simulo 0.23.0__tar.gz → 0.24.0__tar.gz

{simulo-0.23.0/src/simulo.egg-info → simulo-0.24.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: simulo
-Version: 0.23.0
+Version: 0.24.0
 Summary: Simulo SDK and CLI — define robotics simulation and training apps in Python and run them on the Simulo cloud.
 Author-email: Simulo Team <team@simulo.ai>
 License: BSD-3-Clause
@@ -15,12 +15,12 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Typing :: Typed
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
-Requires-Dist: simulo-interfaces<0.18,>=0.17.0
+Requires-Dist: simulo-interfaces<0.19,>=0.18.0
 Requires-Dist: mcap<2,>=1.3
 Requires-Dist: defusedxml>=0.7.1
-Requires-Dist: usd-core<27,>=25.5
+Requires-Dist: usd-core<27,>=26.5
 Provides-Extra: assets
-Requires-Dist: usd-core<27,>=25.5; extra == "assets"
+Requires-Dist: usd-core<27,>=26.5; extra == "assets"
 Provides-Extra: dev
 Requires-Dist: black==26.5.1; extra == "dev"
 Requires-Dist: isort==8.0.1; extra == "dev"

{simulo-0.23.0 → simulo-0.24.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "simulo"
-version = "0.23.0"
+version = "0.24.0"
 description = "Simulo SDK and CLI — define robotics simulation and training apps in Python and run them on the Simulo cloud."
 readme = "PYPI.md"
 requires-python = ">=3.11"
@@ -26,7 +26,7 @@ classifiers = [
 # mcap: used by `simulo recordings` to read back a downloaded recording and
 # verify it (message count) — MIT-licensed, deps only lz4+zstandard.
 dependencies = [
-    "simulo-interfaces>=0.17.0,<0.18",
+    "simulo-interfaces>=0.18.0,<0.19",
     "mcap>=1.3,<2",
     # Hardened XML parsing for URDF ingestion (USD Asset Catalogs, PR-12 fix
     # loop 2, security NIT): stdlib xml.etree.ElementTree relies on
@@ -44,7 +44,7 @@ dependencies = [
     # discover first). Still torch-free and still lazy-imported ONLY on the
     # USD inspection path (`_client/asset_package.py::_load_pxr_usdutils`) —
     # importing `simulo` itself never pays its cost.
-    "usd-core>=25.5,<27",
+    "usd-core>=26.5,<27",
 ]
 
 [project.optional-dependencies]
@@ -53,7 +53,7 @@ dependencies = [
 # install above in 0.13.1, so this extra is now redundant (its dep is
 # already installed unconditionally) but harmless — resolvers don't warn on
 # an extra whose contents are already satisfied by the base requirement.
-assets = ["usd-core>=25.5,<27"]
+assets = ["usd-core>=26.5,<27"]
 # black/isort/ruff/mypy pinned EXACT, not >=: these are rule-set tools whose
 # defaults change between releases, so an unbounded lower bound lets CI silently
 # resolve a newer release than a developer's environment has — "clean locally" and
@@ -141,6 +141,9 @@ module = ["pxr", "pxr.*"]
 ignore_missing_imports = true
 
 [tool.pytest.ini_options]
+# Resolve the client from this checkout before any shared editable installation.
+# This makes the documented pytest command exercise the checkout that owns tests/.
+pythonpath = ["src"]
 testpaths = ["tests"]
 addopts = "--import-mode=importlib"
 # A healthy hosted leg spent 36s before pytest and 63s in pytest, leaving roughly

{simulo-0.23.0 → simulo-0.24.0}/src/simulo/_client/_secure_downloads.py

@@ -110,9 +110,13 @@ before.
 
 from __future__ import annotations
 
+import ctypes
+import errno
 import os
 import secrets
 import stat as stat_module
+import sys
+import unicodedata
 from pathlib import Path
 from typing import Optional
 
