tensorfs 0.3.28__tar.gz → 0.3.30__tar.gz

{tensorfs-0.3.28 → tensorfs-0.3.30}/Cargo.lock

@@ -392,7 +392,7 @@ checksum = "adb6935a6f5c20170eeceb1a3835a49e12e19d792f6dd344ccc76a985ca5a6ca"
 
 [[package]]
 name = "tensorfs-core"
-version = "0.3.28"
+version = "0.3.30"
 dependencies = [
  "fs2",
  "minicbor",
@@ -404,7 +404,7 @@ dependencies = [
 
 [[package]]
 name = "tensorfs-py"
-version = "0.3.28"
+version = "0.3.30"
 dependencies = [
  "pyo3",
  "tensorfs-core",

{tensorfs-0.3.28 → tensorfs-0.3.30}/Cargo.toml

@@ -3,5 +3,5 @@ resolver = "2"
 members = ["crates/tensorfs-core", "crates/tensorfs-py"]
 
 [workspace.package]
-version = "0.3.28"
+version = "0.3.30"
 edition = "2021"

{tensorfs-0.3.28 → tensorfs-0.3.30}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tensorfs
-Version: 0.3.28
+Version: 0.3.30
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Programming Language :: Rust

{tensorfs-0.3.28 → tensorfs-0.3.30}/crates/tensorfs-core/src/bin/tfs/fetch.rs

@@ -228,6 +228,34 @@ fn credential_of(
 /// unbound Store is a pull with no cache, and a cache that is missing, cold, corrupt,
 /// read-only or unmounted degrades to exactly that pull.
 pub fn cmd_pull(root: &Path, refspec: &str, flags: &Flags) -> ExitCode {
+    pull_with_budget(root, refspec, flags, None)
+}
+
+/// A distinct verb makes an older CLI refuse instead of ignoring new quota flags.
+pub fn cmd_bounded_pull(root: &Path, refspec: &str, flags: &Flags) -> ExitCode {
+    let bound = |name: &str| {
+        let values = crate::flag_all(flags, name);
+        if values.len() != 1 {
+            return None;
+        }
+        values[0].parse::<u64>().ok()
+    };
+    let (Some(bytes), Some(objects)) = (bound("max-download-bytes"), bound("max-download-objects"))
+    else {
+        eprintln!(
+            "bounded fetch requires one unsigned --max-download-bytes and --max-download-objects"
+        );
+        return ExitCode::from(2);
+    };
+    pull_with_budget(root, refspec, flags, Some((bytes, objects)))
+}
+
+fn pull_with_budget(
+    root: &Path,
+    refspec: &str,
+    flags: &Flags,
+    budget: Option<(u64, u64)>,
+) -> ExitCode {
     let store = ok!(Store::open(root));
     let Some(base) = flag(flags, "hub") else {
         eprintln!("--hub <base-url> is required");
@@ -247,6 +275,7 @@ pub fn cmd_pull(root: &Path, refspec: &str, flags: &Flags) -> ExitCode {
     request.session = flag(flags, "session").unwrap_or("");
     request.streams = crate::flag_num(flags, "streams", transport::STREAMS);
     request.deadline = deadline_of(flags);
+    request.download_budget = budget;
     // THE WALK REPORTS WHILE IT WALKS.
     //
     // Until now `tfs fetch` printed one report at the end, the pod's supervisor buffered
@@ -258,17 +287,18 @@ pub fn cmd_pull(root: &Path, refspec: &str, flags: &Flags) -> ExitCode {
     // What is printed is what was MEASURED — bytes through each door and the instant they
     // landed — and nothing derived. A rate is the consumer's division of two of these
     // samples, which is the only place it can be computed honestly: this walk has sixteen
-    // streams and no opinion about what interval anyone wants to average over. There is no
-    // denominator here on purpose. `FetchPlan` knows it and `pull()` holds it, but a
-    // caller that must not invent a percentage would rather be given none than one this
-    // side guessed.
+    // streams and no opinion about what interval anyone wants to average over. The
+    // denominator is the native FetchPlan's declared byte count. The plan callback also
+    // supplies already-held bytes, so a resumed or warm pull starts at its real position.
     //
     // The two doors are separate counters because they cost different things and only one
     // of them is an invoice. A cache that has silently gone cold produces a complete
     // closure, correct totals, and a bill — and looks exactly like a warm one unless the
     // split is reported while it happens.
     let progress = PullProgress::new(request.sample_seconds);
+    let planned = |plan: &FetchPlan| progress.planned(plan);
     let observe = |_object: &ObjectRef, moved: u64, door: ObjectSource| progress.saw(moved, door);
+    request.on_plan = Some(&planned);
     request.on_object = Some(&observe);
     let report = ok!(transport::pull(&request));
     progress.settle();
@@ -1282,6 +1312,8 @@ struct PullProgress {
 }
 
