tensorfs 0.3.62__tar.gz → 0.3.64__tar.gz

{tensorfs-0.3.62 → tensorfs-0.3.64}/Cargo.lock

@@ -439,7 +439,7 @@ checksum = "adb6935a6f5c20170eeceb1a3835a49e12e19d792f6dd344ccc76a985ca5a6ca"
 
 [[package]]
 name = "tensorfs-core"
-version = "0.3.62"
+version = "0.3.64"
 dependencies = [
  "fs2",
  "libc",
@@ -454,7 +454,7 @@ dependencies = [
 
 [[package]]
 name = "tensorfs-py"
-version = "0.3.62"
+version = "0.3.64"
 dependencies = [
  "pyo3",
  "tensorfs-core",

{tensorfs-0.3.62 → tensorfs-0.3.64}/Cargo.toml

@@ -3,5 +3,5 @@ resolver = "2"
 members = ["crates/tensorfs-core", "crates/tensorfs-py"]
 
 [workspace.package]
-version = "0.3.62"
+version = "0.3.64"
 edition = "2021"

{tensorfs-0.3.62 → tensorfs-0.3.64}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tensorfs
-Version: 0.3.62
+Version: 0.3.64
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Programming Language :: Rust

{tensorfs-0.3.62 → tensorfs-0.3.64}/crates/tensorfs-core/src/bin/tfs/fetch.rs

@@ -182,6 +182,7 @@ fn policy_of(flags: &Flags) -> SourcePolicy {
             .unwrap_or_default(),
         allow_local: crate::flag_on(flags, "allow-local"),
         max_redirects: crate::flag_num(flags, "max-redirects", 0u32),
+        ..Default::default()
     }
 }
 
@@ -334,12 +335,13 @@ fn pull_with_budget(
     // And what admitting them cost: a pull whose streams stop growing while its batches
     // take most of the wall time is held by the disk, not the link.
     eprintln!(
-        "{{\"event\":\"pull.streams\",\"model\":{},\"seconds\":{:.3},\"bytes_moved\":{},\"streams\":{},\"levels\":[{}],\"admission\":{{\"objects\":{},\"batches\":{},\"seconds\":{:.3}}}}}",
+        "{{\"event\":\"pull.streams\",\"model\":{},\"seconds\":{:.3},\"bytes_moved\":{},\"streams\":{},\"levels\":[{}],\"backoffs\":{},\"admission\":{{\"objects\":{},\"batches\":{},\"seconds\":{:.3}}}}}",
         quoted(&report.model),
         seconds,
         report.bytes_moved,
         report.streams,
         levels.join(","),
+        report.backoffs,
         after.admitted_objects - before.admitted_objects,
         after.admission_batches - before.admission_batches,
         (after.admission_nanos - before.admission_nanos) as f64 / 1e9,

{tensorfs-0.3.62 → tensorfs-0.3.64}/crates/tensorfs-core/src/catalog.rs

@@ -1473,7 +1473,16 @@ impl WriterGuard {
             .read(true)
             .write(true)
             .open(&path)
-            .map_err(|error| io("create writer marker", error))?;
+            .map_err(|error| {
+                if crate::descriptors::exhausted(&error) {
+                    Refusal {
+                        code: Code::FD_HEADROOM,
+                        detail: format!("create writer marker: {error}"),
+                    }
+                } else {
+                    io("create writer marker", error)
+                }
+            })?;
         file.try_lock_exclusive()
             .map_err(|error| io("lock writer marker", error))?;
         Ok(Self {

{tensorfs-0.3.62 → tensorfs-0.3.64}/crates/tensorfs-core/src/derived/part_rows_tests.rs

