tensorfs 0.3.63__tar.gz → 0.3.64__tar.gz

{tensorfs-0.3.63 → tensorfs-0.3.64}/Cargo.lock

@@ -439,7 +439,7 @@ checksum = "adb6935a6f5c20170eeceb1a3835a49e12e19d792f6dd344ccc76a985ca5a6ca"
 
 [[package]]
 name = "tensorfs-core"
-version = "0.3.63"
+version = "0.3.64"
 dependencies = [
  "fs2",
  "libc",
@@ -454,7 +454,7 @@ dependencies = [
 
 [[package]]
 name = "tensorfs-py"
-version = "0.3.63"
+version = "0.3.64"
 dependencies = [
  "pyo3",
  "tensorfs-core",

{tensorfs-0.3.63 → tensorfs-0.3.64}/Cargo.toml

@@ -3,5 +3,5 @@ resolver = "2"
 members = ["crates/tensorfs-core", "crates/tensorfs-py"]
 
 [workspace.package]
-version = "0.3.63"
+version = "0.3.64"
 edition = "2021"

{tensorfs-0.3.63 → tensorfs-0.3.64}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tensorfs
-Version: 0.3.63
+Version: 0.3.64
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Programming Language :: Rust

{tensorfs-0.3.63 → tensorfs-0.3.64}/crates/tensorfs-core/src/bin/tfs/fetch.rs

@@ -182,6 +182,7 @@ fn policy_of(flags: &Flags) -> SourcePolicy {
             .unwrap_or_default(),
         allow_local: crate::flag_on(flags, "allow-local"),
         max_redirects: crate::flag_num(flags, "max-redirects", 0u32),
+        ..Default::default()
     }
 }
 
@@ -334,12 +335,13 @@ fn pull_with_budget(
     // And what admitting them cost: a pull whose streams stop growing while its batches
     // take most of the wall time is held by the disk, not the link.
     eprintln!(
-        "{{\"event\":\"pull.streams\",\"model\":{},\"seconds\":{:.3},\"bytes_moved\":{},\"streams\":{},\"levels\":[{}],\"admission\":{{\"objects\":{},\"batches\":{},\"seconds\":{:.3}}}}}",
+        "{{\"event\":\"pull.streams\",\"model\":{},\"seconds\":{:.3},\"bytes_moved\":{},\"streams\":{},\"levels\":[{}],\"backoffs\":{},\"admission\":{{\"objects\":{},\"batches\":{},\"seconds\":{:.3}}}}}",
         quoted(&report.model),
         seconds,
         report.bytes_moved,
         report.streams,
         levels.join(","),
+        report.backoffs,
         after.admitted_objects - before.admitted_objects,
         after.admission_batches - before.admission_batches,
         (after.admission_nanos - before.admission_nanos) as f64 / 1e9,

{tensorfs-0.3.63 → tensorfs-0.3.64}/crates/tensorfs-core/src/catalog.rs

@@ -1473,7 +1473,16 @@ impl WriterGuard {
             .read(true)
             .write(true)
             .open(&path)
-            .map_err(|error| io("create writer marker", error))?;
+            .map_err(|error| {
+                if crate::descriptors::exhausted(&error) {
+                    Refusal {
+                        code: Code::FD_HEADROOM,
+                        detail: format!("create writer marker: {error}"),
+                    }
+                } else {
+                    io("create writer marker", error)
+                }
+            })?;
         file.try_lock_exclusive()
             .map_err(|error| io("lock writer marker", error))?;
         Ok(Self {

