tensorfs 0.3.60__tar.gz → 0.3.61__tar.gz

{tensorfs-0.3.60 → tensorfs-0.3.61}/Cargo.lock

@@ -439,7 +439,7 @@ checksum = "adb6935a6f5c20170eeceb1a3835a49e12e19d792f6dd344ccc76a985ca5a6ca"
 
 [[package]]
 name = "tensorfs-core"
-version = "0.3.60"
+version = "0.3.61"
 dependencies = [
  "fs2",
  "libc",
@@ -454,7 +454,7 @@ dependencies = [
 
 [[package]]
 name = "tensorfs-py"
-version = "0.3.60"
+version = "0.3.61"
 dependencies = [
  "pyo3",
  "tensorfs-core",

{tensorfs-0.3.60 → tensorfs-0.3.61}/Cargo.toml

@@ -3,5 +3,5 @@ resolver = "2"
 members = ["crates/tensorfs-core", "crates/tensorfs-py"]
 
 [workspace.package]
-version = "0.3.60"
+version = "0.3.61"
 edition = "2021"

{tensorfs-0.3.60 → tensorfs-0.3.61}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tensorfs
-Version: 0.3.60
+Version: 0.3.61
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Programming Language :: Rust

{tensorfs-0.3.60 → tensorfs-0.3.61}/crates/tensorfs-core/src/bin/tfs/fetch.rs

@@ -273,7 +273,8 @@ fn pull_with_budget(
     let mut request = PullRequest::new(&store, base, refspec, &credential, &policy);
     request.lane = flag(flags, "lane").unwrap_or("");
     request.session = flag(flags, "session").unwrap_or("");
-    request.streams = crate::flag_num(flags, "streams", transport::STREAMS);
+    request.streams = crate::flag_num(flags, "streams", transport::PULL_STREAMS);
+    request.streams_start = crate::flag_num(flags, "streams-start", transport::STREAMS);
     request.deadline = deadline_of(flags);
     request.download_budget = budget;
     // THE WALK REPORTS WHILE IT WALKS.
@@ -300,7 +301,11 @@ fn pull_with_budget(
     let observe = |_object: &ObjectRef, moved: u64, door: ObjectSource| progress.saw(moved, door);
     request.on_plan = Some(&planned);
     request.on_object = Some(&observe);
+    let before = tensorfs_core::stats::snapshot();
+    let started = std::time::Instant::now();
     let report = ok!(transport::pull(&request));
+    let seconds = started.elapsed().as_secs_f64();
+    let after = tensorfs_core::stats::snapshot();
     progress.settle();
     if !tensorfs_core::repo_cache::finish_optional_backfills() {
         eprintln!("repo cache replication incomplete; local fetch remains complete");
@@ -313,6 +318,32 @@ fn pull_with_budget(
         quoted(&report.model), quoted(&report.manifest), quoted(&report.scope),
         report.cache_writes.bytes(), report.bytes_cached, report.bytes_total,
     );
+    // What each stream level bought, so a slow pull says whether more streams helped
+    // (one GET was the limit) or not (the link, disk or origin was).
+    let levels: Vec<String> = report
+        .levels
+        .iter()
+        .map(|level| {
+            format!(
+                "[{},{}]",
+                level.streams,
+                level.bytes_per_second.round() as u64
+            )
+        })
+        .collect();
+    // And what admitting them cost: a pull whose streams stop growing while its batches
+    // take most of the wall time is held by the disk, not the link.
+    eprintln!(
+        "{{\"event\":\"pull.streams\",\"model\":{},\"seconds\":{:.3},\"bytes_moved\":{},\"streams\":{},\"levels\":[{}],\"admission\":{{\"objects\":{},\"batches\":{},\"seconds\":{:.3}}}}}",
+        quoted(&report.model),
+        seconds,
+        report.bytes_moved,
+        report.streams,
+        levels.join(","),
+        after.admitted_objects - before.admitted_objects,
+        after.admission_batches - before.admission_batches,
+        (after.admission_nanos - before.admission_nanos) as f64 / 1e9,
+    );
     println!(
         "model        {}@{} lane {}",
         report.model, report.release, report.lane

