File size: 28,131 Bytes
0693474
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
"""SP1-WINDOW coordinator runner: HOLD, stage, one profiled 327,680 arm (never-started controls, then torch-profiler
captures on both TP ranks), bounded trace collection, ALWAYS the W8 restore.

Dry plan by default (no command, network or file). Only Deepseek / coordinator runs --execute, after review and staging.
Records numbers and hashes only: no prompt or generated text is saved. Reuses the reviewed PF1 runner
(offload/launch/windows/pf1_window.py: Supervisor, Live preflight/HOLD/snapshot/start/restore, runtime(), restored()).
See offload/gb10_budget/PROFILE-WINDOW.md (coordinator sheet), PROFILE-WINDOW-DESIGN.md and PROFILE-WINDOW-RECONCILE.md.
"""
from __future__ import annotations

import argparse
import hashlib
import json
import os
import re
import shlex
import signal
import subprocess
import sys
import time
from collections.abc import Callable
from dataclasses import dataclass
from pathlib import Path
from typing import Protocol, cast

from offload.gb10_budget import window_cells as wc
from offload.launch.windows import pf1_window as pf
from offload.launch.windows import up2_checks as ck
from offload.launch.windows.up2_low import X86HOST_PROBE
from offload.prefill_maxlen.evidence import Json, number, record

CONFIG = 'offload/launch/configs/SP1-profile.env'
# Byte-identical to SP1-profile.env (CPU test). Fields verified against img vllm/config/profiler.py:39-158.
PROFILER_CONFIG: dict[str, Json] = {
    'profiler': 'torch', 'torch_profiler_dir': '/sp1-profile', 'torch_profiler_activities': ['CPU', 'CUDA'],
    'torch_profiler_with_stack': False, 'torch_profiler_with_flops': False, 'torch_profiler_record_shapes': False,
    'torch_profiler_with_memory': False, 'torch_profiler_use_gzip': True, 'torch_profiler_dump_cuda_time_total': False,
    'ignore_frontend': True, 'detailed_trace_annotation': True, 'max_iterations': 16}
PROFILER_JSON = json.dumps(PROFILER_CONFIG, separators=(',', ':'))
PIN_FILES = ('offload/launch/configs/PF1-window.env', CONFIG, 'offload/launch/start_exp.sh', 'offload/launch/serve_exp.sh',
             'offload/launch/dsv41_tp2_offload.sh', 'offload/kvpack/MANIFEST.json')
PROFILE_DIR = 'dsv41-offload-run/sp1-profile'      # relative to each node's home; must be absent before the window
MOUNT = '/sp1-profile'
TRACE_NAME = re.compile(r'(?:dp0_pp0_tp(?P<tp>[01])_dcp0_ep\d+_)?rank(?P<rank>[01])\.(?P<ns>\d+)\.pt\.trace\.json\.gz')
FILE_CAP = 128 * 1024**2                            # per trace file
DIR_CAP = 512 * 1024**2                             # profile directory per node at any check
DISK_FLOOR_KB = 8 * 1024**2                         # free home disk after every capture
PRE_DISK_KB = 10 * 1024**2                          # free home disk before the HOLD
CAPTURE_FLOOR_KB = int(4.5 * 1024**2)               # MemAvailable before every /start_profile (item 1 §4)
SUBMIT_S, ABORT_S = 40 * 60, 45 * 60                # from the HOLD timestamp (design: ~20 min of measurement)
PROFILER_ON = "Profiler with mode 'torch' is enabled in the API server"
PROFILER_STARTED = 'Torch profiling enabled. Traces will be saved to'


@dataclass(frozen=True)
class SP1Arm(pf.Arm):
    """PF1's OFF arm at 327,680 (PF1_CAP/PF1_TRACE/PF1_EAGER passed by Live.start) through SP1-profile.env."""

