From bb8aad22c4d41dd1b89c85c8d46878a31a9530e5 Mon Sep 17 00:00:00 2001
From: Christophe Besson <cbesson@gmail.com>
Date: Tue, 8 Sep 2026 13:21:02 +0200
Subject: fix(hub): never collect a large download in the page
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`pipelinedDownload` with no writable allocates `new Array(totalChunks)` and
keeps every decrypted chunk, so whatever `_openDownloadTarget` returns null for
is held whole in RAM. That floor had no upper bound: the
`!window.showSaveFilePicker` branch returned null at any size, so on a browser
without the File System Access API a 20 GB film went to memory whenever the
streamed path did not answer. Nothing logged, nothing refused; the symptom was
the tab dying, with no error attributable to this code.

MEMORY_CEILING is 100 MB and every `return null` in that chain now goes through
a guard that throws above it. The refusal names the size, the limit and why the
streamed path declined, and lands in the transfers panel as a failed transfer
rather than in a console nobody opens.

This is a guard, not a limit on what can be downloaded: with the streamed path
primed and retried (previous commit), a file of any size still goes to disk
progressively on every browser. Two things had to change for that to be true:

- the streamed path is now tried in "ask" mode too, for a file over the ceiling
  on a browser with no Save As of its own. The mode decides whether to show a
  dialog; it was silently deciding whether a film could be downloaded at all;
- FilePreview had no size check whatsoever — a multi-gigabyte PDF or .csv was
  fetched whole, and the text branch decoded all of it to keep 500 000
  characters. It refuses above the same ceiling and offers the download.

ZIP_MAX_BYTES (512 MB) and the ceiling do not contradict: the archive limit
bounds the archive, the ceiling bounds what may be built in the page, so a
400 MB zip is allowed when there is somewhere to stream it and refused when the
only route left is memory. The build-in-memory confirmation only appears below
the ceiling now.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HCGdheDLxGReuKHga3BtST
---
 packages/meshbay-hub/src/meshbay_hub/static/locales/de.js | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'packages/meshbay-hub/src/meshbay_hub/static/locales/de.js')

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
index 97a835d..1ebab8b 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
@@ -216,6 +216,8 @@ export default {
   'video.close': 'Schließen (Esc)',
   'preview.pdf_fallback': 'Dieser Browser zeigt das PDF nicht direkt an. Laden Sie es '
     + 'stattdessen herunter — entschlüsselt wurde es ohnehin hier.',
+  'preview.too_large': 'Diese Datei ist {size} groß, mehr als diese Seite im Arbeitsspeicher halten kann ({limit}). Laden Sie sie stattdessen herunter — ein Download wird direkt auf die Festplatte geschrieben.',
+  'download.too_large_for_memory': '„{name}“ ist {size} groß. Dieser Browser kann eine Datei dieser Größe nur speichern, indem er sie direkt auf die Festplatte schreibt, und das ist hier nicht möglich — er müsste die ganze Datei im Arbeitsspeicher halten. Verwenden Sie die Desktop-App oder Chrome bzw. Edge.',
   'group.upload_indexing': 'wird indiziert …',
   'video.err_transport': 'Transport nicht verbunden',
   'video.err_mse': 'Codec wird für das Streaming nicht unterstützt: {codec}',
-- 
cgit v1.2.3


From 4b94468d24913c3071b48eeefb43367f4f5cd523 Mon Sep 17 00:00:00 2001
From: Christophe Besson <cbesson@gmail.com>
Date: Tue, 8 Sep 2026 14:53:03 +0200
Subject: feat(node): make the transfer caps settable, node-wide and per group
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Step 3 of ~/next/improve-downloads.md. Step 2 built the pools with constants;
this gives them to the operator, in the two scopes they belong to.

**The pools are the machine's.** `[node] max_concurrent_downloads` and
`max_concurrent_uploads`, default 8, on the §2.11 pattern: node.toml for a
fresh install, a roster.db override for immediate effect, editable from the
Node page and from `meshbay-node transfers show|set`, applied live through the
one `set_capacity` step 1 fixed.

**The per-member cap is a group's.** How many transfers one member may run at
once here — on the node like every other group setting (not the hub, which
would have authority over someone else's disk; not node.toml, which is
hand-written and needs a restart), changed by a signed operator instruction
(`OP_TRANSFER_LIMITS`, subject "d=2,u=2" so what is signed names the outcome),
broadcast to the group, and read live by the pools.

That was the one thing step 2's shape could not express: `per_member` was a
single node-wide number. `group_limits` and `member_cap(kind, member)` make it
a lookup — the group's own value if it has one, the node's default otherwise —
and it is deliberately the only dimension that is not node-wide.

Three refusals, each with a test:

- **absent means the default (2), never "unlimited".** A group that predates
  the setting coming back unlimited would leave the node-wide pool as the only
  control, which is the situation slots exist to end;
- **zero is not "unlimited"**, and is not "this member may not transfer"
  either: the floor is one everywhere, and the CLI says to revoke the member
  instead;
- **an unreadable row reads as unset**, not as zero — the same discipline the
  sealed messages follow, where a payload that does not open must never become
  a default state on its own.

`handshake_ack` carries this member's own caps for this group, so the interface
can say "2 of your 2 slots are busy" instead of drawing a bare spinner. Absent
reads as "no limit known" and the hint is not drawn — never as "unlimited",
which would have the interface contradicting the node.

1164 node, 793 hub, 0 failed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HCGdheDLxGReuKHga3BtST
---
 .../meshbay-common/src/meshbay_common/adminop.py   |   6 +
 .../meshbay-common/src/meshbay_common/protocol.py  |   2 +
 .../src/meshbay_hub/static/locales/de.js           |   2 +
 .../src/meshbay_hub/static/locales/en.js           |   2 +
 .../src/meshbay_hub/static/locales/es.js           |   2 +
 .../src/meshbay_hub/static/locales/fr.js           |   2 +
 .../src/meshbay_hub/static/locales/it.js           |   2 +
 .../src/meshbay_hub/static/locales/ja.js           |   2 +
 .../src/meshbay_hub/static/locales/nl.js           |   2 +
 .../src/meshbay_hub/static/locales/pl.js           |   2 +
 .../src/meshbay_hub/static/locales/pt-BR.js        |   2 +
 .../src/meshbay_hub/static/locales/zh-CN.js        |   2 +
 .../src/meshbay_hub/static/node-page.js            |  14 ++
 packages/meshbay-node/src/meshbay_node/config.py   |  21 +++
 packages/meshbay-node/src/meshbay_node/daemon.py   |  69 +++++++++-
 packages/meshbay-node/src/meshbay_node/ops.py      |  28 ++++
 packages/meshbay-node/src/meshbay_node/roster.py   |  33 +++++
 .../meshbay-node/src/meshbay_node/transfers.py     |  34 ++++-
 .../src/meshbay_node/transport/webrtc_server.py    |  89 ++++++++++++
 packages/meshbay-node/tests/test_cli_dispatch.py   |   5 +
 .../meshbay-node/tests/test_transfer_settings.py   | 152 +++++++++++++++++++++
 21 files changed, 470 insertions(+), 3 deletions(-)
 create mode 100644 packages/meshbay-node/tests/test_transfer_settings.py

(limited to 'packages/meshbay-hub/src/meshbay_hub/static/locales/de.js')

diff --git a/packages/meshbay-common/src/meshbay_common/adminop.py b/packages/meshbay-common/src/meshbay_common/adminop.py
index ed6e940..5c7345b 100644
--- a/packages/meshbay-common/src/meshbay_common/adminop.py
+++ b/packages/meshbay-common/src/meshbay_common/adminop.py
@@ -61,6 +61,12 @@ OP_APPS_ENABLED = "apps_enabled"
 # security property in itself, but the pattern (every operator setting is
 # signed) is what keeps the authorization model simple to reason about.
 OP_SET_SCAN_SETTINGS = "set_scan_settings"
+# How many transfers one member may run at once in this group. Signed like the
+# rest: an unsigned cap is one any member can raise for themselves, which makes
+# the control a suggestion. The subject is "d=2,u=2" so what the operator is
+# shown before signing names the outcome and not the operation -- the same rule
+# member_upload's on/off subject follows.
+OP_TRANSFER_LIMITS = "transfer_limits"
 # Whether the node uses the operator's own API token/language instead of the
 # shipped default — node-wide (docs/mediacenter.md §5.5), one credential
 # shared by every group. Signed like the rest: it turns on outbound
diff --git a/packages/meshbay-common/src/meshbay_common/protocol.py b/packages/meshbay-common/src/meshbay_common/protocol.py
index 4890d3b..8a521bb 100644
--- a/packages/meshbay-common/src/meshbay_common/protocol.py
+++ b/packages/meshbay-common/src/meshbay_common/protocol.py
@@ -152,6 +152,8 @@ class MNP:
     MEMBER_UPLOAD_ACK    = "member_upload_ack"
     APPS_ENABLED         = "apps_enabled"          # operator → node: which group apps to show
     APPS_ENABLED_ACK     = "apps_enabled_ack"
+    TRANSFER_LIMITS       = "transfer_limits"       # operator → node: per-member caps for this group
+    TRANSFER_LIMITS_ACK   = "transfer_limits_ack"   # node → this group: the new caps
     SET_SCAN_SETTINGS     = "set_scan_settings"     # operator → node: reconcile/debounce timing
     SET_SCAN_SETTINGS_ACK = "set_scan_settings_ack"
     MEDIA_META_REQ        = "media_meta_req"        # client → node: TMDB metadata for a path
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
index 1ebab8b..8ed1ef0 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
@@ -739,6 +739,8 @@ export default {
   'node.setting_pair_ttl': 'Pairing code TTL',
   'node.setting_device_ttl': 'Device request TTL',
   'node.setting_max_streams': 'Max concurrent streams',
+  'node.setting_max_downloads': 'Max. gleichzeitige Downloads',
+  'node.setting_max_uploads': 'Max. gleichzeitige Uploads',
   'node.setting_transcode': 'Transcode incompatible video',
   'node.setting_unit_hours': 'hours',
   'node.setting_unit_minutes': 'min',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
index d85f51b..285ff7a 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
@@ -890,6 +890,8 @@ export default {
   'node.setting_pair_ttl': 'Pairing code TTL',
   'node.setting_device_ttl': 'Device request TTL',
   'node.setting_max_streams': 'Max concurrent streams',
+  'node.setting_max_downloads': 'Max concurrent downloads',
+  'node.setting_max_uploads': 'Max concurrent uploads',
   'node.setting_transcode': 'Transcode incompatible video',
   'node.setting_unit_hours': 'hours',
   'node.setting_unit_minutes': 'min',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
index bfe4112..f74c763 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
@@ -734,6 +734,8 @@ export default {
   'node.setting_pair_ttl': 'Pairing code TTL',
   'node.setting_device_ttl': 'Device request TTL',
   'node.setting_max_streams': 'Max concurrent streams',
+  'node.setting_max_downloads': 'Descargas simultáneas máximas',
+  'node.setting_max_uploads': 'Subidas simultáneas máximas',
   'node.setting_transcode': 'Transcode incompatible video',
   'node.setting_unit_hours': 'hours',
   'node.setting_unit_minutes': 'min',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
index 9addec5..0c5103f 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
@@ -737,6 +737,8 @@ export default {
   'node.setting_pair_ttl': 'Durée du code d\'appairage',
   'node.setting_device_ttl': 'Durée des demandes d\'appareil',
   'node.setting_max_streams': 'Flux vidéo simultanés max',
+  'node.setting_max_downloads': 'Téléchargements simultanés max',
+  'node.setting_max_uploads': 'Téléversements simultanés max',
   'node.setting_transcode': 'Transcoder les vidéos incompatibles',
   'node.setting_unit_hours': 'heures',
   'node.setting_unit_minutes': 'min',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
index fe76b9e..ebac541 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
@@ -736,6 +736,8 @@ export default {
   'node.setting_pair_ttl': 'Pairing code TTL',
   'node.setting_device_ttl': 'Device request TTL',
   'node.setting_max_streams': 'Max concurrent streams',
+  'node.setting_max_downloads': 'Download simultanei massimi',
+  'node.setting_max_uploads': 'Caricamenti simultanei massimi',
   'node.setting_transcode': 'Transcode incompatible video',
   'node.setting_unit_hours': 'hours',
   'node.setting_unit_minutes': 'min',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
index 272be73..1b49ddb 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
@@ -724,6 +724,8 @@ export default {
   'node.setting_pair_ttl': 'Pairing code TTL',
   'node.setting_device_ttl': 'Device request TTL',
   'node.setting_max_streams': 'Max concurrent streams',
+  'node.setting_max_downloads': '同時ダウンロードの上限',
+  'node.setting_max_uploads': '同時アップロードの上限',
   'node.setting_transcode': 'Transcode incompatible video',
   'node.setting_unit_hours': 'hours',
   'node.setting_unit_minutes': 'min',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
index 76f3586..7cf4cd4 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
@@ -738,6 +738,8 @@ export default {
   'node.setting_pair_ttl': 'Pairing code TTL',
   'node.setting_device_ttl': 'Device request TTL',
   'node.setting_max_streams': 'Max concurrent streams',
+  'node.setting_max_downloads': 'Max. gelijktijdige downloads',
+  'node.setting_max_uploads': 'Max. gelijktijdige uploads',
   'node.setting_transcode': 'Transcode incompatible video',
   'node.setting_unit_hours': 'hours',
   'node.setting_unit_minutes': 'min',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
index dd05487..6edffd5 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
@@ -756,6 +756,8 @@ export default {
   'node.setting_pair_ttl': 'Pairing code TTL',
   'node.setting_device_ttl': 'Device request TTL',
   'node.setting_max_streams': 'Max concurrent streams',
+  'node.setting_max_downloads': 'Maks. równoczesnych pobierań',
+  'node.setting_max_uploads': 'Maks. równoczesnych wysyłek',
   'node.setting_transcode': 'Transcode incompatible video',
   'node.setting_unit_hours': 'hours',
   'node.setting_unit_minutes': 'min',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
index 4632d36..3a6fa22 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
@@ -735,6 +735,8 @@ export default {
   'node.setting_pair_ttl': 'Pairing code TTL',
   'node.setting_device_ttl': 'Device request TTL',
   'node.setting_max_streams': 'Max concurrent streams',
+  'node.setting_max_downloads': 'Máximo de downloads simultâneos',
+  'node.setting_max_uploads': 'Máximo de envios simultâneos',
   'node.setting_transcode': 'Transcode incompatible video',
   'node.setting_unit_hours': 'hours',
   'node.setting_unit_minutes': 'min',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
index b6ff3c9..f43ef72 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
@@ -711,6 +711,8 @@ export default {
   'node.setting_pair_ttl': 'Pairing code TTL',
   'node.setting_device_ttl': 'Device request TTL',
   'node.setting_max_streams': 'Max concurrent streams',
+  'node.setting_max_downloads': '最大同时下载数',
+  'node.setting_max_uploads': '最大同时上传数',
   'node.setting_transcode': 'Transcode incompatible video',
   'node.setting_unit_hours': 'hours',
   'node.setting_unit_minutes': 'min',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/node-page.js b/packages/meshbay-hub/src/meshbay_hub/static/node-page.js
index 2e216a9..c1d57f9 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/node-page.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/node-page.js
@@ -1043,6 +1043,20 @@ export function NodePage({ groups }) {
                   onInput=${e => setEditSettings(s => ({...s, max_concurrent_streams: parseInt(e.target.value) || 1}))} />
               </div>
             </label>
+            <label class="node-setting">
+              <span class="node-setting-label">${t('node.setting_max_downloads')}</span>
+              <div class="node-setting-input">
+                <input type="number" min="1" value=${editSettings.max_concurrent_downloads}
+                  onInput=${e => setEditSettings(s => ({...s, max_concurrent_downloads: parseInt(e.target.value) || 1}))} />
+              </div>
+            </label>
+            <label class="node-setting">
+              <span class="node-setting-label">${t('node.setting_max_uploads')}</span>
+              <div class="node-setting-input">
+                <input type="number" min="1" value=${editSettings.max_concurrent_uploads}
+                  onInput=${e => setEditSettings(s => ({...s, max_concurrent_uploads: parseInt(e.target.value) || 1}))} />
+              </div>
+            </label>
             <label class="node-setting">
               <span class="node-setting-label">${t('node.setting_transcode')}</span>
               <div class="node-setting-input">
diff --git a/packages/meshbay-node/src/meshbay_node/config.py b/packages/meshbay-node/src/meshbay_node/config.py
index 7673a51..7351b1c 100644
--- a/packages/meshbay-node/src/meshbay_node/config.py
+++ b/packages/meshbay-node/src/meshbay_node/config.py
@@ -60,6 +60,13 @@ device_request_ttl_minutes = 60
 # lower it on a Pi.
 max_concurrent_streams = 8
 
+# How many downloads and uploads run at once on this node, across every group.
+# A slot is concurrency, not bandwidth: what it protects is open file handles,
+# disk seeks and the channel buffer each transfer keeps full. Past this, a
+# member is queued and told so, and starts when a slot frees.
+max_concurrent_downloads = 8
+max_concurrent_uploads = 8
+
 # HEVC sources have no browser decoder on most platforms, so streaming one is
 # transcoded to H264 rather than the usual free copy — real CPU per viewer.
 # Set to false only if every viewer's client is known to decode HEVC itself.
@@ -157,6 +164,14 @@ class NodeConfig:
     # the node answers "server busy" — see MAX_CONCURRENT_TRANSCODES in
     # transport/webrtc_server.py for what one costs.
     max_concurrent_streams: int = 8
+    # How many transfers run at once on this node, across every group —
+    # separate pools, because a download and an upload cost different things
+    # and one queue for both makes each cap meaningless. Streaming has its own
+    # third pool (max_concurrent_streams above): a member watching a film is
+    # not charged a download slot, and a download does not make the next film
+    # answer "server busy". See meshbay_node/transfers.py.
+    max_concurrent_downloads: int = 8
+    max_concurrent_uploads: int = 8
     # HEVC (and any future codec in media_probe.py's
     # BROWSER_INCOMPATIBLE_VIDEO_CODECS) has no decoder in most browsers, so
     # streaming it needs a real re-encode to H264 rather than the usual free
@@ -332,6 +347,12 @@ def load_config(path: Path = DEFAULT_CONFIG_PATH) -> Config:
         cfg.node.max_concurrent_streams = _positive(
             nd.get("max_concurrent_streams", cfg.node.max_concurrent_streams),
             cfg.node.max_concurrent_streams, "max_concurrent_streams")
+        cfg.node.max_concurrent_downloads = _positive(
+            nd.get("max_concurrent_downloads", cfg.node.max_concurrent_downloads),
+            cfg.node.max_concurrent_downloads, "max_concurrent_downloads")
+        cfg.node.max_concurrent_uploads = _positive(
+            nd.get("max_concurrent_uploads", cfg.node.max_concurrent_uploads),
+            cfg.node.max_concurrent_uploads, "max_concurrent_uploads")
         cfg.node.transcode_incompatible_video = bool(
             nd.get("transcode_incompatible_video", cfg.node.transcode_incompatible_video))
         ice_if = nd.get("ice_interfaces")
diff --git a/packages/meshbay-node/src/meshbay_node/daemon.py b/packages/meshbay-node/src/meshbay_node/daemon.py
index e270b6c..f7c1b33 100644
--- a/packages/meshbay-node/src/meshbay_node/daemon.py
+++ b/packages/meshbay-node/src/meshbay_node/daemon.py
@@ -406,6 +406,12 @@ class NodeDaemon:
                     # which the RootSet above already carries.)
                     "enabled_apps": await self._roster.enabled_apps(
                         group_cfg.id) if self._roster else list(Roster.DEFAULT_APPS),
+                    # How many transfers one member may run at once here. Empty
+                    # means the operator has not said, and the node's default
+                    # applies — never "unlimited" (transfers.member_cap).
+                    "transfer_limits": (
+                        await self._roster.transfer_limits(group_cfg.id)
+                        if self._roster else {}),
                     # Which folder(s) inside the shared roots each app works
                     # over. One shape for every app (roster.py's
                     # app_directories) — an empty list means nothing has been
@@ -511,6 +517,8 @@ class NodeDaemon:
                     groups=groups_ctx,
                     denylist=denylist,
                     max_concurrent_streams=self._config.node.max_concurrent_streams,
+                    max_concurrent_downloads=self._config.node.max_concurrent_downloads,
+                    max_concurrent_uploads=self._config.node.max_concurrent_uploads,
                     transcode_incompatible_video=self._config.node.transcode_incompatible_video,
                     stun_servers=self._config.node.stun_servers or None,
                 )
@@ -874,6 +882,9 @@ class NodeDaemon:
                 "enabled_apps": (
                     await self._roster.enabled_apps(group_cfg.id)
                     if self._roster else list(Roster.DEFAULT_APPS)),
+                "transfer_limits": (
+                    await self._roster.transfer_limits(group_cfg.id)
+                    if self._roster else {}),
                 **(await self._app_directories_ctx(group_cfg.id)),
                 "chat_link_preview": (
                     await self._roster.chat_link_preview(group_cfg.id)
@@ -1799,6 +1810,7 @@ def main() -> None:
                         choices=["init", "reset", "status", "gek-init",
                                  "gek", "operator", "member", "group", "root",
                                  "file", "video", "chat", "denylist", "stun",
+                                 "transfers",
                                  "reload",
                                  "restart-daemon", "autostart", "service",
                                  "calibrate-argon2"],
@@ -1814,6 +1826,8 @@ def main() -> None:
                              "| chat status|rotate|encrypt-history|prune "
                              "| denylist show|clear "
                              "| stun list|add|remove|reset "
+                             "| transfers show|set: live transfer slots, and "
+                             "the node-wide download/upload caps "
                              "| reload: re-read node.toml (hot; systemd or the "
                              "loopback API) | restart-daemon: restart the node "
                              "(systemd unit, the Windows autostart launcher, or the "
@@ -1831,12 +1845,16 @@ def main() -> None:
                              "init|rotate for gek; "
                              "list|rm for file; rematch for video; show|clear for "
                              "denylist; list|add|remove|reset for stun; "
+                             "show|set for transfers; "
                              "install|remove|start|stop|status for autostart and "
                              "for service")
     parser.add_argument("target", nargs="?",
                         help="username for member invite|revoke|unpin; group name "
                              "for group add; file id for file rm; identifier for "
-                             "denylist clear")
+                             "denylist clear; download cap for transfers set")
+    parser.add_argument("value", nargs="?",
+                        help="the second value where a verb takes two: the "
+                             "upload cap for transfers set")
     parser.add_argument("--hub-url", default=None,
                         help="hub URL, for init (e.g. https://meshbay.org)")
     parser.add_argument("--username", default=None,
@@ -2560,6 +2578,55 @@ def main() -> None:
         print("usage: meshbay-node stun list|add|remove|reset [url]")
         sys.exit(1)
 
+    if args.command == "transfers":
+        cfg = load_config(args.config or DEFAULT_CONFIG_PATH)
+        sub = args.subcommand or "show"
+
+        if sub == "show":
+            out = _daemon_api(cfg, "/api/transfers")
+            for kind, pool in out.get("pools", {}).items():
+                print(f"  {kind:<9} {pool['in_use']}/{pool['cap']} in use, "
+                      f"{pool['queued']} queued, "
+                      f"{pool['per_member']} per member")
+            leases = out.get("leases", [])
+            if not leases:
+                print("\n  nothing transferring")
+                return
+            print(f"\n  {'transfer':<14}{'kind':<10}{'state':<9}"
+                  f"{'user':<12}{'bytes':>12}")
+            for x in leases:
+                where = f"  (#{x['ahead'] + 1} in queue)" if x["state"] == "queued" else ""
+                print(f"  {x['tr']:<14}{x['kind']:<10}{x['state']:<9}"
+                      f"{x['user_id'][:10]:<12}{x['bytes']:>12}{where}")
+            return
+
+        if sub == "set":
+            # `transfers set 4 2` — downloads, then uploads. Node-wide; the
+            # per-member cap is a group's setting and is signed, so it is not
+            # settable from here (see `ops.set_transfer_limits`).
+            values = [v for v in (args.target, args.value) if v]
+            if len(values) != 2:
+                print("usage: meshbay-node transfers set <downloads> <uploads>")
+                sys.exit(1)
+            try:
+                downloads, uploads = int(values[0]), int(values[1])
+            except ValueError:
+                print("error: both values must be whole numbers")
+                sys.exit(1)
+            if downloads < 1 or uploads < 1:
+                print("error: a cap below 1 is not 'unlimited'; it would stop "
+                      "every transfer. Revoke the member instead.")
+                sys.exit(1)
+            out = _daemon_api(cfg, "/api/node-settings", method="PUT",
+                              body={"max_concurrent_downloads": downloads,
+                                    "max_concurrent_uploads": uploads})
+            print(f"downloads: {downloads}, uploads: {uploads} "
+                  f"(applied now, and kept in node.toml)")
+            return
+
+        print("usage: meshbay-node transfers show|set <downloads> <uploads>")
+        sys.exit(1)
+
     if args.command == "file":
         cfg = load_config(args.config or DEFAULT_CONFIG_PATH)
         sub = args.subcommand or "list"
diff --git a/packages/meshbay-node/src/meshbay_node/ops.py b/packages/meshbay-node/src/meshbay_node/ops.py
index 9fcbc21..81b92c7 100644
--- a/packages/meshbay-node/src/meshbay_node/ops.py
+++ b/packages/meshbay-node/src/meshbay_node/ops.py
@@ -1298,6 +1298,8 @@ async def get_node_settings(state: dict) -> dict:
         "pair_ttl_hours": nd.pair_ttl_hours,
         "device_request_ttl_minutes": nd.device_request_ttl_minutes,
         "max_concurrent_streams": nd.max_concurrent_streams,
+        "max_concurrent_downloads": nd.max_concurrent_downloads,
+        "max_concurrent_uploads": nd.max_concurrent_uploads,
         "transcode_incompatible_video": nd.transcode_incompatible_video,
         "stun_servers": nd.stun_servers if nd.stun_servers else list(DEFAULT_STUN_SERVERS),
         "ice_interfaces": nd.ice_interfaces,
@@ -1318,6 +1320,8 @@ async def set_node_settings(state: dict, settings: dict) -> dict:
         "pair_ttl_hours": ("int", roster.SETTING_PAIR_TTL),
         "device_request_ttl_minutes": ("int", roster.SETTING_DEVICE_TTL),
         "max_concurrent_streams": ("int", roster.SETTING_MAX_STREAMS),
+        "max_concurrent_downloads": ("int", roster.SETTING_MAX_DOWNLOADS),
+        "max_concurrent_uploads": ("int", roster.SETTING_MAX_UPLOADS),
         "transcode_incompatible_video": ("bool", roster.SETTING_TRANSCODE),
         "stun_servers": ("stun_list", roster.SETTING_STUN_SERVERS),
         "ice_interfaces": ("list", roster.SETTING_ICE_INTERFACES),
@@ -1393,6 +1397,30 @@ async def set_node_settings(state: dict, settings: dict) -> dict:
 
 # ── Transfers ────────────────────────────────────────────────────────────────
 
+async def set_transfer_limits(state: dict, group_id: str,
+                              downloads: int, uploads: int) -> dict:
+    """How many transfers one member may run at once in this group.
+
+    Same shape as every other operator setting: lives on the node (roster.db,
+    not the hub and not node.toml, for the reason change 5 gives — a hub that
+    decided this would have authority over someone else's machine), signed
+    (webrtc_server checks the caller's admin authority before this runs), and
+    live, so the pools are updated in place rather than at the next restart.
+    """
+    roster = _roster(state)
+    ctx = _group_ctx(state, group_id)
+    limits = await roster.set_transfer_limits(
+        group_id, {"download": downloads, "upload": uploads},
+        set_by=state.get("node_user_id", ""))
+    ctx["transfer_limits"] = limits
+    webrtc = state.get("webrtc")
+    slots = getattr(webrtc, "_ctx", {}).get("_transfer_slots") if webrtc else None
+    granted = slots.set_group_limits(group_id, limits) if slots else []
+    log.info("Transfer limits for group %s: %s (%d started at once)",
+             group_id[:8], limits, len(granted))
+    return {"group_id": group_id, "limits": limits,
+            "started": [x.tr for x in granted]}
+
 async def list_transfers(state: dict) -> dict:
     """Live transfer leases and queue depth.
 
diff --git a/packages/meshbay-node/src/meshbay_node/roster.py b/packages/meshbay-node/src/meshbay_node/roster.py
index 3d3a143..ae0b4cf 100644
--- a/packages/meshbay-node/src/meshbay_node/roster.py
+++ b/packages/meshbay-node/src/meshbay_node/roster.py
@@ -701,6 +701,35 @@ class Roster:
     SETTING_ENABLED_APPS = "enabled_apps"
     DEFAULT_APPS = ("chat", "files")
 
+    # How many transfers one member may run at once in this group. Unset means
+    # the node's default (transfers.DEFAULT_MAX_PER_MEMBER), never "unlimited":
+    # a group that predates this coming back unlimited would leave the
+    # node-wide pool as the only control.
+    SETTING_TRANSFER_LIMITS = "transfer_limits"
+
+    async def transfer_limits(self, group_id: str) -> dict[str, int]:
+        """{"download": n, "upload": n}, or {} when the operator has not said."""
+        value = await self.get_setting(group_id, self.SETTING_TRANSFER_LIMITS)
+        if value is None:
+            return {}
+        try:
+            raw = json.loads(value)
+        except (ValueError, TypeError):
+            return {}
+        out: dict[str, int] = {}
+        for kind in ("download", "upload"):
+            if isinstance(raw.get(kind), int) and raw[kind] >= 1:
+                out[kind] = raw[kind]
+        return out
+
+    async def set_transfer_limits(self, group_id: str, limits: dict[str, int],
+                                  set_by: str = "") -> dict[str, int]:
+        clean = {k: max(1, int(v)) for k, v in limits.items()
+                 if k in ("download", "upload")}
+        await self.set_setting(group_id, self.SETTING_TRANSFER_LIMITS,
+                               json.dumps(clean), set_by)
+        return clean
+
     async def enabled_apps(self, group_id: str) -> list[str]:
         value = await self.get_setting(group_id, self.SETTING_ENABLED_APPS)
         if value is None:
@@ -936,6 +965,8 @@ class Roster:
     SETTING_PAIR_TTL = "pair_ttl_hours"
     SETTING_DEVICE_TTL = "device_request_ttl_minutes"
     SETTING_MAX_STREAMS = "max_concurrent_streams"
+    SETTING_MAX_DOWNLOADS = "max_concurrent_downloads"
+    SETTING_MAX_UPLOADS = "max_concurrent_uploads"
     SETTING_TRANSCODE = "transcode_incompatible_video"
     SETTING_STUN_SERVERS = "stun_servers"
     SETTING_ICE_INTERFACES = "ice_interfaces"
@@ -949,6 +980,8 @@ class Roster:
             ("pair_ttl_hours", self.SETTING_PAIR_TTL),
             ("device_request_ttl_minutes", self.SETTING_DEVICE_TTL),
             ("max_concurrent_streams", self.SETTING_MAX_STREAMS),
+            ("max_concurrent_downloads", self.SETTING_MAX_DOWNLOADS),
+            ("max_concurrent_uploads", self.SETTING_MAX_UPLOADS),
             ("transcode_incompatible_video", self.SETTING_TRANSCODE),
         ]:
             stored = await self.get_setting(self.NODE_WIDE_GROUP_ID, setting)
diff --git a/packages/meshbay-node/src/meshbay_node/transfers.py b/packages/meshbay-node/src/meshbay_node/transfers.py
index 0689ec8..533e985 100644
--- a/packages/meshbay-node/src/meshbay_node/transfers.py
+++ b/packages/meshbay-node/src/meshbay_node/transfers.py
@@ -104,8 +104,13 @@ class TransferSlots:
 
     caps: dict[str, int] = field(
         default_factory=lambda: {k: DEFAULT_MAX_CONCURRENT for k in KINDS})
+    # The node-wide default per member, per kind.
     per_member: dict[str, int] = field(
         default_factory=lambda: {k: DEFAULT_MAX_PER_MEMBER for k in KINDS})
+    # Per-group overrides: {group_id: {kind: n}}. The cap is a group's setting
+    # (its operator signs it), while the pools are the machine's — so this is
+    # the one dimension that is not node-wide, and a lookup rather than a field.
+    group_limits: dict[str, dict[str, int]] = field(default_factory=dict)
     leases: dict[str, Lease] = field(default_factory=dict)
     # FIFO of `tr`, per kind. Order is arrival; a member at their own cap is
     # skipped rather than blocking the head, or one member's limit would stall
@@ -135,10 +140,22 @@ class TransferSlots:
         except ValueError:
             return 0
 