tensorfs-0.3.64/crates/tensorfs-core/src/descriptors.rs

@@ -0,0 +1,112 @@
+//! File descriptors as a budget: raised to what the process may have, measured before a
+//! transfer sizes itself, and an exhausted table reported as backpressure.
+//!
+//! Run 1297 (2026-09-27) grew a pull toward 128 streams under a 1,024 soft RLIMIT_NOFILE;
+//! each object in flight holds a socket, a temp file, writer markers and a catalog
+//! connection, and the table ran out mid-pull (`name resolution failed (Too many open
+//! files)`). A Go supervisor raises its own soft limit but hands its children the original.
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::sync::Once;
+
+/// Descriptors one object stream may hold at once, and what it is spent on: the object
+/// socket and one pooled idle socket (2); the temp file and the two writer-marker files of
+/// its admission, nested once more by the catalog record (5); the catalog connection and its
+/// journal (2); and the transient DNS socket or contender of a retry (3).
+pub const PER_STREAM: u64 = 12;
+
+/// Descriptors left for everything that is not a stream: stdio, the Store's own locks, the
+/// hub calls, the progress channel and whatever the caller opens next.
+pub const MARGIN: u64 = 64;
+
+static RAISE: Once = Once::new();
+static EXHAUSTED: AtomicU64 = AtomicU64::new(0);
+
+/// Raise the soft RLIMIT_NOFILE to the hard limit, once per process. Idempotent; a refused
+/// raise leaves the limit where it was and the budget below measures that.
+pub fn raise() {
+    RAISE.call_once(|| {
+        use rustix::process::{getrlimit, setrlimit, Resource, Rlimit};
+        let limit = getrlimit(Resource::Nofile);
+        if let (Some(soft), Some(hard)) = (limit.current, limit.maximum) {
+            if soft < hard {
+                let _ = setrlimit(
+                    Resource::Nofile,
+                    Rlimit {
+                        current: Some(hard),
+                        maximum: Some(hard),
+                    },
+                );
+            }
+        }
+    });
+}
+
+/// Descriptors this process can still open now: soft limit less those open and `MARGIN`.
+/// `None` when the platform cannot say (no `/proc`, or no soft limit).
+pub fn available() -> Option<u64> {
+    let soft = rustix::process::getrlimit(rustix::process::Resource::Nofile).current?;
+    let open = std::fs::read_dir("/proc/self/fd").ok()?.count() as u64;
+    Some(soft.saturating_sub(open).saturating_sub(MARGIN))
+}
+
+/// Object streams the descriptor table allows now: at most `wanted`, at least one.
+pub fn streams_within(wanted: usize) -> usize {
+    streams_for(wanted, available())
+}
+
+/// `streams_within` against a stated number of free descriptors.
+pub fn streams_for(wanted: usize, available: Option<u64>) -> usize {
+    let fits = available.map_or(usize::MAX, |free| {
+        usize::try_from(free / PER_STREAM).unwrap_or(usize::MAX)
+    });
+    wanted.min(fits).max(1)
+}
+
+/// Whether `error` is the descriptor table being full, counting it when it is. Call it
+/// where an open, socket or resolution fails, before the error loses its errno.
+pub fn exhausted(error: &std::io::Error) -> bool {
+    let full = matches!(
+        error.raw_os_error(),
+        Some(code) if code == rustix::io::Errno::MFILE.raw_os_error()
+            || code == rustix::io::Errno::NFILE.raw_os_error()
+    );
+    if full {
+        EXHAUSTED.fetch_add(1, Ordering::Relaxed);
+    }
+    full
+}
+
+/// How many times this process has found its descriptor table full. A caller diffs two
+/// reads around its own work.
+pub fn exhaustions() -> u64 {
+    EXHAUSTED.load(Ordering::Relaxed)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn the_budget_is_descriptors_over_per_stream_cost() {
+        assert_eq!(streams_for(128, Some(PER_STREAM * 10)), 10);
+        assert_eq!(streams_for(8, Some(PER_STREAM * 10)), 8);
+        assert_eq!(streams_for(128, Some(0)), 1, "one stream is always allowed");
+        assert_eq!(
+            streams_for(128, None),
+            128,
+            "an unmeasurable table is not a shortage"
+        );
+    }
+
+    #[test]
+    fn only_a_full_table_counts_as_exhaustion() {
+        let before = exhaustions();
+        assert!(exhausted(&std::io::Error::from_raw_os_error(
+            rustix::io::Errno::MFILE.raw_os_error()
+        )));
+        assert!(!exhausted(&std::io::Error::from_raw_os_error(
+            rustix::io::Errno::CONNREFUSED.raw_os_error()
+        )));
+        assert!(exhaustions() > before);
+    }
+}

