tensorfs 0.3.76__tar.gz → 0.3.78__tar.gz

{tensorfs-0.3.76 → tensorfs-0.3.78}/Cargo.lock

@@ -439,7 +439,7 @@ checksum = "adb6935a6f5c20170eeceb1a3835a49e12e19d792f6dd344ccc76a985ca5a6ca"
 
 [[package]]
 name = "tensorfs-core"
-version = "0.3.76"
+version = "0.3.78"
 dependencies = [
  "fs2",
  "libc",
@@ -454,7 +454,7 @@ dependencies = [
 
 [[package]]
 name = "tensorfs-py"
-version = "0.3.76"
+version = "0.3.78"
 dependencies = [
  "pyo3",
  "tensorfs-core",

{tensorfs-0.3.76 → tensorfs-0.3.78}/Cargo.toml

@@ -3,5 +3,5 @@ resolver = "2"
 members = ["crates/tensorfs-core", "crates/tensorfs-py"]
 
 [workspace.package]
-version = "0.3.76"
+version = "0.3.78"
 edition = "2021"

{tensorfs-0.3.76 → tensorfs-0.3.78}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tensorfs
-Version: 0.3.76
+Version: 0.3.78
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Programming Language :: Rust

tensorfs-0.3.78/crates/tensorfs-core/src/bin/tfs/ensure.rs

@@ -0,0 +1,160 @@
+//! `tfs ensure <root> <ref> --hub <base>`: make one model resident (proto-063 M2a).
+//!
+//! STDOUT is JSON lines and nothing else: `ensure.progress` samples, then exactly one
+//! `ensure.result` (exit 0) or `ensure.refused` (exit 1). Usage errors exit 2.
+
+use std::io::Write;
+use std::path::Path;
+use std::process::ExitCode;
+use std::sync::Mutex;
+
+use tensorfs_core::canon::{self, Value};
+use tensorfs_core::ensure::{self, Ensured, Event, Request};
+use tensorfs_core::err::Refusal;
+use tensorfs_core::store::Store;
+use tensorfs_core::transport;
+
+use crate::{flag, flag_all, flag_num, Flags};
+
+fn read(path: &str) -> Result<Vec<u8>, Refusal> {
+    std::fs::read(path).map_err(|e| Refusal {
+        code: tensorfs_core::err::Code::IO_FAILED,
+        detail: format!("read {path}: {e}"),
+    })
+}
+
+fn quoted(text: &str) -> String {
+    String::from_utf8(canon::write(&Value::str(text))).unwrap()
+}
+
+fn say(out: &Mutex<std::io::Stdout>, line: String) {
+    let mut out = out.lock().unwrap();
+    // A closed reader is not this download's business; the bytes are still wanted.
+    let _ = writeln!(out, "{line}").and_then(|()| out.flush());
+}
+
+fn progress(event: &Event) -> String {
+    format!(
+        "{{\"event\":\"ensure.progress\",\"model\":{},\"step\":{},\"phase\":\"{}\",\"bytes_done\":{},\"bytes_total\":{},\"rate\":{:.1},\"attempt\":{}}}",
+        quoted(&event.model),
+        quoted(&event.step),
+        event.phase.as_str(),
+        event.bytes_done,
+        event.bytes_total,
+        event.rate,
+        event.attempt,
+    )
+}
+
+fn result(r: &Ensured) -> String {
+    format!(
+        "{{\"event\":\"ensure.result\",\"model\":{},\"release\":{},\"lane\":{},\"scope\":{},\"manifest\":\"{}\",\"manifest_length\":{},\"bytes_total\":{},\"bytes_held\":{},\"bytes_fetched\":{},\"bytes_cached\":{},\"cache_written_bytes\":{},\"collected_bytes\":{},\"attempts\":{},\"joined\":{},\"seconds\":{:.3}}}",
+        quoted(&r.model),
+        quoted(&r.release),
+        quoted(&r.lane),
+        quoted(&r.scope),
+        r.manifest.id(),
+        r.manifest.length,
+        r.bytes_total,
+        r.bytes_held,
+        r.bytes_fetched,
+        r.bytes_cached,
+        r.cache_written_bytes,
+        r.collected_bytes,
+        r.attempts,
+        r.joined,
+        r.seconds,
+    )
+}
+
+fn refused(refusal: &Refusal, model: &str, step: &str) -> String {
+    format!(
+        "{{\"event\":\"ensure.refused\",\"code\":\"{}\",\"resumable\":{},\"detail\":{},\"model\":{},\"step\":{}}}",