+    def member_cap(self, kind: str, member: tuple[str, str]) -> int:
+        """This member's cap in this group: the group's own, else the default.
+
+        Absent means the default, never "unlimited" — a group that predates the
+        setting coming back unlimited would leave the node-wide cap as the only
+        control, which is the situation slots exist to end.
+        """
+        group_id = member[0]
+        override = self.group_limits.get(group_id, {}).get(kind)
+        if override is not None:
+            return int(override)
+        return self.per_member.get(kind, DEFAULT_MAX_PER_MEMBER)
+
     def _has_room(self, kind: str, member: tuple[str, str]) -> bool:
         # Per-member first: see the module docstring.
-        if self.member_in_use(kind, member) >= self.per_member.get(
-                kind, DEFAULT_MAX_PER_MEMBER):
+        if self.member_in_use(kind, member) >= self.member_cap(kind, member):
             return False
         return self.in_use(kind) < self.caps.get(kind, DEFAULT_MAX_CONCURRENT)
 
@@ -292,6 +309,19 @@ class TransferSlots:
 
     # ── what the operator sees ──────────────────────────────────────────────
 
+    def set_group_limits(self, group_id: str, limits: dict[str, int],
+                         now: float | None = None) -> list[Lease]:
+        """One group's per-member caps, as its operator signed them."""
+        current = dict(self.group_limits.get(group_id, {}))
+        for kind, value in limits.items():
+            if kind in KINDS:
+                current[kind] = max(1, int(value))
+        self.group_limits[group_id] = current
+        granted: list[Lease] = []
+        for kind in KINDS:
+            granted.extend(self._pump(kind, now))
+        return granted
+
     def set_caps(self, *, node: dict[str, int] | None = None,
                  per_member: dict[str, int] | None = None,
                  now: float | None = None) -> list[Lease]:
diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
index 164cc62..fdab53d 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
@@ -70,6 +70,7 @@ from meshbay_common.adminop import (
     OP_MEMBER_UPLOAD,
     OP_APPS_ENABLED,
     OP_SET_SCAN_SETTINGS,
+    OP_TRANSFER_LIMITS,
     OP_TMDB_CONFIG,
     OP_TMDB_ENABLED,
     OP_VIDEO_ROOT,
@@ -565,6 +566,8 @@ class WebRTCPeerSession:
                 self._do_member_upload(msg)
             elif mtype == MNP.APPS_ENABLED:
                 self._do_apps_enabled(msg)
+            elif mtype == MNP.TRANSFER_LIMITS:
+                self._do_transfer_limits(msg)
             elif mtype == MNP.SET_SCAN_SETTINGS:
                 self._do_set_scan_settings(msg)
             elif mtype == MNP.TMDB_CONFIG:
@@ -933,6 +936,19 @@ class WebRTCPeerSession:
             # No `chat_encrypted` beside it: there is no switch. A peer that
             # reached this point speaks MNP 2.0, and 2.0 has no plaintext chat.
             "chat_epoch": int(self._group_ctx().get("chat_epoch", 0) or 0),
+            # This member's own transfer caps in this group, so the interface
+            # can say "2 of 2 of your slots are busy" rather than draw a bare
+            # spinner. Absent reads as "no limit known" and the hint is simply
+            # not drawn — never as "unlimited", which would have the interface
+            # contradicting the node.
+            "transfer_limits": {
+                "download": self._slots().member_cap(
+                    transfers_mod.DOWNLOAD,
+                    (self._group_id or "", self._user_id or "")),
+                "upload": self._slots().member_cap(
+                    transfers_mod.UPLOAD,
+                    (self._group_id or "", self._user_id or "")),
+            },
             # So a client that connects mid-scan shows the indexing state
             # immediately, instead of waiting for the next periodic
             # INDEX_PROGRESS push. Never a path or filename — see
@@ -2715,6 +2731,64 @@ class WebRTCPeerSession:
         self._issue_admin_challenge(
             OP_SET_SCAN_SETTINGS, f"{reconcile:g},{debounce:g}")
 
+    MIN_TRANSFER_LIMIT = 1
+    MAX_TRANSFER_LIMIT = 32
+
+    def _do_transfer_limits(self, msg: dict) -> None:
+        """How many transfers one member may run at once in this group.
+
+        Zero is not "unlimited" and is refused: a member who may not transfer at
+        all is a member the operator revokes, and reading 0 as no-limit would
+        make the most dangerous value the easiest to type by accident.
+        """
+        try:
+            downloads = int(msg.get("downloads"))
+            uploads = int(msg.get("uploads"))
+        except (TypeError, ValueError):
+            self._send({"type": "error", "detail": "Invalid transfer limits"})
+            return
+        for value in (downloads, uploads):
+            if not (self.MIN_TRANSFER_LIMIT <= value <= self.MAX_TRANSFER_LIMIT):
+                self._send({"type": "error",
+                            "detail": f"transfer limits must be between "
+                                      f"{self.MIN_TRANSFER_LIMIT} and "
+                                      f"{self.MAX_TRANSFER_LIMIT}"})
+                return
+        if not self._has_admin_authority():
+            self._send({"type": "error", "detail": "No authorized key for this"})
+            return
+        self._issue_admin_challenge(OP_TRANSFER_LIMITS,
+                                    f"d={downloads},u={uploads}")
+
+    async def _admin_exec_transfer_limits(
+        self, pending: dict, transcript: bytes, sig: bytes,
+    ) -> None:
+        try:
+            parts = dict(p.split("=") for p in pending["subject"].split(","))
+            downloads, uploads = int(parts["d"]), int(parts["u"])
+        except (ValueError, KeyError):
+            self._send({"type": "error", "detail": "Invalid transfer limits"})
+            return
+        if not await self._verify_admin_sig(transcript, sig):
+            self._send({"type": "error", "detail": "Signature verification failed"})
+            self._audit("admin_auth_failed", f"transfer_limits:{pending['subject']}")
+            return
+        try:
+            result = await self._run_op(
+                ops.set_transfer_limits, self._group_id or "", downloads, uploads)
+        except ops.OpError as e:
+            self._send({"type": "error", "detail": e.message})
+            return
+        self._audit("transfer_limits", pending["subject"])
+
+        notice = {"type": MNP.TRANSFER_LIMITS_ACK, "v": MNP_VERSION,
+                  "limits": result["limits"]}
+        for session in list(self._peer_registry().values()):
+            try:
+                session._send(notice)
+            except Exception:
+                pass
+
     async def _admin_exec_set_scan_settings(
         self, pending: dict, transcript: bytes, sig: bytes,
     ) -> None:
@@ -3341,6 +3415,12 @@ class WebRTCPeerSession:
                 slots.caps[transfers_mod.UPLOAD] = int(u)
             self._ctx["_transfer_slots"] = slots
             log.info("transfer: %s", slots.summary())
+        # Refreshed from the group context rather than only at construction: a
+        # node serves several groups, each with its own signed cap, and the
+        # pools are built by whichever group happens to transfer first.
+        limits = self._group_ctx().get("transfer_limits")
+        if limits and self._group_id:
+            slots.group_limits[self._group_id] = dict(limits)
         return slots
 
     def _transfer_state_msg(self, lease, state: str, reason: str = "") -> dict:
@@ -5124,6 +5204,9 @@ class WebRTCPeerSession:
         elif pending["op"] == OP_APPS_ENABLED:
             self._spawn(
                 self._admin_exec_apps_enabled(pending, transcript, sig_bytes))
+        elif pending["op"] == OP_TRANSFER_LIMITS:
+            self._spawn(
+                self._admin_exec_transfer_limits(pending, transcript, sig_bytes))
         elif pending["op"] == OP_SET_SCAN_SETTINGS:
             self._spawn(
                 self._admin_exec_set_scan_settings(pending, transcript, sig_bytes))
@@ -5795,6 +5878,8 @@ class WebRTCTransport:
         denylist: Any | None = None,
         stun_servers: list[str] | None = None,
         max_concurrent_streams: int | None = None,
+        max_concurrent_downloads: int | None = None,
+        max_concurrent_uploads: int | None = None,
         transcode_incompatible_video: bool = True,
     ):
         self._ctx: dict[str, Any] = {
@@ -5807,6 +5892,10 @@ class WebRTCTransport:
             # None means "the operator said nothing" — the default applies. It
             # is read once, when the first stream builds the semaphore.
             "max_concurrent_streams": max_concurrent_streams,
+            # Read once, when the first transfer builds the pools. None means
+            # the operator said nothing and transfers.py's defaults apply.
+            "max_concurrent_downloads": max_concurrent_downloads,
+            "max_concurrent_uploads": max_concurrent_uploads,
             # Operator opt-out (node.toml) for the HEVC-etc. transcode
             # fallback in _stream_video_inner — real CPU cost, unlike copy.
             "transcode_incompatible_video": transcode_incompatible_video,
diff --git a/packages/meshbay-node/tests/test_cli_dispatch.py b/packages/meshbay-node/tests/test_cli_dispatch.py
index 6f43772..87b8550 100644
--- a/packages/meshbay-node/tests/test_cli_dispatch.py
+++ b/packages/meshbay-node/tests/test_cli_dispatch.py
@@ -46,6 +46,11 @@ VERBS = [
     # that no longer takes one.
     ["member", "upload"],
     ["operator", "pair"],
+    ["transfers"],                         # defaults to show
+    ["transfers", "show"],
+    ["transfers", "set", "4", "2"],
+    ["transfers", "set", "4"],             # only one number: usage, then exit
+    ["transfers", "set", "0", "2"],        # zero is not "unlimited": refused
     ["file", "list"],
     ["file", "rm", "abc", "--yes"],
     ["video", "rematch", "--yes"],
diff --git a/packages/meshbay-node/tests/test_transfer_settings.py b/packages/meshbay-node/tests/test_transfer_settings.py
new file mode 100644
index 0000000..79502e7
--- /dev/null
+++ b/packages/meshbay-node/tests/test_transfer_settings.py
@@ -0,0 +1,152 @@
+"""
+The two scopes a transfer cap has, and the rule that they are not the same kind
+of setting.
+
+The **pools** are the machine's: how many transfers this node runs at once,
+across every group, from `[node]` in node.toml with a roster override — the
+§2.11 pattern, changed from the Node page or the CLI, applied live.
+
+The **per-member cap** is a group's: how many one member may run at once here.
+It lives on the node like every other group setting (not the hub, which would
+have authority over someone else's disk; not node.toml, which is hand-written
+and needs a restart), and changing it is a signed operator instruction, because
+an unsigned cap is one any member can raise for themselves.
+
+What is checked here is the seam between the stored value and the pool that
+enforces it — a setting that is written, acknowledged and never read is the
+shape of the bug this whole branch started from (`webrtc._stream_sem`).
+"""
+
+import pytest
+
+from meshbay_node.roster import Roster
+from meshbay_node.transfers import (
+    DEFAULT_MAX_PER_MEMBER, DOWNLOAD, UPLOAD, TransferSlots,
+)
+
+
+@pytest.fixture
+async def roster(tmp_path):
+    r = Roster(db_path=tmp_path / "roster.db")
+    await r.open()
+    yield r
+    await r.close()
+
+
+# ── the group's own cap ─────────────────────────────────────────────────────
+
+@pytest.mark.asyncio
+async def test_absent_means_the_default_not_unlimited(roster):
+    """A group that predates the setting must not come back unlimited: the
+    node-wide pool would then be the only control, which is the situation slots
+    exist to end."""
+    assert await roster.transfer_limits("g1") == {}
+    slots = TransferSlots()
+    assert slots.member_cap(DOWNLOAD, ("g1", "alice")) == DEFAULT_MAX_PER_MEMBER
+
+
+@pytest.mark.asyncio
+async def test_the_cap_survives_a_restart(roster, tmp_path):
+    await roster.set_transfer_limits("g1", {"download": 4, "upload": 1},
+                                     set_by="op")
+    await roster.close()
+    reopened = Roster(db_path=tmp_path / "roster.db")
+    await reopened.open()
+    try:
+        assert await reopened.transfer_limits("g1") == {"download": 4,
+                                                        "upload": 1}
+    finally:
+        await reopened.close()
+
+
+@pytest.mark.asyncio
+async def test_one_group_does_not_set_anothers(roster):
+    await roster.set_transfer_limits("g1", {"download": 5}, set_by="op")
+    assert await roster.transfer_limits("g2") == {}
+
+
+@pytest.mark.asyncio
+async def test_a_stored_zero_never_becomes_a_cap_of_zero(roster):
+    """Zero is not "unlimited" and must not be "nobody may transfer" either.
+    Whatever reaches storage, the floor is one."""
+    await roster.set_transfer_limits("g1", {"download": 0}, set_by="op")
+    assert (await roster.transfer_limits("g1"))["download"] == 1
+
+
+@pytest.mark.asyncio
+async def test_rubbish_in_the_row_reads_as_unset(roster):
+    """A row this code did not write must not take a group's transfers down —
+    the same "a payload that does not open ends nothing silently" discipline
+    the sealed messages follow."""
+    await roster.set_setting("g1", Roster.SETTING_TRANSFER_LIMITS,
+                             "not json", "op")
+    assert await roster.transfer_limits("g1") == {}
+
+
+# ── the pool that enforces it ───────────────────────────────────────────────
+
+def test_a_group_cap_overrides_the_node_default():
+    slots = TransferSlots()
+    slots.set_group_limits("strict", {DOWNLOAD: 1})
+    assert slots.member_cap(DOWNLOAD, ("strict", "alice")) == 1
+    assert slots.member_cap(DOWNLOAD, ("other", "alice")) == DEFAULT_MAX_PER_MEMBER
+    assert slots.member_cap(UPLOAD, ("strict", "alice")) == DEFAULT_MAX_PER_MEMBER, (
+        "setting the download cap must not silently change the upload one")
+
+
+def test_the_group_cap_is_what_queues_a_member():
+    slots = TransferSlots()
+    slots.set_group_limits("strict", {DOWNLOAD: 1})
+    args = dict(kind=DOWNLOAD, session_key="s1", user_id="alice",
+                group_id="strict")
+    assert slots.open(tr="t1", **args)[0].state == "granted"
+    assert slots.open(tr="t2", **args)[0].state == "queued"
+
+
+def test_raising_a_group_cap_starts_what_was_waiting():
+    slots = TransferSlots()
+    slots.set_group_limits("g1", {DOWNLOAD: 1})
+    args = dict(kind=DOWNLOAD, session_key="s1", user_id="alice", group_id="g1")
+    slots.open(tr="t1", **args)
+    slots.open(tr="t2", **args)
+    granted = slots.set_group_limits("g1", {DOWNLOAD: 3})
+    assert [x.tr for x in granted] == ["t2"], (
+        "the cap was raised and the waiting transfer was left waiting")
+
+
+def test_one_groups_cap_does_not_move_anothers_queue():
+    slots = TransferSlots()
+    slots.set_group_limits("g1", {DOWNLOAD: 1})
+    slots.set_group_limits("g2", {DOWNLOAD: 1})
+    for g in ("g1", "g2"):
+        args = dict(kind=DOWNLOAD, session_key=f"s-{g}", user_id="alice",
+                    group_id=g)
+        slots.open(tr=f"{g}-1", **args)
+        slots.open(tr=f"{g}-2", **args)
+    granted = slots.set_group_limits("g1", {DOWNLOAD: 2})
+    assert [x.tr for x in granted] == ["g1-2"]
+    assert slots.leases["g2-2"].state == "queued"
+
+
+# ── the node-wide pools ─────────────────────────────────────────────────────
+
+@pytest.mark.asyncio
+async def test_the_node_wide_caps_round_trip_through_the_roster(roster):
+    defaults = {"max_concurrent_downloads": 8, "max_concurrent_uploads": 8}
+    assert await roster.node_settings(defaults) == {
+        **{k: v for k, v in defaults.items()},
+        **{k: None for k in ("invite_ttl_hours", "pair_ttl_hours",
+                             "device_request_ttl_minutes",
+                             "max_concurrent_streams",
+                             "transcode_incompatible_video")},
+        "stun_servers": [], "ice_interfaces": [],
+    }
+    await roster.set_node_setting(roster.SETTING_MAX_DOWNLOADS, "3", "op")
+    assert (await roster.node_settings(defaults))["max_concurrent_downloads"] == 3
+
+
+def test_node_toml_carries_both_keys():
+    """The template is what an operator reads before they read any document."""
+    from meshbay_node.config import EXAMPLE_CONFIG as tpl
+    assert "max_concurrent_downloads" in tpl
+    assert "max_concurrent_uploads" in tpl
-- 
cgit v1.2.3


From 1a495f5ed3f8a55222d406152c833882264dc377 Mon Sep 17 00:00:00 2001
From: Christophe Besson <cbesson@gmail.com>
Date: Tue, 8 Sep 2026 22:54:16 +0200
Subject: feat(hub): client-side transfer leases and the transfers panel
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Steps 5 and 6 of ~/next/improve-downloads.md. The node has handed out slots
since step 2 and nothing asked for one; now the client does, and the panel shows
what is happening.

`transport.openTransfer()` returns a Lease: `acquire()` resolves when the node
grants, `release()` gives it back exactly once, and nothing else in the client
speaks to the node about slots. Whether a node hands out slots is read from the
handshake ack rather than guessed from a timeout — "no answer yet" and "this
node will never answer" are indistinguishable in time, and guessing wrong either
stalls every download or defeats the cap.

Two things exist only because a queue can lie: a watchdog re-asks when a pushed
grant does not arrive (the node is idempotent on `tr`, so asking again is free),
and a grant for a transfer the page has forgotten is handed straight back rather
than held until the node's deadline.

The slot is asked for **after** there is somewhere to write, and that ordering
is load-bearing: opening a target takes thirty seconds of streamed-download
timeouts, or as long as somebody leaves a Save As dialog open, and a grant not
taken up in time is revoked. Moving it earlier looked better and broke three
downloads into one. Pinned by a test.

The panel groups by state — running, waiting, finished — rather than re-sorting a
flat list, so a row moves only when its own state does. The ETA is withheld until
the speed window holds real measurement: a figure from the first two chunks
swings between four seconds and an hour, and people plan around the first number
they see. One live region announces state changes and not progress.

Three silent paths closed on the way: a download refused for want of a user
gesture (a browser grants one file picker per gesture, and downloading three
files is one gesture) now falls back to the streamed path, which needs none; a
click with no connection says so instead of doing nothing at all; and a queued
transfer counts as busy, so a transport is never closed under one that is
waiting for a grant that could then never arrive.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HCGdheDLxGReuKHga3BtST
---
 packages/meshbay-hub/src/meshbay_hub/static/app.js | 173 ++++++++++++-----
 .../src/meshbay_hub/static/file-utils.js           |  96 ++++++++--
 .../src/meshbay_hub/static/files-app.js            |  14 +-
 .../src/meshbay_hub/static/group-page.js           |   7 +-
 .../src/meshbay_hub/static/locales/de.js           |  12 ++
 .../src/meshbay_hub/static/locales/en.js           |  12 ++
 .../src/meshbay_hub/static/locales/es.js           |  12 ++
 .../src/meshbay_hub/static/locales/fr.js           |  12 ++
 .../src/meshbay_hub/static/locales/it.js           |  12 ++
 .../src/meshbay_hub/static/locales/ja.js           |  12 ++
 .../src/meshbay_hub/static/locales/nl.js           |  12 ++
 .../src/meshbay_hub/static/locales/pl.js           |  12 ++
 .../src/meshbay_hub/static/locales/pt-BR.js        |  12 ++
 .../src/meshbay_hub/static/locales/zh-CN.js        |  12 ++
 .../meshbay-hub/src/meshbay_hub/static/style.css   |  64 +++++++
 .../src/meshbay_hub/static/transfers.js            | 105 +++++++++-
 .../src/meshbay_hub/static/transport.js            | 213 ++++++++++++++++++++-
 packages/meshbay-hub/tests/test_layout_measured.py | 119 +++++++++++-
 packages/meshbay-hub/tests/test_memory_ceiling.py  |  36 +++-
 packages/meshbay-hub/tests/test_transfers.py       | 213 +++++++++++++++++++++
 packages/meshbay-hub/tests/test_zip_size_limit.py  |  12 +-
 21 files changed, 1090 insertions(+), 82 deletions(-)

(limited to 'packages/meshbay-hub/src/meshbay_hub/static/locales/de.js')

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/app.js b/packages/meshbay-hub/src/meshbay_hub/static/app.js
index 9d64292..ff066cf 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/app.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/app.js
@@ -4,7 +4,7 @@ import {
 } from './vendor/htm-preact.js';
 import { t, getLocale, setLocale, initLocale, LOCALES } from './i18n.js';
 import { ZipStream, entriesUnder } from './zipstream.js';
-import { transfers, formatSpeed } from './transfers.js';
+import { transfers, formatSpeed, etaSeconds } from './transfers.js';
 import * as platform from './platform.js';
 import * as downloads from './downloads.js';
 import { Icon } from './icon.js';
@@ -157,69 +157,67 @@ function TransferWidget() {
   }, [open]);
 
   const running = items.filter(i => i.status === 'running');
+  const waiting = items.filter(i => i.status === 'queued');
+  const finished = items.filter(
+    i => i.status !== 'running' && i.status !== 'queued');
+  const active = running.length + waiting.length;
+
+  // Grouped, and in this order: what is moving, what is waiting, what is over.
+  // Re-sorting the flat list on every emit made rows jump under the pointer
+  // each time a neighbour finished — the group is what changes, not the
+  // position within it, so a row only moves when its own state does.
+  const groups = [
+    ['running', running],
+    ['waiting', waiting],
+    ['finished', finished],
+  ].filter(([, rows]) => rows.length);
+
   if (!items.length) return null;
 
   return html`
     <div class="transfer-wrap" ref=${ref}>
       <button class="nav-notif transfer-btn ${running.length ? 'active' : ''}"
+        aria-label=${t('transfers.title')}
+        aria-expanded=${open ? 'true' : 'false'}
         title=${t('transfers.title')}
         onClick=${(e) => { e.stopPropagation(); setOpen(o => !o); }}>
         <${Icon} name="transfer" />
-        ${running.length > 0 && html`
-          <span class="notif-badge">${running.length}</span>
+        ${active > 0 && html`
+          <span class="notif-badge">${active}</span>
         `}
       </button>
+      ${/* One live region for the panel, announcing what changed state rather
+            than every progress tick — a reader that says "62%… 63%… 64%" for a
+            four-gigabyte film is a reader nobody leaves on. */''}
+      <span class="sr-only" aria-live="polite">
+        ${t('transfers.summary', { running: running.length, waiting: waiting.length })}
+      </span>
       ${open && html`
-        <div class="transfer-panel">
+        <div class="transfer-panel" role="group"
+          aria-label=${t('transfers.title')}>
           <div class="transfer-head">
-            ${t('transfers.title')}
-            <button class="btn-secondary"
-              onClick=${() => transfers.clearFinished()}>
-              ${t('transfers.clear')}
-            </button>
+            <span class="transfer-head-title">${t('transfers.title')}</span>
+            ${active > 0 && html`
+              <span class="transfer-head-summary">
+                ${t('transfers.summary', {
+                  running: running.length, waiting: waiting.length })}
+              </span>
+            `}
+            ${finished.length > 0 && html`
+              <button class="btn-secondary"
+                onClick=${() => transfers.clearFinished()}>
+                ${t('transfers.clear')}
+              </button>
+            `}
           </div>
-          ${items.map(it => html`
-            <div class="transfer-item" key=${it.id}>
-              <div class="transfer-line">
-                <span class="transfer-kind">
-                  <${Icon} name=${it.kind === 'upload' ? 'upload' : 'download'} />
-                </span>
-                ${it.canOpen
-                  ? html`<a class="transfer-name" href="#" title=${it.name}
-                      onClick=${(e) => { e.preventDefault(); transfers.open(it.id); }}>${it.name}</a>`
-                  : html`<span class="transfer-name" title=${it.name}>${it.name}</span>`}
-                ${it.status === 'running' && html`
-                  <button class="transfer-cancel" title=${t('transfers.cancel')}
-                    onClick=${() => transfers.cancel(it.id)}>
-                    <${Icon} name="close" />
-                  </button>
-                `}
-              </div>
-              ${it.status === 'running'
-                ? html`
-                  <div class="dl-progress">
-                    <div class="dl-fill" style="width:${it.percent}%"></div>
-                  </div>
-                  <div class="transfer-meta">
-                    <span>${formatSize(it.done)}${it.total
-                      ? ' / ' + formatSize(it.total) : ''}</span>
-                    <span>${formatSpeed(it.speed)}</span>
-                  </div>
-                `
-                : html`
-                  <div class="transfer-meta">
-                    <span class=${it.status === 'failed' ? 'transfer-failed' : ''}>
-                      ${it.status === 'done' ? t('transfers.done')
-                        : it.status === 'cancelled' ? t('transfers.cancelled')
-                        : it.error || t('transfers.failed')}
-                    </span>
-                    ${it.canOpen && html`
-                      <button class="link-btn" onClick=${() => transfers.open(it.id)}>
-                        ${t('transfers.open')}
-                      </button>
-                    `}
-                  </div>
-                `}
+          ${groups.map(([label, rows]) => html`
+            <div class="transfer-group" key=${label}>
+              ${groups.length > 1 && html`
+                <div class="transfer-group-head">
+                  ${t('transfers.group_' + label, { n: rows.length })}
+                </div>
+              `}
+              ${rows.map(it => html`<${TransferRow} it=${it} key=${it.id} />`)}
             </div>
           `)}
         </div>
@@ -228,6 +226,79 @@ function TransferWidget() {
   `;
 }
 
+/** One row. Split out so the panel above reads as a layout and this as a state
+ *  machine — they change for different reasons. */
+function TransferRow({ it }) {
+  const eta = etaSeconds(it);
+  return html`
+    <div class="transfer-item transfer-${it.status}">
+      <div class="transfer-line">
+        <span class="transfer-kind" aria-hidden="true">
+          <${Icon} name=${it.kind === 'upload' ? 'upload' : 'download'} />
+        </span>
+        ${it.canOpen
+          ? html`<a class="transfer-name" href="#" title=${it.name}
+              onClick=${(e) => { e.preventDefault(); transfers.open(it.id); }}>${it.name}</a>`
+          : html`<span class="transfer-name" title=${it.name}>${it.name}</span>`}
+        ${(it.status === 'running' || it.status === 'queued') && html`
+          <button class="transfer-cancel"
+            aria-label=${t('transfers.cancel_one', { name: it.name })}
+            title=${t('transfers.cancel')}
+            onClick=${() => transfers.cancel(it.id)}>
+            <${Icon} name="close" />
+          </button>
+        `}
+      </div>
+      ${it.status === 'queued'
+        ? html`
+          <div class="dl-progress dl-waiting"></div>
+          <div class="transfer-meta">
+            <span>${it.queuedByOwnLimit
+              ? t('transfers.waiting_own_slots')
+              : t('transfers.waiting_node', { n: it.ahead })}</span>
+            <span>${formatSize(it.total)}</span>
+          </div>
+        `
+        : it.status === 'running'
+        ? html`
+          <div class="dl-progress" role="progressbar"
+            aria-valuenow=${it.percent} aria-valuemin="0" aria-valuemax="100">
+            <div class="dl-fill" style="width:${it.percent}%"></div>
+          </div>
+          <div class="transfer-meta">
+            <span>${formatSize(it.done)}${it.total
+              ? ' / ' + formatSize(it.total) : ''}</span>
+            <span>${[formatSpeed(it.speed),
+                     it.settled && eta !== null ? formatEta(eta) : '']
+                     .filter(Boolean).join(' · ')}</span>
+          </div>
+        `
+        : html`
+          <div class="transfer-meta">
+            <span class=${it.status === 'failed' ? 'transfer-failed' : ''}>
+              ${it.status === 'done' ? t('transfers.done')
+                : it.status === 'cancelled' ? t('transfers.cancelled')
+                : it.error || t('transfers.failed')}
+            </span>
+            ${it.canOpen && html`
+              <button class="link-btn" onClick=${() => transfers.open(it.id)}>
+                ${t('transfers.open')}
+              </button>
+            `}
+          </div>
+        `}
+    </div>
+  `;
+}
+
+/** "4 min left". Coarse on purpose: a per-second countdown on a transfer whose
+ *  speed varies is a number that is wrong most of the time and looks precise. */
+function formatEta(seconds) {
+  if (seconds < 60) return t('transfers.eta_seconds', { n: Math.ceil(seconds) });
+  if (seconds < 3600) return t('transfers.eta_minutes', { n: Math.round(seconds / 60) });
+  return t('transfers.eta_hours', { n: Math.round(seconds / 360) / 10 });
+}
+
 // ── Nav ──────────────────────────────────────────────────────────────────────
 
 function Nav({ user, theme, onThemeChange, onLogout, onMenuToggle, unreadCount,
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/file-utils.js b/packages/meshbay-hub/src/meshbay_hub/static/file-utils.js
index a942fd5..61002d6 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/file-utils.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/file-utils.js
@@ -164,6 +164,25 @@ async function _openDownloadTarget(filename, size = 0, pickerOpts = {},
     return { writable: await handle.createWritable(), name: handle.name || filename };
   } catch (err) {
     if (err.name === 'AbortError') return false;
+    // "Must be handling a user gesture to show a file picker."
+    //
+    // A browser grants one picker per gesture, and downloading three files is
+    // one gesture. So the second and third throw this, and the person sees a
+    // failed transfer with a message from Chrome about gestures, for having
+    // done something entirely reasonable.
+    //
+    // The streamed path needs no gesture at all, which makes it the right
+    // answer here rather than a consolation: the file still lands on disk, in
+    // the browser's own download folder, written as it arrives. Only the choice
+    // of folder is lost, and it was already lost — there was no picker to make
+    // it in.
+    if (err.name === 'SecurityError' || /user gesture/i.test(err.message || '')) {
+      console.warn('[MeshBay] no gesture left for a save dialog; streaming '
+                   + 'this one to the download folder instead');
+      const streamed = await downloads.openStreamedDownload(filename, swSize);
+      if (streamed) return streamed;
+      if (size <= MEMORY_CEILING) return _memoryFloor();
+    }
     throw err;
   }
 }
@@ -193,17 +212,47 @@ function _saveBlob(blob, filename) {
 const CHUNK_RETRY_ATTEMPTS = 6;
 const CHUNK_RETRY_DELAY_MS = 1500;
 
+// How long one megabyte may take to reach the disk before we call it stuck.
+//
+// Every other await on this path is bounded and says so when it expires:
+// `_sendAndWait` logs a Response timeout, `_fetchChunkResilient` retries and
+// then throws. `writable.write()` was the exception — a sink that stops
+// consuming (a service-worker stream the browser has stopped reading, a file
+// handle that has gone away) leaves it pending for ever. It never rejects, so
+// there is no error, no log and no failed transfer: the progress bar simply
+// stops, the console stays empty, and the node is perfectly healthy the whole
+// time, which is what made this invisible.
+//
+// Generous on purpose. A megabyte takes milliseconds on any working sink; a
+// minute means the sink is gone, not slow.
+const WRITE_STALL_MS = 60000;
+
+/** `writable.write`, but it fails instead of hanging for ever. */
+async function _writeOrStall(writable, bytes, at) {
+  let timer = 0;
+  const stalled = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(new Error(
+      t('group.download_write_stalled', { seconds: WRITE_STALL_MS / 1000 })
+      + ` (chunk ${at})`)), WRITE_STALL_MS);
+  });
+  try {
+    await Promise.race([writable.write(bytes), stalled]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
 function _isRetryableTransportError(err) {
   return err.name === 'TransportLostError'
     || err.message === 'Response timeout'
     || (err.message || '').startsWith('DataChannel not open');
 }
 
