[TeoSlayer]

Summary

Four fixes to file transfer and framing, found by running a node in a 1 GB container under load.

Changes

• Several transfers of the same content at once no longer fail. The .partial is named after the content hash so a retry can resume it. Two peers sending the same file (or one sender on two connections) therefore wrote the same file, and all but the first failed at the final rename. The first transfer keeps the resumable .partial; a concurrent one gets a private file, removed if it does not finish.
• A file that cannot fit on the receiver's disk is refused at INIT, keeping 16 MiB in reserve. The byte quota is a fixed number and can be larger than the disk: a transfer ran until the disk was full, failed, and left its bytes in .partial, where they kept the disk full and blocked incoming messages. If a write still hits ENOSPC, that .partial is deleted.
• A refusal at INIT is reported as a refusal. The sender took any non-INIT_ACK reply for a receiver without streamed-transfer support, so the caller fell back to pushing the whole file in one frame at a peer that had just declined it.
• WriteFrame sends a frame of up to 64 KiB as one write. Header and payload as two writes made the payload wait on Nagle and the peer's delayed ACK.

Wire format is unchanged. The free-space check uses statfs on unix and is skipped elsewhere.

Test Plan

• go build ./..., go vet ./...
• go test ./... -count=1 and -race
• New tests: four concurrent transfers of one payload all succeed and leave no .partial; a transfer is refused when free space is one byte short and accepted when it fits; a disk-full write removes the .partial while other write errors keep it; small frames are one write and round-trip.
• In a two-container lab: four concurrent transfers of the same 20 MB file went from 3 of 4 failing to 0 of 4.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[TeoSlayer]

Converted to draft after review; two things to fix before this merges (nothing ships until a stable tag, but both are regressions against main).

1. Resume regression (filestream.go around lines 642-651). A retry that arrives while the stalled connection is still open on the receiver (idle timeout is 2 minutes) gets a private .partial and restarts at offset 0; main resumes mid-file in the same scenario. The stale .partial is then orphaned and counts against the quota, and with a quota set the retry is refused outright ("receiver disk quota exceeded") where main accepts it.
2. Build break on some unix targets (filestream_disk_unix.go:3). //go:build unix no longer compiles on openbsd, netbsd, solaris and illumos; main does. linux, darwin, windows, freebsd and android are fine.

The rest reviewed well: wire bytes are unchanged, pilotctl already handles res.OK == false, and the new concurrency test fails on main and passes here. The handleChunk ENOSPC path is not covered by the PR's own tests (it does work against /dev/full).

[TeoSlayer]

Both review findings fixed in c6b706d, rebased onto main.

1. Resume regression. A claim on a .partial whose holder has written nothing for 10 s (staleClaimAfter) can now be taken over: a retry after a stall resumes where the stalled transfer stopped, and the stalled transfer is refused any further write or rename ("a newer transfer of this file has taken it over"). Two live transfers of the same content still get separate files. TestFileStream_RetryTakesOverAStalledTransfer covers it: the retry resumes at the stalled offset, the stalled connection's next chunk is refused, the file completes intact, and no .partial is left.
2. Build. The free-space check is built for linux, darwin and freebsd; other platforms rely on the byte quota. Cross-compiled for openbsd, netbsd, solaris, illumos, freebsd, windows, darwin and linux.

go test -race ./... passes twice. Marking ready.