+        refusal.code.as_str(),
+        ensure::resumable(refusal.code),
+        quoted(&refusal.detail),
+        quoted(model),
+        quoted(step),
+    )
+}
+
+pub fn cmd_ensure(root: &Path, refspec: &str, flags: &Flags) -> ExitCode {
+    let Some(hub) = flag(flags, "hub") else {
+        eprintln!("--hub <base-url> is required");
+        return ExitCode::from(2);
+    };
+    let out = Mutex::new(std::io::stdout());
+    let model = refspec.split('@').next().unwrap_or_default();
+    let step = flag(flags, "step").unwrap_or("");
+    let answer = |outcome: Result<Ensured, Refusal>| match outcome {
+        Ok(ensured) => {
+            say(&out, result(&ensured));
+            ExitCode::SUCCESS
+        }
+        Err(refusal) => {
+            say(&out, refused(&refusal, model, step));
+            ExitCode::FAILURE
+        }
+    };
+    let setup = || -> Result<_, Refusal> {
+        if let Some(path) = flag(flags, "ca-file") {
+            transport::trust_roots(&read(path)?)?;
+        }
+        // The credential reaches the child as a file or TFS_CREDENTIAL, never argv.
+        let spec = match flag(flags, "credential-file") {
+            Some(path) => String::from_utf8_lossy(&read(path)?).into_owned(),
+            None => std::env::var("TFS_CREDENTIAL").unwrap_or_default(),
+        };
+        let credential =
+            transport::credential_from_spec(spec.trim(), vec![transport::base_host(hub)?])?;
+        Ok((Store::open(root)?, credential))
+    };
+    let (store, credential) = match setup() {
+        Ok(setup) => setup,
+        Err(refusal) => return answer(Err(refusal)),
+    };
+    let policy = crate::fetch::policy_of(flags);
+    let keep: Vec<String> = flag_all(flags, "keep")
+        .into_iter()
+        .map(str::to_string)
+        .collect();
+    let on_event = |event: &Event| say(&out, progress(event));
+    let mut request = Request::new(&store, hub, refspec, &credential, &policy);
+    request.lane = flag(flags, "lane").unwrap_or("");
+    request.step = step;
+    request.keep = &keep;
+    request.streams = flag_num(flags, "streams", transport::PULL_STREAMS);
+    request.streams_start = flag_num(flags, "streams-start", transport::STREAMS);
+    request.sample_seconds = flag_num(flags, "sample-seconds", transport::SAMPLE_SECONDS);
+    request.on_event = Some(&on_event);
+    answer(ensure::ensure(&request))
+}
+
+/// `tfs pressure <root> [--keep sha256:<m>]...`: one pressure pass (see `ensure::relieve`),
+/// reported as one JSON line.
+pub fn cmd_pressure(root: &Path, flags: &Flags) -> ExitCode {
+    let keep: Vec<String> = flag_all(flags, "keep")
+        .into_iter()
+        .map(str::to_string)
+        .collect();
+    let relief = match Store::open(root).and_then(|store| ensure::relieve(&store, &keep)) {
+        Ok(relief) => relief,
+        Err(refusal) => {
+            println!(
+                "{{\"event\":\"pressure.refused\",\"code\":\"{}\",\"detail\":{}}}",
+                refusal.code.as_str(),
+                quoted(&refusal.detail)
+            );
+            return ExitCode::FAILURE;
+        }
+    };
+    println!(
+        "{{\"event\":\"pressure\",\"pressure\":{},\"collected_bytes\":{},\"capacity_bytes\":{},\"available_bytes\":{},\"unable\":{}}}",
+        relief.pressure,
+        relief.collected_bytes,
+        relief.capacity_bytes,
+        relief.available_bytes,
+        relief.unable.as_deref().map_or("null".to_string(), quoted),
+    );
+    ExitCode::SUCCESS
+}