-async function _fetchChunkResilient(transport, fileId, index) {
+async function _fetchChunkResilient(transport, fileId, index, tr = '') {
   let lastErr;
   for (let attempt = 0; attempt < CHUNK_RETRY_ATTEMPTS; attempt++) {
     try {
-      return await transport.fetchChunk(fileId, index);
+      return await transport.fetchChunk(fileId, index, tr);
     } catch (err) {
       if (!_isRetryableTransportError(err)) throw err;
       lastErr = err;
@@ -216,14 +265,14 @@ async function _fetchChunkResilient(transport, fileId, index) {
 }
 
 async function pipelinedDownload(transport, gekKey, fileId, totalChunks, onChunk,
-                                 writable, signal) {
+                                 writable, signal, tr = '') {
   const results = writable ? null : new Array(totalChunks);
   let nextSend = 0, nextRecv = 0;
   const inflight = new Array(totalChunks);
 
   const fire = () => {
     while (nextSend < totalChunks && nextSend - nextRecv < PIPELINE_WINDOW) {
-      inflight[nextSend] = _fetchChunkResilient(transport, fileId, nextSend);
+      inflight[nextSend] = _fetchChunkResilient(transport, fileId, nextSend, tr);
       nextSend++;
     }
   };
@@ -254,7 +303,7 @@ async function pipelinedDownload(transport, gekKey, fileId, totalChunks, onChunk
     const plaintext = await window.MeshBayCrypto.decryptChunkBin(
       gekKey, fileId, nextRecv, chunkMsg.nonce, chunkMsg.ct);
     if (writable) {
-      await writable.write(plaintext);
+      await _writeOrStall(writable, plaintext, nextRecv);
     } else {
       results[nextRecv] = plaintext;
     }
@@ -272,6 +321,20 @@ async function pipelinedDownload(transport, gekKey, fileId, totalChunks, onChunk
  * download button — both just want "get this entry to disk".
  */
 async function downloadEntry(transfers, transport, gek, entry) {
+  // The target FIRST, then the slot — and that order is load-bearing.
+  //
+  // Asking for the slot first looks better (the widget could draw a row while
+  // the target is being chosen) and is wrong: a granted slot has to be taken up
+  // within the node's acceptance deadline, and opening a target can take thirty
+  // seconds of streamed-download timeouts, or as long as somebody leaves a Save
+  // As dialog open. The node then revokes the grant and passes it to the next
+  // in the queue — `transfer: reclaimed … (not_taken_up)` in its log — and this
+  // download starts fetching under a `tr` that is no longer granted.
+  //
+  // Measured, not reasoned: three downloads started, one arrived, and the
+  // node's log named the reason. Do not move this again without moving the
+  // deadline, and the deadline exists so a client that dies between asking and
+  // starting does not hold a slot nobody can use.
   let target;
   try {
     target = await _openDownloadTarget(entry.name, entry.size);
@@ -289,21 +352,25 @@ async function downloadEntry(transfers, transport, gek, entry) {
   if (target === false) return;          // the picker was dismissed
 
   const openRef = { url: null };
+  const totalChunks = Math.ceil(entry.size / CHUNK_SIZE);
   transfers.start({
     kind: 'download', name: (target && target.name) || entry.name,
     total: entry.size, transport,
+    // Asked for here, once there is somewhere to write: see the note above.
+    lease: transport.openTransfer({
+      kind: 'download', bytes: entry.size, chunks: totalChunks }),
     open: target
       ? (target.open || null)
       : () => { if (openRef.url) window.open(openRef.url, '_blank'); },
-    run: async ({ signal, onProgress }) => {
-      const totalChunks = Math.ceil(entry.size / CHUNK_SIZE);
+    run: async ({ signal, onProgress, lease }) => {
       let done = 0;
       const onChunk = (bytes) => { done += bytes; onProgress(done, entry.size); };
 
       if (target) {
         try {
           await pipelinedDownload(transport, gek, entry.id, totalChunks,
-                                  onChunk, target.writable, signal);
+                                  onChunk, target.writable, signal,
+                                  lease && lease.tr);
           await target.writable.close();
         } catch (err) {
           await target.writable.abort().catch(() => {});
@@ -311,7 +378,8 @@ async function downloadEntry(transfers, transport, gek, entry) {
         }
       } else {
         const chunks = await pipelinedDownload(
-          transport, gek, entry.id, totalChunks, onChunk, null, signal);
+          transport, gek, entry.id, totalChunks, onChunk, null, signal,
+          lease && lease.tr);
         const blob = new Blob(chunks);
         _saveBlob(blob, entry.name);
         openRef.url = URL.createObjectURL(blob);
@@ -391,10 +459,15 @@ async function downloadDirectory(transfers, transport, gek, entries, dir, { setE
   transfers.start({
     kind: 'download', name: (target && target.name) || suggested,
     total: totalBytes, transport,
+    // **One** lease for the archive, not one per file. Dozens of leases for a
+    // folder would deadlock against the member's own cap: the job cannot finish
+    // until it holds them all, and it can never hold more than two.
+    lease: transport.openTransfer({
+      kind: 'download', bytes: totalBytes, chunks: files.length }),
     open: target
       ? (target.open || null)
       : () => { if (zipOpenRef.url) window.open(zipOpenRef.url, '_blank'); },
-    run: async ({ signal, onProgress }) => {
+    run: async ({ signal, onProgress, lease }) => {
       const writable = target ? target.writable : null;
       const parts = writable ? null : [];
       let written = 0;
@@ -414,7 +487,8 @@ async function downloadDirectory(transfers, transport, gek, entries, dir, { setE
             transport, gek, entry.id, totalChunks,
             (bytes) => { written += bytes; onProgress(written, totalBytes); },
             // pipelinedDownload writes in order, which the archive needs.
-            { write: (plaintext) => zip.write(plaintext) }, signal);
+            { write: (plaintext) => zip.write(plaintext) }, signal,
+            lease && lease.tr);
           await zip.end();
         }
         await zip.finish();
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/files-app.js b/packages/meshbay-hub/src/meshbay_hub/static/files-app.js
index 36c5af3..fb9d801 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/files-app.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/files-app.js
@@ -66,7 +66,15 @@ function FilesPanel({
       transport = transportRef.current;
       gek = gekRef.current;
     }
-    if (!transport || !transport.connected) return;
+    // Never a silent return. A click that produces nothing at all — no
+    // transfer, no icon, no message — is indistinguishable from a broken
+    // button, and it is what a download looks like whenever the WebRTC
+    // connection is not up: on a screen lock, mid-reconnect, or after the node
+    // restarted. Say so instead.
+    if (!transport || !transport.connected) {
+      setError(t('group.download_offline'));
+      return;
+    }
     await downloadEntry(transfers, transport, gek, entry);
   }, [getTransport]);
 
@@ -86,13 +94,15 @@ function FilesPanel({
     for (const file of files) {
       transfers.start({
         kind: 'upload', name: file.name, total: file.size, transport,
-        run: async ({ signal, onProgress }) => {
+        lease: transport.openTransfer({ kind: 'upload', bytes: file.size }),
+        run: async ({ signal, onProgress, lease }) => {
           await transport.uploadFile(file, {
             // Bytes the node acknowledged, not bytes read locally.
             onProgress: (sent) => onProgress(sent, file.size),
             signal,
             root: uploadRoot,
             dir: uploadDir,
+            tr: lease && lease.tr,
           });
           // The node re-indexes on a filesystem event, so there is nothing to
           // wait on but the clock. Refreshing here means the file appears in
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/group-page.js b/packages/meshbay-hub/src/meshbay_hub/static/group-page.js
index 6f41426..c6748f2 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/group-page.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/group-page.js
@@ -553,7 +553,12 @@ function GroupPage({ groupId, group, token, username, userId, userPrefs,
     // toolbar actions call the same shared helper from files-app.js, since
     // only a single open file/video is ever in play here.
     const transport = transportRef.current;
-    if (!transport || !transport.connected) return;
+    if (!transport || !transport.connected) {
+      // Same reasoning as files-app.js's downloadFile: a click that does
+      // nothing at all is worse than a refusal.
+      setError(t('group.download_offline'));
+      return;
+    }
     await downloadEntry(transfers, transport, gekRef.current, entry);
   }, []);
 
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
index 8ed1ef0..f5c0c78 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
@@ -162,6 +162,8 @@ export default {
   'group.mkdir': 'Neuer Ordner',
   'group.mkdir_prompt': 'Name des neuen Ordners',
   'group.mkdir_offline': 'Nicht mit dem Node verbunden.',
+  'group.download_offline': 'Keine Verbindung zum Node — der Download kann nicht starten. Die Verbindung wird automatisch wiederhergestellt; versuchen Sie es gleich erneut.',
+  'group.download_write_stalled': 'Die Datei wird nicht mehr auf die Festplatte geschrieben ({seconds} s ohne Fortschritt). Der Download wurde abgebrochen statt hängen gelassen; versuchen Sie es erneut.',
   'device.add_title': 'This browser is not linked to this node yet',
   'device.add_hint': 'Your account is known here, but this browser holds a different key. Approve it from a device already linked — no operator needed.',
   'device.add_btn': 'Get a linking code',
@@ -576,6 +578,16 @@ export default {
   'transfers.open': 'Öffnen',
   'transfers.done': 'Abgeschlossen',
   'transfers.cancelled': 'Abgebrochen',
+  'transfers.waiting_own_slots': 'Wartet — Ihre Plätze sind belegt',
+  'transfers.waiting_node': 'Wartet — {n} davor',
+  'transfers.summary': '{running} laufend · {waiting} wartend',
+  'transfers.group_running': 'Laufend',
+  'transfers.group_waiting': 'Wartend',
+  'transfers.group_finished': 'Abgeschlossen',
+  'transfers.cancel_one': '{name} abbrechen',
+  'transfers.eta_seconds': 'noch {n} s',
+  'transfers.eta_minutes': 'noch {n} Min.',
+  'transfers.eta_hours': 'noch {n} Std.',
   'transfers.failed': 'Fehlgeschlagen',
   'group.select': 'Auswählen',
   'group.select_done': 'Fertig',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
index 285ff7a..e3ed844 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
@@ -162,6 +162,8 @@ export default {
   'group.mkdir': 'New folder',
   'group.mkdir_prompt': 'New folder name',
   'group.mkdir_offline': 'Not connected to the node.',
+  'group.download_offline': 'Not connected to the node — the download cannot start. It reconnects on its own; try again in a moment.',
+  'group.download_write_stalled': 'The file stopped being written to disk ({seconds}s with no progress). The download was stopped rather than left hanging; try it again.',
   'device.add_title': 'This browser is not linked to this node yet',
   'device.add_hint': 'Your account is known here, but this browser holds a different key. Approve it from a device already linked — no operator needed.',
   'device.add_btn': 'Get a linking code',
@@ -692,6 +694,16 @@ export default {
   'transfers.open': 'Open',
   'transfers.done': 'Finished',
   'transfers.cancelled': 'Cancelled',
+  'transfers.waiting_own_slots': 'Waiting — your slots are busy',
+  'transfers.waiting_node': 'Waiting — {n} ahead',
+  'transfers.summary': '{running} running · {waiting} waiting',
+  'transfers.group_running': 'Running',
+  'transfers.group_waiting': 'Waiting',
+  'transfers.group_finished': 'Finished',
+  'transfers.cancel_one': 'Cancel {name}',
+  'transfers.eta_seconds': '{n}s left',
+  'transfers.eta_minutes': '{n} min left',
+  'transfers.eta_hours': '{n} h left',
   'transfers.failed': 'Failed',
   'group.select': 'Select',
   'group.select_done': 'Done',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
index f74c763..c509599 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
@@ -160,6 +160,8 @@ export default {
   'group.mkdir': 'Nueva carpeta',
   'group.mkdir_prompt': 'Nombre de la nueva carpeta',
   'group.mkdir_offline': 'Sin conexión con el nodo.',
+  'group.download_offline': 'Sin conexión con el nodo — la descarga no puede empezar. Se reconecta sola; inténtelo de nuevo en un momento.',
+  'group.download_write_stalled': 'El archivo dejó de escribirse en el disco ({seconds} s sin avance). La descarga se detuvo en lugar de quedarse colgada; inténtelo de nuevo.',
   'device.add_title': 'This browser is not linked to this node yet',
   'device.add_hint': 'Your account is known here, but this browser holds a different key. Approve it from a device already linked — no operator needed.',
   'device.add_btn': 'Get a linking code',
@@ -572,6 +574,16 @@ export default {
   'transfers.open': 'Abrir',
   'transfers.done': 'Terminada',
   'transfers.cancelled': 'Cancelada',
+  'transfers.waiting_own_slots': 'En espera — sus espacios están ocupados',
+  'transfers.waiting_node': 'En espera — {n} por delante',
+  'transfers.summary': '{running} en curso · {waiting} en espera',
+  'transfers.group_running': 'En curso',
+  'transfers.group_waiting': 'En espera',
+  'transfers.group_finished': 'Finalizados',
+  'transfers.cancel_one': 'Cancelar {name}',
+  'transfers.eta_seconds': 'quedan {n} s',
+  'transfers.eta_minutes': 'quedan {n} min',
+  'transfers.eta_hours': 'quedan {n} h',
   'transfers.failed': 'Fallida',
   'group.select': 'Seleccionar',
   'group.select_done': 'Listo',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
index 0c5103f..49a1071 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
@@ -161,6 +161,8 @@ export default {
   'group.mkdir': 'Nouveau dossier',
   'group.mkdir_prompt': 'Nom du nouveau dossier',
   'group.mkdir_offline': 'Non connecté au nœud.',
+  'group.download_offline': 'Pas de connexion au node — le téléchargement ne peut pas démarrer. La reconnexion est automatique, réessayez dans un instant.',
+  'group.download_write_stalled': 'L\'écriture du fichier sur le disque s\'est arrêtée ({seconds} s sans progression). Le téléchargement a été interrompu plutôt que laissé en suspens ; réessayez.',
   'device.add_title': 'Ce navigateur n’est pas encore lié à ce nœud',
   'device.add_hint': 'Votre compte est connu ici, mais ce navigateur détient une autre clé. Approuvez-le depuis un appareil déjà lié — sans passer par l’opérateur.',
   'device.add_btn': 'Obtenir un code de liaison',
@@ -575,6 +577,16 @@ export default {
   'transfers.open': 'Ouvrir',
   'transfers.done': 'Terminé',
   'transfers.cancelled': 'Annulé',
+  'transfers.waiting_own_slots': 'En attente — vos slots sont occupés',
+  'transfers.waiting_node': 'En attente — {n} devant',
+  'transfers.summary': '{running} en cours · {waiting} en attente',
+  'transfers.group_running': 'En cours',
+  'transfers.group_waiting': 'En attente',
+  'transfers.group_finished': 'Terminés',
+  'transfers.cancel_one': 'Annuler {name}',
+  'transfers.eta_seconds': '{n} s restantes',
+  'transfers.eta_minutes': '{n} min restantes',
+  'transfers.eta_hours': '{n} h restantes',
   'transfers.failed': 'Échec',
   'group.select': 'Sélectionner',
   'group.select_done': 'Terminé',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
index ebac541..8f1ef1e 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
@@ -161,6 +161,8 @@ export default {
   'group.mkdir': 'Nuova cartella',
   'group.mkdir_prompt': 'Nome della nuova cartella',
   'group.mkdir_offline': 'Non connesso al nodo.',
+  'group.download_offline': 'Nessuna connessione al nodo — il download non può iniziare. La riconnessione è automatica, riprovi tra poco.',
+  'group.download_write_stalled': 'Il file ha smesso di essere scritto su disco ({seconds} s senza progressi). Il download è stato interrotto invece di restare bloccato; riprovi.',
   'device.add_title': 'This browser is not linked to this node yet',
   'device.add_hint': 'Your account is known here, but this browser holds a different key. Approve it from a device already linked — no operator needed.',
   'device.add_btn': 'Get a linking code',
@@ -575,6 +577,16 @@ export default {
   'transfers.open': 'Apri',
   'transfers.done': 'Completato',
   'transfers.cancelled': 'Annullato',
+  'transfers.waiting_own_slots': 'In attesa — i suoi posti sono occupati',
+  'transfers.waiting_node': 'In attesa — {n} prima',
+  'transfers.summary': '{running} in corso · {waiting} in attesa',
+  'transfers.group_running': 'In corso',
+  'transfers.group_waiting': 'In attesa',
+  'transfers.group_finished': 'Completati',
+  'transfers.cancel_one': 'Annulla {name}',
+  'transfers.eta_seconds': '{n} s rimanenti',
+  'transfers.eta_minutes': '{n} min rimanenti',
+  'transfers.eta_hours': '{n} h rimanenti',
   'transfers.failed': 'Non riuscito',
   'group.select': 'Seleziona',
   'group.select_done': 'Fine',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
index 1b49ddb..7ea9789 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
@@ -159,6 +159,8 @@ export default {
   'group.mkdir': '新しいフォルダー',
   'group.mkdir_prompt': '新しいフォルダー名',
   'group.mkdir_offline': 'ノードに接続していません。',
+  'group.download_offline': 'ノードに接続していません — ダウンロードを開始できません。再接続は自動で行われます。少し待って再試行してください。',
+  'group.download_write_stalled': 'ファイルのディスクへの書き込みが止まりました（{seconds} 秒間進みません）。ぶら下がったままにせず中止しました。もう一度お試しください。',
   'device.add_title': 'This browser is not linked to this node yet',
   'device.add_hint': 'Your account is known here, but this browser holds a different key. Approve it from a device already linked — no operator needed.',
   'device.add_btn': 'Get a linking code',
@@ -567,6 +569,16 @@ export default {
   'transfers.open': '開く',
   'transfers.done': '完了',
   'transfers.cancelled': 'キャンセル済み',
+  'transfers.waiting_own_slots': '待機中 — 自分の枠がすべて使用中です',
+  'transfers.waiting_node': '待機中 — 前に {n} 件',
+  'transfers.summary': '実行中 {running} · 待機中 {waiting}',
+  'transfers.group_running': '実行中',
+  'transfers.group_waiting': '待機中',
+  'transfers.group_finished': '完了',
+  'transfers.cancel_one': '{name} をキャンセル',
+  'transfers.eta_seconds': '残り {n} 秒',
+  'transfers.eta_minutes': '残り {n} 分',
+  'transfers.eta_hours': '残り {n} 時間',
   'transfers.failed': '失敗',
   'group.select': '選択',
   'group.select_done': '完了',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
index 7cf4cd4..74cd269 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
@@ -162,6 +162,8 @@ export default {
   'group.mkdir': 'Nieuwe map',
   'group.mkdir_prompt': 'Naam van de nieuwe map',
   'group.mkdir_offline': 'Niet verbonden met de node.',
+  'group.download_offline': 'Geen verbinding met de node — de download kan niet starten. Er wordt automatisch opnieuw verbonden; probeer het zo weer.',
+  'group.download_write_stalled': 'Het bestand wordt niet meer naar schijf geschreven ({seconds} s zonder voortgang). De download is gestopt in plaats van te blijven hangen; probeer het opnieuw.',
   'device.add_title': 'This browser is not linked to this node yet',
   'device.add_hint': 'Your account is known here, but this browser holds a different key. Approve it from a device already linked — no operator needed.',
   'device.add_btn': 'Get a linking code',
@@ -576,6 +578,16 @@ export default {
   'transfers.open': 'Openen',
   'transfers.done': 'Voltooid',
   'transfers.cancelled': 'Geannuleerd',
+  'transfers.waiting_own_slots': 'Wacht — uw plaatsen zijn bezet',
+  'transfers.waiting_node': 'Wacht — {n} ervoor',
+  'transfers.summary': '{running} bezig · {waiting} wachtend',
+  'transfers.group_running': 'Bezig',
+  'transfers.group_waiting': 'Wachtend',
+  'transfers.group_finished': 'Voltooid',
+  'transfers.cancel_one': '{name} annuleren',
+  'transfers.eta_seconds': 'nog {n} s',
+  'transfers.eta_minutes': 'nog {n} min',
+  'transfers.eta_hours': 'nog {n} u',
   'transfers.failed': 'Mislukt',
   'group.select': 'Selecteren',
   'group.select_done': 'Klaar',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
index 6edffd5..584e5f2 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
@@ -165,6 +165,8 @@ export default {
   'group.mkdir': 'Nowy folder',
   'group.mkdir_prompt': 'Nazwa nowego folderu',
   'group.mkdir_offline': 'Brak połączenia z węzłem.',
+  'group.download_offline': 'Brak połączenia z węzłem — pobieranie nie może się rozpocząć. Połączenie wróci samo; proszę spróbować za chwilę.',
+  'group.download_write_stalled': 'Plik przestał być zapisywany na dysk ({seconds} s bez postępu). Pobieranie zostało przerwane, zamiast wisieć w nieskończoność; proszę spróbować ponownie.',
   'device.add_title': 'This browser is not linked to this node yet',
   'device.add_hint': 'Your account is known here, but this browser holds a different key. Approve it from a device already linked — no operator needed.',
   'device.add_btn': 'Get a linking code',
@@ -588,6 +590,16 @@ export default {
   'transfers.open': 'Otwórz',
   'transfers.done': 'Zakończony',
   'transfers.cancelled': 'Anulowany',
+  'transfers.waiting_own_slots': 'Oczekiwanie — Twoje miejsca są zajęte',
+  'transfers.waiting_node': 'Oczekiwanie — {n} przed',
+  'transfers.summary': '{running} w toku · {waiting} oczekuje',
+  'transfers.group_running': 'W toku',
+  'transfers.group_waiting': 'Oczekuje',
+  'transfers.group_finished': 'Zakończone',
+  'transfers.cancel_one': 'Anuluj {name}',
+  'transfers.eta_seconds': 'pozostało {n} s',
+  'transfers.eta_minutes': 'pozostało {n} min',
+  'transfers.eta_hours': 'pozostało {n} godz.',
   'transfers.failed': 'Nie powiódł się',
   'group.select': 'Zaznacz',
   'group.select_done': 'Gotowe',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
index 3a6fa22..b034117 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
@@ -162,6 +162,8 @@ export default {
   'group.mkdir': 'Nova pasta',
   'group.mkdir_prompt': 'Nome da nova pasta',
   'group.mkdir_offline': 'Sem conexão com o nó.',
+  'group.download_offline': 'Sem conexão com o nó — o download não pode começar. Ele reconecta sozinho; tente de novo em instantes.',
+  'group.download_write_stalled': 'O arquivo parou de ser gravado no disco ({seconds}s sem progresso). O download foi interrompido em vez de ficar travado; tente de novo.',
   'device.add_title': 'This browser is not linked to this node yet',
   'device.add_hint': 'Your account is known here, but this browser holds a different key. Approve it from a device already linked — no operator needed.',
   'device.add_btn': 'Get a linking code',
@@ -574,6 +576,16 @@ export default {
   'transfers.open': 'Abrir',
   'transfers.done': 'Concluída',
   'transfers.cancelled': 'Cancelada',
+  'transfers.waiting_own_slots': 'Aguardando — seus espaços estão ocupados',
+  'transfers.waiting_node': 'Aguardando — {n} na frente',
+  'transfers.summary': '{running} em andamento · {waiting} aguardando',
+  'transfers.group_running': 'Em andamento',
+  'transfers.group_waiting': 'Aguardando',
+  'transfers.group_finished': 'Concluídos',
+  'transfers.cancel_one': 'Cancelar {name}',
+  'transfers.eta_seconds': 'faltam {n} s',
+  'transfers.eta_minutes': 'faltam {n} min',
+  'transfers.eta_hours': 'faltam {n} h',
   'transfers.failed': 'Falhou',
   'group.select': 'Selecionar',
   'group.select_done': 'Concluir',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
index f43ef72..ffe2cb0 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
@@ -158,6 +158,8 @@ export default {
   'group.mkdir': '新建文件夹',
   'group.mkdir_prompt': '新文件夹名称',
   'group.mkdir_offline': '未连接到节点。',
+  'group.download_offline': '未连接到节点 — 无法开始下载。连接会自动恢复，请稍后重试。',
+  'group.download_write_stalled': '文件停止写入磁盘（{seconds} 秒无进展）。已中止下载而不是让它一直卡住，请重试。',
   'device.add_title': 'This browser is not linked to this node yet',
   'device.add_hint': 'Your account is known here, but this browser holds a different key. Approve it from a device already linked — no operator needed.',
   'device.add_btn': 'Get a linking code',
@@ -555,6 +557,16 @@ export default {
   'transfers.open': '打开',
   'transfers.done': '已完成',
   'transfers.cancelled': '已取消',
+  'transfers.waiting_own_slots': '等待中 — 您的通道已占满',
+  'transfers.waiting_node': '等待中 — 前面还有 {n} 个',
+  'transfers.summary': '进行中 {running} · 等待中 {waiting}',
+  'transfers.group_running': '进行中',
+  'transfers.group_waiting': '等待中',
+  'transfers.group_finished': '已完成',
+  'transfers.cancel_one': '取消 {name}',
+  'transfers.eta_seconds': '剩余 {n} 秒',
+  'transfers.eta_minutes': '剩余 {n} 分钟',
+  'transfers.eta_hours': '剩余 {n} 小时',
   'transfers.failed': '失败',
   'group.select': '选择',
   'group.select_done': '完成',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/style.css b/packages/meshbay-hub/src/meshbay_hub/static/style.css
index dfed44b..22fcd3f 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/style.css
+++ b/packages/meshbay-hub/src/meshbay_hub/static/style.css
@@ -4243,3 +4243,67 @@ h2 .gn-owner, h3 .gn-owner { font-size: 0.55em; }
   color: var(--warn);
   margin-bottom: 2px;
 }
+
+/* A transfer waiting for a slot. Deliberately not a progress bar at 0%: it is
+   not stalled and nothing is wrong, and a bar that never moves is exactly how a
+   queue comes to look like a hang. The stripes say "not yet", not "broken". */
+.dl-progress.dl-waiting {
+  background-color: var(--bg-raised);
+  background-image: repeating-linear-gradient(
+    45deg,
+    var(--accent-bg) 0 8px,
+    transparent 8px 16px);
+  animation: dl-waiting-slide 1.1s linear infinite;
+}
+@keyframes dl-waiting-slide {
+  from { background-position: 0 0; }
+  to   { background-position: 22.6px 0; }
+}
+/* The state has to survive without the motion: someone who asked for less of it
+   still needs to see that this row is waiting rather than stopped. */
+@media (prefers-reduced-motion: reduce) {
+  .dl-progress.dl-waiting { animation: none; }
+}
+
+/* ── Transfers panel (grouped) ───────────────────────────────────────────── */
+
+.transfer-head-title { font-weight: 600; }
+.transfer-head-summary {
+  margin-left: auto;
+  margin-right: .5rem;
+  font-size: .85em;
+  color: var(--text-dim);
+  /* Never wraps to a second line: it is the one part of the header that grows
+     with what is happening, and a header that changes height as transfers come
+     and go pushes every row under it. */
+  white-space: nowrap;
+}
+.transfer-group + .transfer-group { border-top: 1px solid var(--border); }
+.transfer-group-head {
+  padding: .35rem .6rem .2rem;
+  font-size: .78em;
+  text-transform: uppercase;
+  letter-spacing: .04em;
+  color: var(--text-dim);
+}
+/* Finished rows recede rather than disappear: somebody who just downloaded
+   three files wants to see that all three are there. */
+.transfer-item.transfer-done .transfer-name,
+.transfer-item.transfer-cancelled .transfer-name { color: var(--text-dim); }
+
+/* Announced, not shown. The transfers panel needs a live region that says what
+   changed state without drawing anything — used with aria-live, so it must
+   stay in the accessibility tree: `display: none` would remove it from there
+   too and announce nothing at all, which is the usual way this is got wrong. */
+.sr-only {
+  position: absolute;
+  width: 1px;
+  height: 1px;
+  margin: -1px;
+  padding: 0;
+  overflow: hidden;
+  clip: rect(0 0 0 0);
+  clip-path: inset(50%);
+  white-space: nowrap;
+  border: 0;
+}
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transfers.js b/packages/meshbay-hub/src/meshbay_hub/static/transfers.js
index fa34c67..46f75a2 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/transfers.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/transfers.js
@@ -22,6 +22,12 @@
 
 const SPEED_WINDOW_MS = 5000;
 
+function _abortError() {
+  const err = new Error('Cancelled');
+  err.name = 'AbortError';
+  return err;
+}
+
 let _nextId = 1;
 
 export class TransferStore {
@@ -53,8 +59,18 @@ export class TransferStore {
       total: it.total,
       done: it.done,
       status: it.status,
+      // How many are in front of this one, and whose limit is holding it up:
+      // "your own two slots are busy" and "the node is full" are different
+      // situations and the person can act on only one of them.
+      ahead: it.ahead || 0,
+      queuedByOwnLimit: Boolean(
+        it.lease && it.lease.cap && it.lease.used >= it.lease.cap),
       error: it.error || '',
       speed: this._speed(it),
+      // The ETA is drawn only once the window holds a few seconds of real
+      // measurement -- see etaSeconds.
+      settled: it.samples.length > 2
+        && (it.samples[it.samples.length - 1].t - it.samples[0].t) >= 3000,
       percent: it.total ? Math.min(100, Math.round(it.done / it.total * 100)) : 0,
       // Only for a file written into a folder the browser granted us: that is
       // the one case where the page can read its own download back.
@@ -66,6 +82,12 @@ export class TransferStore {
     return this._items.filter(it => it.status === 'running').length;
   }
 
+  /** Running or waiting for a slot — what the nav badge counts. */
+  get pending() {
+    return this._items.filter(
+      it => it.status === 'running' || it.status === 'queued').length;
+  }
+
   _speed(it) {
     // Over a window rather than since the start: a transfer that stalls should
     // read as slow immediately, not as its own historical average.
@@ -82,12 +104,18 @@ export class TransferStore {
    * `run` receives `{ signal, onProgress }`. It must poll `signal.aborted` — a
    * cancel that only sets a flag nobody reads is a button that lies.
    */
-  start({ kind, name, total = 0, transport = null, run, open = null }) {
+  start({ kind, name, total = 0, transport = null, run, open = null,
+          lease = null }) {
     const item = {
       id: _nextId++,
-      kind, name, total, transport, open,
+      kind, name, total, transport, open, lease,
       done: 0,
-      status: 'running',
+      // A transfer that has to wait for a slot starts as 'queued', not
+      // 'running'. Two different things are true of it — nothing is moving, and
+      // nothing is wrong — and a status that conflates them is what makes a
+      // queue look like a hang.
+      status: lease && lease.state !== 'granted' ? 'queued' : 'running',
+      ahead: (lease && lease.ahead) || 0,
       error: '',
       samples: [{ t: this._now(), done: 0 }],
       signal: { aborted: false },
@@ -113,8 +141,39 @@ export class TransferStore {
       this._maybeRelease(item.transport);
     };
 
+    // The slot is given back in a `finally` around everything, so it survives
+    // a throw, a cancel and a return alike. A slot not returned is a member who
+    // cannot start another transfer until the node times it out.
+    const finished = () => {
+      if (item.lease) item.lease.release(
+        item.signal.aborted ? 'cancelled' : 'done');
+    };
+
+    // Installed here and not inside the promise chain below. A state push that
+    // arrived before the first microtask ran was simply dropped, so a transfer
+    // could sit at the position it was given when it was created and never
+    // appear to move — the widget showing "3 ahead" for ever while the node
+    // quietly worked through the queue. Nothing about that looks wrong from
+    // either side, which is why it needs a test rather than a reading.
+    if (item.lease) {
+      item.lease._onState = (lease) => {
+        if (item.status !== 'queued' && item.status !== 'running') return;
+        item.ahead = lease.ahead;
+        item.status = lease.state === 'granted' ? 'running' : 'queued';
+        this._emit();
+      };
+    }
+
     const promise = Promise.resolve()
-      .then(() => run({ signal: item.signal, onProgress }))
+      .then(async () => {
+        if (item.lease) {
+          await item.lease.acquire();
+          if (item.signal.aborted) throw _abortError();
+          item.status = 'running';
+          this._emit();
+        }
+        return run({ signal: item.signal, onProgress, lease: item.lease });
+      })
       .then(() => {
         if (item.signal.aborted) finish('cancelled');
         else {
@@ -125,7 +184,8 @@ export class TransferStore {
       .catch(err => {
         if (item.signal.aborted || err.name === 'AbortError') finish('cancelled');
         else finish('failed', err.message || String(err));
-      });
+      })
+      .finally(finished);
 
     item.promise = promise;
     return item.id;
@@ -146,8 +206,12 @@ export class TransferStore {
 
   cancel(id) {
     const item = this._items.find(it => it.id === id);
-    if (!item || item.status !== 'running') return;
+    // 'queued' too: a transfer waiting for a slot is exactly the one somebody
+    // is most likely to give up on, and its queue entry has to go with it or
+    // the node grants a slot to a transfer that will never use it.
+    if (!item || (item.status !== 'running' && item.status !== 'queued')) return;
     item.signal.aborted = true;
+    if (item.lease) item.lease.release('cancelled');
     // Marked at once. The work stops when it next looks, but a cancelled
     // transfer should not keep reporting progress in the meantime.
     item.status = 'cancelled';
@@ -157,19 +221,24 @@ export class TransferStore {
 
   cancelAll() {
     for (const it of this._items) {
-      if (it.status === 'running') this.cancel(it.id);
+      if (it.status === 'running' || it.status === 'queued') this.cancel(it.id);
     }
   }
 
-  /** Drop everything finished, keeping what is still running. */
+  /** Drop everything finished, keeping what is still running or waiting. */
   clearFinished() {
-    this._items = this._items.filter(it => it.status === 'running');
+    this._items = this._items.filter(
+      it => it.status === 'running' || it.status === 'queued');
     this._emit();
   }
 
   _busy(transport) {
+    // Queued counts as busy: a transport closed while a transfer waits for a
+    // slot can never be granted one, and the transfer would sit at "waiting"
+    // for ever with nothing left to answer it.
     return this._items.some(
-      it => it.transport === transport && it.status === 'running');
+      it => it.transport === transport
+        && (it.status === 'running' || it.status === 'queued'));
   }
 
