From 304b3c5ddcea4ed4182714e8705b8dbadc98ef79 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@profullstack.com>
Date: Mon, 9 Nov 2026 12:38:31 +0000
Subject: [PATCH 1/8] feat(hosting): media-size sites: striped placement, Range
 streaming, fast multi-source replication

- Sites over 1 GiB are striped: chunks bucketed by hash into one group per
  64 MiB, each group placed on 3 nodes by rendezvous hashing on (site, group).
  Healing, copy counting, GC, challenges, budgets and the free-disk floor all
  work per group; gossip carries a group bitmap and each node's room.
- Caps: 256 GiB paid / 64 GiB free per site, 128 GiB per file; small sites
  other features publish keep 1 GiB. Parted manifests also split by chunk
  count so every part stays one chunk fetch.
- Node budget follows the disk by default (held + 25% of free above the
  floor); per-owner limit (16 GiB) applies to free copies only. Placement
  skips nodes that announced too little room, whole sites too.
- Gateways answer Range requests (206/416, If-Range, 304) on /s/<id>/ and
  custom domains, fetching only the chunks a range covers, streaming large
  files with read-ahead; video content types (mkv, m4v, mov, ...).
- Fetching: many chunks in flight, each from the holder with the lowest
  expected wait, AIMD per-peer limits, hedged slow requests, failover, DHT
  last. Chunk fetch protocol 2.0.0 sends byte strings (v1 sent integer
  arrays, ~1.9x the bytes); v1 kept for older peers. Chunk reads no longer
  block the swarm loop.
- Hosting nodes and publishers dial hosting peers that announced a public
  address, so peers behind NAT can be fetched from.
- publish scans in place (no copy; served from the files), caches hashes,
  resumes on re-run, shows hashing/replication progress, and says which
  limit was hit. --disks auto asks for disks with room for their share.
- New: c0mpute hosting get (download with MB/s, --sequential to compare),
  c0mpute hosting rm (publish an empty version).

Tests: stripe placement determinism and refill, room/widening, Range parsing
and slicing, chunk-bounded parts, scanner and cache, AIMD limits, and
hosting_striped_e2e: a 260 MiB site striped over 5 nodes, ranges via a
gateway, refill after a holder leaves.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 Cargo.lock                                    |    1 +
 apps/web/src/app/getting-started/page.tsx     |    7 +-
 docs/hosting.md                               |  119 +-
 node/crates/c0mpute-cli/src/main.rs           |   78 +-
 node/crates/c0mpute-core/Cargo.toml           |    1 +
 node/crates/c0mpute-core/src/ads/manage.rs    |    4 +-
 node/crates/c0mpute-core/src/apps/deploy.rs   |    4 +-
 node/crates/c0mpute-core/src/config.rs        |    4 +-
 node/crates/c0mpute-core/src/hosting/fetch.rs |  349 +++
 node/crates/c0mpute-core/src/hosting/mod.rs   | 2063 +++++++++++++++--
 node/crates/c0mpute-core/src/hosting/proof.rs |   17 +
 .../c0mpute-core/src/hosting/replicas.rs      |  128 +-
 node/crates/c0mpute-core/src/hosting/seed.rs  |   89 +
 .../crates/c0mpute-core/src/hosting/settle.rs |   16 +-
 node/crates/c0mpute-core/src/hosting/site.rs  |  433 +++-
 .../crates/c0mpute-core/src/hosting/stripe.rs |  567 +++++
 node/crates/c0mpute-core/src/opendisk.rs      |   12 +-
 node/crates/c0mpute-core/src/podcast/show.rs  |    2 +-
 node/crates/c0mpute-core/src/supervisor.rs    |    6 +-
 .../c0mpute-core/tests/ads_billing_e2e.rs     |    2 +
 node/crates/c0mpute-core/tests/ads_e2e.rs     |    2 +
 node/crates/c0mpute-core/tests/hosting_e2e.rs |    2 +
 .../c0mpute-core/tests/hosting_market_e2e.rs  |    2 +
 .../c0mpute-core/tests/hosting_striped_e2e.rs |  370 +++
 node/crates/c0mpute-core/tests/podcast_e2e.rs |    2 +
 node/crates/c0mpute-net/src/swarm.rs          |  130 +-
 26 files changed, 4123 insertions(+), 287 deletions(-)
 create mode 100644 node/crates/c0mpute-core/src/hosting/fetch.rs
 create mode 100644 node/crates/c0mpute-core/src/hosting/seed.rs
 create mode 100644 node/crates/c0mpute-core/src/hosting/stripe.rs
 create mode 100644 node/crates/c0mpute-core/tests/hosting_striped_e2e.rs

diff --git a/Cargo.lock b/Cargo.lock
index fe06723f..bb3ff2ab 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -568,6 +568,7 @@ dependencies = [
  "c0mpute-verify",
  "directories",
  "flate2",
+ "futures",
  "hex",
  "hkdf",
  "hmac",
diff --git a/apps/web/src/app/getting-started/page.tsx b/apps/web/src/app/getting-started/page.tsx
index 8bdeda43..9f743f8b 100644
--- a/apps/web/src/app/getting-started/page.tsx
+++ b/apps/web/src/app/getting-started/page.tsx
@@ -92,8 +92,11 @@ $ c0mpute hosting ls          # sites a gateway knows, with live copy counts`}</
           can publish new versions: run the same command with the same{" "}
           <code>--name</code> to update it. Any gateway serves it at{" "}
           <code>/s/&lt;site_id&gt;/</code>, for example{" "}
-          <code>https://gateway.c0mpute.com/s/&lt;site_id&gt;/</code>. Limits:
-          256 MiB and 10,000 files per site.
+          <code>https://gateway.c0mpute.com/s/&lt;site_id&gt;/</code>, with
+          byte ranges so video seeks. Limits: 64 GiB per free site, 256 GiB
+          with <code>--disks auto</code>. Sites over 1 GiB are striped over the
+          network in 64 MiB groups; run the same command again to resume an
+          interrupted publish.
         </p>
 
         <p className="text-sm">point a Moshpit name at it (free to register):</p>
diff --git a/docs/hosting.md b/docs/hosting.md
index 997a4e1d..afa75c90 100644
--- a/docs/hosting.md
+++ b/docs/hosting.md
@@ -9,11 +9,21 @@ c0mpute hosting publish ./public --name my-site            # first version
 c0mpute hosting publish ./public --name my-site            # same name again = new version
 c0mpute hosting publish ./public --name my-site --domain blog.example.org
 c0mpute hosting ls                                         # sites a gateway knows, with copy counts
+c0mpute hosting get <site_id> movies/a.mp4                 # download one file, shows MB/s
+c0mpute hosting rm --name my-site                          # take it down (publishes an empty version)
 ```
 
 `publish` signs the site with this machine's identity (`<data_dir>/buyer/identity.key`),
-seeds it, and stays up until three hosting nodes hold copies (default wait 10 min).
-Only the machine holding that key can publish new versions of the site.
+seeds it, and stays up until three hosting nodes hold copies (default wait 10 min; for a
+large site, 10 min without progress). Only the machine holding that key can publish new
+versions of the site.
+
+The folder is scanned in place: nothing is copied, and the publisher serves chunks
+straight from the files while the network takes its copies, so publishing 50 GiB of
+video does not need another 50 GiB of local disk. Hashes of unchanged files are kept in
+`<data_dir>/hosting/scan-cache.json`, so running the same command again is quick. That
+is also how to resume: if `publish` stops (Ctrl-C, laptop asleep), run it again. The
+record already on the network is reused and holders keep every group they have.
 
 The site is then served by every gateway at `http://<gateway>:7777/s/<site_id>/`.
 Paths resolve like a static host: `/` and directories map to `index.html`, an
@@ -30,18 +40,111 @@ is used for misses.
 | Healing | A site with fewer than 3 live copies: each hosting node ranks the candidates (rendezvous hashing on site id + peer id). The top-ranked ones fetch a copy. A node that stops announcing stops counting after ~200 s and another node takes over. Above 5 copies the lowest-ranked holder lets go. A publisher seeding its own site is a source, not a copy. |
 | Serving | Any gateway: local chunks when it holds them, otherwise fetched over libp2p from the fastest live holder (measured round-trip, round-robin among equally fast ones), failing over to the next and then to the DHT. Every chunk is checked against its hash. |
 
-Limits per site: 1 GiB, 10,000,000 files. Up to 5,000 files the manifest is one chunk;
-above that it is a root listing parts of 4,000 files each (by first path), so a
-gateway fetches only the part a request needs. Nodes before v0.3.0 cannot read
-parted manifests and skip those sites. A node holds at most `hosting.max_bytes`
-(default 5 GiB) of other people's sites, and at most 1 GiB per owner key.
+## Limits
+
+| | |
+|---|---|
+| Site, paid (`--disks`, a v2 record) | 256 GiB |
+| Site, free (v1 record) | 64 GiB |
+| Files per site | 10,000,000 |
+| One file | 128 GiB |
+| Small sites other features publish (ad creatives, app images, podcast shows, git repos) | 1 GiB, built in memory |
+| Node budget | `[hosting] max_bytes`; `0` (default) = what it holds plus 25% of the free space above the free-disk floor |
+| Free-disk floor | a copy must leave max(10 GiB, 5% of the disk), capped at 50 GiB, free |
+| Per owner, per node | 16 GiB of free sites; sites the node is a preferred (paid) host for do not count |
 
 ```toml
 # ~/.config/c0mpute/config.toml
 [hosting]
-max_bytes = 5368709120
+max_bytes = 0            # 0 = follow the disk; or a fixed number of bytes
 ```
 
+The budget advertised to d1sks (`max_gib`) is the same number, so `--disks auto` only
+picks disks with room for their share of the site.
+
+Errors say which limit was hit and what to do (`--disks auto` for a free site over
+64 GiB, split the folder above 256 GiB). A hosting node logs the limit that made it
+refuse a copy (`over this node's hosting budget`, `disk nearly full`, `per-owner limit`).
+
+## Large sites: striped placement
+
+A site up to 1 GiB is replicated whole, exactly as before. Above that it is
+**striped**: its chunks are bucketed by hash into groups, one group per 64 MiB of the
+site (the count comes from the size in the signed record), and every group is placed on
+its own:
+
+* The hosting nodes that rank highest for `(site, group)` (rendezvous hashing, the same
+  answer on every node) take that group until it has three copies. No node needs the
+  whole site; a 50 GiB folder spreads over the whole network.
+* Hosting nodes gossip which groups they hold (a bitmap per site) and how many bytes
+  they can still take (`room`). Only nodes that announce `room` are counted on for a
+  group, and only when they have room for it. A group that stays short for 3 minutes
+  brings in the next-ranked node, so a chosen node that cannot take it never stalls it.
+* Healing, copy counting, garbage collection, proof-of-storage challenges (a chunk of a
+  group the holder says it holds), budgets and the free-disk floor all work per group.
+  A node holds each group as soon as it is complete, so a restart resumes group by group.
+* Paid sites: preferred hosts take every group when there are at most three of them (a
+  paid host holds the whole site), else the three that rank highest per group; each is
+  paid for its share (`size x 3 / preferred`).
+* `c0mpute hosting ls` and `/hosting/v1/sites` show, for a striped site, `copies` = the
+  fewest copies of any group, plus `groups`, `short_groups` and `missing_groups`.
+
+Manifests: up to 5,000 files and 1 GiB the manifest is one chunk, byte for byte what
+older nodes read. Above either, it is a root listing parts (by first path) of at most
+4,000 files and 65,536 chunk hashes each, so every part is one chunk fetch even for a
+256 GiB site; a gateway fetches only the part a request needs. Every holder of any group
+keeps the root and all parts.
+
+Groups are defined over chunk hashes only (the group of a chunk is its hash modulo the
+group count), never file contents. A gateway finds the holders of any chunk from the
+record alone, and the same layout works for a site whose chunks are ciphertext.
+
+**Older nodes** refuse records over their own cap (256 MiB before v0.3.0, 1 GiB in
+v0.3.0 to v0.3.2), so they never see a striped site: they neither hold nor serve it (a
+gateway that old answers 404 for it), and they are never counted on for a group because
+they do not announce `room`. Sites up to 1 GiB are unchanged and those nodes keep holding
+and serving them.
+
+## Streaming and Range requests
+
+Gateways answer `Range` requests on `/s/<id>/...` and on custom domains: `206 Partial
+Content` with `Content-Range`, only the chunks the range covers are fetched, and
+`Accept-Ranges: bytes` is on every file, so `<video>` seeks. Single ranges of every form
+work (`bytes=a-b`, `bytes=a-`, `bytes=-n`); a range past the end is `416`; several ranges
+in one request get the whole file. `If-Range` and `If-None-Match` (`304`) use the file's
+ETag. Large files stream with 8 chunks of read-ahead instead of being loaded whole first.
+Video types: `.mp4`/`.m4v` `video/mp4`, `.webm`, `.mkv` `video/x-matroska`, `.mov`,
+`.ogv`, `.m3u8`, `.vtt`, `.srt`, plus the audio types. Media is cached for an hour (the
+ETag changes with a new version), HTML for a minute.
+
+## Fast replication
+
+Replication and gateway reads fetch many chunks at once (32 in flight for a copy, 8 of
+read-ahead for a stream), each from the holder with the lowest expected wait (its measured
+time per chunk times the requests already queued on it), so every holder of a group serves
+part of a copy at the rate it can. A request slow for that peer is hedged to the next best
+holder and the first answer wins; a failed holder is retried elsewhere and sorts last until
+it answers again. Requests ride the existing libp2p connection (one yamux stream each). A
+new holder of a group pulls from all of its holders and the publisher at once; holders that
+finish a group become sources for it straight away.
+
+Chunks travel on `/c0mpute/chunk-fetch/2.0.0`, which sends them as CBOR byte strings.
+Version 1 sent an array of integers, about 1.9x the bytes, and is still used with peers
+that do not speak 2. Chunk reads no longer run on the swarm's event loop.
+
+c0mpute has no relay, so a node behind NAT (or a firewall that drops its random p2p
+port) cannot be dialled. Every hosting node and publisher now keeps itself connected to
+the hosting peers that announced a public address, so those peers can fetch the copies it
+holds, or the site it is publishing, over that connection. Two nodes that both cannot be
+dialled still cannot exchange chunks: give at least some hosting nodes a fixed, open p2p
+port (`C0MPUTE_P2P_LISTEN=/ip4/0.0.0.0/tcp/<port>` and `C0MPUTE_P2P_EXTERNAL`).
+
+Placement skips nodes that announced less room than a copy needs (whole sites too), so a
+full node ranked first no longer leaves a site at zero copies.
+
+`c0mpute hosting get <site> <path>` downloads one file the way a gateway does and prints
+the rate (`--sequential` fetches the old way, one chunk at a time, to compare).
+
 `--roles` without `hosting` means the node holds no copies; a gateway still serves
 sites by proxying.
 
diff --git a/node/crates/c0mpute-cli/src/main.rs b/node/crates/c0mpute-cli/src/main.rs
index 9721d2ee..11e64ef6 100644
--- a/node/crates/c0mpute-cli/src/main.rs
+++ b/node/crates/c0mpute-cli/src/main.rs
@@ -825,6 +825,10 @@ enum HostingCmd {
     /// The site is signed with this machine's identity, so only this machine
     /// can update it; publishing the same --name again ships a new version.
     /// Stays up until three hosting nodes hold copies, then exits.
+    /// Sites over 1 GiB (up to 64 GiB free, 256 GiB with --disks) are striped
+    /// over the network in 64 MiB groups; files are served from the folder
+    /// itself while the network copies them, so keep it running, and run the
+    /// same command again to resume if it stops.
     #[command(verbatim_doc_comment)]
     Publish {
         /// Directory to publish (hidden files are skipped, .well-known kept).
@@ -836,7 +840,8 @@ enum HostingCmd {
         /// add TXT `_c0mpute-hosting.<domain>` = `site=<site_id>`.
         #[arg(long = "domain")]
         domains: Vec<String>,
-        /// Give up waiting for network copies after this many seconds.
+        /// Give up waiting for network copies after this many seconds (for a
+        /// striped site: this many seconds without progress).
         #[arg(long, default_value_t = 600)]
         wait_secs: u64,
         /// Pay hosting nodes from the d1sks OpenDisk marketplace to hold the
@@ -886,6 +891,35 @@ enum HostingCmd {
         #[arg(long)]
         live: bool,
     },
+    /// Take a site down: publish an empty version of it. Holders switch to
+    /// it and delete the old files; gateways answer 404.
+    Rm {
+        /// Site name (as published from this machine).
+        #[arg(long)]
+        name: String,
+        /// Seconds to keep telling the network.
+        #[arg(long, default_value_t = 90)]
+        wait_secs: u64,
+    },
+    /// Download one file of a site from the network (as a gateway would),
+    /// showing the transfer rate.
+    Get {
+        /// Site id.
+        site: String,
+        /// Path in the site, e.g. `movies/a.mp4`.
+        path: String,
+        /// Where to write it (default: the file name).
+        #[arg(short, long)]
+        out: Option<std::path::PathBuf>,
+        /// One chunk at a time from one peer (how releases up to 0.3.2
+        /// fetched), to compare.
+        #[arg(long)]
+        sequential: bool,
+        /// Only fetch from these peers: peer ids or full multiaddrs
+        /// (repeatable). They are asked for every chunk.
+        #[arg(long)]
+        from: Vec<String>,
+    },
     /// List the sites a gateway knows, with live copy counts.
     Ls {
         /// Gateway to ask.
@@ -4172,6 +4206,36 @@ async fn run_hosting(cmd: HostingCmd) -> Result<()> {
             }
             Ok(())
         }
+        HostingCmd::Rm { name, wait_secs } => {
+            let rec = c0mpute_core::hosting::unpublish(&name, std::time::Duration::from_secs(wait_secs)).await?;
+            println!("site:    {} ({name}) is empty now, version {}", rec.site_id, rec.seq);
+            Ok(())
+        }
+        HostingCmd::Get {
+            site,
+            path,
+            out,
+            sequential,
+            from,
+        } => {
+            let out = out.unwrap_or_else(|| {
+                std::path::PathBuf::from(path.rsplit('/').next().filter(|s| !s.is_empty()).unwrap_or("index.html"))
+            });
+            let d = c0mpute_core::hosting::download(&site, &path, &out, sequential, from).await?;
+            let secs = d.took.as_secs_f64().max(0.001);
+            println!(
+                "{} bytes in {:.1} s = {:.1} MB/s ({}) -> {}",
+                d.bytes,
+                secs,
+                d.bytes as f64 / secs / 1e6,
+                if sequential { "sequential" } else { "parallel" },
+                out.display()
+            );
+            for (p, b) in d.by_peer {
+                println!("  {p}  {:.1} MiB", b as f64 / 1048576.0);
+            }
+            Ok(())
+        }
         HostingCmd::Ls { gateway } => {
             let url = format!("{}/hosting/v1/sites", gateway.trim_end_matches('/'));
             let v: serde_json::Value = reqwest::get(&url)
@@ -4184,13 +4248,23 @@ async fn run_hosting(cmd: HostingCmd) -> Result<()> {
                 println!("no sites known to {gateway} yet");
             }
             for s in sites {
+                // Striped sites: copies = fewest copies of any group.
+                let striped = if s["striped"].as_bool() == Some(true) {
+                    format!(
+                        "  striped: {} groups, {} short, {} without a copy",
+                        s["groups"], s["short_groups"], s["missing_groups"]
+                    )
+                } else {
+                    String::new()
+                };
                 println!(
-                    "{:<22} {:<24} copies {}/{}  {} bytes  {}",
+                    "{:<22} {:<24} copies {}/{}  {} bytes{}  {}",
                     s["site_id"].as_str().unwrap_or(""),
                     s["name"].as_str().unwrap_or(""),
                     s["copies"],
                     v["target_copies"],
                     s["size"],
+                    striped,
                     s["domains"]
                         .as_array()
                         .map(|d| d.iter().filter_map(|x| x.as_str()).collect::<Vec<_>>().join(","))
diff --git a/node/crates/c0mpute-core/Cargo.toml b/node/crates/c0mpute-core/Cargo.toml
index d9f44541..965fdcfa 100644
--- a/node/crates/c0mpute-core/Cargo.toml
+++ b/node/crates/c0mpute-core/Cargo.toml
@@ -44,6 +44,7 @@ hkdf = { workspace = true }
 hmac = { workspace = true }
 aes-gcm = { workspace = true }
 base64 = { workspace = true }
+futures = { workspace = true }
 sysinfo = { workspace = true }
 zip = { workspace = true }
 flate2 = "1"
diff --git a/node/crates/c0mpute-core/src/ads/manage.rs b/node/crates/c0mpute-core/src/ads/manage.rs
index 3996b80a..1b091e07 100644
--- a/node/crates/c0mpute-core/src/ads/manage.rs
+++ b/node/crates/c0mpute-core/src/ads/manage.rs
@@ -120,8 +120,8 @@ pub fn build_creative_dir(files: &[PathBuf], out: &Path, duration_override_ms: O
         let (kind, mime) = media_kind(f).context("not a creative")?;
         let bytes = std::fs::read(f).with_context(|| format!("read {}", f.display()))?;
         total += bytes.len() as u64;
-        if total > site::MAX_SITE_BYTES {
-            bail!("creatives add up to more than {} MiB", site::MAX_SITE_BYTES / (1024 * 1024));
+        if total > site::MAX_SMALL_SITE_BYTES {
+            bail!("creatives add up to more than {} MiB", site::MAX_SMALL_SITE_BYTES / (1024 * 1024));
         }
         let stem: String = f
             .file_name()
diff --git a/node/crates/c0mpute-core/src/apps/deploy.rs b/node/crates/c0mpute-core/src/apps/deploy.rs
index 7340e490..a04ff653 100644
--- a/node/crates/c0mpute-core/src/apps/deploy.rs
+++ b/node/crates/c0mpute-core/src/apps/deploy.rs
@@ -209,12 +209,12 @@ pub async fn deploy(opts: DeployOptions) -> Result<AppRecord> {
             let tmp = std::env::temp_dir().join(format!("c0mpute-deploy-{}-{seq}", opts.name));
             std::fs::create_dir_all(&tmp)?;
             let size = save_image(&tag, &tmp).await?;
-            if size > site::MAX_SITE_BYTES {
+            if size > site::MAX_SMALL_SITE_BYTES {
                 let _ = std::fs::remove_dir_all(&tmp);
                 bail!(
                     "the image is {} MiB gzipped; the limit is {} MiB (use a slim base image, or --pull a pinned registry image)",
                     size >> 20,
-                    site::MAX_SITE_BYTES >> 20
+                    site::MAX_SMALL_SITE_BYTES >> 20
                 );
             }
             let site_name = format!("app-{}", opts.name);
diff --git a/node/crates/c0mpute-core/src/config.rs b/node/crates/c0mpute-core/src/config.rs
index 63292837..9a7adfaa 100644
--- a/node/crates/c0mpute-core/src/config.rs
+++ b/node/crates/c0mpute-core/src/config.rs
@@ -196,7 +196,9 @@ pub struct HostingConfig {
     /// --no-hosting`) is the opt-out.
     #[serde(default = "default_true")]
     pub enabled: bool,
-    /// Most bytes of other people's sites this node will hold.
+    /// Most bytes of other people's sites this node will hold. `0` (the
+    /// default) follows the disk: what it holds plus a quarter of the free
+    /// space above the free-disk floor (see `hosting::auto_budget`).
     #[serde(default = "default_hosting_max_bytes")]
     pub max_bytes: u64,
     /// What this node asks to be a preferred (paid) host, USD per GiB-month.
diff --git a/node/crates/c0mpute-core/src/hosting/fetch.rs b/node/crates/c0mpute-core/src/hosting/fetch.rs
new file mode 100644
index 00000000..1cf1aca0
--- /dev/null
+++ b/node/crates/c0mpute-core/src/hosting/fetch.rs
@@ -0,0 +1,349 @@
+//! Multi-source chunk fetching, BitTorrent style.
+//!
+//! Replication and gateway reads used to fetch one chunk at a time from one
+//! peer, waiting a full round trip for each 1 MiB, so a copy moved at one
+//! chunk per round trip whatever the link could carry. Now:
+//!
+//! * many chunks are in flight at once (callers keep a window of them);
+//! * each request goes to the source with the lowest expected wait, which is
+//!   its measured time per chunk times the requests already queued on it, so
+//!   load spreads over every holder in proportion to how fast it is;
+//! * a request that is slow compared with that peer's own record is hedged:
+//!   the same chunk is asked of the next best source and the first answer
+//!   wins (work stealing from slow peers);
+//! * a failed source is retried elsewhere and sorts last until it answers
+//!   again; the DHT is the last resort;
+//! * requests ride the peers' existing libp2p connections (one yamux stream
+//!   per request), so nothing is dialled per chunk.
+
+use std::collections::HashMap;
+use std::sync::Mutex;
+use std::time::{Duration, Instant};
+
+use anyhow::{Result, bail};
+use c0mpute_net::{Libp2pNetwork, Network};
+use c0mpute_proto::{ChunkRequest, Hash};
+use futures::stream::{FuturesUnordered, StreamExt};
+
+/// Chunks a bulk copy keeps in flight.
+pub const BULK_WINDOW: usize = 32;
+/// Chunks a gateway reads ahead of what it is sending.
+pub const READ_AHEAD: usize = 8;
+/// Most requests in flight to one peer. Each peer's own limit starts at
+/// [`START_LIMIT`] and adapts (AIMD): up while its answers come back well
+/// inside the timeout, halved when one is slow or fails, so a peer on a thin
+/// uplink is never asked for more than it can send before requests time out.
+const PER_PEER_CAP: f64 = 16.0;
+const START_LIMIT: f64 = 4.0;
+/// Assumed time per chunk for a peer never measured.
+const UNKNOWN_MS: f64 = 400.0;
+
+#[derive(Clone, Debug, Default)]
+struct PeerStat {
+    inflight: usize,
+    /// Smoothed time per chunk, ms.
+    ms: Option<f64>,
+    /// Consecutive failures.
+    fails: u32,
+    last_fail: Option<Instant>,
+    bytes: u64,
+    /// Requests this peer may have in flight (AIMD), when adapted.
+    limit: Option<f64>,
+}
+
+impl PeerStat {
+    fn limit(&self) -> f64 {
+        self.limit.unwrap_or(START_LIMIT)
+    }
+}
+
+/// Per-peer speed and load, shared by every fetch on this node.
+#[derive(Default)]
+pub struct Stats {
+    peers: Mutex<HashMap<String, PeerStat>>,
+}
+
+impl Stats {
+    fn cost(&self, s: &PeerStat) -> f64 {
+        let ms = s.ms.unwrap_or(UNKNOWN_MS);
+        let penalty = match s.last_fail {
+            // A peer that failed recently waits its turn behind everyone.
+            Some(t) if t.elapsed() < Duration::from_secs(60) => 1.0 + 8.0 * s.fails.min(4) as f64,
+            _ => 1.0,
+        };
+        ms * (s.inflight as f64 + 1.0) * penalty
+    }
+
+    /// Reserve a request slot on the best of `sources` that has one free
+    /// (skipping `tried`). `None` when every untried source is at its limit
+    /// or there is none.
+    fn take(&self, sources: &[String], tried: &[String], turn: usize) -> Option<String> {
+        let order = self.rank(sources, turn);
+        let mut peers = self.peers.lock().expect("stats lock");
+        for p in order {
+            if tried.contains(&p) {
+                continue;
+            }
+            let s = peers.entry(p.clone()).or_default();
+            if (s.inflight as f64) < s.limit() {
+                s.inflight += 1;
+                return Some(p);
+            }
+        }
+        None
+    }
+
+    /// `sources` best first for one more request right now.
+    pub fn rank(&self, sources: &[String], turn: usize) -> Vec<String> {
+        let peers = self.peers.lock().expect("stats lock");
+        let mut v: Vec<(f64, usize, String)> = sources
+            .iter()
+            .enumerate()
+            .map(|(i, p)| {
+                let s = peers.get(p).cloned().unwrap_or_default();
+                // Rotate among equals so unmeasured peers all get tried.
+                let rot = (i + turn) % sources.len().max(1);
+                (self.cost(&s), rot, p.clone())
+            })
+            .collect();
+        v.sort_by(|a, b| a.0.total_cmp(&b.0).then(a.1.cmp(&b.1)));
+        v.into_iter().map(|(_, _, p)| p).collect()
+    }
+
+    #[cfg(test)]
+    fn start(&self, peer: &str) {
+        self.peers
+            .lock()
+            .expect("stats lock")
+            .entry(peer.to_string())
+            .or_default()
+            .inflight += 1;
+    }
+
+    fn finish(&self, peer: &str, ok: Option<(Duration, usize)>, timeout: Duration) {
+        let mut peers = self.peers.lock().expect("stats lock");
+        let s = peers.entry(peer.to_string()).or_default();
+        s.inflight = s.inflight.saturating_sub(1);
+        let limit = s.limit();
+        match ok {
+            Some((took, _)) if took > timeout / 2 => s.limit = Some((limit / 2.0).max(1.0)),
+            Some((took, _)) if took < timeout / 4 => {
+                s.limit = Some((limit + 0.5).min(PER_PEER_CAP))
+            }
+            Some(_) => {}
+            None => s.limit = Some((limit / 2.0).max(1.0)),
+        }
+        match ok {
+            Some((took, len)) => {
+                let ms = (took.as_secs_f64() * 1000.0).max(1.0);
+                s.ms = Some(match s.ms {
+                    Some(old) => old * 0.7 + ms * 0.3,
+                    None => ms,
+                });
+                s.fails = 0;
+                s.bytes += len as u64;
+            }
+            None => {
+                s.fails += 1;
+                s.last_fail = Some(Instant::now());
+            }
+        }
+    }
+
+    /// Expected time per chunk for a peer, when measured.
+    pub fn ms(&self, peer: &str) -> Option<f64> {
+        self.peers
+            .lock()
+            .expect("stats lock")
+            .get(peer)
+            .and_then(|s| s.ms)
+    }
+
+    /// Bytes received from each peer so far.
+    pub fn bytes_by_peer(&self) -> Vec<(String, u64)> {
+        let mut v: Vec<(String, u64)> = self
+            .peers
+            .lock()
+            .expect("stats lock")
+            .iter()
+            .filter(|(_, s)| s.bytes > 0)
+            .map(|(p, s)| (p.clone(), s.bytes))
+            .collect();
+        v.sort_by(|a, b| b.1.cmp(&a.1));
+        v
+    }
+}
+
+/// How long to wait on a request before hedging it with another source.