 struct PullProgressState {
+    total_bytes: u64,
+    held_bytes: u64,
     origin_bytes: u64,
     cache_bytes: u64,
     origin_objects: u64,
@@ -1293,6 +1325,8 @@ impl PullProgress {
     fn new(sample_seconds: f64) -> PullProgress {
         PullProgress {
             state: Mutex::new(PullProgressState {
+                total_bytes: 0,
+                held_bytes: 0,
                 origin_bytes: 0,
                 cache_bytes: 0,
                 origin_objects: 0,
@@ -1303,6 +1337,14 @@ impl PullProgress {
         }
     }
 
+    fn planned(&self, plan: &FetchPlan) {
+        let mut state = self.state.lock().unwrap();
+        state.total_bytes = plan.declared_bytes();
+        state.held_bytes = plan.held_bytes();
+        state.last = Some(Instant::now());
+        print_progress(&state);
+    }
+
     fn saw(&self, moved: u64, door: ObjectSource) {
         let mut state = self.state.lock().unwrap();
         match door {
@@ -1364,7 +1406,8 @@ impl PullProgress {
 /// door at all, and those are the two states worth telling apart.
 fn print_progress(state: &PullProgressState) {
     eprintln!(
-        "{{\"event\":\"pull.progress\",\"origin_bytes\":{},\"cache_bytes\":{},\"origin_objects\":{},\"cache_objects\":{}}}",
-        state.origin_bytes, state.cache_bytes, state.origin_objects, state.cache_objects
+        "{{\"event\":\"pull.progress\",\"total_bytes\":{},\"held_bytes\":{},\"origin_bytes\":{},\"cache_bytes\":{},\"origin_objects\":{},\"cache_objects\":{}}}",
+        state.total_bytes, state.held_bytes, state.origin_bytes, state.cache_bytes,
+        state.origin_objects, state.cache_objects
     );
 }

{tensorfs-0.3.28 → tensorfs-0.3.30}/crates/tensorfs-core/src/bin/tfs/main.rs

@@ -47,6 +47,8 @@
 //! and the origin. It is bound by `tfs store ensure --repo-cache` and never by a flag here.
 //!
 //!   tfs fetch <root> <ref>       closure -> plan -> N-way walk (presign at use) -> proof
+//!   tfs fetch bounded <root> <ref> --max-download-bytes N --max-download-objects N
+//!                               same pull, refused before body transfer if new objects exceed bounds
 //!   tfs fetch plan-objects <root> <session> --refs <jsonl>   HELD/WANTED, no manifest
 //!   tfs fetch url <root> <sha256> <length> <url|-> [--progress] [--streams N]
 //!                                                    one granted object, in parallel ranges
@@ -351,6 +353,7 @@ fn main() -> ExitCode {
         ["fetch", "plan-objects", r, s] => fetch::cmd_plan_objects(Path::new(r), s, &flags),
         ["fetch", "admit", r, p, i] => fetch::cmd_admit(Path::new(r), Path::new(p), i, &flags),
         ["fetch", "complete", r, p] => fetch::cmd_complete(Path::new(r), Path::new(p)),
+        ["fetch", "bounded", r, refspec] => fetch::cmd_bounded_pull(Path::new(r), refspec, &flags),
         ["fetch", "url", r, i, l, u] => fetch::cmd_url(Path::new(r), i, l, u, &flags),
         ["staging", "fetch", r, i, l, u] => fetch::cmd_staging_fetch(Path::new(r), i, l, u, &flags),
         ["staging", "drop", r, i] => fetch::cmd_staging_drop(Path::new(r), i),
@@ -361,7 +364,15 @@ fn main() -> ExitCode {
         ["source", "plan", u] => fetch::cmd_source_plan(u, &flags),
         ["source", "pull", r, u] => fetch::cmd_source_pull(Path::new(r), u, &flags),
         ["fetch", sub, _t]
-            if ["plan", "plan-objects", "admit", "complete", "url"].contains(sub) =>
+            if [
+                "plan",
+                "plan-objects",
+                "admit",
+                "complete",
+                "url",
+                "bounded",
+            ]
+            .contains(sub) =>
         {
             eprintln!("usage: see the header of {}", file!());
             ExitCode::from(2)