    @property
    def config(self) -> str:
        return CONFIG


ARM = SP1Arm('sp1-327', 327680, 0)


# ---------------------------------------------------------------- pure checks (CPU-tested)

def strip_profiler(argv: str) -> str:
    """The experiment's /serve.sh argv minus exactly one reviewed --profiler-config; anything else refuses."""
    tokens = shlex.split(argv.replace('\\\n', ' '))
    ck.require(tokens.count('--profiler-config') == 1, 'experiment argv lacks exactly one --profiler-config')
    i = tokens.index('--profiler-config')
    ck.require(i + 1 < len(tokens) and tokens[i + 1] == PROFILER_JSON, 'profiler config differs from the reviewed JSON')
    del tokens[i:i + 2]
    return shlex.join(tokens)


def trace_mount(mounts: list[dict[str, Json]]) -> dict[str, Json]:
    found = [m for m in mounts if m.get('Destination') == MOUNT]
    ck.require(len(found) == 1, f'expected exactly one {MOUNT} mount')
    m = found[0]
    ck.require(m.get('Type') == 'bind' and m.get('RW') is True and str(m.get('Source', '')).endswith('/' + PROFILE_DIR),
               f'{MOUNT} is not the read-write bind of ~/{PROFILE_DIR}')
    return {'source_tail': PROFILE_DIR, 'rw': True}


def listing(text: str) -> tuple[dict[str, int], int]:
    """`find -printf '%y %s %f'` + FREE line -> ({file: bytes}, free kB); refuses directories or odd names."""
    files: dict[str, int] = {}
    free = -1
    for line in text.splitlines():
        parts = line.split()
        if parts[:1] == ['FREE'] and len(parts) == 2:
            free = int(parts[1])
        elif len(parts) == 3 and parts[0] in ('f', 'd'):
            ck.require(parts[0] == 'f', f'unexpected directory in the profile directory: {parts[2]}')
            ck.require(TRACE_NAME.fullmatch(parts[2]) is not None, f'unexpected file in the profile directory: {parts[2][:80]}')
            files[parts[2]] = int(parts[1])
        elif line.strip():
            raise ValueError(f'unparsed profile listing line: {line[:80]}')
    ck.require(free >= 0, 'profile listing lacks the FREE line')
    return files, free


def new_traces(files: dict[str, int], seen: set[str], rank: int, expected: int, free_kb: int) -> list[tuple[str, int]]:
    """This capture's files on one node, oldest first, against the hard caps."""
    ck.require(sum(files.values()) <= DIR_CAP, f'rank{rank} profile directory exceeds {DIR_CAP >> 20} MiB')
    ck.require(free_kb >= DISK_FLOOR_KB, f'rank{rank} node free disk below {DISK_FLOOR_KB >> 20} GiB')
    new = sorted(((n, s) for n, s in files.items() if n not in seen), key=lambda x: int(_ns(x[0])))
    ck.require(len(new) == expected, f'rank{rank}: {len(new)} new trace files, expected {expected}')
    for name, size in new:
        match = TRACE_NAME.fullmatch(name)
        ck.require(match is not None and int(match['rank']) == rank and match['tp'] in (None, str(rank)),
                   f'trace {name[:60]} is not global rank {rank}')
        ck.require(0 < size <= FILE_CAP, f'trace {name[:60]} size {size} outside (0, {FILE_CAP >> 20} MiB]')
    return new


def _ns(name: str) -> str:
    match = TRACE_NAME.fullmatch(name)
    return match['ns'] if match is not None else '0'


def taken(cell: dict[str, Json]) -> list[dict[str, Json]]:
    """Captures that started a profiler (each wrote one file per rank); SKIPPED_MEMORY started none."""
    rows = [record(c) for c in cast(list[Json], cell['captures'])]
    for row in rows:
        ck.require(row.get('status') in ('TAKEN', 'MIXED', 'ENDED', 'SKIPPED_MEMORY'), 'capture status unknown')
        ck.require(row.get('status') == 'SKIPPED_MEMORY' or row.get('stop_return_rel_s') is not None,
                   'a started capture has no completed stop')
    return [r for r in rows if r.get('status') != 'SKIPPED_MEMORY']


def log_count(text: str) -> int:
    lines = [x for x in text.split() if x.isdigit()]
    ck.require(len(lines) >= 1, 'log count missing')
    return int(lines[-1])


# ---------------------------------------------------------------- live backend (coordinator only)

class SP1Live(pf.Live):
    def __init__(self, out: Path, sup: pf.Supervisor, *, remote: str, expected: str, data_dir: Path, tag: str,
                 stage_bundle: bool, call: pf.Call | None = None,
                 plain: Callable[[str, list[str], float], tuple[int, str]] | None = None,
                 clock: Callable[[], float] = time.time) -> None:
        super().__init__(out, sup, remote=remote, expected=expected, data_dir=data_dir, tag=tag,
                         stage_bundle=stage_bundle, call=call, plain=plain, clock=clock)
        self.created: set[str] = set()
        self.collected: dict[str, set[str]] = {host: set() for host in pf.HOSTS}   # Live.seen = container ids
        self.manifest: list[dict[str, Json]] = []
        self.cuts = out / 'cuts.json'
        self.never_started: dict[str, Json] | None = None