@@ -25,7 +25,12 @@ fn fixture(label: &str) -> (Store, Meta, String, Declaration) {
         .map(|index| ("model".into(), format!("weight_{index}")))
         .collect();
     declaration.max_new_bytes = 3 * 512;
-    (store, meta, format!("sha256:{}", "7a".repeat(32)), declaration)
+    (
+        store,
+        meta,
+        format!("sha256:{}", "7a".repeat(32)),
+        declaration,
+    )
 }
 
 fn catalog(store: &Store) -> rusqlite::Connection {
@@ -55,9 +60,16 @@ fn stored_rows(store: &Store, id: &str) -> (usize, Option<i64>, i64) {
         )
         .unwrap();
     let value = crate::canon::parse_canonical(&bytes, limits::DOC_MAX_BYTES).unwrap();
-    let inline = TransactionRow::from_value(&value).unwrap().added_parts.len();
+    let inline = TransactionRow::from_value(&value)
+        .unwrap()
+        .added_parts
+        .len();
     let parts = connection
-        .query_row("SELECT count(*) FROM tensorfs_derived_parts WHERE id=?1", [id], |row| row.get(0))
+        .query_row(
+            "SELECT count(*) FROM tensorfs_derived_parts WHERE id=?1",
+            [id],
+            |row| row.get(0),
+        )
         .unwrap();
     (inline, open, parts)
 }
@@ -74,14 +86,18 @@ fn parts_are_rows_that_resume_refuse_conflicts_and_stay_retained() {
     add(&store, &meta, &id, &writer, "weight_0", 1).unwrap();
     assert_eq!(stored_rows(&store, &id).2, 2);
     assert_eq!(
-        add(&store, &meta, &id, &writer, "weight_0", 9).unwrap_err().code,
+        add(&store, &meta, &id, &writer, "weight_0", 9)
+            .unwrap_err()
+            .code,
         Code::TRANSACTION_CONFLICT
     );
     // A fenced writer cannot add. Once it is gone, GC keeps its accepted bytes through
     // the append-only journal alone, and its successor resumes with both parts.
     fence(&meta, &id, 1).unwrap();
     assert_eq!(
-        add(&store, &meta, &id, &writer, "weight_2", 3).unwrap_err().code,
+        add(&store, &meta, &id, &writer, "weight_2", 3)
+            .unwrap_err()
+            .code,
         Code::WRITER_FENCED
     );
     release_guards(&meta, Some(writer.writer_hold), writer.source_leases);
@@ -135,7 +151,9 @@ fn an_older_builds_inline_row_and_a_torn_journal_line_are_read() {
     std::fs::write(&journal, torn).unwrap();
 
     assert_eq!(
-        add(&store, &meta, &id, &writer, "weight_0", 9).unwrap_err().code,
+        add(&store, &meta, &id, &writer, "weight_0", 9)
+            .unwrap_err()
+            .code,
         Code::TRANSACTION_CONFLICT
     );
     add(&store, &meta, &id, &writer, "weight_1", 2).unwrap();

{tensorfs-0.3.62 → tensorfs-0.3.64}/crates/tensorfs-core/src/derived/roots.rs

@@ -2,8 +2,8 @@
 //! metadata journals lifecycle; GC never needs that database to discover retained bytes.
 
 use std::fs::{self, File, OpenOptions};
-use std::os::unix::fs::FileExt;
 use std::io::{Read, Write};
+use std::os::unix::fs::FileExt;
 use std::path::PathBuf;
 
 use crate::canon::{Fields, Value};
@@ -164,7 +164,11 @@ pub(super) fn append_parts(store: &Store, transaction: &str, objects: &[ObjectRe
         file.read_exact_at(&mut last, length - 1).map_err(io)?;
     }
     // Terminate a line torn by a dead writer so this one parses on its own.
-    let mut bytes = if last[0] == b'\n' { Vec::new() } else { vec![b'\n'] };
+    let mut bytes = if last[0] == b'\n' {
+        Vec::new()
+    } else {
+        vec![b'\n']
+    };
     bytes.extend(parts_line(objects));
     file.write_all(&bytes)
         .and_then(|()| file.sync_data())
@@ -185,7 +189,11 @@ pub(super) fn rewrite_parts(store: &Store, transaction: &str, objects: &[ObjectR
         .create_new(true)
         .open(&temporary)
         .map_err(io)?;
-    let bytes = if objects.is_empty() { Vec::new() } else { parts_line(objects) };
+    let bytes = if objects.is_empty() {
+        Vec::new()
+    } else {
+        parts_line(objects)
+    };
     file.write_all(&bytes)
         .and_then(|()| file.sync_all())
         .map_err(io)?;
@@ -211,8 +219,12 @@ pub(super) fn journaled(store: &Store) -> Result<Vec<ObjectRef>> {
             Err(error) if error.kind() == std::io::ErrorKind::NotFound => continue,
             Err(error) => return Err(io(error)),
         };
-        for line in bytes.split(|byte| *byte == b'\n').filter(|line| !line.is_empty()) {
-            let Ok(value) = crate::canon::parse_canonical(line, crate::limits::DOC_MAX_BYTES) else {
+        for line in bytes
+            .split(|byte| *byte == b'\n')
+            .filter(|line| !line.is_empty())
+        {
+            let Ok(value) = crate::canon::parse_canonical(line, crate::limits::DOC_MAX_BYTES)
+            else {
                 continue;
             };
             for value in crate::canon::as_arr("PrivateDerivedParts", "objects", &value)? {