+fn hedge_after(ms: Option<f64>) -> Duration {
+    let base = ms.unwrap_or(UNKNOWN_MS) * 3.0;
+    Duration::from_millis(base.clamp(800.0, 6000.0) as u64)
+}
+
+/// Fetch one chunk from the best of `sources` (never `me`), hedging slow
+/// requests and failing over, then the DHT. Bytes are checked against the
+/// hash.
+pub async fn fetch_one(
+    net: &Libp2pNetwork,
+    stats: &Stats,
+    me: &str,
+    hash: &Hash,
+    sources: &[String],
+    timeout: Duration,
+    turn: usize,
+) -> Result<Vec<u8>> {
+    let sources: Vec<String> = sources.iter().filter(|p| *p != me).cloned().collect();
+    let req = ChunkRequest {
+        chunk_hash: *hash,
+        shard_index: None,
+    };
+    let mut tried: Vec<String> = Vec::new();
+    let mut inflight = FuturesUnordered::new();
+    let mut last = String::from("no holders");
+    let launch = |peer: String| {
+        let req = req.clone();
+        async move {
+            let Ok(pid) = peer.parse::<c0mpute_net::PeerId>() else {
+                return (peer, Err(anyhow::anyhow!("not a peer id")), Duration::ZERO);
+            };
+            let started = Instant::now();
+            let got = match tokio::time::timeout(timeout, net.fetch_from_peer(pid, &req)).await {
+                Ok(r) => r,
+                Err(_) => Err(anyhow::anyhow!("timed out")),
+            };
+            (peer, got, started.elapsed())
+        }
+    };
+    let begun = Instant::now();
+    let mut hedge = hedge_after(None);
+    // Wait for a free slot on some source (every source busy = back off).
+    while !sources.is_empty() && inflight.is_empty() && begun.elapsed() < timeout {
+        match stats.take(&sources, &tried, turn) {
+            Some(p) => {
+                hedge = hedge_after(stats.ms(&p));
+                tried.push(p.clone());
+                inflight.push(launch(p));
+            }
+            None if tried.len() >= sources.len() => break,
+            None => tokio::time::sleep(Duration::from_millis(40)).await,
+        }
+    }
+    while !inflight.is_empty() {
+        tokio::select! {
+            done = inflight.next() => {
+                let Some((peer, got, took)) = done else { break };
+                match got {
+                    Ok(bytes) if Hash::of(&bytes) == *hash => {
+                        stats.finish(&peer, Some((took, bytes.len())), timeout);
+                        return Ok(bytes);
+                    }
+                    Ok(_) => {
+                        stats.finish(&peer, None, timeout);
+                        last = format!("{peer} sent bytes that do not match the hash");
+                    }
+                    Err(e) => {
+                        stats.finish(&peer, None, timeout);
+                        last = format!("{peer}: {e}");
+                    }
+                }
+                // Fail over: the next source with a free slot.
+                while inflight.is_empty() && tried.len() < sources.len() && begun.elapsed() < timeout * 2 {
+                    match stats.take(&sources, &tried, turn) {
+                        Some(p) => {
+                            hedge = hedge_after(stats.ms(&p));
+                            tried.push(p.clone());
+                            inflight.push(launch(p));
+                        }
+                        None => tokio::time::sleep(Duration::from_millis(40)).await,
+                    }
+                }
+            }
+            _ = tokio::time::sleep(hedge), if inflight.len() < 2 => {
+                // Slow for this peer: ask the next best one too, if it has room.
+                if let Some(p) = stats.take(&sources, &tried, turn) {
+                    tried.push(p.clone());
+                    inflight.push(launch(p));
+                } else {
+                    hedge = timeout;
+                }
+            }
+        }
+    }
+    // Last resort: the DHT (any peer that announced the chunk).
+    match tokio::time::timeout(timeout, net.fetch(&req)).await {
+        Ok(Ok(bytes)) if Hash::of(&bytes) == *hash => Ok(bytes),
+        _ => bail!("could not fetch chunk {}: {last}", hash.to_hex()),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn faster_and_idler_peers_rank_first() {
+        let s = Stats::default();
+        let peers = vec!["slow".to_string(), "fast".to_string(), "new".to_string()];
+        s.start("slow");
+        s.finish(
+            "slow",
+            Some((Duration::from_millis(900), 1 << 20)),
+            Duration::from_secs(20),
+        );
+        s.start("fast");
+        s.finish(
+            "fast",
+            Some((Duration::from_millis(100), 1 << 20)),
+            Duration::from_secs(20),
+        );
+        assert_eq!(s.rank(&peers, 0)[0], "fast");
+        // Load the fast peer until the unmeasured one is cheaper.
+        for _ in 0..6 {
+            s.start("fast");
+        }
+        assert_eq!(s.rank(&peers, 0)[0], "new");
+        // A failed peer sorts last.
+        s.start("new");
+        s.finish("new", None, Duration::from_secs(20));
+        assert_eq!(s.rank(&peers, 0).last().unwrap(), "new");
+    }
+
+    #[test]
+    fn per_peer_limits_adapt_to_how_fast_answers_come_back() {
+        let s = Stats::default();
+        let t = Duration::from_secs(20);
+        let one = vec!["p".to_string()];
+        // Starts at 4 in flight.
+        for _ in 0..4 {
+            assert!(s.take(&one, &[], 0).is_some());
+        }
+        assert!(s.take(&one, &[], 0).is_none(), "at its limit");
+        // Quick answers raise the limit.
+        for _ in 0..4 {
+            s.finish("p", Some((Duration::from_millis(200), 1 << 20)), t);
+        }
+        let mut n = 0;
+        while s.take(&one, &[], 0).is_some() {
+            n += 1;
+        }
+        assert_eq!(n, 6);
+        // A slow answer halves it.
+        s.finish("p", Some((Duration::from_secs(15), 1 << 20)), t);
+        for _ in 0..5 {
+            s.finish("p", Some((Duration::from_secs(6), 1 << 20)), t);
+        }
+        for _ in 0..3 {
+            assert!(s.take(&one, &[], 0).is_some());
+        }
+        assert!(s.take(&one, &[], 0).is_none(), "limit halved to 3");
+        // Tried peers are skipped.
+        assert!(s.take(&one, &["p".to_string()], 0).is_none());
+    }
+
+    #[test]
+    fn hedging_waits_longer_for_slow_peers() {
+        assert_eq!(hedge_after(Some(10.0)), Duration::from_millis(800));
+        assert_eq!(hedge_after(Some(1000.0)), Duration::from_millis(3000));
+        assert_eq!(hedge_after(Some(1e6)), Duration::from_millis(6000));
+    }
+}
diff --git a/node/crates/c0mpute-core/src/hosting/mod.rs b/node/crates/c0mpute-core/src/hosting/mod.rs
index 40442913..ebfa8791 100644
--- a/node/crates/c0mpute-core/src/hosting/mod.rs
+++ b/node/crates/c0mpute-core/src/hosting/mod.rs
@@ -20,14 +20,17 @@
 //!   through [`crate::payments`], off unless the operator turns it on).
 
 pub mod dns;
+pub mod fetch;
 pub mod market;
 pub mod meta;
 pub mod proof;
 pub mod replicas;
+pub mod seed;
 pub mod settle;
 pub mod site;
+pub mod stripe;
 
-use std::collections::{HashMap, HashSet};
+use std::collections::{BTreeSet, HashMap, HashSet};
 use std::path::PathBuf;
 use std::sync::Arc;
 use std::sync::atomic::{AtomicUsize, Ordering};
@@ -51,7 +54,7 @@ use tracing::{debug, info, warn};
 use crate::payments::{Micros, Payee};
 use proof::Receipt;
 use replicas::{Action, ReplicaMap};
-use site::{Manifest, ManifestPart, PartRef, SiteRecord};
+use site::{Manifest, ManifestPart, PartRef, SiteManifest, SiteRecord};
 
 pub const TOPIC: &str = "c0mpute/hosting/v1";
 pub const ROLE_TAG: &str = "c0mpute:role:hosting";
@@ -59,14 +62,28 @@ pub const ROLE_TAG: &str = "c0mpute:role:hosting";
 pub const TARGET_REPLICAS: usize = 3;
 /// Above this many copies, the lowest-ranked holder lets go.
 pub const MAX_REPLICAS: usize = 5;
-/// Default bytes a node will hold for other people's sites.
-pub const DEFAULT_MAX_BYTES: u64 = 5 * 1024 * 1024 * 1024;
-/// Most bytes a node holds for any one owner key, so one publisher cannot
-/// fill every node's budget.
-pub const MAX_BYTES_PER_OWNER: u64 = 1024 * 1024 * 1024;
+/// `[hosting] max_bytes = 0` (the default): the budget follows the disk, see
+/// [`auto_budget`].
+pub const DEFAULT_MAX_BYTES: u64 = 0;
+/// Share of the free space above the free-disk floor an automatic budget may
+/// use, in percent.
+pub const AUTO_BUDGET_PERCENT: u64 = 25;
+/// Most bytes of FREE sites a node holds for any one owner key, so one
+/// publisher cannot fill every volunteer's disk. Sites a node is a preferred
+/// (paid) host for are not counted: it was picked, and is paid, for them.
+pub const MAX_BYTES_PER_OWNER: u64 = 16 * GIB_BYTES;
 /// Sites per holding message, so one message stays well under gossipsub's
 /// 64 KiB limit.
 const SITES_PER_MESSAGE: usize = 200;
+/// Bytes of site entries per holding message (group bitmaps make entries of
+/// striped sites larger than the rest).
+const HOLDING_MESSAGE_BYTES: usize = 40 * 1024;
+/// A group short of copies for this long brings in one more candidate per
+/// period, so a chosen node that cannot take it does not stall the group.
+const WIDEN_AFTER: Duration = Duration::from_secs(180);
+/// Most hosting peers a node keeps itself connected to (see
+/// [`Hosting::connect_hosts`]).
+const CONNECT_HOSTS_MAX: usize = 24;
 
 /// How often things happen. Tests shrink these.
 #[derive(Clone, Debug)]
@@ -128,6 +145,11 @@ pub enum HostingMsg {
         /// first in the rendezvous fill. Absent from older nodes.
         #[serde(default, skip_serializing_if = "Option::is_none")]
         room_gib: Option<u64>,
+        /// Bytes it can still take for the network. Sent only by nodes that
+        /// place striped sites, which is how others know to count on them for
+        /// a group. Absent from older nodes.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        room: Option<u64>,
     },
     /// A signed availability receipt (proof-of-storage challenge result).
     /// Older nodes do not know this variant and skip it.
@@ -147,12 +169,20 @@ pub struct Held {
     pub site_id: String,
     pub manifest: String,
     pub seq: u64,
+    /// Striped site held in part: bitmap of the groups held
+    /// ([`stripe::encode_groups`]). Absent = the whole site.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub groups: Option<String>,
 }
 
 /// Sites this node holds, persisted next to the chunk store.
 #[derive(Clone, Debug, Default, Serialize, Deserialize)]
 struct Catalog {
     sites: HashMap<String, SiteRecord>,
+    /// Striped sites: the groups of `sites[id]`'s manifest held here. A site
+    /// in `sites` without an entry is held whole.
+    #[serde(default)]
+    stripes: HashMap<String, BTreeSet<u32>>,
 }
 
 struct Inner {
@@ -180,6 +210,12 @@ struct Inner {
     turn: AtomicUsize,
     stopped: std::sync::atomic::AtomicBool,
     fetch_slots: Semaphore,
+    /// Per-peer speed and load for multi-source fetching.
+    stats: fetch::Stats,
+    /// Group layouts of striped manifests, by manifest hash.
+    layouts: RwLock<HashMap<String, Arc<stripe::Layout>>>,
+    /// When each short group was first seen short, for widening.
+    short_since: std::sync::Mutex<HashMap<(String, u32), Instant>>,
     dns: dns::Verifier,
     /// Optional handler for requests with a query string (podcast ad
     /// insertion installs one); it may decline and let the plain serve run.
@@ -196,6 +232,7 @@ struct Inner {
     /// Receipts this node signed, for settlement (kept on disk too).
     own_receipts: RwLock<Vec<Receipt>>,
     receipts_path: Option<PathBuf>,
+    disk_override: Option<(u64, u64)>,
 }
 
 /// Which sites a node challenges.
@@ -265,6 +302,9 @@ pub struct Options {
     pub payout: Option<Payee>,
     /// JSONL file of this node's own receipts (survives restarts).
     pub receipts_path: Option<PathBuf>,
+    /// Pretend the disk has (free, total) bytes instead of asking the OS.
+    /// For tests on machines whose disk is below the free-disk floor.
+    pub disk_override: Option<(u64, u64)>,
 }
 
 impl Default for Options {
@@ -281,6 +321,7 @@ impl Default for Options {
             price: None,
             payout: None,
             receipts_path: None,
+            disk_override: None,
         }
     }
 }
@@ -335,7 +376,10 @@ impl Hosting {
             replicating: RwLock::new(HashSet::new()),
             turn: AtomicUsize::new(0),
             stopped: std::sync::atomic::AtomicBool::new(false),
-            fetch_slots: Semaphore::new(8),
+            fetch_slots: Semaphore::new(128),
+            stats: fetch::Stats::default(),
+            layouts: RwLock::new(HashMap::new()),
+            short_since: std::sync::Mutex::new(HashMap::new()),
             dns: opts.dns,
             hook: std::sync::OnceLock::new(),
             host_hook: std::sync::OnceLock::new(),
@@ -347,6 +391,7 @@ impl Hosting {
             payout: opts.payout.filter(|p| p.valid()),
             own_receipts: RwLock::new(own_receipts),
             receipts_path: opts.receipts_path,
+            disk_override: opts.disk_override,
         });
         let h = Hosting(inner);
         // Records seen before a restart (each re-verified).
@@ -359,10 +404,24 @@ impl Hosting {
         // Sites held before a restart: keep them only if their chunks are
         // still here.
         for (id, rec) in catalog.sites {
-            if h.has_complete_copy(&rec).await {
-                h.0.catalog.write().await.sites.insert(id, rec.clone());
-                h.0.map.write().await.apply_record(rec);
+            match catalog.stripes.get(&id) {
+                Some(groups) => {
+                    let kept = h.complete_groups(&rec, groups).await;
+                    if kept.is_empty() {
+                        continue;
+                    }
+                    let mut cat = h.0.catalog.write().await;
+                    cat.sites.insert(id.clone(), rec.clone());
+                    cat.stripes.insert(id, kept);
+                }
+                None => {
+                    if !h.has_complete_copy(&rec).await {
+                        continue;
+                    }
+                    h.0.catalog.write().await.sites.insert(id, rec.clone());
+                }
             }
+            h.0.map.write().await.apply_record(rec);
         }
         net.subscribe(TOPIC).await.context("subscribe to hosting topic")?;
         h.spawn_gossip_reader();
@@ -394,7 +453,8 @@ impl Hosting {
         let mut rx = self.0.net.messages();
         tokio::spawn(async move {
             // Partial holding lists from multi-part announcements.
-            let mut partial: HashMap<String, (u32, HashMap<String, (String, u64)>)> = HashMap::new();
+            type Part = (u32, HashMap<String, (String, u64)>, HashMap<String, BTreeSet<u32>>);
+            let mut partial: HashMap<String, Part> = HashMap::new();
             loop {
                 let msg: GossipMessage = match rx.recv().await {
                     Ok(m) => m,
@@ -428,6 +488,7 @@ impl Hosting {
                         payout,
                         full,
                         room_gib,
+                        room,
                     } => {
                         if let Some(pid) = msg.source {
                             for a in addrs.iter().take(8) {
@@ -437,20 +498,41 @@ impl Hosting {
                             }
                         }
                         let parts = parts.clamp(1, 1000);
-                        let entry = partial.entry(source.clone()).or_insert((0, HashMap::new()));
+                        let entry = partial
+                            .entry(source.clone())
+                            .or_insert((0, HashMap::new(), HashMap::new()));
                         if part == 0 {
-                            *entry = (0, HashMap::new());
+                            *entry = (0, HashMap::new(), HashMap::new());
                         }
                         for s in sites.into_iter().take(SITES_PER_MESSAGE) {
+                            if let Some(g) = &s.groups {
+                                // An unreadable bitmap: skip the entry rather
+                                // than count the peer as holding everything.
+                                let Some(gs) = stripe::decode_groups(g) else {
+                                    continue;
+                                };
+                                entry.2.insert(s.site_id.clone(), gs);
+                            }
                             entry.1.insert(s.site_id, (s.manifest, s.seq));
                         }
                         entry.0 += 1;
                         if part + 1 >= parts {
-                            let (_, all) = partial.remove(&source).unwrap_or_default();
+                            let (_, all, groups) = partial.remove(&source).unwrap_or_default();
                             let price = price.as_deref().and_then(|p| crate::payments::parse_usd(p).ok());
                             let payout = payout.filter(|p| p.valid());
+                            let addrs: Vec<String> = addrs.into_iter().take(8).collect();
                             let mut map = h.0.map.write().await;
-                            map.apply_holding_meta(&source, all, Instant::now(), hosts, price, payout);
+                            map.apply_holding_full(
+                                &source,
+                                all,
+                                groups,
+                                Instant::now(),
+                                hosts,
+                                price,
+                                payout,
+                                room,
+                                addrs,
+                            );
                             map.set_full(&source, full);
                             map.set_room(&source, room_gib);
                         }
@@ -473,57 +555,91 @@ impl Hosting {
 
     /// Announce what this node holds, and count itself in its own map.
     pub async fn announce_holding(&self) {
-        let held: Vec<Held> = self
-            .0
-            .catalog
-            .read()
-            .await
-            .sites
-            .values()
-            .map(|r| Held {
-                site_id: r.site_id.clone(),
-                manifest: r.manifest.clone(),
-                seq: r.seq,
-            })
-            .collect();
-        let mine: HashMap<String, (String, u64)> = held
-            .iter()
-            .map(|h| (h.site_id.clone(), (h.manifest.clone(), h.seq)))
-            .collect();
+        let (held, mine, my_groups): (
+            Vec<Held>,
+            HashMap<String, (String, u64)>,
+            HashMap<String, BTreeSet<u32>>,
+        ) = {
+            let cat = self.0.catalog.read().await;
+            let held = cat
+                .sites
+                .values()
+                .map(|r| Held {
+                    site_id: r.site_id.clone(),
+                    manifest: r.manifest.clone(),
+                    seq: r.seq,
+                    groups: cat.stripes.get(&r.site_id).map(stripe::encode_groups),
+                })
+                .collect();
+            let mine = cat
+                .sites
+                .values()
+                .map(|r| (r.site_id.clone(), (r.manifest.clone(), r.seq)))
+                .collect();
+            (held, mine, cat.stripes.clone())
+        };
         let (price, payout) = if self.0.hosts {
             (self.0.price, self.0.payout.clone())
         } else {
             (None, None)
         };
-        let full = self.0.hosts && self.is_full().await;
-        let room_gib = if self.0.hosts { self.room_gib() } else { None };
-        if self.0.hosts || !mine.is_empty() {
-            let mut map = self.0.map.write().await;
-            map.apply_holding_meta(&self.0.me, mine, Instant::now(), self.0.hosts, price, payout.clone());
-            map.set_full(&self.0.me, full);
-            map.set_room(&self.0.me, room_gib);
+        let room = if self.0.hosts {
+            Some(self.room().await)
         } else {
+            None
+        };
+        let full = room.is_some_and(|r| r < FULL_HEADROOM_BYTES);
+        let room_gib = room.map(|r| r / GIB_BYTES);
+        if !self.0.hosts && mine.is_empty() {
             return;
         }
-        let chunks: Vec<&[Held]> = if held.is_empty() {
-            vec![&[]]
-        } else {
-            held.chunks(SITES_PER_MESSAGE).collect()
-        };
-        let parts = chunks.len() as u32;
         let addrs: Vec<String> = self
             .0
             .net
             .advertised_addrs()
             .await
             .into_iter()
-            .filter(|a| !a.to_string().contains("/ip4/0.0.0.0") && !a.to_string().contains("/ip6/::/"))
+            .filter(|a| {
+                !a.to_string().contains("/ip4/0.0.0.0") && !a.to_string().contains("/ip6/::/")
+            })
             .take(8)
             .map(|a| a.to_string())
             .collect();
+        self.0.map.write().await.apply_holding_full(
+            &self.0.me,
+            mine,
+            my_groups,
+            Instant::now(),
+            self.0.hosts,
+            price,
+            payout.clone(),
+            room,
+            addrs.clone(),
+        );
+        {
+            let mut map = self.0.map.write().await;
+            map.set_full(&self.0.me, full);
+            map.set_room(&self.0.me, room_gib);
+        }
+        // Split by count and by size: group bitmaps make striped entries big.
+        let mut chunks: Vec<Vec<Held>> = vec![Vec::new()];
+        let mut bytes = 0usize;
+        for h in held {
+            let len = 120 + h.groups.as_ref().map(|g| g.len()).unwrap_or(0);
+            let cur = chunks.last_mut().expect("one chunk");
+            if !cur.is_empty()
+                && (cur.len() >= SITES_PER_MESSAGE || bytes + len > HOLDING_MESSAGE_BYTES)
+            {
+                chunks.push(Vec::new());
+                bytes = 0;
+            }
+            chunks.last_mut().expect("one chunk").push(h);
+            bytes += len;
+        }
+        let parts = chunks.len() as u32;
         for (i, c) in chunks.into_iter().enumerate() {
             self.publish(&HostingMsg::Holding {
-                sites: c.to_vec(),
+                sites: c,
                 part: i as u32,
                 parts,
                 hosts: self.0.hosts,
@@ -532,11 +648,103 @@ impl Hosting {
                 payout: payout.clone(),
                 full,
                 room_gib,
+                room,
             })
             .await;
         }
     }
 
+    /// Bytes this node holds for the network (striped sites: the groups held).
+    async fn held_bytes(&self) -> u64 {
+        let (recs, stripes): (Vec<SiteRecord>, HashMap<String, BTreeSet<u32>>) = {
+            let cat = self.0.catalog.read().await;
+            (cat.sites.values().cloned().collect(), cat.stripes.clone())
+        };
+        let mut total = 0;
+        for r in recs {
+            total += match stripes.get(&r.site_id) {
+                Some(gs) => match self.layout(&r).await {
+                    Ok(l) => l.bytes_of(gs),
+                    Err(_) => {
+                        gs.len() as u64 * (stripe::GROUP_CHUNKS * site::FILE_CHUNK_BYTES) as u64
+                    }
+                },
+                None => r.size,
+            };
+        }
+        total
+    }
+
+    /// (free, total) bytes of the disk the chunk store is on.
+    fn disk(&self) -> (u64, u64) {
+        self.0
+            .disk_override
+            .unwrap_or_else(|| crate::opendisk::disk_for(self.0.store.root()))
+    }
+
+    /// The most this node holds for the network right now: `[hosting]
+    /// max_bytes` when set, else [`auto_budget`] of the disk.
+    pub async fn budget(&self) -> u64 {
+        let held = self.held_bytes().await;
+        self.budget_with(held)
+    }
+
+    fn budget_with(&self, held: u64) -> u64 {
+        if self.0.max_bytes > 0 {
+            return self.0.max_bytes;
+        }
+        let (free, total) = self.disk();
+        auto_budget(held, free, total)
+    }
+
+    /// Bytes this node can still take: within its budget, and leaving the
+    /// free-disk floor.
+    pub async fn room(&self) -> u64 {
+        let held = self.held_bytes().await;
+        let budget = self.budget_with(held);
+        let (free, total) = self.disk();
+        let by_disk = if total == 0 {
+            u64::MAX
+        } else {
+            free.saturating_sub(free_disk_floor(total))
+        };
+        budget.saturating_sub(held).min(by_disk)
+    }
+
+    /// Keep a connection open to the hosting peers that announced a public
+    /// address. c0mpute has no relay: a node behind NAT cannot be dialled, so
+    /// other nodes could never fetch the copies it holds, or the site it is
+    /// publishing. Dialling out to them gives every such peer a connection it
+    /// can fetch over (gossipsub keeps it open).
+    pub async fn connect_hosts(&self) {
+        let connected: HashSet<String> = self
+            .0
+            .net
+            .connected_peers()
+            .await
+            .iter()
+            .map(|p| p.to_base58())
+            .collect();
+        let targets: Vec<String> = {
+            let map = self.0.map.read().await;
+            let mut v: Vec<String> = map
+                .peers
+                .iter()
+                .filter(|(p, h)| h.hosts && **p != self.0.me && !connected.contains(*p))
+                .filter(|(_, h)| h.addrs.iter().any(|a| public_tcp_addr(a)))
+                .map(|(p, _)| p.clone())
+                .collect();
+            v.sort();
+            v
+        };
+        let room = CONNECT_HOSTS_MAX.saturating_sub(connected.len().min(CONNECT_HOSTS_MAX));
+        for p in targets.into_iter().take(room.max(4)) {
+            if let Ok(pid) = p.parse::<c0mpute_net::PeerId>() {
+                let _ = self.0.net.connect(pid).await;
+            }
+        }
+    }
+
     async fn announce_records(&self) {
         let mut recs: Vec<SiteRecord> = self.0.catalog.read().await.sites.values().cloned().collect();
         // Also keep short sites alive: a record we know but do not hold, with
@@ -590,6 +798,7 @@ impl Hosting {
                     return;
                 }
                 h.announce_holding().await;
+                h.connect_hosts().await;
                 if last_records.elapsed() >= h.0.timing.records_every {
                     h.announce_records().await;
                     last_records = Instant::now();
@@ -621,25 +830,29 @@ impl Hosting {
         // A full node does not put itself forward for new copies (it would be
         // chosen, fail, and hold the slot from the next ranked node).
         let can_take = self.0.hosts && !self.is_full().await;
-        let actions: Vec<(SiteRecord, Action)> = {
+        let (whole, striped): (Vec<(SiteRecord, Action)>, Vec<SiteRecord>) = {
             let mut map = self.0.map.write().await;
             map.prune(Instant::now(), self.0.timing.holder_ttl);
-            map.records
-                .values()
-                .map(|r| {
-                    let a = replicas::decide(
-                        &map,
-                        &r.site_id,
-                        &self.0.me,
-                        can_take,
-                        TARGET_REPLICAS,
-                        MAX_REPLICAS,
-                    );
-                    (r.clone(), a)
-                })
-                .collect()
+            let mut whole = Vec::new();
+            let mut striped = Vec::new();
+            for r in map.records.values() {
+                if stripe::is_striped(r.size) {
+                    striped.push(r.clone());
+                    continue;
+                }
+                let a = replicas::decide(
+                    &map,
+                    &r.site_id,
+                    &self.0.me,
+                    can_take,
+                    TARGET_REPLICAS,
+                    MAX_REPLICAS,
+                );
+                whole.push((r.clone(), a));
+            }
+            (whole, striped)
         };
-        for (rec, action) in actions {
+        for (rec, action) in whole {
             // A site we hold whose record moved on: fetch the new version.
             let stale = self
                 .0
@@ -660,6 +873,88 @@ impl Hosting {
                 Action::Nothing => {}
             }
         }
+        for rec in striped {
+            self.repair_striped(rec).await;
+        }
+    }
+
+    /// One striped site: work out which groups this node should take or let
+    /// go, then do it.
+    async fn repair_striped(&self, rec: SiteRecord) {
+        let held = self.0.catalog.read().await.sites.get(&rec.site_id).cloned();
+        // Only nodes that host, or already hold groups, need the manifest.
+        if !self.0.hosts && held.is_none() {
+            return;
+        }
+        // Holding the current version whole (a publisher seeding it): nothing
+        // to place. An older whole copy is replaced group by group below.
+        if held.as_ref().is_some_and(|h| h.seq >= rec.seq)
+            && !self
+                .0
+                .catalog
+                .read()
+                .await
+                .stripes
+                .contains_key(&rec.site_id)
+        {
+            return;
+        }
+        if self.0.replicating.read().await.contains(&rec.site_id) {
+            return;
+        }
+        let layout = match self.layout(&rec).await {
+            Ok(l) => l,
+            Err(e) => {
+                debug!(site = %rec.site_id, err = %e, "hosting: striped manifest unavailable");
+                return;
+            }
+        };
+        let plan = {
+            let map = self.0.map.read().await;
+            let holders = map.group_holders(&rec.site_id, layout.len(), true);
+            let now = Instant::now();
+            let mut short = self.0.short_since.lock().expect("short_since");
+            for (g, hs) in holders.iter().enumerate() {
+                let key = (rec.site_id.clone(), g as u32);
+                if hs.len() < TARGET_REPLICAS {
+                    short.entry(key).or_insert(now);
+                } else {
+                    short.remove(&key);
+                }
+            }
+            let widen = |g: u32| -> usize {
+                short
+                    .get(&(rec.site_id.clone(), g))
+                    .map(|t| (now.duration_since(*t).as_secs() / WIDEN_AFTER.as_secs()) as usize)
+                    .unwrap_or(0)
+            };
+            stripe::plan(
+                &map,
+                &rec.site_id,
+                &layout,
+                &self.0.me,
+                self.0.hosts,
+                TARGET_REPLICAS,
+                MAX_REPLICAS,
+                &widen,
+            )
+        };
+        let stale = held.as_ref().is_some_and(|h| h.seq < rec.seq);
+        if !plan.drop.is_empty() && !stale {
+            self.drop_groups(&rec.site_id, &plan.drop).await;
+        }
+        let mine: BTreeSet<u32> = self
+            .0
+            .catalog
+            .read()
+            .await
+            .stripes
+            .get(&rec.site_id)
+            .cloned()
+            .unwrap_or_default();
+        if stale || plan.fetch.iter().any(|g| !mine.contains(g)) {
+            self.spawn_replicate_groups(rec, plan.fetch);
+        }
     }
 
     fn spawn_replicate(&self, rec: SiteRecord) {
@@ -683,81 +978,132 @@ impl Hosting {
         });
     }
 
-    /// True when this node cannot take another copy: its disk is at the free
-    /// floor (with a little headroom) or its hosting budget is used up.
+    /// True when this node cannot take another copy: what it may still take
+    /// (budget and free-disk floor, see [`Self::room`]) is under a little
+    /// headroom.
     pub async fn is_full(&self) -> bool {
-        let (disk_free, disk_total) = crate::opendisk::disk_for(self.0.store.root());
-        !leaves_free_floor(disk_free, disk_total, FULL_HEADROOM_BYTES)
-            || self.held_bytes().await.saturating_add(FULL_HEADROOM_BYTES) > self.0.max_bytes
+        self.room().await < FULL_HEADROOM_BYTES
     }
 
-    /// Free disk above the floor in whole GiB, or None when the disk is unknown.
