@@ -218,13 +218,20 @@ gpulab serverless list --volume my-volume
 ### Syncing a directory to a volume
 
 ```bash
-# rsync-style: uploads only new/changed files, previews the diff, and warns how
-# many endpoints/replicas use the volume (they keep old code until restarted).
+# rsync-style: uploads only new/changed files (compared by content hash, so
+# equal-length edits are caught), hash-verifies each upload, previews the diff,
+# and warns how many endpoints/replicas use the volume (they keep old code until
+# restarted).
 gpulab volumes sync ./server my-volume server --dry-run   # preview only
 gpulab volumes sync ./server my-volume server             # upload changes
+gpulab volumes sync ./server my-volume server --size-only # faster, size-only compare
 gpulab volumes files upload my-volume ./local.py --to server/tasks.py  # single file, renamed
 ```
 
+> `volumes sync --delete` refuses to run against an empty local dir (would wipe
+> the volume) unless you pass `--allow-empty`, and `--json`/non-interactive runs
+> won't mutate the volume without `--yes`.
+
 ## Templates (Docker images)
 
 Create and manage reusable container templates. Only `--name` and `--image` are
 
@@ -3,6 +3,7 @@ package api
 import (
 	"bytes"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -157,10 +158,61 @@ func (c *Client) doRaw(method, path, contentType string, body io.Reader) ([]byte
 	return respBody, nil
 }
 
+// GetStream issues a GET and returns the raw response for streaming (the caller
+// must close the body). Non-2xx responses are turned into an *APIError with the
+// body read, so large downloads are never buffered on the success path.
+func (c *Client) GetStream(path string) (*http.Response, error) {
+	req, err := http.NewRequest("GET", c.BaseURL+path, nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)
+	}
+	req.Header.Set("api-key", c.APIKey)
+	req.Header.Set("Accept", "application/octet-stream")
+
+	if c.Debug {
+		fmt.Fprintf(os.Stderr, "[DEBUG] GET %s (stream)\n", c.BaseURL+path)
+	}
+
+	resp, err := c.HTTPClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	if resp.StatusCode >= 400 {
+		body, _ := io.ReadAll(resp.Body)
+		resp.Body.Close()
+		var errResp struct {
+			Message string `json:"message"`
+			Error   string `json:"error"`
+		}
+		json.Unmarshal(body, &errResp)
+		message := errResp.Message
+		if message == "" {
+			message = errResp.Error
+		}
+		return nil, &APIError{StatusCode: resp.StatusCode, Message: message, Body: string(body)}
+	}
+	return resp, nil
+}
+
+// PostStream posts a streaming body (e.g. a multipart upload built lazily) and
+// reads the (small) response fully.
+func (c *Client) PostStream(path, contentType string, body io.Reader) ([]byte, error) {
+	return c.doRaw("POST", path, contentType, body)
+}
+
 func (c *Client) Get(path string) ([]byte, error) {
 	return c.do("GET", path, nil)
 }
 
+// IsNotFound reports whether err is an API 404.
+func IsNotFound(err error) bool {
+	var apiErr *APIError
+	if errors.As(err, &apiErr) {
+		return apiErr.StatusCode == 404
+	}
+	return false
+}
+
 func (c *Client) Post(path string, body interface{}) ([]byte, error) {
 	return c.do("POST", path, body)
 }
 
@@ -1,7 +1,8 @@
 package api
 
 import (
-	"bytes"
+	"crypto/sha256"
+	"encoding/hex"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -148,47 +149,74 @@ type UploadItem struct {
 // stored flat under destDir using its DestName (or basename). To place a file at
 // an arbitrary path, set destDir to the target directory and DestName to the
 // target filename.
+//
+// The multipart body is streamed through an io.Pipe so multi-GB files are never
+// buffered fully in memory.
 func (c *Client) UploadVolumeFiles(volumeUUID, destDir string, items []UploadItem) ([]byte, error) {
-	var buf bytes.Buffer
-	writer := multipart.NewWriter(&buf)
-
-	if err := writer.WriteField("path", destDir); err != nil {
-		return nil, err
-	}
-
-	for _, item := range items {
-		file, err := os.Open(item.LocalPath)
+	pr, pw := io.Pipe()
+	writer := multipart.NewWriter(pw)
+
+	go func() {
+		// Any error here is surfaced on the read side via CloseWithError, which
+		// makes the HTTP request fail with the same error.
+		err := func() error {
+			if err := writer.WriteField("path", destDir); err != nil {
+				return err
+			}
+			for _, item := range items {
+				file, err := os.Open(item.LocalPath)
+				if err != nil {
+					return fmt.Errorf("failed to open %s: %w", item.LocalPath, err)
+				}
+				name := item.DestName
+				if name == "" {
+					name = filepath.Base(item.LocalPath)
+				}
+				part, err := writer.CreateFormFile("files[]", name)
+				if err != nil {
+					file.Close()
+					return err
+				}
+				if _, err := io.Copy(part, file); err != nil {
+					file.Close()
+					return err
+				}
+				file.Close()
+				// Flat upload: system-server stores each by its multipart filename.
+				if err := writer.WriteField("relative_paths[]", ""); err != nil {
+					return err
+				}
+			}
+			return writer.Close()
+		}()
 		if err != nil {
-			return nil, fmt.Errorf("failed to open %s: %w", item.LocalPath, err)
+			pw.CloseWithError(err)
+			return
 		}
+		pw.Close()
+	}()
 