    @property
    def pin_files(self) -> tuple[str, ...]:
        return PIN_FILES

    def hold_purpose(self) -> str:
        return f'SP1-WINDOW {self.tag}: bounded torch profile of K1-327 production; no attention/K1/cap/clock change'

    def reap_script(self) -> str:
        return (pf.REAP.replace('PF1-WINDOW', 'SP1-WINDOW').replace('PF1-window[.]env', 'SP1-profile[.]env')
                .replace('@TAG@', self.tag))

    def runtime_check(self, rank: int, live: dict[str, Json], arm: pf.Arm) -> None:
        stripped = {**live, 'argv': strip_profiler(str(live['argv']))}
        pf.runtime(self.production[rank], stripped, arm, self.run_name(arm))

    # -- before the HOLD (read-only, production serving)
    def preflight(self) -> None:
        super().preflight()
        for host in pf.HOSTS:
            text = self.ssh(f'profile-dir-{host}', host, f'test ! -e ~/{PROFILE_DIR} && df -Pk ~ | tail -1')
            ck.require(int(text.split()[-3]) >= PRE_DISK_KB, f'{host} home has < {PRE_DISK_KB >> 20} GiB free')

    def open_hold(self) -> float:
        opened = super().open_hold()
        self.submit, self.sup.abort_at = opened + SUBMIT_S, opened + ABORT_S
        self.sup.bound = f'{ABORT_S // 60}-minute SP1 abort bound'
        (self.out / 'deadlines.json').write_text(json.dumps({'opened': opened, 'submission': self.submit,
            'abort': self.sup.abort_at, 'restore_by': opened + ABORT_S + 8 * 60}) + '\n')
        return opened

    def node_memory(self, label: str) -> None:
        for host in pf.HOSTS:
            text = self.ssh(f'{label}-memory-{host}', host, pf.HOST_PARITY)
            available = re.findall(r'^MemAvailable:\s+(\d+) kB$', text, re.M)
            ck.require(len(available) == 1, f'{host} missing MemAvailable')
            ck.require(int(available[0]) >= pf.START_FLOOR_KB, f'{host} MemAvailable below 5 GiB before the start')

    def log_hits(self, host: str, pattern: str) -> int:
        return log_count(self.ssh(f'log-count-{host}', host,
                                  f'docker logs dsv41-serve 2>&1 | grep -c -F -e {shlex.quote(pattern)} || true'))

    # -- the arm
    def start_arm(self) -> None:
        self.node_memory(ARM.name)
        for host in pf.HOSTS:
            self.ssh(f'{ARM.name}-profile-dir-{host}', host, f'mkdir -p ~/dsv41-offload-run && mkdir ~/{PROFILE_DIR}')
            self.created.add(host)
        self.sup.arm_minima = {}
        self.sup.arm_memory[ARM.name] = self.sup.arm_minima
        super().start(ARM)          # PF1: HOLD, start_exp.sh, /v1/models 327680, identity == production, 13 pins, logs, worker
        for host in pf.HOSTS:
            mounts = ck.rows(json.loads(self.ssh(f'{ARM.name}-mounts-{host}', host,
                                                 "docker inspect --format '{{json .Mounts}}' dsv41-serve")))
            trace_mount(mounts)
            files, free = listing(self.ssh(f'{ARM.name}-profile-empty-{host}', host, self.find()))
            ck.require(not files and free >= DISK_FLOOR_KB, f'{host} profile directory not empty or disk low')
            ck.require(self.log_hits(host, PROFILER_STARTED) == 0, f'{host} profiler already started')
        ck.require(self.log_hits('sparkhead', PROFILER_ON) >= 1, 'API server did not register the profiler endpoints')

    def find(self) -> str:
        return (f"cd ~/{PROFILE_DIR} && find . -mindepth 1 -maxdepth 1 -printf '%y %s %f\\n' && "
                "echo \"FREE $(df -Pk ~ | tail -1 | awk '{print $4}')\"")