{tensorfs-0.3.76 → tensorfs-0.3.78}/crates/tensorfs-core/src/bin/tfs/fetch.rs

@@ -168,7 +168,7 @@ use tensorfs_core::transport::{
     self, credential_from_spec, Anonymous, Deadline, PullRequest, SourcePolicy,
 };
 
-fn policy_of(flags: &Flags) -> SourcePolicy {
+pub(crate) fn policy_of(flags: &Flags) -> SourcePolicy {
     SourcePolicy {
         allowed_hosts: crate::flag(flags, "allow-hosts")
             .map(|hosts| {

{tensorfs-0.3.76 → tensorfs-0.3.78}/crates/tensorfs-core/src/bin/tfs/ingest.rs

@@ -446,7 +446,7 @@ pub fn cmd_bank(dialect: &str, converter: &str, f: &Flags) -> ExitCode {
     for (component, path) in &srcs {
         let (full, raw) = ok!(source_core::read_carrier_at(path));
         let h = if conv.dialect == "safetensors.single_file" {
-            ok!(convert::single_file_component(component, &full))
+            ok!(convert::single_file_component(conv, component, &full))
         } else {
             full
         };

{tensorfs-0.3.76 → tensorfs-0.3.78}/crates/tensorfs-core/src/bin/tfs/main.rs

@@ -31,7 +31,8 @@
 //!                                   [--session <s>] [--tenant <t>] [--no-journal]
 //!   tfs repo-cache chain <cache> <chain-id> <length>       the links, root to head
 //!   tfs put <root> <file>        stream one object in (any shape)
-//!   tfs get <root> <hex>         verified read, whole or ranged
+//!   tfs get <root> <hex>         verified read, whole or ranged; with --out - the bytes
+//!                                go to stdout under a read lease (--range <off>:<len>|<off>:)
 //!   tfs contains <root> <hex>    the presence HINT, and what it is worth
 //!   tfs verify <root> <hex>      verification record or rehash; remove corrupt bytes
 //!   tfs scrub <root>             one rate knob over the whole store
@@ -48,6 +49,15 @@
 //! `tfs fetch` reads and backfills the Store's bound repo cache between the local Store
 //! and the origin. It is bound by `tfs store ensure --repo-cache` and never by a flag here.
 //!
+//!   tfs capabilities             one feature name per line (ensure/1, get-range/1, ...)
+//!   tfs ensure <root> <ref> --hub <base> [--lane L] [--step S] [--keep sha256:<m>]...
+//!                               make one model resident: closure, one flight per manifest per
+//!                               Store, disk admission + GC policy, paced resumable fetch, retry
+//!                               only after measured progress. STDOUT is JSON lines:
+//!                               ensure.progress samples, then ensure.result (exit 0) or
+//!                               ensure.refused {code, resumable, detail} (exit 1)
+//!   tfs pressure <root> [--keep sha256:<m>]...   one pressure pass: at <= 1/10 free, run
+//!                               the GC policy until > 1/5 is free; one JSON line
 //!   tfs fetch <root> <ref>       closure -> plan -> N-way walk (presign at use) -> proof
 //!   tfs fetch bounded <root> <ref> --max-download-bytes N --max-download-objects N
 //!                               same pull, refused before body transfer if new objects exceed bounds
@@ -203,7 +213,9 @@ fn accept_printed_ids(args: Vec<String>) -> Vec<String> {
 