{tensorfs-0.3.60 → tensorfs-0.3.61}/crates/tensorfs-core/src/bin/tfs/main.rs

@@ -42,7 +42,9 @@
 //! The ONE transport (tfs-048/tfs-049/tfs-050). The credential is `--credential-file` or
 //! TFS_CREDENTIAL (`bearer <token>`, or empty for anonymous), never bare argv; a
 //! URL of `-` arrives on stdin. Flags: --hub <base> --lane --session --streams <n>
-//! --timeout <s> --allow-hosts a,b,.c --allow-local --max-redirects <n>.
+//! --streams-start <n> --timeout <s> --allow-hosts a,b,.c --allow-local --max-redirects <n>.
+//! `--streams` is the most objects in flight (default 128, memory-bounded); the walk starts
+//! at `--streams-start` (default 16) and doubles while measured goodput follows.
 //! `tfs fetch` reads and backfills the Store's bound repo cache between the local Store
 //! and the origin. It is bound by `tfs store ensure --repo-cache` and never by a flag here.
 //!

{tensorfs-0.3.60 → tensorfs-0.3.61}/crates/tensorfs-core/src/catalog.rs

@@ -903,8 +903,9 @@ impl Catalog {
         hold_on(&self.connection()?, operation, key, length)
     }
 
-    /// The object's existing hold and verification become durable together. Filesystem
-    /// publication still precedes its verification record, with FULL synchronization.
+    /// A HELD admission: the hold is written before the object is published, so an
+    /// operation that cannot hold it publishes nothing. Unheld admissions, which is every
+    /// pull, take `record_grouped` instead.
     pub(crate) fn admit_blob(
         &self,
         operation: Option<&str>,
@@ -914,7 +915,7 @@ impl Catalog {
         // One admission at a time per catalog in this process, holding the write lock from
         // before publication: streams landing objects together queue here instead of in
         // SQLite's busy timeout, where a lost race refused bytes already verified.
-        let turn = admissions(&self.path);
+        let turn = held_admissions(&self.path);
         let _turn = turn.lock().unwrap_or_else(|error| error.into_inner());
         let mut connection = self.connection()?;
         let transaction = connection
@@ -941,6 +942,117 @@ impl Catalog {
         Ok(verified.is_some())
     }
 