{tensorfs-0.3.63 → tensorfs-0.3.64}/crates/tensorfs-core/src/lib.rs

@@ -19,6 +19,7 @@ pub mod checkpoint;
 pub mod checkpoint_root;
 pub mod corpus;
 pub mod derived;
+pub mod descriptors;
 pub mod dtype;
 pub mod durability;
 pub mod err;

{tensorfs-0.3.63 → tensorfs-0.3.64}/crates/tensorfs-core/src/providers.rs

@@ -176,6 +176,7 @@ impl Endpoints {
             allowed_hosts,
             allow_local: self.allow_local,
             max_redirects: 5,
+            ..Default::default()
         }
     }
 

{tensorfs-0.3.63 → tensorfs-0.3.64}/crates/tensorfs-core/src/store.rs

@@ -415,9 +415,14 @@ impl Store {
     ///
     /// A symlink, non-directory, partial Store, or directory containing foreign state refuses.
     /// There is no old-layout lookup or fallback root.
+    /// Open the Store at `root`, creating it when absent or empty. Concurrent calls on one
+    /// new root serialize on the root directory: exactly one creates it, the rest open it.
     pub fn ensure(root: &Path) -> Result<Store> {
         match fs::symlink_metadata(root) {
-            Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Store::init(root),
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
+                fs::create_dir_all(root)
+                    .map_err(|error| io(format!("create Store root {}", root.display()), error))?;
+            }
             Err(error) => return Err(io(format!("stat Store root {}", root.display()), error)),
             Ok(metadata) if metadata.file_type().is_symlink() || !metadata.is_dir() => {
                 return refuse(
@@ -427,6 +432,7 @@ impl Store {
             }
             Ok(_) => {}
         }
+        let _creation = creation_lock(root)?;
         let empty = fs::read_dir(root)
             .map_err(|error| io(format!("read Store root {}", root.display()), error))?
             .next()
@@ -434,7 +440,7 @@ impl Store {
             .map_err(|error| io(format!("read Store root {}", root.display()), error))?
             .is_none();
         if empty {
-            Store::init(root)
+            Store::init_locked(root)
         } else {
             validate_store_root(root)?;
             let catalog_path = root.join("tensorfs.sqlite");
@@ -456,6 +462,15 @@ impl Store {
     }
 
     pub fn init(root: &Path) -> Result<Store> {
+        if matches!(fs::symlink_metadata(root), Ok(metadata) if metadata.is_dir() && !metadata.file_type().is_symlink())
+        {
+            let _creation = creation_lock(root)?;
+            return Store::init_locked(root);
+        }
+        Store::init_locked(root)
+    }
+
+    fn init_locked(root: &Path) -> Result<Store> {
         match fs::symlink_metadata(root) {
             Ok(metadata) if metadata.is_dir() && !metadata.file_type().is_symlink() => {}
             Ok(_) => {
@@ -1347,7 +1362,16 @@ impl Store {
                 .create_new(true)
                 .mode(0o600)
                 .open(&tmp)
-                .map_err(|e| io(format!("create temp {}", tmp.display()), e))?;
+                .map_err(|e| {
+                    if crate::descriptors::exhausted(&e) {
+                        Refusal {
+                            code: Code::FD_HEADROOM,
+                            detail: format!("create temp {}: {e}", tmp.display()),
+                        }
+                    } else {
+                        io(format!("create temp {}", tmp.display()), e)
+                    }
+                })?;
             match f.try_lock_exclusive() {
                 Ok(()) => break (tmp, f),
                 // Only a reaper can hold the lock on a name this process just minted: it
@@ -2103,6 +2127,20 @@ fn read_repo_cache_binding(root: &Path) -> Option<crate::repo_cache::RepoObjectC
     Some(crate::repo_cache::RepoObjectCache::new(cache))
 }
 
