1 files changed, 83 insertions, 0 deletions
diff --git a/packages/meshbay-node/src/meshbay_node/transfers.py b/packages/meshbay-node/src/meshbay_node/transfers.py
index dd5da5c..2185547 100644
--- a/packages/meshbay-node/src/meshbay_node/transfers.py
+++ b/packages/meshbay-node/src/meshbay_node/transfers.py
@@ -403,3 +403,86 @@ class TransferSlots:
         return " ".join(
             f"{kind[0]}={p[kind]['in_use']}/{p[kind]['cap']}"
             f"(q{p[kind]['queued']})" for kind in KINDS)
+
+
+# ── Reads that carry no lease ───────────────────────────────────────────────
+
+# How many distinct files one session may be reading at once without a lease.
+#
+# Browsing a group is never subject to a transfer slot — not the poster grid,
+# not the covers, not opening a photo or a PDF to look at it. A member must be
+# able to browse a group that is at capacity exactly as they browse an idle one.
+# That is a requirement, and §3.4 of ~/next/improve-downloads.md satisfies it
+# structurally: a transfer is what the transfers widget shows, and nothing else
+# takes a slot.
+#
+# But "not leased" cannot mean "unbounded", or a client that simply omits `tr`
+# transfers outside every cap and the caps are decoration. Two, because a viewer
+# looks at *one* file — one photo, one document — and the second is there so
+# that prefetching the next photo stays possible.
+#
+# Deliberately a count of files and not a byte budget: a RAW photo out of a
+# camera is 60-80 MB and is browsing, a 40 MB archive is a download, and no
+# size threshold separates them. What separates them is which function asked.
+#
+# What it costs, stated plainly: a client that lies — labelling a bulk download
+# as a view — gets two files at a time instead of its member cap. That is the
+# residual, it is bounded, it is audited, and it is the same kind of statement
+# as the cap itself. **This is a fairness control among cooperating clients**,
+# not a defence against a member determined to saturate a node's disk. The
+# answer to that member is `member revoke`.
+MAX_LEASELESS_IN_FLIGHT = 2
+
+# A leaseless read has no "close" message, so it ends when the last chunk goes
+# out — or, when a viewer is closed mid-file and simply stops asking, when it
+# has been quiet this long.
+LEASELESS_IDLE_SECS = 60
+
+
+class LeaselessReads:
+    """
+    The files one session is reading without a lease, and the bound on them.
+
+    Per session rather than per member: this is not a resource pool, it is a
+    ceiling on what one connection can do while claiming to be browsing. A
+    member with three tabs open is browsing in three tabs, which is fine.
+    """
+
+    def __init__(self, limit: int = MAX_LEASELESS_IN_FLIGHT,
+                 idle: float = LEASELESS_IDLE_SECS) -> None:
+        self.limit = limit
+        self.idle = idle
+        self._seen: dict[str, float] = {}
+
+    def admit(self, file_id: str, now: float | None = None) -> bool:
+        """May this session read `file_id` without a lease right now?
+
+        True for a file it is already reading, whatever the count: refusing a
+        chunk halfway through a photo because the limit moved would be worse
+        than never having admitted it.
+        """
+        when = time.monotonic() if now is None else now
+        self._expire(when)
+        if file_id in self._seen:
+            self._seen[file_id] = when
+            return True
+        if len(self._seen) >= self.limit:
+            return False
+        self._seen[file_id] = when
+        return True
+
+    def finish(self, file_id: str) -> None:
+        """The last chunk went out; the slot is free at once rather than in a
+        minute."""
+        self._seen.pop(file_id, None)
+
+    def _expire(self, now: float) -> None:
+        # A viewer closed mid-file stops asking and says nothing. Without this
+        # the session would carry two dead entries and refuse every later
+        # preview, which is the bound turning into a bug.
+        for file_id, last in list(self._seen.items()):
+            if now - last > self.idle:
+                del self._seen[file_id]
+
+    def __len__(self) -> int:
+        return len(self._seen)