+    /// The object's existing hold and verification become durable together. Filesystem
+    /// publication has already happened, on the caller's thread, and precedes this record,
+    /// which is written with FULL synchronization.
+    ///
+    /// Records queue per catalog in this process, and whichever arrives while no batch is
+    /// committing leads the next one: one immediate transaction and one commit make every
+    /// waiting record durable. One object alone costs what it always did. Before this,
+    /// directory creation, link, directory fsync and commit ran for one object at a time
+    /// under one lock, several fsyncs each, and on a disk busy flushing those same objects'
+    /// bodies that queue, not the network, set a pull's rate.
+    pub(crate) fn record_grouped(&self, recording: Recording) -> Result<()> {
+        let group = admission_group(&self.path);
+        let mut state = group
+            .state
+            .lock()
+            .unwrap_or_else(|error| error.into_inner());
+        let ticket = state.next;
+        state.next += 1;
+        state.queue.push((ticket, recording));
+        loop {
+            if let Some(result) = state.done.remove(&ticket) {
+                return result;
+            }
+            if state.leading {
+                state = group
+                    .turned
+                    .wait(state)
+                    .unwrap_or_else(|error| error.into_inner());
+                continue;
+            }
+            state.leading = true;
+            let batch = std::mem::take(&mut state.queue);
+            let mut lead = Lead {
+                group: &group,
+                tickets: batch.iter().map(|(ticket, _)| *ticket).collect(),
+                results: Vec::new(),
+            };
+            drop(state);
+            let started = std::time::Instant::now();
+            let objects = batch.len();
+            lead.results = self.record_batch(batch);
+            crate::stats::admission_batch(objects, started.elapsed());
+            drop(lead);
+            state = group
+                .state
+                .lock()
+                .unwrap_or_else(|error| error.into_inner());
+        }
+    }
+
+    fn record_batch(&self, batch: Vec<(u64, Recording)>) -> Vec<(u64, Result<()>)> {
+        let fail_all = |batch: Vec<(u64, Recording)>, error: Refusal| {
+            batch
+                .into_iter()
+                .map(|(ticket, _)| (ticket, Err(error.clone())))
+                .collect::<Vec<_>>()
+        };
+        let mut connection = match self.connection() {
+            Ok(connection) => connection,
+            Err(error) => return fail_all(batch, error),
+        };
+        let mut transaction =
+            match connection.transaction_with_behavior(rusqlite::TransactionBehavior::Immediate) {
+                Ok(transaction) => transaction,
+                Err(error) => return fail_all(batch, sql("begin blob admission", error)),
+            };
+        let mut results = Vec::with_capacity(batch.len());
+        let mut written = Vec::with_capacity(batch.len());
+        // Each object's row sits behind its own savepoint: one refused row refuses that
+        // object, as it did when every object had a transaction of its own.
+        for (ticket, recording) in batch {
+            let outcome = transaction
+                .savepoint()
+                .map_err(|error| sql("begin object admission", error))
+                .and_then(|savepoint| {
+                    if let Some(row) = &recording.record {
+                        write_verification_on(&savepoint, row)?;
+                    }
+                    savepoint
+                        .commit()
+                        .map_err(|error| sql("record object admission", error))
+                });
+            match outcome {
+                Ok(()) => written.push((ticket, recording.record)),
+                Err(error) => results.push((ticket, Err(error))),
+            }
+        }
+        match transaction
+            .commit()
+            .map_err(|error| sql("commit blob admission", error))
+        {
+            Ok(()) => {
+                let trust = Trust::live(&self.path);
+                for (ticket, record) in written {
+                    if let (Some(row), Some(trust)) = (&record, &trust) {
+                        trust.remember(row);
+                    }
+                    results.push((ticket, Ok(())));
+                }
+            }
+            Err(error) => {
+                results.extend(
+                    written
+                        .into_iter()
+                        .map(|(ticket, _)| (ticket, Err(error.clone()))),
+                );
+            }
+        }
+        results
+    }
+
     pub fn held_keys(&self) -> Result<Vec<crate::storage::HeldKey>> {
         let connection = self.connection()?;
         let mut statement = connection
@@ -1084,7 +1196,7 @@ impl Catalog {
     }
 }
 
-fn admissions(path: &Path) -> Arc<Mutex<()>> {
+fn held_admissions(path: &Path) -> Arc<Mutex<()>> {
     static TURNS: OnceLock<Mutex<HashMap<PathBuf, Arc<Mutex<()>>>>> = OnceLock::new();
     TURNS
         .get_or_init(Default::default)
@@ -1095,6 +1207,73 @@ fn admissions(path: &Path) -> Arc<Mutex<()>> {
         .clone()
 }
 
+/// One published object's catalog rows, handed to the admission group.
+pub(crate) struct Recording {
+    /// The verification row, when this call installed the object.
+    pub record: Option<crate::store::VRecord>,
+}
+
+#[derive(Default)]
+struct AdmissionGroup {
+    state: Mutex<GroupState>,
+    turned: std::sync::Condvar,
+}
+
+#[derive(Default)]
+struct GroupState {
+    next: u64,
+    leading: bool,
+    queue: Vec<(u64, Recording)>,
+    done: HashMap<u64, Result<()>>,
+}
+
+fn admission_group(path: &Path) -> Arc<AdmissionGroup> {
+    static GROUPS: OnceLock<Mutex<HashMap<PathBuf, Arc<AdmissionGroup>>>> = OnceLock::new();
+    GROUPS
+        .get_or_init(Default::default)
+        .lock()
+        .unwrap_or_else(|error| error.into_inner())
+        .entry(path.to_path_buf())
+        .or_default()
+        .clone()
+}
+
+/// A leader hands its batch's results back however it leaves, so a panic inside one batch
+/// cannot strand the admissions queued behind it.
+struct Lead<'a> {
+    group: &'a AdmissionGroup,
+    tickets: Vec<u64>,
+    results: Vec<(u64, Result<()>)>,
+}
+
+impl Drop for Lead<'_> {
+    fn drop(&mut self) {
+        let mut state = self
+            .group
+            .state
+            .lock()
+            .unwrap_or_else(|error| error.into_inner());
+        state.leading = false;
+        let mut answered = std::collections::HashSet::new();
+        for (ticket, result) in self.results.drain(..) {
+            answered.insert(ticket);
+            state.done.insert(ticket, result);
+        }
+        for ticket in &self.tickets {
+            if !answered.contains(ticket) {
+                state.done.insert(
+                    *ticket,
+                    Err(Refusal {
+                        code: Code::IO_FAILED,
+                        detail: "the admission batch holding this object did not finish".into(),
+                    }),
+                );
+            }
+        }
+        self.group.turned.notify_all();
+    }
+}
+
 fn hold_on(connection: &Connection, operation: &str, key: &str, length: u64) -> Result<()> {
     let kind = if key.starts_with("blobs/") {
         "blob"