   /**
@@ -211,6 +280,22 @@ export class TransferStore {
 
 export const transfers = new TransferStore();
 
+/**
+ * Seconds left, or null when saying nothing is the honest answer.
+ *
+ * Withheld until the speed window has real samples in it: a figure computed
+ * from the first two chunks of a transfer swings between "4 seconds" and "an
+ * hour" and back, and a number that behaves like that is worse than a blank —
+ * people read the first one they see and plan around it.
+ */
+export function etaSeconds(item) {
+  if (item.status !== 'running' || !item.total || !item.speed) return null;
+  const left = item.total - item.done;
+  if (left <= 0) return null;
+  const secs = left / item.speed;
+  return Number.isFinite(secs) ? secs : null;
+}
+
 /** Human-readable rate, for a widget that updates several times a second. */
 export function formatSpeed(bytesPerSecond) {
   if (!bytesPerSecond || bytesPerSecond < 1) return '';
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport.js b/packages/meshbay-hub/src/meshbay_hub/static/transport.js
index c4a24c5..54a1302 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/transport.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/transport.js
@@ -283,6 +283,129 @@ const JOIN_REFUSALS = {
   group_mismatch: 'The node refused a request naming a different group.',
 };
 
+/**
+ * One transfer's slot on the node, from this side.
+ *
+ * The contract the transfer store depends on: `acquire()` resolves when the
+ * node has granted the slot (immediately on a node that hands out none), and
+ * `release(reason)` gives it back exactly once. Nothing else in the client
+ * speaks to the node about slots.
+ *
+ * Two things here exist only because a queue can lie, and both are the
+ * difference between "waiting" and "waiting for ever":
+ *
+ *   - **the watchdog.** A grant is pushed, not polled, so a lost push leaves
+ *     this side waiting on a node that believes it has started. Re-asking is
+ *     free — the node is idempotent on `tr` — and it is the only thing that
+ *     recovers a message that did not arrive.
+ *   - **release is idempotent and unconditional.** A slot given back twice
+ *     costs nothing; one never given back is a member who cannot transfer
+ *     again until a timeout the node runs on its own.
+ */
+const LEASE_WATCHDOG_MS = 60000;
+
+class Lease {
+  constructor(transport, tr, kind, bytes, chunks, onState) {
+    this.transport = transport;
+    this.tr = tr;
+    this.kind = kind;
+    this.bytes = bytes;
+    this.chunks = chunks;
+    this.state = 'opening';
+    this.ahead = 0;
+    this.closed = false;
+    this._onState = onState;
+    this._granted = null;
+    this._watchdog = 0;
+    this._wait = new Promise((resolve) => { this._granted = resolve; });
+  }
+
+  /** No slots on this node: behave as though one was granted at once. */
+  _skip() {
+    this.state = 'granted';
+    this._granted();
+  }
+
+  _request() {
+    // A closed channel is not a failure here, and must not throw: the transport
+    // reconnects on its own, `_reopenTransfers` re-asks for every live lease
+    // when it does, and the watchdog below asks again meanwhile.
+    //
+    // This is the same tolerance `_fetchChunkResilient` already gives a chunk
+    // request — and before leases existed, a chunk request was the first thing
+    // to touch the channel, so a download started on a briefly dead connection
+    // simply retried. Asking for a slot first made `_send` the first contact
+    // and threw "DataChannel not open (state: closed)" out of `downloadEntry`,
+    // where nothing catches it: a download that used to recover became an
+    // error with no row in the widget to show it. Found by downloading a file
+    // right after a connection dropped.
+    try {
+      this.transport._send({
+        type: 'transfer_open', v: '0.1', tr: this.tr, kind: this.kind,
+        bytes: this.bytes, chunks: this.chunks,
+      });
+    } catch (err) {
+      console.warn('[MeshBay] could not ask for a slot yet:', err.message);
+    }
+    this._arm();
+  }
+
+  _arm() {
+    clearTimeout(this._watchdog);
+    if (this.closed || this.state === 'granted') return;
+    this._watchdog = setTimeout(() => {
+      if (this.closed || this.state === 'granted') return;
+      console.warn('[MeshBay] no answer for transfer', this.tr.slice(0, 8),
+                   '- asking again');
+      this._request();
+    }, LEASE_WATCHDOG_MS);
+  }
+
+  _apply(msg) {
+    if (this.closed) return;
+    this.state = msg.state;
+    this.ahead = msg.ahead || 0;
+    this.used = msg.used;
+    this.cap = msg.cap;
+    if (msg.state === 'granted') {
+      clearTimeout(this._watchdog);
+      this._granted();
+    } else if (msg.state === 'closed') {
+      // The node ended it: reclaimed as idle, or revoked. Not an error here —
+      // whoever is running the transfer finds out through its own failure — but
+      // the slot is gone and asking again is the only way back.
+      clearTimeout(this._watchdog);
+    } else {
+      this._arm();
+    }
+    if (this._onState) {
+      try { this._onState(this); } catch (e) {
+        console.error('[MeshBay] lease state handler threw:', e);
+      }
+    }
+  }
+
+  /** Resolves once the node has granted the slot. */
+  acquire() { return this._wait; }
+
+  /**
+   * Give the slot back. Safe to call twice, and safe on a dead transport: a
+   * lease that is not released is a member who cannot start another transfer
+   * until the node times it out, so this must never be conditional on anything.
+   */
+  release(reason = 'done') {
+    if (this.closed) return;
+    this.closed = true;
+    clearTimeout(this._watchdog);
+    this.transport._leases.delete(this.tr);
+    if (!this.transport.supportsTransferSlots) return;
+    try {
+      this.transport._send({ type: 'transfer_close', v: '0.1', tr: this.tr,
+                             reason });
+    } catch { /* the connection is gone, and so is the lease with it */ }
+  }
+}
+
 class MeshBayTransport {
   constructor(hubUrl, accessToken) {
     this._hubUrl = hubUrl;
@@ -315,6 +438,13 @@ class MeshBayTransport {
     // Names, not ids: the "already being uploaded" guard is about the file the
     // caller passed, and two `uploadFile` calls for one file draw two ids.
     this._inFlightUploads = new Set();
+    // tr → Lease. A transfer's slot on the node, from the client's side.
+    this._leases = new Map();
+    // Set from the handshake ack: a node that answers with `transfer_limits`
+    // speaks transfer slots. Used instead of a timeout, because "no answer
+    // yet" and "this node will never answer" are indistinguishable in time and
+    // guessing wrong either stalls every download or defeats the cap.
+    this._transferLimits = null;
     // Set once close() runs — stops the automatic reconnect from firing on a
     // connection the caller tore down on purpose (leaving the group, page
     // unload), which would otherwise race back in right as everything else
@@ -376,6 +506,20 @@ class MeshBayTransport {
   /** The MNP version the connected node declared, or '' before a handshake. */
   get nodeVersion() { return this._nodeVersion || ''; }
 
+  /**
+   * Whether this node hands out transfer slots.
+   *
+   * Read from the handshake ack rather than from the MNP version: the caps
+   * shipped before the version bump that will make leases compulsory, so for
+   * now a node either answers with `transfer_limits` or it predates all of
+   * this. A node that does not is asked for nothing and enforces nothing —
+   * every download behaves exactly as it did.
+   */
+  get supportsTransferSlots() { return this._transferLimits !== null; }
+
+  /** This member's own caps in this group, or null when the node said nothing. */
+  get transferLimits() { return this._transferLimits; }
+
   /**
    * Whether the node speaks the per-root and per-app operations MNP 1.1 added:
    * `root_update`/`root_eject`/`root_plug`, `app_directories`,
@@ -880,6 +1024,7 @@ class MeshBayTransport {
       delete ack.nonce;
       delete ack.ct;
       Object.assign(ack, config);
+      this._transferLimits = ack.transfer_limits || null;
 
       // Tell the node which of this account's devices is on this connection.
       // Deliberately after the ack, and gated on the node's own version rather
@@ -1016,6 +1161,10 @@ class MeshBayTransport {
         }
         trace('reconnect_ok', { attempt: this._reconnectAttempts });
         console.log('[MeshBay] Reconnected after', this._reconnectAttempts, 'attempt(s)');
+        // Before the caller's own hook: a transfer that resumes mid-chunk must
+        // have asked for its slot back first, or its next `file_req` carries a
+        // `tr` the node has never heard of.
+        this._reopenTransfers();
         if (this._onReconnected) {
           try { this._onReconnected(); } catch (e) {
             console.error('[MeshBay] onReconnected handler threw:', e);
@@ -1100,12 +1249,52 @@ class MeshBayTransport {
     return msg;
   }
 
-  async fetchChunk(fileId, chunkIndex) {
+  // ── Transfer slots ─────────────────────────────────────────────────────────
+
+  /**
+   * Ask the node for a slot, and wait until it says yes.
+   *
+   * `tr` is drawn here, not by the node — 16 random bytes, exactly like
+   * `upload_id` — which is what makes re-opening after a reconnect idempotent
+   * rather than a second charge against the member's cap.
+   *
+   * On a node that predates transfer slots this resolves at once and costs
+   * nothing: there is no cap to respect and no message that would be
+   * understood.
+   */
+  openTransfer({ kind = 'download', bytes = 0, chunks = 0, onState = null } = {}) {
+    const tr = _hex(crypto.getRandomValues(new Uint8Array(16)));
+    const lease = new Lease(this, tr, kind, bytes, chunks, onState);
+    if (!this.supportsTransferSlots) {
+      lease._skip();
+      return lease;
+    }
+    this._leases.set(tr, lease);
+    lease._request();
+    return lease;
+  }
+
+  /** Re-ask for every live lease. Called after a reconnect. */
+  _reopenTransfers() {
+    if (!this.supportsTransferSlots) return;
+    for (const lease of this._leases.values()) {
+      // The node lost the lease with the session, so this is a fresh request
+      // for the same `tr` — which the node treats as the same transfer rather
+      // than a second one.
+      if (!lease.closed) lease._request();
+    }
+  }
+
+  async fetchChunk(fileId, chunkIndex, tr = '') {
     const msg = await this._sendAndWait({
       type: 'file_req',
       v: '0.1',
       file_id: fileId,
       chunk_index: chunkIndex,
+      // Present only when this download holds a slot. The node does not require
+      // it yet; carrying it is what lets the node see the transfer is alive and
+      // not reclaim its slot as idle.
+      ...(tr ? { tr } : {}),
     });
     if (msg.type === 'error') throw new Error(msg.detail);
     return msg;
@@ -2189,7 +2378,8 @@ class MeshBayTransport {
    * folder on screen to name. Omitting both leaves the node to pick, which it
    * only does for a client old enough to have had one destination.
    */
-  async uploadFile(file, { chunkSize, onProgress, signal, root, dir } = {}) {
+  async uploadFile(file, { chunkSize, onProgress, signal, root, dir,
+                          tr = '' } = {}) {
     // The same file twice at once would confuse the node, which keys its own
     // upload state by name — and would race for the same destination. The guard
     // is by name for that reason, even though the map below is keyed by id.
@@ -2273,6 +2463,7 @@ class MeshBayTransport {
           upload_id: uploadId,
           chunk_index: i,
           total_chunks: total,
+          ...(tr ? { tr } : {}),
           ...sealed,
         });
       }
@@ -2992,6 +3183,24 @@ class MeshBayTransport {
     // "arrived" — and every message after that is one slot off too. Found
     // live: a group mid-scan corrupted its own handshake and chat history
     // this way, arriving roughly every 2s for as long as scanning ran.
+    // Routed by `tr`, and only by `tr`. A grant arrives unsolicited, minutes
+    // after the request that produced it, so falling through to "the oldest
+    // pending request" would hand a chat send or a handshake somebody else's
+    // slot — the class of defect `req_id` was introduced for.
+    if (msg.type === 'transfer_state') {
+      const lease = this._leases.get(msg.tr);
+      if (lease) lease._apply(msg);
+      else if (msg.state === 'granted') {
+        // A grant for a transfer this page has forgotten (a reload, a cancel
+        // that raced the grant). Handing it back at once matters: otherwise the
+        // node holds it until the 30 s acceptance deadline, and everyone behind
+        // it waits for nothing.
+        this._send({ type: 'transfer_close', v: '0.1', tr: msg.tr,
+                     reason: 'cancelled' });
+      }
+      return;
+    }
+
     if (msg.type === 'index_progress') {
       if (this._onIndexProgress) {
         this._onIndexProgress({
diff --git a/packages/meshbay-hub/tests/test_layout_measured.py b/packages/meshbay-hub/tests/test_layout_measured.py
index 91f1ed0..a71b6b9 100644
--- a/packages/meshbay-hub/tests/test_layout_measured.py
+++ b/packages/meshbay-hub/tests/test_layout_measured.py
@@ -54,7 +54,7 @@ NAV = textwrap.dedent("""
             <div class="transfer-item">
               <div class="transfer-line">
                 <span class="transfer-kind">&#8595;</span>
-                <span class="transfer-name">S03E01. Salt and Sea, Fire and Blood.mp4</span>
+                <span class="transfer-name">Some Saga S03E01 - A Long Enough Title.mp4</span>
                 <button class="transfer-cancel">&#10005;</button>
               </div>
               <div class="dl-progress"><div class="dl-fill" style="width:42%"></div></div>
@@ -144,3 +144,120 @@ def test_the_page_does_not_scroll_sideways(measured, width):
     r = measured[str(width)]
     assert r["docScrollW"] <= r["viewport"]["w"], (
         f"the document scrolls to {r['docScrollW']} px on a {width} px screen")
+
+
+# ── The grouped panel (§8.2) ────────────────────────────────────────────────
+#
+# The panel gained groups, a header summary and a waiting row. Every one of
+# those can push something off a 320 px screen, and none of it can be seen by
+# reading the stylesheet: what decides where the panel lands is the button it
+# hangs from, which is not at the right edge. That is the defect this file was
+# written for, and it comes back with any change to the header's width.
+
+GROUPED = textwrap.dedent("""
+    <nav class="nav">
+      <div class="nav-left">
+        <button class="nav-hamburger">&#9776;</button>
+        <a class="nav-brand" href="#/">MeshBay</a>
+      </div>
+      <div class="nav-right">
+        <div class="transfer-wrap">
+          <button class="nav-notif transfer-btn">&#8595;</button>
+          <div class="transfer-panel">
+            <div class="transfer-head">
+              <span class="transfer-head-title">Transfers</span>
+              <span class="transfer-head-summary">2 running &middot; 3 waiting</span>
+              <button class="btn-secondary">Clear finished</button>
+            </div>
+            <div class="transfer-group">
+              <div class="transfer-group-head">Running</div>
+              <div class="transfer-item transfer-running">
+                <div class="transfer-line">
+                  <span class="transfer-kind">&#8595;</span>
+                  <span class="transfer-name">Some Saga S03E01 - A Long Enough Title.mp4</span>
+                  <button class="transfer-cancel">&#10005;</button>
+                </div>
+                <div class="dl-progress"><div class="dl-fill" style="width:42%"></div></div>
+                <div class="transfer-meta"><span>210 MB / 493 MB</span><span>3.1 MB/s &middot; 4 min left</span></div>
+              </div>
+            </div>
+            <div class="transfer-group">
+              <div class="transfer-group-head">Waiting</div>
+              <div class="transfer-item transfer-queued">
+                <div class="transfer-line">
+                  <span class="transfer-kind">&#8595;</span>
+                  <span class="transfer-name">Another File With A Long Name.mkv</span>
+                  <button class="transfer-cancel">&#10005;</button>
+                </div>
+                <div class="dl-progress dl-waiting"></div>
+                <div class="transfer-meta"><span>Waiting &mdash; your slots are busy</span><span>1.2 GB</span></div>
+              </div>
+            </div>
+          </div>
+        </div>
+        <a class="nav-notif" href="#/">&#128276;</a>
+        <div class="user-menu"><button class="nav-btn">someone</button></div>
+      </div>
+    </nav>
+""")
+
+GROUPED_SELECTORS = [".transfer-panel", ".transfer-head", ".transfer-head-summary",
+                     ".transfer-group-head", ".transfer-name",
+                     ".transfer-item.transfer-queued .dl-progress"]
+
+
+@pytest.fixture(scope="module")
+def grouped(tmp_path_factory):
+    fragment = tmp_path_factory.mktemp("grouped") / "fragment.html"
+    fragment.write_text(GROUPED)
+    proc = subprocess.run(
+        ["python3", str(HARNESS), ",".join(str(w) for w in WIDTHS),
+         str(fragment), *GROUPED_SELECTORS],
+        capture_output=True, text=True, timeout=180)
+    assert proc.returncode == 0, f"probe failed: {proc.stdout}{proc.stderr}"
+    out = json.loads(proc.stdout)
+    assert "error" not in out, f"no measurement: {out}"
+    return out
+
+
+def test_the_grouped_panel_stays_on_a_phone_screen(grouped):
+    for width in WIDTHS:
+        box = grouped[str(width)]["boxes"][".transfer-panel"]
+        assert box["offLeft"] == 0, (
+            f"at {width} px the panel hangs {box['offLeft']} px off the left — "
+            "which is where the file names are")
+        assert box["offRight"] == 0, (
+            f"at {width} px the panel hangs {box['offRight']} px off the right")
+
+
+def test_the_file_name_is_on_screen_in_every_group(grouped):
+    for width in WIDTHS:
+        box = grouped[str(width)]["boxes"][".transfer-name"]
+        assert box["offLeft"] == 0 and box["offRight"] == 0, (
+            f"at {width} px a file name is cut off: {box}")
+        assert box["width"] > 40, "the name column collapsed to nothing"
+
+
+def test_the_header_summary_does_not_push_the_header_taller(grouped):
+    """It is the one part of the header that grows with what is happening. If
+    it wraps, the header changes height as transfers come and go and every row
+    below it moves — on the narrowest screen, repeatedly."""
+    for width in WIDTHS:
+        head = grouped[str(width)]["boxes"][".transfer-head"]
+        summary = grouped[str(width)]["boxes"][".transfer-head-summary"]
+        assert head["height"] <= 48, (
+            f"at {width} px the header is {head['height']} px tall — it wrapped")
+        assert summary["height"] <= 24, (
+            f"at {width} px the summary wrapped to {summary['height']} px")
+
+
+def test_the_waiting_bar_is_as_wide_as_a_progress_bar(grouped):
+    """A waiting row has no inner fill element — the stripes are on the track
+    itself. Getting that wrong renders a zero-width bar, which reads as a
+    transfer stuck at 0% rather than one that has not started."""
+    for width in WIDTHS:
+        bar = grouped[str(width)]["boxes"][
+            ".transfer-item.transfer-queued .dl-progress"]
+        assert bar["width"] > 100, (
+            f"at {width} px the waiting bar is {bar['width']} px wide")
+        assert bar["height"] >= 3, "the waiting bar has no height"
diff --git a/packages/meshbay-hub/tests/test_memory_ceiling.py b/packages/meshbay-hub/tests/test_memory_ceiling.py
index 9966e48..8430627 100644
--- a/packages/meshbay-hub/tests/test_memory_ceiling.py
+++ b/packages/meshbay-hub/tests/test_memory_ceiling.py
@@ -92,9 +92,15 @@ const downloads = {{
 }};
 globalThis.window = {{}};
 if ({json.dumps(picker)}) {{
-  window.showSaveFilePicker = async () => ({{
-    name: 'p', createWritable: async () => ({{}}),
-  }});
+  window.showSaveFilePicker = async () => {{
+    if ({json.dumps(picker)} === 'no-gesture') {{
+      const e = new Error("Failed to execute 'showSaveFilePicker' on 'Window': "
+                          + "Must be handling a user gesture to show a file picker.");
+      e.name = 'SecurityError';
+      throw e;
+    }}
+    return {{ name: 'p', createWritable: async () => ({{}}) }};
+  }};
 }}
 
 {target_fn}
@@ -207,3 +213,27 @@ def test_the_guard_is_what_the_preview_uses_too(target_fn):
         "the preview modal must refuse an oversized entry before fetching it")
     assert not re.search(r"100\s*\*\s*1024\s*\*\s*1024", files_app), (
         "the ceiling is defined once, in file-utils.js")
+
+
+def test_a_lost_gesture_streams_instead_of_failing(target_fn, tmp_path):
+    """
+    A browser grants one file picker per user gesture, and downloading three
+    files is one gesture — so the second and third throw "Must be handling a
+    user gesture". The person sees a failed transfer, with a message from Chrome
+    about gestures, for having done something entirely reasonable.
+
+    The streamed path needs no gesture, so it is the right answer rather than a
+    consolation: the file lands on disk either way, and the only thing lost is
+    the choice of folder, which there was no picker to make anyway.
+    """
+    out = _run(target_fn, tmp_path, size=20 * GB,
+               picker="no-gesture", streamed=True, mode="ask")
+    assert out == {"kind": "stream", "name": "s"}, out
+
+
+def test_a_lost_gesture_with_nothing_to_stream_to_still_refuses(target_fn, tmp_path):
+    """And the ceiling still holds underneath: no gesture and no stream is not
+    a reason to put twenty gigabytes in the page."""
+    out = _run(target_fn, tmp_path, size=20 * GB,
+               picker="no-gesture", streamed=False, mode="ask")
+    assert out["kind"] == "refused", out
diff --git a/packages/meshbay-hub/tests/test_transfers.py b/packages/meshbay-hub/tests/test_transfers.py
index 3316615..e805afc 100644
--- a/packages/meshbay-hub/tests/test_transfers.py
+++ b/packages/meshbay-hub/tests/test_transfers.py
@@ -222,3 +222,216 @@ def test_a_folder_name_carries_no_trailing_slash():
     assert "dir-row" in row, "the anchor no longer lands on the directory row"
     assert "${d}/" not in row, "the folder name is rendered with a trailing slash"
     assert "${d}" in row
+
+
+# ── Transfer slots, client side ─────────────────────────────────────────────
+#
+# A queue can lie in two directions, and both are worse than no queue: a
+# transfer that shows "waiting" on a node that already granted it, and a slot
+# the page holds after it has stopped using it. Everything below is one of
+# those two.
+
+def _lease_stub():
+    """A Lease as the store sees it, driveable from the test."""
+    return """
+class L {
+  constructor() {
+    this.state = 'queued'; this.ahead = 2; this.closed = false;
+    this.released = []; this.tr = 'tr1';
+    this._wait = new Promise(r => { this._go = r; });
+  }
+  acquire() { return this._wait; }
+  release(reason) { if (!this.closed) { this.closed = true; this.released.push(reason); } }
+  grant() { this.state = 'granted'; if (this._onState) this._onState(this); this._go(); }
+  push(state, ahead) { this.state = state; this.ahead = ahead; if (this._onState) this._onState(this); }
+}
+"""
+
+
+def test_a_transfer_waiting_for_a_slot_is_queued_not_running(tmp_path):
+    out = _run(_lease_stub() + """
+      const t = new TransferStore();
+      const lease = new L();
+      t.start({ kind: 'download', name: 'f', total: 10, lease,
+                run: async () => { say('ran'); } });
+      say(t.list()[0].status, t.list()[0].ahead);
+      await new Promise(r => setTimeout(r, 0));
+      say('still:' + t.list()[0].status);
+    """, tmp_path)
+    assert out[:2] == ["queued", 2]
+    assert "ran" not in out, "the work started before the slot was granted"
+    assert out[-1] == "still:queued"
+
+
+def test_the_grant_starts_the_work(tmp_path):
+    out = _run(_lease_stub() + """
+      const t = new TransferStore();
+      const lease = new L();
+      t.start({ kind: 'download', name: 'f', total: 10, lease,
+                run: async () => { say('ran:' + t.list()[0].status); } });
+      lease.grant();
+      await new Promise(r => setTimeout(r, 10));
+      say('after:' + t.list()[0].status);
+    """, tmp_path)
+    assert out[0] == "ran:running"
+    assert out[1] == "after:done"
+
+
+def test_the_slot_comes_back_however_the_transfer_ends(tmp_path):
+    """A slot not returned is a member who cannot transfer again until the node
+    times it out — so this must hold for a throw as much as for a success."""
+    out = _run(_lease_stub() + """
+      for (const mode of ['ok', 'throw']) {
+        const t = new TransferStore();
+        const lease = new L();
+        t.start({ kind: 'download', name: 'f', total: 10, lease,
+                  run: async () => { if (mode === 'throw') throw new Error('x'); } });
+        lease.grant();
+        await new Promise(r => setTimeout(r, 10));
+        say(mode + ':' + lease.released.join(',') + ':' + t.list()[0].status);
+      }
+    """, tmp_path)
+    assert out == ["ok:done:done", "throw:done:failed"]
+
+
+def test_cancelling_while_queued_gives_the_slot_back(tmp_path):
+    """The transfer somebody is most likely to give up on is the one that has
+    not started. Its queue entry has to go, or the node grants a slot to a
+    transfer that will never use it."""
+    out = _run(_lease_stub() + """
+      const t = new TransferStore();
+      const lease = new L();
+      const id = t.start({ kind: 'download', name: 'f', total: 10, lease,
+                           run: async () => { say('ran'); } });
+      t.cancel(id);
+      say(t.list()[0].status, lease.released.join(','));
+      lease.grant();
+      await new Promise(r => setTimeout(r, 10));
+      say('ran?', out.includes('ran'));
+    """, tmp_path)
+    assert out[0] == "cancelled"
+    assert out[1] == "cancelled"
+    assert out[-1] is False, "a cancelled transfer ran anyway once granted"
+
+
+def test_a_queue_position_update_reaches_the_view(tmp_path):
+    out = _run(_lease_stub() + """
+      const t = new TransferStore();
+      const lease = new L();
+      const seen = [];
+      t.subscribe(items => seen.push(items[0].ahead));
+      t.start({ kind: 'download', name: 'f', total: 10, lease, run: async () => {} });
+      lease.push('queued', 1);
+      lease.push('queued', 0);
+      say(seen.join('>'));
+    """, tmp_path)
+    assert out[0].endswith("1>0"), "the widget never learns it is moving up"
+
+
+def test_a_transport_with_a_queued_transfer_is_not_closed(tmp_path):
+    """Closing it would leave the transfer waiting for a grant that can never
+    arrive — waiting for ever, with nothing left to answer."""
+    out = _run(_lease_stub() + """
+      const t = new TransferStore();
+      const lease = new L();
+      let closed = false;
+      const transport = { close() { closed = true; } };
+      t.start({ kind: 'download', name: 'f', total: 10, transport, lease,
+                run: async () => {} });
+      t.releaseWhenIdle(transport);
+      say('closed while queued:', closed);
+      lease.grant();
+      await new Promise(r => setTimeout(r, 10));
+      say('closed after:', closed);
+    """, tmp_path)
+    assert out[1] is False
+    assert out[3] is True
+
+
+def test_clearing_finished_keeps_what_is_waiting(tmp_path):
+    out = _run(_lease_stub() + """
+      const t = new TransferStore();
+      const lease = new L();
+      t.start({ kind: 'download', name: 'waiting', total: 1, lease, run: async () => {} });
+      t.start({ kind: 'download', name: 'done', total: 1, run: async () => {} });
+      await new Promise(r => setTimeout(r, 10));
+      t.clearFinished();
+      say(t.list().map(i => i.name + ':' + i.status).join(','));
+    """, tmp_path)
+    assert out[0] == "waiting:queued"
+
+
+def test_asking_for_a_slot_on_a_dead_channel_does_not_throw(tmp_path):
+    """
+    The transport reconnects on its own and re-asks for every live lease when it
+    does, so a closed channel at the moment a transfer starts is a wait, not a
+    failure. `_fetchChunkResilient` has always treated it that way — and before
+    leases existed a chunk request was the first thing to touch the channel, so
+    a download begun on a briefly dead connection simply retried.
+
+    Asking for a slot first made `_send` the first contact. It threw
+    "DataChannel not open (state: closed)" straight out of `downloadEntry`,
+    where nothing catches it: a download that used to recover became an error
+    with no row in the widget to show it. Found live, by downloading a file
+    just after a connection dropped.
+    """
+    module = tmp_path / "transport_lease.mjs"
+    # The real Lease, lifted out as text — the class is not exported, and a
+    # second copy of it here would agree with whatever it was copied from.
+    src = (STATIC / "transport.js").read_text()
+    # From the constant the class depends on, not from the class: lifting only
+    # the class left LEASE_WATCHDOG_MS undefined, which the class reads the
+    # first time it arms its watchdog.
+    start = src.index("const LEASE_WATCHDOG_MS")
+    end = src.index("\nclass MeshBayTransport")
+    module.write_text(src[start:end] + "\nexport { Lease };\n")
+
+    script = tmp_path / "case.mjs"
+    script.write_text(f"""
+import {{ Lease }} from '{module.as_posix()}';
+const out = [];
+const transport = {{
+  supportsTransferSlots: true,
+  _leases: new Map(),
+  _send() {{ throw new Error('DataChannel not open (state: closed)'); }},
+}};
+let threw = null;
+const lease = new Lease(transport, 'tr1', 'download', 10, 1, null);
+try {{ lease._request(); }} catch (e) {{ threw = e.message; }}
+out.push(threw);
+// And releasing one must be just as safe: a lease not released is a member who
+// cannot start another transfer until the node times it out.
+try {{ lease.release('cancelled'); out.push('release ok'); }}
+catch (e) {{ out.push('release threw: ' + e.message); }}
+clearTimeout(lease._watchdog);
+console.log(JSON.stringify(out));
+""")
+    proc = subprocess.run(["node", str(script)], capture_output=True, text=True)
+    assert proc.returncode == 0, proc.stderr
+    out = json.loads(proc.stdout)
+    assert out[0] is None, f"asking for a slot threw: {out[0]}"
+    assert out[1] == "release ok"
+
+
+def test_the_slot_is_asked_for_after_there_is_somewhere_to_write():
+    """
+    A granted slot has to be taken up within the node's acceptance deadline, so
+    it must not be asked for until the download can actually start.
+
+    Asking first reads better — the widget could draw a row while the target is
+    being chosen — and is wrong: opening a target takes thirty seconds of
+    streamed-download timeouts, or as long as somebody leaves a Save As dialog
+    open. The node revokes the grant, passes it to the next in the queue
+    (`transfer: reclaimed … (not_taken_up)` in its log), and the download then
+    fetches under a `tr` that is no longer granted. Three downloads started, one
+    arrived.
+
+    Source-reading, because the ordering is the whole property and it has no
+    behaviour of its own to drive: what matters is which call comes first.
+    """
+    src = (STATIC / "file-utils.js").read_text()
+    fn = src[src.index("async function downloadEntry"):]
+    fn = fn[:fn.index("\n}\n")]
+    assert fn.index("_openDownloadTarget") < fn.index("openTransfer"), (
+        "downloadEntry asks for a transfer slot before it has anywhere to "
+        "write — the grant expires before the download can use it")
diff --git a/packages/meshbay-hub/tests/test_zip_size_limit.py b/packages/meshbay-hub/tests/test_zip_size_limit.py
index 44ad59e..e970c55 100644
--- a/packages/meshbay-hub/tests/test_zip_size_limit.py
+++ b/packages/meshbay-hub/tests/test_zip_size_limit.py
@@ -81,7 +81,17 @@ if ({picker_js}) {{
 const M = await import('{(sandbox / "file-utils.js").as_posix()}');
 
 const transfers = {{ start: () => {{ out.started += 1; }} }};
-const transport = {{ connected: true }};
+// A transport hands out transfer slots now (transfers.py's leases). The stub
+// grants at once, which is what a node with no caps does: what this file is
+// about is the archive limit, not the queue.
+const transport = {{
+  connected: true,
+  openTransfer: () => ({{
+    tr: 'stub', state: 'granted', ahead: 0,
+    acquire: () => Promise.resolve(),
+    release: () => {{}},
+  }}),
+}};
 // One file, in the folder itself — entriesUnder keys on `path`.
 const entries = [{{ id: 'f1', name: 'big.bin', path: 'album',
                    size: {total_bytes}, added_at: 0 }}];
-- 
cgit v1.2.3


From 77615ddb5fead3e74751a94847d3bcc99fc0a96d Mon Sep 17 00:00:00 2001
From: Christophe Besson <cbesson@gmail.com>
Date: Tue, 8 Sep 2026 23:43:46 +0200
Subject: fix(hub): the transfers row exists from the click
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Clicking Download produced nothing — no row, no icon, no panel — for as long as
it took to open somewhere to write, and then several rows at once. The streamed
path waits for the worker twice; a Save As dialog waits for a person. The row
was created after that, so the slowest part of a download happened with nothing
on screen to say it had begun.

The store gains a `prepare` step, distinct from `run`, and the order is now:
row, then target, then slot.

