1 files changed, 85 insertions, 0 deletions
diff --git a/packages/meshbay-node/tests/test_leaseless_reads.py b/packages/meshbay-node/tests/test_leaseless_reads.py
new file mode 100644
index 0000000..70fd24f
--- /dev/null
+++ b/packages/meshbay-node/tests/test_leaseless_reads.py
@@ -0,0 +1,85 @@
+"""
+Browsing is never subject to a transfer slot — and is not unbounded either.
+
+**Operator decision, 2026-09-08:** a member must be able to browse a group that
+is at capacity exactly as they browse an idle one. Not the poster grid, not the
+covers, not opening a photo or a PDF to look at it. §3.4 of
+~/next/improve-downloads.md satisfies that structurally: a transfer is what the
+transfers widget shows, and nothing else takes a slot.
+
+But "not leased" cannot mean "unbounded". With MNP 3.0 making leases
+compulsory, a client that simply omits `tr` would otherwise transfer outside
+every cap, and the caps would be decoration — the leaseless branch left
+reachable is finding C6's lesson (a transport that accepted a bare token) one
+feature later.
+
+So a leaseless read is bounded by a small count of *files in flight*, not by
+bytes: a RAW photo out of a camera is 60–80 MB and is browsing, a 40 MB archive
+is a download, and no size threshold separates them. What separates them is
+which function asked.
+"""
+
+from meshbay_node.transfers import (
+    LEASELESS_IDLE_SECS, MAX_LEASELESS_IN_FLIGHT, LeaselessReads,
+)
+
+
+def test_a_viewer_looking_at_one_file_is_never_refused():
+    reads = LeaselessReads()
+    for chunk in range(20):
+        assert reads.admit("photo-1", now=float(chunk)) is True
+
+
+def test_a_second_file_is_allowed_so_prefetching_stays_possible():
+    """One is what a viewer needs; two is so the photo viewer can fetch the
+    next one while showing this one."""
+    reads = LeaselessReads()
+    assert reads.admit("photo-1", now=0.0) is True
+    assert reads.admit("photo-2", now=0.0) is True
+
+
+def test_a_third_file_is_refused():
+    reads = LeaselessReads()
+    reads.admit("a", now=0.0)
+    reads.admit("b", now=0.0)
+    assert reads.admit("c", now=0.0) is False
+
+
+def test_a_file_already_being_read_is_never_cut_off():
+    """Even once the limit is reached. Refusing a chunk halfway through a photo
+    because the count moved would be worse than never having admitted it — the
+    viewer would show half an image and no error anyone can act on."""
+    reads = LeaselessReads()
+    reads.admit("a", now=0.0)
+    reads.admit("b", now=0.0)
+    assert reads.admit("c", now=0.0) is False
+    assert reads.admit("a", now=1.0) is True
+
+
+def test_finishing_one_frees_it_at_once():
+    """The last chunk is the only "close" a leaseless read has. Waiting for the
+    idle timeout instead would mean somebody who looked at two photos cannot
+    look at a third for a minute."""
+    reads = LeaselessReads()
+    reads.admit("a", now=0.0)
+    reads.admit("b", now=0.0)
+    reads.finish("a")
+    assert reads.admit("c", now=0.0) is True
+
+
+def test_a_viewer_closed_mid_file_does_not_hold_its_place_for_ever():
+    """It stops asking and says nothing — there is no message for "I closed the
+    tab". Without the idle expiry the session would carry two dead entries and
+    refuse every later preview, which is the bound turning into a bug."""
+    reads = LeaselessReads()
+    reads.admit("a", now=0.0)
+    reads.admit("b", now=0.0)
+    assert reads.admit("c", now=1.0) is False
+    assert reads.admit("c", now=LEASELESS_IDLE_SECS + 2) is True
+
+
+def test_the_bound_is_two():
+    """Stated here so that changing it is a decision rather than a typo: it is
+    the number §3.4.1 argues for, and the argument is about viewers, not about
+    tuning."""
+    assert MAX_LEASELESS_IN_FLIGHT == 2