 fn main() -> ExitCode {
     let (args, flags) = split_flags(std::env::args().skip(1).collect());
-    if let Some(path) = flag(&flags, "ca-file") {
+    // `ensure` names its CA itself so a bad file is a refusal on its own channel.
+    let ensure = args.first().is_some_and(|verb| verb == "ensure");
+    if let (Some(path), false) = (flag(&flags, "ca-file"), ensure) {
         let trusted = fs::read(path)
             .map_err(|e| format!("IO_FAILED: read {path}: {e}"))
             .and_then(|pem| {
@@ -218,6 +230,14 @@ fn main() -> ExitCode {
     let a: Vec<&str> = args.iter().map(|s| s.as_str()).collect();
     match a.as_slice() {
         ["version"] => cmd_version(),
+        ["capabilities"] => {
+            tensorfs_core::CAPABILITIES
+                .iter()
+                .for_each(|c| println!("{c}"));
+            ExitCode::SUCCESS
+        }
+        ["ensure", r, refspec] => ensure::cmd_ensure(Path::new(r), refspec, &flags),
+        ["pressure", r] => ensure::cmd_pressure(Path::new(r), &flags),
         ["home"] => cmd_home(None),
         ["home", r] => cmd_home(Some(Path::new(r))),
         ["store", "init"] => cmd_store_default("init", &flags),
@@ -815,6 +835,7 @@ macro_rules! ok {
 
 mod ckpt;
 mod conform;
+mod ensure;
 mod fetch;
 mod ingest;
 mod rd;
@@ -936,6 +957,67 @@ fn fault_of(f: &Flags) -> Fault {
     }
 }
 
+/// `<off>:<len>` or `<off>:` (to the end) inside an object of `length` bytes.
+fn byte_range(range: &str, length: u64) -> TfsResult<(u64, u64)> {
+    let bad = || Refusal {
+        code: tensorfs_core::err::Code::RANGE_BOUNDS,
+        detail: format!("--range {range:?} is not <off>:<len> or <off>: inside {length} B"),
+    };
+    let (off, len) = range.split_once(':').ok_or_else(bad)?;
+    let off: u64 = off.parse().map_err(|_| bad())?;
+    let len: u64 = match len {
+        "" => length.checked_sub(off).ok_or_else(bad)?,
+        len => len.parse().map_err(|_| bad())?,
+    };
+    match off.checked_add(len) {
+        Some(end) if end <= length => Ok((off, len)),
+        _ => Err(bad()),
+    }
+}
+
+/// Stream a range of one verified object to stdout under a read lease, so a GC pass cannot
+/// take the object mid-read.
+fn get_leased(store: &Store, hex: &str, range: Option<&str>) -> TfsResult<()> {
+    use std::io::Write;
+    use tensorfs_core::read::{self, ObjectRange};
+    let length = store.open_verified(hex)?.len();
+    let (mut off, mut left) = match range {
+        Some(range) => byte_range(range, length)?,
+        None => (0, length),
+    };
+    let meta = tensorfs_core::meta::Meta::open(store)?;
+    let obj = ObjectRef {
+        sha256: hex.to_string(),
+        length,
+    };
+    let (lease, _) = read::acquire(store, &meta, "", vec![obj.clone()])?;
+    let mut out = std::io::stdout().lock();
+    let mut buf = vec![0u8; 1 << 20];
+    let streamed = (|| {
+        while left > 0 {
+            let n = left.min(buf.len() as u64);
+            let chunk = &mut buf[..n as usize];
+            let range = ObjectRange {
+                obj: obj.clone(),
+                off,
+                len: n,
+            };
+            read::read_into(&lease, &range, chunk)?;
+            out.write_all(chunk).map_err(|e| Refusal {
+                code: tensorfs_core::err::Code::IO_FAILED,
+                detail: format!("write stdout: {e}"),
+            })?;
+            (off, left) = (off + n, left - n);
+        }
+        out.flush().map_err(|e| Refusal {
+            code: tensorfs_core::err::Code::IO_FAILED,
+            detail: format!("write stdout: {e}"),
+        })
+    })();
+    lease.release(&meta)?;
+    streamed
+}
+
 fn cmd_put(root: &Path, src: &Path, f: &Flags) -> ExitCode {
     let s = ok!(Store::open(root));
     let expect = match (flag(f, "expect"), flag(f, "expect-length")) {
@@ -1016,6 +1098,10 @@ fn cmd_verify_object(root: &Path, hex: &str, f: &Flags) -> ExitCode {
 
 fn cmd_get(root: &Path, hex: &str, f: &Flags) -> ExitCode {
     let s = ok!(Store::open(root));
+    if flag(f, "out") == Some("-") {
+        ok!(get_leased(&s, hex, flag(f, "range")));
+        return ExitCode::SUCCESS;
+    }
     let t = Instant::now();
     if let Some(r) = flag(f, "range") {
         let (o, l) = r.split_once(':').unwrap_or((r, "1"));