-		name := item.DestName
-		if name == "" {
-			name = filepath.Base(item.LocalPath)
-		}
-		part, err := writer.CreateFormFile("files[]", name)
-		if err != nil {
-			file.Close()
-			return nil, err
-		}
-		if _, err := io.Copy(part, file); err != nil {
-			file.Close()
-			return nil, err
-		}
-		file.Close()
+	return c.PostStream(c.volumeFilesPath(volumeUUID, "/upload"), writer.FormDataContentType(), pr)
+}
 
-		// Flat upload: keep files at the destination root (system-server stores
-		// each by its multipart filename).
-		if err := writer.WriteField("relative_paths[]", ""); err != nil {
-			return nil, err
+// HashVolumeFile streams a file from the volume and returns its sha256 and size
+// without buffering it in memory. found=false (nil error) for a missing file.
+func (c *Client) HashVolumeFile(volumeUUID, path string) (sum string, size int64, found bool, err error) {
+	resp, err := c.GetStream(c.volumeFilesPath(volumeUUID, "/download") + "?path=" + url.QueryEscape(path))
+	if err != nil {
+		if IsNotFound(err) {
+			return "", 0, false, nil
 		}
+		return "", 0, false, err
 	}
+	defer resp.Body.Close()
 
-	if err := writer.Close(); err != nil {
-		return nil, err
+	h := sha256.New()
+	n, err := io.Copy(h, resp.Body)
+	if err != nil {
+		return "", 0, false, err
 	}
-
-	return c.doRaw("POST", c.volumeFilesPath(volumeUUID, "/upload"), writer.FormDataContentType(), &buf)
+	return hex.EncodeToString(h.Sum(nil)), n, true, nil
 }
 