{tensorfs-0.3.28 → tensorfs-0.3.30}/crates/tensorfs-core/src/transport/api.rs

@@ -185,7 +185,13 @@ fn open_following_with<'l>(
             None,
             deadline,
             ledger,
-            false,
+            // The one plane tfs-106 deliberately left as it was. A foreign source read is
+            // not serving a hub call and has the source lane's own per-part retry above it,
+            // so arming a plane here would change a path this lane did not measure. It is
+            // therefore still bounded by the caller's deadline alone, and a foreign source
+            // that accepts a connection and stops sending to a caller who set no deadline
+            // still waits. Named here so the next reader finds a decision, not an oversight.
+            http::Judge::Deadline,
             None,
             Code::TRANSFER_FAILED,
         )?;

{tensorfs-0.3.28 → tensorfs-0.3.30}/crates/tensorfs-core/src/transport/http.rs

@@ -8,8 +8,19 @@
 //!   rebinding window `egress.py` could only name;
 //! - **every socket wait is bounded by the caller's deadline and judged by the liveness
 //!   ledger, never by an invented constant.** The socket read timeout here is the ledger's
-//!   sampling RESOLUTION; each empty tick re-consults the deadline and, on a judged body,
-//!   the measured stall rule. Nothing in this file owns a number of seconds.
+//!   sampling RESOLUTION; each empty tick re-consults the deadline and the measured stall
+//!   rule. Nothing in this file owns a number of seconds.
+//!
+//! That second claim used to hold for the BYTE plane only, and tfs-106 is the repair. A
+//! caller with no wall deadline — which is every pod fetch, deliberately, because a module
+//! that substituted a number there would be deciding on the caller's behalf that a large
+//! artifact on a slow link is a failure — could wait here forever: `read_head` and the TLS
+//! handshake looped on an empty tick with nothing to consult, and a hub exchange left the
+//! body rule disarmed. That is how a presign to a black-holed tunnel held `Leases::minting`
+//! while sixteen streams parked behind it and two paid H100s billed fifteen minutes at
+//! exactly zero bytes. A CONTROL-plane exchange now answers to `Judge::Transfer`: the
+//! pull's own progress, which is a measurement, and never to this call's own duration,
+//! which would be a constant.
 
 use crate::err::{refuse, Code, Refusal, Result};
 use crate::transport::ledger::{Deadline, Ledger};
@@ -27,6 +38,90 @@ fn would_block(error: &std::io::Error) -> bool {
     matches!(error.kind(), ErrorKind::WouldBlock | ErrorKind::TimedOut)
 }
 
