Merge branch 'fix/large-download-paths'

Concurrent-transfer limits, with the queue, the pause and the flag day.

A node now caps how many transfers it runs at once (8 downloads, 8 uploads,
node-wide) and how many one member may run in one group (2 by default,
operator-signed). Beyond that the node answers "queued" and the client waits its
turn, visibly, in the transfers panel — and a slot that frees starts whatever is
next, skipping past a member who is at their own cap rather than letting them
stall everyone behind them.

Browsing is never subject to a slot: not the poster grid, not the covers, not
opening a photo to look at it. That is structural — a transfer is what the
transfers widget shows — and the exemption is bounded rather than open, at two
files in flight per session, because an exemption with no bound is a leaseless
branch under another name.

Transfers can be cancelled, and now paused and resumed. A paused one holds
nothing: its slot goes back at once and resuming rejoins the queue at the tail.
Uploads survive the connection that started them and resume where the node
stopped, asked for inside the seal rather than on a clear message. What they
leave behind when they are abandoned is reaped, which closes a disk leak that
predates this work.

MNP 3.0 makes the lease compulsory and refuses 2.x at the handshake, with the
desktop client checking `client.minimum` before connecting so an un-updated one
says "update" instead of failing every connection in a protocol vocabulary.

Fourteen defects were found on the way, eight of them by a person clicking
Download and pasting a console — none of which 2075 tests could reach. Section
12 of ~/next/improve-downloads.md is that report, including the three this work
introduced itself and the one that turned out to be caused by an instruction to
hard-reload after each deployment.

Node suite 1209 passed, hub suite 866 passed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HCGdheDLxGReuKHga3BtST

1 files changed, 70 insertions, 2 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/sw.js b/packages/meshbay-hub/src/meshbay_hub/static/sw.js
index 119687d..5f663f9 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/sw.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/sw.js
@@ -17,6 +17,35 @@
  */
 
 const PREFIX = '/_mbdl/';
+
+/**
+ * A filename, safe to put in Content-Disposition.
+ *
+ * `encodeURIComponent` alone is not enough, and the way it fails is invisible
+ * until somebody downloads the wrong film: it leaves `'` untouched, and `'` is
+ * the *delimiter* in RFC 5987's `filename*=<charset>'<lang>'<value>`. A single
+ * apostrophe in a name therefore makes the header unparseable, and a browser
+ * that cannot parse it falls back to the last segment of the URL — which here
+ * is the made-up id this worker answers on. The file arrives complete, 449 MB
+ * of it, called "mtsshk9w-ohqty535".
+ *
+ * Found by downloading three files where exactly one had an apostrophe in its
+ * name. `(`, `)` and `*` are excluded from RFC 5987's attr-char for the same
+ * reason and get the same treatment.
+ *
+ * The plain `filename=` beside it is the ASCII fallback every parser
+ * understands: it loses the accents, and it is what stops a name being lost
+ * entirely the next time one of these encodings surprises us.
+ */
+function contentDisposition(name) {
+  const encoded = encodeURIComponent(name)
+    .replace(/['()*]/g, (c) => '%' + c.charCodeAt(0).toString(16).toUpperCase());
+  // Quotes and backslashes would end the quoted-string early; anything not
+  // plain ASCII is dropped rather than mangled, since the starred form above
+  // carries the real name.
+  const ascii = name.replace(/["\\]/g, '_').replace(/[^\x20-\x7e]/g, '_');
+  return `attachment; filename="${ascii}"; filename*=UTF-8''${encoded}`;
+}
 const pending = new Map();
 
 self.addEventListener('install', () => self.skipWaiting());
@@ -24,6 +53,31 @@ self.addEventListener('activate', (event) => event.waitUntil(self.clients.claim(
 
 self.addEventListener('message', (event) => {
   const data = event.data || {};
+  // A worker with nothing to do is terminated — Firefox after about thirty
+  // seconds, and `respondWith(new Response(stream))` does not extend its life
+  // for the duration of the response. So a download longer than that lost its
+  // reader mid-file: the page's next `write()` never resolved and never
+  // rejected, the progress bar stopped, the console stayed empty and the node
+  // went on looking perfectly healthy. Handling a message is an event, and an
+  // event resets that timer, so the page pings while it is writing.
+  //
+  // It also has to be answered: a ping that only arrives keeps *this* worker
+  // alive, and the reply is how the page learns the worker it is talking to is
+  // still the one holding its stream.
+  if (data.type === 'mbdl-ping') {
+    if (event.ports && event.ports[0]) {
+      try { event.ports[0].postMessage({ type: 'mbdl-pong' }); } catch { /* gone */ }
+    }
+    return;
+  }
+  // A page that loaded before any worker existed can miss the claim on
+  // activate. Rather than declare the streamed path unavailable — which on
+  // Firefox and Safari means the download cannot happen at all — the page asks
+  // for another claim and waits a moment longer.
+  if (data.type === 'mbdl-claim') {
+    event.waitUntil(self.clients.claim());
+    return;
+  }
   if (data.type !== 'mbdl' || !data.id || !data.readable) return;
   pending.set(data.id, {
     readable: data.readable,
@@ -35,6 +89,21 @@ self.addEventListener('message', (event) => {
     // stream and the page's first write blocks for good.
     port: data.port || null,
   });
+  // Say so, on the port the page is already listening to.
+  //
+  // `pending` is in memory, and a worker with nothing to do is terminated:
+  // Chrome after tens of seconds, which a long upload spends without giving
+  // this worker a single event. A stream posted to a worker in that state is
+  // lost, the iframe then wakes it with no entry to find, and the request falls
+  // through to the network — measured as a 404 from the hub and thirty seconds
+  // of nothing, twice, before the download started at all.
+  //
+  // The page waits for this before navigating, so the entry is known to be here
+  // rather than hoped to be. A page talking to an older worker gets no answer
+  // and navigates anyway, which is what it did before.
+  if (data.port) {
+    try { data.port.postMessage({ type: 'mbdl-ready', id: data.id }); } catch { /* gone */ }
+  }
   // A tab that is closed before it navigates would leave a stream here for the
   // life of the worker.
   setTimeout(() => pending.delete(data.id), 60000);
@@ -56,8 +125,7 @@ self.addEventListener('fetch', (event) => {
   const headers = {
     'Content-Type': 'application/octet-stream',
     // filename* so a name with accents or spaces survives the trip.
-    'Content-Disposition':
-      `attachment; filename*=UTF-8''${encodeURIComponent(entry.filename)}`,
+    'Content-Disposition': contentDisposition(entry.filename),
     'Cache-Control': 'no-store',
   };
   // Only when it is known. A zip is assembled as it goes and announcing a