pgw#1142 (§4.32 item 4): an operator can turn compiled serving off on a LIVE worker — and back on - #664
Merged
Merged
Conversation
… a LIVE worker — and back on
Paul, verbatim: "The consumer should have the ability to turn off compile
entirely, and serve-eager only, if the compile is broken or they just don't
care. I.e., they can send some sort of command to the worker to serve eager
rather than serve compiled. This is useful for the hub and cozy-local."
Half the vocabulary already existed, and it is reused rather than duplicated:
`eager_only` is a Plan ExecutionSpec backend (STEADY_BACKEND_EAGER_ONLY ->
`arm_ordered`: "eager_only arms nothing, by order"), and pgw#714's
`operator_eager_pin` is the hub-resolved lane pinned in config. Both are
decided BEFORE a pod serves, and neither can be taken back — which is exactly
what "the compile is broken", a thing discovered mid-flight, needs. There was
no env toggle to migrate (GEN_WORKER_FORCE_EAGER and friends do not exist,
grep-verified); this is the first explicit mechanism, and it is a COMMAND over
the existing scheduler control channel (`ServePosture` on SchedulerMessage,
th#1808), never an env: §1.17, an env may carry a VALUE, not a DECISION.
SCOPE, decided and recorded so it is not re-litigated:
* WHOLE-WORKER, not per-function. The operator's question is "is compile
broken on this pod". Per-function needs a second addressing vocabulary
(which function, which execution group, which release) for a case nobody
has had; every enforcement point reads the ONE order, so adding a scope
later narrows this rather than forking it.
* RUNTIME, not boot-only. A boot-only switch means recycling the pod to use
it, which is the cost the switch exists to avoid.
* REVERSIBLE — and that decides the enforcement point. The order is read AT
THE CALL in aot_serve's wrapper, so an armed artifact is never unwrapped
and releasing the order resumes compiled serving on the very next request
with no re-arm, no re-materialize and no re-mint. Unwrapping would have
produced the same first half and a permanently eager pod afterwards.
ONE POSTURE, ONE GATE. `compile_cache.arming_block` — the one precondition
authority — answers the order first, so adoption, JIT intake, cold compile and
every self-mint are suppressed by a single check instead of a check per call
site. `fleet_cells.enable_compiled` short-circuits BEFORE the policy, so no
cell is resolved, downloaded or minted for a gate that has already decided.
`arm_ordered` obeys the order over the hub's own Plan by arming nothing and
serving — never OrderedArmError, because killing the function is the opposite
of "serve eager instead", and it would not be reversible. The executor's boot
path folds the order in beside the pgw#775 topology reason so boot-adopt does
not fetch a cell the pod may not call; the topology reason KEEPS the ordered
aot_cell refusal to itself, since a degree>1 pod genuinely cannot run the named
cell while a suppressed pod simply chooses not to.
COMPOSES WITH §4.31's STICKY DE-ARM WITHOUT BEING MISTAKABLE FOR IT. Same eager
posture, two triggers: the de-arm is automatic, per-cell, evidence, irreversible
for the boot; this is operator-explicit, whole-worker, policy, reversible.
Releasing the order deliberately does NOT resurrect a cell that de-armed itself
for cause — policy has no standing to overrule evidence.
TELEMETRY SAYS WHICH. `EagerPhase.OPERATOR_EAGER_ONLY` ("operator_eager_only",
pinned in the wire-contract test), aliased into serving_mode and boot_adopt's
gate reasons; a `serve_posture` activity kind carrying eager_only_engaged /
eager_only_released with the operator's own words. `serving_mode.resolve`
reports a suppressed request as eager rather than aot_cell — the cell is still
armed, so naive classification reads exactly the wire lie pgw#1082/pgw#1093
spent two pods closing, arriving from the opposite direction — and not as a
fallback, because nothing fell back.
COZY-LOCAL: `gen-worker serve --eager-only` / `run --eager-only` for the boot,
and a {"posture": {...}} control frame on the serve socket for a warm serve
(cl#49 drives both). Named --eager-only, never --eager, which means eager
LOADING and is a false friend this lane nearly inherited.
Tests are mutation-proven RED: neutering `eager_only()` fails 8 of them and
neutering `block()` fails 2 more. Joins the batched 0.110.0; no release cut.
PaulFidika
force-pushed
the
1142-eager-only-command
branch
from
August 11, 2026 20:59
8f6b75d to
8df37df
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
DESIGN-RULINGS §4.32 item 4. Paul, verbatim: "The consumer should have the ability to turn off compile entirely, and serve-eager only, if the compile is broken or they just don't care. I.e., they can send some sort of command to the worker to serve eager rather than serve compiled. This is useful for the hub and cozy-local."
What this is
A command, over the existing scheduler control channel (
ServePostureonSchedulerMessage), not an env and not a second config surface (§1.17: an env may carry a VALUE, never a DECISION).Half the vocabulary already existed and is reused:
eager_onlyis a PlanExecutionSpecbackend, and pgw#714'soperator_eager_pinis the hub-resolved lane pinned in config. Both are decided before a pod serves and neither can be taken back. There was no env toggle to migrate (GEN_WORKER_FORCE_EAGER&c. do not exist, grep-verified).Scope decisions
Enforcement, one posture and one gate
compile_cache.arming_block(the ONE precondition authority) answers it first → no adopt, no JIT intake, no cold compile, no self-mint.fleet_cells.enable_compiledshort-circuits before the policy → nothing resolved, downloaded or minted.arm_orderedobeys the order over the hub's Plan by arming nothing and serving — neverOrderedArmError.aot_serve's wrapper serves eager with the arm intact (the reversibility seam).aot_cellrefusal to itself.Composition with §4.31's sticky de-arm
Same posture, two triggers, two tokens. De-arm: automatic, per-cell, evidence, irreversible for the boot. This: operator-explicit, whole-worker, policy, reversible. Releasing the order does not resurrect a de-armed cell.
Telemetry
EagerPhase.OPERATOR_EAGER_ONLY(operator_eager_only, pinned in the wire-contract test) + aserve_postureactivity kind (eager_only_engaged/eager_only_released) carrying the operator's words. A suppressed request reportseager, notaot_cell— the cell is still armed, so naive classification would report the compiled lane for a forward the artifact never ran.cozy-local
gen-worker serve --eager-only/run --eager-only, plus a{"posture": {...}}control frame on the serve socket for a warm serve (cl#49 drives both). Named--eager-only, never--eager— that one means eager LOADING.Verification
tests/test_eager_only_command_pgw1142.py(18 tests), mutation-proven RED: neuteringeager_only()fails 8, neuteringblock()fails 2 more.mypy src/gen_workerclean,ruffclean,scripts/lint_unreached_surface.pyclean,PROTO_SKIP_PEER=1 scripts/proto-drift-check.shpasses.test_aot_serve_pgw721,test_pgw714_compile_crash,test_silent_failure_audit_pgw824,test_sp_eager_only_pgw775,test_eager_first_boot_pgw671, the boot-adopt files.Land this BEFORE tensorhub th#1808 — the hub's proto-drift layer 2 reads this repo's
master. No release cut here: joins the batched 0.110.0 (pgw#1140 ledger).