That last part is why the obvious fix was wrong. Taking the slot first would let
the row appear immediately, and it was tried this morning: a granted slot has to
be taken up within the node's deadline, opening a target can outlast it, and
three downloads became one. (The diagnosis at the time blamed that ordering for
revocations which were in fact a missing `touch()` call — the revert was right
for the wrong reason.) `makeLease` is called after `prepare` succeeds, never
before.

Three behaviours fall out, each with a test:

  - a dismissed dialog leaves nothing behind. `prepare` returning false drops
    the row: nothing started, so nothing should remain on screen to explain it;
  - the row takes the name the file was actually saved under, once known;
  - a refusal above the memory ceiling fails the row that is already there,
    rather than creating one to kill it.

`preparing` counts as live everywhere — badge, cancel, clearFinished, and
`_busy`, since closing a transport under a preparing transfer strands it exactly
as under a queued one. Six places asked "is this finished?" and were drifting
apart; there is one definition now.

Two mistakes in the tests, worth the note: one counted positions in an output
array by hand and was one out, which reads exactly like a failing assertion
about the code — the values are tagged now, not indexed. And
test_zip_size_limit.py's stub did not run `prepare`, so it no longer reached the
size check the file is about; it now behaves like the real store.

819 hub, 1169 node, 0 failed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HCGdheDLxGReuKHga3BtST
---
 packages/meshbay-hub/src/meshbay_hub/static/app.js |  23 +++-
 .../src/meshbay_hub/static/file-utils.js           | 111 +++++++++-----------
 .../src/meshbay_hub/static/locales/de.js           |   1 +
 .../src/meshbay_hub/static/locales/en.js           |   1 +
 .../src/meshbay_hub/static/locales/es.js           |   1 +
 .../src/meshbay_hub/static/locales/fr.js           |   1 +
 .../src/meshbay_hub/static/locales/it.js           |   1 +
 .../src/meshbay_hub/static/locales/ja.js           |   1 +
 .../src/meshbay_hub/static/locales/nl.js           |   1 +
 .../src/meshbay_hub/static/locales/pl.js           |   1 +
 .../src/meshbay_hub/static/locales/pt-BR.js        |   1 +
 .../src/meshbay_hub/static/locales/zh-CN.js        |   1 +
 .../src/meshbay_hub/static/transfers.js            |  90 ++++++++++++----
 packages/meshbay-hub/tests/test_transfers.py       | 116 +++++++++++++++++++++
 packages/meshbay-hub/tests/test_zip_size_limit.py  |  17 ++-
 15 files changed, 280 insertions(+), 87 deletions(-)

(limited to 'packages/meshbay-hub/src/meshbay_hub/static/locales/de.js')

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/app.js b/packages/meshbay-hub/src/meshbay_hub/static/app.js
index ff066cf..6f4bb92 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/app.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/app.js
@@ -157,9 +157,11 @@ function TransferWidget() {
   }, [open]);
 
   const running = items.filter(i => i.status === 'running');
-  const waiting = items.filter(i => i.status === 'queued');
+  const waiting = items.filter(
+    i => i.status === 'queued' || i.status === 'preparing');
   const finished = items.filter(
-    i => i.status !== 'running' && i.status !== 'queued');
+    i => i.status !== 'running' && i.status !== 'queued'
+      && i.status !== 'preparing');
   const active = running.length + waiting.length;
 
   // Grouped, and in this order: what is moving, what is waiting, what is over.
@@ -240,7 +242,8 @@ function TransferRow({ it }) {
           ? html`<a class="transfer-name" href="#" title=${it.name}
               onClick=${(e) => { e.preventDefault(); transfers.open(it.id); }}>${it.name}</a>`
           : html`<span class="transfer-name" title=${it.name}>${it.name}</span>`}
-        ${(it.status === 'running' || it.status === 'queued') && html`
+        ${(it.status === 'running' || it.status === 'queued'
+           || it.status === 'preparing') && html`
           <button class="transfer-cancel"
             aria-label=${t('transfers.cancel_one', { name: it.name })}
             title=${t('transfers.cancel')}
@@ -249,7 +252,19 @@ function TransferRow({ it }) {
           </button>
         `}
       </div>
-      ${it.status === 'queued'
+      ${it.status === 'preparing'
+        ? html`
+          ${/* Not a progress bar at 0%: nothing is wrong and nothing is
+                stalled, the download is still finding somewhere to write. The
+                row exists from the click precisely so this state is visible
+                instead of being an empty panel. */''}
+          <div class="dl-progress dl-waiting"></div>
+          <div class="transfer-meta">
+            <span>${t('transfers.preparing')}</span>
+            <span>${formatSize(it.total)}</span>
+          </div>
+        `
+        : it.status === 'queued'
         ? html`
           <div class="dl-progress dl-waiting"></div>
           <div class="transfer-meta">
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/file-utils.js b/packages/meshbay-hub/src/meshbay_hub/static/file-utils.js
index 61002d6..3475f81 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/file-utils.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/file-utils.js
@@ -321,47 +321,34 @@ async function pipelinedDownload(transport, gekKey, fileId, totalChunks, onChunk
  * download button — both just want "get this entry to disk".
  */
 async function downloadEntry(transfers, transport, gek, entry) {
-  // The target FIRST, then the slot — and that order is load-bearing.
-  //
-  // Asking for the slot first looks better (the widget could draw a row while
-  // the target is being chosen) and is wrong: a granted slot has to be taken up
-  // within the node's acceptance deadline, and opening a target can take thirty
-  // seconds of streamed-download timeouts, or as long as somebody leaves a Save
-  // As dialog open. The node then revokes the grant and passes it to the next
-  // in the queue — `transfer: reclaimed … (not_taken_up)` in its log — and this
-  // download starts fetching under a `tr` that is no longer granted.
-  //
-  // Measured, not reasoned: three downloads started, one arrived, and the
-  // node's log named the reason. Do not move this again without moving the
-  // deadline, and the deadline exists so a client that dies between asking and
-  // starting does not hold a slot nobody can use.
-  let target;
-  try {
-    target = await _openDownloadTarget(entry.name, entry.size);
-  } catch (err) {
-    // The refusal belongs in the transfers panel, not in a console nobody
-    // opens: that is where someone who just clicked Download is looking, and a
-    // failed row naming the reason is the whole point of refusing rather than
-    // filling the tab. Started only to be failed, deliberately.
-    transfers.start({
-      kind: 'download', name: entry.name, total: entry.size, transport,
-      run: async () => { throw err; },
-    });
-    return;
-  }
-  if (target === false) return;          // the picker was dismissed
-
-  const openRef = { url: null };
   const totalChunks = Math.ceil(entry.size / CHUNK_SIZE);
+  const openRef = { url: null };
+  let target = null;
+
   transfers.start({
-    kind: 'download', name: (target && target.name) || entry.name,
-    total: entry.size, transport,
-    // Asked for here, once there is somewhere to write: see the note above.
-    lease: transport.openTransfer({
+    kind: 'download', name: entry.name, total: entry.size, transport,
+
+    // The row exists from the click. Opening a target is what takes the time —
+    // the streamed path waits for the worker (twice), a Save As dialog waits
+    // for a person — and doing it before the row meant three clicks produced no
+    // panel at all and then several rows at once.
+    prepare: async () => {
+      target = await _openDownloadTarget(entry.name, entry.size);
+      // Dismissed: nothing was started, so nothing is left on screen.
+      if (target === false) return false;
+      return target ? { name: target.name } : true;
+    },
+
+    // After the target, never before: a granted slot has to be taken up within
+    // the node's deadline, and opening a target can outlast it. See §8.1 of
+    // ~/next/improve-downloads.md — the other order was tried and cost two of
+    // three downloads.
+    makeLease: () => transport.openTransfer({
       kind: 'download', bytes: entry.size, chunks: totalChunks }),
-    open: target
-      ? (target.open || null)
-      : () => { if (openRef.url) window.open(openRef.url, '_blank'); },
+
+    open: () => (target && target.open) ? target.open()
+      : (openRef.url ? window.open(openRef.url, '_blank') : undefined),
+
     run: async ({ signal, onProgress, lease }) => {
       let done = 0;
       const onChunk = (bytes) => { done += bytes; onProgress(done, entry.size); };
@@ -435,38 +422,36 @@ async function downloadDirectory(transfers, transport, gek, entries, dir, { setE
   // totalBytes decides how this is delivered, but it is not the archive's
   // size — headers and the central directory come on top — so it is not
   // announced as a Content-Length that the download would then miss.
-  let target;
-  try {
-    target = await _openDownloadTarget(suggested, totalBytes, {
-      types: [{ description: 'ZIP archive',
-                accept: { 'application/zip': ['.zip'] } }],
-    }, 0);
-  } catch (err) {
-    // Reported beside the folder that was clicked, like zip_too_large just
-    // above — this function is called in a loop over a selection, and the
-    // sibling folders must still download.
-    setError(err.message);
-    return;
-  }
-  if (target === false) return;
-  if (!target && !confirm(t('group.zip_no_stream', {
-    size: formatSize(totalBytes), name: suggested,
-  }))) {
-    return;
-  }
   const zipOpenRef = { url: null };
+  let target = null;
 
   transfers.start({
-    kind: 'download', name: (target && target.name) || suggested,
-    total: totalBytes, transport,
+    kind: 'download', name: suggested, total: totalBytes, transport,
+
+    // Same order as downloadEntry: the row first, then the target, then the
+    // slot. A folder of forty files is exactly where the wait is longest.
+    prepare: async () => {
+      target = await _openDownloadTarget(suggested, totalBytes, {
+        types: [{ description: 'ZIP archive',
+                  accept: { 'application/zip': ['.zip'] } }],
+      }, 0);
+      if (target === false) return false;
+      if (!target && !confirm(t('group.zip_no_stream', {
+        size: formatSize(totalBytes), name: suggested,
+      }))) {
+        return false;
+      }
+      return target ? { name: target.name } : true;
+    },
+
     // **One** lease for the archive, not one per file. Dozens of leases for a
     // folder would deadlock against the member's own cap: the job cannot finish
     // until it holds them all, and it can never hold more than two.
-    lease: transport.openTransfer({
+    makeLease: () => transport.openTransfer({
       kind: 'download', bytes: totalBytes, chunks: files.length }),
-    open: target
-      ? (target.open || null)
-      : () => { if (zipOpenRef.url) window.open(zipOpenRef.url, '_blank'); },
+
+    open: () => (target && target.open) ? target.open()
+      : (zipOpenRef.url ? window.open(zipOpenRef.url, '_blank') : undefined),
     run: async ({ signal, onProgress, lease }) => {
       const writable = target ? target.writable : null;
       const parts = writable ? null : [];
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
index f5c0c78..1458cf2 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
@@ -578,6 +578,7 @@ export default {
   'transfers.open': 'Öffnen',
   'transfers.done': 'Abgeschlossen',
   'transfers.cancelled': 'Abgebrochen',
+  'transfers.preparing': 'Wird vorbereitet…',
   'transfers.waiting_own_slots': 'Wartet — Ihre Plätze sind belegt',
   'transfers.waiting_node': 'Wartet — {n} davor',
   'transfers.summary': '{running} laufend · {waiting} wartend',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
index e3ed844..b0430c0 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
@@ -694,6 +694,7 @@ export default {
   'transfers.open': 'Open',
   'transfers.done': 'Finished',
   'transfers.cancelled': 'Cancelled',
+  'transfers.preparing': 'Preparing…',
   'transfers.waiting_own_slots': 'Waiting — your slots are busy',
   'transfers.waiting_node': 'Waiting — {n} ahead',
   'transfers.summary': '{running} running · {waiting} waiting',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
index c509599..adfb1cc 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
@@ -574,6 +574,7 @@ export default {
   'transfers.open': 'Abrir',
   'transfers.done': 'Terminada',
   'transfers.cancelled': 'Cancelada',
+  'transfers.preparing': 'Preparando…',
   'transfers.waiting_own_slots': 'En espera — sus espacios están ocupados',
   'transfers.waiting_node': 'En espera — {n} por delante',
   'transfers.summary': '{running} en curso · {waiting} en espera',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
index 49a1071..b409927 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
@@ -577,6 +577,7 @@ export default {
   'transfers.open': 'Ouvrir',
   'transfers.done': 'Terminé',
   'transfers.cancelled': 'Annulé',
+  'transfers.preparing': 'Préparation…',
   'transfers.waiting_own_slots': 'En attente — vos slots sont occupés',
   'transfers.waiting_node': 'En attente — {n} devant',
   'transfers.summary': '{running} en cours · {waiting} en attente',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
index 8f1ef1e..7e6246e 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
@@ -577,6 +577,7 @@ export default {
   'transfers.open': 'Apri',
   'transfers.done': 'Completato',
   'transfers.cancelled': 'Annullato',
+  'transfers.preparing': 'Preparazione…',
   'transfers.waiting_own_slots': 'In attesa — i suoi posti sono occupati',
   'transfers.waiting_node': 'In attesa — {n} prima',
   'transfers.summary': '{running} in corso · {waiting} in attesa',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
index 7ea9789..a74eec9 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
@@ -569,6 +569,7 @@ export default {
   'transfers.open': '開く',
   'transfers.done': '完了',
   'transfers.cancelled': 'キャンセル済み',
+  'transfers.preparing': '準備中…',
   'transfers.waiting_own_slots': '待機中 — 自分の枠がすべて使用中です',
   'transfers.waiting_node': '待機中 — 前に {n} 件',
   'transfers.summary': '実行中 {running} · 待機中 {waiting}',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
index 74cd269..a7d64f7 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
@@ -578,6 +578,7 @@ export default {
   'transfers.open': 'Openen',
   'transfers.done': 'Voltooid',
   'transfers.cancelled': 'Geannuleerd',
+  'transfers.preparing': 'Voorbereiden…',
   'transfers.waiting_own_slots': 'Wacht — uw plaatsen zijn bezet',
   'transfers.waiting_node': 'Wacht — {n} ervoor',
   'transfers.summary': '{running} bezig · {waiting} wachtend',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
index 584e5f2..5bd34fb 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
@@ -590,6 +590,7 @@ export default {
   'transfers.open': 'Otwórz',
   'transfers.done': 'Zakończony',
   'transfers.cancelled': 'Anulowany',
+  'transfers.preparing': 'Przygotowywanie…',
   'transfers.waiting_own_slots': 'Oczekiwanie — Twoje miejsca są zajęte',
   'transfers.waiting_node': 'Oczekiwanie — {n} przed',
   'transfers.summary': '{running} w toku · {waiting} oczekuje',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
index b034117..102ec92 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
@@ -576,6 +576,7 @@ export default {
   'transfers.open': 'Abrir',
   'transfers.done': 'Concluída',
   'transfers.cancelled': 'Cancelada',
+  'transfers.preparing': 'Preparando…',
   'transfers.waiting_own_slots': 'Aguardando — seus espaços estão ocupados',
   'transfers.waiting_node': 'Aguardando — {n} na frente',
   'transfers.summary': '{running} em andamento · {waiting} aguardando',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
index ffe2cb0..6b64785 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
@@ -557,6 +557,7 @@ export default {
   'transfers.open': '打开',
   'transfers.done': '已完成',
   'transfers.cancelled': '已取消',
+  'transfers.preparing': '准备中…',
   'transfers.waiting_own_slots': '等待中 — 您的通道已占满',
   'transfers.waiting_node': '等待中 — 前面还有 {n} 个',
   'transfers.summary': '进行中 {running} · 等待中 {waiting}',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transfers.js b/packages/meshbay-hub/src/meshbay_hub/static/transfers.js
index 46f75a2..d3b164d 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/transfers.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/transfers.js
@@ -22,6 +22,12 @@
 
 const SPEED_WINDOW_MS = 5000;
 
+/** Not finished: still preparing, waiting for a slot, or transferring. One
+ *  definition, because six places ask and they were drifting apart. */
+function _live(status) {
+  return status === 'preparing' || status === 'queued' || status === 'running';
+}
+
 function _abortError() {
   const err = new Error('Cancelled');
   err.name = 'AbortError';
@@ -84,8 +90,7 @@ export class TransferStore {
 
   /** Running or waiting for a slot — what the nav badge counts. */
   get pending() {
-    return this._items.filter(
-      it => it.status === 'running' || it.status === 'queued').length;
+    return this._items.filter(it => _live(it.status)).length;
   }
 
   _speed(it) {
@@ -104,8 +109,28 @@ export class TransferStore {
    * `run` receives `{ signal, onProgress }`. It must poll `signal.aborted` — a
    * cancel that only sets a flag nobody reads is a button that lies.
    */
+  /**
+   * Start a transfer.
+   *
+   * `run` receives `{ signal, onProgress, lease }`. It must poll
+   * `signal.aborted` — a cancel that only sets a flag nobody reads is a button
+   * that lies.
+   *
+   * `prepare` is optional and runs before anything else, with the row already
+   * on screen. It is where a download opens its target, which can take tens of
+   * seconds — the streamed path waits for the worker, twice, and a Save As
+   * dialog waits for a person. Doing that *before* creating the row meant three
+   * clicks produced no panel at all, not even the icon, and then several rows
+   * at once. Returning `false` drops the row again, which is what a dismissed
+   * dialog should look like: nothing, rather than a cancelled transfer nobody
+   * started.
+   *
+   * `makeLease` is called after `prepare` succeeds, never before. A granted
+   * slot must be taken up within the node's deadline, so it is asked for once
+   * there is somewhere to write — see file-utils.js's downloadEntry.
+   */
   start({ kind, name, total = 0, transport = null, run, open = null,
-          lease = null }) {
+          lease = null, prepare = null, makeLease = null }) {
     const item = {
       id: _nextId++,
       kind, name, total, transport, open, lease,
@@ -114,7 +139,8 @@ export class TransferStore {
       // 'running'. Two different things are true of it — nothing is moving, and
       // nothing is wrong — and a status that conflates them is what makes a
       // queue look like a hang.
-      status: lease && lease.state !== 'granted' ? 'queued' : 'running',
+      status: prepare ? 'preparing'
+        : (lease && lease.state !== 'granted' ? 'queued' : 'running'),
       ahead: (lease && lease.ahead) || 0,
       error: '',
       samples: [{ t: this._now(), done: 0 }],
@@ -155,17 +181,32 @@ export class TransferStore {
     // appear to move — the widget showing "3 ahead" for ever while the node
     // quietly worked through the queue. Nothing about that looks wrong from
     // either side, which is why it needs a test rather than a reading.
-    if (item.lease) {
-      item.lease._onState = (lease) => {
-        if (item.status !== 'queued' && item.status !== 'running') return;
-        item.ahead = lease.ahead;
-        item.status = lease.state === 'granted' ? 'running' : 'queued';
-        this._emit();
-      };
-    }
+    if (item.lease) this._watchLease(item);
 
     const promise = Promise.resolve()
       .then(async () => {
+        if (prepare) {
+          const ready = await prepare();
+          if (item.signal.aborted) throw _abortError();
+          if (ready === false) {
+            // Dismissed. Not a failure and not a cancellation: nothing was ever
+            // started, so nothing should be left on screen to explain.
+            this._drop(item.id);
+            return undefined;
+          }
+          if (ready && ready.name) item.name = ready.name;
+          item.status = 'running';
+          this._emit();
+        }
+        if (makeLease && !item.lease) {
+          item.lease = makeLease();
+          this._watchLease(item);
+          if (item.lease.state !== 'granted') {
+            item.status = 'queued';
+            item.ahead = item.lease.ahead || 0;
+            this._emit();
+          }
+        }
         if (item.lease) {
           await item.lease.acquire();
           if (item.signal.aborted) throw _abortError();
@@ -191,6 +232,21 @@ export class TransferStore {
     return item.id;
   }
 
+  _watchLease(item) {
+    item.lease._onState = (lease) => {
+      if (item.status !== 'queued' && item.status !== 'running') return;
+      item.ahead = lease.ahead;
+      item.status = lease.state === 'granted' ? 'running' : 'queued';
+      this._emit();
+    };
+  }
+
+  /** Remove a row entirely. Only for a transfer that never started. */
+  _drop(id) {
+    this._items = this._items.filter(it => it.id !== id);
+    this._emit();
+  }
+
   /**
    * Hand a finished download to the browser to display.
    *
@@ -209,7 +265,7 @@ export class TransferStore {
     // 'queued' too: a transfer waiting for a slot is exactly the one somebody
     // is most likely to give up on, and its queue entry has to go with it or
     // the node grants a slot to a transfer that will never use it.
-    if (!item || (item.status !== 'running' && item.status !== 'queued')) return;
+    if (!item || !_live(item.status)) return;
     item.signal.aborted = true;
     if (item.lease) item.lease.release('cancelled');
     // Marked at once. The work stops when it next looks, but a cancelled
@@ -221,14 +277,13 @@ export class TransferStore {
 
   cancelAll() {
     for (const it of this._items) {
-      if (it.status === 'running' || it.status === 'queued') this.cancel(it.id);
+      if (_live(it.status)) this.cancel(it.id);
     }
   }
 
   /** Drop everything finished, keeping what is still running or waiting. */
   clearFinished() {
-    this._items = this._items.filter(
-      it => it.status === 'running' || it.status === 'queued');
+    this._items = this._items.filter(it => _live(it.status));
     this._emit();
   }
 
@@ -237,8 +292,7 @@ export class TransferStore {
     // slot can never be granted one, and the transfer would sit at "waiting"
     // for ever with nothing left to answer it.
     return this._items.some(
-      it => it.transport === transport
-        && (it.status === 'running' || it.status === 'queued'));
+      it => it.transport === transport && _live(it.status));
   }
 
   /**
diff --git a/packages/meshbay-hub/tests/test_transfers.py b/packages/meshbay-hub/tests/test_transfers.py
index e805afc..7e21409 100644
--- a/packages/meshbay-hub/tests/test_transfers.py
+++ b/packages/meshbay-hub/tests/test_transfers.py
@@ -435,3 +435,119 @@ def test_the_slot_is_asked_for_after_there_is_somewhere_to_write():
     assert fn.index("_openDownloadTarget") < fn.index("openTransfer"), (
         "downloadEntry asks for a transfer slot before it has anywhere to "
         "write — the grant expires before the download can use it")
+
+
+# ── the row exists from the click ───────────────────────────────────────────
+
+def test_the_row_appears_before_the_target_is_open(tmp_path):
+    """
+    Opening a target is the slow part — the streamed path waits for the worker
+    twice, a Save As dialog waits for a person — and the row used to be created
+    only after it returned. Three clicks produced no panel at all, not even the
+    icon, and then several rows at once.
+    """
+    out = _run("""
+      const t = new TransferStore();
+      let release;
+      const opened = new Promise(r => { release = r; });
+      t.start({ kind: 'download', name: 'film.mkv', total: 10,
+                prepare: async () => { await opened; return { name: 'saved.mkv' }; },
+                run: async () => { say('ran'); } });
+      const shot = (when) => say(when + '=' + t.list().length + ':'
+        + t.list().map(i => i.status + '/' + i.name).join(','));
+      shot('click');
+      release();
+      await new Promise(r => setTimeout(r, 10));
+      shot('after');
+    """, tmp_path)
+    # Tagged, not indexed. An earlier version counted pushes by hand and was one
+    # out, which reads exactly like a failing assertion about the code.
+    seen = dict(line.split("=", 1) for line in out
+                if isinstance(line, str) and "=" in line)
+    assert {"click", "after"} <= set(seen), f"probe produced: {out}"
+    assert seen["click"] == "1:preparing/film.mkv", (
+        f"no row, or the wrong one, at the moment of the click: {seen['click']}")
+    assert seen["after"] == "1:done/saved.mkv", (
+        f"the row must keep the name it was saved under: {seen['after']}")
+
+
+def test_a_dismissed_dialog_leaves_nothing_behind(tmp_path):
+    """Dismissing a Save As dialog is not a failure and not a cancellation:
+    nothing was started, so nothing should be left on screen explaining it."""
+    out = _run("""
+      const t = new TransferStore();
+      t.start({ kind: 'download', name: 'film.mkv', total: 10,
+                prepare: async () => false,
+                run: async () => { say('ran'); } });
+      say('at click:', t.list().length);
+      await new Promise(r => setTimeout(r, 10));
+      say('after:', t.list().length, out.includes('ran'));
+    """, tmp_path)
+    assert out[1] == 1
+    assert out[3] == 0, "a dismissed dialog left a row behind"
+    assert out[4] is False
+
+
+def test_the_slot_is_only_asked_for_once_there_is_somewhere_to_write(tmp_path):
+    """
+    A granted slot must be taken up within the node's deadline, and opening a
+    target can outlast it. Asking first cost two of three downloads.
+    """
+    out = _run("""
+      const t = new TransferStore();
+      let release;
+      const opened = new Promise(r => { release = r; });
+      let asked = false;
+      t.start({ kind: 'download', name: 'f', total: 10,
+                prepare: async () => { await opened; return true; },
+                makeLease: () => { asked = true; return {
+                  state: 'granted', ahead: 0, tr: 'x',
+                  acquire: () => Promise.resolve(), release: () => {} }; },
+                run: async () => {} });
+      say('while preparing, asked?', asked);
+      release();
+      await new Promise(r => setTimeout(r, 10));
+      say('after preparing, asked?', asked, t.list()[0].status);
+    """, tmp_path)
+    assert out[1] is False, "the slot was taken before there was a target"
+    assert out[3] is True
+    assert out[4] == "done"
+
+
+def test_a_target_that_cannot_be_opened_fails_the_row_it_already_has(tmp_path):
+    """The refusal above the memory ceiling lands in the panel, on the row that
+    is already there, rather than in a console nobody opens."""
+    out = _run("""
+      const t = new TransferStore();
+      t.start({ kind: 'download', name: 'film.mkv', total: 10,
+                prepare: async () => { throw new Error('too large for memory'); },
+                run: async () => { say('ran'); } });
+      await new Promise(r => setTimeout(r, 10));
+      const it = t.list()[0];
+      say(it.status, it.error, out.includes('ran'));
+    """, tmp_path)
+    assert out[0] == "failed"
+    assert "too large" in out[1]
+    assert out[2] is False
+
+
+def test_a_transport_is_not_closed_under_a_preparing_transfer(tmp_path):
+    """It has no lease yet and has moved no bytes, but closing its transport
+    would strand it exactly like a queued one."""
+    out = _run("""
+      const t = new TransferStore();
+      let release;
+      const opened = new Promise(r => { release = r; });
+      let closed = false;
+      const transport = { close() { closed = true; } };
+      t.start({ kind: 'download', name: 'f', total: 10, transport,
+                prepare: async () => { await opened; return true; },
+                run: async () => {} });
+      t.releaseWhenIdle(transport);
+      say('closed while preparing:', closed);
+      release();
+      await new Promise(r => setTimeout(r, 10));
+      say('closed after:', closed);
+    """, tmp_path)
+    assert out[1] is False
+    assert out[3] is True
diff --git a/packages/meshbay-hub/tests/test_zip_size_limit.py b/packages/meshbay-hub/tests/test_zip_size_limit.py
index e970c55..28e3a0c 100644
--- a/packages/meshbay-hub/tests/test_zip_size_limit.py
+++ b/packages/meshbay-hub/tests/test_zip_size_limit.py
@@ -60,7 +60,7 @@ globalThis.localStorage = {{
 // Node 22 defines `navigator` itself, so it is left alone; `window` is what
 // platform.js reaches for to decide it is not running in the desktop app.
 globalThis.window = globalThis;
-const out = {{ errors: [], started: 0, asked: 0 }};
+const out = {{ errors: [], started: 0, asked: 0, dropped: 0 }};
 // Reached only once the size check has passed: with no File System Access API
 // under Node, downloadDirectory falls through to its build-in-memory path and
 // asks first. Answering yes is what lets the at-the-limit case get as far as
@@ -80,7 +80,18 @@ if ({picker_js}) {{
 
 const M = await import('{(sandbox / "file-utils.js").as_posix()}');
 
-const transfers = {{ start: () => {{ out.started += 1; }} }};
+// Faithful enough to the real store: it runs `prepare` and honours what it
+// returns. The target is opened there now — the row exists from the click and
+// the slow part happens behind it — so a stub that only counts calls would
+// never reach the size check this file is about.
+const transfers = {{ start: (opts) => {{
+  out.started += 1;
+  if (!opts.prepare) return;
+  Promise.resolve()
+    .then(() => opts.prepare())
+    .then((ready) => {{ if (ready === false) {{ out.started -= 1; out.dropped += 1; }} }})
+    .catch((e) => {{ out.started -= 1; out.errors.push(e.message); }});
+}} }};
 // A transport hands out transfer slots now (transfers.py's leases). The stub
 // grants at once, which is what a node with no caps does: what this file is
 // about is the archive limit, not the queue.
@@ -100,6 +111,8 @@ await M.downloadDirectory(transfers, transport, null, entries, 'album', {{
   setError: (m) => out.errors.push(m),
 }});
 
+// `prepare` runs on a microtask, so let it.
+await new Promise(r => setTimeout(r, 10));
 out.limit = M.ZIP_MAX_BYTES;
 console.log(JSON.stringify(out));
 """, encoding="utf-8")
-- 
cgit v1.2.3


From fc148e185c01b2e25361c7625a67d310d2e1d288 Mon Sep 17 00:00:00 2001
From: Christophe Besson <cbesson@gmail.com>
Date: Wed, 9 Sep 2026 10:05:30 +0200
Subject: fix(spa): repair a page the download worker cannot serve
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Downloads on Firefox failed with "the worker did not answer the download within
15s", every time, for one operator, while the same profile driven from here
succeeded every time. Their own test sequence found it: a freshly started
browser downloaded four files out of four, twice; one Ctrl+F5 and every
attempt afterwards failed; restart, fine again; Ctrl+F5 before any attempt and
the very first one failed.

A document fetched by a hard reload is loaded with the service worker bypassed.
It can still be claimed afterwards, so `navigator.serviceWorker.controller`
comes back and every check in `_claimController` passes — but the navigations
that document starts keep missing the worker, and the hidden iframe a streamed
download needs is a navigation. On Firefox and Safari that is the only way to
write a file too large to hold in memory, so the download cannot happen at all,
for the life of the page.

Being controlled is not being servable, so priming now asks the question
directly instead of inferring it: a four-byte stream and a hidden iframe,
exactly as a real download would, torn down completely so nothing lands in the
download folder. When it goes unanswered the page reloads once, ordinarily,
which puts it back under the worker. The flag lives in sessionStorage rather
than a variable because it has to survive the reload it triggers, and because a
page that is still unservable afterwards must stop rather than loop.

Also stops telling people to change browser. The message said "use the desktop
app, or Chrome or Edge" for a state an ordinary reload undoes, on the one path
Firefox has no alternative to; all ten catalogues now say to reload first.

The hard reloads were on my instruction: the SPA's HTML is served `no-store`,
so a plain reload has always picked up a new build and Ctrl+F5 was never needed.