{tensorfs-0.3.62 → tensorfs-0.3.64}/crates/tensorfs-core/src/derived.rs

@@ -1168,11 +1168,19 @@ pub(crate) fn part_bytes(part: &Part) -> Vec<u8> {
 }
 
 impl AddedPart {
-    pub(crate) fn stored(component: String, key: String, role: String, bytes: &[u8]) -> Result<Self> {
+    pub(crate) fn stored(
+        component: String,
+        key: String,
+        role: String,
+        bytes: &[u8],
+    ) -> Result<Self> {
         name("added part component", &component)?;
         self::key("added part tensor", &key)?;
         name("added part role", &role)?;
-        let part = part_from_value(&crate::canon::parse_canonical(bytes, limits::DOC_MAX_BYTES)?)?;
+        let part = part_from_value(&crate::canon::parse_canonical(
+            bytes,
+            limits::DOC_MAX_BYTES,
+        )?)?;
         Ok(Self {
             component,
             key,
@@ -3005,7 +3013,11 @@ impl Additions {
             for tensor in &component.add {
                 for part in &tensor.parts {
                     parts.insert(
-                        (component.target.clone(), tensor.key.clone(), part.role.clone()),
+                        (
+                            component.target.clone(),
+                            tensor.key.clone(),
+                            part.role.clone(),
+                        ),
                         part.clone(),
                     );
                 }
@@ -3025,7 +3037,11 @@ impl Additions {
     fn get(&self, (component, tensor_key, role): (&str, &str, &str)) -> Result<&PartDeclaration> {
         let part = self
             .parts
-            .get(&(component.to_string(), tensor_key.to_string(), role.to_string()))
+            .get(&(
+                component.to_string(),
+                tensor_key.to_string(),
+                role.to_string(),
+            ))
             .ok_or_else(|| Refusal {
                 code: Code::MISSING_FIELD,
                 detail: format!("{component}/{tensor_key}#{role} is not a declared addition"),
@@ -3093,7 +3109,15 @@ pub fn add_part<R: Read>(
     reader: &mut R,
 ) -> Result<crate::checkpoint::Written> {
     let additions = Additions::load(meta, transaction, writer_session)?;
-    add_indexed_part(store, meta, transaction, writer_session, &additions, value, reader)
+    add_indexed_part(
+        store,
+        meta,
+        transaction,
+        writer_session,
+        &additions,
+        value,
+        reader,
+    )
 }
 