@@ -137,6 +141,27 @@ class DestinationDirectoryError(OSError):
     """
 
 
+def _retained_temp_error(
+    destination_display_path: Path, temp_name: str, exc: Exception, *, existing_final_preserved: bool = False
+) -> DestinationDirectoryError:
+    """Describe a possible temporary residue without trusting its current path."""
+    preservation = "Existing final entry was preserved. " if existing_final_preserved else ""
+    return DestinationDirectoryError(
+        f"{preservation}Download created private temporary entry {temp_name!r} in the originally selected "
+        f"destination directory {destination_display_path} before the failure. That directory and name may now "
+        "resolve elsewhere; locate and verify the original entry before cleanup. Do not delete a same-named "
+        "current path unless its identity is independently confirmed. "
+        f"Could not complete the download write: {exc}."
+    )
+
+
+def _close_fd_quietly(fd: int) -> None:
+    try:
+        os.close(fd)
+    except OSError:
+        pass
+
+
 #: ``True`` when this interpreter can perform openat-style,
 #: directory-file-descriptor-relative operations for every primitive this
 #: module needs. A platform property, checked once at import time — used by
@@ -164,6 +189,89 @@ SUPPORTS_DIR_FD = (
 #: count for the same collision-on-``O_EXCL`` situation.
 _TEMP_NAME_ATTEMPTS = 64
 
+# Linux ``renameat2(..., RENAME_NOREPLACE)`` is one syscall: either the
+# temporary entry becomes the final entry and the temporary name disappears,
+# or an existing final entry is left untouched.  ``link`` followed by
+# ``unlink`` cannot offer that postcondition because a process death between
+# those calls leaves both names behind.  Keep the optional libc binding at
+# module scope so unsupported libc/platform combinations are explicitly
+# refused rather than silently falling back to replacement.
+_AT_FDCWD = -100
+_RENAME_NOREPLACE = 1
+_RENAME_EXCL = 0x00000004
+_renameat2 = None
+_renameatx_np = None
+if sys.platform.startswith("linux"):
+    _libc = ctypes.CDLL(None, use_errno=True)
+    _renameat2 = getattr(_libc, "renameat2", None)
+    if _renameat2 is not None:
+        _renameat2.argtypes = [ctypes.c_int, ctypes.c_char_p, ctypes.c_int, ctypes.c_char_p, ctypes.c_uint]
+        _renameat2.restype = ctypes.c_int
+elif sys.platform == "darwin":
+    _libc = ctypes.CDLL(None, use_errno=True)
+    _renameatx_np = getattr(_libc, "renameatx_np", None)
+    if _renameatx_np is not None:
+        _renameatx_np.argtypes = [ctypes.c_int, ctypes.c_char_p, ctypes.c_int, ctypes.c_char_p, ctypes.c_uint]
+        _renameatx_np.restype = ctypes.c_int
+
+
+def _rename_noreplace(
+    source: str,
+    destination: str,
+    *,
+    src_dir_fd: Optional[int] = None,
+    dst_dir_fd: Optional[int] = None,
+) -> None:
+    """Atomically publish *source* at absent *destination*, or fail closed.
+
+    Linux uses ``renameat2(RENAME_NOREPLACE)`` and macOS uses
+    ``renameatx_np(RENAME_EXCL)``.  Windows' native ``os.rename`` refuses an
+    existing destination. Other platforms deliberately refuse the
+    server-derived no-clobber path instead of using a two-name link/unlink
+    sequence or replacing an existing file. Explicit user file targets keep
+    using ``os.replace`` through ``replace_existing=True``.
+    """
+    if os.name == "nt":
+        if src_dir_fd is not None or dst_dir_fd is not None:
+            raise DestinationDirectoryError(
+                "This platform cannot atomically publish a server-named download through directory descriptors."
+            )
+        os.rename(source, destination)
+        return
+    if sys.platform.startswith("linux"):
+        rename_function = _renameat2
+        flag = _RENAME_NOREPLACE
+    elif sys.platform == "darwin":
+        rename_function = _renameatx_np
+        flag = _RENAME_EXCL
+    else:
+        rename_function = None
+        flag = 0
+    if rename_function is None:
+        raise DestinationDirectoryError(
+            "This platform cannot atomically publish a server-named download without replacing an existing file."
+        )
+    old_dir_fd = _AT_FDCWD if src_dir_fd is None else src_dir_fd
+    new_dir_fd = _AT_FDCWD if dst_dir_fd is None else dst_dir_fd
+    ctypes.set_errno(0)
+    result = rename_function(
+        old_dir_fd,
+        os.fsencode(source),
+        new_dir_fd,
+        os.fsencode(destination),
+        flag,
+    )
+    if result == 0:
+        return
+    error_number = ctypes.get_errno()
+    if error_number == errno.EEXIST:
+        raise FileExistsError(error_number, os.strerror(error_number), destination)
+    if error_number in (errno.EINVAL, errno.ENOSYS, errno.EOPNOTSUPP):
+        raise DestinationDirectoryError(
+            "This filesystem cannot atomically publish a server-named download without replacing an existing file."
+        )
+    raise OSError(error_number, os.strerror(error_number), destination)
+
 