    def driver(self, *extra: str) -> list[str]:
        return [sys.executable, '-m', 'offload.gb10_budget.window_cells', '--execute', '--data-dir', str(self.data_dir), *extra]

    def build(self) -> dict[str, Json]:
        self.call('prompts-build', self.driver('build', '--output', str(self.cuts)), timeout=600)
        cuts = ck.read(self.cuts)
        return {key: record(v).get('tokens') for key, v in record(cuts['prompts']).items()}

    def cell(self, name: str) -> dict[str, Json]:
        cell = wc.CELLS[name]
        ck.require(self.clock() + cell.estimate_s <= self.submit, f'{name}: does not fit before the submission bound')
        if cell.captures and self.never_started is None:
            # Every control so far ran with the profiler configured and never started: prove it before the first start.
            self.never_started = {host: self.log_hits(host, PROFILER_STARTED) for host in pf.HOSTS}
            ck.require(not any(self.never_started.values()), 'a profiler started before the profiled cells')
        before = self.stats(f'{name}-stats-before')
        steps = number(pf.worker(self.json(f'{name}-worker-before', 'x86host', 'python3 -c ' + shlex.quote(X86HOST_PROBE)),
                                 self.clock()).get('steps', 0))
        output = self.out / 'cells' / f'{name}.json'
        output.parent.mkdir(exist_ok=True)
        self.call(f'{name}-cell', self.driver(
            'run', '--cell', name, '--cuts', str(self.cuts), '--output', str(output), '--deadline-utc', f'{self.submit:.3f}',
            '--telemetry', *(str(self.out / f'telemetry-{host}.jsonl') for host in pf.HOSTS),
            '--capture-floor-kb', str(CAPTURE_FLOOR_KB), '--cache-salt-prefix', self.tag,
            '--ledger', str(self.out / 'requests-ledger.jsonl')), timeout=3 * cell.estimate_s + 600, inflight=cell.batch)
        result = ck.read(output)
        ck.require(result.get('cell') == name and len(cast(list[Json], result['streams'])) == cell.batch,
                   'cell artifact identity mismatch')
        after = self.stats(f'{name}-stats-after')
        ck.counters(after, 0, before)
        ck.require(number(record(after['counters']).get('rounds_ok', 0)) > number(record(before['counters']).get('rounds_ok', 0)),
                   'no remote drafting during the cell')
        status = pf.worker(self.json(f'{name}-worker-after', 'x86host', 'python3 -c ' + shlex.quote(X86HOST_PROBE)), self.clock())
        ck.require(number(status.get('steps', 0)) > steps, 'x86host worker took no steps during the cell')
        with (self.out / 'proxy-stats.jsonl').open('a') as handle:
            handle.write(json.dumps({'cell': name, 'before': before['counters'], 'after': after['counters']}) + '\n')
        traces = self.collect_traces(name, result) if cell.captures else []
        return {'captures': [{k: c.get(k) for k in ('kind', 'status')} for c in map(record, cast(list[Json], result['captures']))],
                'traces': cast(Json, traces)}

    def collect_traces(self, name: str, result: dict[str, Json]) -> list[dict[str, Json]]:
        started = taken(result)
        rows: list[dict[str, Json]] = []
        for rank, host in enumerate(pf.HOSTS):
            files, free = listing(self.ssh(f'{name}-list-{host}', host, self.find()))
            new = new_traces(files, self.collected[host], rank, len(started), free)
            if not new:
                continue
            local = self.out / 'traces' / name / host
            local.mkdir(parents=True, exist_ok=True)
            names = [n for n, _ in new]
            remote = self.json(f'{name}-hash-{host}', host, f'cd ~/{PROFILE_DIR} && python3 - ' + shlex.join(names),
                               pf.IMAGE_BASES)      # O_DIRECT sha256 on the Spark, no page-cache fill
            for (file, size), capture in zip(new, started):
                self.call(f'{name}-copy-{host}', ['scp', '-q', '-o', 'BatchMode=yes', f'{host}:{PROFILE_DIR}/{file}', str(local)])
                got = pf.digest(local / file)
                ck.require(remote.get(file) == got and (local / file).stat().st_size == size, f'{file[:40]} copy differs')
                rows.append({'cell': name, 'capture': capture['kind'], 'status': capture['status'], 'rank': rank,
                             'host': host, 'file': str((local / file).relative_to(self.out)), 'bytes': size, 'sha256': got})
            # Verified copies only; the directory is user-owned, so the container's root-owned files unlink normally.
            self.ssh(f'{name}-remove-{host}', host, f'cd ~/{PROFILE_DIR} && rm -f -- ' + shlex.join(names))
            self.collected[host].update(names)
        self.manifest.extend(rows)
        (self.out / 'traces-manifest.json').write_text(json.dumps(self.manifest, indent=1) + '\n')
        return rows