 /// Accept one part. The cost is this part's bytes plus one indexed SQL row: the

tensorfs-0.3.64/crates/tensorfs-core/src/descriptors.rs

@@ -0,0 +1,112 @@
+//! File descriptors as a budget: raised to what the process may have, measured before a
+//! transfer sizes itself, and an exhausted table reported as backpressure.
+//!
+//! Run 1297 (2026-09-27) grew a pull toward 128 streams under a 1,024 soft RLIMIT_NOFILE;
+//! each object in flight holds a socket, a temp file, writer markers and a catalog
+//! connection, and the table ran out mid-pull (`name resolution failed (Too many open
+//! files)`). A Go supervisor raises its own soft limit but hands its children the original.
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::sync::Once;
+
+/// Descriptors one object stream may hold at once, and what it is spent on: the object
+/// socket and one pooled idle socket (2); the temp file and the two writer-marker files of
+/// its admission, nested once more by the catalog record (5); the catalog connection and its
+/// journal (2); and the transient DNS socket or contender of a retry (3).
+pub const PER_STREAM: u64 = 12;
+
+/// Descriptors left for everything that is not a stream: stdio, the Store's own locks, the
+/// hub calls, the progress channel and whatever the caller opens next.
+pub const MARGIN: u64 = 64;
+
+static RAISE: Once = Once::new();
+static EXHAUSTED: AtomicU64 = AtomicU64::new(0);
+
+/// Raise the soft RLIMIT_NOFILE to the hard limit, once per process. Idempotent; a refused
+/// raise leaves the limit where it was and the budget below measures that.
+pub fn raise() {
+    RAISE.call_once(|| {
+        use rustix::process::{getrlimit, setrlimit, Resource, Rlimit};
+        let limit = getrlimit(Resource::Nofile);
+        if let (Some(soft), Some(hard)) = (limit.current, limit.maximum) {
+            if soft < hard {
+                let _ = setrlimit(
+                    Resource::Nofile,
+                    Rlimit {
+                        current: Some(hard),
+                        maximum: Some(hard),
+                    },
+                );
+            }
+        }
+    });
+}
+
+/// Descriptors this process can still open now: soft limit less those open and `MARGIN`.
+/// `None` when the platform cannot say (no `/proc`, or no soft limit).
+pub fn available() -> Option<u64> {
+    let soft = rustix::process::getrlimit(rustix::process::Resource::Nofile).current?;
+    let open = std::fs::read_dir("/proc/self/fd").ok()?.count() as u64;
+    Some(soft.saturating_sub(open).saturating_sub(MARGIN))
+}
+
+/// Object streams the descriptor table allows now: at most `wanted`, at least one.
+pub fn streams_within(wanted: usize) -> usize {
+    streams_for(wanted, available())
+}
+
+/// `streams_within` against a stated number of free descriptors.
+pub fn streams_for(wanted: usize, available: Option<u64>) -> usize {
+    let fits = available.map_or(usize::MAX, |free| {
+        usize::try_from(free / PER_STREAM).unwrap_or(usize::MAX)
+    });
+    wanted.min(fits).max(1)
+}
+
+/// Whether `error` is the descriptor table being full, counting it when it is. Call it
+/// where an open, socket or resolution fails, before the error loses its errno.
+pub fn exhausted(error: &std::io::Error) -> bool {
+    let full = matches!(
+        error.raw_os_error(),
+        Some(code) if code == rustix::io::Errno::MFILE.raw_os_error()
+            || code == rustix::io::Errno::NFILE.raw_os_error()
+    );
+    if full {
+        EXHAUSTED.fetch_add(1, Ordering::Relaxed);
+    }
+    full
+}
+
+/// How many times this process has found its descriptor table full. A caller diffs two
+/// reads around its own work.
+pub fn exhaustions() -> u64 {
+    EXHAUSTED.load(Ordering::Relaxed)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn the_budget_is_descriptors_over_per_stream_cost() {
+        assert_eq!(streams_for(128, Some(PER_STREAM * 10)), 10);
+        assert_eq!(streams_for(8, Some(PER_STREAM * 10)), 8);
+        assert_eq!(streams_for(128, Some(0)), 1, "one stream is always allowed");
+        assert_eq!(
+            streams_for(128, None),
+            128,
+            "an unmeasurable table is not a shortage"
+        );
+    }
+
+    #[test]
+    fn only_a_full_table_counts_as_exhaustion() {
+        let before = exhaustions();
+        assert!(exhausted(&std::io::Error::from_raw_os_error(
+            rustix::io::Errno::MFILE.raw_os_error()
+        )));
+        assert!(!exhausted(&std::io::Error::from_raw_os_error(
+            rustix::io::Errno::CONNREFUSED.raw_os_error()
+        )));
+        assert!(exhaustions() > before);
+    }
+}

{tensorfs-0.3.62 → tensorfs-0.3.64}/crates/tensorfs-core/src/lib.rs

@@ -19,6 +19,7 @@ pub mod checkpoint;
 pub mod checkpoint_root;
 pub mod corpus;
 pub mod derived;
+pub mod descriptors;
 pub mod dtype;
 pub mod durability;
 pub mod err;