+/// Serializes Store creation on one root across threads and processes. A lock on the root
+/// directory itself leaves nothing behind in it.
+fn creation_lock(root: &Path) -> Result<File> {
+    let directory = OpenOptions::new()
+        .read(true)
+        .custom_flags(O_NOFOLLOW)
+        .open(root)
+        .map_err(|error| io(format!("open Store root {}", root.display()), error))?;
+    directory
+        .lock_exclusive()
+        .map_err(|error| io(format!("lock Store root {}", root.display()), error))?;
+    Ok(directory)
+}
+
 fn open_validated(root: &Path) -> Result<Store> {
     fs::create_dir_all(root.join("tmp")).map_err(|error| io("mkdir tmp", error))?;
     Ok(Store {

{tensorfs-0.3.63 → tensorfs-0.3.64}/crates/tensorfs-core/src/transport/http.rs

@@ -166,7 +166,8 @@ pub struct Client {
 type IdlePool = Arc<Mutex<Vec<Idle>>>;
 
 // This bounds retained descriptors, not in-flight transfers (the caller owns those).
-const MAX_IDLE: usize = 8;
+// `descriptors::PER_STREAM` counts one idle socket per stream.
+const MAX_IDLE: usize = 32;
 
 /// A connection belongs to its origin and the credentials sent on it, never to one
 /// request target: a signed CDN URL changes per resolve, and keying on it meant the
@@ -414,7 +415,15 @@ fn connect(
         let socket = match nonblocking_socket(family) {
             Ok(socket) => socket,
             Err(error) => {
-                last = Some(error.into());
+                let error: std::io::Error = error.into();
+                if crate::descriptors::exhausted(&error) {
+                    // Another address needs another descriptor it will not get either.
+                    return refuse(
+                        Code::FD_HEADROOM,
+                        format!("{}: no descriptor for a socket ({error})", checked.host),
+                    );
+                }
+                last = Some(error);
                 continue;
             }
         };
@@ -653,6 +662,15 @@ pub struct BodyReader<'l> {
 
 impl Drop for BodyReader<'_> {
     fn drop(&mut self) {
+        self.recycle_if_consumed();
+    }
+}
+
+impl BodyReader<'_> {
+    /// Hand the connection back the moment its last body byte is read, not when the
+    /// reader is dropped: the consumer may still spend seconds hashing, fsyncing and
+    /// committing what arrived, and the next object's GET should find this socket idle.
+    fn recycle_if_consumed(&mut self) {
         // Only a fully consumed, unambiguous Content-Length response is reusable.
         // Dropped/failed bodies, chunked bodies and EOF-delimited replies close.
         if !matches!(self.framing, Framing::Length { remaining: 0 }) || self.raw_len() != 0 {
@@ -722,6 +740,7 @@ impl BodyReader<'_> {
                     let silent = self.advanced.elapsed();
                     if self.judge.silent_is_stall() && silent > self.ledger.patience() {
                         self.stalled = true;
+                        self.ledger.stalled_stream();
                         let _ = self
                             .wire
                             .as_ref()
@@ -846,6 +865,7 @@ impl BodyReader<'_> {
                 self.framing = Framing::Length {
                     remaining: remaining - n as u64,
                 };
+                self.recycle_if_consumed();
                 Ok(n)
             }
             Framing::Chunked { in_chunk, done } => {
@@ -946,13 +966,11 @@ pub fn request<'l>(
     write_silence: Option<Duration>,
     fail: Code,
 ) -> Result<Response<'l>> {
-    // Retained-source ranges already own their retry/resume budget. Other GETs and
-    // metadata writes keep their one-connection behavior.
-    let ranged = method == "GET"
+    // Every bodiless GET may reuse a connection to its origin: a pull's objects are many
+    // GETs to one host, and a fresh TCP+TLS connection per object spent a descriptor, a
+    // handshake and a slow start on each. Metadata writes keep one connection each.
+    let pooled = method == "GET"
         && body.is_none()
-        && headers
-            .iter()
-            .any(|(name, _)| name.eq_ignore_ascii_case("range"))
         && !headers
             .iter()
             .any(|(name, _)| name.eq_ignore_ascii_case("connection"));
@@ -967,7 +985,7 @@ pub fn request<'l>(
         method,
         headers,
         body.map(Payload::Bytes),
-        ranged.then_some(scoped.as_slice()),
+        pooled.then_some(scoped.as_slice()),
         deadline,
         ledger,
         judge,