+/// What an exchange's SILENCE answers to, beyond the caller's deadline.
+///
+/// The two planes measure different things because they are different things, and the whole
+/// defect tfs-106 repairs is that only one of them was measured at all.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Judge {
+    /// The BYTE plane. This stream's own chunks, against the pull's measured pace: an
+    /// object GET that accepted a connection and stopped sending is stalled, closed, and
+    /// re-asked, which the plan already made cost one object.
+    Stream,
+    /// The CONTROL plane. A hub call has no bytes of its own worth judging — a mint that
+    /// takes a minute while sixteen streams keep landing objects is a call, not a wedge —
+    /// so it is judged by the PULL'S OWN PROGRESS instead. It faults exactly when nothing
+    /// has landed anywhere in this pull for longer than the pull's measured pace allows,
+    /// which is the owner's rule read literally: the lack of measured progress, never a
+    /// number of seconds.
+    Transfer,
+    /// Neither. The caller's deadline is the only bound, which is what a foreign-source
+    /// read with its own per-part retry loop above it already had.
+    Deadline,
+}
+
+/// The CONTROL plane's verdict, quoting exactly the figures a reader needs and no others:
+/// how long this call has been waiting, what the pull has actually landed, how long ago,
+/// and the term the pull itself taught. Nobody has to read this file to learn whether the
+/// number was earned.
+///
+/// It refuses `TRANSFER_FAILED` and deliberately not the exchange's own `fail` code. The hub
+/// may be perfectly healthy; what has been established is that the transfer this call serves
+/// has stopped, and calling that "the hub did not answer" would send the next reader to the
+/// wrong machine. It is also what makes the verdict terminal in `hub::call` instead of
+/// re-asked three more times: a re-ask reaches the identical conclusion on its first tick and
+/// would only overwrite this diagnosis with a duller one.
+fn transfer_verdict(
+    judge: Judge,
+    ledger: &Ledger,
+    since: Instant,
+    waiting_for: &str,
+) -> Result<()> {
+    if judge != Judge::Transfer {
+        return Ok(());
+    }
+    let still = ledger.still();
+    // NOTHING MOVED IS NOT THE SAME AS STOPPED MOVING, and the owner's rule turns on exactly
+    // that distinction: kill or error on the lack of MEASURED progress. A pull that has not
+    // yet landed a byte has measured nothing about its own pace, so there is no term here
+    // that is not a number somebody made up — and a made-up number is the thing this whole
+    // module refuses. A hub call that wedges before the first byte of a pull is therefore
+    // still bounded by the caller's deadline alone. That is a real remaining silence and it
+    // is stated rather than papered over with a constant.
+    if still.moved == 0 {
+        return Ok(());
+    }
+    let patience = ledger.stillness();
+    // TWO CLOCKS, AND BOTH MUST BE PAST THE MEASURED TERM. `silent` is how long the pull has
+    // moved nothing; `outstanding` is how long THIS call has been the thing it waits on.
+    //
+    // A call must never inherit stillness that predates it. Between one object landing and
+    // the next mint going out, a pull is legitimately still — it is hashing, fsyncing and
+    // committing what just arrived — and a mint that opened into the tail of that would
+    // otherwise be condemned on its first tick for local work it had nothing to do with.
+    // Requiring the call to have been outstanding for the term as well gives every call a
+    // full measured window of its own, and leaves the verdict meaning what it says: this
+    // call has been waiting this long, and the transfer moved nothing in any of it.
+    let outstanding = since.elapsed();
+    if still.silent <= patience || outstanding <= patience {
+        return Ok(());
+    }
+    refuse(
+        Code::TRANSFER_FAILED,
+        format!(
+            "the transfer this call serves has stopped: {:.1} s waiting for {waiting_for}, \
+             {} B landed in this pull and none of them for {:.1} s, against the {:.1} s \
+             this pull's own measured pace allows ({} times the longest it has ever gone \
+             still and recovered, and never less than one stream's own term)",
+            outstanding.as_secs_f64(),
+            still.moved,
+            still.silent.as_secs_f64(),
+            patience.as_secs_f64(),
+            crate::transport::ledger::STALL_FACTOR,
+        ),
+    )
+}
+
 pub struct Client {
     tls: Arc<rustls::ClientConfig>,
 }
@@ -182,10 +277,14 @@ fn tls_handshake(
     sock: &mut TcpStream,
     conn: &mut rustls::ClientConnection,
     deadline: Deadline,
-    sample: Duration,
+    ledger: &Ledger,
+    judge: Judge,
+    since: Instant,
     fail: Code,
 ) -> Result<()> {
+    let sample = ledger.sample();
     while conn.is_handshaking() {
+        transfer_verdict(judge, ledger, since, "a TLS handshake")?;
         let tick = match deadline.remaining()? {
             Some(left) => left.min(sample),
             None => sample,
@@ -275,8 +374,11 @@ pub struct BodyReader<'l> {
     raw_at: usize,
     deadline: Deadline,
     ledger: &'l Ledger,
-    judge: bool,
+    judge: Judge,
     advanced: Instant,
+    /// When this body's reader was built — the start of the wait a control-plane verdict
+    /// measures, so a body that opens into a pull's local pause is not condemned for it.
+    since: Instant,
     failure: Option<Refusal>,
     stalled: bool,
     fail: Code,
@@ -309,8 +411,9 @@ impl BodyReader<'_> {
                     return Ok(n);
                 }
                 Err(e) if would_block(&e) => {
+                    transfer_verdict(self.judge, self.ledger, self.since, "a response body")?;
                     let silent = self.advanced.elapsed();
-                    if self.judge && silent > self.ledger.patience() {
+                    if self.judge == Judge::Stream && silent > self.ledger.patience() {
                         self.stalled = true;
                         let _ = self.wire.sock().shutdown(std::net::Shutdown::Both);
                         return refuse(
@@ -381,7 +484,30 @@ impl BodyReader<'_> {
         }
     }
 