-    fn room_gib(&self) -> Option<u64> {
-        let (disk_free, disk_total) = crate::opendisk::disk_for(self.0.store.root());
-        if disk_total == 0 {
-            return None;
-        }
-        Some(disk_free.saturating_sub(free_disk_floor(disk_total)) / GIB_BYTES)
+    fn spawn_replicate_groups(&self, rec: SiteRecord, groups: Vec<u32>) {
+        let h = self.clone();
+        tokio::spawn(async move {
+            {
+                let mut busy = h.0.replicating.write().await;
+                if !busy.insert(rec.site_id.clone()) {
+                    return;
+                }
+            }
+            let id = rec.site_id.clone();
+            match h.replicate_groups(&rec, &groups).await {
+                Ok(n) if n > 0 => {
+                    info!(site = %id, name = %rec.name, groups = n, "hosting: holding groups of a striped site");
+                }
+                Ok(_) => {}
+                Err(e) => warn!(site = %id, err = %e, "hosting: replicate failed"),
+            }
+            h.announce_holding().await;
+            h.0.replicating.write().await.remove(&id);
+        });
     }
 
-    async fn held_bytes(&self) -> u64 {
-        self.0.catalog.read().await.sites.values().map(|r| r.size).sum()
+    /// The per-owner limit applies to free copies only: a preferred host was
+    /// picked (and is paid) for the site.
+    async fn owner_bytes_excluding(&self, rec: &SiteRecord) -> u64 {
+        let recs: Vec<SiteRecord> = self
+            .0
+            .catalog
+            .read()
+            .await
+            .sites
+            .values()
+            .filter(|r| r.owner == rec.owner && r.site_id != rec.site_id && !r.prefers(&self.0.me))
+            .cloned()
+            .collect();
+        let stripes = self.0.catalog.read().await.stripes.clone();
+        let mut total = 0;
+        for r in recs {
+            total += match stripes.get(&r.site_id) {
+                Some(gs) => self.layout(&r).await.map(|l| l.bytes_of(gs)).unwrap_or(0),
+                None => r.size,
+            };
+        }
+        total
     }
 
-    /// Fetch every chunk of `rec` and start holding it.
-    pub async fn replicate(&self, rec: &SiteRecord) -> Result<()> {
-        let previous = self.0.catalog.read().await.sites.get(&rec.site_id).cloned();
-        let already = previous.as_ref().map(|p| p.size).unwrap_or(0);
-        if self.held_bytes().await - already + rec.size > self.0.max_bytes {
-            bail!("over this node's hosting budget");
+    /// Whether this node may take `extra` more bytes of `rec`: budget, the
+    /// free-disk floor, and (free copies only) the per-owner limit. The error
+    /// says which limit.
+    async fn check_room(&self, rec: &SiteRecord, extra: u64, this_site_held: u64) -> Result<()> {
+        let held = self.held_bytes().await;
+        let budget = self.budget_with(held);
+        if held + extra > budget {
+            bail!(
+                "over this node's hosting budget ({} GiB held of {} GiB; set [hosting] max_bytes to change it)",
+                held / GIB_BYTES,
+                budget / GIB_BYTES
+            );
         }
-        let (disk_free, disk_total) = crate::opendisk::disk_for(self.0.store.root());
-        if !leaves_free_floor(disk_free, disk_total, rec.size.saturating_sub(already)) {
+        let (disk_free, disk_total) = self.disk();
+        if !leaves_free_floor(disk_free, disk_total, extra) {
             bail!(
                 "disk nearly full: {} GiB free, a copy must leave at least {} GiB",
                 disk_free / GIB_BYTES,
                 free_disk_floor(disk_total) / GIB_BYTES
             );
         }
-        let owner_bytes: u64 = self
-            .0
-            .catalog
-            .read()
-            .await
-            .sites
-            .values()
-            .filter(|r| r.owner == rec.owner && r.site_id != rec.site_id)
-            .map(|r| r.size)
-            .sum();
-        if owner_bytes + rec.size > MAX_BYTES_PER_OWNER {
-            bail!("over this node's per-owner hosting budget");
+        if !rec.prefers(&self.0.me) {
+            let owner = self.owner_bytes_excluding(rec).await;
+            if owner + this_site_held + extra > MAX_BYTES_PER_OWNER {
+                bail!(
+                    "over this node's per-owner limit for free hosting ({} GiB)",
+                    MAX_BYTES_PER_OWNER / GIB_BYTES
+                );
+            }
         }
+        Ok(())
+    }
+
+    /// Fetch every chunk of `rec` and start holding it.
+    pub async fn replicate(&self, rec: &SiteRecord) -> Result<()> {
+        let previous = self.0.catalog.read().await.sites.get(&rec.site_id).cloned();
+        let already = previous.as_ref().map(|p| p.size).unwrap_or(0);
+        self.check_room(rec, rec.size.saturating_sub(already), 0)
+            .await?;
         let manifest = self.manifest(rec).await?;
         if manifest.total_bytes() != rec.size || manifest.name() != rec.name {
             bail!("manifest does not match its record");
         }
         let holders = self.0.map.read().await.sources(&rec.site_id);
-        // Files part by part (a large site's chunk list never sits in memory
-        // whole); the root goes in last, marking the copy complete.
-        let mut todo: Vec<String> = Vec::new();
+        // Part by part for a parted manifest (its chunk list never sits in
+        // memory whole), many chunks in flight; the root goes in last,
+        // marking the copy complete.
         match &*manifest {
-            Manifest::Inline(m) => todo.extend(m.chunk_hashes()),
+            Manifest::Inline(m) => {
+                let wanted: Vec<(Hash, Vec<String>)> = m
+                    .chunk_hashes()
+                    .iter()
+                    .filter_map(|h| Hash::from_hex(h).ok())
+                    .map(|h| (h, holders.clone()))
+                    .collect();
+                self.fetch_into_store(wanted, fetch::BULK_WINDOW).await?;
+            }
             Manifest::Parted(r) => {
                 for pr in &r.parts {
                     let part = self.part(&rec.site_id, pr).await?;
-                    let hashes: Vec<String> = part.chunk_hashes().cloned().collect();
-                    self.store_chunks(&hashes, &holders).await?;
-                    self.0.store.put(&serde_json::to_vec(&*part)?).await?;
+                    let mut hs: Vec<Hash> = part.chunk_hashes().filter_map(|h| Hash::from_hex(h).ok()).collect();
+                    hs.sort_by(|a, b| a.0.cmp(&b.0));
+                    hs.dedup();
+                    let wanted = hs.into_iter().map(|h| (h, holders.clone())).collect();
+                    self.fetch_into_store(wanted, fetch::BULK_WINDOW).await?;
                 }
             }
         }
-        self.store_chunks(&todo, &holders).await?;
-        let mh = Hash::from_hex(&rec.manifest).context("manifest hash")?;
-        let mbytes = self.fetch_chunk(&mh, &holders).await?;
-        self.0.store.put(&mbytes).await?;
+        self.store_manifest(rec, &manifest).await?;
         {
             let mut cat = self.0.catalog.write().await;
             cat.sites.insert(rec.site_id.clone(), rec.clone());
+            cat.stripes.remove(&rec.site_id);
         }
         self.save_catalog().await;
         if let Some(old) = previous
@@ -773,10 +1119,260 @@ impl Hosting {
         Ok(())
     }
 
+    /// Store a manifest's parts and root locally (every holder keeps them,
+    /// so any holder can answer for the manifest). The root goes in last.
+    async fn store_manifest(&self, rec: &SiteRecord, manifest: &Manifest) -> Result<()> {
+        if let Manifest::Parted(r) = manifest {
+            for pr in &r.parts {
+                let part = self.part(&rec.site_id, pr).await?;
+                self.0.store.put(&serde_json::to_vec(&*part)?).await?;
+            }
+        }
+        let mh = Hash::from_hex(&rec.manifest).context("manifest hash")?;
+        if !self.0.store.has(&mh).await {
+            let holders = self.0.map.read().await.sources(&rec.site_id);
+            let bytes = self.fetch_chunk(&mh, &holders).await?;
+            self.0.store.put(&bytes).await?;
+        }
+        Ok(())
+    }
+
+    /// Fetch chunks that are not local yet, `window` at a time, from their
+    /// sources, into the store. Chunks that fail are retried once (sources
+    /// may have changed); the error names how many are still missing.
+    async fn fetch_into_store(
+        &self,
+        wanted: Vec<(Hash, Vec<String>)>,
+        window: usize,
+    ) -> Result<u64> {
+        use futures::StreamExt;
+        let mut todo = Vec::new();
+        for (h, src) in wanted {
+            if !self.0.store.has(&h).await {
+                todo.push((h, src));
+            }
+        }
+        let mut fetched = 0u64;
+        for attempt in 0..2 {
+            if todo.is_empty() {
+                break;
+            }
+            let results: Vec<(Hash, Vec<String>, Result<usize>)> =
+                futures::stream::iter(todo.into_iter())
+                    .map(|(h, src)| async move {
+                        let r = match self.fetch_chunk(&h, &src).await {
+                            Ok(bytes) => self.0.store.put(&bytes).await.map(|_| bytes.len()),
+                            Err(e) => Err(e),
+                        };
+                        (h, src, r)
+                    })
+                    .buffer_unordered(window.max(1))
+                    .collect()
+                    .await;
+            todo = Vec::new();
+            let mut last_err = None;
+            for (h, src, r) in results {
+                match r {
+                    Ok(n) => fetched += n as u64,
+                    Err(e) => {
+                        last_err = Some(e);
+                        todo.push((h, src));
+                    }
+                }
+            }
+            if attempt == 1
+                && let Some(e) = last_err
+            {
+                bail!("{} chunks still missing: {e}", todo.len());
+            }
+        }
+        Ok(fetched)
+    }
+
+    /// Fetch the given groups of a striped site (those not held yet) and
+    /// hold them. A newer version of a site held in part is fetched in full
+    /// (chunks it shares with the old version are not fetched again) before
+    /// it replaces the old one. Returns how many groups were added.
+    pub async fn replicate_groups(&self, rec: &SiteRecord, groups: &[u32]) -> Result<usize> {
+        let manifest = self.manifest(rec).await?;
+        if manifest.total_bytes() != rec.size || manifest.name() != rec.name {
+            bail!("manifest does not match its record");
+        }
+        let layout = self.layout(rec).await?;
+        let previous = self.0.catalog.read().await.sites.get(&rec.site_id).cloned();
+        let same_version = previous
+            .as_ref()
+            .is_some_and(|p| p.manifest == rec.manifest);
+        let mine: BTreeSet<u32> = if same_version {
+            self.0
+                .catalog
+                .read()
+                .await
+                .stripes
+                .get(&rec.site_id)
+                .cloned()
+                .unwrap_or_default()
+        } else {
+            BTreeSet::new()
+        };
+        if same_version && previous.as_ref().is_some_and(|p| p.seq < rec.seq) {
+            // Same content, newer record (a re-publish): nothing to fetch.
+            self.0
+                .catalog
+                .write()
+                .await
+                .sites
+                .insert(rec.site_id.clone(), rec.clone());
+            self.save_catalog().await;
+        }
+        let todo: Vec<u32> = groups
+            .iter()
+            .copied()
+            .filter(|g| !mine.contains(g) && (*g as usize) < layout.len())
+            .collect();
+        if todo.is_empty() {
+            if !same_version && previous.is_some() {
+                // The new version needs nothing from us: let the old one go.
+                self.drop_site(&rec.site_id).await?;
+            }
+            return Ok(0);
+        }
+        self.store_manifest(rec, &manifest).await?;
+        let this_site = std::sync::atomic::AtomicU64::new(layout.bytes_of(&mine));
+        let mut added: BTreeSet<u32> = BTreeSet::new();
+        let mut last_announce = Instant::now();
+        let mut first_err: Option<anyhow::Error> = None;
+        let full = std::sync::atomic::AtomicBool::new(false);
+        {
+            use futures::StreamExt;
+            // Two groups at a time keeps the pipe full between groups.
+            let layout2 = layout.clone();
+            let mut results = futures::stream::iter(todo)
+                .map(|g| {
+                    let layout = layout2.clone();
+                    let this_site = &this_site;
+                    let full = &full;
+                    async move {
+                        if full.load(Ordering::Relaxed) || self.is_stopped() {
+                            return (g, Err(anyhow::anyhow!("stopped")));
+                        }
+                        let need = layout.bytes(g);
+                        if let Err(e) = self
+                            .check_room(rec, need, this_site.load(Ordering::Relaxed))
+                            .await
+                        {
+                            full.store(true, Ordering::Relaxed);
+                            return (g, Err(e));
+                        }
+                        this_site.fetch_add(need, Ordering::Relaxed);
+                        let sources = self.0.map.read().await.group_sources(&rec.site_id, g);
+                        let wanted: Vec<(Hash, Vec<String>)> = layout
+                            .group(g)
+                            .iter()
+                            .map(|h| (*h, sources.clone()))
+                            .collect();
+                        let r = self.fetch_into_store(wanted, fetch::BULK_WINDOW).await;
+                        if r.is_err() {
+                            this_site.fetch_sub(need, Ordering::Relaxed);
+                        }
+                        (
+                            g,
+                            r.map(|_| ()).map_err(|e| e.context(format!("group {g}"))),
+                        )
+                    }
+                })
+                .buffer_unordered(2);
+            while let Some((g, r)) = results.next().await {
+                if let Err(e) = r {
+                    if !e.to_string().contains("stopped") {
+                        first_err.get_or_insert(e);
+                    }
+                    continue;
+                }
+                added.insert(g);
+                if same_version {
+                    // Hold each group as soon as it is complete, so the copy
+                    // counts (and a restart resumes) group by group.
+                    {
+                        let mut cat = self.0.catalog.write().await;
+                        cat.sites.insert(rec.site_id.clone(), rec.clone());
+                        cat.stripes
+                            .entry(rec.site_id.clone())
+                            .or_default()
+                            .insert(g);
+                    }
+                    self.save_catalog().await;
+                    if last_announce.elapsed() > Duration::from_secs(20) {
+                        self.announce_holding().await;
+                        last_announce = Instant::now();
+                    }
+                }
+            }
+        }
+        if !same_version && !added.is_empty() {
+            {
+                let mut cat = self.0.catalog.write().await;
+                cat.sites.insert(rec.site_id.clone(), rec.clone());
+                cat.stripes.insert(rec.site_id.clone(), added.clone());
+            }
+            self.save_catalog().await;
+            if let Some(old) = &previous {
+                self.collect_garbage(old, None).await;
+            }
+        }
+        if previous.is_none() || !same_version {
+            let _ = self
+                .0
+                .net
+                .announce(&Hash::from_hex(&rec.manifest).context("manifest hash")?)
+                .await;
+        }
+        match first_err {
+            Some(e) if added.is_empty() => Err(e),
+            Some(e) => {
+                warn!(site = %rec.site_id, err = %e, "hosting: some groups not taken");
+                Ok(added.len())
+            }
+            None => Ok(added.len()),
+        }
+    }
+
+    /// Let go of some groups of a striped site: announce first, delete their
+    /// chunks once peers have seen it (as [`Self::drop_site`] does).
+    async fn drop_groups(&self, site_id: &str, groups: &[u32]) {
+        let rec = {
+            let mut cat = self.0.catalog.write().await;
+            let Some(rec) = cat.sites.get(site_id).cloned() else {
+                return;
+            };
+            let Some(mine) = cat.stripes.get_mut(site_id) else {
+                return;
+            };
+            for g in groups {
+                mine.remove(g);
+            }
+            if mine.is_empty() {
+                cat.stripes.remove(site_id);
+                cat.sites.remove(site_id);
+            }
+            rec
+        };
+        self.save_catalog().await;
+        self.announce_holding().await;
+        info!(site = %site_id, groups = groups.len(), "hosting: released surplus groups");
+        let h = self.clone();
+        let grace = self.0.timing.holder_ttl;
+        tokio::spawn(async move {
+            tokio::time::sleep(grace).await;
+            h.collect_garbage(&rec, None).await;
+        });
+    }
+
     async fn drop_site(&self, site_id: &str) -> Result<()> {
         let Some(rec) = self.0.catalog.write().await.sites.remove(site_id) else {
             return Ok(());
         };
+        self.0.catalog.write().await.stripes.remove(site_id);
         self.save_catalog().await;
         // Tell the network first, and keep the chunks (still served to
         // fetches and challenges) until peers have certainly seen that we no
@@ -797,6 +1393,28 @@ impl Hosting {
         Ok(())
     }
 
+    /// The chunks (data and manifest) a held site needs kept.
+    async fn live_chunks_of(&self, rec: &SiteRecord, groups: Option<&BTreeSet<u32>>, live: &mut HashSet<String>) {
+        live.insert(rec.manifest.clone());
+        let Ok(m) = self.manifest(rec).await else {
+            return;
+        };
+        match groups {
+            Some(gs) => {
+                if let Manifest::Parted(r) = &*m {
+                    live.extend(r.parts.iter().map(|p| p.hash.clone()));
+                }
+                if let Ok(layout) = self.layout(rec).await {
+                    for g in gs {
+                        live.extend(layout.group(*g).iter().map(|h| h.to_hex()));
+                    }
+                }
+            }
+            // Whole: every chunk, parts included.
+            None => live.extend(self.chunk_set(&rec.site_id, &m).await),
+        }
+    }
+
     /// Delete chunks of `old` that no held site (and not `keep`) still uses.
     async fn collect_garbage(&self, old: &SiteRecord, keep: Option<&Manifest>) {
         let Ok(old_manifest) = self.manifest(old).await else {
@@ -806,12 +1424,12 @@ impl Hosting {
         if let Some(k) = keep {
             live.extend(self.chunk_set(&old.site_id, k).await);
         }
-        let held: Vec<SiteRecord> = self.0.catalog.read().await.sites.values().cloned().collect();
+        let (held, stripes): (Vec<SiteRecord>, HashMap<String, BTreeSet<u32>>) = {
+            let cat = self.0.catalog.read().await;
+            (cat.sites.values().cloned().collect(), cat.stripes.clone())
+        };
         for r in held {
-            live.insert(r.manifest.clone());
-            if let Ok(m) = self.manifest(&r).await {
-                live.extend(self.chunk_set(&r.site_id, &m).await);
-            }
+            self.live_chunks_of(&r, stripes.get(&r.site_id), &mut live).await;
         }
         let doomed = self.chunk_set(&old.site_id, &old_manifest).await;
         for h in doomed.into_iter().chain([old.manifest.clone()]) {
@@ -838,39 +1456,57 @@ impl Hosting {
     }
 
     async fn has_complete_copy(&self, rec: &SiteRecord) -> bool {
-        let Ok(mh) = Hash::from_hex(&rec.manifest) else {
-            return false;
-        };
-        let Ok(bytes) = self.0.store.get(&mh).await else {
+        let Ok(files) = self.local_files(rec).await else {
             return false;
         };
-        let Ok(m) = Manifest::from_bytes(&bytes) else {
-            return false;
+        for f in &files {
+            for h in &f.chunks {
+                match Hash::from_hex(h) {
+                    Ok(hash) if self.0.store.has(&hash).await => {}
+                    _ => return false,
+                }
+            }
+        }
+        true
+    }
+
+    /// The groups of `groups` whose chunks are all still here.
+    async fn complete_groups(&self, rec: &SiteRecord, groups: &BTreeSet<u32>) -> BTreeSet<u32> {
+        let Ok(files) = self.local_files(rec).await else {
+            return BTreeSet::new();
         };
-        let mut hashes: Vec<String> = Vec::new();
-        match &m {
-            Manifest::Inline(m) => hashes.extend(m.chunk_hashes()),
-            Manifest::Parted(r) => {
-                for pr in &r.parts {
-                    let Ok(ph) = Hash::from_hex(&pr.hash) else { return false };
-                    let Ok(pb) = self.0.store.get(&ph).await else { return false };
-                    let Ok(part) = ManifestPart::from_bytes(&pb, pr) else { return false };
-                    for h in part.chunk_hashes() {
-                        match Hash::from_hex(h) {
-                            Ok(hash) if self.0.store.has(&hash).await => {}
-                            _ => return false,
-                        }
-                    }
+        let layout = stripe::Layout::new(stripe::group_count(rec.size), files.iter());
+        let mut out = BTreeSet::new();
+        'g: for g in groups {
+            if *g as usize >= layout.len() {
+                continue;
+            }
+            for h in layout.group(*g) {
+                if !self.0.store.has(h).await {
+                    continue 'g;
                 }
             }
+            out.insert(*g);
         }
-        for h in hashes {
-            match Hash::from_hex(&h) {
-                Ok(hash) if self.0.store.has(&hash).await => {}
-                _ => return false,
+        out
+    }
+
+    /// Every file entry of a site, from local chunks only (root and parts).
+    async fn local_files(&self, rec: &SiteRecord) -> Result<Vec<site::FileEntry>> {
+        let mh = Hash::from_hex(&rec.manifest).context("manifest hash")?;
+        let bytes = self.0.store.get(&mh).await?;
+        match Manifest::from_bytes(&bytes)? {
+            Manifest::Inline(m) => Ok(m.files.into_values().collect()),
+            Manifest::Parted(r) => {
+                let mut out = Vec::new();
+                for pr in &r.parts {
+                    let ph = Hash::from_hex(&pr.hash).context("part hash")?;
+                    let pb = self.0.store.get(&ph).await?;
+                    out.extend(ManifestPart::from_bytes(&pb, pr)?.files.into_values());
+                }
+                Ok(out)
             }
         }
-        true
     }
 
     // ── publishing ───────────────────────────────────────────────────────
@@ -905,6 +1541,43 @@ impl Hosting {
         Ok(())
     }
 
+    /// Hand a site scanned in place to the network: its chunks are served
+    /// straight from the source files ([`seed`]), only the manifest is stored.
+    /// Publishing the same version again (to resume) is accepted.
+    pub async fn publish_scanned(&self, scanned: &site::ScannedSite, record: SiteRecord) -> Result<()> {
+        seed::register(&scanned.locations);
+        let stored = scanned.manifest.stored();
+        for p in &stored.parts {
+            self.0.store.put(p).await?;
+        }
+        let mh = self.0.store.put(&stored.root).await?;
+        if mh.to_hex() != record.manifest {
+            bail!("record does not point at this manifest");
+        }
+        let applied = self.0.map.write().await.apply_record(record.clone());
+        if !applied && self.record_for(&record.site_id).await.as_ref() != Some(&record) {
+            bail!("record rejected (bad signature, or a newer version exists)");
+        }
+        self.0
+            .catalog
+            .write()
+            .await
+            .sites
+            .insert(record.site_id.clone(), record.clone());
+        self.save_catalog().await;
+        self.publish(&HostingMsg::Record { record }).await;
+        self.announce_holding().await;
+        let _ = self.0.net.announce(&mh).await;
+        Ok(())
+    }
+
+    /// Per-group holders of a striped site, from this node's map.
+    pub async fn group_holders(&self, rec: &SiteRecord) -> Result<(Arc<stripe::Layout>, Vec<Vec<String>>)> {
+        let layout = self.layout(rec).await?;
+        let holders = self.0.map.read().await.group_holders(&rec.site_id, layout.len(), true);
+        Ok((layout, holders))
+    }
+
     /// Re-gossip a record (publishers repeat it while the mesh forms).
     pub async fn regossip(&self, record: &SiteRecord) {
         self.publish(&HostingMsg::Record {
@@ -971,6 +1644,18 @@ impl Hosting {
         }
     }
 
+    /// Per-group copy health of a striped site (`None` for a whole site).
+    pub async fn health(&self, rec: &SiteRecord) -> Option<stripe::Health> {
+        if !stripe::is_striped(rec.size) {
+            return None;
+        }
+        let map = self.0.map.read().await;
+        Some(stripe::health(
+            &map.group_holders(&rec.site_id, stripe::group_count(rec.size), true),
+            TARGET_REPLICAS,
+        ))
+    }
+
     /// Every known site: record plus live copy count.
     pub async fn sites(&self) -> Vec<(SiteRecord, usize)> {
         let map = self.0.map.read().await;
@@ -1065,7 +1750,24 @@ impl Hosting {
     ) -> Result<Receipt> {
         let manifest = self.manifest(rec).await?;
         let nonce: [u8; 32] = rand::random();
+        let striped_pick = if stripe::is_striped(rec.size) {
+            // Only a chunk of a group the holder says it holds.
+            let layout = self.layout(rec).await?;
+            let groups: Vec<u32> = {
+                let map = self.0.map.read().await;
+                map.group_holders(&rec.site_id, layout.len(), true)
+                    .iter()
+                    .enumerate()
+                    .filter(|(_, hs)| hs.iter().any(|p| p == holder))
+                    .map(|(g, _)| g as u32)
+                    .collect()
+            };
+            Some(proof::pick_chunk_of(&layout, &groups, &nonce).context("holder holds no groups")?)
+        } else {
+            None
+        };
         let chunk = match &*manifest {
+            _ if striped_pick.is_some() => striped_pick,
             Manifest::Inline(m) => proof::pick_chunk(m, &nonce),
             Manifest::Parted(r) => {
                 // A random part, then a random chunk of it (or the part itself).
@@ -1196,54 +1898,76 @@ impl Hosting {
 
     // ── fetching ─────────────────────────────────────────────────────────
 
+    /// One chunk: local (store, or a file this process is publishing), else
+    /// from the best of `holders` (see [`fetch`]).
     async fn fetch_chunk(&self, hash: &Hash, holders: &[String]) -> Result<Vec<u8>> {
-        let _slot = self.0.fetch_slots.acquire().await?;
         if self.0.store.has(hash).await {
             return self.0.store.get(hash).await;
         }
-        let order = {
-            let turn = self.0.turn.fetch_add(1, Ordering::Relaxed);
-            self.0.map.read().await.proxy_order(holders, turn)
-        };
-        let req = ChunkRequest {
-            chunk_hash: *hash,
-            shard_index: None,
-        };
-        let mut last = String::from("no holders");
-        for peer in order.iter().filter(|p| **p != self.0.me) {
-            let Ok(pid) = peer.parse::<c0mpute_net::PeerId>() else {
-                continue;
-            };
-            let started = Instant::now();
-            match tokio::time::timeout(self.0.timing.fetch_timeout, self.0.net.fetch_from_peer(pid, &req)).await {
-                Ok(Ok(bytes)) if Hash::of(&bytes) == *hash => {
-                    let ms = started.elapsed().as_secs_f64() * 1000.0;
-                    self.0.map.write().await.observe_rtt(peer, ms);
-                    return Ok(bytes);
+        if let Some(bytes) = seed::read_async(hash).await {
+            return Ok(bytes);
+        }
+        let _slot = self.0.fetch_slots.acquire().await?;
+        let turn = self.0.turn.fetch_add(1, Ordering::Relaxed);
+        fetch::fetch_one(
+            &self.0.net,
+            &self.0.stats,
+            &self.0.me,
+            hash,
+            holders,
+            self.0.timing.fetch_timeout,
+            turn,
+        )
+        .await
+    }
+
+    /// Bytes received from each peer by this node's fetches so far.
+    pub fn fetched_by_peer(&self) -> Vec<(String, u64)> {
+        self.0.stats.bytes_by_peer()
+    }
+
+    /// Every file entry of a site (all parts of a parted manifest).
+    async fn files_of(&self, rec: &SiteRecord, m: &Manifest) -> Result<Vec<site::FileEntry>> {
+        match m {
+            Manifest::Inline(m) => Ok(m.files.values().cloned().collect()),
+            Manifest::Parted(r) => {
+                let mut out = Vec::new();
+                for pr in &r.parts {
+                    out.extend(self.part(&rec.site_id, pr).await?.files.values().cloned());
                 }
-                Ok(Ok(_)) => last = format!("{peer} sent bytes that do not match the hash"),
-                Ok(Err(e)) => last = format!("{peer}: {e}"),
-                Err(_) => last = format!("{peer}: timed out"),
+                Ok(out)
             }
-            // A failed holder sorts last until it proves itself again.
-            self.0.map.write().await.observe_rtt(peer, 5_000.0);
         }
-        // Last resort: the DHT (any peer that announced the chunk).
-        match tokio::time::timeout(self.0.timing.fetch_timeout, self.0.net.fetch(&req)).await {
-            Ok(Ok(bytes)) if Hash::of(&bytes) == *hash => Ok(bytes),
-            _ => bail!("could not fetch chunk {}: {last}", hash.to_hex()),
+    }
+
+    /// The group layout of a striped site's current manifest.
+    async fn layout(&self, rec: &SiteRecord) -> Result<Arc<stripe::Layout>> {
+        if let Some(l) = self.0.layouts.read().await.get(&rec.manifest) {
+            return Ok(l.clone());
+        }
+        let m = self.manifest(rec).await?;
+        let files = self.files_of(rec, &m).await?;
+        let l = Arc::new(stripe::Layout::new(stripe::group_count(rec.size), files.iter()));
+        let mut cache = self.0.layouts.write().await;
+        if cache.len() > 64 {
+            cache.clear();
         }
+        cache.insert(rec.manifest.clone(), l.clone());
+        Ok(l)
     }
 
-    async fn store_chunks(&self, hashes: &[String], holders: &[String]) -> Result<()> {
-        for h in hashes {
-            let hash = Hash::from_hex(h).context("bad chunk hash")?;
-            if !self.0.store.has(&hash).await {
-                let bytes = self.fetch_chunk(&hash, holders).await?;
-                self.0.store.put(&bytes).await?;
-            }
+    /// Where to fetch the chunks of `rec` from: per chunk for a striped site
+    /// (the holders of its group, found from its hash), else every source.
+    async fn chunk_sources(&self, rec: &SiteRecord) -> ChunkSources {
+        let map = self.0.map.read().await;
+        if !stripe::is_striped(rec.size) {
+            return ChunkSources::Whole(map.sources(&rec.site_id));
+        }
+        let n = stripe::group_count(rec.size);
+        ChunkSources::Striped {
+            n,
+            per_group: map.group_holders(&rec.site_id, n, false),
         }
-        Ok(())
     }
 
     /// One part of a large site's manifest (local, cached, or fetched).
@@ -1374,17 +2098,36 @@ impl Hosting {
     }
 
     async fn read_entry(&self, rec: &SiteRecord, entry: &site::FileEntry) -> Result<Vec<u8>> {
-        let holders = self.0.map.read().await.sources(&rec.site_id);
-        let mut body = Vec::with_capacity(entry.size as usize);
-        for h in &entry.chunks {
-            let hash = Hash::from_hex(h).context("bad chunk hash")?;
-            body.extend_from_slice(&self.fetch_chunk(&hash, &holders).await?);
-        }
-        Ok(body)
+        let sources = self.chunk_sources(rec).await;
+        let wanted: Vec<(u64, Hash)> = entry
+            .chunks
+            .iter()
+            .enumerate()
+            .map(|(i, h)| {
+                Hash::from_hex(h)
+                    .map(|h| (i as u64, h))
+                    .context("bad chunk hash")
+            })
+            .collect::<Result<_>>()?;
+        self.read_range(rec, &sources, &wanted, 0, entry.size.saturating_sub(1))
+            .await
     }
 
     /// Serve `path` of a site: from local chunks, else proxied from holders.
     pub async fn serve(&self, rec: &SiteRecord, path: &str) -> Response {
+        self.serve_request(rec, path, &HeaderMap::new()).await
+    }
+
+    /// Serve `path` of a site for a request with these headers: Range
+    /// requests (206 with only the chunks the range needs), conditional
+    /// requests (304), and large files streamed with read-ahead so video
+    /// seeks and plays without loading the whole file first.