 // UploadLocalFiles is a convenience wrapper for uploading files by path using
 
@@ -0,0 +1,49 @@
+package commands
+
+import (
+	"testing"
+
+	"github.com/GPULab-AI/gpulab-cli/internal/api"
+)
+
+func TestDetectLogIssues_LineCountingAndAttributeError(t *testing.T) {
+	logs := "" +
+		"AttributeError: 'NoneType' object has no attribute 'size'\n" +
+		"AttributeError: 'NoneType' object has no attribute 'size'\n" +
+		"all good\n"
+	issues := detectLogIssues(logs)
+
+	byCat := map[string]int{}
+	for _, iss := range issues {
+		byCat[iss.Category] = iss.Count
+	}
+	// The exact incident crash must be caught.
+	if byCat["attribute-error"] != 2 {
+		t.Fatalf("attribute-error count = %d, want 2", byCat["attribute-error"])
+	}
+	// Two overlapping patterns on the same line (NoneType twice) must count the
+	// line once per category, not ×N.
+	if byCat["nonetype"] != 2 {
+		t.Fatalf("nonetype count = %d, want 2 (one per matching line)", byCat["nonetype"])
+	}
+}
+
+func TestComputeRequestStats_ErrorRateNeverExceeds100(t *testing.T) {
+	code := func(c int) *int { return &c }
+	msg := "boom"
+	reqs := []api.ServerlessRequestLog{
+		// A 5xx that is also an error status + error message — must count once.
+		{Status: "error", ResponseStatusCode: code(500), ErrorMessage: msg},
+		{Status: "completed", ResponseStatusCode: code(200)},
+	}
+	s := computeRequestStats(reqs)
+	if s.Errors != 1 {
+		t.Fatalf("deduped Errors = %d, want 1", s.Errors)
+	}
+	if s.ErrorRate != 50 {
+		t.Fatalf("ErrorRate = %v, want 50", s.ErrorRate)
+	}
+	if s.ErrorRate > 100 {
+		t.Fatalf("ErrorRate exceeds 100: %v", s.ErrorRate)
+	}
+}
@@ -0,0 +1,83 @@
+package commands
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"io"
+	"os"
+
+	"github.com/GPULab-AI/gpulab-cli/internal/api"
+)
+
+// localFileDigest streams a local file and returns its sha256 hex digest and size
+// without buffering it in memory.
+func localFileDigest(path string) (string, int64, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return "", 0, err
+	}
+	defer f.Close()
+	h := sha256.New()
+	n, err := io.Copy(h, f)
+	if err != nil {
+		return "", 0, err
+	}
+	return hex.EncodeToString(h.Sum(nil)), n, nil
+}
+
+// remoteDiffersFromLocal decides whether localPath needs to be uploaded to
+// remotePath given the already-known remote size. It short-circuits on size
+// (different size ⇒ changed) and only content-hashes when the sizes match — the
+// exact case a size-only diff gets wrong (an equal-length edit). With sizeOnly
+// it trusts size alone.
+//
+// remoteExists=false means the file isn't on the volume yet (always "new").
+func remoteDiffersFromLocal(client *api.Client, uuid, remotePath, localPath string, localSize, remoteSize int64, remoteExists, sizeOnly bool) (changed bool, reason string, err error) {
+	if !remoteExists {
+		return true, "new", nil
+	}
+	if remoteSize != localSize {
+		return true, "size", nil
+	}
+	if sizeOnly {
+		return false, "", nil
+	}
+	// Same size — the dangerous case. Content-hash both sides.
+	localSum, _, err := localFileDigest(localPath)
+	if err != nil {
+		return false, "", err
+	}
+	remoteSum, _, found, err := client.HashVolumeFile(uuid, remotePath)
+	if err != nil {
+		return false, "", fmt.Errorf("hashing remote %s: %w", remotePath, err)
+	}
+	if !found {
+		return true, "new", nil
+	}
+	if remoteSum != localSum {
+		return true, "content", nil
+	}
+	return false, "", nil
+}
+
+// verifyReadback confirms the file uploaded to remotePath is byte-identical to
+// localPath by comparing sha256 digests, streaming both sides (no full-file
+// buffering, so it is safe for multi-GB files).
+func verifyReadback(client *api.Client, uuid, remotePath, localPath string) error {
+	localSum, _, err := localFileDigest(localPath)
+	if err != nil {
+		return err
+	}
+	remoteSum, _, found, err := client.HashVolumeFile(uuid, remotePath)
+	if err != nil {
+		return fmt.Errorf("verify: cannot read back %s: %w", remotePath, err)
+	}
+	if !found {
+		return fmt.Errorf("verify: %s is missing after upload", remotePath)
+	}
+	if remoteSum != localSum {
+		return fmt.Errorf("verify FAILED for %s: readback differs from local (upload corrupted)", remotePath)
+	}
+	return nil
+}
@@ -20,6 +20,9 @@ var logIssuePatterns = []logIssuePattern{
 	{"OutOfMemoryError", "cuda-oom"},
 	{"CUDA error: out of memory", "cuda-oom"},
 	{"torch.cuda.OutOfMemoryError", "cuda-oom"},
+	{"device-side assert", "cuda-assert"},
+	{"CUDA error", "cuda-error"},
+	{"illegal memory access", "cuda-error"},
 	{"OOMKilled", "oom-killed"},
 	{"Segmentation fault", "segfault"},
 	{"core dumped", "segfault"},
@@ -28,8 +31,12 @@ var logIssuePatterns = []logIssuePattern{
 	{"Address already in use", "port-conflict"},
 	{"Connection refused", "connection-refused"},
 	{"RuntimeError", "runtime-error"},
-	{"AssertionError", "assertion-error"},
+	{"AttributeError", "attribute-error"},
+	{"ValueError", "value-error"},
+	{"TypeError", "type-error"},
+	{"IndexError", "index-error"},
 	{"KeyError", "key-error"},
+	{"AssertionError", "assertion-error"},
 }
 
 // logIssue summarizes one detected problem category in a log blob.
@@ -49,12 +56,18 @@ func detectLogIssues(logs string) []logIssue {
 	counts := map[string]int{}
 	samples := map[string]string{}
 	for _, line := range strings.Split(logs, "\n") {
+		// Count each matching LINE once per category — overlapping patterns in
+		// the same category (e.g. NoneType) must not inflate the count ×N.
+		seen := map[string]bool{}
 		for _, p := range logIssuePatterns {
 			if strings.Contains(line, p.needle) {
-				counts[p.category]++
-				if samples[p.category] == "" {
-					samples[p.category] = strings.TrimSpace(line)
-				}
+				seen[p.category] = true
+			}
+		}
+		for cat := range seen {
+			counts[cat]++
+			if samples[cat] == "" {
+				samples[cat] = strings.TrimSpace(line)
 			}
 		}
 	}