{tensorfs-0.3.63 → tensorfs-0.3.64}/crates/tensorfs-core/src/transport/http_reuse_tests.rs

@@ -197,6 +197,7 @@ impl Origin {
             allowed_hosts: vec!["localhost".into()],
             allow_local: true,
             max_redirects: 2,
+            ..Default::default()
         }
     }
     fn count(&self) -> usize {
@@ -364,20 +365,23 @@ fn only_complete_unambiguous_http11_length_bodies_enter_the_pool() {
 }
 
 #[test]
-fn idle_descriptor_retention_is_bounded_and_non_range_gets_do_not_pool() {
+fn idle_descriptor_retention_is_bounded_and_plain_gets_pool_too() {
     let origin = Origin::new(false, Duration::ZERO, |_, _| Reply::body(b"bytes"));
     let client = origin.client();
-    for index in 0..32 {
+    let scopes = MAX_IDLE + 8;
+    for index in 0..scopes {
         let mut headers = ranged();
         headers.push(("authorization".into(), format!("Bearer {index}")));
         ask(&client, &origin.checked("/object"), &headers).unwrap();
     }
     assert_eq!(client.idle.lock().unwrap().len(), MAX_IDLE);
-    assert_eq!(origin.count(), 32);
+    assert_eq!(origin.count(), scopes);
+    // A whole-object GET is a pull's common case: the second rides the first's socket.
     for _ in 0..2 {
-        ask(&client, &origin.checked("/metadata"), &[]).unwrap();
+        ask(&client, &origin.checked("/object"), &[]).unwrap();
     }
-    assert_eq!(origin.count(), 34);
+    assert_eq!(origin.count(), scopes + 1);
+    assert_eq!(client.idle.lock().unwrap().len(), MAX_IDLE);
 }
 
 #[test]

{tensorfs-0.3.63 → tensorfs-0.3.64}/crates/tensorfs-core/src/transport/ledger.rs

@@ -31,7 +31,7 @@
 //! paid H100s sat at exactly zero for fifteen minutes with neither plane complaining.
 
 use crate::err::{refuse, Code, Result};
-use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
 use std::sync::{Arc, Mutex};
 use std::time::{Duration, Instant};
 
@@ -151,6 +151,8 @@ impl PullCancellation {
 pub struct Ledger {
     caller_cancellation: Option<PullCancellation>,
     cancelled: Arc<AtomicBool>,
+    /// Streams this pull has judged stalled, a backpressure signal for its pace.
+    stalls: Arc<AtomicU64>,
     sample: Duration,
     worst_gap: Arc<Mutex<Duration>>,
     progress: Arc<Mutex<Progress>>,
@@ -170,6 +172,7 @@ impl Ledger {
         Ledger {
             caller_cancellation: None,
             cancelled: Arc::new(AtomicBool::new(false)),
+            stalls: Arc::new(AtomicU64::new(0)),
             sample: sample.max(Duration::from_millis(1)),
             worst_gap: Arc::new(Mutex::new(Duration::ZERO)),
             progress: Arc::new(Mutex::new(Progress {
@@ -243,6 +246,16 @@ impl Ledger {
         self.sample
     }
 