    def finish(self) -> dict[str, Json]:
        checks: dict[str, Json] = {}
        for rank, host in enumerate(pf.HOSTS):
            identity = self.ssh(f'final-id-{host}', host, "docker inspect --format '{{.Id}}' dsv41-serve").strip()
            ck.require(identity == self.ids[rank], 'experiment container changed during the window')
            checks[f'logs_rank{rank}'] = pf.logs(self.json(f'final-logs-{host}', host, 'python3 -c ' +
                shlex.quote(pf.LOG_FILTER) + ' ' + shlex.quote(ck.STOP_LOG.pattern)), rank, ARM.cap)
            files, _ = listing(self.ssh(f'final-list-{host}', host, self.find()))
            ck.require(not files, f'{host} profile directory still holds files after collection')
            self.ssh(f'final-rmdir-{host}', host, f'rmdir ~/{PROFILE_DIR}')
            self.created.discard(host)
        pf.worker(self.json('final-worker', 'x86host', 'python3 -c ' + shlex.quote(X86HOST_PROBE)), self.clock())
        checks['never_started_before_profiled_cells'] = cast(Json, self.never_started)
        minima = self.sup.arm_minima
        ck.require(minima is not None and set(minima) == set(pf.HOSTS), 'missing memory minima')
        checks['mem_available_min_kb'] = cast(Json, dict(cast(dict[str, int], minima)))
        return checks

    def restore(self, *, production_stopped: bool) -> dict[str, Json]:
        (self.out / 'arm-memory.json').write_text(json.dumps(self.sup.arm_memory, indent=1) + '\n')
        out = super().restore(production_stopped=production_stopped)
        # Only directories this window created; uncollected traces are evidence and stay for the coordinator.
        for host in sorted(self.created):
            rc, text = self.plain(f'profile-dir-{host}', [*pf.SSH, host, f'rmdir ~/{PROFILE_DIR} 2>/dev/null; '
                                  f'if [ -e ~/{PROFILE_DIR} ]; then echo "LEFT $(ls -1 ~/{PROFILE_DIR} | wc -l) files"; '
                                  'else echo CLEAN; fi'], 60)
            out[f'profile_dir_{host}'] = f'rc{rc}: {text.strip()[-80:]}'
        return out


# ---------------------------------------------------------------- orchestration (shared by SP1Live and fakes)

class Backend(Protocol):
    def preflight(self) -> None: ...
    def open_hold(self) -> float: ...
    def snapshot(self) -> None: ...
    def start_arm(self) -> None: ...
    def build(self) -> dict[str, Json]: ...
    def cell(self, name: str) -> dict[str, Json]: ...
    def finish(self) -> dict[str, Json]: ...
    def restore(self, *, production_stopped: bool) -> dict[str, Json]: ...


def window(b: Backend, checkpoint: Callable[[dict[str, Json]], None]) -> dict[str, Json]:
    """Whatever happens after the HOLD may exist, the W8 restore runs; a failed restore is never hidden."""
    result: dict[str, Json] = {'status': 'INCOMPLETE', 'cells': {}}
    cells = cast(dict[str, Json], result['cells'])
    hold = stopped = False
    try:
        b.preflight()
        hold = True    # from here a HOLD may exist (open can time out after writing it): always restore/close
        result['hold_opened'] = b.open_hold()
        b.snapshot()
        stopped = True    # start_exp.sh stops production before anything else
        b.start_arm()
        result['prompts'] = b.build()
        checkpoint({'prompts': result['prompts']})
        for name in wc.ORDER:
            cells[name] = b.cell(name)
            checkpoint({'cell': name})
        result['finish'] = b.finish()
        result['status'] = 'COMPLETE'
    except (Exception, KeyboardInterrupt) as exc:
        result['stop'] = f'{type(exc).__name__}: {exc}'
    finally:
        # Ignore hangups/interrupts BEFORE the backend closes its supervisor (PF1 S40 FIX 3).
        saved = {sig: signal.signal(sig, signal.SIG_IGN) for sig in (signal.SIGTERM, signal.SIGINT, signal.SIGHUP)}
        try:
            if hold:
                try:
                    result['restore'] = b.restore(production_stopped=stopped)
                except (Exception, KeyboardInterrupt) as exc:
                    result['restore'] = {'status': 'FAILED', 'error': f'{type(exc).__name__}: {exc}'}
            else:
                result['restore'] = {'status': 'NOT NEEDED: no HOLD written, production untouched'}
        finally:
            for sig, handler in saved.items():
                signal.signal(sig, handler)
    return result