{tensorfs-0.3.60 → tensorfs-0.3.61}/crates/tensorfs-core/src/ingest/fingerprint.rs

@@ -262,6 +262,21 @@ impl FingerprintRegistry {
         crate::canon::write(&self.to_value())
     }
 
+    /// Extend this registry with a newer reviewed one: its entries and profiles replace
+    /// these under the same key and add the rest. Every entry keeps its own provenance.
+    pub fn extend(&mut self, newer: FingerprintRegistry) {
+        for entry in newer.entries {
+            self.merge(entry);
+        }
+        for profile in newer.source_profiles {
+            self.merge_source_profile(profile);
+        }
+    }
+
+    /// Key set and component classify. An entry banked from the exact same tensor schema is
+    /// preferred; otherwise any entry for this key set and component serves when they agree
+    /// on dialect and converter, and conversion validates the actual shapes and dtypes (an
+    /// fp16 upload of a model banked in bf16 classifies).
     pub fn classify(&self, fp: &Fingerprint) -> Verdict {
         let keyset: Vec<&Banked> = self
             .entries
@@ -281,7 +296,7 @@ impl FingerprintRegistry {
                 banked_as: keyset.iter().map(|e| name_of(e)).collect(),
             };
         }
-        let hits: Vec<&Banked> = component
+        let exact: Vec<&Banked> = component
             .iter()
             .copied()
             .filter(|e| {
@@ -289,6 +304,14 @@ impl FingerprintRegistry {
                     && e.logical_keys as usize == fp.logical_keys
             })
             .collect();
+        let hits = if exact.is_empty() {
+            let mut verdicts = component.clone();
+            verdicts.sort_by(|a, b| (&a.dialect, &a.converter).cmp(&(&b.dialect, &b.converter)));
+            verdicts.dedup_by(|a, b| (&a.dialect, &a.converter) == (&b.dialect, &b.converter));
+            verdicts
+        } else {
+            exact
+        };
         match hits.len() {
             0 => Verdict::Unregistered,
             1 => Verdict::Authorized(Box::new(hits[0].clone())),

{tensorfs-0.3.60 → tensorfs-0.3.61}/crates/tensorfs-core/src/ingest/source.rs

@@ -242,6 +242,9 @@ fn profile_assignments(
 ) -> Vec<Vec<SourceAssignment>> {
     let mut candidates = Vec::new();
     for component in &profile.components {
+        // Carriers banked from this exact tensor schema first; otherwise any carrier with
+        // the reviewed key set, whose shapes and dtypes the conversion itself validates.
+        let mut exact = Vec::new();
         let mut hits = Vec::new();
         for (variant_index, variant) in component.variants.iter().enumerate() {
             for entry in registry.entries.iter().filter(|entry| {
@@ -277,15 +280,21 @@ fn profile_assignments(
                         Ok(observed) => observed,
                         Err(_) => continue,
                     };
-                    if observed.keyset_digest == variant.keyset_digest
-                        && observed.tensor_schema_digest == entry.tensor_schema_digest
+                    if observed.keyset_digest != variant.keyset_digest {
+                        continue;
+                    }
+                    let hit = (index, projected, variant_index);
+                    if observed.tensor_schema_digest == entry.tensor_schema_digest
                         && observed.logical_keys as u64 == entry.logical_keys
                     {
-                        hits.push((index, projected, variant_index));
+                        exact.push(hit);
+                    } else if !hits.contains(&hit) {
+                        hits.push(hit);
                     }
                 }
             }
         }
+        let hits = if exact.is_empty() { hits } else { exact };
         if hits.is_empty() {
             return Vec::new();
         }
@@ -303,6 +312,58 @@ fn profile_assignments(
     solutions
 }
 