 def _random_temp_name(final_name: str) -> str:
     """One candidate temp-file name for ``final_name``, unpredictable
@@ -174,6 +282,10 @@ def _random_temp_name(final_name: str) -> str:
     return f".{final_name}.{secrets.token_hex(8)}.part"
 
 
+def _portable_name_key(name: str) -> str:
+    return unicodedata.normalize("NFKC", name).casefold()
+
+
 def _validate_leaf_name(final_name: str) -> None:
     """Refuse anything that is not a bare basename.
 
@@ -244,15 +356,22 @@ class DestinationDirectory:
     #: re-resolved for a filesystem operation once the handle exists.
     display_path: Path
 
-    def write_atomic(self, final_name: str, data: bytes) -> None:
+    def write_atomic(self, final_name: str, data: bytes, *, replace_existing: bool = True) -> None:
         """Write *data* into ``final_name`` directly inside this directory.
 
-        Torn-write-free and interruption-safe: a same-directory temporary
-        file is written, flushed, and ``fsync``'d, then atomically renamed
-        onto ``final_name`` — a killed process or full disk leaves either
-        the previous complete file (if any) or the new one, never a partial
-        write, and never a stray temp file. ``final_name`` must be a bare
-        basename (no path separators); see :func:`_validate_leaf_name`.
+        A same-directory temporary file is written, flushed, and ``fsync``'d,
+        then published atomically. With ``replace_existing=True`` it replaces
+        a prior complete entry; otherwise publication fails if *any* final
+        entry already exists. Any failure after temporary-file creation may
+        leave that mode-0600 ``.part`` entry behind. No backend deletes it
+        automatically because a pathname can be replaced before cleanup.
+        Ordinary write and publication errors name the temporary entry and ask
+        the operator to locate and verify it before manual cleanup.
+        ``KeyboardInterrupt`` and
+        ``SystemExit`` are re-raised unchanged; their possible residue is
+        documented here rather than reported while interrupting the caller.
+        ``final_name`` must be a bare basename (no path separators); see
+        :func:`_validate_leaf_name`.
         """
         raise NotImplementedError
 
@@ -309,26 +428,85 @@ class _DirFdDestinationDirectory(DestinationDirectory):
             "after repeated attempts."
         ) from last_exc
 