# ---------------------------------------------------------------- entry point

def plan() -> str:
    lines = ['DRY RUN: no command, network or file. Coordinator Deepseek/coordinator only (--execute).',
             'Preflight (read-only, production serving): PF1 preflight (restore.sh pin; D2 pause; corpus; production 21bed31/tag,',
             f'  clean, no HOLD; ~/dsv41-deploy-offload = reviewed commit or --stage-bundle; {len(PIN_FILES)} staged pins incl. {CONFIG};',
             '  :8000 K1 327680; x86host TP2 worker fb68c52 read-only probe; nvidia-smi + MemAvailable >= 5 GiB); 1 s telemetry both Sparks;',
             f'  ~/{PROFILE_DIR} absent and >= {PRE_DISK_KB >> 20} GiB free home disk on both Sparks.',
             f'HOLD: window.sh open "SP1-WINDOW <tag>: ..." (drain <= 20 min); deadlines from HOLD: submit +{SUBMIT_S // 60},'
             f' abort +{ABORT_S // 60}, restore by about +{ABORT_S // 60 + 8} min.',
             'Snapshot production both ranks (identity, mounted hashes, env, argv, Engram, 13 pins, image bases) -> rollback.json.',
             'Tunnel 127.0.0.1:18001 -> sparkhead 127.0.0.1:8001 (owned). Guards: MemAvailable >= 4 GiB, swap +256 MiB after ready,',
             '  telemetry liveness, foreign demand on :8001 above owned in-flight requests, STOP file, deadlines.',
             f'{ARM.name}: mkdir ~/{PROFILE_DIR} both nodes; PF1_CAP=327680 PF1_TRACE=0 PF1_EAGER=0 bash offload/launch/start_exp.sh {CONFIG}',
             '  identity == production except port/REQUIRED and exactly one reviewed --profiler-config; KV 2502600; 13-pin verify;',
             f'  {MOUNT} rw bind on both ranks; profile directory empty; API "{PROFILER_ON[:40]}..." logged; profiler never started.',
             'Prompts: window_cells build (7 public prompts, <= 4 /tokenize each; numeric cuts + sha256 only).']
    for name in wc.ORDER:
        cell = wc.CELLS[name]
        what = ('+'.join(cell.captures) + ' capture(s)') if cell.captures else ('discarded' if cell.warmup else 'never-started control')
        lines.append(f'  {name}: {cell.batch} x {"/".join(cell.prompts)}, {cell.max_tokens} output; {what}; '
                     'proxy/spec/worker counters before+after')
        if cell.captures:
            lines.append(f'    capture floor MemAvailable >= {CAPTURE_FLOOR_KB / 2**20:.1f} GiB else SKIPPED_MEMORY; per node: one new rank file'
                         f' per capture <= {FILE_CAP >> 20} MiB, dir <= {DIR_CAP >> 20} MiB, free disk >= {DISK_FLOOR_KB >> 20} GiB;'
                         ' copy + O_DIRECT sha256 both sides; remove verified Spark copies')
    lines += ['Finish: containers unchanged, clean logs both ranks, worker probe, profile directories empty and removed.',
              'ALWAYS (success or any STOP): close owned processes, then bash ' + str(pf.RESTORE) + ' start (if production stopped),',
              '  check, close; require K1 START VERIFIED, six "greedy K1-post vs restored: i IDENTICAL n", PRODUCTION HOLD OK,',
              '  CHECK: DONE, CLOSE: window closed. Then remove only the empty profile directories this window created.',
              'Analysis afterwards (Controller, CPU): python3 -m offload.gb10_budget.trace_budget --window <out> (PROFILE-WINDOW.md).',
              'ESTIMATED: ~28 min HOLD, production down ~27.6 min (offload/gb10_budget/PROFILE-WINDOW-DESIGN.md).']
    return '\n'.join(lines)