+/// Where a Store keeps a reviewed registry newer than the built-in one: shipped as a pinned
+/// file or served by the Hub, and bound with [`bind_registry`]. It only extends the built-in
+/// registry, so a TensorFS older than a model can still ingest it.
+pub const REGISTRY_BINDING: &str = "fingerprint-registry.json";
+
+/// Bind (or with `None`, clear) the Store's reviewed registry. The data is validated here,
+/// provenance included, so a malformed file is a caller's mistake at bind time.
+pub fn bind_registry(store: &Store, bytes: Option<&[u8]>) -> Result<()> {
+    let path = store.root().join(REGISTRY_BINDING);
+    let Some(bytes) = bytes else {
+        return match fs::remove_file(&path) {
+            Ok(()) => Ok(()),
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(()),
+            Err(error) => refuse(Code::IO_FAILED, format!("clear registry binding: {error}")),
+        };
+    };
+    FingerprintRegistry::parse(bytes)?;
+    let temporary = store.root().join("tmp").join(format!(
+        "{REGISTRY_BINDING}.{}",
+        crate::meta::now_nanos_unique()
+    ));
+    let written = fs::write(&temporary, bytes)
+        .and_then(|()| fs::File::open(&temporary)?.sync_all())
+        .and_then(|()| fs::rename(&temporary, &path));
+    if let Err(error) = written {
+        let _ = fs::remove_file(&temporary);
+        return refuse(Code::IO_FAILED, format!("bind registry: {error}"));
+    }
+    Ok(())
+}
+
+/// The registry an ingest on this Store classifies with: the built-in one, extended by the
+/// Store's bound registry, then by a caller-`supplied` one. A bound file that no longer
+/// parses is skipped (it can only add); supplied data that does not parse refuses.
+pub fn effective_registry(store: &Store, supplied: Option<&[u8]>) -> Result<(String, Vec<u8>)> {
+    let mut registry = FingerprintRegistry::parse(BUILTIN_REGISTRY_BYTES)?;
+    let mut locator = BUILTIN_REGISTRY.to_string();
+    let bound = fs::read(store.root().join(REGISTRY_BINDING))
+        .ok()
+        .filter(|bytes| bytes.len() <= crate::limits::DOC_MAX_BYTES)
+        .and_then(|bytes| FingerprintRegistry::parse(&bytes).ok());
+    if let Some(bound) = bound {
+        registry.extend(bound);
+        locator.push_str("+store");
+    }
+    if let Some(bytes) = supplied {
+        registry.extend(FingerprintRegistry::parse(bytes)?);
+        locator.push_str("+supplied");
+    }
+    Ok((locator, registry.to_bytes()))
+}
+
 pub fn read_header_only(path: &Path) -> Result<(SourceHeader, Vec<u8>)> {
     let json = fs::read(path).map_err(|error| Refusal {
         code: Code::IO_FAILED,
@@ -1658,7 +1719,8 @@ pub fn prepare_model_source(
     store: &Store,
     request: &PrepareModelSource,
 ) -> Result<PreparedModelSources> {
-    prepare_model_source_with_registry(store, request, BUILTIN_REGISTRY, BUILTIN_REGISTRY_BYTES)
+    let (locator, bytes) = effective_registry(store, None)?;
+    prepare_model_source_with_registry(store, request, &locator, &bytes)
 }
 
 /// One member of an exact provider selection: its pinned identity and the header a ranged
@@ -2308,6 +2370,36 @@ mod tests {
         let _ = fs::remove_dir_all(root);
     }
 