-    def write_atomic(self, final_name: str, data: bytes) -> None:
+    def _refuse_portable_alias(self, final_name: str, *, published_identity: Optional[tuple[int, int]] = None) -> None:
+        aliases = [
+            name
+            for name in os.listdir(self._fd)
+            if name != final_name and _portable_name_key(name) == _portable_name_key(final_name)
+        ]
+        if not aliases:
+            return
+        if published_identity is not None:
+            current = os.stat(final_name, dir_fd=self._fd, follow_symlinks=False)
+            if (current.st_dev, current.st_ino) != published_identity:
+                raise DestinationDirectoryError(
+                    f"A portable-equivalent alias appeared after the complete download was published at "
+                    f"{final_name!r}, and another process replaced that entry before identity verification. "
+                    "Manual resolution is required; the client did not delete either entry."
+                )
+            # Python exposes no conditional unlink-by-inode primitive. Leave
+            # the proven self-published entry in place rather than reopening a
+            # stat-to-unlink race that could delete a replacement.
+            raise DestinationDirectoryError(
+                f"The complete download was published at {final_name!r}, but portable-equivalent alias "
+                f"{aliases[0]!r} appeared. Manual resolution is required; the client did not delete either entry."
+            )
+        raise DestinationDirectoryError(
+            f"Refusing to publish {final_name!r}: portable-equivalent alias {aliases[0]!r} exists."
+        )
+
+    def write_atomic(self, final_name: str, data: bytes, *, replace_existing: bool = True) -> None:
         _validate_leaf_name(final_name)
+        if not replace_existing:
+            self._refuse_portable_alias(final_name)
         fd, temp_name = self._mkstemp(final_name)
+        try:
+            published_identity = os.fstat(fd)
+        except (KeyboardInterrupt, SystemExit):
+            _close_fd_quietly(fd)
+            raise
+        except Exception as exc:
+            _close_fd_quietly(fd)
+            raise _retained_temp_error(self.display_path, temp_name, exc) from exc
         try:
             handle = os.fdopen(fd, "wb")
-        except BaseException:
-            os.close(fd)
+        except (KeyboardInterrupt, SystemExit):
+            _close_fd_quietly(fd)
             raise
+        except Exception as exc:
+            _close_fd_quietly(fd)
+            raise _retained_temp_error(self.display_path, temp_name, exc) from exc
+        published = False
+        existing_final_preserved = False
         try:
             with handle:
                 handle.write(data)
                 handle.flush()
                 os.fsync(handle.fileno())
-            os.replace(temp_name, final_name, src_dir_fd=self._fd, dst_dir_fd=self._fd)
-        except BaseException:
-            try:
-                os.unlink(temp_name, dir_fd=self._fd)
-            except FileNotFoundError:
-                pass
+            if replace_existing:
+                os.replace(temp_name, final_name, src_dir_fd=self._fd, dst_dir_fd=self._fd)
+                published = True
+            else:
+                try:
+                    _rename_noreplace(temp_name, final_name, src_dir_fd=self._fd, dst_dir_fd=self._fd)
+                except FileExistsError as exc:
+                    existing_final_preserved = True
+                    raise DestinationDirectoryError(
+                        f"Refusing to replace existing download destination {final_name!r} in {self.display_path}. "
+                        "The existing final entry was preserved."
+                    ) from exc
+                published = True
+                self._refuse_portable_alias(
+                    final_name, published_identity=(published_identity.st_dev, published_identity.st_ino)
+                )
+        except (KeyboardInterrupt, SystemExit):
             raise
+        except Exception as exc:
+            if published:
+                raise
+            raise _retained_temp_error(
+                self.display_path, temp_name, exc, existing_final_preserved=existing_final_preserved
+            ) from exc
 
     def close(self) -> None:
         if not self._closed:
@@ -398,29 +576,84 @@ class _PathIdentityDestinationDirectory(DestinationDirectory):
             "after repeated attempts."
         ) from last_exc
 