+    pub async fn serve_request(
+        &self,
+        rec: &SiteRecord,
+        path: &str,
+        headers: &HeaderMap,
+    ) -> Response {
         let manifest = match self.manifest(rec).await {
             Ok(m) => m,
             Err(e) => {
@@ -1410,28 +2153,208 @@ impl Hosting {
         let Some((entry, status)) = found else {
             return (StatusCode::NOT_FOUND, "not found").into_response();
         };
-        let body = match self.read_entry(rec, &entry).await {
-            Ok(b) => b,
-            Err(e) => {
-                warn!(site = %rec.site_id, err = %e, "hosting: chunk unavailable");
-                return (StatusCode::BAD_GATEWAY, "site is unavailable right now").into_response();
+        let etag = format!(
+            "\"{}\"",
+            &Hash::of(entry.chunks.join(",").as_bytes()).to_hex()[..32]
+        );
+        let html = entry.content_type.starts_with("text/html");
+        let cache = if html || status != StatusCode::OK {
+            "public, max-age=60"
+        } else {
+            // Media and assets: a new version of the site changes the ETag.
+            "public, max-age=3600"
+        };
+        let base_headers = |resp: &mut Response| {
+            let hdr = resp.headers_mut();
+            if let Ok(v) = HeaderValue::from_str(&entry.content_type) {
+                hdr.insert(header::CONTENT_TYPE, v);
+            }
+            if let Ok(v) = HeaderValue::from_str(&etag) {
+                hdr.insert(header::ETAG, v);
+            }
+            hdr.insert(header::CACHE_CONTROL, HeaderValue::from_static(cache));
+            hdr.insert(header::ACCEPT_RANGES, HeaderValue::from_static("bytes"));
+            hdr.insert(
+                "x-content-type-options",
+                HeaderValue::from_static("nosniff"),
+            );
+            hdr.insert(
+                "x-c0mpute-site",
+                HeaderValue::from_str(&rec.site_id).unwrap_or(HeaderValue::from_static("")),
+            );
+        };
+        if status == StatusCode::OK
+            && headers
+                .get(header::IF_NONE_MATCH)
+                .and_then(|v| v.to_str().ok())
+                .is_some_and(|v| v.split(',').any(|t| t.trim() == etag || t.trim() == "*"))
+        {
+            let mut resp = StatusCode::NOT_MODIFIED.into_response();
+            base_headers(&mut resp);
+            resp.headers_mut().remove(header::CONTENT_TYPE);
+            return resp;
+        }
+        // A Range applies only to the real file, and only when If-Range (if
+        // any) still names this version.
+        let range = if status == StatusCode::OK {
+            let if_range_ok = headers
+                .get(header::IF_RANGE)
+                .and_then(|v| v.to_str().ok())
+                .is_none_or(|v| v.trim() == etag);
+            headers
+                .get(header::RANGE)
+                .and_then(|v| v.to_str().ok())
+                .filter(|_| if_range_ok)
+                .map(|v| parse_range(v, entry.size))
+        } else {
+            None
+        };
+        let (start, end_incl, status) = match range {
+            None | Some(RangeSpec::Ignore) => (0, entry.size.saturating_sub(1), status),
+            Some(RangeSpec::Unsatisfiable) => {
+                let mut resp = StatusCode::RANGE_NOT_SATISFIABLE.into_response();
+                base_headers(&mut resp);
+                resp.headers_mut().remove(header::CONTENT_TYPE);
+                if let Ok(v) = HeaderValue::from_str(&format!("bytes */{}", entry.size)) {
+                    resp.headers_mut().insert(header::CONTENT_RANGE, v);
+                }
+                return resp;
             }
+            Some(RangeSpec::Bytes(a, b)) => (a, b, StatusCode::PARTIAL_CONTENT),
         };
-        let etag = format!("\"{}\"", &Hash::of(entry.chunks.join(",").as_bytes()).to_hex()[..32]);
-        let mut resp = (status, Body::from(body)).into_response();
-        let hdr = resp.headers_mut();
-        if let Ok(v) = HeaderValue::from_str(&entry.content_type) {
-            hdr.insert(header::CONTENT_TYPE, v);
-        }
-        if let Ok(v) = HeaderValue::from_str(&etag) {
-            hdr.insert(header::ETAG, v);
-        }
-        hdr.insert(header::CACHE_CONTROL, HeaderValue::from_static("public, max-age=60"));
-        hdr.insert("x-content-type-options", HeaderValue::from_static("nosniff"));
-        hdr.insert("x-c0mpute-site", HeaderValue::from_str(&rec.site_id).unwrap_or(HeaderValue::from_static("")));
+        let len = if entry.size == 0 {
+            0
+        } else {
+            end_incl - start + 1
+        };
+        let sources = Arc::new(self.chunk_sources(rec).await);
+        let cb = site::FILE_CHUNK_BYTES as u64;
+        let (first, last) = if len == 0 {
+            (0, 0)
+        } else {
+            (start / cb, end_incl / cb)
+        };
+        let wanted: Vec<(u64, Hash)> = entry
+            .chunks
+            .iter()
+            .enumerate()
+            .skip(first as usize)
+            .take((last - first + 1) as usize)
+            .filter_map(|(i, h)| Hash::from_hex(h).ok().map(|h| (i as u64, h)))
+            .collect();
+        // Small bodies are read whole first, so a missing chunk is a clean 502.
+        let small = wanted.len() <= fetch::READ_AHEAD;
+        let body = if small || html {
+            match self
+                .read_range(rec, &sources, &wanted, start, end_incl)
+                .await
+            {
+                Ok(b) => Body::from(b),
+                Err(e) => {
+                    warn!(site = %rec.site_id, err = %e, "hosting: chunk unavailable");
+                    return (StatusCode::BAD_GATEWAY, "site is unavailable right now")
+                        .into_response();
+                }
+            }
+        } else {
+            // Fetch the first chunk before answering, so an unavailable site
+            // still answers 502 rather than a truncated 200.
+            let (i0, h0) = wanted[0];
+            let first_bytes = match self.fetch_chunk(&h0, sources.for_chunk(&h0)).await {
+                Ok(b) => b,
+                Err(e) => {
+                    warn!(site = %rec.site_id, err = %e, "hosting: chunk unavailable");
+                    return (StatusCode::BAD_GATEWAY, "site is unavailable right now")
+                        .into_response();
+                }
+            };
+            Body::from_stream(self.stream_range(
+                sources,
+                wanted,
+                (i0, first_bytes),
+                start,
+                end_incl,
+            ))
+        };
+        let mut resp = (status, body).into_response();
+        base_headers(&mut resp);
+        if let Ok(v) = HeaderValue::from_str(&len.to_string()) {
+            resp.headers_mut().insert(header::CONTENT_LENGTH, v);
+        }
+        if status == StatusCode::PARTIAL_CONTENT
+            && let Ok(v) =
+                HeaderValue::from_str(&format!("bytes {start}-{end_incl}/{}", entry.size))
+        {
+            resp.headers_mut().insert(header::CONTENT_RANGE, v);
+        }
         resp
     }
 
+    /// The bytes `start..=end` of a file whose chunks `wanted` (index, hash)
+    /// cover that range, read whole.
+    async fn read_range(
+        &self,
+        _rec: &SiteRecord,
+        sources: &ChunkSources,
+        wanted: &[(u64, Hash)],
+        start: u64,
+        end_incl: u64,
+    ) -> Result<Vec<u8>> {
+        use futures::StreamExt;
+        let parts: Vec<Result<(u64, Vec<u8>)>> = futures::stream::iter(wanted.iter().copied())
+            .map(|(i, h)| async move {
+                self.fetch_chunk(&h, sources.for_chunk(&h))
+                    .await
+                    .map(|b| (i, b))
+            })
+            .buffered(fetch::READ_AHEAD)
+            .collect()
+            .await;
+        let mut out = Vec::new();
+        for p in parts {
+            let (i, b) = p?;
+            out.extend_from_slice(slice_chunk(i, &b, start, end_incl));
+        }
+        Ok(out)
+    }
+
+    /// Stream the bytes `start..=end`, fetching [`fetch::READ_AHEAD`] chunks
+    /// ahead of what has been sent.
+    fn stream_range(
+        &self,
+        sources: Arc<ChunkSources>,
+        wanted: Vec<(u64, Hash)>,
+        first: (u64, Vec<u8>),
+        start: u64,
+        end_incl: u64,
+    ) -> impl futures::Stream<Item = std::result::Result<axum::body::Bytes, std::io::Error>>
+    + Send
+    + 'static {
+        use futures::StreamExt;
+        let h = self.clone();
+        let head = futures::stream::once(async move { Ok::<_, anyhow::Error>(first) });
+        let rest = futures::stream::iter(wanted.into_iter().skip(1))
+            .map(move |(i, hash)| {
+                let h = h.clone();
+                let sources = sources.clone();
+                async move {
+                    h.fetch_chunk(&hash, sources.for_chunk(&hash))
+                        .await
+                        .map(|b| (i, b))
+                }
+            })
+            .buffered(fetch::READ_AHEAD);
+        head.chain(rest).map(move |r| match r {
+            Ok((i, b)) => Ok(axum::body::Bytes::copy_from_slice(slice_chunk(
+                i, &b, start, end_incl,
+            ))),
+            Err(e) => {
+                warn!(err = %e, "hosting: chunk unavailable mid-stream");
+                Err(std::io::Error::other(e.to_string()))
+            }
+        })
+    }
+
     /// Gateway routes: `/s/{site}/...`, `/hosting/v1/sites`, and custom
     /// domains (any other Host whose DNS names a site).
     pub fn router(&self) -> Router {
@@ -1538,6 +2461,110 @@ fn leaves_free_floor(disk_free: u64, disk_total: u64, extra: u64) -> bool {
     disk_total == 0 || disk_free.saturating_sub(extra) >= free_disk_floor(disk_total)
 }
 
+/// Where to fetch each chunk of one site from.
+enum ChunkSources {
+    Whole(Vec<String>),
+    Striped { n: usize, per_group: Vec<Vec<String>> },
+}
+
+impl ChunkSources {
+    fn for_chunk(&self, h: &Hash) -> &[String] {
+        match self {
+            ChunkSources::Whole(v) => v,
+            ChunkSources::Striped { n, per_group } => per_group
+                .get(stripe::group_of_hash(h, *n) as usize)
+                .map(|v| v.as_slice())
+                .unwrap_or(&[]),
+        }
+    }
+}
+
+/// A `Range` header against a file of `size` bytes.
+#[derive(Debug, PartialEq, Eq)]
+enum RangeSpec {
+    /// Serve the whole file (no usable range: several ranges, other units).
+    Ignore,
+    Unsatisfiable,
+    /// Inclusive byte range.
+    Bytes(u64, u64),
+}
+
+fn parse_range(v: &str, size: u64) -> RangeSpec {
+    let Some(spec) = v.trim().strip_prefix("bytes=") else {
+        return RangeSpec::Ignore;
+    };
+    if spec.contains(',') {
+        return RangeSpec::Ignore;
+    }
+    let Some((a, b)) = spec.trim().split_once('-') else {
+        return RangeSpec::Ignore;
+    };
+    let (a, b) = (a.trim(), b.trim());
+    if a.is_empty() {
+        // Suffix: the last `b` bytes.
+        let Ok(n) = b.parse::<u64>() else {
+            return RangeSpec::Ignore;
+        };
+        if n == 0 || size == 0 {
+            return RangeSpec::Unsatisfiable;
+        }
+        return RangeSpec::Bytes(size.saturating_sub(n), size - 1);
+    }
+    let Ok(start) = a.parse::<u64>() else {
+        return RangeSpec::Ignore;
+    };
+    if start >= size {
+        return RangeSpec::Unsatisfiable;
+    }
+    let end = if b.is_empty() {
+        size - 1
+    } else {
+        match b.parse::<u64>() {
+            Ok(e) if e >= start => e.min(size - 1),
+            _ => return RangeSpec::Ignore,
+        }
+    };
+    RangeSpec::Bytes(start, end)
+}
+
+/// The part of chunk `i` (1 MiB each) inside the inclusive range.
+fn slice_chunk(i: u64, bytes: &[u8], start: u64, end_incl: u64) -> &[u8] {
+    let cb = site::FILE_CHUNK_BYTES as u64;
+    let c0 = i * cb;
+    let from = start.saturating_sub(c0).min(bytes.len() as u64) as usize;
+    let to = (end_incl + 1).saturating_sub(c0).min(bytes.len() as u64) as usize;
+    &bytes[from..to.max(from)]
+}
+
+/// The automatic hosting budget (`[hosting] max_bytes = 0`): what the node
+/// already holds plus [`AUTO_BUDGET_PERCENT`] of the free space above the
+/// free-disk floor. It follows the disk: a nearly full disk takes nothing new,
+/// a big empty one takes a lot.
+pub fn auto_budget(held: u64, disk_free: u64, disk_total: u64) -> u64 {
+    if disk_total == 0 {
+        return held + 5 * GIB_BYTES;
+    }
+    held + disk_free.saturating_sub(free_disk_floor(disk_total)) / 100 * AUTO_BUDGET_PERCENT
+}
+
+/// A multiaddr string with a public IP over TCP.
+fn public_tcp_addr(a: &str) -> bool {
+    let Ok(ma) = a.parse::<c0mpute_net::Multiaddr>() else {
+        return false;
+    };
+    let mut ip = false;
+    let mut tcp = false;
+    for p in ma.iter() {
+        match p {
+            c0mpute_net::Protocol::Ip4(v) => ip = crate::net_guard::is_public_ip(v.into()),
+            c0mpute_net::Protocol::Ip6(v) => ip = crate::net_guard::is_public_ip(v.into()),
+            c0mpute_net::Protocol::Tcp(_) => tcp = true,
+            _ => {}
+        }
+    }
+    ip && tcp
+}
+
 pub(crate) fn jitter(d: Duration) -> Duration {
     let ms = d.as_millis() as u64;
     let spread = ms / 10;
@@ -1549,12 +2576,12 @@ pub(crate) fn jitter(d: Duration) -> Duration {
 }
 
 async fn list_sites(State(h): State<Hosting>) -> Response {
-    let sites: Vec<serde_json::Value> = h
-        .sites()
-        .await
-        .into_iter()
-        .map(|(r, copies)| {
-            serde_json::json!({
+    let mut sites: Vec<serde_json::Value> = Vec::new();
+    for (r, copies) in h.sites().await {
+        // Striped sites: copies = the fewest copies of any group.
+        let health = h.health(&r).await;
+        let copies = health.as_ref().map(|x| x.min_copies).unwrap_or(copies);
+        let mut v = serde_json::json!({
                 "site_id": r.site_id,
                 "name": r.name,
                 "owner": r.owner,
@@ -1565,9 +2592,15 @@ async fn list_sites(State(h): State<Hosting>) -> Response {
                 "path": format!("/s/{}/", r.site_id),
                 "preferred_hosts": r.preferred_hosts,
                 "price_per_gib_month": r.price_per_gib_month,
-            })
-        })
-        .collect();
+            });
+        if let Some(x) = health {
+            v["striped"] = serde_json::json!(true);
+            v["groups"] = serde_json::json!(x.groups);
+            v["short_groups"] = serde_json::json!(x.short);
+            v["missing_groups"] = serde_json::json!(x.missing);
+        }
+        sites.push(v);
+    }
     axum::Json(serde_json::json!({ "target_copies": TARGET_REPLICAS, "sites": sites })).into_response()
 }
 
@@ -1618,6 +2651,10 @@ async fn with_absolute_meta(resp: Response, page_url: Option<&str>) -> Response
     let Some(page) = page_url.and_then(|u| url::Url::parse(u).ok()) else {
         return resp;
     };
+    // A byte range of a page cannot be rewritten (its length is promised).
+    if resp.status() == StatusCode::PARTIAL_CONTENT {
+        return resp;
+    }
     let html = resp
         .headers()
         .get(header::CONTENT_TYPE)
@@ -1649,7 +2686,7 @@ impl Hosting {
         {
             return resp;
         }
-        self.serve(rec, path).await
+        self.serve_request(rec, path, headers).await
     }
 }
 
@@ -1701,6 +2738,82 @@ async fn serve_by_host(State(h): State<Hosting>, req: axum::extract::Request) ->
 
 #[cfg(test)]
 mod tests {
+    use super::*;
+
+    #[test]
+    fn ranges_parse_like_browsers_send_them() {
+        let n = 10 * 1024 * 1024;
+        assert_eq!(parse_range("bytes=0-99", n), RangeSpec::Bytes(0, 99));
+        assert_eq!(parse_range("bytes=100-", n), RangeSpec::Bytes(100, n - 1));
+        assert_eq!(parse_range("bytes=-500", n), RangeSpec::Bytes(n - 500, n - 1));
+        assert_eq!(parse_range("bytes=-99999999999", n), RangeSpec::Bytes(0, n - 1));
+        assert_eq!(parse_range("bytes=5-99999999999", n), RangeSpec::Bytes(5, n - 1));
+        assert_eq!(parse_range("bytes=0-0", n), RangeSpec::Bytes(0, 0));
+        assert_eq!(parse_range(&format!("bytes={n}-"), n), RangeSpec::Unsatisfiable);
+        assert_eq!(parse_range("bytes=-0", n), RangeSpec::Unsatisfiable);
+        assert_eq!(parse_range("bytes=0-1,5-9", n), RangeSpec::Ignore);
+        assert_eq!(parse_range("items=0-1", n), RangeSpec::Ignore);
+        assert_eq!(parse_range("bytes=9-3", n), RangeSpec::Ignore);
+        assert_eq!(parse_range("bytes=0-", 0), RangeSpec::Unsatisfiable);
+    }
+
+    #[test]
+    fn chunk_slices_cover_a_range_exactly() {
+        let cb = site::FILE_CHUNK_BYTES as u64;
+        let size = 3 * cb + 17;
+        let file: Vec<u8> = (0..size).map(|i| (i % 253) as u8).collect();
+        let chunks: Vec<&[u8]> = file.chunks(cb as usize).collect();
+        for (a, b) in [(0, 0), (0, cb - 1), (cb - 3, cb + 3), (5, size - 1), (2 * cb, 2 * cb + 1), (size - 1, size - 1)] {
+            let mut out = Vec::new();
+            for i in a / cb..=b / cb {
+                out.extend_from_slice(slice_chunk(i, chunks[i as usize], a, b));
+            }
+            assert_eq!(out, file[a as usize..=b as usize].to_vec(), "{a}-{b}");
+        }
+    }
+
+    #[test]
+    fn auto_budget_follows_the_disk() {
+        let g = GIB_BYTES;
+        // 1.8 TiB disk with 57 GiB free: floor 50 GiB, a quarter of 7 GiB.
+        assert_eq!(auto_budget(0, 57 * g, 1843 * g), 7 * g / 100 * 25);
+        // Below the floor: nothing new.
+        assert_eq!(auto_budget(3 * g, 40 * g, 1843 * g), 3 * g);
+        // A big empty disk takes a lot.
+        assert!(auto_budget(0, 3000 * g, 4000 * g) > 700 * g);
+        // Unknown disk: the old 5 GiB.
+        assert_eq!(auto_budget(0, 0, 0), 5 * g);
+    }
+
+    #[test]
+    fn a_holding_message_of_striped_sites_fits_gossipsub() {
+        // Entries are packed up to HOLDING_MESSAGE_BYTES; the largest bitmap
+        // (every group of a 256 GiB site) still leaves room.
+        let all: BTreeSet<u32> = (0..stripe::group_count(site::MAX_SITE_BYTES) as u32).collect();
+        let g = stripe::encode_groups(&all);
+        let per = HOLDING_MESSAGE_BYTES / (120 + g.len()) + 1;
+        let sites: Vec<Held> = (0..per)
+            .map(|i| Held {
+                site_id: format!("{:020}", i),
+                manifest: "f".repeat(64),
+                seq: u64::MAX,
+                groups: Some(g.clone()),
+            })
+            .collect();
+        let bytes = serde_json::to_vec(&HostingMsg::Holding {
+            sites,
+            part: 0,
+            parts: 1,
+            hosts: true,
+            addrs: vec!["/ip4/203.0.113.7/tcp/40001".into(); 8],
+            price: Some("0.004".into()),
+            payout: None,
+            room: Some(u64::MAX),
+        })
+        .unwrap();
+        assert!(bytes.len() < 64 * 1024, "{} bytes", bytes.len());
+    }
+
     #[test]
     fn hosting_copy_must_leave_a_free_disk_floor() {
         let g = GIB_BYTES;
@@ -1730,7 +2843,6 @@ mod tests {
         assert_eq!(r.status(), StatusCode::NOT_FOUND);
     }
 
-    use super::*;
 
     #[test]
     fn holding_messages_round_trip() {
@@ -1739,6 +2851,7 @@ mod tests {
                 site_id: "a".into(),
                 manifest: "b".into(),
                 seq: 1,
+                groups: None,
             }],
             part: 0,
             parts: 1,
@@ -1748,6 +2861,7 @@ mod tests {
             payout: None,
             full: false,
             room_gib: Some(3000),
+            room: None,
         };
         let bytes = serde_json::to_vec(&m).unwrap();
         assert!(bytes.len() < 1024);
@@ -1768,6 +2882,7 @@ mod tests {
                 site_id: format!("{:020}", i),
                 manifest: "f".repeat(64),
                 seq: u64::MAX,
+                groups: None,
             })
             .collect();
         let bytes = serde_json::to_vec(&HostingMsg::Holding {
@@ -1783,6 +2898,7 @@ mod tests {
             }),
             full: true,
             room_gib: Some(u64::MAX),
+            room: Some(u64::MAX),
         })
         .unwrap();
         assert!(bytes.len() < 64 * 1024, "{} bytes", bytes.len());
@@ -1912,8 +3028,67 @@ pub async fn pick_terms(m: &MarketOptions, size: u64, hosting: Option<&Hosting>)
     }
 }
 
+/// Prints a progress bar on one line of stderr (a plain line every few
+/// seconds when stderr is not a terminal).
+struct Progress {
+    tty: bool,
+    last: Instant,
+    every: Duration,
+}
+
+impl Progress {
+    fn new() -> Self {
+        use std::io::IsTerminal;
+        let tty = std::io::stderr().is_terminal();
+        Self {
+            tty,
+            last: Instant::now() - Duration::from_secs(3600),
+            every: if tty {
+                Duration::from_millis(250)
+            } else {
+                Duration::from_secs(15)
+            },
+        }
+    }
+
+    fn show(&mut self, line: &str, force: bool) {
+        if !force && self.last.elapsed() < self.every {
+            return;
+        }
+        self.last = Instant::now();
+        if self.tty {
+            eprint!("\r\x1b[2K{line}");
+        } else {
+            eprintln!("{line}");
+        }
+    }
+
+    fn done(&mut self, line: &str) {
+        self.show(line, true);
+        if self.tty {
+            eprintln!();
+        }
+    }
+}
+
+fn bar(frac: f64) -> String {
+    let n = (frac.clamp(0.0, 1.0) * 24.0).round() as usize;
+    format!("[{}{}]", "#".repeat(n), ".".repeat(24 - n))
+}
+
+fn gib(b: u64) -> f64 {
+    b as f64 / GIB_BYTES as f64
+}
+
 /// [`publish_dir`], optionally picking paid hosts from the d1sks marketplace
 /// first and signing them into a v2 record.
+///
+/// The folder is scanned in place (nothing is copied; re-running reuses the
+/// hashes of unchanged files) and served from the files while the network
+/// takes copies. Running it again with the same folder resumes: the record
+/// already on the network is reused, and holders keep what they have.
+/// Large sites are striped; the wait ends once every group has
+/// [`TARGET_REPLICAS`] copies, or after `wait` with no progress.
 pub async fn publish_dir_with(
     dir: &std::path::Path,
     name: &str,
@@ -1926,44 +3101,383 @@ pub async fn publish_dir_with(
             bail!("invalid domain {d:?}");
         }
     }
-    let built = site::build_from_dir(dir, name)?;
+    let cache_path = crate::config::data_dir()
+        .unwrap_or_else(|| PathBuf::from("."))
+        .join("hosting")
+        .join("scan-cache.json");
+    let scanned = {
+        let dir = dir.to_path_buf();
+        let name = name.to_string();
+        let cache_path = cache_path.clone();
+        tokio::task::spawn_blocking(move || -> Result<site::ScannedSite> {
+            let mut cache = site::ScanCache::load(&cache_path);
+            let mut p = Progress::new();
+            let started = Instant::now();
+            let mut show = |done: u64, total: u64| {
+                let secs = started.elapsed().as_secs_f64().max(0.001);
+                p.show(
+                    &format!(
+                        "  hashing     {} {:>6.2}/{:.2} GiB  {:.0} MB/s",
+                        bar(done as f64 / total.max(1) as f64),
+                        gib(done),
+                        gib(total),
+                        done as f64 / secs / 1e6
+                    ),
+                    done == total,
+                );
+            };
+            let r = site::scan_dir(&dir, &name, &mut cache, &mut show);
+            cache.save(&cache_path);
+            if r.is_ok() {
+                eprintln!();
+            }
+            r
+        })
+        .await
+        .context("scan task")??
+    };
+    let total = scanned.manifest.total_bytes();
+    site::check_site_size(total, market.is_some())?;
+    let striped = stripe::is_striped(total);
+    let manifest_hash = scanned.manifest.stored().hash();
     let supervisor = crate::Supervisor::boot_buyer(crate::Config::default()).await?;
     let keypair = publisher_keypair()?;
-    let manifest_hash = built.manifest_hash();
+    let owner = site::owner_hex(&keypair).context("hosting needs an ed25519 identity")?;
+    let site_id = site::site_id_for(&owner, name);
     let seq = std::time::SystemTime::now()
         .duration_since(std::time::UNIX_EPOCH)
         .map(|d| d.as_millis() as u64)
         .unwrap_or(0);
     // Join the hosting gossip first: picking marketplace hosts checks the
     // d1sks listing against which hosting nodes are live right now.
-    let hosting = Hosting::start(supervisor.libp2p.clone(), supervisor.store.clone(), Options::default()).await?;
-    let terms = match &market {
-        Some(m) => pick_terms(m, built.manifest.total_bytes(), Some(&hosting)).await,
-        None => None,
-    };
-    let record = SiteRecord::sign_with_terms(
-        &keypair,
-        name,
-        &manifest_hash,
-        seq,
-        built.manifest.total_bytes(),
-        domains,
-        terms,
-    )?;
+    let hosting = Hosting::start(
+        supervisor.libp2p.clone(),
+        supervisor.store.clone(),
+        Options::default(),
+    )
+    .await?;
     // Let the swarm reach peers before the first gossip.
     tokio::time::sleep(Duration::from_secs(5)).await;
-    hosting.publish_site(&built, record.clone()).await?;
+    // Resume: the same version already on the network is reused as it is,
+    // so holders keep every group they have.
+    let existing = hosting.lookup_record(&site_id).await.filter(|r| {
+        r.manifest == manifest_hash.to_hex()
+            && r.domains == domains
+            && market.is_some() == !r.preferred_hosts.is_empty()
+    });
+    let record = match existing {
+        Some(r) => {
+            eprintln!(
+                "resuming: the network already has this version of {name} (seq {})",
+                r.seq
+            );
+            r
+        }
+        None => {
+            let terms = match &market {
+                Some(m) => {
+                    // Striped over more preferred hosts than the copy target,
+                    // each holds only its share: ask for disks with room for that.
+                    let n = m.copies.clamp(1, site::MAX_PREFERRED_HOSTS) as u64;
+                    let t = TARGET_REPLICAS as u64;
+                    let share = if striped && n > t {
+                        total / n * t
+                    } else {
+                        total
+                    };
+                    pick_terms(m, share, Some(&hosting)).await
+                }
+                None => None,
+            };
+            if terms.is_none() && total > site::MAX_FREE_SITE_BYTES {
+                bail!(
+                    "no d1sks hosting disk has room for this site ({:.1} GiB each), and it is too big to publish free \
+                     (at most {} GiB). Try `c0mpute hosting disks` to see what is listed, --copies 5 to spread it \
+                     over more paid hosts, or split the folder into several sites.",
+                    gib(total),
+                    site::MAX_FREE_SITE_BYTES / GIB_BYTES
+                );
+            }
+            SiteRecord::sign_with_terms(&keypair, name, &manifest_hash, seq, total, domains, terms)?
+        }
+    };
+    hosting.publish_scanned(&scanned, record.clone()).await?;
     eprintln!(
-        "published {} ({} files, {} bytes) as site {}",
+        "published {} ({} files, {:.2} GiB{}) as site {}",
         name,
-        built.manifest.files.len(),
-        record.size,
+        scanned.manifest.files.len(),
+        gib(record.size),
+        if striped {
+            ", striped in 64 MiB groups"
+        } else {
+            ""
+        },
         record.site_id
     );
-    // Wait for copies, healing as we go: re-announce on a Fibonacci schedule
-    // (1, 1, 2, 3, 5, ... s, capped at REANNOUNCE_CAP) that starts over
-    // whenever a new copy shows up, so a stalled publish keeps knocking
-    // without hammering the mesh.
+    eprintln!(
+        "  keep this running until the network holds copies; if it stops, run the same command again to resume"
+    );
+    let copies = if striped {
+        wait_striped(&hosting, &record, &scanned.manifest, wait).await
+    } else {
+        wait_whole(&hosting, &record, wait).await
+    };
+    Ok((record, copies))
+}
+
+/// What [`download`] did.
+pub struct Download {
+    pub bytes: u64,
+    pub took: Duration,
+    /// Bytes per source peer.
+    pub by_peer: Vec<(String, u64)>,
+}
+
+/// `c0mpute hosting get`: fetch one file of a site from the network into
+/// `out`, the way a gateway does. `sequential` fetches one chunk at a time
+/// from the first source that answers (how every release up to 0.2.99
+/// replicated and proxied), for comparison. `from` limits the sources to
+/// these peers.