+    #[test]
+    fn a_bound_registry_ingests_models_the_build_never_banked_at_any_precision() {
+        let root = temporary("bound-registry");
+        let (store, registry, mut request) = fixture(&root, false);
+        // Banked from F32 carriers; the first carrier is now re-uploaded as F16.
+        let first_path = request.roster[0].path.clone();
+        let header = "{\"weight\":{\"data_offsets\":[0,2],\"dtype\":\"F16\",\"shape\":[1]}}";
+        let mut bytes = (header.len() as u64).to_le_bytes().to_vec();
+        bytes.extend_from_slice(header.as_bytes());
+        bytes.extend_from_slice(&[0x00, 0x3c]);
+        fs::write(&first_path, &bytes).unwrap();
+        request.roster[0].object_id = ObjectRef::of(&bytes).id();
+        request.roster[0].length = bytes.len() as u64;
+        request.roster[0].header = header_prefix(&bytes);
+
+        // Unknown to the compiled-in registry until the reviewed data is bound.
+        assert_eq!(
+            prepare_model_source(&store, &request).unwrap_err().code,
+            Code::UNREGISTERED_FINGERPRINT
+        );
+        bind_registry(&store, Some(&registry)).unwrap();
+        let prepared = prepare_model_source(&store, &request).unwrap();
+        assert!(prepared.complete);
+        assert_eq!(prepared.sources.len(), 2);
+        // Registry data without provenance is not reviewed data.
+        assert!(bind_registry(&store, Some(b"{\"entries\":[{\"component\":\"x\"}]}")).is_err());
+        bind_registry(&store, None).unwrap();
+        let _ = fs::remove_dir_all(root);
+    }
+
     #[test]
     #[ignore = "subprocess for source journal SIGKILL proof"]
     fn source_tail_snapshot_worker() {

{tensorfs-0.3.60 → tensorfs-0.3.61}/crates/tensorfs-core/src/stats.rs

@@ -6,6 +6,9 @@ use std::sync::atomic::{AtomicU64, Ordering};
 static CATALOG_OPENS: AtomicU64 = AtomicU64::new(0);
 static PRESENCE_PASSES: AtomicU64 = AtomicU64::new(0);
 static REPO_CACHE_VERIFIED_READS: AtomicU64 = AtomicU64::new(0);
+static ADMISSION_BATCHES: AtomicU64 = AtomicU64::new(0);
+static ADMITTED_OBJECTS: AtomicU64 = AtomicU64::new(0);
+static ADMISSION_NANOS: AtomicU64 = AtomicU64::new(0);
 
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
 pub struct Stats {
@@ -15,6 +18,12 @@ pub struct Stats {
     pub presence_passes: u64,
     /// Repository-cache entries read and hashed.
     pub repo_cache_verified_reads: u64,
+    /// Blob admission batches committed (one transaction and commit each).
+    pub admission_batches: u64,
+    /// Blobs those batches published and recorded.
+    pub admitted_objects: u64,
+    /// Wall time those batches spent linking, fsyncing and committing.
+    pub admission_nanos: u64,
 }
 
 pub fn snapshot() -> Stats {
@@ -22,6 +31,9 @@ pub fn snapshot() -> Stats {
         catalog_opens: CATALOG_OPENS.load(Ordering::Relaxed),
         presence_passes: PRESENCE_PASSES.load(Ordering::Relaxed),
         repo_cache_verified_reads: REPO_CACHE_VERIFIED_READS.load(Ordering::Relaxed),
+        admission_batches: ADMISSION_BATCHES.load(Ordering::Relaxed),
+        admitted_objects: ADMITTED_OBJECTS.load(Ordering::Relaxed),
+        admission_nanos: ADMISSION_NANOS.load(Ordering::Relaxed),
     }
 }
 
@@ -48,3 +60,12 @@ pub(crate) fn presence_pass() {
 pub(crate) fn repo_cache_verified_read() {
     REPO_CACHE_VERIFIED_READS.fetch_add(1, Ordering::Relaxed);
 }
+
+pub(crate) fn admission_batch(objects: usize, spent: std::time::Duration) {
+    ADMISSION_BATCHES.fetch_add(1, Ordering::Relaxed);
+    ADMITTED_OBJECTS.fetch_add(objects as u64, Ordering::Relaxed);
+    ADMISSION_NANOS.fetch_add(
+        u64::try_from(spent.as_nanos()).unwrap_or(u64::MAX),
+        Ordering::Relaxed,
+    );
+}