-    def write_atomic(self, final_name: str, data: bytes) -> None:
+    def _refuse_portable_alias(self, final_name: str, *, published_identity: Optional[tuple[int, int]] = None) -> None:
+        aliases = [
+            path
+            for path in self.display_path.iterdir()
+            if path.name != final_name and _portable_name_key(path.name) == _portable_name_key(final_name)
+        ]
+        if not aliases:
+            return
+        if published_identity is not None:
+            final_path = self.display_path / final_name
+            info = final_path.stat(follow_symlinks=False)
+            if (info.st_dev, info.st_ino) != published_identity:
+                raise DestinationDirectoryError(
+                    f"A portable-equivalent alias appeared after the complete download was published at "
+                    f"{final_name!r}, and another process replaced that entry before identity verification. "
+                    "Manual resolution is required; the client did not delete either entry."
+                )
+            raise DestinationDirectoryError(
+                f"The complete download was published at {final_name!r}, but portable-equivalent alias "
+                f"{aliases[0].name!r} appeared. Manual resolution is required; the client did not delete either entry."
+            )
+        raise DestinationDirectoryError(f"Refusing to publish {final_name!r}: portable-equivalent alias exists.")
+
+    def write_atomic(self, final_name: str, data: bytes, *, replace_existing: bool = True) -> None:
         _validate_leaf_name(final_name)
         self._verify_unchanged()
+        if not replace_existing:
+            self._refuse_portable_alias(final_name)
         fd, temp_path = self._mkstemp(final_name)
+        try:
+            published_identity = os.fstat(fd)
+        except (KeyboardInterrupt, SystemExit):
+            _close_fd_quietly(fd)
+            raise
+        except Exception as exc:
+            _close_fd_quietly(fd)
+            raise _retained_temp_error(self.display_path, temp_path.name, exc) from exc
         final_path = self.display_path / final_name
         try:
             handle = os.fdopen(fd, "wb")
-        except BaseException:
-            os.close(fd)
+        except (KeyboardInterrupt, SystemExit):
+            _close_fd_quietly(fd)
             raise
+        except Exception as exc:
+            _close_fd_quietly(fd)
+            raise _retained_temp_error(self.display_path, temp_path.name, exc) from exc
+        published = False
+        existing_final_preserved = False
         try:
             with handle:
                 handle.write(data)
                 handle.flush()
                 os.fsync(handle.fileno())
             self._verify_unchanged()
-            os.replace(os.fspath(temp_path), os.fspath(final_path))
-        except BaseException:
-            try:
-                os.unlink(os.fspath(temp_path))
-            except FileNotFoundError:
-                pass
+            if replace_existing:
+                os.replace(os.fspath(temp_path), os.fspath(final_path))
+                published = True
+            else:
+                try:
+                    _rename_noreplace(os.fspath(temp_path), os.fspath(final_path))
+                except FileExistsError as exc:
+                    existing_final_preserved = True
+                    raise DestinationDirectoryError(
+                        f"Refusing to replace existing download destination {final_name!r} in {self.display_path}. "
+                        "The existing final entry was preserved."
+                    ) from exc
+                published = True
+                self._refuse_portable_alias(
+                    final_name, published_identity=(published_identity.st_dev, published_identity.st_ino)
+                )
+        except (KeyboardInterrupt, SystemExit):
             raise
+        except Exception as exc:
+            if published:
+                raise
+            raise _retained_temp_error(
+                self.display_path, temp_path.name, exc, existing_final_preserved=existing_final_preserved
+            ) from exc
 
     def close(self) -> None:
         self._closed = True
@@ -526,6 +759,39 @@ class DestinationObservation:
             )
         self._consumed = True
 