+pub async fn download(
+    site_id: &str,
+    path: &str,
+    out: &std::path::Path,
+    sequential: bool,
+    from: Vec<String>,
+) -> Result<Download> {
+    use futures::StreamExt;
+    use std::io::Write;
+    let supervisor = crate::Supervisor::boot_buyer(crate::Config::default()).await?;
+    let hosting = Hosting::start(
+        supervisor.libp2p.clone(),
+        supervisor.store.clone(),
+        Options::default(),
+    )
+    .await?;
+    // `--from` takes peer ids or full multiaddrs (`/ip4/../tcp/../p2p/<id>`):
+    // dial the addresses, keep the ids.
+    let mut from_ids = Vec::new();
+    for f in &from {
+        match f.parse::<c0mpute_net::Multiaddr>() {
+            Ok(ma) => {
+                if let Some(id) = ma.iter().find_map(|p| match p {
+                    c0mpute_net::Protocol::P2p(id) => Some(id.to_base58()),
+                    _ => None,
+                }) {
+                    from_ids.push(id);
+                }
+                let _ = hosting.0.net.dial(ma).await;
+            }
+            Err(_) => from_ids.push(f.clone()),
+        }
+    }
+    let from = from_ids;
+    for p in &from {
+        if let Ok(pid) = p.parse::<c0mpute_net::PeerId>() {
+            let _ = hosting.0.net.connect(pid).await;
+        }
+    }
+    tokio::time::sleep(Duration::from_secs(2)).await;
+    let started = Instant::now();
+    let mut rec = None;
+    while started.elapsed() < Duration::from_secs(90) {
+        // Ask the named sources first: they certainly know the record.
+        for p in &from {
+            let Ok(pid) = p.parse::<c0mpute_net::PeerId>() else {
+                continue;
+            };
+            if let Ok(Ok(body)) = tokio::time::timeout(
+                Duration::from_secs(5),
+                hosting.0.net.rpc(pid, RPC_RECORD, site_id.as_bytes().to_vec()),
+            )
+            .await
+                && let Ok(r) = serde_json::from_slice::<SiteRecord>(&body)
+                && r.site_id == site_id
+            {
+                hosting.0.map.write().await.apply_record(r);
+            }
+        }
+        if let Some(r) = hosting.lookup_record(site_id).await {
+            rec = Some(r);
+            break;
+        }
+        tokio::time::sleep(Duration::from_secs(3)).await;
+    }
+    let rec = rec.with_context(|| format!("no record for site {site_id} on the network"))?;
+    // Named sources serve the whole site whatever the gossip has said so far.
+    for p in &from {
+        let mut sites = HashMap::new();
+        sites.insert(rec.site_id.clone(), (rec.manifest.clone(), rec.seq));
+        hosting.0.map.write().await.apply_holding_full(
+            p,
+            sites,
+            HashMap::new(),
+            Instant::now(),
+            false,
+            None,
+            None,
+            None,
+            Vec::new(),
+        );
+    }
+    // Wait for holders to announce themselves (once a minute).
+    let mut sources = Vec::new();
+    let t = Instant::now();
+    while t.elapsed() < Duration::from_secs(75) {
+        sources = hosting.0.map.read().await.sources(&rec.site_id);
+        sources.extend(hosting.holders(&rec.site_id).await);
+        sources.sort();
+        sources.dedup();
+        if !from.is_empty() {
+            sources.retain(|p| from.contains(p));
+        }
+        if !sources.is_empty() {
+            break;
+        }
+        tokio::time::sleep(Duration::from_secs(3)).await;
+    }
+    if sources.is_empty() {
+        bail!("no live holder of {site_id} announced itself");
+    }
+    for p in &sources {
+        if let Ok(pid) = p.parse::<c0mpute_net::PeerId>() {
+            let _ = hosting.0.net.connect(pid).await;
+        }
+    }
+    let manifest = hosting.manifest(&rec).await?;
+    let entry = hosting
+        .resolve_entry(&rec, &manifest, path)
+        .await?
+        .with_context(|| format!("{path} is not in site {site_id}"))?;
+    let chunk_sources = Arc::new(hosting.chunk_sources(&rec).await);
+    let only: Option<Vec<String>> = (!from.is_empty()).then(|| from.clone());
+    let pick = move |src: &ChunkSources, h: &Hash| -> Vec<String> {
+        let v = src.for_chunk(h).to_vec();
+        match &only {
+            Some(o) => v.into_iter().filter(|p| o.contains(p)).collect(),
+            None => v,
+        }
+    };
+    let hashes: Vec<Hash> = entry
+        .chunks
+        .iter()
+        .filter_map(|h| Hash::from_hex(h).ok())
+        .collect();
+    let mut f = std::fs::File::create(out).with_context(|| format!("create {}", out.display()))?;
+    let mut p = Progress::new();
+    let t0 = Instant::now();
+    let mut done = 0u64;
+    let mut by_peer: HashMap<String, u64> = HashMap::new();
+    let report = |done: u64, p: &mut Progress, force: bool| {
+        let secs = t0.elapsed().as_secs_f64().max(0.001);
+        p.show(
+            &format!(
+                "  downloading {} {:.1}/{:.1} MiB  {:.1} MB/s",
+                bar(done as f64 / entry.size.max(1) as f64),
+                done as f64 / 1048576.0,
+                entry.size as f64 / 1048576.0,
+                done as f64 / secs / 1e6
+            ),
+            force,
+        );
+    };
+    if sequential {
+        for h in &hashes {
+            let req = ChunkRequest {
+                chunk_hash: *h,
+                shard_index: None,
+            };
+            let mut got = None;
+            for peer in pick(&chunk_sources, h) {
+                let Ok(pid) = peer.parse::<c0mpute_net::PeerId>() else {
+                    continue;
+                };
+                if let Ok(Ok(b)) = tokio::time::timeout(
+                    Duration::from_secs(20),
+                    hosting.0.net.fetch_from_peer(pid, &req),
+                )
+                .await
+                    && Hash::of(&b) == *h
+                {
+                    *by_peer.entry(peer).or_default() += b.len() as u64;
+                    got = Some(b);
+                    break;
+                }
+            }
+            let b = got.with_context(|| format!("chunk {} unavailable", h.to_hex()))?;
+            f.write_all(&b)?;
+            done += b.len() as u64;
+            report(done, &mut p, false);
+        }
+    } else {
+        let h2 = hosting.clone();
+        let src2 = chunk_sources.clone();
+        let mut stream = futures::stream::iter(hashes.clone())
+            .map(move |h| {
+                let hosting = h2.clone();
+                let srcs = pick(&src2, &h);
+                async move { hosting.fetch_chunk(&h, &srcs).await }
+            })
+            .buffered(fetch::BULK_WINDOW);
+        while let Some(r) = stream.next().await {
+            let b = r?;
+            f.write_all(&b)?;
+            done += b.len() as u64;
+            report(done, &mut p, false);
+        }
+        by_peer = hosting.fetched_by_peer().into_iter().collect();
+    }
+    report(done, &mut p, true);
+    p.done("");
+    let mut by_peer: Vec<(String, u64)> = by_peer.into_iter().collect();
+    by_peer.sort_by(|a, b| b.1.cmp(&a.1));
+    Ok(Download {
+        bytes: done,
+        took: t0.elapsed(),
+        by_peer,
+    })
+}
+
+/// `c0mpute hosting rm`: replace a site with an empty version (no files).
+/// Holders switch to it and delete the old chunks; gateways answer 404. The
+/// record stays (a few hundred bytes), so the name can be published again.
+/// Works on every node version: it is a plain v1 record.
+pub async fn unpublish(name: &str, wait: Duration) -> Result<SiteRecord> {
+    let manifest = SiteManifest {
+        v: 1,
+        name: name.to_string(),
+        files: std::collections::BTreeMap::new(),
+    };
+    let scanned = site::ScannedSite {
+        manifest,
+        locations: HashMap::new(),
+    };
+    let manifest_hash = scanned.manifest.stored().hash();
+    let supervisor = crate::Supervisor::boot_buyer(crate::Config::default()).await?;
+    let keypair = publisher_keypair()?;
+    let seq = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|d| d.as_millis() as u64)
+        .unwrap_or(0);
+    let record = SiteRecord::sign(&keypair, name, &manifest_hash, seq, 0, vec![])?;
+    let hosting = Hosting::start(
+        supervisor.libp2p.clone(),
+        supervisor.store.clone(),
+        Options::default(),
+    )
+    .await?;
+    tokio::time::sleep(Duration::from_secs(5)).await;
+    hosting.publish_scanned(&scanned, record.clone()).await?;
+    eprintln!("site {} ({name}) is now empty; telling the network", record.site_id);
+    wait_whole(&hosting, &record, wait).await;
+    Ok(record)
+}
+
+/// Wait for a whole (small) site to reach its copies, healing as we go:
+/// re-announce on a Fibonacci schedule (1, 1, 2, 3, 5, ... s, capped at
+/// [`REANNOUNCE_CAP`]) that starts over whenever a new copy shows up, so a
+/// stalled publish keeps knocking without hammering the mesh.
+async fn wait_whole(hosting: &Hosting, record: &SiteRecord, wait: Duration) -> usize {
     let started = Instant::now();
     let mut copies = 0;
     let mut schedule = crate::backoff::Fibonacci::new(REANNOUNCE_CAP);
@@ -1997,9 +3511,84 @@ pub async fn publish_dir_with(
             break;
         }
         if Instant::now() >= next_announce {
-            hosting.reannounce(&record).await;
+            hosting.reannounce(record).await;
             next_announce = Instant::now() + schedule.next_delay();
         }
     }
-    Ok((record, copies))
+    copies
+}
+
+/// Wait for every group of a striped site to reach its copies, showing
+/// progress. Gives up after `wait` without progress. Returns the fewest
+/// copies of any group.
+async fn wait_striped(
+    hosting: &Hosting,
+    record: &SiteRecord,
+    manifest: &SiteManifest,
+    wait: Duration,
+) -> usize {
+    let layout = stripe::Layout::of(manifest);
+    let want = record.size.saturating_mul(TARGET_REPLICAS as u64).max(1);
+    let mut p = Progress::new();
+    let mut schedule = crate::backoff::Fibonacci::new(REANNOUNCE_CAP);
+    let mut next_announce = Instant::now() + schedule.next_delay();
+    let mut last_progress = Instant::now();
+    let mut best = 0u64;
+    let mut rate = 0f64;
+    let mut prev = (Instant::now(), 0u64);
+    loop {
+        tokio::time::sleep(Duration::from_secs(2)).await;
+        if Instant::now() >= next_announce {
+            hosting.reannounce(record).await;
+            next_announce = Instant::now() + schedule.next_delay();
+        }
+        let holders = hosting
+            .0
+            .map
+            .read()
+            .await
+            .group_holders(&record.site_id, layout.len(), true);
+        let placed: u64 = holders
+            .iter()
+            .enumerate()
+            .map(|(g, hs)| hs.len().min(TARGET_REPLICAS) as u64 * layout.bytes(g as u32))
+            .sum();
+        let h = stripe::health(&holders, TARGET_REPLICAS);
+        let dt = prev.0.elapsed().as_secs_f64();
+        if dt >= 2.0 {
+            let r = placed.saturating_sub(prev.1) as f64 / dt;
+            rate = if rate == 0.0 { r } else { rate * 0.7 + r * 0.3 };
+            prev = (Instant::now(), placed);
+        }
+        if placed > best {
+            best = placed;
+            last_progress = Instant::now();
+            schedule.reset();
+        }
+        let line = format!(
+            "  replicating {} {:>5.1}%  {:.2}/{:.2} GiB of {} copies, groups {}/{} complete, {} without a copy, {:.1} MB/s",
+            bar(placed as f64 / want as f64),
+            placed as f64 * 100.0 / want as f64,
+            gib(placed),
+            gib(want),
+            TARGET_REPLICAS,
+            h.groups - h.short,
+            h.groups,
+            h.missing,
+            rate / 1e6
+        );
+        if h.short == 0 && h.groups > 0 {
+            p.done(&line);
+            return h.min_copies;
+        }
+        p.show(&line, false);
+        if last_progress.elapsed() >= wait {
+            p.done(&line);
+            eprintln!(
+                "  no progress for {} s: stopping. The copies made so far stay; run the same command to resume.",
+                wait.as_secs()
+            );
+            return h.min_copies;
+        }
+    }
 }
diff --git a/node/crates/c0mpute-core/src/hosting/proof.rs b/node/crates/c0mpute-core/src/hosting/proof.rs
index c74b4680..2fabaa28 100644
--- a/node/crates/c0mpute-core/src/hosting/proof.rs
+++ b/node/crates/c0mpute-core/src/hosting/proof.rs
@@ -131,6 +131,23 @@ pub fn pick_from(all: &[String], nonce: &[u8]) -> Option<String> {
     Some(all[(n % all.len() as u64) as usize].clone())
 }
 
+/// The chunk to ask for when the holder holds only some groups of a striped
+/// site: a nonce-picked group among `groups`, then a nonce-picked chunk in it.
+pub fn pick_chunk_of(layout: &super::stripe::Layout, groups: &[u32], nonce: &[u8]) -> Option<String> {
+    if groups.is_empty() {
+        return None;
+    }
+    let h = Hash::of(nonce).0;
+    let a = u64::from_le_bytes(h[..8].try_into().expect("8 bytes"));
+    let b = u64::from_le_bytes(h[8..16].try_into().expect("8 bytes"));
+    let g = groups[(a % groups.len() as u64) as usize];
+    let chunks = layout.group(g);
+    if chunks.is_empty() {
+        return None;
+    }
+    Some(chunks[(b % chunks.len() as u64) as usize].to_hex())
+}
+
 /// Whether a holder has lost preference: of its most recent [`RECENT`]
 /// receipts signed by a `trusted` key (the site's owner or payer), at least
 /// [`FAIL_LIMIT`] failed. `receipts` may be in any order and may include
diff --git a/node/crates/c0mpute-core/src/hosting/replicas.rs b/node/crates/c0mpute-core/src/hosting/replicas.rs
index e2a3e742..e58ca484 100644
--- a/node/crates/c0mpute-core/src/hosting/replicas.rs
+++ b/node/crates/c0mpute-core/src/hosting/replicas.rs
@@ -14,7 +14,7 @@
 //! on its own, and once preferred hosts hold copies the surplus free copies
 //! are released one at a time. A site never drops below three copies.
 
-use std::collections::HashMap;
+use std::collections::{BTreeSet, HashMap};
 use std::time::{Duration, Instant};
 
 use c0mpute_proto::Hash;
@@ -41,6 +41,14 @@ pub struct Holding {
     /// Free disk above its floor, GiB, when it says. More room ranks higher
     /// in the fill (see [`space_tier`]).
     pub room_gib: Option<u64>,
+    /// Striped sites it holds only some groups of: site id -> groups. A site
+    /// in `sites` but not here is held whole.
+    pub groups: HashMap<String, BTreeSet<u32>>,
+    /// Bytes it can still take. Present only from nodes that place striped
+    /// sites, so older nodes are never counted on for a group.
+    pub room: Option<u64>,
+    /// Where to dial it (announced multiaddrs).
+    pub addrs: Vec<String>,
 }
 
 #[derive(Debug, Default)]
@@ -95,6 +103,23 @@ impl ReplicaMap {
         hosts: bool,
         price: Option<Micros>,
         payout: Option<Payee>,
+    ) {
+        self.apply_holding_full(peer, sites, HashMap::new(), now, hosts, price, payout, None, Vec::new());
+    }
+
+    /// A holding list with everything a current node announces.
+    #[allow(clippy::too_many_arguments)]
+    pub fn apply_holding_full(
+        &mut self,
+        peer: &str,
+        sites: HashMap<String, (String, u64)>,
+        groups: HashMap<String, BTreeSet<u32>>,
+        now: Instant,
+        hosts: bool,
+        price: Option<Micros>,
+        payout: Option<Payee>,
+        room: Option<u64>,
+        addrs: Vec<String>,
     ) {
         self.peers.insert(
             peer.to_string(),
@@ -106,6 +131,9 @@ impl ReplicaMap {
                 payout,
                 full: false,
                 room_gib: None,
+                groups,
+                room,
+                addrs,
             },
         );
     }
@@ -124,6 +152,78 @@ impl ReplicaMap {
         }
     }
 
+    /// Live hosting peers that place striped sites (they announce `room`),
+    /// sorted.
+    pub fn striping_peers(&self) -> Vec<String> {
+        let mut v: Vec<String> = self
+            .peers
+            .iter()
+            .filter(|(_, h)| h.hosts && h.room.is_some())
+            .map(|(p, _)| p.clone())
+            .collect();
+        v.sort();
+        v
+    }
+
+    /// The room a peer announced.
+    pub fn room_of(&self, peer: &str) -> Option<u64> {
+        self.peers.get(peer).and_then(|h| h.room)
+    }
+
+    /// For each of a striped site's `n` groups, the peers holding it in the
+    /// current version, sorted. `hosting_only` = copies that count (else
+    /// every source, seeding publishers included). A peer that holds the site
+    /// whole holds every group.
+    pub fn group_holders(&self, site_id: &str, n: usize, hosting_only: bool) -> Vec<Vec<String>> {
+        let mut out = vec![Vec::new(); n];
+        let Some(rec) = self.records.get(site_id) else {
+            return out;
+        };
+        let mut peers: Vec<(&String, &Holding)> = self.peers.iter().collect();
+        peers.sort_by(|a, b| a.0.cmp(b.0));
+        for (p, h) in peers {
+            if hosting_only && !h.hosts {
+                continue;
+            }
+            if !h.sites.get(site_id).is_some_and(|(m, _)| *m == rec.manifest) {
+                continue;
+            }
+            match h.groups.get(site_id) {
+                Some(gs) => {
+                    for g in gs {
+                        if let Some(v) = out.get_mut(*g as usize) {
+                            v.push(p.clone());
+                        }
+                    }
+                }
+                None => {
+                    for v in out.iter_mut() {
+                        v.push(p.clone());
+                    }
+                }
+            }
+        }
+        out
+    }
+
+    /// Every source of one group of a striped site (holders and seeding
+    /// publishers), sorted.
+    pub fn group_sources(&self, site_id: &str, g: u32) -> Vec<String> {
+        self.sources(site_id)
+            .into_iter()
+            .filter(|p| {
+                self.peers
+                    .get(p)
+                    .is_some_and(|h| h.groups.get(site_id).is_none_or(|gs| gs.contains(&g)))
+            })
+            .collect()
+    }
+
+    /// Announced addresses of a peer.
+    pub fn addrs_of(&self, peer: &str) -> &[String] {
+        self.peers.get(peer).map(|h| h.addrs.as_slice()).unwrap_or(&[])
+    }
+
     /// Keep a verified receipt (deduplicated, newest [`proof::KEEP_PER_HOLDER`]
     /// per holder). Returns true when it was new.
     pub fn apply_receipt(&mut self, r: Receipt) -> bool {
@@ -387,12 +487,20 @@ pub fn decide(map: &ReplicaMap, site_id: &str, me: &str, i_host: bool, target: u
     // short if one never manages to.
     // Full peers are left out too: one that ranks first but cannot take the
     // copy would otherwise hold the slot from the next ranked node forever.
+    // Peers that announced too little room for the site are skipped, so a
+    // full node ranked first cannot leave a site short forever. Older nodes
+    // do not announce room and stay candidates.
+    let size = map.records.get(site_id).map(|r| r.size).unwrap_or(0);
     let mut candidates: Vec<String> = map
         .candidate_peers()
         .into_iter()
         .filter(|p| !holders.contains(p) && !preferred.contains(p))
+        .filter(|p| map.room_of(p).is_none_or(|r| r >= size))
         .collect();
     if !candidates.iter().any(|p| p == me) {
+        if map.room_of(me).is_some_and(|r| r < size) {
+            return Action::Nothing;
+        }
         candidates.push(me.to_string());
     }
     if chosen_by_space(map, site_id, &candidates, target - holders.len())
@@ -510,6 +618,24 @@ mod tests {
         assert_eq!(decide(&m, &site, "outsider", false, 3, 5), Action::Nothing);
     }
 
+    #[test]
+    fn full_nodes_are_not_counted_on_for_a_copy() {
+        let kp = c0mpute_net::libp2p::identity::Keypair::generate_ed25519();
+        let r = rec(&kp, 1);
+        let site = r.site_id.clone();
+        let mut m = ReplicaMap::default();
+        m.apply_record(r.clone());
+        let now = Instant::now();
+        for (p, room) in [("a", Some(0)), ("b", Some(0)), ("c", Some(1 << 30)), ("d", None), ("e", Some(1 << 30))] {
+            m.apply_holding_full(p, HashMap::new(), HashMap::new(), now, true, None, None, room, vec![]);
+        }
+        let takers: Vec<&str> = ["a", "b", "c", "d", "e"]
+            .into_iter()
+            .filter(|p| decide(&m, &site, p, true, 3, 5) == Action::Replicate)
+            .collect();
+        assert_eq!(takers, vec!["c", "d", "e"], "full a and b are skipped; d (no room field) is not");
+    }
+
     #[test]
     fn a_seeding_publisher_is_a_source_not_a_copy() {
         let kp = c0mpute_net::libp2p::identity::Keypair::generate_ed25519();
diff --git a/node/crates/c0mpute-core/src/hosting/seed.rs b/node/crates/c0mpute-core/src/hosting/seed.rs
new file mode 100644
index 00000000..9c1431f7
--- /dev/null
+++ b/node/crates/c0mpute-core/src/hosting/seed.rs
@@ -0,0 +1,89 @@
+//! Chunks a publisher serves straight from its source files.
+//!
+//! `c0mpute hosting publish` scans a folder in place ([`super::site::scan_dir`])
+//! and registers where every chunk is. The node's chunk server
+//! (`supervisor::StoreSource`) falls back to this index when a chunk is not
+//! in the chunk store, so the publisher seeds a 50 GiB folder without copying
+//! it. Every read is checked against the chunk's hash: a file edited while it
+//! is being published answers "not found", never wrong bytes.
+
+use std::collections::HashMap;
+use std::io::{Read, Seek, SeekFrom};
+use std::sync::{OnceLock, RwLock};
+
+use c0mpute_proto::Hash;
+
+use super::site::ChunkLoc;
+
+fn index() -> &'static RwLock<HashMap<Hash, ChunkLoc>> {
+    static INDEX: OnceLock<RwLock<HashMap<Hash, ChunkLoc>>> = OnceLock::new();
+    INDEX.get_or_init(|| RwLock::new(HashMap::new()))
+}
+
+/// Serve these chunks from their files from now on.
+pub fn register(locations: &HashMap<Hash, ChunkLoc>) {
+    if let Ok(mut idx) = index().write() {
+        for (h, loc) in locations {
+            idx.entry(*h).or_insert_with(|| loc.clone());
+        }
+    }
+}
+
+/// True when this process seeds `hash` from a file.
+pub fn has(hash: &Hash) -> bool {
+    index()
+        .read()
+        .map(|i| i.contains_key(hash))
+        .unwrap_or(false)
+}
+
+/// Read a seeded chunk, checked against its hash.
+pub fn read(hash: &Hash) -> Option<Vec<u8>> {
+    let loc = index().read().ok()?.get(hash).cloned()?;
+    let mut f = std::fs::File::open(&loc.path).ok()?;
+    f.seek(SeekFrom::Start(loc.offset)).ok()?;
+    let mut buf = vec![0u8; loc.len as usize];
+    f.read_exact(&mut buf).ok()?;
+    (Hash::of(&buf) == *hash).then_some(buf)
+}
+
+/// [`read`] off the async runtime.
+pub async fn read_async(hash: &Hash) -> Option<Vec<u8>> {
+    if !has(hash) {
+        return None;
+    }
+    let h = *hash;
+    tokio::task::spawn_blocking(move || read(&h))
+        .await
+        .ok()
+        .flatten()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn serves_registered_chunks_and_refuses_edited_files() {
+        let dir = tempfile::tempdir().unwrap();
+        let p = dir.path().join("f.bin");
+        let data: Vec<u8> = (0..3000u32).map(|i| (i % 251) as u8).collect();
+        std::fs::write(&p, &data).unwrap();
+        let h = Hash::of(&data[1000..2000]);
+        let mut m = HashMap::new();
+        m.insert(
+            h,
+            ChunkLoc {
+                path: p.clone(),
+                offset: 1000,
+                len: 1000,
+            },
+        );
+        register(&m);
+        assert!(has(&h));
+        assert_eq!(read(&h).unwrap(), data[1000..2000].to_vec());
+        std::fs::write(&p, vec![0u8; 3000]).unwrap();
+        assert!(read(&h).is_none(), "changed bytes are not served");
+        assert!(read(&Hash::of(b"other")).is_none());
+    }
+}
diff --git a/node/crates/c0mpute-core/src/hosting/settle.rs b/node/crates/c0mpute-core/src/hosting/settle.rs
index c670d2f3..e4f82dba 100644
--- a/node/crates/c0mpute-core/src/hosting/settle.rs
+++ b/node/crates/c0mpute-core/src/hosting/settle.rs
@@ -50,6 +50,20 @@ pub struct Due {
     pub key: String,
 }
 
+/// Bytes each preferred host of `rec` is paid for. A striped site with more
+/// preferred hosts than the copy target spreads its groups over them, so each
+/// holds (and is paid for) `target / preferred` of it; otherwise each holds
+/// the whole site.
+pub fn paid_share(rec: &SiteRecord) -> u64 {
+    let n = rec.preferred_hosts.len() as u64;
+    let t = super::TARGET_REPLICAS as u64;
+    if super::stripe::is_striped(rec.size) && n > t {
+        rec.size / n * t
+    } else {
+        rec.size
+    }
+}
+
 /// Everything `payer` owes for `[from, to)` (unix seconds).
 pub fn dues(
     records: &[SiteRecord],
@@ -88,7 +102,7 @@ pub fn dues(
                     }
                 }
             }
-            let amount = owed(terms.price_per_gib_month, rec.size, to - from, passed, challenged);
+            let amount = owed(terms.price_per_gib_month, paid_share(rec), to - from, passed, challenged);
             out.push(Due {
                 site_id: rec.site_id.clone(),
                 holder: holder.clone(),
diff --git a/node/crates/c0mpute-core/src/hosting/site.rs b/node/crates/c0mpute-core/src/hosting/site.rs
index e7015520..daa989b3 100644
--- a/node/crates/c0mpute-core/src/hosting/site.rs
+++ b/node/crates/c0mpute-core/src/hosting/site.rs
@@ -18,9 +18,27 @@ use serde::{Deserialize, Serialize};
 /// as a CBOR integer array (about 2x on the wire and slow to decode), so
 /// small chunks keep each fetch quick and well under the 10 MiB response cap.
 pub const FILE_CHUNK_BYTES: usize = 1024 * 1024;
-/// Largest site a node will publish or replicate (equal to the per-owner
-/// hosting budget, so one site always fits it).
-pub const MAX_SITE_BYTES: u64 = 1024 * 1024 * 1024;
+/// Largest site a node will publish or replicate (with paid preferred hosts).
+pub const MAX_SITE_BYTES: u64 = 256 * GIB;
+/// Largest free site (a v1 record, no preferred hosts). Volunteers hold free
+/// copies, so a free site may use at most a quarter of what a paid one may.
+pub const MAX_FREE_SITE_BYTES: u64 = 64 * GIB;
+/// Largest site that is built in memory ([`build_from_dir`]), and the cap for
+/// the small sites other features publish (ad creatives, app images, podcast
+/// shows, git repos). It was the only site cap before striping.
+pub const MAX_SMALL_SITE_BYTES: u64 = GIB;
+/// Sites above this size are striped: every holder keeps some chunk groups
+/// rather than the whole site (see [`super::stripe`]). At or below it a site
+/// is replicated whole, exactly as before, so nodes from 0.3.0 to 0.3.2 (which
+/// accept sites up to this size) keep holding and serving it.
+pub const STRIPE_ABOVE: u64 = GIB;
+/// Largest single file. One file's chunk list lives in one manifest part,
+/// which must stay one chunk fetch (under the protocol's 10 MiB response cap).
+pub const MAX_FILE_BYTES: u64 = 128 * GIB;
+/// Chunks per manifest part (besides [`PART_FILES`]): a part closes before
+/// it lists more than this, unless one file alone is bigger.
+pub const PART_CHUNKS: usize = 65_536;
+const GIB: u64 = 1024 * 1024 * 1024;
 /// Most files in one site. Above [`INLINE_FILES`] the manifest is split into
 /// parts of [`PART_FILES`], so a gateway loads only the part a request needs.
 pub const MAX_FILES: usize = 10_000_000;
@@ -30,6 +48,8 @@ pub const INLINE_FILES: usize = 5_000;
 /// Files per manifest part (a part stays a few hundred KiB, well under the
 /// chunk protocol's response cap).
 pub const PART_FILES: usize = 4_000;
+/// Most parts a root may list: file-bounded parts plus chunk-bounded ones.
+const MAX_PARTS: usize = MAX_FILES.div_ceil(PART_FILES) + 2 * (MAX_SITE_BYTES as usize / FILE_CHUNK_BYTES).div_ceil(PART_CHUNKS) + 2;
 /// Most files a v1 (single-chunk) manifest may list when read.
 const MAX_INLINE_FILES: usize = 10_000;
 /// Longest site name.
@@ -196,7 +216,7 @@ impl Manifest {
                 if r.files as usize > MAX_FILES || r.bytes > MAX_SITE_BYTES || r.parts.is_empty() {
                     bail!("site manifest root out of bounds");
                 }
-                if r.parts.len() > MAX_FILES.div_ceil(PART_FILES) {
+                if r.parts.len() > MAX_PARTS {
                     bail!("site manifest has too many parts");
                 }
                 if r.parts.iter().map(|p| p.files as u64).sum::<u64>() != r.files
@@ -497,8 +517,9 @@ impl SiteRecord {
         if self.domains.len() > MAX_DOMAINS || !self.domains.iter().all(|d| valid_domain(d)) {
             bail!("invalid domain list");
         }
-        if self.size > MAX_SITE_BYTES {
-            bail!("site is over {MAX_SITE_BYTES} bytes");
+        let cap = if self.v >= 2 { MAX_SITE_BYTES } else { MAX_FREE_SITE_BYTES };
+        if self.size > cap {
+            bail!("site is over {cap} bytes");
         }
         if Hash::from_hex(&self.manifest).is_err() {
             bail!("manifest is not a hash");
@@ -559,8 +580,13 @@ pub fn content_type_for(path: &str) -> &'static str {
         "woff2" => "font/woff2",
         "ttf" => "font/ttf",
         "otf" => "font/otf",
-        "mp4" => "video/mp4",
+        "mp4" | "m4v" => "video/mp4",
         "webm" => "video/webm",
+        "mkv" => "video/x-matroska",
+        "mov" => "video/quicktime",
+        "ogv" => "video/ogg",
+        "m3u8" => "application/vnd.apple.mpegurl",
+        "srt" => "application/x-subrip",
         "mp3" => "audio/mpeg",
         "ogg" | "oga" => "audio/ogg",
         "m4a" => "audio/x-m4a",
@@ -597,20 +623,49 @@ impl StoredManifest {
 }
 
 impl BuiltSite {
-    /// Encode the manifest: one chunk up to [`INLINE_FILES`] files, else a
-    /// root plus parts of [`PART_FILES`].
