[oliverlavery]

Problem

On 2.12.2, a QSA resize that would reduce row count below rows owned by a held bank entry raises ValueError: QSA {name} hold {N} rows; resizing to {M} would cut them (one_copy.py _resized_buffers). The raise escapes through the admission path: generation.py prices the fixed-M4 bank via resize_bill() unguarded, so the ValueError surfaces as a server_error and the request dies with 0 tokens.

Repro (Flash-Next MTPLX build, 262k ctx): serve, run a ~50k-token session, then send a short prompt from a new session — fails with the hold-cut error until the engine restarts. Every differently-shaped new session fails, so one long session poisons the lane. Hit in production via OpenClaw subagent spawning (3 consecutive failures, 0 tokens each).

Fix

_layer_bytes() returns None for the hold-cut case instead of raising; resize_bill() propagates None so admission selects the copy path — the same fallback its docstring already promises for promoted banks and missing buffers. _pending_layers() skips the unresizable layer so the execution path skips it too. The fixed-M4 resize caller additionally degrades to the eager verifier if a hold-cut ValueError still surfaces (admission/execution race).

Validation

• All 63 tests in test_one_copy_admission.py, test_one_copy_conversation.py, test_one_copy_cancelled_answer.py, test_demotions_qsa_prefill_sites.py, test_memguard_dense_qsa.py pass.
• End-to-end: big session → immediate new-session spawn → served (previously server_error). Sustained mixed-shape traffic clean.

[jerryjvl]

Hi @oliverlavery, I'm hitting this on 2.12.2 too (Flash-Next, M5 Ultra). I see the fix was reverted on 14 Oct (78ebeb2). Could you say why? I suspect the copy fallback: at 128k+ tokens it prices a multi-GB padded bank, which can evict idle sessions or force eager verify.

The problem seems to be a stale pooled_len, not real data. pooled_len is written before attention advances kv.offset, so it can be left ahead of it. Every other reader clamps it to offset // ratio, but _resized_buffers uses the raw value. In my failures the keys check passed (offset <= rows), yet pooled claimed 42,593 blocks against a 32,768 target, so those extra blocks can't be valid.

A narrower fix: clamp it, and store the clamp. Against 2.12.2:

--- a/mtplx/one_copy.py
+++ b/mtplx/one_copy.py
@@ -194,6 +194,13 @@ def _resizable(cache: Any) -> list[Any] | None:
     return entries

 
+def _valid_pooled_len(entry: Any) -> int:
+    """Pooled blocks ``entry`` really holds: ``pooled_len`` up to the frontier."""
+
+    return min(int(entry.pooled_len), int(entry.kv.offset) // max(1, int(entry.ratio)))
+
+
 def _resized_buffers(entry: Any, rows: int) -> list[tuple[str, Any, int, int]]:
     """(name, buffer, row axis, rows) for each buffer of ``entry`` not at the bank's rows.
 
@@ -208,7 +215,7 @@ def _resized_buffers(entry: Any, rows: int) -> list[tuple[str, Any, int, int]]:
         ("keys", entry.kv.keys, 2, rows, offset),
         ("values", entry.kv.values, 2, rows, offset),
         ("raw_keys", entry.raw_keys, 1, rows, offset),
-        ("pooled", entry.pooled, 1, rows // max(1, int(entry.ratio)), int(entry.pooled_len)),
+        ("pooled", entry.pooled, 1, rows // max(1, int(entry.ratio)), _valid_pooled_len(entry)),
     )
     resized = []
     for name, buffer, axis, target, held in wanted:
@@ -262,6 +269,9 @@ def _resize_layer(entry: Any, rows: int) -> None:
         entry.raw_keys = resized["raw_keys"]
     if "pooled" in resized:
         entry.pooled = resized["pooled"]
+        # Blocks past the frontier went with the cut; say so, as
+        # ``QSACache.trim`` does (restore staging reads it unclamped).
+        entry.pooled_len = _valid_pooled_len(entry)
         # Derived from ``pooled``; rebuilt on the next stock read.
         entry.pooled_f32_t = None

The second change matters: without it, qsa_restore_staging (which reads pooled_len unclamped) raises later.

The in-place resize then goes ahead with no copy. This matches what the bank's own copy promotion already does: from_qsa_cache cuts pooled to capacity // ratio without reading pooled_len. In a test with the real QSACache, the stale case resizes with the valid blocks unchanged, and a genuine cut still raises. I'm running it locally now.