+    def is_existing_directory(self) -> bool:
+        """Whether the selected directory existed when this observation began."""
+        if self.absent_names is not None:
+            return not self.absent_names
+        return self.existed
+
+    def matches_directory(self, directory: Path) -> bool:
+        """Whether *directory* is exactly the path this observation owns."""
+        return self.expanded == Path(os.path.expanduser(os.fspath(directory)))
+
+    def contained_destination(self, final_name: str) -> Path:
+        """Return a final path that passed this observation's containment check.
+
+        The later open consumes this same observation, so a selected directory
+        swapped after this check cannot redirect the write. A swap visible to
+        the path-resolution check instead causes a refusal.
+        """
+        _validate_leaf_name(final_name)
+        destination = self.expanded / final_name
+        try:
+            resolved_root = self.expanded.resolve(strict=False)
+            resolved_destination = destination.resolve(strict=False)
+            resolved_destination.relative_to(resolved_root)
+        except (OSError, RuntimeError, ValueError) as exc:
+            raise DestinationDirectoryError(
+                f"Could not validate {destination} beneath selected directory {self.expanded}: {exc}"
+            ) from exc
+        if resolved_destination == resolved_root:
+            raise DestinationDirectoryError(
+                f"Refusing to write {final_name!r}: it resolves to the selected directory itself."
+            )
+        return destination
+
     def close(self) -> None:
         """Release the held descriptor, if any, and mark this observation
         spent — a later :func:`open_destination_directory` call on it must
@@ -595,11 +861,20 @@ def _observe_posix(directory: Path) -> DestinationObservation:
     # deliberately, not closed: this is what pins its inode against reuse
     # for the entire gap until `open_destination_directory` runs. See the
     # module docstring.
+    was_symlink = False
+    if not absent_names:
+        try:
+            was_symlink = stat_module.S_ISLNK(os.lstat(os.fspath(expanded)).st_mode)
+        except OSError as exc:
+            if current_fd is not None:
+                os.close(current_fd)
+            raise DestinationDirectoryError(f"Could not observe download destination {expanded}: {exc}") from exc
     return DestinationObservation(
         expanded,
         is_absolute=is_absolute,
         held_fd=current_fd,
         absent_names=absent_names,
+        was_symlink=was_symlink,
     )
 
 
@@ -739,6 +1014,23 @@ def _open_posix(observation: DestinationObservation) -> _DirFdDestinationDirecto
     current_fd = observation.held_fd
     observation.held_fd = None
     try:
+        if current_fd is not None and not observation.absent_names:
+            try:
+                leaf_lstat = os.lstat(os.fspath(expanded))
+                leaf_stat = os.stat(os.fspath(expanded), follow_symlinks=True)
+            except OSError as exc:
+                raise DestinationDirectoryError(
+                    f"Download destination {expanded} became unreachable during the download: {exc}"
+                ) from exc
+            if not observation.was_symlink and stat_module.S_ISLNK(leaf_lstat.st_mode):
+                raise DestinationDirectoryError(
+                    f"Refusing to write into {expanded}: it became a symlink during the download."
+                )
+            held_stat = os.fstat(current_fd)
+            if (leaf_stat.st_dev, leaf_stat.st_ino) != (held_stat.st_dev, held_stat.st_ino):
+                raise DestinationDirectoryError(
+                    f"Refusing to write into {expanded}: it was replaced with a different directory during the download."
+                )
         if current_fd is None and not observation.is_absolute:
             # Nothing existed below the anchor, and the anchor itself is
             # the process's own current working directory (an absolute

{simulo-0.23.0 → simulo-0.24.0}/src/simulo/_client/app.py

@@ -45,6 +45,7 @@ from simulo.interfaces.platform.enums import ResumePolicy
 
 if TYPE_CHECKING:  # typing-only; avoids a module-scope dependency on the HTTP client
     from simulo._client.preflight_api import PreflightOutcome
+    from simulo.interfaces.platform.manifest import PreflightFinding
 
 F = TypeVar("F", bound=Callable[..., object])
 
@@ -310,6 +311,56 @@ def _spawn_local(job_name: str, package_path: Path) -> JobHandle:
     return JobHandle(job_id, package_path, job_name)
 