{tensorfs-0.3.62 → tensorfs-0.3.64}/crates/tensorfs-core/src/meta.rs

@@ -172,9 +172,11 @@ impl Meta {
             .optional()
             .map_err(|error| sql("read accepted part", error))?
             .or_else(|| {
-                legacy.iter().flatten().find(|old| old.same_value(added)).map(|old| {
-                    crate::derived::part_bytes(&old.part)
-                })
+                legacy
+                    .iter()
+                    .flatten()
+                    .find(|old| old.same_value(added))
+                    .map(|old| crate::derived::part_bytes(&old.part))
             });
         match existing {
             Some(existing) if existing == bytes => {

{tensorfs-0.3.62 → tensorfs-0.3.64}/crates/tensorfs-core/src/providers.rs

@@ -176,6 +176,7 @@ impl Endpoints {
             allowed_hosts,
             allow_local: self.allow_local,
             max_redirects: 5,
+            ..Default::default()
         }
     }
 

{tensorfs-0.3.62 → tensorfs-0.3.64}/crates/tensorfs-core/src/store.rs

@@ -415,9 +415,14 @@ impl Store {
     ///
     /// A symlink, non-directory, partial Store, or directory containing foreign state refuses.
     /// There is no old-layout lookup or fallback root.
+    /// Open the Store at `root`, creating it when absent or empty. Concurrent calls on one
+    /// new root serialize on the root directory: exactly one creates it, the rest open it.
     pub fn ensure(root: &Path) -> Result<Store> {
         match fs::symlink_metadata(root) {
-            Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Store::init(root),
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
+                fs::create_dir_all(root)
+                    .map_err(|error| io(format!("create Store root {}", root.display()), error))?;
+            }
             Err(error) => return Err(io(format!("stat Store root {}", root.display()), error)),
             Ok(metadata) if metadata.file_type().is_symlink() || !metadata.is_dir() => {
                 return refuse(
@@ -427,6 +432,7 @@ impl Store {
             }
             Ok(_) => {}
         }
+        let _creation = creation_lock(root)?;
         let empty = fs::read_dir(root)
             .map_err(|error| io(format!("read Store root {}", root.display()), error))?
             .next()
@@ -434,7 +440,7 @@ impl Store {
             .map_err(|error| io(format!("read Store root {}", root.display()), error))?
             .is_none();
         if empty {
-            Store::init(root)
+            Store::init_locked(root)
         } else {
             validate_store_root(root)?;
             let catalog_path = root.join("tensorfs.sqlite");
@@ -456,6 +462,15 @@ impl Store {
     }
 
     pub fn init(root: &Path) -> Result<Store> {
+        if matches!(fs::symlink_metadata(root), Ok(metadata) if metadata.is_dir() && !metadata.file_type().is_symlink())
+        {
+            let _creation = creation_lock(root)?;
+            return Store::init_locked(root);
+        }
+        Store::init_locked(root)
+    }
+
+    fn init_locked(root: &Path) -> Result<Store> {
         match fs::symlink_metadata(root) {
             Ok(metadata) if metadata.is_dir() && !metadata.file_type().is_symlink() => {}
             Ok(_) => {
@@ -1347,7 +1362,16 @@ impl Store {
                 .create_new(true)
                 .mode(0o600)
                 .open(&tmp)
-                .map_err(|e| io(format!("create temp {}", tmp.display()), e))?;
+                .map_err(|e| {
+                    if crate::descriptors::exhausted(&e) {
+                        Refusal {
+                            code: Code::FD_HEADROOM,
+                            detail: format!("create temp {}: {e}", tmp.display()),
+                        }
+                    } else {
+                        io(format!("create temp {}", tmp.display()), e)
+                    }
+                })?;
             match f.try_lock_exclusive() {
                 Ok(()) => break (tmp, f),
                 // Only a reaper can hold the lock on a name this process just minted: it
@@ -2103,6 +2127,20 @@ fn read_repo_cache_binding(root: &Path) -> Option<crate::repo_cache::RepoObjectC
     Some(crate::repo_cache::RepoObjectCache::new(cache))
 }
 