tensorfs-0.3.78/crates/tensorfs-core/src/ensure/admission.rs

@@ -0,0 +1,333 @@
+//! Disk admission for one flight, and the GC policy that makes room. Disk only: nothing here
+//! looks at RAM (owner rule: no RAM floor; the Runtime pages to disk).
+//!
+//! The numbers are the Host's storage-pressure policy (pod-supervisor `pressure.go`,
+//! `fetch.go`): a reserve of max(1 GiB, 1/50 of the filesystem) and 32 inodes is never
+//! admitted; a download needs its wanted bytes and 16 + 3 inodes per wanted object; live
+//! flights' unwritten remainders are already spoken for. When a flight does not fit, the GC
+//! policy runs in order: unreferenced bytes, delivered products (oldest delivery first),
+//! then cached model lanes (the dedup-aware reclaim planner); the answer after that is the
+//! answer.
+
+use std::ops::Add;
+use std::path::Path;
+
+use crate::err::{refuse, Code, Refusal, Result};
+use crate::gc;
+use crate::source_artifact;
+use crate::store::Store;
+
+use super::flight::{self, Flight, Record};
+
+pub(super) const RESERVE_BYTES: u64 = 1 << 30;
+pub(super) const RESERVE_DIVISOR: u64 = 50;
+pub(super) const RESERVE_INODES: u64 = 32;
+pub(super) const METADATA_INODES: u64 = 16;
+pub(super) const OBJECT_INODES: u64 = 3;
+/// Pressure begins at 1/10 of the filesystem free and ends above 1/5.
+pub(super) const ENTER_DIVISOR: u64 = 10;
+pub(super) const LEAVE_DIVISOR: u64 = 5;
+
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub(super) struct Space {
+    pub bytes: u64,
+    pub inodes: u64,
+}
+
+impl Add for Space {
+    type Output = Space;
+    fn add(self, other: Space) -> Space {
+        Space {
+            bytes: self.bytes.saturating_add(other.bytes),
+            inodes: self.inodes.saturating_add(other.inodes),
+        }
+    }
+}
+
+impl Space {
+    /// What `objects` new objects of `bytes` in total cost the disk.
+    pub fn of(bytes: u64, objects: u64) -> Space {
+        Space {
+            bytes,
+            inodes: if objects == 0 {
+                0
+            } else {
+                METADATA_INODES + OBJECT_INODES * objects
+            },
+        }
+    }
+
+    fn within(self, free: Space) -> bool {
+        self.bytes <= free.bytes && self.inodes <= free.inodes
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) struct Disk {
+    pub capacity: u64,
+    pub available: u64,
+    /// Zero when the filesystem has no inode limit.
+    pub inodes: u64,
+    pub available_inodes: u64,
+}
+
+pub(super) fn measure(root: &Path) -> Result<Disk> {
+    let stat = rustix::fs::statvfs(root).map_err(|e| Refusal {
+        code: Code::CAPACITY_EXHAUSTED,
+        detail: format!(
+            "cannot measure the filesystem under {}: {e}; admission fails closed",
+            root.display()
+        ),
+    })?;
+    let unit = stat.f_frsize.max(1);
+    Ok(Disk {
+        capacity: stat.f_blocks.saturating_mul(unit),
+        available: stat.f_bavail.saturating_mul(unit),
+        inodes: stat.f_files,
+        available_inodes: stat.f_favail,
+    })
+}
+
+/// What `disk` admits once its reserve and `others` are set aside.
+pub(super) fn free(disk: &Disk, others: Space) -> Space {
+    let reserve = RESERVE_BYTES.max(disk.capacity / RESERVE_DIVISOR);
+    Space {
+        bytes: disk
+            .available
+            .saturating_sub(reserve)
+            .saturating_sub(others.bytes),
+        inodes: if disk.inodes == 0 {
+            u64::MAX
+        } else {
+            disk.available_inodes
+                .saturating_sub(RESERVE_INODES)
+                .saturating_sub(others.inodes)
+        },
+    }
+}
+
+/// The GC policy's outcome: what it freed, why a tier could not run, and the disk after.
+struct Collected {
+    bytes: u64,
+    unable: Option<Refusal>,
+    disk: Disk,
+}
+