 
+def _skip_preflight_hint(blocking: "Sequence[PreflightFinding]") -> str:
+    """The follow-on sentence :func:`_handle_preflight_outcome` appends after
+    its blocking-finding count, chosen from the WHOLE batch rather than one
+    finding at a time.
+
+    For most blocking codes this is the plain hint every prior release has
+    printed: the flag still bypasses the whole preflight phase, and nothing
+    here makes a finding unbypassable — ``skip_preflight_requested``'s
+    docstring rule ("a blocking finding can never become an unbypassable
+    wall") is unchanged.
+
+    ``runtime_not_available`` is the one exception, and only the ADVICE
+    changes, not the flag's behavior. The generic hint's two stated reasons
+    to bypass are "preflight is wrong about your app" and "the platform is
+    unreachable" — this finding is neither: it fires only when the
+    requested runtime id is absent from an ESTABLISHED inventory (at least
+    one worker has actually reported a runtime, so the known set describes
+    the fleet rather than merely restating the default); when nothing has
+    ever reported, that same absence is the advisory ``unknown_runtime``
+    instead (see ``preflight/service.py``'s ``_runtime_availability_finding``).
+    That established-inventory fact is real regardless of workload — the
+    same trigger fires for an unavailable GPU runtime as for an unavailable
+    CPU one. Bypassing it does not route around a wrong opinion, it
+    re-enables the exact silent substitution onto the platform's GPU-backed
+    default runtime that this finding exists to prevent, so the generic
+    hint is replaced with one naming that substitution WITHOUT inventing a
+    rate, an estimate, or any claim about what the workload itself needs —
+    there is no rate card (``PreflightResponse.estimate`` is reserved and
+    always ``null``; see ``preflight/schemas.py``/``routes.py``). Keyed on
+    ``finding.code`` (the server's own vocabulary — see
+    ``preflight_render.py``'s module docstring), never on message text.
+
+    ``--skip-preflight`` bypasses the entire preflight call, not one finding
+    in isolation (see ``skip_preflight_requested``), so if ANY finding in
+    *blocking* is ``runtime_not_available``, the qualified sentence governs
+    the whole raise even when an ordinary, safely-bypassable finding is also
+    blocking alongside it — bypassing would still re-enable that finding's
+    harm too.
+    """
+    from simulo._client.preflight_render import RUNTIME_NOT_AVAILABLE_CODE
+
+    if any(finding.code == RUNTIME_NOT_AVAILABLE_CODE for finding in blocking):
+        return (
+            "--skip-preflight would submit anyway, but not onto the runtime you asked for — this "
+            "platform doesn't offer it, so the job would run on the platform's default runtime "
+            "instead, which is GPU-backed."
+        )
+    return "Pass --skip-preflight to submit anyway (not recommended)."
+
+
 def _handle_preflight_outcome(outcome: "PreflightOutcome", *, job_name: str) -> None:
     """Print + decide for one preflight answer inside ``_spawn_cloud``.
 
@@ -331,7 +382,8 @@ def _handle_preflight_outcome(outcome: "PreflightOutcome", *, job_name: str) ->
     ``blocking`` finding raises :class:`PreflightBlockedError` with a short
     stderr summary — the detailed ``✗`` lines are already on stdout by the
     time this raises, so the exception message is a summary + the
-    ``--skip-preflight`` hint, not a duplicate render.
+    ``--skip-preflight`` hint (:func:`_skip_preflight_hint`), not a
+    duplicate render.
     """
     from simulo._client.preflight_render import render_preflight_findings, render_preflight_skip_notice
 
@@ -343,7 +395,7 @@ def _handle_preflight_outcome(outcome: "PreflightOutcome", *, job_name: str) ->
         return
     raise PreflightBlockedError(
         f"{len(blocking)} preflight issue(s) blocked job {job_name!r} — nothing was uploaded and no "
-        "job was created. Pass --skip-preflight to submit anyway (not recommended)."
+        f"job was created. {_skip_preflight_hint(blocking)}"
     )