+    /// A stream of this pull was judged stalled.
+    pub(super) fn stalled_stream(&self) {
+        self.stalls.fetch_add(1, Ordering::Relaxed);
+    }
+
+    /// Streams this pull has judged stalled so far.
+    pub(super) fn stalls(&self) -> u64 {
+        self.stalls.load(Ordering::Relaxed)
+    }
+
     /// The smallest patience ever granted: `STILL_SAMPLES` intervals of the resolution.
     pub fn floor(&self) -> Duration {
         self.sample * STILL_SAMPLES
@@ -280,6 +293,7 @@ impl Ledger {
         Self {
             caller_cancellation: self.caller_cancellation.clone(),
             cancelled: Arc::clone(&self.cancelled),
+            stalls: Arc::clone(&self.stalls),
             sample: self.sample,
             worst_gap: Arc::clone(&self.worst_gap),
             progress: Arc::clone(&self.progress),

{tensorfs-0.3.63 → tensorfs-0.3.64}/crates/tensorfs-core/src/transport/pace.rs

@@ -9,6 +9,10 @@
 //! admits while doing so bought at least `GAIN` more aggregate goodput. A doubling that
 //! bought less settles the walk; one that bought less than nothing returns to the level
 //! before it. Nothing is ended or failed here: this only admits workers to the next object.
+//!
+//! Two signals halve the level and stop its growth for the rest of the walk: a stream the
+//! ledger judged stalled while the level stood, and a full descriptor table (`shrink`).
+//! Both say the pull is asking more of the link or the process than either will give.
 use super::ledger::Ledger;
 use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
 use std::sync::{Condvar, Mutex};
@@ -32,6 +36,9 @@ struct State {
     limit: usize,
     active: usize,
     settled: bool,
+    /// Times the level was halved on backpressure.
+    backoffs: u32,
+    stalls_seen: u64,
     window_started: Instant,
     moved_at_window: u64,
     history: Vec<Level>,
@@ -67,6 +74,8 @@ impl Pace {
                 limit,
                 active: 0,
                 settled: limit == ceiling,
+                backoffs: 0,
+                stalls_seen: ledger.stalls(),
                 window_started: Instant::now(),
                 moved_at_window: ledger.still().moved,
                 history: Vec::new(),
@@ -82,10 +91,38 @@ impl Pace {
         self.state.lock().unwrap().limit
     }
 
-    /// The level the walk ended at and every level it measured on the way.
-    pub fn outcome(&self) -> (usize, Vec<Level>) {
+    /// The level the walk ended at, every level it measured on the way, and how many
+    /// times backpressure halved it.
+    pub fn outcome(&self) -> (usize, Vec<Level>, u32) {
         let state = self.state.lock().unwrap();
-        (state.limit, state.history.clone())
+        (state.limit, state.history.clone(), state.backoffs)
+    }
+
+    /// Times backpressure has halved the level so far. A caller reads it before an attempt
+    /// and hands it to `back_off`, so one episode that fails many streams at once halves
+    /// the level once, not once per stream.
+    pub fn backoffs(&self) -> u32 {
+        self.state.lock().unwrap().backoffs
+    }
+
+    /// Halve the level unless it was already halved since `seen`.
+    pub fn back_off(&self, seen: u32) {
+        if self.state.lock().unwrap().backoffs == seen {
+            self.shrink();
+        }
+    }
+
+    /// Halve the level and stop growing it. `false` when it is already one stream: there is
+    /// nothing left to give back.
+    pub fn shrink(&self) -> bool {
+        let mut state = self.state.lock().unwrap();
+        state.settled = true;
+        if state.limit <= 1 {
+            return false;
+        }
+        state.limit /= 2;
+        state.backoffs += 1;
+        true
     }
 
