refactor: drop the unread transfer_limits field from the handshake ack

The interface reads a member's cap from transfer_state and never read the
copy on the ack. The transfer probe reads it from transfer_state too.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 5 insertions, 6 deletions

diff --git a/docs/MESHBAY_NODE_PROTOCOL.md b/docs/MESHBAY_NODE_PROTOCOL.md
index 0886a7e..2e314f2 100644
--- a/docs/MESHBAY_NODE_PROTOCOL.md
+++ b/docs/MESHBAY_NODE_PROTOCOL.md
@@ -579,7 +579,6 @@ at all — including a decryption.
 | `chat_link_preview` | whether the node unfurls links posted here. Absent means on |
 | `search_listed` | whether the reader's cross-group Search lists this group. Presentation only — the index is served identically either way. Absent means listed |
 | `chat_epoch` | the chat epoch a client must seal under right now (§11.7). There is no `chat_encrypted` beside it, because there is no switch |
-| `transfer_limits` | `{download, upload}` — this member's own caps in this group, so the interface can say "2 of your 2 slots are busy" instead of drawing a bare spinner. Absent reads as "no limit known" and the hint is not drawn; never as "unlimited", which would have the interface contradicting the node (§11.2) |
 | `tmdb_enabled`, `musicbrainz_enabled` | per-group metadata lookups |
 | `tmdb_token_customized`, `tmdb_language` | node-wide TMDB config; the token itself is never sent |
 | `indexing` | the `index_progress` counters (§11.1) so a client connecting mid-scan shows progress immediately. Never a path, a filename or a root name |
@@ -1412,8 +1411,8 @@ an absent setting as no limit would leave the node-wide cap as the only control,
 is the situation leases exist to end. The per-group value is a signed operator
 operation (`transfer_limits`, §10.4, bounded to 1–32; zero is refused, because a member
 who may not transfer at all is a member the operator revokes). The node-wide values are
-daemon settings. A member's own caps ride on the handshake ack so the interface can say
-"2 of your 2 slots are busy" rather than draw a spinner that explains nothing.
+daemon settings. A member's own cap rides on every `transfer_state`, so the interface can
+say "2 of your 2 slots are busy" rather than draw a spinner that explains nothing.
 
 **Queueing.** One FIFO per kind. `_pump` walks it in arrival order and **skips** a
 member who is at their own cap rather than stopping at them — granting strictly in
@@ -1422,9 +1421,9 @@ told how many are `ahead` of it. Beyond 32 queued per member the answer is
 `too_many_queued`, because an unbounded queue is how a node runs out of memory politely.
 
 `used` and `cap` on `transfer_state` are this member's own count and this member's own
-limit **in this group** — the same value `_has_room` enforces and the same one the
-handshake ack announces. Three readings of one number, and an interface that draws a
-different one from the node's is an interface that offers a slot the node will queue.
+limit **in this group** — the same value `_has_room` enforces. The interface reads it
+from here and from nowhere else: one number with two sources is an interface that can
+offer a slot the node will queue.
 
 **Reclaim.** The session teardown is the primary path and it is immediate. A sweeper
 runs every 15 s for whatever the teardown cannot see, and tells two failures apart: