Merge branch 'fix/large-download-paths'

Concurrent-transfer limits, with the queue, the pause and the flag day.

A node now caps how many transfers it runs at once (8 downloads, 8 uploads,
node-wide) and how many one member may run in one group (2 by default,
operator-signed). Beyond that the node answers "queued" and the client waits its
turn, visibly, in the transfers panel — and a slot that frees starts whatever is
next, skipping past a member who is at their own cap rather than letting them
stall everyone behind them.

Browsing is never subject to a slot: not the poster grid, not the covers, not
opening a photo to look at it. That is structural — a transfer is what the
transfers widget shows — and the exemption is bounded rather than open, at two
files in flight per session, because an exemption with no bound is a leaseless
branch under another name.

Transfers can be cancelled, and now paused and resumed. A paused one holds
nothing: its slot goes back at once and resuming rejoins the queue at the tail.
Uploads survive the connection that started them and resume where the node
stopped, asked for inside the seal rather than on a clear message. What they
leave behind when they are abandoned is reaped, which closes a disk leak that
predates this work.

MNP 3.0 makes the lease compulsory and refuses 2.x at the handshake, with the
desktop client checking `client.minimum` before connecting so an un-updated one
says "update" instead of failing every connection in a protocol vocabulary.

Fourteen defects were found on the way, eight of them by a person clicking
Download and pasting a console — none of which 2075 tests could reach. Section
12 of ~/next/improve-downloads.md is that report, including the three this work
introduced itself and the one that turned out to be caused by an instruction to
hard-reload after each deployment.

Node suite 1209 passed, hub suite 866 passed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HCGdheDLxGReuKHga3BtST

1 files changed, 85 insertions, 0 deletions

diff --git a/packages/meshbay-node/tests/test_leaseless_reads.py b/packages/meshbay-node/tests/test_leaseless_reads.py
new file mode 100644
index 0000000..70fd24f
--- /dev/null
+++ b/packages/meshbay-node/tests/test_leaseless_reads.py
@@ -0,0 +1,85 @@
+"""
+Browsing is never subject to a transfer slot — and is not unbounded either.
+
+**Operator decision, 2026-09-08:** a member must be able to browse a group that
+is at capacity exactly as they browse an idle one. Not the poster grid, not the
+covers, not opening a photo or a PDF to look at it. §3.4 of
+~/next/improve-downloads.md satisfies that structurally: a transfer is what the
+transfers widget shows, and nothing else takes a slot.
+
+But "not leased" cannot mean "unbounded". With MNP 3.0 making leases
+compulsory, a client that simply omits `tr` would otherwise transfer outside
+every cap, and the caps would be decoration — the leaseless branch left
+reachable is finding C6's lesson (a transport that accepted a bare token) one
+feature later.
+
+So a leaseless read is bounded by a small count of *files in flight*, not by
+bytes: a RAW photo out of a camera is 60–80 MB and is browsing, a 40 MB archive
+is a download, and no size threshold separates them. What separates them is
+which function asked.
+"""
+
+from meshbay_node.transfers import (
+    LEASELESS_IDLE_SECS, MAX_LEASELESS_IN_FLIGHT, LeaselessReads,
+)
+
+
+def test_a_viewer_looking_at_one_file_is_never_refused():
+    reads = LeaselessReads()
+    for chunk in range(20):
+        assert reads.admit("photo-1", now=float(chunk)) is True
+
+
+def test_a_second_file_is_allowed_so_prefetching_stays_possible():
+    """One is what a viewer needs; two is so the photo viewer can fetch the
+    next one while showing this one."""
+    reads = LeaselessReads()
+    assert reads.admit("photo-1", now=0.0) is True
+    assert reads.admit("photo-2", now=0.0) is True
+
+
+def test_a_third_file_is_refused():
+    reads = LeaselessReads()
+    reads.admit("a", now=0.0)
+    reads.admit("b", now=0.0)
+    assert reads.admit("c", now=0.0) is False
+
+
+def test_a_file_already_being_read_is_never_cut_off():
+    """Even once the limit is reached. Refusing a chunk halfway through a photo
+    because the count moved would be worse than never having admitted it — the
+    viewer would show half an image and no error anyone can act on."""
+    reads = LeaselessReads()
+    reads.admit("a", now=0.0)
+    reads.admit("b", now=0.0)
+    assert reads.admit("c", now=0.0) is False
+    assert reads.admit("a", now=1.0) is True
+
+
+def test_finishing_one_frees_it_at_once():
+    """The last chunk is the only "close" a leaseless read has. Waiting for the
+    idle timeout instead would mean somebody who looked at two photos cannot
+    look at a third for a minute."""
+    reads = LeaselessReads()
+    reads.admit("a", now=0.0)
+    reads.admit("b", now=0.0)
+    reads.finish("a")
+    assert reads.admit("c", now=0.0) is True
+
+
+def test_a_viewer_closed_mid_file_does_not_hold_its_place_for_ever():
+    """It stops asking and says nothing — there is no message for "I closed the
+    tab". Without the idle expiry the session would carry two dead entries and
+    refuse every later preview, which is the bound turning into a bug."""
+    reads = LeaselessReads()
+    reads.admit("a", now=0.0)
+    reads.admit("b", now=0.0)
+    assert reads.admit("c", now=1.0) is False
+    assert reads.admit("c", now=LEASELESS_IDLE_SECS + 2) is True
+
+
+def test_the_bound_is_two():
+    """Stated here so that changing it is a decision rather than a typo: it is
+    the number §3.4.1 argues for, and the argument is about viewers, not about
+    tuning."""
+    assert MAX_LEASELESS_IN_FLIGHT == 2