playlists: refuse a body no frame can carry, and say which one

A DataChannel send() throws above the max-message-size the node advertises
(aiortc: 65536), so the 1 MB body cap was unreachable and each body push
swallowed the difference in a bare catch. Cap at 62 KB after sealing, name
the playlist in the sync result, keep syncing the rest.

Measured: 1000 tracks seal to 53 276 bytes, so the ceiling is ~1200.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2 files changed, 98 insertions, 0 deletions

diff --git a/packages/meshbay-hub/tests/harness/playlist_store_probe.py b/packages/meshbay-hub/tests/harness/playlist_store_probe.py
index f7573b7..83c00ad 100755
--- a/packages/meshbay-hub/tests/harness/playlist_store_probe.py
+++ b/packages/meshbay-hub/tests/harness/playlist_store_probe.py
@@ -362,6 +362,67 @@ function fakeNode() {
       names: readBack ? Object.values(readBack.playlists).map((p) => p.name).sort() : [],
     });
 
+    // ── what a playlist costs, sealed ─────────────────────────────────────
+    //
+    // The cap below is in bytes, but the only number a reader can act on is a
+    // number of tracks — so it is measured here rather than quoted from the
+    // design doc. (Quoting it is how "225 tracks" got written down: §4's
+    // figure is ~270 bytes a track *raw* and ~60 *sealed*, and the raw one was
+    // read for the sealed one.)
+    //
+    // Varied metadata on purpose. A fixture where every track shares an artist
+    // and an album measures deflate's opinion of its own regularity: the first
+    // attempt at this, 400 tracks differing only by id, sealed to 41 bytes a
+    // track and would have let the case below pass while testing nothing.
+    const WORDS = ['aube', 'ciel', 'verre', 'nord', 'ombre', 'pluie', 'fer',
+                   'sel', 'onze', 'rive', 'brume', 'cendre', 'axe', 'lune'];
+    const hex = (n) => [...crypto.getRandomValues(new Uint8Array(n))]
+      .map((b) => b.toString(16).padStart(2, '0')).join('');
+    const word = () => WORDS[Math.floor(Math.random() * WORDS.length)];
+    const storedTrack = (i) => {
+      const artist = `${word()} ${word()}`;
+      const album = `${word()} ${word()} ${1970 + (i % 50)}`;
+      const title = `${word()} ${word()} ${word()}`;
+      return { id: hex(16), g: 'g1', hv: 1, n: `${i % 20} - ${title}.flac`,
+               s: 30000000 + i, p: `${artist}/${album}`, t: title, a: artist,
+               b: album, d: 180 + (i % 300), tn: (i % 20) + 1 };
+    };
+    const sizes = {};
+    for (const n of [100, 500, 1000]) {
+      const tracks = [];
+      for (let i = 0; i < n; i++) tracks.push(storedTrack(i));
+      const sealed = await seal({ v: 1, id: 'measure', rev: 1, device: 'aaa', tracks },
+                                bodyKind('measure'), USER, key);
+      sizes[n] = sealed.length;
+    }
+    steps.push({ step: 'what a playlist costs sealed', sizes });
+
+    // ── a playlist too large for one frame is named, not swallowed ────────
+    //
+    // A DataChannel `send()` throws above the max-message-size the far end
+    // advertised, which for the node's aiortc is 65536 — so the node's 1 MB
+    // body cap is unreachable and the real limit is a count of tracks
+    // (docs/playlists.md §15.3). The push used to swallow every per-body
+    // failure in one bare `catch {}`: the playlist stopped leaving the browser
+    // and nothing anywhere said so, which is the silent loss this design
+    // exists to prevent.
+    const bigNode = fakeNode();
+    const longId = await P.createPlaylist(USER, 'Trop longue');
+    const many = [];
+    for (let i = 0; i < 1500; i++) {
+      const st = storedTrack(i);
+      many.push({ ...track(i), id: st.id, name: st.n, display_title: st.t,
+                  path: st.p, artist: st.a, album: st.b, duration: st.d });
+    }
+    await P.addTracks(USER, longId, many, 'g1');
+    const bigResult = await P.syncWith(bigNode, USER);
+    steps.push({ step: 'a playlist too large for one frame',
+                 result: bigResult,
+                 bigKind: bodyKind(longId),
+                 // Everything else must still have gone: one oversized
+                 // playlist is not a broken sync.
+                 stored: bigNode.stored.map((e) => ({ kind: e.kind, bytes: e.bytes })) });
+
     // ── a session with no HKDF handle degrades rather than failing ─────────
     P.setPlaylistTransport(null);
     P.forgetPlaylistKey();
diff --git a/packages/meshbay-hub/tests/test_playlist_store.py b/packages/meshbay-hub/tests/test_playlist_store.py
index 59afaee..ce094c4 100644
--- a/packages/meshbay-hub/tests/test_playlist_store.py
+++ b/packages/meshbay-hub/tests/test_playlist_store.py
@@ -280,3 +280,40 @@ def test_a_session_from_before_the_hkdf_handle_degrades_rather_than_failing(step
     r = steps["a session from before the HKDF handle"]["result"]
     assert r["ok"] is False and r["reason"] == "no_key"
     assert r["pushed"] == 0
+
+
+def test_what_a_playlist_costs_sealed_is_measured_not_quoted(steps):
+    """The ceiling the UI promises comes from here, not from the design doc.
+
+    §4 measured ~270 bytes a track *raw* and ~60 *sealed*; the raw figure was
+    then read for the sealed one and "about 225 tracks" written down, which is
+    five times too strict. So the number is measured where it is used.
+    """
+    sizes = steps["what a playlist costs sealed"]["sizes"]
+    per_track = (sizes["1000"] - sizes["100"]) / 900
+    assert 30 < per_track < 90, f"a track now costs {per_track:.0f} sealed bytes"
+    # The sentence shown to a reader is "playlists of about 1000 tracks". If
+    # compression regresses, or a field is added to what is stored, that
+    # sentence becomes false — and this is what says so.
+    assert sizes["1000"] < 62 * 1024, (
+        f"a thousand tracks no longer fit in one frame: {sizes['1000']} bytes")
+
+
+def test_a_playlist_too_large_for_a_frame_is_named(steps):
+    # Not "a sync failed": which playlist, so the reader can act. A bare
+    # `catch {}` per body is what let this stop leaving the browser in silence.
+    s = steps["a playlist too large for one frame"]
+    assert s["result"]["tooLarge"] == ["Trop longue"]
+    kinds = [e["kind"] for e in s["stored"]]
+    assert s["bigKind"] not in kinds, "the oversized body was handed to send() anyway"
+
+
+def test_one_oversized_playlist_does_not_break_the_rest_of_the_sync(steps):
+    s = steps["a playlist too large for one frame"]
+    assert s["result"]["ok"] is True
+    assert s["result"]["failed"] == []
+    kinds = [e["kind"] for e in s["stored"]]
+    # The manifest last, and the other bodies before it: one playlist that
+    # cannot be sent must not hold back the four that can.
+    assert "playlists" in kinds
+    assert len([k for k in kinds if k.startswith("playlist:")]) >= 4