+/// Serializes Store creation on one root across threads and processes. A lock on the root
+/// directory itself leaves nothing behind in it.
+fn creation_lock(root: &Path) -> Result<File> {
+    let directory = OpenOptions::new()
+        .read(true)
+        .custom_flags(O_NOFOLLOW)
+        .open(root)
+        .map_err(|error| io(format!("open Store root {}", root.display()), error))?;
+    directory
+        .lock_exclusive()
+        .map_err(|error| io(format!("lock Store root {}", root.display()), error))?;
+    Ok(directory)
+}
+
 fn open_validated(root: &Path) -> Result<Store> {
     fs::create_dir_all(root.join("tmp")).map_err(|error| io("mkdir tmp", error))?;
     Ok(Store {

{tensorfs-0.3.62 → tensorfs-0.3.64}/crates/tensorfs-core/src/transport/http.rs

@@ -166,7 +166,8 @@ pub struct Client {
 type IdlePool = Arc<Mutex<Vec<Idle>>>;
 
 // This bounds retained descriptors, not in-flight transfers (the caller owns those).
-const MAX_IDLE: usize = 8;
+// `descriptors::PER_STREAM` counts one idle socket per stream.
+const MAX_IDLE: usize = 32;
 
 /// A connection belongs to its origin and the credentials sent on it, never to one
 /// request target: a signed CDN URL changes per resolve, and keying on it meant the
@@ -414,7 +415,15 @@ fn connect(
         let socket = match nonblocking_socket(family) {
             Ok(socket) => socket,
             Err(error) => {
-                last = Some(error.into());
+                let error: std::io::Error = error.into();
+                if crate::descriptors::exhausted(&error) {
+                    // Another address needs another descriptor it will not get either.
+                    return refuse(
+                        Code::FD_HEADROOM,
+                        format!("{}: no descriptor for a socket ({error})", checked.host),
+                    );
+                }
+                last = Some(error);
                 continue;
             }
         };
@@ -653,6 +662,15 @@ pub struct BodyReader<'l> {
 
 impl Drop for BodyReader<'_> {
     fn drop(&mut self) {
+        self.recycle_if_consumed();
+    }
+}
+
+impl BodyReader<'_> {
+    /// Hand the connection back the moment its last body byte is read, not when the
+    /// reader is dropped: the consumer may still spend seconds hashing, fsyncing and
+    /// committing what arrived, and the next object's GET should find this socket idle.
+    fn recycle_if_consumed(&mut self) {
         // Only a fully consumed, unambiguous Content-Length response is reusable.
         // Dropped/failed bodies, chunked bodies and EOF-delimited replies close.
         if !matches!(self.framing, Framing::Length { remaining: 0 }) || self.raw_len() != 0 {
@@ -722,6 +740,7 @@ impl BodyReader<'_> {
                     let silent = self.advanced.elapsed();
                     if self.judge.silent_is_stall() && silent > self.ledger.patience() {
                         self.stalled = true;
+                        self.ledger.stalled_stream();
                         let _ = self
                             .wire
                             .as_ref()
@@ -846,6 +865,7 @@ impl BodyReader<'_> {
                 self.framing = Framing::Length {
                     remaining: remaining - n as u64,
                 };
+                self.recycle_if_consumed();
                 Ok(n)
             }
             Framing::Chunked { in_chunk, done } => {
@@ -946,13 +966,11 @@ pub fn request<'l>(
     write_silence: Option<Duration>,
     fail: Code,
 ) -> Result<Response<'l>> {
-    // Retained-source ranges already own their retry/resume budget. Other GETs and
-    // metadata writes keep their one-connection behavior.
-    let ranged = method == "GET"
+    // Every bodiless GET may reuse a connection to its origin: a pull's objects are many
+    // GETs to one host, and a fresh TCP+TLS connection per object spent a descriptor, a
+    // handshake and a slow start on each. Metadata writes keep one connection each.
+    let pooled = method == "GET"
         && body.is_none()
-        && headers
-            .iter()
-            .any(|(name, _)| name.eq_ignore_ascii_case("range"))
         && !headers
             .iter()
             .any(|(name, _)| name.eq_ignore_ascii_case("connection"));
@@ -967,7 +985,7 @@ pub fn request<'l>(
         method,
         headers,
         body.map(Payload::Bytes),
-        ranged.then_some(scoped.as_slice()),
+        pooled.then_some(scoped.as_slice()),
         deadline,
         ledger,
         judge,