Hub suite 834 passed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HCGdheDLxGReuKHga3BtST
---
 .../src/meshbay_hub/static/downloads.js            | 90 +++++++++++++++++++++-
 .../src/meshbay_hub/static/locales/de.js           |  2 +-
 .../src/meshbay_hub/static/locales/en.js           |  2 +-
 .../src/meshbay_hub/static/locales/es.js           |  2 +-
 .../src/meshbay_hub/static/locales/fr.js           |  2 +-
 .../src/meshbay_hub/static/locales/it.js           |  2 +-
 .../src/meshbay_hub/static/locales/ja.js           |  2 +-
 .../src/meshbay_hub/static/locales/nl.js           |  2 +-
 .../src/meshbay_hub/static/locales/pl.js           |  2 +-
 .../src/meshbay_hub/static/locales/pt-BR.js        |  2 +-
 .../src/meshbay_hub/static/locales/zh-CN.js        |  2 +-
 .../tests/test_streamed_download_reliability.py    | 74 ++++++++++++++++++
 12 files changed, 172 insertions(+), 12 deletions(-)

(limited to 'packages/meshbay-hub/src/meshbay_hub/static/locales/de.js')

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/downloads.js b/packages/meshbay-hub/src/meshbay_hub/static/downloads.js
index 7e4802a..b1eade6 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/downloads.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/downloads.js
@@ -200,6 +200,8 @@ export const BLOB_LIMIT = 512 * 1024 * 1024;
 // ── Streaming to disk without the File System Access API ────────────────────
 
 const SW_PATH = '/sw.js';
+// Kept in step with sw.js's own PREFIX.
+const PREFIX_PATH = '/_mbdl/';
 
 // On Firefox and Safari this worker is not a nicety, it is the only unbounded
 // way to write a download to disk: the File System Access API does not exist
@@ -365,7 +367,91 @@ async function _claimController(budgetMs) {
  */
 export function primeServiceWorker() {
   if (!STREAMS_VIA_SW) return;
-  serviceWorker().catch(() => {});
+  serviceWorker().then((worker) => worker && _repairIfBypassed(worker))
+    .catch(() => {});
+}
+
+// How long to wait for the worker to answer the one-byte self-test below.
+// Milliseconds when it works; a page that cannot stream at all is worth four
+// seconds to find out about, once, at boot.
+const SELF_TEST_BUDGET_MS = 4000;
+// Set for the life of this tab, so the repair below can happen at most once and
+// can never become a reload loop.
+const REPAIRED_KEY = 'meshbay.sw-repaired';
+
+/**
+ * Can this document actually have a download served, or only talk to the worker?
+ *
+ * Being controlled is not the same thing, and the gap between them is a real
+ * failure people hit. A document fetched by a **hard** reload — Ctrl+F5,
+ * Ctrl+Shift+R — is loaded with the service worker bypassed. It can still be
+ * claimed afterwards, so `navigator.serviceWorker.controller` comes back and
+ * every check in `_claimController` passes; but the navigations that document
+ * starts keep missing the worker, and the hidden iframe a streamed download
+ * needs *is* a navigation. Every download then fails with "the worker did not
+ * answer", for the life of that page — on Firefox and Safari, the only path
+ * there is for a file too large to hold in memory.
+ *
+ * Reported after an operator was told, by this author, to hard-reload after
+ * each deployment: four downloads out of four worked on a freshly started
+ * browser, and the first attempt after a Ctrl+F5 failed, every time.
+ *
+ * This asks the question directly rather than inferring it: a four-byte stream
+ * and a hidden iframe, exactly as a real download would.
+ */
+async function _canServeDownloads(worker) {
+  const id = `selftest-${Math.random().toString(36).slice(2, 10)}`;
+  let readable, writable;
+  try {
+    ({ readable, writable } = new TransformStream());
+  } catch {
+    return true;   // No transferable streams: a different failure, not this one.
+  }
+  const chan = new MessageChannel();
+  const serving = new Promise((resolve) => {
+    chan.port1.onmessage = (e) => {
+      if (e.data && e.data.type === 'mbdl-serving') resolve(true);
+    };
+  });
+  try {
+    worker.postMessage({ type: 'mbdl', id, filename: 'meshbay-selftest.bin',
+                         size: 4, readable, port: chan.port2 },
+                       [readable, chan.port2]);
+  } catch {
+    return true;   // Same: not the bypass this is looking for.
+  }
+  const frame = document.createElement('iframe');
+  frame.hidden = true;
+  frame.src = `${PREFIX_PATH}${id}`;
+  document.body.appendChild(frame);
+  const served = await Promise.race([
+    serving,
+    new Promise((r) => setTimeout(() => r(false), SELF_TEST_BUDGET_MS)),
+  ]);
+  frame.remove();
+  try { chan.port1.close(); } catch { /* already gone */ }
+  // Never completed, so the browser has nothing to save and no file appears.
+  try { await writable.abort('self-test'); } catch { /* already gone */ }
+  return served;
+}
+
+/**
+ * An ordinary reload puts the document back under the worker, so do that once.
+ *
+ * Only at boot, where nothing is in flight and the reload costs a flicker.
+ * Guarded by a session flag rather than a variable: the point is to survive the
+ * reload it triggers, and to stop rather than loop if reloading does not help.
+ */
+async function _repairIfBypassed(worker) {
+  let repaired = false;
+  try { repaired = sessionStorage.getItem(REPAIRED_KEY) === '1'; } catch { /* blocked */ }
+  if (repaired) return;
+  if (await _canServeDownloads(worker)) return;
+  console.warn('[MeshBay] this page cannot be served by the download worker — '
+               + 'reloading once to put it back under the worker\u2019s control '
+               + '(a hard reload leaves a page in this state)');
+  try { sessionStorage.setItem(REPAIRED_KEY, '1'); } catch { /* blocked */ }
+  location.reload();
 }
 
 async function serviceWorker(controlMs = SW_CONTROL_BUDGET_MS) {
@@ -458,7 +544,7 @@ async function _attemptStreamedDownload(filename, size, attempt,
 
   const frame = document.createElement('iframe');
   frame.hidden = true;
-  frame.src = `/_mbdl/${id}`;
+  frame.src = `${PREFIX_PATH}${id}`;
   document.body.appendChild(frame);
 
   const answered = await Promise.race([
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
index 1458cf2..f0ec776 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
@@ -219,7 +219,7 @@ export default {
   'preview.pdf_fallback': 'Dieser Browser zeigt das PDF nicht direkt an. Laden Sie es '
     + 'stattdessen herunter — entschlüsselt wurde es ohnehin hier.',
   'preview.too_large': 'Diese Datei ist {size} groß, mehr als diese Seite im Arbeitsspeicher halten kann ({limit}). Laden Sie sie stattdessen herunter — ein Download wird direkt auf die Festplatte geschrieben.',
-  'download.too_large_for_memory': '„{name}“ ist {size} groß. Dieser Browser kann eine Datei dieser Größe nur speichern, indem er sie direkt auf die Festplatte schreibt, und das ist hier nicht möglich — er müsste die ganze Datei im Arbeitsspeicher halten. Verwenden Sie die Desktop-App oder Chrome bzw. Edge.',
+  'download.too_large_for_memory': '„{name}“ ist {size} groß. Dieser Browser kann eine Datei dieser Größe nur speichern, indem er sie direkt auf die Festplatte schreibt, und das ist hier nicht möglich — er müsste die ganze Datei im Arbeitsspeicher halten. Laden Sie die Seite neu und versuchen Sie es erneut; falls das nicht hilft, verwenden Sie die Desktop-App.',
   'group.upload_indexing': 'wird indiziert …',
   'video.err_transport': 'Transport nicht verbunden',
   'video.err_mse': 'Codec wird für das Streaming nicht unterstützt: {codec}',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
index b0430c0..c065b8a 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
@@ -217,7 +217,7 @@ export default {
   'video.close': 'Close (Esc)',
   'preview.pdf_fallback': 'This browser will not display the PDF inline. Download it instead — it was decrypted here either way.',
   'preview.too_large': 'This file is {size}, more than this page can hold in memory ({limit}). Download it instead — a download is written straight to disk.',
-  'download.too_large_for_memory': '"{name}" is {size}. This browser can only save a file that large by streaming it to disk, and it has no way to do that here — it would have to hold the whole file in memory. Use the desktop app, or Chrome or Edge.',
+  'download.too_large_for_memory': '"{name}" is {size}. This browser can only save a file that large by streaming it to disk, and it has no way to do that here — it would have to hold the whole file in memory. Reload the page and try again; if that does not help, use the desktop app.',
   'group.upload_indexing': 'indexing…',
   'video.err_transport': 'Transport not connected',
   'video.err_mse': 'Codec not supported for streaming: {codec}',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
index adfb1cc..f655bc0 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
@@ -217,7 +217,7 @@ export default {
   'preview.pdf_fallback': 'Este navegador no mostrará el PDF integrado. Descárguelo '
     + 'en su lugar — en cualquier caso se descifró aquí.',
   'preview.too_large': 'Este archivo ocupa {size}, más de lo que esta página puede mantener en memoria ({limit}). Descárguelo en su lugar — una descarga se escribe directamente en disco.',
-  'download.too_large_for_memory': '«{name}» ocupa {size}. Este navegador solo puede guardar un archivo así transmitiéndolo al disco, y aquí no puede hacerlo — tendría que mantener el archivo entero en memoria. Use la aplicación de escritorio, o Chrome o Edge.',
+  'download.too_large_for_memory': '«{name}» ocupa {size}. Este navegador solo puede guardar un archivo así transmitiéndolo al disco, y aquí no puede hacerlo — tendría que mantener el archivo entero en memoria. Recargue la página e inténtelo de nuevo; si eso no ayuda, use la aplicación de escritorio.',
   'group.upload_indexing': 'indexando…',
   'video.err_transport': 'Transporte no conectado',
   'video.err_mse': 'Códec no compatible con la reproducción en continuo: {codec}',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
index b409927..e011873 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
@@ -218,7 +218,7 @@ export default {
   'preview.pdf_fallback': 'Ce navigateur n’affichera pas le PDF directement. '
     + 'Téléchargez-le plutôt — il a été déchiffré ici dans les deux cas.',
   'preview.too_large': 'Ce fichier fait {size}, plus que cette page ne peut garder en mémoire ({limit}). Téléchargez-le plutôt — un téléchargement est écrit directement sur le disque.',
-  'download.too_large_for_memory': '« {name} » fait {size}. Ce navigateur ne peut enregistrer un fichier de cette taille qu\'en l\'écrivant au fil de l\'eau sur le disque, ce qu\'il ne peut pas faire ici — il devrait garder le fichier entier en mémoire. Utilisez l\'application de bureau, ou Chrome ou Edge.',
+  'download.too_large_for_memory': '« {name} » fait {size}. Ce navigateur ne peut enregistrer un fichier de cette taille qu\'en l\'écrivant au fil de l\'eau sur le disque, ce qu\'il ne peut pas faire ici — il devrait garder le fichier entier en mémoire. Rechargez la page et réessayez ; si cela ne suffit pas, utilisez l\'application de bureau.',
   'group.upload_indexing': 'indexation…',
   'video.err_transport': 'Transport non connecté',
   'video.err_mse': 'Codec non pris en charge pour la diffusion : {codec}',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
index 7e6246e..80e3c17 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
@@ -218,7 +218,7 @@ export default {
   'preview.pdf_fallback': 'Questo browser non mostrerà il PDF nella pagina. Lo scarichi '
     + 'invece — in ogni caso è stato decifrato qui.',
   'preview.too_large': 'Questo file è di {size}, più di quanto questa pagina possa tenere in memoria ({limit}). Lo scarichi invece — un download viene scritto direttamente su disco.',
-  'download.too_large_for_memory': '«{name}» è di {size}. Questo browser può salvare un file di queste dimensioni solo scrivendolo su disco man mano, e qui non può farlo — dovrebbe tenere l’intero file in memoria. Usi l’applicazione desktop, oppure Chrome o Edge.',
+  'download.too_large_for_memory': '«{name}» è di {size}. Questo browser può salvare un file di queste dimensioni solo scrivendolo su disco man mano, e qui non può farlo — dovrebbe tenere l’intero file in memoria. Ricarichi la pagina e riprovi; se non basta, usi l’applicazione desktop.',
   'group.upload_indexing': 'indicizzazione…',
   'video.err_transport': 'Trasporto non connesso',
   'video.err_mse': 'Codec non supportato per lo streaming: {codec}',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
index a74eec9..5dbb4fa 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
@@ -215,7 +215,7 @@ export default {
   'preview.pdf_fallback': 'このブラウザーはページ内に PDF を表示しません。'
     + 'ダウンロードしてご覧ください。いずれにせよ復号はここで行われています。',
   'preview.too_large': 'このファイルは {size} で、このページがメモリに保持できる上限（{limit}）を超えています。代わりにダウンロードしてください。ダウンロードはディスクに直接書き込まれます。',
-  'download.too_large_for_memory': '「{name}」は {size} です。このブラウザーでこの大きさのファイルを保存するにはディスクへ逐次書き出すしかありませんが、ここではそれができません — ファイル全体をメモリに保持することになります。デスクトップアプリ、または Chrome か Edge をお使いください。',
+  'download.too_large_for_memory': '「{name}」は {size} です。このブラウザーでこの大きさのファイルを保存するにはディスクへ逐次書き出すしかありませんが、ここではそれができません — ファイル全体をメモリに保持することになります。ページを再読み込みしてもう一度お試しください。解決しない場合はデスクトップアプリをお使いください。',
   'group.upload_indexing': 'インデックスを作成中…',
   'video.err_transport': 'トランスポートが接続されていません',
   'video.err_mse': 'ストリーミング再生に対応していないコーデックです：{codec}',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
index a7d64f7..f9c7cf3 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
@@ -219,7 +219,7 @@ export default {
   'preview.pdf_fallback': 'Deze browser toont de PDF niet in de pagina zelf. Download '
     + 'hem in plaats daarvan — ontsleuteld werd hij hoe dan ook hier.',
   'preview.too_large': 'Dit bestand is {size}, meer dan deze pagina in het geheugen kan houden ({limit}). Download het in plaats daarvan — een download wordt rechtstreeks naar schijf geschreven.',
-  'download.too_large_for_memory': '“{name}” is {size}. Deze browser kan een bestand van die omvang alleen opslaan door het meteen naar schijf te schrijven, en dat kan hier niet — het hele bestand zou in het geheugen moeten. Gebruik de desktop-app, of Chrome of Edge.',
+  'download.too_large_for_memory': '“{name}” is {size}. Deze browser kan een bestand van die omvang alleen opslaan door het meteen naar schijf te schrijven, en dat kan hier niet — het hele bestand zou in het geheugen moeten. Herlaad de pagina en probeer het opnieuw; als dat niet helpt, gebruik dan de desktop-app.',
   'group.upload_indexing': 'indexeren…',
   'video.err_transport': 'Transport niet verbonden',
   'video.err_mse': 'Codec wordt niet ondersteund voor streamen: {codec}',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
index 5bd34fb..b26f3cb 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
@@ -224,7 +224,7 @@ export default {
   'preview.pdf_fallback': 'Ta przeglądarka nie wyświetli pliku PDF na stronie. Proszę '
     + 'go pobrać — i tak został odszyfrowany tutaj.',
   'preview.too_large': 'Ten plik ma {size}, więcej niż ta strona może utrzymać w pamięci ({limit}). Proszę go zamiast tego pobrać — pobieranie jest zapisywane wprost na dysk.',
-  'download.too_large_for_memory': '„{name}” ma {size}. Ta przeglądarka może zapisać plik tej wielkości tylko strumieniowo na dysk, a tutaj nie ma takiej możliwości — musiałaby utrzymać cały plik w pamięci. Proszę użyć aplikacji desktopowej albo przeglądarki Chrome lub Edge.',
+  'download.too_large_for_memory': '„{name}” ma {size}. Ta przeglądarka może zapisać plik tej wielkości tylko strumieniowo na dysk, a tutaj nie ma takiej możliwości — musiałaby utrzymać cały plik w pamięci. Proszę odświeżyć stronę i spróbować ponownie; jeśli to nie pomoże, proszę użyć aplikacji desktopowej.',
   'group.upload_indexing': 'indeksowanie…',
   'video.err_transport': 'Transport nie jest połączony',
   'video.err_mse': 'Kodek nieobsługiwany przy odtwarzaniu strumieniowym: {codec}',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
index 102ec92..db5a408 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
@@ -219,7 +219,7 @@ export default {
   'preview.pdf_fallback': 'Este navegador não exibirá o PDF na própria página. Baixe '
     + 'o arquivo — de todo modo ele foi descriptografado aqui.',
   'preview.too_large': 'Este arquivo tem {size}, mais do que esta página consegue manter na memória ({limit}). Baixe-o em vez disso — um download é gravado direto no disco.',
-  'download.too_large_for_memory': '"{name}" tem {size}. Este navegador só consegue salvar um arquivo desse tamanho gravando-o direto no disco, e aqui ele não tem como — precisaria manter o arquivo inteiro na memória. Use o aplicativo para computador, ou Chrome ou Edge.',
+  'download.too_large_for_memory': '"{name}" tem {size}. Este navegador só consegue salvar um arquivo desse tamanho gravando-o direto no disco, e aqui ele não tem como — precisaria manter o arquivo inteiro na memória. Recarregue a página e tente novamente; se não resolver, use o aplicativo para computador.',
   'group.upload_indexing': 'indexando…',
   'video.err_transport': 'Transporte não conectado',
   'video.err_mse': 'Codec sem suporte para transmissão: {codec}',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
index 6b64785..ba88f4e 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
@@ -212,7 +212,7 @@ export default {
   'video.close': '关闭（Esc）',
   'preview.pdf_fallback': '此浏览器不会在页面内显示该 PDF。请改为下载——无论如何它都已在本地解密。',
   'preview.too_large': '该文件为 {size}，超出本页面可在内存中保存的上限（{limit}）。请改为下载——下载会直接写入磁盘。',
-  'download.too_large_for_memory': '“{name}”为 {size}。此浏览器只能通过边下边写入磁盘来保存这么大的文件，而这里无法做到——它将不得不把整个文件放在内存中。请使用桌面应用，或 Chrome、Edge。',
+  'download.too_large_for_memory': '“{name}”为 {size}。此浏览器只能通过边下边写入磁盘来保存这么大的文件，而这里无法做到——它将不得不把整个文件放在内存中。请重新加载页面后重试；如果仍然无效，请使用桌面应用。',
   'group.upload_indexing': '建立索引中…',
   'video.err_transport': '传输未连接',
   'video.err_mse': '该编解码器不支持流式播放：{codec}',
diff --git a/packages/meshbay-hub/tests/test_streamed_download_reliability.py b/packages/meshbay-hub/tests/test_streamed_download_reliability.py
index 9e6f77d..3033a95 100644
--- a/packages/meshbay-hub/tests/test_streamed_download_reliability.py
+++ b/packages/meshbay-hub/tests/test_streamed_download_reliability.py
@@ -110,6 +110,16 @@ Object.defineProperty(globalThis, 'navigator', {
 
 globalThis.window = globalThis;
 globalThis.isSecureContext = true;
+// The self-test's repair reloads once and remembers it for the tab; both have
+// to exist here or priming the worker throws instead of repairing.
+const session = new Map();
+globalThis.sessionStorage = {
+  getItem: k => (session.has(k) ? session.get(k) : null),
+  setItem: (k, v) => session.set(k, String(v)),
+  removeItem: k => session.delete(k),
+};
+log.reloads = 0;
+globalThis.location = { reload: () => { log.reloads += 1; } };
 globalThis.document = {
   createElement: () => ({ hidden: false, src: '', remove() {} }),
   body: {
@@ -377,3 +387,67 @@ if (target) await target.writable.close();
         "the stuck registration was left in place")
     assert out["target"] is True, (
         "discarding it did not get the page a worker it could stream to")
+
+
+# ── A page the worker cannot serve ──────────────────────────────────────────
+
+def test_a_page_the_worker_cannot_serve_reloads_itself_once(tmp_path):
+    """Being controlled is not being servable, and the gap is a real failure.
+
+    A document fetched by a hard reload — Ctrl+F5, Ctrl+Shift+R — is loaded with
+    the service worker bypassed. It can be claimed afterwards, so `controller`
+    comes back and every check in `_claimController` passes; but the navigations
+    it starts keep missing the worker, and the hidden iframe a streamed download
+    needs is a navigation. Every download then fails with "the worker did not
+    answer" for the life of that page — on Firefox and Safari, the only path
+    there is for a file too large to hold in memory.
+
+    Reported after an operator was told to hard-reload after each deployment:
+    four downloads out of four worked on a freshly started browser, and the
+    first attempt after a Ctrl+F5 failed, every time. An ordinary reload puts
+    the document back under the worker, so priming does exactly that, once.
+    """
+    out = _run(tmp_path, """
+      M.primeServiceWorker();
+      await new Promise((r) => setTimeout(r, 6000));
+      out.reloads = log.reloads;
+    """, serve="never")
+    assert out["reloads"] == 1, (
+        "a page that cannot be served by the worker was left that way")
+
+
+def test_a_page_that_works_is_not_reloaded(tmp_path):
+    """The self-test costs milliseconds when it passes, and must cost nothing
+    else. Reloading a healthy page at boot would be a flicker on every visit."""
+    out = _run(tmp_path, """
+      M.primeServiceWorker();
+      await new Promise((r) => setTimeout(r, 3000));
+      out.reloads = log.reloads;
+    """)
+    assert out["reloads"] == 0
+
+
+def test_the_repair_happens_at_most_once(tmp_path):
+    """The flag is in sessionStorage rather than a variable because the point is
+    to survive the reload it triggers. If reloading does not help, the page
+    stays broken and says so — it does not reload again, and again."""
+    out = _run(tmp_path, """
+      sessionStorage.setItem('meshbay.sw-repaired', '1');
+      M.primeServiceWorker();
+      await new Promise((r) => setTimeout(r, 6000));
+      out.reloads = log.reloads;
+    """, serve="never")
+    assert out["reloads"] == 0, "a page that had already been repaired reloaded again"
+
+
+def test_the_self_test_leaves_no_file_behind(tmp_path):
+    """It opens a real download target to ask a real question, so it must also
+    tear it down: a completed one would drop `meshbay-selftest.bin` into the
+    download folder on every page load."""
+    src = DOWNLOADS.read_text()
+    fn = src[src.index("async function _canServeDownloads"):]
+    fn = fn[:fn.index("\n}\n")]
+    assert "writable.abort" in fn, (
+        "the self-test's stream is never aborted, so the browser keeps what it "
+        "was given")
+    assert "frame.remove" in fn
-- 
cgit v1.2.3


From 29e93e5e553c94818cd2b4e587b0e54cfe7d8424 Mon Sep 17 00:00:00 2001
From: Christophe Besson <cbesson@gmail.com>
Date: Wed, 9 Sep 2026 10:48:49 +0200
Subject: feat(spa): pause and resume a download, in session
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Stage 7a of ~/next/improve-downloads.md: pausing within a session, on the
targets that can actually do it. Resuming across a reload is 7b.

A paused transfer holds **nothing**. Its slot goes back to the node the moment
it stops and resuming rejoins the queue at the tail, because anything else lets
one member close a node by pausing four downloads and going to lunch. So the
lease is taken inside the run loop rather than before it, and pause is refused
outright for a transfer that could not ask for another one.

Resuming is exact rather than approximate: the pipeline stops between two
chunks and never inside one, so what is on disk is always a whole number of
chunks and `fromChunk` is a verified position. The failure mode being avoided
is a file that looks complete and is quietly corrupt.

The target has to survive it, so a pause no longer reaches the `abort()` that a
failure does -- that would delete Electron's `.part` or the file just created in
the granted folder, leaving nothing to continue. And the in-memory fallback
keeps its accumulated chunks rather than starting a second array.

The button is drawn only where the target says it can. A service-worker stream
says no, in its own code and for its own reasons: the browser is already writing
an HTTP response into its own download folder, not feeding it stalls that
download where we cannot see or resume it, and an idle worker is terminated
within seconds. Firefox and Safari therefore keep cancel and get no pause, which
is the decision recorded in §6.5.

Cancelling a paused transfer ends it. A paused run is parked on a promise;
without waking it the row said "cancelled" over work that had not stopped and a
target that was still open.

Six cases, each checked against the unfixed source. Hub suite 842 passed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HCGdheDLxGReuKHga3BtST
---
 packages/meshbay-hub/src/meshbay_hub/static/app.js |  32 ++++-
 .../src/meshbay_hub/static/downloads.js            |  11 ++
 .../src/meshbay_hub/static/file-utils.js           |  57 ++++++--
 .../src/meshbay_hub/static/locales/de.js           |   5 +
 .../src/meshbay_hub/static/locales/en.js           |   5 +
 .../src/meshbay_hub/static/locales/es.js           |   5 +
 .../src/meshbay_hub/static/locales/fr.js           |   5 +
 .../src/meshbay_hub/static/locales/it.js           |   5 +
 .../src/meshbay_hub/static/locales/ja.js           |   5 +
 .../src/meshbay_hub/static/locales/nl.js           |   5 +
 .../src/meshbay_hub/static/locales/pl.js           |   5 +
 .../src/meshbay_hub/static/locales/pt-BR.js        |   5 +
 .../src/meshbay_hub/static/locales/zh-CN.js        |   5 +
 .../meshbay-hub/src/meshbay_hub/static/style.css   |  14 ++
 .../src/meshbay_hub/static/transfers.js            | 118 +++++++++++++--
 packages/meshbay-hub/tests/test_downloads.py       |  68 +++++++++
 packages/meshbay-hub/tests/test_transfers.py       | 160 +++++++++++++++++++++
 17 files changed, 484 insertions(+), 26 deletions(-)

(limited to 'packages/meshbay-hub/src/meshbay_hub/static/locales/de.js')

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/app.js b/packages/meshbay-hub/src/meshbay_hub/static/app.js
index 6f4bb92..0394af6 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/app.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/app.js
@@ -242,8 +242,24 @@ function TransferRow({ it }) {
           ? html`<a class="transfer-name" href="#" title=${it.name}
               onClick=${(e) => { e.preventDefault(); transfers.open(it.id); }}>${it.name}</a>`
           : html`<span class="transfer-name" title=${it.name}>${it.name}</span>`}
+        ${it.pausable && (it.status === 'running' || it.status === 'paused')
+          && html`
+          ${/* Offered only where the target can actually do it: a
+                service-worker stream is a download the browser already owns,
+                and a pause there would restart from zero. */''}
+          <button class="transfer-pause"
+            aria-label=${t(it.status === 'paused'
+                           ? 'transfers.resume_one' : 'transfers.pause_one',
+                           { name: it.name })}
+            title=${t(it.status === 'paused'
+                      ? 'transfers.resume' : 'transfers.pause')}
+            onClick=${() => (it.status === 'paused'
+                             ? transfers.resume(it.id) : transfers.pause(it.id))}>
+            <${Icon} name=${it.status === 'paused' ? 'play' : 'pause'} />
+          </button>
+        `}
         ${(it.status === 'running' || it.status === 'queued'
-           || it.status === 'preparing') && html`
+           || it.status === 'preparing' || it.status === 'paused') && html`
           <button class="transfer-cancel"
             aria-label=${t('transfers.cancel_one', { name: it.name })}
             title=${t('transfers.cancel')}
@@ -274,6 +290,20 @@ function TransferRow({ it }) {
             <span>${formatSize(it.total)}</span>
           </div>
         `
+        : it.status === 'paused'
+        ? html`
+          ${/* The bar keeps its fill: what has been written is still there,
+                and resuming continues from it rather than starting again. */''}
+          <div class="dl-progress" role="progressbar"
+            aria-valuenow=${it.percent} aria-valuemin="0" aria-valuemax="100">
+            <div class="dl-fill dl-paused" style="width:${it.percent}%"></div>
+          </div>
+          <div class="transfer-meta">
+            <span>${t('transfers.paused')}</span>
+            <span>${formatSize(it.done)}${it.total
+              ? ' / ' + formatSize(it.total) : ''}</span>
+          </div>
+        `
         : it.status === 'running'
         ? html`
           <div class="dl-progress" role="progressbar"
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/downloads.js b/packages/meshbay-hub/src/meshbay_hub/static/downloads.js
index 87d18b7..6ee7cf0 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/downloads.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/downloads.js
@@ -178,6 +178,9 @@ export async function openTarget(filename) {
       },
     },
     name,
+    // A held-open `FileSystemWritableFileStream`: pausing is simply not
+    // writing to it, and nothing is lost while nothing is written.
+    pausable: true,
     // Reading it back is the only way a page can "open" a file it wrote: hand
     // the bytes to a tab and let the browser decide what to do with them. No
     // web page can start a desktop application, or show a file manager.
@@ -612,6 +615,14 @@ async function _attemptStreamedDownload(filename, size, attempt,
   const writer = writable.getWriter();
   return {
     name: filename,
+    // **Not pausable, and this is not a limitation of our code.** The browser
+    // is already writing an HTTP response into its own download folder: not
+    // writing to the stream stalls that download where we cannot see it or
+    // resume it, and an idle worker is terminated within seconds, taking the
+    // stream with it. A pause button here would restart from zero, which is
+    // worse than not offering one. §6.5 of ~/next/improve-downloads.md records
+    // what giving Firefox and Safari a resumable target would cost.
+    pausable: false,
     writable: {
       write: (bytes) => { lastWrite = Date.now(); return writer.write(bytes); },
       close: async () => {
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/file-utils.js b/packages/meshbay-hub/src/meshbay_hub/static/file-utils.js
index ef074dd..99d9f9a 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/file-utils.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/file-utils.js
@@ -118,7 +118,10 @@ async function _openDownloadTarget(filename, size = 0, pickerOpts = {},
         filename, { auto: downloads.getMode() === 'auto' });
       // Null means the person dismissed the dialog, which is not an error and
       // must not start a transfer.
-      return native || false;
+      //
+      // The desktop sink is an open file stream in the main process: not
+      // writing to it for a while costs nothing and loses nothing.
+      return native ? { ...native, pausable: true } : false;
     } catch (err) {
       console.warn('[MeshBay] native save failed:', platform.bridgeMessage(err));
       return false;
@@ -179,7 +182,8 @@ async function _openDownloadTarget(filename, size = 0, pickerOpts = {},
     const handle = await window.showSaveFilePicker({
       suggestedName: filename, ...pickerOpts,
     });
-    return { writable: await handle.createWritable(), name: handle.name || filename };
+    return { writable: await handle.createWritable(),
+             name: handle.name || filename, pausable: true };
   } catch (err) {
     if (err.name === 'AbortError') return false;
     // "Must be handling a user gesture to show a file picker."
@@ -350,9 +354,10 @@ async function _fetchChunkResilient(transport, fileId, index, tr = '') {
 }
 
 async function pipelinedDownload(transport, gekKey, fileId, totalChunks, onChunk,
-                                 writable, signal, tr = '') {
-  const results = writable ? null : new Array(totalChunks);
-  let nextSend = 0, nextRecv = 0;
+                                 writable, signal, tr = '', fromChunk = 0,
+                                 results = null) {
+  if (!writable && !results) results = new Array(totalChunks);
+  let nextSend = fromChunk, nextRecv = fromChunk;
   const inflight = new Array(totalChunks);
 
   const fire = () => {
@@ -369,6 +374,21 @@ async function pipelinedDownload(transport, gekKey, fileId, totalChunks, onChunk
       err.name = 'AbortError';
       throw err;
     }
+    // Between two chunks, never inside one. Everything written so far is a
+    // whole number of chunks, which is what makes resuming exact rather than
+    // approximate — `fromChunk` is a position, not an estimate, and a resumed
+    // file is never appended to at an offset nobody checked.
+    //
+    // The chunks already in flight past this point are abandoned and asked for
+    // again on resume: at most one pipeline window of duplicated traffic, in
+    // exchange for not having to hold a half-received window across a pause of
+    // unknown length.
+    if (signal && signal.paused) {
+      signal.resumeFrom = nextRecv;
+      const err = new Error('Paused');
+      err.name = 'PausedError';
+      throw err;
+    }
     const chunkMsg = await inflight[nextRecv];
     // One shape, and a refusal for anything else. There used to be two fallbacks
     // below this: a base64 `ct_b64` chunk, which was the real wire format until
@@ -409,6 +429,9 @@ async function downloadEntry(transfers, transport, gek, entry) {
   const totalChunks = Math.ceil(entry.size / CHUNK_SIZE);
   const openRef = { url: null };
   let target = null;
+  // The in-memory fallback's accumulator, held out here so a pause does not
+  // discard what has already been decrypted.
+  const memoryChunks = new Array(totalChunks);
 
   transfers.start({
     kind: 'download', name: entry.name, total: entry.size, transport,
@@ -421,7 +444,10 @@ async function downloadEntry(transfers, transport, gek, entry) {
       target = await _openTargetInTurn(entry.name, entry.size);
       // Dismissed: nothing was started, so nothing is left on screen.
       if (target === false) return false;
-      return target ? { name: target.name } : true;
+      // `pausable` travels with the target, because only the target knows. The
+      // in-memory fallback (a null target) is just an array and pauses fine.
+      return target ? { name: target.name, pausable: !!target.pausable }
+                    : { pausable: true };
     },
 
     // After the target, never before: a granted slot has to be taken up within
@@ -434,24 +460,33 @@ async function downloadEntry(transfers, transport, gek, entry) {
     open: () => (target && target.open) ? target.open()
       : (openRef.url ? window.open(openRef.url, '_blank') : undefined),
 