+    /// The stored manifest (see [`SiteManifest::stored`]).
+    pub fn stored(&self) -> StoredManifest {
+        self.manifest.stored()
+    }
+
+    /// The hash a record pins.
+    pub fn manifest_hash(&self) -> Hash {
+        self.stored().hash()
+    }
+}
+
+impl SiteManifest {
+    /// Encode the manifest: one chunk up to [`INLINE_FILES`] files and
+    /// [`STRIPE_ABOVE`] bytes (byte for byte what older nodes read), else a
+    /// root plus parts of at most [`PART_FILES`] files and [`PART_CHUNKS`]
+    /// chunks, so even a 256 GiB site's chunk lists are fetched a part at a
+    /// time.
     pub fn stored(&self) -> StoredManifest {
-        let m = &self.manifest;
-        if m.files.len() <= INLINE_FILES {
+        let m = self;
+        if m.files.len() <= INLINE_FILES && m.total_bytes() <= super::stripe::stripe_above() {
             return StoredManifest {
                 root: m.to_bytes(),
                 parts: Vec::new(),
             };
         }
         let entries: Vec<(&String, &FileEntry)> = m.files.iter().collect();
+        let mut runs: Vec<&[(&String, &FileEntry)]> = Vec::new();
+        let (mut start, mut chunks) = (0usize, 0usize);
+        for (i, (_, f)) in entries.iter().enumerate() {
+            let n = f.chunks.len();
+            if i > start && (i - start >= PART_FILES || chunks + n > PART_CHUNKS) {
+                runs.push(&entries[start..i]);
+                start = i;
+                chunks = 0;
+            }
+            chunks += n;
+        }
+        if start < entries.len() {
+            runs.push(&entries[start..]);
+        }
         let mut parts = Vec::new();
         let mut refs = Vec::new();
-        for run in entries.chunks(PART_FILES) {
+        for run in runs {
             let part = ManifestPart {
                 v: 2,
                 files: run.iter().map(|(k, v)| ((*k).clone(), (*v).clone())).collect(),
@@ -636,11 +691,6 @@ impl BuiltSite {
             parts,
         }
     }
-
-    /// The hash a record pins.
-    pub fn manifest_hash(&self) -> Hash {
-        self.stored().hash()
-    }
 }
 
 pub fn build_from_dir(dir: &Path, name: &str) -> Result<BuiltSite> {
@@ -662,8 +712,11 @@ pub fn build_from_dir(dir: &Path, name: &str) -> Result<BuiltSite> {
     for (rel, abs) in paths {
         let bytes = std::fs::read(&abs).with_context(|| format!("read {}", abs.display()))?;
         total += bytes.len() as u64;
-        if total > MAX_SITE_BYTES {
-            bail!("site is over {} MiB", MAX_SITE_BYTES / (1024 * 1024));
+        if total > MAX_SMALL_SITE_BYTES {
+            bail!(
+                "site is over {} MiB (publish it with `c0mpute hosting publish`, which scans in place)",
+                MAX_SMALL_SITE_BYTES / (1024 * 1024)
+            );
         }
         let mut hashes = Vec::new();
         if bytes.is_empty() {
@@ -700,6 +753,234 @@ pub fn list_dir(dir: &Path) -> Result<Vec<(String, PathBuf)>> {
     walk(dir, dir, &mut paths)?;
     paths.sort();
     Ok(paths)
+/// Where one chunk of a scanned site lives on the publisher's disk.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct ChunkLoc {
+    pub path: PathBuf,
+    pub offset: u64,
+    pub len: u32,
+}
+
+/// A site scanned in place: the manifest, and where each chunk is in the
+/// source files. Nothing is copied: the publisher serves chunks straight from
+/// the files (see [`super::seed`]), so publishing 50 GiB of video does not
+/// need another 50 GiB of local disk.
+pub struct ScannedSite {
+    pub manifest: SiteManifest,
+    pub locations: std::collections::HashMap<Hash, ChunkLoc>,
+}
+
+/// Chunk hashes of files already scanned, keyed by absolute path and checked
+/// against size and mtime, so publishing the same folder again (to resume, or
+/// after changing a few files) reads only what changed.
+#[derive(Default, Serialize, Deserialize)]
+pub struct ScanCache {
+    files: std::collections::HashMap<String, CachedFile>,
+}
+
+#[derive(Serialize, Deserialize)]
+struct CachedFile {
+    size: u64,
+    mtime_ns: u128,
+    chunks: Vec<String>,
+}
+
+impl ScanCache {
+    pub fn load(path: &Path) -> Self {
+        std::fs::read(path)
+            .ok()
+            .and_then(|b| serde_json::from_slice(&b).ok())
+            .unwrap_or_default()
+    }
+
+    pub fn save(&self, path: &Path) {
+        if let Some(dir) = path.parent() {
+            let _ = std::fs::create_dir_all(dir);
+        }
+        let tmp = path.with_extension("tmp");
+        if serde_json::to_vec(self)
+            .ok()
+            .is_some_and(|b| std::fs::write(&tmp, b).is_ok())
+        {
+            let _ = std::fs::rename(&tmp, path);
+        }
+    }
+}
+
+fn mtime_ns(meta: &std::fs::Metadata) -> u128 {
+    meta.modified()
+        .ok()
+        .and_then(|t| t.duration_since(std::time::UNIX_EPOCH).ok())
+        .map(|d| d.as_nanos())
+        .unwrap_or(0)
+}
+
+fn human_bytes(b: u64) -> String {
+    const UNITS: [&str; 5] = ["B", "KiB", "MiB", "GiB", "TiB"];
+    let mut v = b as f64;
+    let mut u = 0;
+    while v >= 1024.0 && u + 1 < UNITS.len() {
+        v /= 1024.0;
+        u += 1;
+    }
+    if u == 0 {
+        format!("{b} B")
+    } else {
+        format!("{v:.1} {}", UNITS[u])
+    }
+}
+
+/// The size limit for a site, as an error that says which limit and what to
+/// do about it. `paid` = the site will have preferred (paid) hosts.
+pub fn check_site_size(total: u64, paid: bool) -> Result<()> {
+    if total > MAX_SITE_BYTES {
+        bail!(
+            "the site is {}; the most one site can be is {} (paid, --disks) or {} (free). \
+             Split the folder into several sites (one --name each).",
+            human_bytes(total),
+            human_bytes(MAX_SITE_BYTES),
+            human_bytes(MAX_FREE_SITE_BYTES)
+        );
+    }
+    if !paid && total > MAX_FREE_SITE_BYTES {
+        bail!(
+            "the site is {}; a free site can be at most {}, volunteers hold its copies. \
+             Add --disks auto to pay hosts (up to {} per site), or split the folder into several sites.",
+            human_bytes(total),
+            human_bytes(MAX_FREE_SITE_BYTES),
+            human_bytes(MAX_SITE_BYTES)
+        );
+    }
+    Ok(())
+}
+
+/// Walk `dir` and hash every file in 1 MiB chunks without copying anything.
+/// `progress(done, total)` is called as bytes are read. Sizes are checked
+/// against [`MAX_SITE_BYTES`] before anything is read.
+pub fn scan_dir(
+    dir: &Path,
+    name: &str,
+    cache: &mut ScanCache,
+    progress: &mut dyn FnMut(u64, u64),
+) -> Result<ScannedSite> {
+    use std::io::Read;
+    if !valid_name(name) {
+        bail!("site name must be 1-63 of a-z, 0-9 and '-'");
+    }
+    if !dir.is_dir() {
+        bail!("{} is not a directory", dir.display());
+    }
+    let mut paths = Vec::new();
+    walk(dir, dir, &mut paths)?;
+    paths.sort();
+    if paths.is_empty() {
+        bail!("{} has no files to publish", dir.display());
+    }
+    if paths.len() > MAX_FILES {
+        bail!(
+            "{} has {} files; a site holds at most {MAX_FILES}",
+            dir.display(),
+            paths.len()
+        );
+    }
+    let mut metas = Vec::with_capacity(paths.len());
+    let mut total = 0u64;
+    for (_, abs) in &paths {
+        let m = std::fs::metadata(abs).with_context(|| format!("stat {}", abs.display()))?;
+        total += m.len();
+        metas.push(m);
+    }
+    check_site_size(total, true)?;
+    for ((rel, _), m) in paths.iter().zip(&metas) {
+        if m.len() > MAX_FILE_BYTES {
+            bail!(
+                "{rel} is {}; one file can be at most {}. Split it (for video: `ffmpeg -i in -c copy -f segment ...`).",
+                human_bytes(m.len()),
+                human_bytes(MAX_FILE_BYTES)
+            );
+        }
+    }
+    let mut files = BTreeMap::new();
+    let mut locations = std::collections::HashMap::new();
+    let mut done = 0u64;
+    let mut buf = vec![0u8; FILE_CHUNK_BYTES];
+    progress(0, total);
+    for ((rel, abs), meta) in paths.into_iter().zip(metas) {
+        let size = meta.len();
+        let key = abs
+            .canonicalize()
+            .unwrap_or(abs.clone())
+            .to_string_lossy()
+            .to_string();
+        let mt = mtime_ns(&meta);
+        let n = size.div_ceil(FILE_CHUNK_BYTES as u64).max(1) as usize;
+        let cached = cache
+            .files
+            .get(&key)
+            .filter(|c| c.size == size && c.mtime_ns == mt && c.chunks.len() == n)
+            .map(|c| c.chunks.clone());
+        let hashes = match cached {
+            Some(h) => {
+                done += size;
+                progress(done, total);
+                h
+            }
+            None => {
+                let mut f =
+                    std::fs::File::open(&abs).with_context(|| format!("open {}", abs.display()))?;
+                let mut hashes = Vec::with_capacity(n);
+                if size == 0 {
+                    hashes.push(Hash::of(&[]).to_hex());
+                }
+                let mut left = size;
+                while left > 0 {
+                    let want = left.min(FILE_CHUNK_BYTES as u64) as usize;
+                    f.read_exact(&mut buf[..want]).with_context(|| {
+                        format!("read {} (did it change while publishing?)", abs.display())
+                    })?;
+                    hashes.push(Hash::of(&buf[..want]).to_hex());
+                    left -= want as u64;
+                    done += want as u64;
+                    progress(done, total);
+                }
+                cache.files.insert(
+                    key,
+                    CachedFile {
+                        size,
+                        mtime_ns: mt,
+                        chunks: hashes.clone(),
+                    },
+                );
+                hashes
+            }
+        };
+        for (i, h) in hashes.iter().enumerate() {
+            if let Ok(hash) = Hash::from_hex(h) {
+                let offset = i as u64 * FILE_CHUNK_BYTES as u64;
+                locations.entry(hash).or_insert(ChunkLoc {
+                    path: abs.clone(),
+                    offset,
+                    len: (size.saturating_sub(offset)).min(FILE_CHUNK_BYTES as u64) as u32,
+                });
+            }
+        }
+        files.insert(
+            rel.clone(),
+            FileEntry {
+                size,
+                content_type: content_type_for(&rel).to_string(),
+                chunks: hashes,
+            },
+        );
+    }
+    Ok(ScannedSite {
+        manifest: SiteManifest {
+            v: 1,
+            name: name.to_string(),
+            files,
+        },
+        locations,
+    })
 }
 
 fn walk(root: &Path, dir: &Path, out: &mut Vec<(String, PathBuf)>) -> Result<()> {
@@ -1016,6 +1297,120 @@ mod tests {
         assert!(resolve_path(m, "/nope").is_none());
     }
 
+    #[test]
+    fn large_sites_split_parts_by_chunks_and_every_part_stays_one_fetch() {
+        let mk = |n: usize, seed: u64| -> Vec<String> {
+            (0..n).map(|i| Hash::of(&(seed * 1_000_000 + i as u64).to_le_bytes()).to_hex()).collect()
+        };
+        let mut files = BTreeMap::new();
+        for (i, n) in [40_000usize, 40_000, 3, 1].into_iter().enumerate() {
+            files.insert(
+                format!("movies/{i}.mp4"),
+                FileEntry {
+                    size: n as u64 * FILE_CHUNK_BYTES as u64 - 5,
+                    content_type: "video/mp4".into(),
+                    chunks: mk(n, i as u64),
+                },
+            );
+        }
+        let m = SiteManifest {
+            v: 1,
+            name: "big".into(),
+            files,
+        };
+        let st = m.stored();
+        // Two files of 40k chunks cannot share a 65,536-chunk part.
+        assert_eq!(st.parts.len(), 2);
+        let Manifest::Parted(r) = Manifest::from_bytes(&st.root).unwrap() else {
+            panic!("a site over STRIPE_ABOVE is parted");
+        };
+        assert_eq!(r.bytes, m.total_bytes());
+        let mut back = BTreeMap::new();
+        for (pr, b) in r.parts.iter().zip(&st.parts) {
+            assert!(b.len() < 10 * 1024 * 1024, "a part is one fetch: {}", b.len());
+            back.extend(ManifestPart::from_bytes(b, pr).unwrap().files);
+        }
+        assert_eq!(back, m.files);
+        // The largest single file still fits one part (one chunk fetch).
+        let huge = (MAX_FILE_BYTES / FILE_CHUNK_BYTES as u64) as usize;
+        let part = ManifestPart {
+            v: 2,
+            files: [(
+                "x/".repeat(100) + "f.mkv",
+                FileEntry {
+                    size: MAX_FILE_BYTES,
+                    content_type: "video/x-matroska".into(),
+                    chunks: vec!["f".repeat(64); huge],
+                },
+            )]
+            .into_iter()
+            .collect(),
+        };
+        assert!(serde_json::to_vec(&part).unwrap().len() < 10 * 1024 * 1024);
+    }
+
+    #[test]
+    fn size_caps_split_free_and_paid() {
+        let kp = c0mpute_net::libp2p::identity::Keypair::generate_ed25519();
+        let h = Hash::of(b"m");
+        assert!(SiteRecord::sign(&kp, "x", &h, 1, MAX_FREE_SITE_BYTES, vec![]).unwrap().verify());
+        assert!(SiteRecord::sign(&kp, "x", &h, 1, MAX_FREE_SITE_BYTES + 1, vec![]).is_err(), "free cap");
+        let terms = HostingTerms {
+            preferred_hosts: vec![peer()],
+            price_per_gib_month: 4_000,
+            payer: None,
+        };
+        assert!(
+            SiteRecord::sign_with_terms(&kp, "x", &h, 1, MAX_SITE_BYTES, vec![], Some(terms.clone()))
+                .unwrap()
+                .verify()
+        );
+        assert!(SiteRecord::sign_with_terms(&kp, "x", &h, 1, MAX_SITE_BYTES + 1, vec![], Some(terms)).is_err());
+        let e = check_site_size(70 * GIB, false).unwrap_err().to_string();
+        assert!(e.contains("--disks auto"), "{e}");
+        assert!(check_site_size(70 * GIB, true).is_ok());
+        assert!(check_site_size(300 * GIB, true).unwrap_err().to_string().contains("Split"));
+    }
+
+    #[test]
+    fn scanning_hashes_in_place_and_reuses_unchanged_files() {
+        let dir = tempfile::tempdir().unwrap();
+        let big: Vec<u8> = (0..(2 * FILE_CHUNK_BYTES + 7)).map(|i| (i % 249) as u8).collect();
+        std::fs::write(dir.path().join("v.mp4"), &big).unwrap();
+        std::fs::write(dir.path().join("index.html"), b"hi").unwrap();
+        std::fs::write(dir.path().join(".secret"), b"no").unwrap();
+        let mut cache = ScanCache::default();
+        let mut calls = 0;
+        let s = scan_dir(dir.path(), "v", &mut cache, &mut |_, _| calls += 1).unwrap();
+        assert!(calls > 2);
+        let built = build_from_dir(dir.path(), "v").unwrap();
+        assert_eq!(s.manifest, built.manifest, "same manifest as the in-memory builder");
+        assert_eq!(s.manifest.files["v.mp4"].content_type, "video/mp4");
+        let h = Hash::from_hex(&s.manifest.files["v.mp4"].chunks[2]).unwrap();
+        let loc = &s.locations[&h];
+        assert_eq!((loc.offset, loc.len), (2 * FILE_CHUNK_BYTES as u64, 7));
+        // Second scan: nothing read again.
+        let mut reads = 0u64;
+        let mut last = 0u64;
+        let s2 = scan_dir(dir.path(), "v", &mut cache, &mut |d, _| {
+            reads += 1;
+            last = d;
+        })
+        .unwrap();
+        assert_eq!(s2.manifest, s.manifest);
+        assert_eq!(last, big.len() as u64 + 2);
+        assert!(reads <= 3, "cached files are not re-read ({reads} progress calls)");
+    }
+
+    #[test]
+    fn media_types_for_video() {
+        assert_eq!(content_type_for("a/b.mkv"), "video/x-matroska");
+        assert_eq!(content_type_for("a/b.m4v"), "video/mp4");
+        assert_eq!(content_type_for("a/b.MP4"), "video/mp4");
+        assert_eq!(content_type_for("a/b.webm"), "video/webm");
+        assert_eq!(content_type_for("a/b.mp3"), "audio/mpeg");
+    }
+
     #[test]
     fn feeds_serve_as_rss() {
         assert_eq!(content_type_for("feed.xml"), "application/rss+xml");
diff --git a/node/crates/c0mpute-core/src/hosting/stripe.rs b/node/crates/c0mpute-core/src/hosting/stripe.rs
new file mode 100644
index 00000000..a17552c6
--- /dev/null
+++ b/node/crates/c0mpute-core/src/hosting/stripe.rs
@@ -0,0 +1,567 @@
+//! Striped placement for large sites.
+//!
+//! A site at or below [`STRIPE_ABOVE`] is replicated whole, as it always was.
+//! Above it, the site's chunks are bucketed by hash into one group per 64 MiB
+//! ([`group_count`] of the signed size) and every group is placed on its own: the hosting nodes that rank
+//! highest for `(site, group)` (rendezvous hashing, the same answer on every
+//! node) take that group. No node needs the whole site, a 50 GiB folder spreads
+//! over the whole network, and healing, copy counting, garbage collection,
+//! challenges and the free-disk floor all work one group at a time.
+//!
+//! Groups are defined over chunk hashes only, never over file contents, so the
+//! same layout works for a site whose chunks are ciphertext, and a gateway can
+//! tell which group a chunk is in from its hash and the record's size alone.
+
+use std::collections::{BTreeSet, HashMap};
+
+use base64::Engine;
+use c0mpute_proto::Hash;
+
+use super::replicas::{ReplicaMap, chosen, score};
+use super::site::{FILE_CHUNK_BYTES, FileEntry, STRIPE_ABOVE, SiteManifest};
+
+/// Chunks per group: 64 MiB of a site.
+pub const GROUP_CHUNKS: usize = 64;
+/// Most groups any site can have (256 GiB of 1 MiB chunks, plus one partial
+/// chunk per file, in 64-chunk groups, with room to spare). Bounds the size
+/// of a group bitmap read off the gossip.
+pub const MAX_GROUPS: usize = 8192;
+
+static THRESHOLD: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(STRIPE_ABOVE);
+
+/// The size above which sites are striped: [`STRIPE_ABOVE`], unless a test
+/// lowered it.
+pub fn stripe_above() -> u64 {
+    THRESHOLD.load(std::sync::atomic::Ordering::Relaxed)
+}
+
+/// Lower the striping threshold for this process, so an end-to-end test can
+/// stripe a few hundred MiB instead of writing gigabytes. Every node in such a
+/// test must run in the same process. Never call it outside tests.
+#[doc(hidden)]
+pub fn set_stripe_above_for_tests(bytes: u64) {
+    THRESHOLD.store(bytes, std::sync::atomic::Ordering::Relaxed);
+}
+
+/// True when a site of `size` bytes is striped.
+pub fn is_striped(size: u64) -> bool {
+    size > stripe_above()
+}
+
+/// Bytes of a site per group, on average.
+pub const GROUP_BYTES: u64 = (GROUP_CHUNKS * FILE_CHUNK_BYTES) as u64;
+
+/// How many groups a striped site of `size` bytes has: one per 64 MiB. The
+/// size is in the signed record, so every node agrees without the manifest.
+pub fn group_count(size: u64) -> usize {
+    (size.div_ceil(GROUP_BYTES).max(1) as usize).min(MAX_GROUPS)
+}
+
+/// The group a chunk belongs to: its hash, bucketed. A gateway finds the
+/// holders of any chunk from the record alone, without loading every part of
+/// a large manifest, and it works the same over ciphertext.
+pub fn group_of_hash(h: &Hash, n: usize) -> u32 {
+    let x = u64::from_le_bytes(h.0[..8].try_into().expect("8 bytes"));
+    (x % n.max(1) as u64) as u32
+}
+
+/// How a striped site's chunks fall into groups.
+#[derive(Debug)]
+pub struct Layout {
+    groups: Vec<Vec<Hash>>,
+    bytes: Vec<u64>,
+}
+
+impl Layout {
+    /// The groups of a site from all its files ([`group_count`] of its size).
+    pub fn of(manifest: &SiteManifest) -> Self {
+        Self::new(group_count(manifest.total_bytes()), manifest.files.values())
+    }
+
+    /// `n` groups over the chunks of `files` (each chunk once, sorted within
+    /// its group).
+    pub fn new<'a>(n: usize, files: impl Iterator<Item = &'a FileEntry>) -> Self {
+        let n = n.max(1);
+        let mut size_of: HashMap<Hash, u64> = HashMap::new();
+        for f in files {
+            for (i, h) in f.chunks.iter().enumerate() {
+                if let Ok(hash) = Hash::from_hex(h) {
+                    let off = i as u64 * FILE_CHUNK_BYTES as u64;
+                    size_of
+                        .entry(hash)
+                        .or_insert(f.size.saturating_sub(off).min(FILE_CHUNK_BYTES as u64));
+                }
+            }
+        }
+        let mut groups: Vec<Vec<Hash>> = vec![Vec::new(); n];
+        let mut bytes = vec![0u64; n];
+        for (h, len) in &size_of {
+            let g = group_of_hash(h, n) as usize;
+            groups[g].push(*h);
+            bytes[g] += len;
+        }
+        for g in groups.iter_mut() {
+            g.sort_by(|a, b| a.0.cmp(&b.0));
+        }
+        Self { groups, bytes }
+    }
+
+    pub fn len(&self) -> usize {
+        self.groups.len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.groups.is_empty()
+    }
+
+    pub fn group(&self, g: u32) -> &[Hash] {
+        self.groups
+            .get(g as usize)
+            .map(|v| v.as_slice())
+            .unwrap_or(&[])
+    }
+
+    /// Bytes of data in group `g`.
+    pub fn bytes(&self, g: u32) -> u64 {
+        self.bytes.get(g as usize).copied().unwrap_or(0)
+    }
+
+    pub fn group_of(&self, h: &Hash) -> Option<u32> {
+        (!self.groups.is_empty()).then(|| group_of_hash(h, self.groups.len()))
+    }
+
+    /// Bytes of a set of groups.
+    pub fn bytes_of<'a>(&self, groups: impl IntoIterator<Item = &'a u32>) -> u64 {
+        groups.into_iter().map(|g| self.bytes(*g)).sum()
+    }
+}
+
+/// A set of groups as it travels on the gossip: a bitmap, base64url.
+pub fn encode_groups(groups: &BTreeSet<u32>) -> String {
+    let n = groups
+        .iter()
+        .next_back()
+        .map(|g| *g as usize / 8 + 1)
+        .unwrap_or(0);
+    let mut bits = vec![0u8; n];
+    for g in groups {
+        bits[*g as usize / 8] |= 1 << (g % 8);
+    }
+    base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(bits)
+}
+
+/// Parse a group bitmap; `None` when it is not one or is too long.
+pub fn decode_groups(s: &str) -> Option<BTreeSet<u32>> {
+    if s.len() > MAX_GROUPS / 6 + 4 {
+        return None;
+    }
+    let bits = base64::engine::general_purpose::URL_SAFE_NO_PAD
+        .decode(s)
+        .ok()?;
+    let mut out = BTreeSet::new();
+    for (i, b) in bits.iter().enumerate() {
+        for j in 0..8 {
+            if b & (1 << j) != 0 {
+                out.insert((i * 8 + j) as u32);
+            }
+        }
+    }
+    Some(out)
+}
+
+/// The rendezvous key of one group.
+pub fn group_key(site_id: &str, g: u32) -> String {
+    format!("{site_id}/{g}")
+}
+
+/// What this node should do about the groups of one striped site.
+#[derive(Debug, Default, PartialEq, Eq)]
+pub struct Plan {
+    /// Groups to fetch, most wanted first.
+    pub fetch: Vec<u32>,
+    /// Groups to let go.
+    pub drop: Vec<u32>,
+}
+
+/// Per-group copy health of a striped site.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct Health {
+    pub groups: usize,
+    /// Fewest live copies of any group.
+    pub min_copies: usize,
+    /// Groups below the target.
+    pub short: usize,
+    /// Groups with no live copy at all.
+    pub missing: usize,
+}
+
+/// Copy health of a site from the per-group holder lists.
+pub fn health(holders: &[Vec<String>], target: usize) -> Health {
+    Health {
+        groups: holders.len(),
+        min_copies: holders.iter().map(|h| h.len()).min().unwrap_or(0),
+        short: holders.iter().filter(|h| h.len() < target).count(),
+        missing: holders.iter().filter(|h| h.is_empty()).count(),
+    }
+}
+
+fn lowest(key: &str, peers: &[String]) -> Option<String> {
+    peers
+        .iter()
+        .min_by(|a, b| score(key, a).cmp(&score(key, b)).then(b.cmp(a)))
+        .cloned()
+}
+
+/// The preferred hosts that take group `g`: all of them when there are at
+/// most `target` (a paid host holds the whole site), else the `target` that
+/// rank highest for the group.
+pub fn preferred_takers(site_id: &str, g: u32, preferred: &[String], target: usize) -> Vec<String> {
+    if preferred.len() <= target {
+        preferred.to_vec()
+    } else {
+        chosen(&group_key(site_id, g), preferred, target)
+    }
+}
+
+/// Decide, for `me`, which groups of `site_id` to fetch and which to drop.
+///
+/// Per group this is the whole-site rule from `replicas::decide`, keyed on
+/// `(site, group)`: preferred (paid) hosts take their groups whatever the
+/// count; below `target` copies the top-ranked striping hosts with room for
+/// the group take it (`widen(g)` more of them once a group has been short for
+/// a while, so a chosen node that cannot take it does not stall the group);
+/// above `max` copies (or above the paid share) the lowest-ranked holder lets
+/// go.
+#[allow(clippy::too_many_arguments)]
+pub fn plan(
+    map: &ReplicaMap,
+    site_id: &str,
+    layout: &Layout,
+    me: &str,
+    i_host: bool,
+    target: usize,
+    max: usize,
+    widen: &dyn Fn(u32) -> usize,
+) -> Plan {
+    let holders = map.group_holders(site_id, layout.len(), true);
+    let preferred = map.effective_preferred(site_id);
+    let striping = map.striping_peers();
+    let mut out = Plan::default();
+    let mut wanted: Vec<(usize, [u8; 32], u32)> = Vec::new();
+    for (gi, hs) in holders.iter().enumerate() {
+        let g = gi as u32;
+        let key = group_key(site_id, g);
+        let i_hold = hs.iter().any(|p| p == me);
+        let takers = preferred_takers(site_id, g, &preferred, target);
+        if i_hold {
+            if preferred.is_empty() {
+                if hs.len() > max && lowest(&key, hs).as_deref() == Some(me) {
+                    out.drop.push(g);
+                }
+            } else if !takers.iter().any(|p| p == me) {
+                let free: Vec<String> =
+                    hs.iter().filter(|p| !takers.contains(p)).cloned().collect();
+                let paid = hs.len() - free.len();
+                let allowed = target.saturating_sub(paid);
+                if free.len() > allowed && lowest(&key, &free).as_deref() == Some(me) {
+                    out.drop.push(g);
+                }
+            }
+            continue;
+        }
+        if !i_host {
+            continue;
+        }
+        if takers.iter().any(|p| p == me) {
+            // Paid groups first, then the emptiest.
+            wanted.push((0, score(&key, me), g));
+            continue;
+        }
+        if hs.len() >= target {
+            continue;
+        }
+        let need = layout.bytes(g);
+        let mut candidates: Vec<String> = striping
+            .iter()
+            .filter(|p| !hs.contains(p) && !takers.contains(p))
+            .filter(|p| map.room_of(p).is_some_and(|r| r >= need))
+            .cloned()
+            .collect();
+        if !candidates.iter().any(|p| p == me) {
+            // Not announced yet (or too full): only count ourselves when we
+            // have not said we are full.
+            if map.room_of(me).is_some_and(|r| r < need) {
+                continue;
+            }
+            candidates.push(me.to_string());
+        }
+        let n = target - hs.len() + widen(g);
+        if chosen(&key, &candidates, n).iter().any(|p| p == me) {
+            wanted.push((1 + hs.len(), score(&key, me), g));
+        }
+    }
+    // Paid groups, then groups with fewest copies, then a stable order.
+    wanted.sort_by(|a, b| a.0.cmp(&b.0).then(b.1.cmp(&a.1)).then(a.2.cmp(&b.2)));
+    out.fetch = wanted.into_iter().map(|(_, _, g)| g).collect();
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::BTreeMap;
+    use std::time::Instant;
+
+    use super::*;
+    use crate::hosting::site::{FileEntry, SiteRecord};
+
+    fn manifest(chunks: usize) -> SiteManifest {
+        let mut files = BTreeMap::new();
+        let hashes: Vec<String> = (0..chunks)
+            .map(|i| Hash::of(&(i as u64).to_le_bytes()).to_hex())
+            .collect();
+        files.insert(
+            "movie.mp4".to_string(),
+            FileEntry {
+                size: chunks as u64 * FILE_CHUNK_BYTES as u64 - 10,
+                content_type: "video/mp4".into(),
+                chunks: hashes,
+            },
+        );
+        SiteManifest {
+            v: 1,
+            name: "m".into(),
+            files,
+        }
+    }
+
+    #[test]
+    fn layout_is_deterministic_and_covers_every_chunk_once() {
+        let m = manifest(300);
+        let a = Layout::of(&m);
+        let b = Layout::of(&m);
+        assert_eq!(a.len(), 5);
+        assert_eq!(a.groups, b.groups);
+        let total: usize = (0..a.len() as u32).map(|g| a.group(g).len()).sum();
+        assert_eq!(total, 300);
+        let bytes: u64 = (0..a.len() as u32).map(|g| a.bytes(g)).sum();
+        assert_eq!(bytes, m.total_bytes());
+        for h in m.chunk_hashes() {
+            let h = Hash::from_hex(&h).unwrap();
+            let g = a.group_of(&h).unwrap();
+            assert_eq!(g, group_of_hash(&h, group_count(m.total_bytes())));
+            assert!(a.group(g).contains(&h));
+        }
+        // Buckets are roughly even (64 chunks on average).