+/// Run the GC policy's tiers until `short(disk)` says nothing is short. `short` answers
+/// the bytes still missing, or `None` once the disk is enough.
+fn collect_until(
+    store: &Store,
+    protected: &[String],
+    short: &dyn Fn(&Disk) -> Option<u64>,
+    collecting: &dyn Fn(),
+) -> Result<Collected> {
+    let root = store.root();
+    let mut collected = Collected {
+        bytes: 0,
+        unable: None,
+        disk: measure(root)?,
+    };
+    for tier in 0..3 {
+        let Some(short) = short(&collected.disk) else {
+            break;
+        };
+        if tier == 0 {
+            collecting();
+        }
+        let freed = match tier {
+            0 => gc::collect(root, false).map(|report| report.reclaimed_bytes),
+            1 => release_delivered(store, short.max(1)),
+            _ => gc::collect_cached_for(root, protected, short.max(1))
+                .map(|report| report.reclaimed_bytes),
+        };
+        match freed {
+            Ok(bytes) => collected.bytes += bytes,
+            Err(refusal) => collected.unable = Some(refusal),
+        }
+        collected.disk = measure(root)?;
+    }
+    Ok(collected)
+}
+
+/// Live flights under the admission gate: what they still owe the disk, and their
+/// manifests, which no tier may evict.
+fn flights(store: &Store, mine: &str, keep: &[String]) -> Result<(Space, Vec<String>)> {
+    let live = flight::live(store, mine)?;
+    let owed = live
+        .iter()
+        .filter_map(|(_, record)| record.as_ref().map(Record::remaining))
+        .fold(Space::default(), Add::add);
+    let mut protected = keep.to_vec();
+    protected.extend(live.into_iter().map(|(manifest, _)| manifest));
+    protected.extend((!mine.is_empty()).then(|| mine.to_string()));
+    Ok((owed, protected))
+}
+
+/// Admit `record`'s flight, collecting under the GC policy when it does not fit. Returns
+/// the bytes collected. `keep` names manifests no tier may evict.
+pub(super) fn admit(
+    store: &Store,
+    flight: &Flight,
+    record: &Record,
+    keep: &[String],
+    collecting: &dyn Fn(),
+) -> Result<u64> {
+    let need = Space::of(record.wanted_bytes, record.wanted_objects);
+    let _gate = flight::gate(store)?;
+    let (others, protected) = flights(store, &flight.manifest, keep)?;
+    let short = |disk: &Disk| {
+        let free = free(disk, others);
+        (!need.within(free)).then(|| need.bytes.saturating_sub(free.bytes))
+    };
+    let collected = collect_until(store, &protected, &short, collecting)?;
+    if short(&collected.disk).is_none() {
+        flight.record(record)?;
+        return Ok(collected.bytes);
+    }
+    let free = free(&collected.disk, others);
+    let inodes = match collected.disk.inodes {
+        0 => String::new(),
+        _ => format!(" ({} inodes, {} free)", need.inodes, free.inodes),
+    };
+    let why = collected
+        .unable
+        .map_or(String::new(), |r| format!("; GC could not run: {r}"));
+    refuse(
+        Code::CAPACITY_EXHAUSTED,
+        format!(
+            "this download needs {} B{inodes}; the disk under {} admits {} B after its \
+             reserve and {} B still owed to other downloads; GC freed {} B{why}",
+            need.bytes,
+            store.root().display(),
+            free.bytes,
+            others.bytes,
+            collected.bytes,
+        ),
+    )
+}
+
+/// What one pressure pass found and did.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Relief {
+    /// The disk was under pressure when the pass began.
+    pub pressure: bool,
+    pub collected_bytes: u64,
+    pub capacity_bytes: u64,
+    pub available_bytes: u64,
+    /// Why a tier could not run, when one could not.
+    pub unable: Option<String>,
+}
+
+/// The Host's pressure hysteresis in one pass: a disk with at most 1/10 free (or under its