     pub fn worker_finished(&self) {
@@ -126,10 +163,7 @@ impl Pace {
         loop {
             let mut state = self.state.lock().unwrap();
             loop {
-                if state.settled
-                    || stop.load(Ordering::Relaxed)
-                    || self.live.load(Ordering::Acquire) == 0
-                {
+                if stop.load(Ordering::Relaxed) || self.live.load(Ordering::Acquire) == 0 {
                     return;
                 }
                 let waited = state.window_started.elapsed();
@@ -138,7 +172,19 @@ impl Pace {
                 }
                 state = self.wake.wait_timeout(state, tick - waited).unwrap().0;
             }
+            let stalls = ledger.stalls();
+            let stalled = stalls > state.stalls_seen;
+            state.stalls_seen = stalls;
+            if state.settled && !stalled {
+                state.window_started = Instant::now();
+                continue;
+            }
             drop(state);
+            if stalled {
+                self.shrink();
+                self.state.lock().unwrap().window_started = Instant::now();
+                continue;
+            }
             self.observe(ledger.still().moved, Instant::now(), unclaimed());
         }
     }
@@ -195,7 +241,7 @@ mod tests {
         pace.observe(530, t0 + second * 3, 1000);
         assert_eq!(pace.limit(), 64, "1.15x does not");
         pace.observe(10_000, t0 + second * 4, 1000);
-        let (level, history) = pace.outcome();
+        let (level, history, _) = pace.outcome();
         assert_eq!(level, 64, "a settled walk stays settled");
         assert_eq!(history.len(), 3);
     }

{tensorfs-0.3.63 → tensorfs-0.3.64}/crates/tensorfs-core/src/transport/policy.rs

@@ -26,7 +26,9 @@
 //! metadata read.
 
 use crate::err::{refuse, Code, Result};
+use std::collections::HashMap;
 use std::net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr, ToSocketAddrs};
+use std::sync::{Arc, Mutex};
 
 /// The address classes no downloader in this tree connects to — the port of
 /// `egress._CLASSES`, same names, same order. Returns why `address` is not fetchable, or
@@ -173,6 +175,36 @@ pub struct SourcePolicy {
     /// Redirect hop budget. 0 refuses every redirect — a presigned GET has no business
     /// redirecting; a provider handler (tfs-052) that needs hops declares them.
     pub max_redirects: u32,
+    /// Answers this policy has already resolved, shared by its clones. One pull asks the
+    /// resolver once per host instead of once per object; every answer is still checked.
+    pub resolved: Resolved,
+}
+
+/// Checked answers by host and port.
+type Answers = HashMap<(String, u16), Vec<SocketAddr>>;
+
+/// One resolution per host and port for as long as the policy that made it lives.
+#[derive(Clone, Default)]
+pub struct Resolved(Arc<Mutex<Answers>>);
+
+impl std::fmt::Debug for Resolved {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str("Resolved")
+    }
+}
+
+impl Resolved {
+    fn lookup(&self, host: &str, port: u16) -> std::io::Result<Vec<SocketAddr>> {
+        let key = (host.to_string(), port);
+        if let Some(addrs) = self.0.lock().unwrap().get(&key) {
+            return Ok(addrs.clone());
+        }
+        let addrs = resolve(host, port)?;
+        if !addrs.is_empty() {
+            self.0.lock().unwrap().insert(key, addrs.clone());
+        }
+        Ok(addrs)
+    }
 }
 
 impl SourcePolicy {
@@ -219,13 +251,20 @@ impl SourcePolicy {
             );
         }
         let port = port.unwrap_or(if https { 443 } else { 80 });
-        let addrs = resolve(&host, port).map_err(|error| crate::err::Refusal {
-            code: Code::HUB_UNREACHABLE,
-            detail: format!(
-                "{host}: name resolution failed ({error}); an address this module cannot \
+        let addrs = self
+            .resolved
+            .lookup(&host, port)
+            .map_err(|error| crate::err::Refusal {
+                code: if crate::descriptors::exhausted(&error) {
+                    Code::FD_HEADROOM
+                } else {
+                    Code::HUB_UNREACHABLE
+                },
+                detail: format!(
+                    "{host}: name resolution failed ({error}); an address this module cannot \
                  check is not an address it will connect to"
-            ),
-        })?;
+                ),
+            })?;
         if addrs.is_empty() {
             return refuse(Code::HUB_UNREACHABLE, format!("{host} resolved to nothing"));
         }