+        assert!((0..a.len() as u32).all(|g| (20..=110).contains(&a.group(g).len())));
+        assert_eq!(group_count(1), 1);
+        assert_eq!(group_count(super::super::site::MAX_SITE_BYTES), 4096);
+    }
+
+    #[test]
+    fn group_bitmaps_round_trip() {
+        let s: BTreeSet<u32> = [0, 3, 8, 9, 4095].into_iter().collect();
+        assert_eq!(decode_groups(&encode_groups(&s)).unwrap(), s);
+        assert_eq!(
+            decode_groups(&encode_groups(&BTreeSet::new())).unwrap(),
+            BTreeSet::new()
+        );
+        assert!(decode_groups(&"A".repeat(5000)).is_none());
+        assert!(decode_groups("!!").is_none());
+    }
+
+    fn big_record(kp: &c0mpute_net::libp2p::identity::Keypair, m: &SiteManifest) -> SiteRecord {
+        SiteRecord::sign(kp, "m", &m.stored().hash(), 1, m.total_bytes(), vec![]).unwrap()
+    }
+
+    fn map_with(peers: &[String], rec: &SiteRecord) -> ReplicaMap {
+        let mut map = ReplicaMap::default();
+        assert!(map.apply_record(rec.clone()));
+        let now = Instant::now();
+        for p in peers {
+            map.apply_holding_full(
+                p,
+                HashMap::new(),
+                HashMap::new(),
+                now,
+                true,
+                None,
+                None,
+                Some(u64::MAX),
+                vec![],
+            );
+        }
+        map
+    }
+
+    #[test]
+    fn every_group_gets_exactly_target_takers_and_no_node_takes_everything() {
+        let kp = c0mpute_net::libp2p::identity::Keypair::generate_ed25519();
+        let m = manifest(64 * 40);
+        let rec = big_record(&kp, &m);
+        let layout = Layout::of(&m);
+        let peers: Vec<String> = (0..8).map(|i| format!("peer{i}")).collect();
+        let map = map_with(&peers, &rec);
+        let mut takers = vec![0usize; layout.len()];
+        for p in &peers {
+            let plan = plan(&map, &rec.site_id, &layout, p, true, 3, 5, &|_| 0);
+            assert!(plan.drop.is_empty());
+            assert!(
+                plan.fetch.len() < layout.len(),
+                "{p} would hold the whole site"
+            );
+            for g in plan.fetch {
+                takers[g as usize] += 1;
+            }
+        }
+        assert!(takers.iter().all(|t| *t == 3), "{takers:?}");
+        // Same inputs, same plan, on every node.
+        let a = plan(&map, &rec.site_id, &layout, "peer3", true, 3, 5, &|_| 0);
+        let b = plan(&map, &rec.site_id, &layout, "peer3", true, 3, 5, &|_| 0);
+        assert_eq!(a, b);
+    }
+
+    #[test]
+    fn a_group_whose_holder_left_is_refilled_by_one_node() {
+        let kp = c0mpute_net::libp2p::identity::Keypair::generate_ed25519();
+        let m = manifest(64 * 6);
+        let rec = big_record(&kp, &m);
+        let layout = Layout::of(&m);
+        let peers: Vec<String> = (0..6).map(|i| format!("peer{i}")).collect();
+        let mut map = map_with(&peers, &rec);
+        // Everybody takes what it was given.
+        let now = Instant::now();
+        let plans: Vec<(String, Vec<u32>)> = peers
+            .iter()
+            .map(|p| {
+                (
+                    p.clone(),
+                    plan(&map, &rec.site_id, &layout, p, true, 3, 5, &|_| 0).fetch,
+                )
+            })
+            .collect();
+        for (p, groups) in &plans {
+            let mut sites = HashMap::new();
+            sites.insert(rec.site_id.clone(), (rec.manifest.clone(), rec.seq));
+            let mut g = HashMap::new();
+            g.insert(
+                rec.site_id.clone(),
+                groups.iter().copied().collect::<BTreeSet<u32>>(),
+            );
+            map.apply_holding_full(p, sites, g, now, true, None, None, Some(u64::MAX), vec![]);
+        }
+        let h = health(&map.group_holders(&rec.site_id, layout.len(), true), 3);
+        assert_eq!((h.min_copies, h.short), (3, 0));
+        // A holder of group 0 leaves.
+        let gone = map.group_holders(&rec.site_id, layout.len(), true)[0][0].clone();
+        map.peers.remove(&gone);
+        let lost: BTreeSet<u32> = plans
+            .iter()
+            .find(|(p, _)| *p == gone)
+            .unwrap()
+            .1
+            .iter()
+            .copied()
+            .collect();
+        let mut refill = vec![0usize; layout.len()];
+        for p in peers.iter().filter(|p| **p != gone) {
+            let plan = plan(&map, &rec.site_id, &layout, p, true, 3, 5, &|_| 0);
+            assert!(plan.drop.is_empty());
+            for g in plan.fetch {
+                assert!(
+                    lost.contains(&g),
+                    "{p} fetches group {g} that still has 3 copies"
+                );
+                refill[g as usize] += 1;
+            }
+        }
+        for g in 0..layout.len() {
+            assert_eq!(
+                refill[g],
+                usize::from(lost.contains(&(g as u32))),
+                "group {g}"
+            );
+        }
+    }
+
+    #[test]
+    fn nodes_without_room_or_striping_support_are_skipped() {
+        let kp = c0mpute_net::libp2p::identity::Keypair::generate_ed25519();
+        let m = manifest(64 * 4);
+        let rec = big_record(&kp, &m);
+        let layout = Layout::of(&m);
+        let mut map = ReplicaMap::default();
+        map.apply_record(rec.clone());
+        let now = Instant::now();
+        // An older node (no room field) and a full node.
+        map.apply_holding_full(
+            "old",
+            HashMap::new(),
+            HashMap::new(),
+            now,
+            true,
+            None,
+            None,
+            None,
+            vec![],
+        );
+        map.apply_holding_full(
+            "full",
+            HashMap::new(),
+            HashMap::new(),
+            now,
+            true,
+            None,
+            None,
+            Some(0),
+            vec![],
+        );
+        for p in ["a", "b", "c"] {
+            map.apply_holding_full(
+                p,
+                HashMap::new(),
+                HashMap::new(),
+                now,
+                true,
+                None,
+                None,
+                Some(u64::MAX),
+                vec![],
+            );
+        }
+        for p in ["a", "b", "c"] {
+            let plan = plan(&map, &rec.site_id, &layout, p, true, 3, 5, &|_| 0);
+            assert_eq!(
+                plan.fetch.len(),
+                layout.len(),
+                "{p} must take every group: only 3 usable nodes"
+            );
+        }
+    }
+
+    #[test]
+    fn widening_brings_in_the_next_ranked_node() {
+        let kp = c0mpute_net::libp2p::identity::Keypair::generate_ed25519();
+        let m = manifest(64);
+        let rec = big_record(&kp, &m);
+        let layout = Layout::of(&m);
+        let peers: Vec<String> = (0..6).map(|i| format!("peer{i}")).collect();
+        let map = map_with(&peers, &rec);
+        let base = peers
+            .iter()
+            .filter(|p| {
+                !plan(&map, &rec.site_id, &layout, p, true, 3, 5, &|_| 0)
+                    .fetch
+                    .is_empty()
+            })
+            .count();
+        let wide = peers
+            .iter()
+            .filter(|p| {
+                !plan(&map, &rec.site_id, &layout, p, true, 3, 5, &|_| 1)
+                    .fetch
+                    .is_empty()
+            })
+            .count();
+        assert_eq!((base, wide), (3, 4));
+    }
+}
diff --git a/node/crates/c0mpute-core/src/opendisk.rs b/node/crates/c0mpute-core/src/opendisk.rs
index 0a7c2dd6..c28f21df 100644
--- a/node/crates/c0mpute-core/src/opendisk.rs
+++ b/node/crates/c0mpute-core/src/opendisk.rs
@@ -184,7 +184,7 @@ pub fn descriptor(
     if hosts {
         doc["c0mpute"]["hosting"] = json!({
             "price_per_gib_month": config.hosting.price_micros() as f64 / crate::payments::MICROS_PER_USD as f64,
-            "max_gib": gib(config.hosting.max_bytes),
+            "max_gib": gib(hosting_budget(config)),
             "publish": "c0mpute hosting publish <dir> --name <site> --disks auto",
         });
     }
@@ -194,6 +194,16 @@ pub fn descriptor(
     doc
 }
 
+/// The hosting budget to advertise: `[hosting] max_bytes`, or the automatic
+/// budget of the storage disk when it is 0.
+fn hosting_budget(config: &Config) -> u64 {
+    if config.hosting.max_bytes > 0 {
+        return config.hosting.max_bytes;
+    }
+    let (free, total) = disk_for(&config.storage.root);
+    crate::hosting::auto_budget(0, free, total)
+}
+
 fn chrono_now() -> String {
     let secs = std::time::SystemTime::now()
         .duration_since(std::time::UNIX_EPOCH)
diff --git a/node/crates/c0mpute-core/src/podcast/show.rs b/node/crates/c0mpute-core/src/podcast/show.rs
index ad4f2a0c..2e257ce3 100644
--- a/node/crates/c0mpute-core/src/podcast/show.rs
+++ b/node/crates/c0mpute-core/src/podcast/show.rs
@@ -10,7 +10,7 @@ use anyhow::{Context, Result, bail};
 use serde::Deserialize;
 
 use super::dates;
-use crate::hosting::site::{self, MAX_SITE_BYTES, SiteRecord};
+use crate::hosting::site::{self, MAX_SMALL_SITE_BYTES as MAX_SITE_BYTES, SiteRecord};
 
 /// The Podcasting 2.0 namespace UUID for `podcast:guid` (uuid v5).
 pub const PODCAST_GUID_NAMESPACE: uuid::Uuid = uuid::Uuid::from_u128(0xead4c236_bf58_58c6_a2c6_a6b28d128cb6);
diff --git a/node/crates/c0mpute-core/src/supervisor.rs b/node/crates/c0mpute-core/src/supervisor.rs
index 2152d82e..30209146 100644
--- a/node/crates/c0mpute-core/src/supervisor.rs
+++ b/node/crates/c0mpute-core/src/supervisor.rs
@@ -992,7 +992,11 @@ pub struct StoreSource(pub ChunkStore);
 #[async_trait::async_trait]
 impl ChunkSource for StoreSource {
     async fn read_chunk(&self, hash: &Hash) -> Result<Vec<u8>> {
-        self.0.get(hash).await
+        match self.0.get(hash).await {
+            Ok(bytes) => Ok(bytes),
+            // A site being published is served straight from its files.
+            Err(e) => crate::hosting::seed::read_async(hash).await.ok_or(e),
+        }
     }
 }
 
diff --git a/node/crates/c0mpute-core/tests/ads_billing_e2e.rs b/node/crates/c0mpute-core/tests/ads_billing_e2e.rs
index 2ef85780..e036e221 100644
--- a/node/crates/c0mpute-core/tests/ads_billing_e2e.rs
+++ b/node/crates/c0mpute-core/tests/ads_billing_e2e.rs
@@ -174,6 +174,8 @@ async fn funded_campaign_two_gateways_claims_payouts_and_overspend() {
     let hub_addr = listen_addr(&hub_net).await;
     let host_opts = |dir: &std::path::Path| Options {
         hosts: true,
+        // Plenty of (pretend) disk: the test box may be below the free-disk floor.
+        disk_override: Some((1 << 40, 2 << 40)),
         catalog_path: Some(dir.join("catalog.json")),
         timing: fast(),
         ..Default::default()
diff --git a/node/crates/c0mpute-core/tests/ads_e2e.rs b/node/crates/c0mpute-core/tests/ads_e2e.rs
index db4306c5..2f0da5b8 100644
--- a/node/crates/c0mpute-core/tests/ads_e2e.rs
+++ b/node/crates/c0mpute-core/tests/ads_e2e.rs
@@ -145,6 +145,8 @@ async fn campaign_to_stitched_episode_vast_and_report() {
     let hub_addr = listen_addr(&hub_net).await;
     let host_opts = |dir: &std::path::Path| Options {
         hosts: true,
+        // Plenty of (pretend) disk: the test box may be below the free-disk floor.
+        disk_override: Some((1 << 40, 2 << 40)),
         catalog_path: Some(dir.join("catalog.json")),
         timing: fast(),
         ..Default::default()
diff --git a/node/crates/c0mpute-core/tests/hosting_e2e.rs b/node/crates/c0mpute-core/tests/hosting_e2e.rs
index c6dadab3..50ef05f0 100644
--- a/node/crates/c0mpute-core/tests/hosting_e2e.rs
+++ b/node/crates/c0mpute-core/tests/hosting_e2e.rs
@@ -87,6 +87,8 @@ async fn sites_replicate_to_three_heal_and_serve_from_any_gateway() {
     let mut hosts: Vec<Hosting> = Vec::new();
     let opts = |dir: &std::path::Path| Options {
         hosts: true,
+        // Plenty of (pretend) disk: the test box may be below the free-disk floor.
+        disk_override: Some((1 << 40, 2 << 40)),
         catalog_path: Some(dir.join("catalog.json")),
         timing: fast(),
         ..Default::default()
diff --git a/node/crates/c0mpute-core/tests/hosting_market_e2e.rs b/node/crates/c0mpute-core/tests/hosting_market_e2e.rs
index fa779d76..f216c574 100644
--- a/node/crates/c0mpute-core/tests/hosting_market_e2e.rs
+++ b/node/crates/c0mpute-core/tests/hosting_market_e2e.rs
@@ -91,6 +91,8 @@ async fn preferred_hosts_hold_pass_challenges_and_get_paid() {
     // Five hosting nodes, each asking $0.004/GiB-month with a payout wallet.
     let host_opts = |dir: &std::path::Path, i: usize| Options {
         hosts: true,
+        // Plenty of (pretend) disk: the test box may be below the free-disk floor.
+        disk_override: Some((1 << 40, 2 << 40)),
         catalog_path: Some(dir.join("catalog.json")),
         timing: fast(),
         price: Some(4_000),
diff --git a/node/crates/c0mpute-core/tests/hosting_striped_e2e.rs b/node/crates/c0mpute-core/tests/hosting_striped_e2e.rs
new file mode 100644
index 00000000..f1cc862b
--- /dev/null
+++ b/node/crates/c0mpute-core/tests/hosting_striped_e2e.rs
@@ -0,0 +1,370 @@
+//! A large (striped) site end to end on loopback libp2p: a publisher seeds a
+//! 260 MiB folder (the striping threshold is lowered to 256 MiB for the test) straight from its files, five hosting nodes each take only
+//! some 64 MiB groups until every group has three copies, a gateway that holds
+//! nothing serves byte ranges (start, middle, end, suffix, open-ended,
+//! multi-chunk spans) from the holders, and when a holder leaves its groups
+//! are refilled elsewhere.
+//!
+//! Writes about 1 GiB under TMPDIR (the file plus three copies).
+
+use std::collections::HashMap;
+use std::sync::Arc;
+use std::time::Duration;
+
+use c0mpute_core::hosting::site::{ScanCache, SiteRecord, scan_dir};
+use c0mpute_core::hosting::{self, Hosting, Options, Timing, stripe};
+use c0mpute_net::{ChunkSource, Libp2pNetwork, NetworkConfig};
+use c0mpute_proto::Hash;
+use c0mpute_store::ChunkStore;
+use libp2p::multiaddr::Protocol;
+use tempfile::tempdir;
+
+/// The node's chunk server, with the publisher's seed fallback (as the
+/// supervisor's is).
+struct StoreSource(ChunkStore);
+
+#[async_trait::async_trait]
+impl ChunkSource for StoreSource {
+    async fn read_chunk(&self, hash: &Hash) -> anyhow::Result<Vec<u8>> {
+        match self.0.get(hash).await {
+            Ok(b) => Ok(b),
+            Err(e) => hosting::seed::read_async(hash).await.ok_or(e),
+        }
+    }
+}
+
+async fn node(
+    dir: &std::path::Path,
+    bootstrap: Vec<libp2p::Multiaddr>,
+) -> (Arc<Libp2pNetwork>, ChunkStore) {
+    let store = ChunkStore::open(dir.join("store")).await.unwrap();
+    let net = Libp2pNetwork::spawn(
+        NetworkConfig::for_dir(dir.join("id"))
+            .with_listen(vec!["/ip4/127.0.0.1/tcp/0".parse().unwrap()])
+            .with_local_source(Arc::new(StoreSource(store.clone())))
+            .with_bootstrap(bootstrap),
+    )
+    .await
+    .unwrap();
+    (Arc::new(net), store)
+}
+
+async fn listen_addr(net: &Libp2pNetwork) -> libp2p::Multiaddr {
+    for _ in 0..50 {
+        if let Ok(addrs) = net.listen_addrs().await
+            && let Some(a) = addrs.into_iter().next()
+        {
+            return a.with(Protocol::P2p(net.peer_id()));
+        }
+        tokio::time::sleep(Duration::from_millis(50)).await;
+    }
+    panic!("no listen addr");
+}
+
+fn fast() -> Timing {
+    Timing {
+        announce_every: Duration::from_millis(700),
+        records_every: Duration::from_millis(1500),
+        repair_every: Duration::from_millis(500),
+        holder_ttl: Duration::from_secs(4),
+        fetch_timeout: Duration::from_secs(20),
+    }
+}
+
+async fn wait_for<F, Fut>(what: &str, secs: u64, mut f: F)
+where
+    F: FnMut() -> Fut,
+    Fut: std::future::Future<Output = bool>,
+{
+    let deadline = tokio::time::Instant::now() + Duration::from_secs(secs);
+    while tokio::time::Instant::now() < deadline {
+        if f().await {
+            return;
+        }
+        tokio::time::sleep(Duration::from_millis(500)).await;
+    }
+    panic!("timed out waiting for {what}");
+}
+
+/// Deterministic bytes that differ in every chunk.
+fn byte_at(i: u64) -> u8 {
+    let x = i.wrapping_mul(0x9E37_79B9_7F4A_7C15) ^ (i >> 7);
+    (x >> 24) as u8
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 6)]
+async fn a_large_site_stripes_serves_ranges_and_heals() {
+    let _ = tracing_subscriber::fmt()
+        .with_env_filter("c0mpute_core=info,c0mpute_net=warn")
+        .with_test_writer()
+        .try_init();
+    // Stripe above 256 MiB here (1 GiB in production) so the test writes
+    // about 1 GiB rather than 4.
+    stripe::set_stripe_above_for_tests(256 * 1024 * 1024);
+    let tmp = tempdir().unwrap();
+    // Plenty of (pretend) disk: the test box may be below the real floor.
+    let disk = Some((1u64 << 40, 2u64 << 40));
+
+    let (hub_net, hub_store) = node(&tmp.path().join("h0"), vec![]).await;
+    let hub_addr = listen_addr(&hub_net).await;
+    let opts = |dir: &std::path::Path| Options {
+        hosts: true,
+        catalog_path: Some(dir.join("catalog.json")),
+        timing: fast(),
+        disk_override: disk,
+        max_bytes: 4 << 30,
+        ..Default::default()
+    };
+    let mut hosts: Vec<Hosting> = vec![
+        Hosting::start(hub_net.clone(), hub_store, opts(&tmp.path().join("h0")))
+            .await
+            .unwrap(),
+    ];
+    for i in 1..5 {
+        let d = tmp.path().join(format!("h{i}"));
+        let (n, s) = node(&d, vec![hub_addr.clone()]).await;
+        hosts.push(Hosting::start(n, s, opts(&d)).await.unwrap());
+    }
+    let gd = tmp.path().join("gw");
+    let (gn, gs) = node(&gd, vec![hub_addr.clone()]).await;
+    let gateway = Hosting::start(
+        gn,
+        gs,
+        Options {
+            hosts: false,
+            timing: fast(),
+            ..Default::default()
+        },
+    )
+    .await
+    .unwrap();
+    let pd = tmp.path().join("pub");
+    let (pn, ps) = node(&pd, vec![hub_addr.clone()]).await;
+    let publisher = Hosting::start(
+        pn.clone(),
+        ps,
+        Options {
+            hosts: false,
+            timing: fast(),
+            ..Default::default()
+        },
+    )
+    .await
+    .unwrap();
+    tokio::time::sleep(Duration::from_secs(3)).await;
+
+    // 260 MiB + a bit: over the stripe threshold, five groups.
+    let site_dir = tmp.path().join("movies");
+    std::fs::create_dir_all(&site_dir).unwrap();
+    let size: u64 = 260 * 1024 * 1024 + 12_345;
+    {
+        use std::io::Write;
+        let mut f =
+            std::io::BufWriter::new(std::fs::File::create(site_dir.join("movie.mp4")).unwrap());
+        let mut buf = Vec::with_capacity(1 << 20);
+        let mut i = 0u64;
+        while i < size {
+            buf.clear();
+            let end = (i + (1 << 20)).min(size);
+            buf.extend((i..end).map(byte_at));
+            f.write_all(&buf).unwrap();
+            i = end;
+        }
+    }
+    std::fs::write(
+        site_dir.join("index.html"),
+        b"<video src=movie.mp4 controls></video>",
+    )
+    .unwrap();
+    let scanned = scan_dir(
+        &site_dir,
+        "movies",
+        &mut ScanCache::default(),
+        &mut |_, _| {},
+    )
+    .unwrap();
+    assert!(stripe::is_striped(scanned.manifest.total_bytes()));
+    let stored = scanned.manifest.stored();
+    assert!(
+        !stored.parts.is_empty(),
+        "a striped site's manifest is parted"
+    );
+    let kp = libp2p::identity::Keypair::generate_ed25519();
+    let rec = SiteRecord::sign(
+        &kp,
+        "movies",
+        &stored.hash(),
+        1,
+        scanned.manifest.total_bytes(),
+        vec![],
+    )
+    .unwrap();
+    publisher
+        .publish_scanned(&scanned, rec.clone())
+        .await
+        .unwrap();
+
+    // Every group reaches three copies, and nobody holds the whole site.
+    let started = std::time::Instant::now();
+    wait_for("three copies of every group", 300, || {
+        let h = hosts[0].clone();
+        let rec = rec.clone();
+        async move {
+            h.regossip(&rec).await;
+            h.health(&rec)
+                .await
+                .is_some_and(|x| x.groups == 5 && x.short == 0)
+        }
+    })
+    .await;
+    let secs = started.elapsed().as_secs_f64();
+    eprintln!(
+        "striped: 3 copies of {:.0} MiB placed in {secs:.1} s ({:.0} MB/s of copies over loopback)",
+        size as f64 / 1048576.0,
+        3.0 * size as f64 / secs / 1e6
+    );
+    let (layout, holders) = hosts[0].group_holders(&rec).await.unwrap();
+    assert_eq!(layout.len(), 5);
+    let mut per_host: HashMap<String, usize> = HashMap::new();
+    for hs in &holders {
+        assert_eq!(hs.len(), 3, "{holders:?}");
+        for p in hs {
+            *per_host.entry(p.clone()).or_default() += 1;
+        }
+    }
+    assert!(
+        per_host.values().all(|n| *n < 5),
+        "a host holds every group: {per_host:?}"
+    );
+
+    // The gateway serves ranges from the holders.
+    let gw_router = gateway.router();
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let gw_addr = listener.local_addr().unwrap();
+    tokio::spawn(async move { axum::serve(listener, gw_router).await.unwrap() });
+    wait_for("the gateway to know the site", 30, || {
+        let g = gateway.clone();
+        let id = rec.site_id.clone();
+        async move { g.record_for(&id).await.is_some() }
+    })
+    .await;
+    let url = format!("http://{gw_addr}/s/{}/movie.mp4", rec.site_id);
+    let client = reqwest::Client::new();
+    let mb = 1024 * 1024u64;
+    for (range, from, to) in [
+        ("bytes=0-99", 0, 99),
+        ("bytes=1048000-3146000", 1_048_000, 3_146_000),
+        (
+            &*format!("bytes={}-{}", 130 * mb - 1, 131 * mb),
+            130 * mb - 1,
+            131 * mb,
+        ),
+        ("bytes=-500", size - 500, size - 1),
+        (
+            &*format!("bytes={}-", size - 3 * mb - 7),
+            size - 3 * mb - 7,
+            size - 1,
+        ),
+        (
+            &*format!("bytes={}-{}", size - 1, size + 100),
+            size - 1,
+            size - 1,
+        ),
+    ] {
+        let r = client
+            .get(&url)
+            .header("range", range)
+            .send()
+            .await
+            .unwrap();
+        assert_eq!(r.status(), 206, "{range}");
+        assert_eq!(r.headers()["content-type"], "video/mp4");
+        assert_eq!(r.headers()["accept-ranges"], "bytes");
+        assert_eq!(
+            r.headers()["content-range"].to_str().unwrap(),
+            format!("bytes {from}-{to}/{size}"),
+            "{range}"
+        );
+        let body = r.bytes().await.unwrap();
+        assert_eq!(body.len() as u64, to - from + 1, "{range}");
+        assert!(
+            body.iter()
+                .enumerate()
+                .all(|(i, b)| *b == byte_at(from + i as u64)),
+            "{range}: wrong bytes"
+        );
+    }
+    let r = client
+        .get(&url)
+        .header("range", format!("bytes={size}-"))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(r.status(), 416);
+    assert_eq!(
+        r.headers()["content-range"].to_str().unwrap(),
+        format!("bytes */{size}")
+    );
+    // The whole file, streamed with read-ahead.
+    let t = std::time::Instant::now();
+    let r = client.get(&url).send().await.unwrap();
+    assert_eq!(r.status(), 200);
+    assert_eq!(
+        r.headers()["content-length"].to_str().unwrap(),
+        size.to_string()
+    );
+    let etag = r.headers()["etag"].to_str().unwrap().to_string();
+    let body = r.bytes().await.unwrap();
+    eprintln!(
+        "gateway: full {:.0} MiB in {:.1} s",
+        size as f64 / 1048576.0,
+        t.elapsed().as_secs_f64()
+    );
+    assert_eq!(body.len() as u64, size);
+    assert!(
+        body.iter()
+            .enumerate()
+            .step_by(4093)
+            .all(|(i, b)| *b == byte_at(i as u64))
+    );
+    let r = client
+        .get(&url)
+        .header("if-none-match", &etag)
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(r.status(), 304);
+    // If-Range with an old ETag: the whole file, not a range.
+    let r = client
+        .get(&url)
+        .header("range", "bytes=0-9")
+        .header("if-range", "\"old\"")
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(r.status(), 200);
+    drop(r);
+
+    // A holder leaves: its groups are refilled to three copies elsewhere.
+    let gone = holders[0][0].clone();
+    let idx = hosts.iter().position(|h| h.peer_id() == gone).unwrap();
+    let leaving = hosts.remove(idx);
+    leaving.stop();
+    let watcher = hosts[0].clone();
+    wait_for("groups refilled after a holder left", 300, || {
+        let h = watcher.clone();
+        let rec = rec.clone();
+        let gone = gone.clone();
+        async move {
+            h.regossip(&rec).await;
+            let Ok((_, holders)) = h.group_holders(&rec).await else {
+                return false;
+            };
+            holders
+                .iter()
+                .all(|hs| hs.len() >= 3 && !hs.contains(&gone))
+        }
+    })
+    .await;
+    let _ = pn;
+}
diff --git a/node/crates/c0mpute-core/tests/podcast_e2e.rs b/node/crates/c0mpute-core/tests/podcast_e2e.rs
index 17b0199b..ce3d6ceb 100644
--- a/node/crates/c0mpute-core/tests/podcast_e2e.rs
+++ b/node/crates/c0mpute-core/tests/podcast_e2e.rs
@@ -93,6 +93,8 @@ async fn a_published_show_is_read_and_downloaded_through_any_gateway() {
     let hub_addr = listen_addr(&hub_net).await;
     let opts = |dir: &std::path::Path| Options {
         hosts: true,
+        // Plenty of (pretend) disk: the test box may be below the free-disk floor.
+        disk_override: Some((1 << 40, 2 << 40)),
         catalog_path: Some(dir.join("catalog.json")),
         timing: fast(),
         ..Default::default()
diff --git a/node/crates/c0mpute-net/src/swarm.rs b/node/crates/c0mpute-net/src/swarm.rs
index 741d9f6b..adbbcfc6 100644
--- a/node/crates/c0mpute-net/src/swarm.rs
+++ b/node/crates/c0mpute-net/src/swarm.rs
@@ -33,6 +33,11 @@ use crate::{ChunkSource, Network, identity as id_mod};
 
 const KAD_PROTOCOL: StreamProtocol = StreamProtocol::new("/c0mpute/kad/1.0.0");
 const FETCH_PROTOCOL: StreamProtocol = StreamProtocol::new("/c0mpute/chunk-fetch/1.0.0");
+/// Same request, but the chunk travels as a CBOR byte string. Version 1 sends
+/// it as an array of integers: about 1.9x the bytes on the wire and slow to
+/// decode, which halved every chunk transfer. Peers that do not speak 2 are
+/// asked over 1.