-    run: async ({ signal, onProgress, lease }) => {
-      let done = 0;
+    // Kept across a pause: the chunks collected so far on the in-memory path.
+    // A resumed run fills in from where it stopped rather than starting a
+    // second array and throwing the first away.
+    run: async ({ signal, onProgress, lease, from = 0 }) => {
+      let done = from * CHUNK_SIZE;
       const onChunk = (bytes) => { done += bytes; onProgress(done, entry.size); };
 
       if (target) {
         try {
           await pipelinedDownload(transport, gek, entry.id, totalChunks,
                                   onChunk, target.writable, signal,
-                                  lease && lease.tr);
+                                  lease && lease.tr, from);
           await target.writable.close();
         } catch (err) {
-          await target.writable.abort().catch(() => {});
+          // A pause is not a failure, and the target must survive it: aborting
+          // here would delete the `.part` (Electron) or the file just created
+          // in the granted folder, and resuming would then have nothing to
+          // continue. Only a real end tears the target down.
+          if (err.name !== 'PausedError') {
+            await target.writable.abort().catch(() => {});
+          }
           throw err;
         }
       } else {
         const chunks = await pipelinedDownload(
           transport, gek, entry.id, totalChunks, onChunk, null, signal,
-          lease && lease.tr);
+          lease && lease.tr, from, memoryChunks);
         const blob = new Blob(chunks);
         _saveBlob(blob, entry.name);
         openRef.url = URL.createObjectURL(blob);
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
index f0ec776..ae20687 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
@@ -586,6 +586,11 @@ export default {
   'transfers.group_waiting': 'Wartend',
   'transfers.group_finished': 'Abgeschlossen',
   'transfers.cancel_one': '{name} abbrechen',
+  'transfers.pause': 'Anhalten',
+  'transfers.resume': 'Fortsetzen',
+  'transfers.paused': 'Angehalten',
+  'transfers.pause_one': '{name} anhalten',
+  'transfers.resume_one': '{name} fortsetzen',
   'transfers.eta_seconds': 'noch {n} s',
   'transfers.eta_minutes': 'noch {n} Min.',
   'transfers.eta_hours': 'noch {n} Std.',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
index c065b8a..7033778 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
@@ -702,6 +702,11 @@ export default {
   'transfers.group_waiting': 'Waiting',
   'transfers.group_finished': 'Finished',
   'transfers.cancel_one': 'Cancel {name}',
+  'transfers.pause': 'Pause',
+  'transfers.resume': 'Resume',
+  'transfers.paused': 'Paused',
+  'transfers.pause_one': 'Pause {name}',
+  'transfers.resume_one': 'Resume {name}',
   'transfers.eta_seconds': '{n}s left',
   'transfers.eta_minutes': '{n} min left',
   'transfers.eta_hours': '{n} h left',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
index f655bc0..311ba1f 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
@@ -582,6 +582,11 @@ export default {
   'transfers.group_waiting': 'En espera',
   'transfers.group_finished': 'Finalizados',
   'transfers.cancel_one': 'Cancelar {name}',
+  'transfers.pause': 'Pausar',
+  'transfers.resume': 'Reanudar',
+  'transfers.paused': 'En pausa',
+  'transfers.pause_one': 'Pausar {name}',
+  'transfers.resume_one': 'Reanudar {name}',
   'transfers.eta_seconds': 'quedan {n} s',
   'transfers.eta_minutes': 'quedan {n} min',
   'transfers.eta_hours': 'quedan {n} h',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
index e011873..106e3cd 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
@@ -585,6 +585,11 @@ export default {
   'transfers.group_waiting': 'En attente',
   'transfers.group_finished': 'Terminés',
   'transfers.cancel_one': 'Annuler {name}',
+  'transfers.pause': 'Suspendre',
+  'transfers.resume': 'Reprendre',
+  'transfers.paused': 'En pause',
+  'transfers.pause_one': 'Suspendre {name}',
+  'transfers.resume_one': 'Reprendre {name}',
   'transfers.eta_seconds': '{n} s restantes',
   'transfers.eta_minutes': '{n} min restantes',
   'transfers.eta_hours': '{n} h restantes',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
index 80e3c17..a610683 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
@@ -585,6 +585,11 @@ export default {
   'transfers.group_waiting': 'In attesa',
   'transfers.group_finished': 'Completati',
   'transfers.cancel_one': 'Annulla {name}',
+  'transfers.pause': 'Sospendi',
+  'transfers.resume': 'Riprendi',
+  'transfers.paused': 'In pausa',
+  'transfers.pause_one': 'Sospendi {name}',
+  'transfers.resume_one': 'Riprendi {name}',
   'transfers.eta_seconds': '{n} s rimanenti',
   'transfers.eta_minutes': '{n} min rimanenti',
   'transfers.eta_hours': '{n} h rimanenti',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
index 5dbb4fa..aed4ba0 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
@@ -577,6 +577,11 @@ export default {
   'transfers.group_waiting': '待機中',
   'transfers.group_finished': '完了',
   'transfers.cancel_one': '{name} をキャンセル',
+  'transfers.pause': '一時停止',
+  'transfers.resume': '再開',
+  'transfers.paused': '一時停止中',
+  'transfers.pause_one': '{name} を一時停止',
+  'transfers.resume_one': '{name} を再開',
   'transfers.eta_seconds': '残り {n} 秒',
   'transfers.eta_minutes': '残り {n} 分',
   'transfers.eta_hours': '残り {n} 時間',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
index f9c7cf3..fe10e12 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
@@ -586,6 +586,11 @@ export default {
   'transfers.group_waiting': 'Wachtend',
   'transfers.group_finished': 'Voltooid',
   'transfers.cancel_one': '{name} annuleren',
+  'transfers.pause': 'Pauzeren',
+  'transfers.resume': 'Hervatten',
+  'transfers.paused': 'Gepauzeerd',
+  'transfers.pause_one': '{name} pauzeren',
+  'transfers.resume_one': '{name} hervatten',
   'transfers.eta_seconds': 'nog {n} s',
   'transfers.eta_minutes': 'nog {n} min',
   'transfers.eta_hours': 'nog {n} u',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
index b26f3cb..c2ba35c 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
@@ -598,6 +598,11 @@ export default {
   'transfers.group_waiting': 'Oczekuje',
   'transfers.group_finished': 'Zakończone',
   'transfers.cancel_one': 'Anuluj {name}',
+  'transfers.pause': 'Wstrzymaj',
+  'transfers.resume': 'Wznów',
+  'transfers.paused': 'Wstrzymano',
+  'transfers.pause_one': 'Wstrzymaj {name}',
+  'transfers.resume_one': 'Wznów {name}',
   'transfers.eta_seconds': 'pozostało {n} s',
   'transfers.eta_minutes': 'pozostało {n} min',
   'transfers.eta_hours': 'pozostało {n} godz.',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
index db5a408..83d179b 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
@@ -584,6 +584,11 @@ export default {
   'transfers.group_waiting': 'Aguardando',
   'transfers.group_finished': 'Concluídos',
   'transfers.cancel_one': 'Cancelar {name}',
+  'transfers.pause': 'Pausar',
+  'transfers.resume': 'Retomar',
+  'transfers.paused': 'Pausado',
+  'transfers.pause_one': 'Pausar {name}',
+  'transfers.resume_one': 'Retomar {name}',
   'transfers.eta_seconds': 'faltam {n} s',
   'transfers.eta_minutes': 'faltam {n} min',
   'transfers.eta_hours': 'faltam {n} h',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
index ba88f4e..9acfb17 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
@@ -565,6 +565,11 @@ export default {
   'transfers.group_waiting': '等待中',
   'transfers.group_finished': '已完成',
   'transfers.cancel_one': '取消 {name}',
+  'transfers.pause': '暂停',
+  'transfers.resume': '继续',
+  'transfers.paused': '已暂停',
+  'transfers.pause_one': '暂停 {name}',
+  'transfers.resume_one': '继续 {name}',
   'transfers.eta_seconds': '剩余 {n} 秒',
   'transfers.eta_minutes': '剩余 {n} 分钟',
   'transfers.eta_hours': '剩余 {n} 小时',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/style.css b/packages/meshbay-hub/src/meshbay_hub/static/style.css
index 22fcd3f..a37e541 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/style.css
+++ b/packages/meshbay-hub/src/meshbay_hub/static/style.css
@@ -1975,6 +1975,20 @@ a.transfer-name {
   display: flex;
 }
 .transfer-cancel:hover { color: var(--error); }
+/* Same shape as cancel, and beside it: pausing and cancelling are the two
+   things a person does to a transfer, and one of them is not destructive. */
+.transfer-pause {
+  background: none;
+  border: none;
+  color: var(--text-dim);
+  cursor: pointer;
+  padding: 0 2px;
+  display: flex;
+}
+.transfer-pause:hover { color: var(--accent); }
+/* A paused bar keeps its fill -- what was written is still on disk -- but stops
+   looking like something in progress. */
+.dl-fill.dl-paused { background: var(--text-dim); }
 .transfer-meta {
   display: flex;
   justify-content: space-between;
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transfers.js b/packages/meshbay-hub/src/meshbay_hub/static/transfers.js
index d3b164d..797321c 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/transfers.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/transfers.js
@@ -25,7 +25,15 @@ const SPEED_WINDOW_MS = 5000;
 /** Not finished: still preparing, waiting for a slot, or transferring. One
  *  definition, because six places ask and they were drifting apart. */
 function _live(status) {
-  return status === 'preparing' || status === 'queued' || status === 'running';
+  return status === 'preparing' || status === 'queued' || status === 'running'
+    || status === 'paused';
+}
+
+/** Raised by `run` when it stopped because the transfer was paused. */
+function _pausedError() {
+  const err = new Error('Paused');
+  err.name = 'PausedError';
+  return err;
 }
 
 function _abortError() {
@@ -81,6 +89,9 @@ export class TransferStore {
       // Only for a file written into a folder the browser granted us: that is
       // the one case where the page can read its own download back.
       canOpen: it.status === 'done' && typeof it.open === 'function',
+      // Whether the target can be stopped and continued. False is the honest
+      // answer for a service-worker stream, and the button is not drawn.
+      pausable: Boolean(it.pausable),
     }));
   }
 
@@ -144,7 +155,18 @@ export class TransferStore {
       ahead: (lease && lease.ahead) || 0,
       error: '',
       samples: [{ t: this._now(), done: 0 }],
-      signal: { aborted: false },
+      signal: { aborted: false, paused: false },
+      // Set from `prepare`: whether this target can be stopped and continued.
+      pausable: false,
+      // Where a resumed run picks up, in chunks. Zero until something pauses.
+      resumeFrom: 0,
+      // Resolved by resume(); awaited by the run loop while paused.
+      resumed: null,
+      _wake: null,
+      // Pausing gives the slot back, so resuming has to be able to ask for
+      // another one. A transfer handed a lease directly cannot, and must not
+      // be offered a button that would drop its slot for good.
+      _canRelease: Boolean(makeLease),
     };
     this._items.push(item);
     this._emit();
@@ -195,25 +217,58 @@ export class TransferStore {
             return undefined;
           }
           if (ready && ready.name) item.name = ready.name;
+          // Only the target knows. A service-worker stream is already an HTTP
+          // response the browser is writing to its own download folder: not
+          // writing to it stalls that download outside our control, and an idle
+          // worker is terminated within seconds, taking the stream with it. So
+          // the button is offered where it works and nowhere else — a pause
+          // that silently restarts from zero is worse than no pause.
+          if (ready && ready.pausable) item.pausable = true;
           item.status = 'running';
           this._emit();
         }
-        if (makeLease && !item.lease) {
-          item.lease = makeLease();
-          this._watchLease(item);
-          if (item.lease.state !== 'granted') {
-            item.status = 'queued';
-            item.ahead = item.lease.ahead || 0;
+        // Run, and be prepared to be stopped and started again.
+        //
+        // A paused transfer holds **nothing**: its slot goes back to the node
+        // and resuming rejoins the queue at the tail. Anything else lets one
+        // member close a node by pausing four downloads and going to lunch.
+        // So the lease is taken inside this loop, not before it.
+        for (;;) {
+          if (makeLease && !item.lease) {
+            item.lease = makeLease();
+            this._watchLease(item);
+            if (item.lease.state !== 'granted') {
+              item.status = 'queued';
+              item.ahead = item.lease.ahead || 0;
+              this._emit();
+            }
+          }
+          if (item.lease) {
+            await item.lease.acquire();
+            if (item.signal.aborted) throw _abortError();
+            item.status = 'running';
             this._emit();
           }
-        }
-        if (item.lease) {
-          await item.lease.acquire();
-          if (item.signal.aborted) throw _abortError();
-          item.status = 'running';
+          try {
+            return await run({ signal: item.signal, onProgress,
+                               lease: item.lease, from: item.resumeFrom || 0 });
+          } catch (err) {
+            if (err.name !== 'PausedError') throw err;
+          }
+          // Where to pick up. `run` records it on the signal rather than
+          // returning it, because it has to survive being thrown past.
+          item.resumeFrom = item.signal.resumeFrom || 0;
+          if (item.lease) {
+            item.lease.release('paused');
+            item.lease = null;
+          }
+          item.status = 'paused';
+          item.ahead = 0;
           this._emit();
+          this._maybeRelease(item.transport);
+          await item.resumed;
+          if (item.signal.aborted) throw _abortError();
         }
-        return run({ signal: item.signal, onProgress, lease: item.lease });
       })
       .then(() => {
         if (item.signal.aborted) finish('cancelled');
@@ -260,6 +315,37 @@ export class TransferStore {
     if (item && typeof item.open === 'function') return item.open();
   }
 
+  /**
+   * Stop a running transfer, keeping what it has already written.
+   *
+   * Only while running: a queued transfer is already stopped and holds no slot,
+   * and pausing it would only cost it its place. Only where the target can do
+   * it — see the note in `start`.
+   *
+   * The slot goes back to the node at once (§6.2 of the plan): a paused
+   * transfer holds nothing, and resuming rejoins the queue at the tail.
+   */
+  pause(id) {
+    const item = this._items.find(it => it.id === id);
+    if (!item || !item.pausable || !item._canRelease
+        || item.status !== 'running') return;
+    item.signal.paused = true;
+    // Created here rather than in resume(): the run loop awaits it the moment
+    // `run` throws, which can be sooner than the next call into this store.
+    item.resumed = new Promise((resolve) => { item._wake = resolve; });
+    this._emit();
+  }
+
+  /** Start it again, from where it stopped, behind whatever is waiting now. */
+  resume(id) {
+    const item = this._items.find(it => it.id === id);
+    if (!item || item.status !== 'paused') return;
+    item.signal.paused = false;
+    item.status = 'queued';
+    this._emit();
+    if (item._wake) { item._wake(); item._wake = null; }
+  }
+
   cancel(id) {
     const item = this._items.find(it => it.id === id);
     // 'queued' too: a transfer waiting for a slot is exactly the one somebody
@@ -268,6 +354,10 @@ export class TransferStore {
     if (!item || !_live(item.status)) return;
     item.signal.aborted = true;
     if (item.lease) item.lease.release('cancelled');
+    // A paused run is parked on `item.resumed`. Without this it stays parked
+    // for the life of the page, holding its target open, and the row says
+    // "cancelled" over a download that never stopped.
+    if (item._wake) { item._wake(); item._wake = null; }
     // Marked at once. The work stops when it next looks, but a cancelled
     // transfer should not keep reporting progress in the meantime.
     item.status = 'cancelled';
diff --git a/packages/meshbay-hub/tests/test_downloads.py b/packages/meshbay-hub/tests/test_downloads.py
index dfb1433..41ae5d3 100644
--- a/packages/meshbay-hub/tests/test_downloads.py
+++ b/packages/meshbay-hub/tests/test_downloads.py
@@ -489,3 +489,71 @@ out.push(asked);
     assert batched == [False, True, True], (
         "the stuck one is still the only holder of the gesture, so the released "
         "openings must not try for a dialog of their own")
+
+
+def test_a_pause_falls_between_chunks_and_resumes_at_one(tmp_path):
+    """What makes resuming exact rather than approximate.
+
+    Everything written is a whole number of chunks, because the loop checks for
+    a pause between two of them and never inside one. So `fromChunk` is a
+    position, not an estimate, and a resumed download is never appended to at an
+    offset nobody verified — the failure mode being avoided is a file that looks
+    complete and is quietly corrupt.
+
+    The real `pipelinedDownload` is lifted out and run against stubs, on the
+    rule this repo follows for the video player: model the environment, never
+    the code under test.
+    """
+    src = (STATIC / "file-utils.js").read_text()
+    fn = src[src.index("async function pipelinedDownload"):]
+    fn = fn[:fn.index("\n}\n") + 2]
+
+    script = tmp_path / "pipeline.mjs"
+    script.write_text("""
+const CHUNK_SIZE = 8;
+const PIPELINE_WINDOW = 4;
+const written = [];
+// `ct` has to be truthy: chunk 0 with a falsy body is refused as undecryptable,
+// which is the guard working, not the harness.
+const _fetchChunkResilient = async (transport, fileId, i) =>
+  ({ ct: new Uint8Array([i & 0xff]), nonce: new Uint8Array(12) });
+const _writeOrStall = async (w, bytes, index) => { written.push(index); };
+globalThis.window = { MeshBayCrypto: {
+  // The plaintext carries its own index, so what lands where can be checked.
+  decryptChunkBin: async (k, id, index) => ({ byteLength: CHUNK_SIZE, index }),
+} };
+""" + fn + """
+const out = {};
+const signal = { aborted: false, paused: false };
+// Stop it part way, the way the store does.
+let seen = 0;
+const onChunk = () => { if (++seen === 3) signal.paused = true; };
+try {
+  await pipelinedDownload({}, 'k', 'file', 10, onChunk, {}, signal, '', 0);
+  out.threw = 'no';
+} catch (err) {
+  out.threw = err.name;
+}
+out.resumeFrom = signal.resumeFrom;
+out.writtenBeforePause = written.slice();
+
+// And again, from where it said.
+signal.paused = false;
+written.length = 0;
+await pipelinedDownload({}, 'k', 'file', 10, () => {}, {}, signal, '',
+                        out.resumeFrom);
+out.writtenAfterResume = written.slice();
+console.log(JSON.stringify(out));
+""")
+    proc = subprocess.run(["node", str(script)], capture_output=True, text=True)
+    assert proc.returncode == 0, proc.stderr
+    out = json.loads(proc.stdout)
+
+    assert out["threw"] == "PausedError", out
+    # Whole chunks only, in order, with nothing skipped.
+    assert out["writtenBeforePause"] == list(range(len(out["writtenBeforePause"])))
+    assert out["resumeFrom"] == len(out["writtenBeforePause"]), (
+        f"stopped after {len(out['writtenBeforePause'])} chunks but asked to "
+        f"resume at {out['resumeFrom']} — that gap is a hole in the file")
+    # The resumed run covers exactly the rest, and repeats nothing.
+    assert out["writtenAfterResume"] == list(range(out["resumeFrom"], 10)), out
diff --git a/packages/meshbay-hub/tests/test_transfers.py b/packages/meshbay-hub/tests/test_transfers.py
index c48e38c..035f569 100644
--- a/packages/meshbay-hub/tests/test_transfers.py
+++ b/packages/meshbay-hub/tests/test_transfers.py
@@ -553,3 +553,163 @@ def test_a_transport_is_not_closed_under_a_preparing_transfer(tmp_path):
     """, tmp_path)
     assert out[1] is False
     assert out[3] is True
+
+
+# ── Pause and resume ────────────────────────────────────────────────────────
+#
+# The rule the whole design turns on: **a paused transfer holds nothing.** Its
+# slot goes back to the node the moment it stops, and resuming rejoins the queue
+# at the tail. Anything else lets one member close a node by pausing four
+# downloads and going to lunch (§6.2 of ~/next/improve-downloads.md).
+
+
+def _pausable_run():
+    """A `run` that stops where it is told and reports where it resumed."""
+    return """
+const mkStore = () => {
+  const t = new TransferStore();
+  const leases = [];
+  const state = { starts: [], paused: null, aborted: false };
+  t.start({
+    kind: 'download', name: 'f', total: 1000,
+    prepare: async () => ({ name: 'f', pausable: true }),
+    makeLease: () => { const l = new L(); leases.push(l); return l; },
+    run: async ({ signal, from }) => {
+      state.starts.push(from);
+      state.running = true;
+      try {
+      // Runs until told to stop, one "chunk" at a time.
+      for (let i = from; i < 10; i++) {
+        await new Promise(r => setTimeout(r, 5));
+        if (signal.aborted) { const e = new Error('c'); e.name = 'AbortError'; throw e; }
+        if (signal.paused) {
+          signal.resumeFrom = i;
+          const e = new Error('p'); e.name = 'PausedError'; throw e;
+        }
+      }
+      } finally { state.running = false; }
+    },
+  });
+  return { t, leases, state };
+};
+"""
+
+
+def test_pausing_gives_the_slot_back(tmp_path):
+    """The node has to get it back at once, not when the person resumes: the
+    whole point of a queue is that a slot nobody is using is a slot somebody
+    else can have."""
+    out = _run(_lease_stub() + _pausable_run() + """
+      const { t, leases } = mkStore();
+      await new Promise(r => setTimeout(r, 5));
+      leases[0].grant();
+      await new Promise(r => setTimeout(r, 20));
+      say('before:' + t.list()[0].status);
+      t.pause(t.list()[0].id);
+      await new Promise(r => setTimeout(r, 30));
+      say('after:' + t.list()[0].status);
+      say('released:' + leases[0].released.join(','));
+      say('leases:' + leases.length);
+    """, tmp_path)
+    assert out[0] == "before:running"
+    assert out[1] == "after:paused"
+    assert out[2] == "released:paused", "a paused transfer kept its slot"
+    assert out[3] == "leases:1"
+
+
+def test_resuming_asks_for_a_new_slot_and_continues_where_it_stopped(tmp_path):
+    """Rejoining at the tail is the design, not an accident: a paused transfer
+    that could reclaim its old place would be a way to hold one."""
+    out = _run(_lease_stub() + _pausable_run() + """
+      const { t, leases, state } = mkStore();
+      await new Promise(r => setTimeout(r, 5));
+      leases[0].grant();
+      await new Promise(r => setTimeout(r, 20));
+      const id = t.list()[0].id;
+      t.pause(id);
+      await new Promise(r => setTimeout(r, 30));
+      t.resume(id);
+      await new Promise(r => setTimeout(r, 10));
+      say('queued:' + t.list()[0].status, 'leases:' + leases.length);
+      leases[1].grant();
+      await new Promise(r => setTimeout(r, 120));
+      say('end:' + t.list()[0].status);
+      say('starts:' + state.starts.join(','));
+    """, tmp_path)
+    assert out[0] == "queued:queued", "a resumed transfer skipped the queue"
+    assert out[1] == "leases:2", "resuming did not ask for a slot again"
+    assert out[2] == "end:done"
+    starts = out[3].split(":")[1].split(",")
+    assert starts[0] == "0" and int(starts[1]) > 0, (
+        f"resumed from {starts} — it started again from the beginning")
+
+
+def test_a_transfer_whose_target_cannot_pause_is_not_paused(tmp_path):
+    """A service-worker stream is a download the browser already owns: not
+    writing to it stalls it outside our control and an idle worker is killed
+    within seconds. A button that silently restarts from zero is worse than no
+    button, so `pause` refuses rather than pretending."""
+    out = _run(_lease_stub() + """
+      const t = new TransferStore();
+      const lease = new L();
+      t.start({ kind: 'download', name: 'f', total: 10, lease,
+                prepare: async () => ({ name: 'f' }),
+                run: async ({ signal }) => {
+                  while (!signal.aborted) await new Promise(r => setTimeout(r, 5));
+                } });
+      lease.grant();
+      await new Promise(r => setTimeout(r, 20));
+      const id = t.list()[0].id;
+      say('pausable:' + t.list()[0].pausable);
+      t.pause(id);
+      await new Promise(r => setTimeout(r, 20));
+      say('status:' + t.list()[0].status);
+      t.cancel(id);
+    """, tmp_path)
+    assert out == ["pausable:false", "status:running"]
+
+
+def test_cancelling_a_paused_transfer_actually_ends_it(tmp_path):
+    """A paused run is parked on a promise. Without waking it, cancel marks the
+    row and leaves the work parked for the life of the page, holding its target
+    open — a button that lies, in the same way the first test in this file
+    describes."""
+    out = _run(_lease_stub() + _pausable_run() + """
+      const { t, leases, state } = mkStore();
+      await new Promise(r => setTimeout(r, 5));
+      leases[0].grant();
+      await new Promise(r => setTimeout(r, 20));
+      const id = t.list()[0].id;
+      t.pause(id);
+      await new Promise(r => setTimeout(r, 30));
+      t.cancel(id);
+      // What matters is whether the store's own loop ends, not whether the row
+      // says so: the row is marked at once either way.
+      const settled = await Promise.race([
+        t._items[0].promise.then(() => 'settled', () => 'settled'),
+        new Promise(r => setTimeout(() => r('parked'), 60)),
+      ]);
+      say('status:' + t.list()[0].status);
+      say('loop:' + settled);
+      say('resumed:' + state.starts.length);
+    """, tmp_path)
+    assert out[0] == "status:cancelled"
+    assert out[1] == "loop:settled", (
+        "the run was still parked on the resume promise after a cancel — the "
+        "row said cancelled over work that had not stopped")
+    assert out[2] == "resumed:1", "cancelling started the work again"
+
+
+def test_a_paused_transfer_still_counts_as_live(tmp_path):
+    """It is not finished, and its transport must not be closed under it — the
+    person is coming back to it."""
+    out = _run(_lease_stub() + _pausable_run() + """
+      const { t, leases } = mkStore();
+      await new Promise(r => setTimeout(r, 5));
+      leases[0].grant();
+      await new Promise(r => setTimeout(r, 20));
+      t.pause(t.list()[0].id);
+      await new Promise(r => setTimeout(r, 30));
+      say('pending:' + t.pending);
+    """, tmp_path)
+    assert out == ["pending:1"]
-- 
cgit v1.2.3


From 99ae7f6955ffc94cd973822d4e2fd5a8c952f563 Mon Sep 17 00:00:00 2001
From: Christophe Besson <cbesson@gmail.com>
Date: Wed, 9 Sep 2026 10:59:59 +0200
Subject: docs(spa): say that a download with no folder cannot be paused
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reported from testing 7a: pause worked in the desktop app and no button
appeared in Chrome. That is the design working — without a granted download
folder, "save automatically" means the service worker, and that target is a
download the browser already owns — but nothing anywhere said so, and choosing
a folder looked like a question of where files land.

So the Settings line now says what it costs not to choose one, in all ten
catalogues. It renders only where a folder can be chosen at all, which is
exactly the browsers the advice applies to.

Also pins the tier table the pause button is drawn from: a granted folder, a
save dialog and the desktop sink can be paused, a service-worker stream cannot.
Four cases through the real `_openDownloadTarget`, and one more that reads the
value off the real `downloads.js` rather than a stub of it -- the first version
of these stubs did not carry the field at all, so the cases would have passed
while checking nothing.

Hub suite 847 passed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HCGdheDLxGReuKHga3BtST
---
 .../src/meshbay_hub/static/locales/de.js           |  2 +-
 .../src/meshbay_hub/static/locales/en.js           |  2 +-
 .../src/meshbay_hub/static/locales/es.js           |  2 +-
 .../src/meshbay_hub/static/locales/fr.js           |  2 +-
 .../src/meshbay_hub/static/locales/it.js           |  2 +-
 .../src/meshbay_hub/static/locales/ja.js           |  2 +-
 .../src/meshbay_hub/static/locales/nl.js           |  2 +-
 .../src/meshbay_hub/static/locales/pl.js           |  2 +-
 .../src/meshbay_hub/static/locales/pt-BR.js        |  2 +-
 .../src/meshbay_hub/static/locales/zh-CN.js        |  2 +-
 packages/meshbay-hub/tests/test_memory_ceiling.py  | 63 ++++++++++++++++++----
 .../tests/test_streamed_download_reliability.py    | 19 +++++++
 12 files changed, 81 insertions(+), 21 deletions(-)

(limited to 'packages/meshbay-hub/src/meshbay_hub/static/locales/de.js')

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
index ae20687..fd63ddf 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
@@ -317,7 +317,7 @@ export default {
     + 'auch wenn Sie eine Auswahl herunterladen.',
   'settings.dl_folder': 'Ordner: {name}',
   'settings.dl_no_folder': 'Kein Ordner ausgewählt — Downloads landen dort, wo Ihr '
-    + 'Browser sie ablegt',
+    + 'Browser sie ablegt, und sie lassen sich nicht anhalten',
   'settings.dl_choose': 'Ordner auswählen',
   'settings.dl_change': 'Ändern',
   'settings.dl_forget': 'Verwerfen',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
index 7033778..e9d4072 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
@@ -315,7 +315,7 @@ export default {
     + 'including when you download a selection.',
   'settings.dl_folder': 'Folder: {name}',
   'settings.dl_no_folder': 'No folder chosen — downloads go wherever your browser '
-    + 'puts them',
+    + 'puts them, and they cannot be paused',
   'settings.dl_choose': 'Choose folder',
   'settings.dl_change': 'Change',
   'settings.dl_forget': 'Forget',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
index 311ba1f..4fa19e7 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
@@ -315,7 +315,7 @@ export default {
     + 'también cuando descarga una selección.',
   'settings.dl_folder': 'Carpeta: {name}',
   'settings.dl_no_folder': 'Ninguna carpeta elegida — las descargas van adonde las '
-    + 'ponga su navegador',
+    + 'ponga su navegador, y no se pueden pausar',
   'settings.dl_choose': 'Elegir carpeta',
   'settings.dl_change': 'Cambiar',
   'settings.dl_forget': 'Olvidar',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
index 106e3cd..6fba91d 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
@@ -316,7 +316,7 @@ export default {
     + 'un par fichier, y compris lorsque vous téléchargez une sélection.',
   'settings.dl_folder': 'Dossier : {name}',
   'settings.dl_no_folder': 'Aucun dossier choisi — les téléchargements vont là où '
-    + 'votre navigateur les place',
+    + 'votre navigateur les place, et ne peuvent pas être suspendus',
   'settings.dl_choose': 'Choisir un dossier',
   'settings.dl_change': 'Changer',
   'settings.dl_forget': 'Oublier',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
index a610683..76b3101 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
@@ -316,7 +316,7 @@ export default {
     + 'file, anche quando scarica una selezione.',
   'settings.dl_folder': 'Cartella: {name}',
   'settings.dl_no_folder': 'Nessuna cartella scelta — i download finiscono dove li '
-    + 'colloca il browser',
+    + 'colloca il browser, e non si possono sospendere',
   'settings.dl_choose': 'Scegli una cartella',
   'settings.dl_change': 'Cambia',
   'settings.dl_forget': 'Dimentica',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
index aed4ba0..cfc1125 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
@@ -313,7 +313,7 @@ export default {
     + 'まとめてダウンロードする場合も 1 ファイルにつき 1 回です。',
   'settings.dl_folder': 'フォルダー：{name}',
   'settings.dl_no_folder': 'フォルダーが選ばれていません。ダウンロードは'
-    + 'ブラウザーが決めた場所に保存されます',
+    + 'ブラウザーが決めた場所に保存され、一時停止できません',
   'settings.dl_choose': 'フォルダーを選択',
   'settings.dl_change': '変更',
   'settings.dl_forget': '解除',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
index fe10e12..29cc566 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
@@ -317,7 +317,7 @@ export default {
     + 'ook wanneer u een selectie downloadt.',
   'settings.dl_folder': 'Map: {name}',
   'settings.dl_no_folder': 'Geen map gekozen — downloads komen terecht waar uw browser '
-    + 'ze neerzet',
+    + 'ze neerzet, en ze kunnen niet worden gepauzeerd',
   'settings.dl_choose': 'Map kiezen',
   'settings.dl_change': 'Wijzigen',
   'settings.dl_forget': 'Vergeten',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
index c2ba35c..38fe714 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
@@ -328,7 +328,7 @@ export default {
     + 'także przy pobieraniu zaznaczonych pozycji.',
   'settings.dl_folder': 'Folder: {name}',
   'settings.dl_no_folder': 'Nie wybrano folderu — pobrane pliki trafiają tam, gdzie '
-    + 'umieszcza je przeglądarka',
+    + 'umieszcza je przeglądarka, i nie można ich wstrzymać',
   'settings.dl_choose': 'Wybierz folder',
   'settings.dl_change': 'Zmień',
   'settings.dl_forget': 'Zapomnij',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
index 83d179b..5942b77 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
@@ -317,7 +317,7 @@ export default {
     + 'arquivo, inclusive quando você baixa uma seleção.',
   'settings.dl_folder': 'Pasta: {name}',
   'settings.dl_no_folder': 'Nenhuma pasta escolhida — os downloads vão para onde o '
-    + 'seu navegador os colocar',
+    + 'seu navegador os colocar, e não podem ser pausados',
   'settings.dl_choose': 'Escolher pasta',
   'settings.dl_change': 'Alterar',
   'settings.dl_forget': 'Esquecer',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
index 9acfb17..56af6c8 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
@@ -309,7 +309,7 @@ export default {
   'settings.dl_ask_hint': '每个文件弹出一次“另存为”对话框——每个文件一次，'
     + '批量下载时也是如此。',
   'settings.dl_folder': '文件夹：{name}',
-  'settings.dl_no_folder': '未选择文件夹——下载内容会保存到浏览器指定的位置',
+  'settings.dl_no_folder': '未选择文件夹——下载内容会保存到浏览器指定的位置，且无法暂停',
   'settings.dl_choose': '选择文件夹',
   'settings.dl_change': '更改',
   'settings.dl_forget': '忘记',
diff --git a/packages/meshbay-hub/tests/test_memory_ceiling.py b/packages/meshbay-hub/tests/test_memory_ceiling.py
index d46cae3..1654825 100644
--- a/packages/meshbay-hub/tests/test_memory_ceiling.py
+++ b/packages/meshbay-hub/tests/test_memory_ceiling.py
@@ -90,9 +90,12 @@ const downloads = {{
   // wrong failure entirely.
   lastStreamFailure: () => 'stubbed: no streamed target in this harness',
   getMode: () => {json.dumps(mode)},
-  openTarget: async () => ({json.dumps(granted)} ? {{ name: 'g', writable: {{}} }} : null),
+  // `pausable` mirrors the real modules: a granted folder is a held-open file
+  // handle, a service-worker stream is a download the browser already owns.
+  openTarget: async () =>
+    ({json.dumps(granted)} ? {{ name: 'g', writable: {{}}, pausable: true }} : null),
   openStreamedDownload: async () =>
-    ({json.dumps(streamed)} ? {{ name: 's', writable: {{}} }} : null),
+    ({json.dumps(streamed)} ? {{ name: 's', writable: {{}}, pausable: false }} : null),
 }};
 globalThis.window = {{}};
 if ({json.dumps(picker)}) {{
@@ -115,7 +118,7 @@ try {{
                                      {{ batched: {json.dumps(batched)} }});
   outcome = r === null ? {{ kind: 'memory' }}
     : r === false ? {{ kind: 'cancelled' }}
-    : {{ kind: 'stream', name: r.name }};
+    : {{ kind: 'stream', name: r.name, pausable: !!r.pausable }};
 }} catch (err) {{
   outcome = {{ kind: 'refused', name: err.name, message: err.message }};
 }}
@@ -164,17 +167,17 @@ def test_the_boundary_is_the_ceiling_itself(target_fn, tmp_path):
 
 def test_a_granted_folder_streams_whatever_the_size(target_fn, tmp_path):
     out = _run(target_fn, tmp_path, size=20 * GB, granted=True)
-    assert out == {"kind": "stream", "name": "g"}
+    assert (out["kind"], out["name"]) == ("stream", "g")
 
 
 def test_the_service_worker_streams_whatever_the_size(target_fn, tmp_path):
     out = _run(target_fn, tmp_path, size=20 * GB, streamed=True)
-    assert out == {"kind": "stream", "name": "s"}
+    assert (out["kind"], out["name"]) == ("stream", "s")
 
 
 def test_the_desktop_app_streams_whatever_the_size(target_fn, tmp_path):
     out = _run(target_fn, tmp_path, size=20 * GB, native=True)
-    assert out == {"kind": "stream", "name": "n"}
+    assert (out["kind"], out["name"]) == ("stream", "n")
 
 
 def test_a_browser_with_a_picker_is_offered_one_instead_of_being_refused(
@@ -182,7 +185,7 @@ def test_a_browser_with_a_picker_is_offered_one_instead_of_being_refused(
     """Chrome/Edge: the file is large, nothing streamed yet, but Save As does.
     A refusal here would be this fix breaking a path that was never broken."""
     out = _run(target_fn, tmp_path, size=20 * GB, picker=True)
-    assert out == {"kind": "stream", "name": "p"}
+    assert (out["kind"], out["name"]) == ("stream", "p")
 