{tensorfs-0.3.62 → tensorfs-0.3.64}/crates/tensorfs-core/src/transport/http_reuse_tests.rs

@@ -197,6 +197,7 @@ impl Origin {
             allowed_hosts: vec!["localhost".into()],
             allow_local: true,
             max_redirects: 2,
+            ..Default::default()
         }
     }
     fn count(&self) -> usize {
@@ -364,20 +365,23 @@ fn only_complete_unambiguous_http11_length_bodies_enter_the_pool() {
 }
 
 #[test]
-fn idle_descriptor_retention_is_bounded_and_non_range_gets_do_not_pool() {
+fn idle_descriptor_retention_is_bounded_and_plain_gets_pool_too() {
     let origin = Origin::new(false, Duration::ZERO, |_, _| Reply::body(b"bytes"));
     let client = origin.client();
-    for index in 0..32 {
+    let scopes = MAX_IDLE + 8;
+    for index in 0..scopes {
         let mut headers = ranged();
         headers.push(("authorization".into(), format!("Bearer {index}")));
         ask(&client, &origin.checked("/object"), &headers).unwrap();
     }
     assert_eq!(client.idle.lock().unwrap().len(), MAX_IDLE);
-    assert_eq!(origin.count(), 32);
+    assert_eq!(origin.count(), scopes);
+    // A whole-object GET is a pull's common case: the second rides the first's socket.
     for _ in 0..2 {
-        ask(&client, &origin.checked("/metadata"), &[]).unwrap();
+        ask(&client, &origin.checked("/object"), &[]).unwrap();
     }
-    assert_eq!(origin.count(), 34);
+    assert_eq!(origin.count(), scopes + 1);
+    assert_eq!(client.idle.lock().unwrap().len(), MAX_IDLE);
 }
 
 #[test]

{tensorfs-0.3.62 → tensorfs-0.3.64}/crates/tensorfs-core/src/transport/ledger.rs

@@ -31,7 +31,7 @@
 //! paid H100s sat at exactly zero for fifteen minutes with neither plane complaining.
 
 use crate::err::{refuse, Code, Result};
-use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
 use std::sync::{Arc, Mutex};
 use std::time::{Duration, Instant};
 
@@ -151,6 +151,8 @@ impl PullCancellation {
 pub struct Ledger {
     caller_cancellation: Option<PullCancellation>,
     cancelled: Arc<AtomicBool>,
+    /// Streams this pull has judged stalled, a backpressure signal for its pace.
+    stalls: Arc<AtomicU64>,
     sample: Duration,
     worst_gap: Arc<Mutex<Duration>>,
     progress: Arc<Mutex<Progress>>,
@@ -170,6 +172,7 @@ impl Ledger {
         Ledger {
             caller_cancellation: None,
             cancelled: Arc::new(AtomicBool::new(false)),
+            stalls: Arc::new(AtomicU64::new(0)),
             sample: sample.max(Duration::from_millis(1)),
             worst_gap: Arc::new(Mutex::new(Duration::ZERO)),
             progress: Arc::new(Mutex::new(Progress {
@@ -243,6 +246,16 @@ impl Ledger {
         self.sample
     }
 
+    /// A stream of this pull was judged stalled.
+    pub(super) fn stalled_stream(&self) {
+        self.stalls.fetch_add(1, Ordering::Relaxed);
+    }
+
+    /// Streams this pull has judged stalled so far.
+    pub(super) fn stalls(&self) -> u64 {
+        self.stalls.load(Ordering::Relaxed)
+    }
+
     /// The smallest patience ever granted: `STILL_SAMPLES` intervals of the resolution.
     pub fn floor(&self) -> Duration {
         self.sample * STILL_SAMPLES
@@ -280,6 +293,7 @@ impl Ledger {
         Self {
             caller_cancellation: self.caller_cancellation.clone(),
             cancelled: Arc::clone(&self.cancelled),
+            stalls: Arc::clone(&self.stalls),
             sample: self.sample,
             worst_gap: Arc::clone(&self.worst_gap),
             progress: Arc::clone(&self.progress),