Ship model updates to 10,000 edge hosts without melting anything.
Classical binary diff tools build a suffix array over the entire base file. Memory use scales at roughly 5× filesize.
A 20 GB fine-tuned transformer. An 8 GB Jetson Orin Nano. Do the math: 100 GB of RAM to apply a patch that moves a few million weights.
The field solution today is ship the whole model, every time. That's gigabytes of cellular uplink per robot, per update. We can do better.
Data flows through bounded buffers. Nothing in the hot path allocates unbounded structures.
FastCDC picks chunk boundaries based on rolling-hash fingerprints, not fixed offsets. A perturbation near the front of the file only disturbs nearby chunks — downstream chunks keep the same digests and are emitted as zero-cost COPY instructions.
The applier never comprehends the file as a whole — it just loops over COPY and LITERAL ops, streaming the reconstructed bytes through a BLAKE3 hasher. At EOF, if the digest doesn't match the header, the applier refuses the output.
The control plane unicasts an Announce. Agents race to Bid. First bid wins via atomic CAS. The winner downloads once, then re-seeds every other agent. The control plane uplink stays cool.
Each message fits in a single 1500-byte UDP datagram. Crash an agent and it rejoins the next round — the ManifestId tags every message to the election it belongs to.
Flat resident memory on any file size. Your edge system doesn't care if the model is 2 GB or 200.
Edits don't cascade. One-byte perturbation ≠ whole-file re-upload.
Streaming hash over reconstructed bytes. Mismatch → refuse. No corrupt weights.
First bid wins. Atomic CAS on the control plane. Stateless agent recovery.
No custom crypto. No NAT traversal code. The overlay already solved both.
No Quinn. No rustls. No iroh-blobs. Boring TCP + hash verification.
Ship a fine-tuned YOLO update to 500 live systems in the field. Leader pulls once at 4G uplink speed; followers pull from the leader over local Tailscale. Control plane uplink stays cool.
A deploy turns sour. Revert is just another patch — from v2 weights back to v1 weights, most chunks identical, delta under a megabyte. Deployed fleet-wide in under five minutes.
One leader per regional Tailscale subnet. Control plane sends N announcements, each region elects locally, each region cascades internally. No cross-region traffic duplication.
/// Download a blob from `server`, verifying BLAKE3 streaming.
/// Memory cost: 1 MiB BufWriter + 64 KiB scratch + hasher state.
pub async fn download(
server: SocketAddr,
expected_hash: [u8; 32],
out: &Path,
) -> Result<u64> {
let mut stream = TcpStream::connect(server).await?;
stream.write_all(&expected_hash).await?;
// status + length header
let mut status = [0u8; 1];
stream.read_exact(&mut status).await?;
if status[0] != STATUS_OK { bail!("peer lacks blob"); }
let mut len_buf = [0u8; 8];
stream.read_exact(&mut len_buf).await?;
let total = u64::from_le_bytes(len_buf);
// stream socket → disk, hashing as we go
let file = File::create(out).await?;
let mut writer = BufWriter::with_capacity(1<<20, file);
let mut hasher = blake3::Hasher::new();
let mut buf = vec![0u8; 64 * 1024];
let mut remaining = total;
while remaining > 0 {
let take = remaining.min(buf.len() as u64) as usize;
stream.read_exact(&mut buf[..take]).await?;
writer.write_all(&buf[..take]).await?;
hasher.update(&buf[..take]);
remaining -= take as u64;
}
writer.flush().await?;
// verify or refuse
let digest = *hasher.finalize().as_bytes();
if digest != expected_hash {
bail!("BLAKE3 mismatch after download");
}
Ok(total)
}/// Every UDP datagram on the control socket carries one of these.
/// All fit in a single 1500-byte datagram via bincode.
pub enum Msg {
/// control plane → every agent
Announce {
manifest_id: ManifestId,
version: String,
patch_blake3: [u8; 32],
controlplane_p2p_addr: Option<SocketAddr>,
},
/// agent → control plane (race!)
Bid { manifest_id: ManifestId, node_id: String },
/// control plane → winning agent
LeaderAck { manifest_id: ManifestId },
/// leader → control plane (ready to serve followers)
LeaderReady {
manifest_id: ManifestId,
leader_p2p_port: u16,
},
/// control plane → every agent (the pivot signal)
ElectionClosed {
manifest_id: ManifestId,
leader_node_id: String,
leader_tailscale_ip: IpAddr,
leader_p2p_port: u16,
},
}//! Wire format
//!
//! ┌──────────── header (54 bytes) ────────────┐
//! │ magic "POOL" (4) │
//! │ version u16 (2) │
//! │ base_size u64 (8) │
//! │ target_size u64(8) │
//! │ target_blake3 [u8; 32] (32) │
//! ├──────────── instruction body ─────────────┤
//! │ 0x01 COPY : op(1) offset(8) len(8) │
//! │ 0x02 LITERAL : op(1) len(8) bytes[len] │
//! └───────────────────────────────────────────┘
pub const MAGIC: &[u8; 4] = b"POOL";
pub const VERSION: u16 = 1;
pub const MIN_CHUNK: u32 = 256 * 1024; // 256 KiB
pub const AVG_CHUNK: u32 = 1024 * 1024; // 1 MiB
pub const MAX_CHUNK: u32 = 4 * 1024 * 1024; // 4 MiB