 
 # ── One dialog per gesture, not one per file ────────────────────────────────
@@ -192,7 +195,7 @@ def test_the_first_of_a_batch_still_asks_where_to_save(target_fn, tmp_path):
     folder chooses it, for the download they actually clicked."""
     out = _run(target_fn, tmp_path, size=20 * GB, mode="ask", picker=True,
                streamed=True)
-    assert out == {"kind": "stream", "name": "p"}
+    assert (out["kind"], out["name"]) == ("stream", "p")
 
 
 def test_the_rest_of_a_batch_stream_instead_of_asking(target_fn, tmp_path):
@@ -207,7 +210,7 @@ def test_the_rest_of_a_batch_stream_instead_of_asking(target_fn, tmp_path):
     """
     out = _run(target_fn, tmp_path, size=20 * GB, mode="ask", picker=True,
                streamed=True, batched=True)
-    assert out == {"kind": "stream", "name": "s"}
+    assert (out["kind"], out["name"]) == ("stream", "s")
 
 
 def test_a_batched_download_falls_back_to_the_dialog_rather_than_failing(
@@ -218,7 +221,7 @@ def test_a_batched_download_falls_back_to_the_dialog_rather_than_failing(
     neither must the fix for one."""
     out = _run(target_fn, tmp_path, size=20 * GB, mode="ask", picker=True,
                streamed=False, batched=True)
-    assert out == {"kind": "stream", "name": "p"}
+    assert (out["kind"], out["name"]) == ("stream", "p")
 
 
 def test_batching_never_pushes_a_large_file_into_memory(target_fn, tmp_path):
@@ -277,7 +280,7 @@ def test_a_lost_gesture_streams_instead_of_failing(target_fn, tmp_path):
     """
     out = _run(target_fn, tmp_path, size=20 * GB,
                picker="no-gesture", streamed=True, mode="ask")
-    assert out == {"kind": "stream", "name": "s"}, out
+    assert (out["kind"], out["name"]) == ("stream", "s"), out
 
 
 def test_a_lost_gesture_with_nothing_to_stream_to_still_refuses(target_fn, tmp_path):
@@ -286,3 +289,41 @@ def test_a_lost_gesture_with_nothing_to_stream_to_still_refuses(target_fn, tmp_p
     out = _run(target_fn, tmp_path, size=20 * GB,
                picker="no-gesture", streamed=False, mode="ask")
     assert out["kind"] == "refused", out
+
+
+# ── Which targets can be paused ─────────────────────────────────────────────
+#
+# `pausable` travels with the target rather than with the platform, because the
+# same browser yields both answers on the same page: a granted folder is a
+# held-open file, and a service-worker stream is a download the browser already
+# owns. The widget draws its button from this and nothing else.
+
+
+def test_a_granted_folder_can_be_paused(tmp_path, target_fn):
+    out = _run(target_fn, tmp_path, size=20 * GB, granted=True)
+    assert out["pausable"] is True
+
+
+def test_a_save_dialog_can_be_paused(tmp_path, target_fn):
+    out = _run(target_fn, tmp_path, size=20 * GB, picker=True)
+    assert out["pausable"] is True
+
+
+def test_the_desktop_sink_can_be_paused(tmp_path, target_fn):
+    out = _run(target_fn, tmp_path, size=20 * GB, native=True)
+    assert out["pausable"] is True
+
+
+def test_a_service_worker_stream_cannot_be_paused(tmp_path, target_fn):
+    """Not a shortcoming of this code. The browser is already writing an HTTP
+    response into its own download folder: not feeding the stream stalls that
+    download where we can neither see nor resume it, and an idle worker is
+    terminated within seconds. Firefox and Safari have no other target, so they
+    get cancel and no pause — the browser's own download manager is where a
+    pause lives there, for as long as it works.
+
+    This is also why Chrome shows no pause button until a download folder has
+    been granted: without one, "save automatically" means the service worker.
+    """
+    out = _run(target_fn, tmp_path, size=20 * GB, streamed=True)
+    assert out["pausable"] is False
diff --git a/packages/meshbay-hub/tests/test_streamed_download_reliability.py b/packages/meshbay-hub/tests/test_streamed_download_reliability.py
index 355fbff..da745d0 100644
--- a/packages/meshbay-hub/tests/test_streamed_download_reliability.py
+++ b/packages/meshbay-hub/tests/test_streamed_download_reliability.py
@@ -501,3 +501,22 @@ def test_a_download_waits_for_the_self_test(tmp_path):
     """)
     assert out["target"] is True
     assert out["ms"] >= 1, "the download did not wait for priming at all"
+
+
+def test_the_streamed_target_says_it_cannot_be_paused(tmp_path):
+    """The value the widget's pause button is drawn from, read off the real
+    module rather than a stub of it.
+
+    It is false for a reason that is not about this code: the browser is already
+    writing an HTTP response into its own download folder, so not feeding the
+    stream stalls a download we can neither see nor resume, and an idle worker
+    is terminated within seconds. Firefox and Safari therefore get cancel and no
+    pause; Chrome gets one as soon as a download folder has been granted, which
+    yields a held-open file instead of this.
+    """
+    out = _run(tmp_path, """
+      const target = await M.openStreamedDownload('film.mkv', 20e9, FAST);
+      out.pausable = target && target.pausable;
+      if (target) await target.writable.close();
+    """)
+    assert out["pausable"] is False
-- 
cgit v1.2.3


From b472b4d43149ed12a7f64c94f34c34f436bef492 Mon Sep 17 00:00:00 2001
From: Christophe Besson <cbesson@gmail.com>
Date: Wed, 9 Sep 2026 14:14:11 +0200
Subject: fix(spa): a paused transfer is not a finished one
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reported while testing the flag day: pausing an upload put it under "Finished".

"Finished" was defined by exclusion — everything that is not running, queued or
preparing — so it swallowed `paused` the day pausing shipped. A transfer
somebody stopped on purpose then sat beside the ones that are actually over,
offering a resume button in the section of things that cannot be resumed, and
dropped out of the badge, which announced less activity than there was.

Paused is now its own group, in all ten catalogues, and counts as active: it is
not over, the person means to come back to it.

The three filters are lifted out of `app.js` and executed rather than described
in the test, and one case asserts that every status lands in exactly one group
— a state added later that falls into none is a transfer the panel simply does
not show, which is how this one got in.

The same report also said the three running downloads lost their pause buttons
when the upload was paused. That part is **not** explained and **not** fixed:
the store returns `pausable` true and status `running` for all three (new test),
closing an upload lease pumps only the upload queue, and the button's condition
is a pure function of those two. All three say the buttons should have stayed,
so an observation is missing rather than a cause.

Hub suite 864 passed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HCGdheDLxGReuKHga3BtST
---
 packages/meshbay-hub/src/meshbay_hub/static/app.js |  15 ++-
 .../src/meshbay_hub/static/locales/de.js           |   1 +
 .../src/meshbay_hub/static/locales/en.js           |   1 +
 .../src/meshbay_hub/static/locales/es.js           |   1 +
 .../src/meshbay_hub/static/locales/fr.js           |   1 +
 .../src/meshbay_hub/static/locales/it.js           |   1 +
 .../src/meshbay_hub/static/locales/ja.js           |   1 +
 .../src/meshbay_hub/static/locales/nl.js           |   1 +
 .../src/meshbay_hub/static/locales/pl.js           |   1 +
 .../src/meshbay_hub/static/locales/pt-BR.js        |   1 +
 .../src/meshbay_hub/static/locales/zh-CN.js        |   1 +
 packages/meshbay-hub/tests/test_transfers.py       | 109 +++++++++++++++++++++
 12 files changed, 132 insertions(+), 2 deletions(-)

(limited to 'packages/meshbay-hub/src/meshbay_hub/static/locales/de.js')

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/app.js b/packages/meshbay-hub/src/meshbay_hub/static/app.js
index 0394af6..de47982 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/app.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/app.js
@@ -159,10 +159,20 @@ function TransferWidget() {
   const running = items.filter(i => i.status === 'running');
   const waiting = items.filter(
     i => i.status === 'queued' || i.status === 'preparing');
+  // Its own group, and not a leftover.
+  //
+  // "Finished" used to be defined as everything that is not running, queued or
+  // preparing — a definition by exclusion, which quietly swallowed `paused` the
+  // day pausing shipped. A transfer somebody stopped on purpose then sat under
+  // "Finished", beside the ones that are actually over, offering a resume
+  // button in the section of things that cannot be resumed.
+  const paused = items.filter(i => i.status === 'paused');
   const finished = items.filter(
     i => i.status !== 'running' && i.status !== 'queued'
-      && i.status !== 'preparing');
-  const active = running.length + waiting.length;
+      && i.status !== 'preparing' && i.status !== 'paused');
+  // Paused counts as active: it is not over, the person means to come back to
+  // it, and the badge saying nothing is happening would be a lie.
+  const active = running.length + waiting.length + paused.length;
 
   // Grouped, and in this order: what is moving, what is waiting, what is over.
   // Re-sorting the flat list on every emit made rows jump under the pointer
@@ -171,6 +181,7 @@ function TransferWidget() {
   const groups = [
     ['running', running],
     ['waiting', waiting],
+    ['paused', paused],
     ['finished', finished],
   ].filter(([, rows]) => rows.length);
 
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
index fd63ddf..738b131 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
@@ -584,6 +584,7 @@ export default {
   'transfers.summary': '{running} laufend · {waiting} wartend',
   'transfers.group_running': 'Laufend',
   'transfers.group_waiting': 'Wartend',
+  'transfers.group_paused': 'Angehalten',
   'transfers.group_finished': 'Abgeschlossen',
   'transfers.cancel_one': '{name} abbrechen',
   'transfers.pause': 'Anhalten',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
index e9d4072..0b9de8a 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
@@ -700,6 +700,7 @@ export default {
   'transfers.summary': '{running} running · {waiting} waiting',
   'transfers.group_running': 'Running',
   'transfers.group_waiting': 'Waiting',
+  'transfers.group_paused': 'Paused',
   'transfers.group_finished': 'Finished',
   'transfers.cancel_one': 'Cancel {name}',
   'transfers.pause': 'Pause',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
index 4fa19e7..8da8f9f 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
@@ -580,6 +580,7 @@ export default {
   'transfers.summary': '{running} en curso · {waiting} en espera',
   'transfers.group_running': 'En curso',
   'transfers.group_waiting': 'En espera',
+  'transfers.group_paused': 'En pausa',
   'transfers.group_finished': 'Finalizados',
   'transfers.cancel_one': 'Cancelar {name}',
   'transfers.pause': 'Pausar',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
index 6fba91d..3135c03 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
@@ -583,6 +583,7 @@ export default {
   'transfers.summary': '{running} en cours · {waiting} en attente',
   'transfers.group_running': 'En cours',
   'transfers.group_waiting': 'En attente',
+  'transfers.group_paused': 'En pause',
   'transfers.group_finished': 'Terminés',
   'transfers.cancel_one': 'Annuler {name}',
   'transfers.pause': 'Suspendre',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
index 76b3101..91f0e9b 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
@@ -583,6 +583,7 @@ export default {
   'transfers.summary': '{running} in corso · {waiting} in attesa',
   'transfers.group_running': 'In corso',
   'transfers.group_waiting': 'In attesa',
+  'transfers.group_paused': 'In pausa',
   'transfers.group_finished': 'Completati',
   'transfers.cancel_one': 'Annulla {name}',
   'transfers.pause': 'Sospendi',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
index cfc1125..b352188 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
@@ -575,6 +575,7 @@ export default {
   'transfers.summary': '実行中 {running} · 待機中 {waiting}',
   'transfers.group_running': '実行中',
   'transfers.group_waiting': '待機中',
+  'transfers.group_paused': '一時停止中',
   'transfers.group_finished': '完了',
   'transfers.cancel_one': '{name} をキャンセル',
   'transfers.pause': '一時停止',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
index 29cc566..e0a799d 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
@@ -584,6 +584,7 @@ export default {
   'transfers.summary': '{running} bezig · {waiting} wachtend',
   'transfers.group_running': 'Bezig',
   'transfers.group_waiting': 'Wachtend',
+  'transfers.group_paused': 'Gepauzeerd',
   'transfers.group_finished': 'Voltooid',
   'transfers.cancel_one': '{name} annuleren',
   'transfers.pause': 'Pauzeren',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
index 38fe714..e6319b0 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
@@ -596,6 +596,7 @@ export default {
   'transfers.summary': '{running} w toku · {waiting} oczekuje',
   'transfers.group_running': 'W toku',
   'transfers.group_waiting': 'Oczekuje',
+  'transfers.group_paused': 'Wstrzymane',
   'transfers.group_finished': 'Zakończone',
   'transfers.cancel_one': 'Anuluj {name}',
   'transfers.pause': 'Wstrzymaj',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
index 5942b77..02c8356 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
@@ -582,6 +582,7 @@ export default {
   'transfers.summary': '{running} em andamento · {waiting} aguardando',
   'transfers.group_running': 'Em andamento',
   'transfers.group_waiting': 'Aguardando',
+  'transfers.group_paused': 'Pausados',
   'transfers.group_finished': 'Concluídos',
   'transfers.cancel_one': 'Cancelar {name}',
   'transfers.pause': 'Pausar',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
index 56af6c8..6c4c73f 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
@@ -563,6 +563,7 @@ export default {
   'transfers.summary': '进行中 {running} · 等待中 {waiting}',
   'transfers.group_running': '进行中',
   'transfers.group_waiting': '等待中',
+  'transfers.group_paused': '已暂停',
   'transfers.group_finished': '已完成',
   'transfers.cancel_one': '取消 {name}',
   'transfers.pause': '暂停',
diff --git a/packages/meshbay-hub/tests/test_transfers.py b/packages/meshbay-hub/tests/test_transfers.py
index f27d4fd..d19a458 100644
--- a/packages/meshbay-hub/tests/test_transfers.py
+++ b/packages/meshbay-hub/tests/test_transfers.py
@@ -770,3 +770,112 @@ def test_an_upload_handed_a_lease_it_cannot_recreate_is_not_offered_pause(tmp_pa
       t.cancel(id);
     """, tmp_path)
     assert out == ["status:running"]
+
+
+def test_pausing_one_transfer_leaves_the_others_alone(tmp_path):
+    """Reported: three downloads running, one upload paused, and the three
+    downloads lost their pause buttons.
+
+    The button is drawn from `pausable` and the status, so this asks the store
+    what it says about the other three at the moment one of them pauses.
+    """
+    out = _run(_lease_stub() + """
+      const t = new TransferStore();
+      const leases = [];
+      const mk = (kind, name) => t.start({
+        kind, name, total: 100, pausable: true,
+        makeLease: () => { const l = new L(); leases.push(l); return l; },
+        run: async ({ signal, from }) => {
+          for (let i = from || 0; i < 40; i++) {
+            await new Promise(r => setTimeout(r, 5));
+            if (signal.aborted) { const e = new Error('c'); e.name = 'AbortError'; throw e; }
+            if (signal.paused) {
+              signal.resumeFrom = i;
+              const e = new Error('p'); e.name = 'PausedError'; throw e;
+            }
+          }
+        },
+      });
+      mk('download', 'd1'); mk('download', 'd2'); mk('download', 'd3');
+      mk('upload', 'u1');
+      await new Promise(r => setTimeout(r, 5));
+      for (const l of leases) l.grant();
+      await new Promise(r => setTimeout(r, 20));
+      const up = t.list().find(i => i.kind === 'upload');
+      say('before:' + t.list().filter(
+        i => i.kind === 'download' && i.pausable && i.status === 'running').length);
+      t.pause(up.id);
+      await new Promise(r => setTimeout(r, 40));
+      const rows = t.list();
+      say('after:' + rows.filter(
+        i => i.kind === 'download' && i.pausable && i.status === 'running').length);
+      say('statuses:' + rows.map(i => i.kind[0] + ':' + i.status).join(','));
+      for (const r of rows) t.cancel(r.id);
+    """, tmp_path)
+    assert out[0] == "before:3"
+    assert out[1] == "after:3", (
+        f"pausing the upload changed the downloads — {out[2]}")
+
+
+def test_a_paused_transfer_is_not_filed_under_finished(tmp_path):
+    """"Finished" was defined by exclusion — everything that is not running,
+    queued or preparing — so it quietly swallowed `paused` the day pausing
+    shipped. A transfer somebody stopped on purpose then sat beside the ones
+    that are actually over, offering a resume button in the section of things
+    that cannot be resumed.
+
+    The three filters are lifted out of `app.js` and run, rather than described
+    here: a copy of them in this file would agree with a broken version by
+    construction.
+    """
+    src = (STATIC / "app.js").read_text()
+    start = src.index("  const running = items.filter(")
+    block = src[start:src.index("const active =", start)]
+
+    script = tmp_path / "groups.mjs"
+    script.write_text("""
+const items = [
+  { id: 1, status: 'running' },
+  { id: 2, status: 'queued' },
+  { id: 3, status: 'preparing' },
+  { id: 4, status: 'paused' },
+  { id: 5, status: 'done' },
+  { id: 6, status: 'failed' },
+  { id: 7, status: 'cancelled' },
+];
+""" + block + """
+const seen = { running, waiting, paused, finished };
+console.log(JSON.stringify(Object.fromEntries(
+  Object.entries(seen).map(([k, v]) => [k, v.map(i => i.id)]))));
+""")
+    proc = subprocess.run(["node", str(script)], capture_output=True, text=True)
+    assert proc.returncode == 0, proc.stderr
+    groups = json.loads(proc.stdout)
+
+    assert groups["paused"] == [4]
+    assert groups["finished"] == [5, 6, 7], (
+        f"paused landed in {groups['finished']}")
+    assert groups["running"] == [1] and groups["waiting"] == [2, 3]
+    # Every row appears exactly once: a state added later that lands in no group
+    # is a transfer the panel simply does not show.
+    placed = sum((groups[k] for k in groups), [])
+    assert sorted(placed) == [1, 2, 3, 4, 5, 6, 7]
+
+
+def test_a_paused_transfer_still_counts_as_active(tmp_path):
+    """The badge says how much is going on. A paused transfer is not over — the
+    person means to come back to it — so counting it as nothing would be a
+    panel that says "0" over work that is still there."""
+    src = (STATIC / "app.js").read_text()
+    start = src.index("  const running = items.filter(")
+    block = src[start:src.index("\n\n", src.index("const active =", start))]
+
+    script = tmp_path / "active.mjs"
+    script.write_text("""
+const items = [{ id: 1, status: 'paused' }, { id: 2, status: 'done' }];
+""" + block + """
+console.log(JSON.stringify({ active }));
+""")
+    proc = subprocess.run(["node", str(script)], capture_output=True, text=True)
+    assert proc.returncode == 0, proc.stderr
+    assert json.loads(proc.stdout)["active"] == 1
-- 
cgit v1.2.3


From e6f895c473a0b19e7b186889c1836d3945bc880b Mon Sep 17 00:00:00 2001
From: Christophe Besson <cbesson@gmail.com>
Date: Wed, 9 Sep 2026 14:24:59 +0200
Subject: fix(spa): say why a download cannot be paused
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reported from Chrome, with a screenshot: four downloads with no pause button
and an upload beside them with one, and nothing anywhere saying why.

The reason is real. Without a granted download folder the browser writes
through the service worker — a download it already owns, which cannot be paused
without stalling it somewhere we can neither see nor resume. An upload writes to
the node, which keeps the position, so it is always pausable. But that was
stated only in a Settings line nobody reads on the way to a download, and a gap
where the row above has a button is not an explanation.

So a download that cannot be paused now shows a dimmed pause icon where the
button would be, carrying the reason and the remedy in its tooltip. Not a
button: there is nothing to click, and a disabled one invites the click anyway.

And only where the advice can be taken. Firefox and Safari have no folder to
choose — the streamed path is the only target they have, which is what §6.5 of
~/next/improve-downloads.md costs out — so telling someone there to choose one
would be advice they cannot follow. Nothing is drawn.

Hub suite 866 passed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HCGdheDLxGReuKHga3BtST
---
 packages/meshbay-hub/src/meshbay_hub/static/app.js | 14 +++++++++
 .../src/meshbay_hub/static/locales/de.js           |  1 +
 .../src/meshbay_hub/static/locales/en.js           |  1 +
 .../src/meshbay_hub/static/locales/es.js           |  1 +
 .../src/meshbay_hub/static/locales/fr.js           |  1 +
 .../src/meshbay_hub/static/locales/it.js           |  1 +
 .../src/meshbay_hub/static/locales/ja.js           |  1 +
 .../src/meshbay_hub/static/locales/nl.js           |  1 +
 .../src/meshbay_hub/static/locales/pl.js           |  1 +
 .../src/meshbay_hub/static/locales/pt-BR.js        |  1 +
 .../src/meshbay_hub/static/locales/zh-CN.js        |  1 +
 .../meshbay-hub/src/meshbay_hub/static/style.css   | 10 +++++++
 packages/meshbay-hub/tests/test_transfers.py       | 35 ++++++++++++++++++++++
 13 files changed, 69 insertions(+)

(limited to 'packages/meshbay-hub/src/meshbay_hub/static/locales/de.js')

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/app.js b/packages/meshbay-hub/src/meshbay_hub/static/app.js
index de47982..dfd0aeb 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/app.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/app.js
@@ -269,6 +269,20 @@ function TransferRow({ it }) {
             <${Icon} name=${it.status === 'paused' ? 'play' : 'pause'} />
           </button>
         `}
+        ${!it.pausable && downloads.SUPPORTED && it.kind === 'download'
+          && (it.status === 'running' || it.status === 'queued') && html`
+          ${/* Say why, rather than leaving a gap where a button is on the row
+                above. Without a granted folder this browser writes through the
+                service worker — a download it already owns, which cannot be
+                paused — so the button is absent for a reason nobody can see,
+                and an upload beside it has one. Shown only where choosing a
+                folder is actually possible: on Firefox and Safari there is no
+                folder to choose and this hint would be a lie. */''}
+          <span class="transfer-nopause" title=${t('transfers.not_pausable')}
+            aria-label=${t('transfers.not_pausable')}>
+            <${Icon} name="pause" />
+          </span>
+        `}
         ${(it.status === 'running' || it.status === 'queued'
            || it.status === 'preparing' || it.status === 'paused') && html`
           <button class="transfer-cancel"
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
index 738b131..0f632e3 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
@@ -590,6 +590,7 @@ export default {
   'transfers.pause': 'Anhalten',
   'transfers.resume': 'Fortsetzen',
   'transfers.paused': 'Angehalten',
+  'transfers.not_pausable': 'Kann nicht angehalten werden — wählen Sie in den Einstellungen einen Download-Ordner',
   'transfers.pause_one': '{name} anhalten',
   'transfers.resume_one': '{name} fortsetzen',
   'transfers.eta_seconds': 'noch {n} s',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
index 0b9de8a..cb7f4a0 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
@@ -706,6 +706,7 @@ export default {
   'transfers.pause': 'Pause',
   'transfers.resume': 'Resume',
   'transfers.paused': 'Paused',
+  'transfers.not_pausable': 'Cannot be paused — choose a download folder in Settings to enable it',
   'transfers.pause_one': 'Pause {name}',
   'transfers.resume_one': 'Resume {name}',
   'transfers.eta_seconds': '{n}s left',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
index 8da8f9f..fe1c13b 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
@@ -586,6 +586,7 @@ export default {
   'transfers.pause': 'Pausar',
   'transfers.resume': 'Reanudar',
   'transfers.paused': 'En pausa',
+  'transfers.not_pausable': 'No se puede pausar — elija una carpeta de descargas en Ajustes para activarlo',
   'transfers.pause_one': 'Pausar {name}',
   'transfers.resume_one': 'Reanudar {name}',
   'transfers.eta_seconds': 'quedan {n} s',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
index 3135c03..ea3f60e 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
@@ -589,6 +589,7 @@ export default {
   'transfers.pause': 'Suspendre',
   'transfers.resume': 'Reprendre',
   'transfers.paused': 'En pause',
+  'transfers.not_pausable': 'Non suspendable — choisissez un dossier de téléchargement dans les Réglages pour l\'activer',
   'transfers.pause_one': 'Suspendre {name}',
   'transfers.resume_one': 'Reprendre {name}',
   'transfers.eta_seconds': '{n} s restantes',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
index 91f0e9b..0687b25 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
@@ -589,6 +589,7 @@ export default {
   'transfers.pause': 'Sospendi',
   'transfers.resume': 'Riprendi',
   'transfers.paused': 'In pausa',
+  'transfers.not_pausable': 'Non si può sospendere — scelga una cartella di download nelle Impostazioni',
   'transfers.pause_one': 'Sospendi {name}',
   'transfers.resume_one': 'Riprendi {name}',
   'transfers.eta_seconds': '{n} s rimanenti',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
index b352188..a02e058 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
@@ -581,6 +581,7 @@ export default {
   'transfers.pause': '一時停止',
   'transfers.resume': '再開',
   'transfers.paused': '一時停止中',
+  'transfers.not_pausable': '一時停止できません。設定でダウンロードフォルダーを選ぶと使えます',
   'transfers.pause_one': '{name} を一時停止',
   'transfers.resume_one': '{name} を再開',
   'transfers.eta_seconds': '残り {n} 秒',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
index e0a799d..0235d8a 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
@@ -590,6 +590,7 @@ export default {
   'transfers.pause': 'Pauzeren',
   'transfers.resume': 'Hervatten',
   'transfers.paused': 'Gepauzeerd',
+  'transfers.not_pausable': 'Kan niet worden gepauzeerd — kies een downloadmap in Instellingen',
   'transfers.pause_one': '{name} pauzeren',
   'transfers.resume_one': '{name} hervatten',
   'transfers.eta_seconds': 'nog {n} s',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
index e6319b0..af4a5bb 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
@@ -602,6 +602,7 @@ export default {
   'transfers.pause': 'Wstrzymaj',
   'transfers.resume': 'Wznów',
   'transfers.paused': 'Wstrzymano',
+  'transfers.not_pausable': 'Nie można wstrzymać — proszę wybrać folder pobierania w Ustawieniach',
   'transfers.pause_one': 'Wstrzymaj {name}',
   'transfers.resume_one': 'Wznów {name}',
   'transfers.eta_seconds': 'pozostało {n} s',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
index 02c8356..f179c6f 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
@@ -588,6 +588,7 @@ export default {
   'transfers.pause': 'Pausar',
   'transfers.resume': 'Retomar',
   'transfers.paused': 'Pausado',
+  'transfers.not_pausable': 'Não pode ser pausado — escolha uma pasta de downloads em Configurações',
   'transfers.pause_one': 'Pausar {name}',
   'transfers.resume_one': 'Retomar {name}',
   'transfers.eta_seconds': 'faltam {n} s',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
index 6c4c73f..c89bbdc 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
@@ -569,6 +569,7 @@ export default {
   'transfers.pause': '暂停',
   'transfers.resume': '继续',
   'transfers.paused': '已暂停',
+  'transfers.not_pausable': '无法暂停——请在设置中选择下载文件夹以启用',
   'transfers.pause_one': '暂停 {name}',
   'transfers.resume_one': '继续 {name}',
   'transfers.eta_seconds': '剩余 {n} 秒',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/style.css b/packages/meshbay-hub/src/meshbay_hub/static/style.css
index a37e541..5e08a6a 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/style.css
+++ b/packages/meshbay-hub/src/meshbay_hub/static/style.css
@@ -1986,6 +1986,16 @@ a.transfer-name {
   display: flex;
 }
 .transfer-pause:hover { color: var(--accent); }
+/* Not a button: there is nothing to click. Dimmer than the cancel beside it,
+   and it carries its explanation in a tooltip rather than in the row, which
+   would be four lines of prose in a panel that has none. */
+.transfer-nopause {
+  color: var(--text-dim);
+  opacity: .45;
+  padding: 0 2px;
+  display: flex;
+  cursor: help;
+}
 /* A paused bar keeps its fill -- what was written is still on disk -- but stops
    looking like something in progress. */
 .dl-fill.dl-paused { background: var(--text-dim); }
diff --git a/packages/meshbay-hub/tests/test_transfers.py b/packages/meshbay-hub/tests/test_transfers.py
index d19a458..d93cf80 100644
--- a/packages/meshbay-hub/tests/test_transfers.py
+++ b/packages/meshbay-hub/tests/test_transfers.py
@@ -879,3 +879,38 @@ console.log(JSON.stringify({ active }));
     proc = subprocess.run(["node", str(script)], capture_output=True, text=True)
     assert proc.returncode == 0, proc.stderr
     assert json.loads(proc.stdout)["active"] == 1
+
+
+def test_a_row_that_cannot_pause_says_so_where_the_button_would_be():
+    """Reported from Chrome: four downloads with no pause button and an upload
+    with one, and no way to tell why.
+
+    The reason is real — without a granted folder the browser writes through the
+    service worker, a download it already owns and cannot pause — but it was
+    stated only in a Settings line nobody reads on the way to a download. A gap
+    where the row above has a button is not an explanation.
+
+    Shown only where a folder can actually be chosen: Firefox and Safari have
+    none to choose, and "choose a folder" would be advice that cannot be taken.
+    """
+    src = (STATIC / "app.js").read_text()
+    row = src[src.index("function TransferRow"):]
+    row = row[:row.index("\n}\n")]
+
+    hint = row[row.index("!it.pausable"):]
+    hint = hint[:hint.index("`}")]
+    assert "downloads.SUPPORTED" in hint, (
+        "the hint would tell a Firefox user to choose a folder it cannot offer")
+    assert "it.kind === 'download'" in hint, (
+        "an upload is always pausable; this is about download targets")
+    assert "transfers.not_pausable" in hint, "the reason is not stated"
+    # Not a button. There is nothing to click, and a disabled one invites the
+    # click anyway.
+    assert "<button" not in hint
+
+
+def test_the_reason_is_translated_everywhere():
+    """`t()` falls back to the key, so a missing catalogue entry shows
+    `transfers.not_pausable` in a tooltip rather than a sentence."""
+    for path in sorted((STATIC / "locales").glob("*.js")):
+        assert "'transfers.not_pausable'" in path.read_text(), path.name
-- 
cgit v1.2.3