Receiver consent: preview the transfer, write nothing until accepted

[op-q]

Consent plan, phases 2–3, recorded as decision 19. It changes behaviour and the wire (still protocol v2, unreleased), so it waits for your review. Stacked on #71.

What a receiver sees now

Incoming transfer
  Name     quarterly-report.pdf
  Type     PDF document (.pdf)
  Size     2.4 MiB
  Save as  ./quarterly-report-1.pdf   (instead of quarterly-report.pdf)
Accept? [y/N]

Folders show the file count and unpacked size. Programs (.exe, .ps1, .dmg, .sh…) get a warning line. The type comes from the real extension, not the sender's MIME type, so invoice.pdf .exe shows up as a program.

• Nothing is created until accept. The destination is worked out by looking: numbering past existing names, plus the Windows rewrite from Windows receiver: rewrite names Windows would misread, skip what it can't store #70. A decline leaves the directory byte-identical.
• An unanswered question is declined after 120s.
• No terminal and no --yes → refuses before contacting anything, so the code isn't spent (your choice from earlier). Scripts piping drop recv need --yes; netlab and scripts/dev-transfer.sh are updated.

Sender

Prints what the receiver is doing: "The receiver entered the code and is deciding whether to accept...", "Accepted.", "The receiver has everything and is finishing up...". It also reports "the receiver declined the transfer", "…did not answer within two minutes…", and receiver cancels, with reasons.

Relay

• New receiver frames: accept, decline {reason}, cancel {reason}, finishing. A sender cancel now reaches the receiver as cancel, not error: sender cancelled.
• No chunk is carried before accept, and accept is refused before meta.
• Reasons come from a fixed set and are normalised, so a peer can't put its own text on the other terminal.
• /metrics gains total_transfers_declined and total_transfers_cancelled. These are no longer counted as failures.

Found while building it

While the question is open, the receiver must keep reading the socket, or the relay drops it for not answering pings. That read gets abandoned when the person answers, so receiving must be cancel-safe, and the QUIC framing wasn't: read_exact into a local buffer loses a partial frame when dropped. It now keeps partial frames in the transport, and the trait documents the requirement.

Tests (240, up from 217)

• Relay: early-chunk gate, decline, a reason outside the set, cancel both ways, accept before meta, finishing.
• Consent: timeout (paused clock), sender cancel mid-question, chunk before consent, relay narration, rendering, and the three clocks in order (120s < 150s < 300s session TTL).
• End to end: a decline over a real relay leaves the destination byte-identical and counts as declined, not failed. A receiver with no terminal refuses without ever connecting to a listening socket.
• Negative controls: removing the relay gate fails the early-chunk test; creating a file on the decline path fails the decline test; the old framed reader fails the cancel-safety test.
• netlab against the real binaries: the relayed, UDP-blocked and load-bearing topologies pass. Plain LAN hit the separate, already-known intermittent QUIC authentication failed handshake error, which also occurs on main (details in the netlab plan).

Not in this PR (phase 4)

Letting a person cancel (a key, or a first Ctrl-C), drop-status: state= lines, and exit codes 3/4.

🤖 Generated with Claude Code

https://claude.ai/code/session_01G7Fy45hUvna94cd79WKG8S

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.