def main(argv: list[str] | None = None) -> int:
    ap = argparse.ArgumentParser(description=__doc__)
    mode = ap.add_mutually_exclusive_group()
    mode.add_argument('--execute', action='store_true')
    mode.add_argument('--dry-run', action='store_true')
    ap.add_argument('--out', type=Path)
    ap.add_argument('--remote-repo', default='dsv41-deploy-offload')
    ap.add_argument('--expected-experiment-commit', default='')
    ap.add_argument('--stage-bundle', action='store_true', help='bundle-stage the reviewed commit if the remote checkout differs')
    ap.add_argument('--data-dir', type=Path, default=Path('/opt/dsv41/data/bench-data'))
    args = ap.parse_args(argv)
    if not args.execute:
        print(plan())
        return 0
    try:
        ck.require(os.environ.get('WINDOW_COORDINATOR') == 'Deepseek/coordinator', 'WINDOW_COORDINATOR=Deepseek/coordinator required')
        ck.require(args.out is not None and args.out.resolve().parent == pf.CAMPAIGN and not args.out.exists(),
                   'fresh --out directly inside the campaign directory required')
        ck.require(re.fullmatch('[0-9a-f]{40}', args.expected_experiment_commit) is not None, 'full reviewed commit required')
        ck.require(re.fullmatch('[A-Za-z0-9_.-]+', args.remote_repo) is not None and args.remote_repo != 'dsv41-deploy',
                   'experiment checkout must be a separate relative checkout, never ~/dsv41-deploy')
        local = subprocess.check_output(['git', 'rev-parse', 'HEAD'], cwd=pf.ROOT, text=True).strip()
        ck.require(local == args.expected_experiment_commit, 'local checkout is not the reviewed commit')
        ck.require(not subprocess.check_output(['git', 'status', '--porcelain', '--untracked-files=no'], cwd=pf.ROOT,
                                               text=True).strip(), 'local tracked source is dirty')
    except (ValueError, OSError, subprocess.CalledProcessError) as exc:
        print(f'STOP before any remote action: {exc}', file=sys.stderr)
        return 1
    out = cast(Path, args.out)
    out.mkdir()
    tag = re.sub('[^A-Za-z0-9_-]', '-', out.name)

    def interrupted(signum: int, _frame: object) -> None:
        raise KeyboardInterrupt(f'signal {signum}')
    for sig in (signal.SIGTERM, signal.SIGINT, signal.SIGHUP):
        signal.signal(sig, interrupted)

    def checkpoint(data: dict[str, Json]) -> None:
        with (out / 'checkpoints.jsonl').open('a') as handle:
            handle.write(json.dumps({'time': time.time(), **data}, allow_nan=False) + '\n')
    sup = pf.Supervisor(out)
    live = SP1Live(out, sup, remote=args.remote_repo, expected=args.expected_experiment_commit, data_dir=args.data_dir,
                   tag=tag, stage_bundle=args.stage_bundle)
    result = window(live, checkpoint)
    sup.close()
    result.update({'experiment_commit': args.expected_experiment_commit, 'config_sha256': pf.digest(pf.ROOT / CONFIG),
                   'profiler_config': PROFILER_JSON, 'restore_sha256': pf.RESTORE_SHA256, 'worker_source': pf.WORKER,
                   'artifact_sha256': {str(p.relative_to(out)): pf.digest(p) for p in sorted(out.rglob('*.json*'))
                                       if p.is_file() and not p.name.startswith('telemetry-')}})
    (out / 'summary.json').write_text(json.dumps(result, indent=1, allow_nan=False) + '\n')
    restore = record(result['restore'])
    print(json.dumps({'status': result['status'], 'stop': result.get('stop'), 'restore': restore.get('status')}))
    if str(restore.get('status', '')).startswith(('RESTORED', 'NOT NEEDED')):
        return 0 if 'stop' not in result else 1
    print('PRODUCTION NOT VERIFIED; HOLD left open. Coordinator: inspect cmd/restore-*.log, then run\n'
          + '\n'.join(f'  bash {pf.RESTORE} {s}' for s in ('start', 'check', 'close')), file=sys.stderr)
    return 2


if __name__ == '__main__':
    raise SystemExit(main())