # ``lora_alpha`` became user-authorable, so to_dict() now emits it for non-warm-start runs. A
-    # snapshot prepared BEFORE that change hashed a public spec without alpha, so rehashing it with
-    # alpha would fail a still-valid run's integrity check on recovery -- same reason as the
-    # omissions and restorations above. That omission is scoped to those legacy snapshots only: a
-    # digest created from here on binds the public alpha, so tampering with the persisted public
-    # value is caught. Without that binding the two halves can disagree silently, because
-    # _runner()._validate_effective_spec() excludes lora_alpha from its structural comparison (the worker's
-    # warm-start-inherited alpha legitimately differs from the public one), leaving the digest as
-    # the only thing that could cover it.
-    if legacy_public_alpha:
-        public_payload["train"].pop("lora_alpha", None)
     payload = {
         "version": 1,
         "public_spec": public_payload,
@@ -488,15 +346,12 @@ def _validate_effective_spec(public_spec: JobSpec, worker_spec: JobSpec) -> None
         "workload_profile",
     ):
         effective[managed_top] = public.get(managed_top)
-    # the pin value is stripped from every new public spec. a runner-assigned pin is asymmetric by
-    # design, as is an authored pin inherited by a new warm-start child after the public key's removal.
-    # exclude those two cases only. a historical authored source still carries its public revision and
-    # remains structurally compared. both asymmetric shapes are digest-protected: the marker triggers
-    # verification for auto pins, and every warm start verifies its complete preparation snapshot.
-    if not public.get("model_revision") and (
-        worker_spec.model_revision_auto or public.get("train", {}).get("init_from_adapter")
-    ):
-        effective["model_revision"] = public.get("model_revision")
+    # the pin value is stripped from EVERY public spec (`to_dict` drops it), so the worker half
+    # legitimately carries a revision the public half cannot: a runner-assigned pin, or an authored
+    # pin a warm-start child inherited. the asymmetry is therefore unconditional and excluded here.
+    # it stays digest-protected: the auto marker triggers digest verification, and every warm start
+    # verifies its complete preparation snapshot.
+    effective["model_revision"] = public.get("model_revision")
     public_train = dict(public["train"])
     effective_train = dict(effective["train"])
     public_ref = public_train.get("init_from_adapter") or ""