+    /// One read of the framed body, and the ONE place the pull's own progress is counted.
+    ///
+    /// It is counted here and not at the socket because `read_head` fills its buffer with
+    /// the head AND whatever of the body arrived behind it, so a small object can land in
+    /// its entirety before this reader exists. Counting at the socket missed exactly those,
+    /// which left the control plane believing a busy pull had moved nothing — the one state
+    /// in which it must not judge at all.
+    ///
+    /// THE PULL'S PROGRESS IS ITS ARTIFACT BYTES. A judged body is an object crossing the
+    /// door and is counted; anything else — a hub's JSON answer, a foreign source read —
+    /// advances the pull without adding to the figure a refusal quotes, because a reader
+    /// checking that figure against the transfer's own report must find the same number.
     pub fn read_refusing(&mut self, out: &mut [u8]) -> Result<usize> {
+        let n = self.read_framed(out)?;
+        if n > 0 {
+            match self.judge {
+                Judge::Stream => self.ledger.moved(n as u64),
+                _ => self.ledger.answered(),
+            }
+        }
+        Ok(n)
+    }
+
+    fn read_framed(&mut self, out: &mut [u8]) -> Result<usize> {
         if out.is_empty() {
             return Ok(0);
         }
@@ -469,11 +595,13 @@ impl Read for BodyReader<'_> {
 }
 
 /// One exchange: connect to the CHECKED addresses, write the request, read the head, hand
-/// back the framed body. `judge_body` arms the ledger's stall verdict on body reads (the
-/// object plane); hub JSON exchanges leave it off and answer to the deadline alone, as
-/// `pull.py`'s `_json` did. `write_silence` bounds one WRITE operation that moves nothing
-/// — the push plane derives it from the ledger's floor, the port of egress.py's one
-/// derived silence bound; `None` answers to the deadline alone.
+/// back the framed body. `judge` says which plane this exchange belongs to and therefore
+/// what its silence answers to — see `Judge`. It governs EVERY wait in the exchange, not
+/// only the body: the handshake, the request write and the response head are exactly where
+/// a black-holed tunnel parks a hub call, and leaving them unjudged is what made a
+/// deadline-free caller wait forever. `write_silence` additionally bounds one WRITE
+/// operation that moves nothing — the push plane derives it from the ledger's floor, the
+/// port of egress.py's one derived silence bound; `None` leaves the write to `judge`.
 #[allow(clippy::too_many_arguments)]
 pub fn request<'l>(
     client: &Client,
@@ -483,7 +611,7 @@ pub fn request<'l>(
     body: Option<&[u8]>,
     deadline: Deadline,
     ledger: &'l Ledger,
-    judge_body: bool,
+    judge: Judge,
     write_silence: Option<Duration>,
     fail: Code,
 ) -> Result<Response<'l>> {
@@ -501,7 +629,7 @@ pub fn request<'l>(
             })?;
         let mut sock = sock;
         let mut conn = Box::new(conn);
-        tls_handshake(&mut sock, &mut conn, deadline, ledger.sample(), fail)?;
+        tls_handshake(&mut sock, &mut conn, deadline, ledger, judge, opened, fail)?;
         Wire::Tls { sock, conn }
     } else {
         Wire::Plain(sock)
@@ -531,12 +659,19 @@ pub fn request<'l>(
         &request_bytes,
         deadline,
         ledger,
+        judge,
+        opened,
         write_silence,
         fail,
     )?;
 
-    let (status, response_headers, spill) = read_head(&mut wire, deadline, ledger, fail)?;
+    let (status, response_headers, spill) =
+        read_head(&mut wire, deadline, ledger, judge, opened, fail)?;
     ledger.taught(opened.elapsed());
+    // A HEAD THAT ARRIVED IS PROGRESS. Without this, the second page of a paginated closure
+    // would be judged from the start of the first, and a pull whose hub is merely slow
+    // would condemn its own second call for the first call's honest latency.
+    ledger.answered();
 
     let framing = framing_of(status, &response_headers, fail)?;
     Ok(Response {
@@ -549,8 +684,9 @@ pub fn request<'l>(
             raw_at: 0,
             deadline,
             ledger,
-            judge: judge_body,
+            judge,
             advanced: Instant::now(),
+            since: Instant::now(),
             failure: None,
             stalled: false,
             fail,
@@ -558,17 +694,21 @@ pub fn request<'l>(
     })
 }
 
