Bound the full loading path before reserving a device

Bound downloaded bytes, elapsed transfer time, redirects or source selection, and the number of files before parsing a package. If a surrounding archive or transport encoding can expand, cap cumulative expanded bytes and member count as work proceeds rather than trusting a declared length. Path and extraction policy are separate from the tensor parser. Safetensors itself is a tensor layout, so do not attribute a generic archive decompression behavior to it; the enclosing ingestion pipeline may introduce that layer.

Validate metadata counts, tensor dimensions, dtypes, offsets, and total approved storage using checked arithmetic before allocation wherever the pinned API permits. Safetensors v0.5.3 has implementation checks and a header-size bound, but a service can need stricter workload-specific budgets. PyTorch preserves some storage/view relationships, so summing logical tensor elements does not universally equal serialized storage or peak resident memory. Track actual unique storage and required conversion copies under the selected format and loader path.

Distinguish disk payload, mapped virtual address space, resident host memory, and device allocation. Lazy mapping can defer page access without making those bytes disappear. A conversion can hold source and destination dtypes simultaneously, and framework initialization can allocate buffers not present in the weight file. PyTorch 2.9 documents map_location behavior, including CPU placement to avoid an immediate GPU-memory surge, but moving the completed model later still requires device capacity. Define and test a peak bound for the actual path.

Concurrent loading needs a shared atomic reservation; two workers independently observing the same free space can both decide to proceed. Reserve the appropriate resource vector and a loading slot, then release it only after the relevant allocations and subprocess work are gone. Cancellation and failed parsing must close files and remove temporary state under the actual lifecycle. Keep capacity headroom for serving and recovery rather than letting an authorized model upload monopolize the entire host.

Build bounded synthetic fixtures around the permitted maximum file count, dimension product, expanded size, and temporary-copy demand. A rejection should occur before the expensive allocation it is intended to prevent, with a stable reason and no stale reservation. Test two simultaneous near-limit loads and a cancellation during conversion. A timeout response alone does not establish that the loader stopped or released memory; verify worker and device state and isolate any path whose work cannot be interrupted safely.

The function lab isolates one tensor-shape growth term. Reset and set both a=1,x=1, predict y=1, then Play or Step. Reset and set both a=1,x=2 for y=4. Interpret x as a normalized side length of a square dense tensor, holding element width fixed. The model computes ax², not archive expansion, memory mapping, dtype copies, tensor sharing, operating-system enforcement, or concurrent reservations. Its quadratic arithmetic helps check a proposed count but cannot establish a real loader peak.