[arjunnai]

Large tensors cross the server/worker boundary by pickling through the worker's control socket, including on cache hits. This passes blobs of at least 1 MiB, both inputs and results, as sealed memfds over the same socket instead. The receiver checks the seals and exact size and maps them read-only. Small blobs, non-Linux hosts and Python builds without memfd_create (a libc fallback covers standalone builds) keep the current path. Two follow-ups reuse sealed buffers from the input cache and hash immutable upload snapshots in parallel.

Vector add, 64 MiB tensors, median of 30 trials in balanced order, sandbox off (RTX 5090 / RTX 2070):

cell	main	this PR
reused worker	997 / 982 ms	643 / 657 ms (−36% / −33%)
fresh worker	1335 / 1310 ms	940 / 940 ms (−30% / −28%)

4 MiB reused drops 28% / 17%. 4 KiB requests do not use the new path and are unchanged. Measured with the overhead harness from #127 on bare metal.

Testing:

• Full test suite on main and this branch (RTX 5090 + RTX 2070): no new failures. New tests cover the fallback, descriptor cleanup after crashes and timeouts, rejected handles, and oversized results.
• Real-kernel run with bubblewrap: transfers work inside the sandbox and the parent's descriptor count is unchanged.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.