+/// reserve) is collected under the GC policy until more than 1/5 is free. Live flights'
+/// manifests and `keep` are never evicted. A disk not under pressure is left alone.
+pub fn relieve(store: &Store, keep: &[String]) -> Result<Relief> {
+    let _gate = flight::gate(store)?;
+    let (_, protected) = flights(store, "", keep)?;
+    let disk = measure(store.root())?;
+    let reserve = RESERVE_BYTES.max(disk.capacity / RESERVE_DIVISOR);
+    let low = |disk: &Disk, divisor: u64| {
+        disk.available <= reserve.max(disk.capacity / divisor)
+            || (disk.inodes > 0
+                && disk.available_inodes <= RESERVE_INODES.max(disk.inodes / divisor))
+    };
+    let pressure = low(&disk, ENTER_DIVISOR);
+    let short = |disk: &Disk| {
+        low(disk, LEAVE_DIVISOR).then(|| {
+            (reserve.max(disk.capacity / LEAVE_DIVISOR) + 1).saturating_sub(disk.available)
+        })
+    };
+    let collected = if pressure {
+        collect_until(store, &protected, &short, &|| {})?
+    } else {
+        Collected {
+            bytes: 0,
+            unable: None,
+            disk,
+        }
+    };
+    Ok(Relief {
+        pressure,
+        collected_bytes: collected.bytes,
+        capacity_bytes: collected.disk.capacity,
+        available_bytes: collected.disk.available,
+        unable: collected.unable.map(|r| r.to_string()),
+    })
+}
+
+/// Release delivered products oldest delivery first, in doubling batches, collecting after
+/// each batch, until `short` bytes are freed or none are left.
+fn release_delivered(store: &Store, short: u64) -> Result<u64> {
+    let owners = source_artifact::delivered(store)?;
+    let (mut freed, mut at, mut batch) = (0u64, 0usize, 1usize);
+    while at < owners.len() && freed < short {
+        for owner in &owners[at..(at + batch).min(owners.len())] {
+            match source_artifact::release(store, owner) {
+                Err(refusal) if refusal.code == Code::STORE_BUSY => {}
+                other => other?,
+            }
+        }
+        at += batch;
+        batch *= 2;
+        freed += gc::collect(store.root(), false)?.reclaimed_bytes;
+    }
+    Ok(freed)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const GIB: u64 = 1 << 30;
+
+    fn disk(capacity: u64, available: u64) -> Disk {
+        Disk {
+            capacity,
+            available,
+            inodes: 1000,
+            available_inodes: 500,
+        }
+    }
+
+    #[test]
+    fn the_reserve_is_a_gib_or_a_fiftieth_and_others_are_spoken_for() {
+        // 10 GiB disk: the reserve is the 1 GiB floor.
+        assert_eq!(
+            free(&disk(10 * GIB, 5 * GIB), Space::default()).bytes,
+            4 * GIB
+        );
+        // 1000 GiB disk: the reserve is 20 GiB.
+        assert_eq!(
+            free(&disk(1000 * GIB, 100 * GIB), Space::default()).bytes,
+            80 * GIB
+        );
+        let others = Space::of(GIB, 10);
+        let left = free(&disk(10 * GIB, 5 * GIB), others);
+        assert_eq!(
+            left,
+            Space {
+                bytes: 3 * GIB,
+                inodes: 500 - 32 - 46
+            }
+        );
+        // Nothing left is zero, never an underflow.
+        assert_eq!(free(&disk(10 * GIB, GIB / 2), others).bytes, 0);
+    }
+
+    #[test]
+    fn a_warm_flight_needs_nothing_and_inodes_can_refuse_alone() {
+        assert!(Space::of(0, 0).within(Space::default()));
+        let tight = Disk {
+            inodes: 1000,
+            available_inodes: 40,
+            ..disk(10 * GIB, 5 * GIB)
+        };
+        assert!(!Space::of(1, 1).within(free(&tight, Space::default())));
+        let unlimited = Disk {
+            inodes: 0,
+            available_inodes: 0,
+            ..tight
+        };
+        assert!(Space::of(1, 1000).within(free(&unlimited, Space::default())));
+    }
+}