+#[allow(clippy::too_many_arguments)]
 fn write_all(
     wire: &mut Wire,
     bytes: &[u8],
     deadline: Deadline,
     ledger: &Ledger,
+    judge: Judge,
+    since: Instant,
     silence: Option<Duration>,
     fail: Code,
 ) -> Result<()> {
     let mut at = 0;
     let mut advanced = Instant::now();
     loop {
+        transfer_verdict(judge, ledger, since, "a request write")?;
         let tick = match deadline.remaining()? {
             Some(left) => left.min(ledger.sample()),
             None => ledger.sample(),
@@ -611,7 +751,14 @@ fn write_all(
 /// Status, headers (lowercased names), and body bytes read past the head.
 type Head = (u16, Vec<(String, String)>, Vec<u8>);
 
-fn read_head(wire: &mut Wire, deadline: Deadline, ledger: &Ledger, fail: Code) -> Result<Head> {
+fn read_head(
+    wire: &mut Wire,
+    deadline: Deadline,
+    ledger: &Ledger,
+    judge: Judge,
+    since: Instant,
+    fail: Code,
+) -> Result<Head> {
     let mut collected: Vec<u8> = Vec::new();
     let mut buf = vec![0u8; 8 * 1024];
     let split = loop {
@@ -624,7 +771,7 @@ fn read_head(wire: &mut Wire, deadline: Deadline, ledger: &Ledger, fail: Code) -
         if collected.len() > HEAD_MAX_BYTES {
             return refuse(fail, "response head passed 64 KiB");
         }
-        let n = read_step_ticking(wire, &mut buf, deadline, ledger, fail)?;
+        let n = read_step_ticking(wire, &mut buf, deadline, ledger, judge, since, fail)?;
         if n == 0 {
             return refuse(
                 fail,
@@ -660,9 +807,12 @@ fn read_step_ticking(
     buf: &mut [u8],
     deadline: Deadline,
     ledger: &Ledger,
+    judge: Judge,
+    since: Instant,
     fail: Code,
 ) -> Result<usize> {
     loop {
+        transfer_verdict(judge, ledger, since, "a response head")?;
         let tick = match deadline.remaining()? {
             Some(left) => left.min(ledger.sample()),
             None => ledger.sample(),

{tensorfs-0.3.28 → tensorfs-0.3.30}/crates/tensorfs-core/src/transport/hub.rs

@@ -505,6 +505,15 @@ fn call(
             client, base, path, body, credential, policy, deadline, ledger,
         ) {
             Ok(value) => return Ok(value),
+            // NOT WEATHER, AND NOT ABOUT THE HUB (tfs-106). `TRANSFER_FAILED` out of an
+            // exchange means the PULL has stopped moving while this call was outstanding.
+            // Re-asking reaches the identical verdict on the next attempt's first tick —
+            // nothing this loop does can restart a transfer — and the only thing three more
+            // asks would achieve is replacing a refusal that names the response head with
+            // one that names a request write. Answer with what was measured.
+            Err(Retryable { refusal, .. }) if refusal.code == Code::TRANSFER_FAILED => {
+                return Err(refusal)
+            }
             Err(Retryable { wait, refusal }) if !final_attempt => {
                 // A wait is spent out of the caller's budget, never past it.
                 let wait = match deadline.remaining()? {
@@ -561,7 +570,13 @@ fn call_once(
         Some(body),
         deadline,
         ledger,
-        false,
+        // THE CONTROL PLANE (tfs-106). Every wait in this exchange answers to the pull's own
+        // progress. It is not a bound on how long a mint may take — a hub is entitled to be
+        // slow, and a mint outstanding while sixteen streams keep landing objects is left
+        // entirely alone. It is a bound on a call that is serving a transfer which has
+        // itself stopped, which is the only shape `Leases::minting` can wedge in, and the
+        // shape that cost `gayong` and `weed` fifteen billed minutes at zero bytes.
+        crate::transport::http::Judge::Transfer,
         None,
         Code::HUB_UNREACHABLE,
     )