+const FETCH2_PROTOCOL: StreamProtocol = StreamProtocol::new("/c0mpute/chunk-fetch/2.0.0");
 const RPC_PROTOCOL: StreamProtocol = StreamProtocol::new("/c0mpute/rpc/1.0.0");
 /// Largest RPC request body accepted.
 pub const RPC_MAX_REQUEST: u64 = 1024 * 1024;
@@ -160,6 +165,14 @@ enum Cmd {
         channel: request_response::ResponseChannel<RpcResponse>,
         resp: RpcResponse,
     },
+    FetchRespond {
+        channel: request_response::ResponseChannel<FetchResponse>,
+        resp: FetchResponse,
+    },
+    Fetch2Respond {
+        channel: request_response::ResponseChannel<FetchResponse2>,
+        resp: FetchResponse2,
+    },
     ConnectedPeers {
         reply: oneshot::Sender<Vec<PeerId>>,
     },
@@ -543,6 +556,7 @@ struct C0mputeBehaviour {
     identify: identify::Behaviour,
     ping: ping::Behaviour,
     fetch: request_response::cbor::Behaviour<FetchRequest, FetchResponse>,
+    fetch2: request_response::cbor::Behaviour<FetchRequest, FetchResponse2>,
     rpc: request_response::Behaviour<request_response::cbor::codec::Codec<RpcRequest, RpcResponse>>,
     gossipsub: gossipsub::Behaviour,
     mdns: libp2p::swarm::behaviour::toggle::Toggle<mdns::tokio::Behaviour>,
@@ -559,6 +573,15 @@ enum FetchResponse {
     NotFound,
 }
 
+#[derive(serde::Serialize, serde::Deserialize, Debug, Clone)]
+enum FetchResponse2 {
+    Ok {
+        #[serde(with = "cbor_bytes")]
+        bytes: Vec<u8>,
+    },
+    NotFound,
+}
+
 #[derive(serde::Serialize, serde::Deserialize, Debug, Clone)]
 struct RpcRequest {
     service: String,
@@ -627,6 +650,11 @@ struct SwarmTask {
     /// Track which chunk a fetch is for, so we can re-issue against another
     /// provider if the first one says NotFound.
     fetch_targets: HashMap<request_response::OutboundRequestId, Hash>,
+    /// Version-2 fetches in flight: who was asked, so a peer that does not
+    /// speak version 2 can be asked again over version 1.
+    pending_fetches2: HashMap<request_response::OutboundRequestId, (PeerId, Hash, oneshot::Sender<Result<Vec<u8>>>)>,
+    /// Peers that answered "unsupported protocol" to version 2.
+    fetch_v1_only: std::collections::HashSet<PeerId>,
     /// Pending outbound RPC calls.
     pending_rpcs: HashMap<request_response::OutboundRequestId, oneshot::Sender<Result<Vec<u8>>>>,
     rpc_handlers: RpcHandlers,
@@ -670,6 +698,10 @@ impl SwarmTask {
                     [(FETCH_PROTOCOL, request_response::ProtocolSupport::Full)],
                     request_response::Config::default(),
                 );
+                let fetch2 = request_response::cbor::Behaviour::<FetchRequest, FetchResponse2>::new(
+                    [(FETCH2_PROTOCOL, request_response::ProtocolSupport::Full)],
+                    request_response::Config::default(),
+                );
                 let rpc = request_response::Behaviour::with_codec(
                     request_response::cbor::codec::Codec::<RpcRequest, RpcResponse>::default()
                         .set_request_size_maximum(RPC_MAX_REQUEST)
@@ -705,6 +737,7 @@ impl SwarmTask {
                     identify,
                     ping,
                     fetch,
+                    fetch2,
                     rpc,
                     gossipsub,
                     mdns,
@@ -720,6 +753,8 @@ impl SwarmTask {
             pending_kad_lookups: HashMap::new(),
             pending_fetches: HashMap::new(),
             fetch_targets: HashMap::new(),
+            pending_fetches2: HashMap::new(),
+            fetch_v1_only: std::collections::HashSet::new(),
             pending_rpcs: HashMap::new(),
             rpc_handlers,
             cmd_weak,
@@ -827,6 +862,16 @@ impl SwarmTask {
                 self.pending_kad_lookups.insert(qid, reply);
                 debug!(chunk = %req.chunk_hash, "kad get_providers issued");
             }
+            Cmd::FetchFrom { peer, req, reply } if !self.fetch_v1_only.contains(&peer) => {
+                let request_id = self.swarm.lock().await.behaviour_mut().fetch2.send_request(
+                    &peer,
+                    FetchRequest {
+                        chunk_hash: req.chunk_hash,
+                    },
+                );
+                self.pending_fetches2.insert(request_id, (peer, req.chunk_hash, reply));
+                debug!(%peer, chunk = %req.chunk_hash, "direct chunk fetch issued (v2)");
+            }
             Cmd::FetchFrom { peer, req, reply } => {
                 let request_id = self.swarm.lock().await.behaviour_mut().fetch.send_request(
                     &peer,
@@ -856,6 +901,12 @@ impl SwarmTask {
             Cmd::RpcRespond { channel, resp } => {
                 let _ = self.swarm.lock().await.behaviour_mut().rpc.send_response(channel, resp);
             }
+            Cmd::FetchRespond { channel, resp } => {
+                let _ = self.swarm.lock().await.behaviour_mut().fetch.send_response(channel, resp);
+            }
+            Cmd::Fetch2Respond { channel, resp } => {
+                let _ = self.swarm.lock().await.behaviour_mut().fetch2.send_response(channel, resp);
+            }
             Cmd::ConnectedPeers { reply } => {
                 let peers = self.swarm.lock().await.connected_peers().copied().collect();
                 let _ = reply.send(peers);
@@ -942,6 +993,62 @@ impl SwarmTask {
                     let _ = reply.send(Err(anyhow!("fetch failed: {error}")));
                 }
             }
+            SwarmEvent::Behaviour(C0mputeBehaviourEvent::Fetch2(request_response::Event::Message {
+                message, ..
+            })) => match message {
+                request_response::Message::Request { request, channel, .. } => {
+                    // Read off the event loop: a disk read per chunk inline
+                    // here stalled every other peer's traffic behind it.
+                    let src = self.local_source.clone();
+                    let weak = self.cmd_weak.clone();
+                    tokio::spawn(async move {
+                        let resp = match src {
+                            Some(src) => match src.read_chunk(&request.chunk_hash).await {
+                                Ok(bytes) => FetchResponse2::Ok { bytes },
+                                Err(_) => FetchResponse2::NotFound,
+                            },
+                            None => FetchResponse2::NotFound,
+                        };
+                        if let Some(tx) = weak.upgrade() {
+                            let _ = tx.send(Cmd::Fetch2Respond { channel, resp }).await;
+                        }
+                    });
+                }
+                request_response::Message::Response {
+                    request_id, response, ..
+                } => {
+                    if let Some((_, _, reply)) = self.pending_fetches2.remove(&request_id) {
+                        let _ = reply.send(match response {
+                            FetchResponse2::Ok { bytes } => Ok(bytes),
+                            FetchResponse2::NotFound => Err(anyhow!("provider returned NotFound for chunk")),
+                        });
+                    }
+                }
+            },
+            SwarmEvent::Behaviour(C0mputeBehaviourEvent::Fetch2(request_response::Event::OutboundFailure {
+                request_id,
+                error,
+                ..
+            })) => {
+                if let Some((peer, hash, reply)) = self.pending_fetches2.remove(&request_id) {
+                    if matches!(error, request_response::OutboundFailure::UnsupportedProtocols) {
+                        // An older peer: ask again over version 1, and
+                        // remember not to try version 2 with it.
+                        self.fetch_v1_only.insert(peer);
+                        let id = self
+                            .swarm
+                            .lock()
+                            .await
+                            .behaviour_mut()
+                            .fetch
+                            .send_request(&peer, FetchRequest { chunk_hash: hash });
+                        self.pending_fetches.insert(id, reply);
+                        self.fetch_targets.insert(id, hash);
+                    } else {
+                        let _ = reply.send(Err(anyhow!("fetch failed: {error}")));
+                    }
+                }
+            }
             SwarmEvent::Behaviour(C0mputeBehaviourEvent::Rpc(request_response::Event::Message {
                 peer, message, ..
             })) => match message {
@@ -1104,15 +1211,20 @@ impl SwarmTask {
             request_response::Message::Request {
                 request, channel, ..
             } => {
-                let resp = match &self.local_source {
-                    Some(src) => match src.read_chunk(&request.chunk_hash).await {
-                        Ok(bytes) => FetchResponse::Ok { bytes },
-                        Err(_) => FetchResponse::NotFound,
-                    },
-                    None => FetchResponse::NotFound,
-                };
-                let mut sw = self.swarm.lock().await;
-                let _ = sw.behaviour_mut().fetch.send_response(channel, resp);
+                let src = self.local_source.clone();
+                let weak = self.cmd_weak.clone();
+                tokio::spawn(async move {
+                    let resp = match src {
+                        Some(src) => match src.read_chunk(&request.chunk_hash).await {
+                            Ok(bytes) => FetchResponse::Ok { bytes },
+                            Err(_) => FetchResponse::NotFound,
+                        },
+                        None => FetchResponse::NotFound,
+                    };
+                    if let Some(tx) = weak.upgrade() {
+                        let _ = tx.send(Cmd::FetchRespond { channel, resp }).await;
+                    }
+                });
             }
             request_response::Message::Response {
                 request_id,

From 83b8708c01b4ad1f5ffecf8474c9a155589b7f72 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@profullstack.com>
Date: Mon, 9 Nov 2026 12:46:39 +0000
Subject: [PATCH 2/8] fix: keep list_dir from the private-storage merge

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 node/crates/c0mpute-core/src/hosting/site.rs | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/node/crates/c0mpute-core/src/hosting/site.rs b/node/crates/c0mpute-core/src/hosting/site.rs
index daa989b3..77297a3a 100644
--- a/node/crates/c0mpute-core/src/hosting/site.rs
+++ b/node/crates/c0mpute-core/src/hosting/site.rs
@@ -753,6 +753,8 @@ pub fn list_dir(dir: &Path) -> Result<Vec<(String, PathBuf)>> {
     walk(dir, dir, &mut paths)?;
     paths.sort();
     Ok(paths)
+}
+
 /// Where one chunk of a scanned site lives on the publisher's disk.
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub struct ChunkLoc {

From b071799bd5bdab668536bef1afe9e8813a60c73a Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@profullstack.com>
Date: Mon, 9 Nov 2026 12:56:18 +0000
Subject: [PATCH 3/8] test(opendisk): descriptor tests pin a fixed hosting
 budget; auto budget test

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 node/crates/c0mpute-core/src/opendisk.rs | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/node/crates/c0mpute-core/src/opendisk.rs b/node/crates/c0mpute-core/src/opendisk.rs
index c28f21df..b97e6c49 100644
--- a/node/crates/c0mpute-core/src/opendisk.rs
+++ b/node/crates/c0mpute-core/src/opendisk.rs
@@ -452,7 +452,9 @@ mod tests {
 
     #[test]
     fn descriptor_is_valid_opendisk() {
-        let cfg = Config::default();
+        let mut cfg = Config::default();
+        // A fixed budget (the default, 0, follows the disk).
+        cfg.hosting.max_bytes = 5 * 1024 * 1024 * 1024;
         let key = "a".repeat(64);
         let d = descriptor(
             &cfg,
@@ -479,6 +481,14 @@ mod tests {
         assert_eq!(d["c0mpute"]["hosting"]["max_gib"], 5.0);
     }
 
+    #[test]
+    fn the_automatic_budget_follows_the_disk() {
+        let cfg = Config::default();
+        assert_eq!(cfg.hosting.max_bytes, 0);
+        let (free, total) = disk_for(&cfg.storage.root);
+        assert_eq!(hosting_budget(&cfg), crate::hosting::auto_budget(0, free, total));
+    }
+
     #[test]
     fn a_node_without_the_hosting_role_does_not_offer_hosting() {
         let mut cfg = Config::default();
@@ -495,7 +505,8 @@ mod tests {
     fn the_descriptor_parses_as_a_marketplace_hosting_disk() {
         // What d1sks stores is the descriptor under `data`; the publisher's
         // ranking reads it back as a hosting node.
-        let cfg = Config::default();
+        let mut cfg = Config::default();
+        cfg.hosting.max_bytes = 5 * 1024 * 1024 * 1024;
         let peer = c0mpute_net::libp2p::identity::Keypair::generate_ed25519()
             .public()
             .to_peer_id()

From b0779fd2a3c2b81ef7d64f57fb1e12732358719d Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@profullstack.com>
Date: Mon, 9 Nov 2026 13:21:39 +0000
Subject: [PATCH 4/8] test: striped holding fixture carries full/room_gib

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 node/crates/c0mpute-core/src/hosting/mod.rs | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/node/crates/c0mpute-core/src/hosting/mod.rs b/node/crates/c0mpute-core/src/hosting/mod.rs
index ebfa8791..6cd77313 100644
--- a/node/crates/c0mpute-core/src/hosting/mod.rs
+++ b/node/crates/c0mpute-core/src/hosting/mod.rs
@@ -2808,6 +2808,8 @@ mod tests {
             addrs: vec!["/ip4/203.0.113.7/tcp/40001".into(); 8],
             price: Some("0.004".into()),
             payout: None,
+            full: false,
+            room_gib: Some(u64::MAX),
             room: Some(u64::MAX),
         })
         .unwrap();

From 2e709ba8678a20d0b8ca76fff0205e3c147ded62 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@profullstack.com>
Date: Mon, 9 Nov 2026 13:27:13 +0000
Subject: [PATCH 5/8] test: striped e2e checks spread without a
 chance-dependent bound

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 node/crates/c0mpute-core/tests/hosting_striped_e2e.rs | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/node/crates/c0mpute-core/tests/hosting_striped_e2e.rs b/node/crates/c0mpute-core/tests/hosting_striped_e2e.rs
index f1cc862b..11b3c1c0 100644
--- a/node/crates/c0mpute-core/tests/hosting_striped_e2e.rs
+++ b/node/crates/c0mpute-core/tests/hosting_striped_e2e.rs
@@ -232,10 +232,10 @@ async fn a_large_site_stripes_serves_ranges_and_heals() {
             *per_host.entry(p.clone()).or_default() += 1;
         }
     }
-    assert!(
-        per_host.values().all(|n| *n < 5),
-        "a host holds every group: {per_host:?}"
-    );
+    // Spread over the network (with only 5 groups one host may still rank
+    // top-3 for all of them; the unit test checks that over 40 groups).
+    assert!(per_host.len() >= 4, "groups spread over the hosts: {per_host:?}");
+    assert_eq!(per_host.values().sum::<usize>(), 15);
 
     // The gateway serves ranges from the holders.
     let gw_router = gateway.router();

From cecb6eb2e53a5db823fc6fbe185f2b8d0be8f8b4 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@profullstack.com>
Date: Mon, 9 Nov 2026 12:45:49 +0000
Subject: [PATCH 6/8] feat(hosting): 4 TiB site cap on top of striped sites
 (#222)

Paid (--disks) sites go from 256 GiB to 4 TiB. Striping already caps a
site at MAX_GROUPS (8,192) groups, so past 512 GiB the group count stays
put and each group grows (512 MiB at 4 TiB): the gossip bitmap stays at
most 1 KiB and replication still streams chunks through the fetch window.
Free sites stay at 64 GiB, one file at 128 GiB.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/web/src/app/getting-started/page.tsx     |  2 +-
 docs/hosting.md                               | 14 +++++++------
 node/crates/c0mpute-cli/src/main.rs           |  4 ++--
 node/crates/c0mpute-core/src/hosting/mod.rs   |  7 ++++---
 node/crates/c0mpute-core/src/hosting/site.rs  |  8 +++++---
 .../crates/c0mpute-core/src/hosting/stripe.rs | 20 ++++++++++++-------
 6 files changed, 33 insertions(+), 22 deletions(-)

diff --git a/apps/web/src/app/getting-started/page.tsx b/apps/web/src/app/getting-started/page.tsx
index 9f743f8b..2456a525 100644
--- a/apps/web/src/app/getting-started/page.tsx
+++ b/apps/web/src/app/getting-started/page.tsx
@@ -93,7 +93,7 @@ $ c0mpute hosting ls          # sites a gateway knows, with live copy counts`}</
           <code>--name</code> to update it. Any gateway serves it at{" "}
           <code>/s/&lt;site_id&gt;/</code>, for example{" "}
           <code>https://gateway.c0mpute.com/s/&lt;site_id&gt;/</code>, with
-          byte ranges so video seeks. Limits: 64 GiB per free site, 256 GiB
+          byte ranges so video seeks. Limits: 64 GiB per free site, 4 TiB
           with <code>--disks auto</code>. Sites over 1 GiB are striped over the
           network in 64 MiB groups; run the same command again to resume an
           interrupted publish.
diff --git a/docs/hosting.md b/docs/hosting.md
index afa75c90..2e3e4c6e 100644
--- a/docs/hosting.md
+++ b/docs/hosting.md
@@ -44,7 +44,7 @@ is used for misses.
 
 | | |
 |---|---|
-| Site, paid (`--disks`, a v2 record) | 256 GiB |
+| Site, paid (`--disks`, a v2 record) | 4 TiB |
 | Site, free (v1 record) | 64 GiB |
 | Files per site | 10,000,000 |
 | One file | 128 GiB |
@@ -63,15 +63,16 @@ The budget advertised to d1sks (`max_gib`) is the same number, so `--disks auto`
 picks disks with room for their share of the site.
 
 Errors say which limit was hit and what to do (`--disks auto` for a free site over
-64 GiB, split the folder above 256 GiB). A hosting node logs the limit that made it
+64 GiB, split the folder above 4 TiB). A hosting node logs the limit that made it
 refuse a copy (`over this node's hosting budget`, `disk nearly full`, `per-owner limit`).
 
 ## Large sites: striped placement
 
 A site up to 1 GiB is replicated whole, exactly as before. Above that it is
 **striped**: its chunks are bucketed by hash into groups, one group per 64 MiB of the
-site (the count comes from the size in the signed record), and every group is placed on
-its own:
+site up to 8,192 groups (512 GiB); a bigger site keeps 8,192 groups and makes each one
+bigger (512 MiB at the 4 TiB cap), so a group bitmap on the gossip stays at most 1 KiB.
+The count comes from the size in the signed record, and every group is placed on its own:
 
 * The hosting nodes that rank highest for `(site, group)` (rendezvous hashing, the same
   answer on every node) take that group until it has three copies. No node needs the
@@ -85,14 +86,15 @@ its own:
   A node holds each group as soon as it is complete, so a restart resumes group by group.
 * Paid sites: preferred hosts take every group when there are at most three of them (a
   paid host holds the whole site), else the three that rank highest per group; each is
-  paid for its share (`size x 3 / preferred`).
+  paid for its share (`size x 3 / preferred`). A multi-TiB site therefore needs disks
+  with that much room each; `--copies 5` cuts each host's share to 60% of the site.
 * `c0mpute hosting ls` and `/hosting/v1/sites` show, for a striped site, `copies` = the
   fewest copies of any group, plus `groups`, `short_groups` and `missing_groups`.
 
 Manifests: up to 5,000 files and 1 GiB the manifest is one chunk, byte for byte what
 older nodes read. Above either, it is a root listing parts (by first path) of at most
 4,000 files and 65,536 chunk hashes each, so every part is one chunk fetch even for a
-256 GiB site; a gateway fetches only the part a request needs. Every holder of any group
+4 TiB site; a gateway fetches only the part a request needs. Every holder of any group
 keeps the root and all parts.
 
 Groups are defined over chunk hashes only (the group of a chunk is its hash modulo the
diff --git a/node/crates/c0mpute-cli/src/main.rs b/node/crates/c0mpute-cli/src/main.rs
index 11e64ef6..a35dc2b4 100644
--- a/node/crates/c0mpute-cli/src/main.rs
+++ b/node/crates/c0mpute-cli/src/main.rs
@@ -825,8 +825,8 @@ enum HostingCmd {
     /// The site is signed with this machine's identity, so only this machine
     /// can update it; publishing the same --name again ships a new version.
     /// Stays up until three hosting nodes hold copies, then exits.
-    /// Sites over 1 GiB (up to 64 GiB free, 256 GiB with --disks) are striped
-    /// over the network in 64 MiB groups; files are served from the folder
+    /// Sites over 1 GiB (up to 64 GiB free, 4 TiB with --disks) are striped
+    /// over the network in 64 MiB groups (bigger past 512 GiB); files are served from the folder
     /// itself while the network copies them, so keep it running, and run the
     /// same command again to resume if it stops.
     #[command(verbatim_doc_comment)]
diff --git a/node/crates/c0mpute-core/src/hosting/mod.rs b/node/crates/c0mpute-core/src/hosting/mod.rs
index 6cd77313..5b5e31b3 100644
--- a/node/crates/c0mpute-core/src/hosting/mod.rs
+++ b/node/crates/c0mpute-core/src/hosting/mod.rs
@@ -2788,7 +2788,7 @@ mod tests {
     #[test]
     fn a_holding_message_of_striped_sites_fits_gossipsub() {
         // Entries are packed up to HOLDING_MESSAGE_BYTES; the largest bitmap
-        // (every group of a 256 GiB site) still leaves room.
+        // (every group of a 4 TiB site, MAX_GROUPS) still leaves room.
         let all: BTreeSet<u32> = (0..stripe::group_count(site::MAX_SITE_BYTES) as u32).collect();
         let g = stripe::encode_groups(&all);
         let per = HOLDING_MESSAGE_BYTES / (120 + g.len()) + 1;
@@ -3210,9 +3210,10 @@ pub async fn publish_dir_with(
         scanned.manifest.files.len(),
         gib(record.size),
         if striped {
-            ", striped in 64 MiB groups"
+            let n = stripe::group_count(record.size) as u64;
+            format!(", striped in {n} groups of ~{} MiB", record.size.div_ceil(n) >> 20)
         } else {
-            ""
+            String::new()
         },
         record.site_id
     );
diff --git a/node/crates/c0mpute-core/src/hosting/site.rs b/node/crates/c0mpute-core/src/hosting/site.rs
index 77297a3a..3788c63b 100644
--- a/node/crates/c0mpute-core/src/hosting/site.rs
+++ b/node/crates/c0mpute-core/src/hosting/site.rs
@@ -18,8 +18,10 @@ use serde::{Deserialize, Serialize};
 /// as a CBOR integer array (about 2x on the wire and slow to decode), so
 /// small chunks keep each fetch quick and well under the 10 MiB response cap.
 pub const FILE_CHUNK_BYTES: usize = 1024 * 1024;
-/// Largest site a node will publish or replicate (with paid preferred hosts).
-pub const MAX_SITE_BYTES: u64 = 256 * GIB;
+/// Largest site a node will publish or replicate (with paid preferred hosts):
+/// 4 TiB. Striping caps a site at [`super::stripe::MAX_GROUPS`] groups, so
+/// past 512 GiB the groups grow (512 MiB each at 4 TiB) instead.
+pub const MAX_SITE_BYTES: u64 = 4 * 1024 * GIB;
 /// Largest free site (a v1 record, no preferred hosts). Volunteers hold free
 /// copies, so a free site may use at most a quarter of what a paid one may.
 pub const MAX_FREE_SITE_BYTES: u64 = 64 * GIB;
@@ -638,7 +640,7 @@ impl SiteManifest {
     /// Encode the manifest: one chunk up to [`INLINE_FILES`] files and
     /// [`STRIPE_ABOVE`] bytes (byte for byte what older nodes read), else a
     /// root plus parts of at most [`PART_FILES`] files and [`PART_CHUNKS`]
-    /// chunks, so even a 256 GiB site's chunk lists are fetched a part at a
+    /// chunks, so even a 4 TiB site's chunk lists are fetched a part at a
     /// time.
     pub fn stored(&self) -> StoredManifest {
         let m = self;
diff --git a/node/crates/c0mpute-core/src/hosting/stripe.rs b/node/crates/c0mpute-core/src/hosting/stripe.rs
index a17552c6..85d5644e 100644
--- a/node/crates/c0mpute-core/src/hosting/stripe.rs
+++ b/node/crates/c0mpute-core/src/hosting/stripe.rs
@@ -1,8 +1,9 @@
 //! Striped placement for large sites.
 //!
 //! A site at or below [`STRIPE_ABOVE`] is replicated whole, as it always was.
-//! Above it, the site's chunks are bucketed by hash into one group per 64 MiB
-//! ([`group_count`] of the signed size) and every group is placed on its own: the hosting nodes that rank
+//! Above it, the site's chunks are bucketed by hash into one group per 64 MiB,
+//! at most [`MAX_GROUPS`] ([`group_count`] of the signed size; a site over
+//! 512 GiB gets bigger groups, 512 MiB each at the 4 TiB cap) and every group is placed on its own: the hosting nodes that rank
 //! highest for `(site, group)` (rendezvous hashing, the same answer on every
 //! node) take that group. No node needs the whole site, a 50 GiB folder spreads
 //! over the whole network, and healing, copy counting, garbage collection,
@@ -22,9 +23,9 @@ use super::site::{FILE_CHUNK_BYTES, FileEntry, STRIPE_ABOVE, SiteManifest};
 
 /// Chunks per group: 64 MiB of a site.
 pub const GROUP_CHUNKS: usize = 64;
-/// Most groups any site can have (256 GiB of 1 MiB chunks, plus one partial
-/// chunk per file, in 64-chunk groups, with room to spare). Bounds the size
-/// of a group bitmap read off the gossip.
+/// Most groups any site can have: 512 GiB of 64 MiB groups. Larger sites (up
+/// to the 4 TiB cap) keep this many groups and make each one bigger, so a
+/// group bitmap read off the gossip stays at most 1 KiB.
 pub const MAX_GROUPS: usize = 8192;
 
 static THRESHOLD: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(STRIPE_ABOVE);
@@ -51,7 +52,8 @@ pub fn is_striped(size: u64) -> bool {
 /// Bytes of a site per group, on average.
 pub const GROUP_BYTES: u64 = (GROUP_CHUNKS * FILE_CHUNK_BYTES) as u64;
 
-/// How many groups a striped site of `size` bytes has: one per 64 MiB. The
+/// How many groups a striped site of `size` bytes has: one per 64 MiB, at
+/// most [`MAX_GROUPS`]. The
 /// size is in the signed record, so every node agrees without the manifest.
 pub fn group_count(size: u64) -> usize {
     (size.div_ceil(GROUP_BYTES).max(1) as usize).min(MAX_GROUPS)
@@ -354,7 +356,11 @@ mod tests {
         // Buckets are roughly even (64 chunks on average).
         assert!((0..a.len() as u32).all(|g| (20..=110).contains(&a.group(g).len())));
         assert_eq!(group_count(1), 1);
-        assert_eq!(group_count(super::super::site::MAX_SITE_BYTES), 4096);
+        assert_eq!(group_count(256 * 1024 * 1024 * 1024), 4096);
+        assert_eq!(group_count(512 * 1024 * 1024 * 1024), MAX_GROUPS);
+        // The 4 TiB cap: the group count stops at MAX_GROUPS, groups grow to 512 MiB.
+        assert_eq!(group_count(super::super::site::MAX_SITE_BYTES), MAX_GROUPS);
+        assert_eq!(super::super::site::MAX_SITE_BYTES / MAX_GROUPS as u64, 512 * 1024 * 1024);
     }
 
     #[test]

From 5b4bcb5e8a2fe4812217c318beec067ab7f35feb Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@profullstack.com>
Date: Mon, 9 Nov 2026 13:26:28 +0000
Subject: [PATCH 7/8] test: 300 GiB is a valid paid site under the 4 TiB cap

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 node/crates/c0mpute-core/src/hosting/site.rs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/node/crates/c0mpute-core/src/hosting/site.rs b/node/crates/c0mpute-core/src/hosting/site.rs
index 3788c63b..5daffdb8 100644
--- a/node/crates/c0mpute-core/src/hosting/site.rs
+++ b/node/crates/c0mpute-core/src/hosting/site.rs
@@ -1373,7 +1373,8 @@ mod tests {
         let e = check_site_size(70 * GIB, false).unwrap_err().to_string();
         assert!(e.contains("--disks auto"), "{e}");
         assert!(check_site_size(70 * GIB, true).is_ok());
-        assert!(check_site_size(300 * GIB, true).unwrap_err().to_string().contains("Split"));
+        assert!(check_site_size(300 * GIB, true).is_ok(), "300 GiB is under the 4 TiB cap");
+        assert!(check_site_size(MAX_SITE_BYTES + GIB, true).unwrap_err().to_string().contains("Split"));
     }
 
     #[test]

From ed9c10cf970d4e74d9749e097b2cc63d5baaa88d Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@profullstack.com>
Date: Mon, 9 Nov 2026 13:34:39 +0000
Subject: [PATCH 8/8] chore: bump v0.3.7 (hosting: media-size striped sites,
 Range streaming, fast replication)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 Cargo.lock                                    | 34 +++++++++----------
 Cargo.toml                                    |  2 +-
 apps/tui/package.json                         |  2 +-
 apps/web/package.json                         |  2 +-
 .../web/src/app/releases/latest.json/route.ts |  2 +-
 package.json                                  |  2 +-
 packages/captcha/package.json                 |  2 +-
 packages/shared/package.json                  |  2 +-
 plugins/ad-generator-agent/module.toml        |  2 +-
 plugins/ads-manager/module.toml               |  2 +-
 plugins/apps/module.toml                      |  2 +-
 plugins/captcha/module.toml                   |  2 +-
 plugins/coinpay/module.toml                   |  2 +-
 plugins/crawl/module.toml                     |  2 +-
 plugins/crowdgpt/module.toml                  |  2 +-
 plugins/ctv-ads/module.toml                   |  2 +-
 plugins/diffusion/module.toml                 |  2 +-
 plugins/embed/module.toml                     |  2 +-
 plugins/gameserver/module.toml                |  2 +-
 plugins/hosting/module.toml                   |  2 +-
 plugins/infernet/module.toml                  |  2 +-
 plugins/live-stream/module.toml               |  2 +-
 plugins/music/module.toml                     |  2 +-
 plugins/ocr/module.toml                       |  2 +-
 plugins/podcast-ads/module.toml               |  2 +-
 plugins/podcasting/module.toml                |  2 +-
 plugins/podcasts/module.toml                  |  2 +-
 plugins/render/module.toml                    |  2 +-
 plugins/secure-chat/module.toml               |  2 +-
 plugins/storage/module.toml                   |  2 +-
 plugins/train/module.toml                     |  2 +-
 plugins/transcode/module.toml                 |  2 +-
 plugins/tts/module.toml                       |  2 +-
 plugins/video/module.toml                     |  2 +-
 plugins/webhook/module.toml                   |  2 +-
 plugins/whisper/module.toml                   |  2 +-
 plugins/workflow-step/module.toml             |  2 +-
 37 files changed, 53 insertions(+), 53 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index bb3ff2ab..1ed4038c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -486,7 +486,7 @@ checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 
 [[package]]
 name = "c0mpute-api"
-version = "0.3.6"
+version = "0.3.7"
 dependencies = [
  "anyhow",
  "c0mpute-proto",
@@ -501,7 +501,7 @@ dependencies = [
 
 [[package]]
 name = "c0mpute-bench"
-version = "0.3.6"
+version = "0.3.7"
 dependencies = [
  "anyhow",
  "blake3",
@@ -512,7 +512,7 @@ dependencies = [
 
 [[package]]
 name = "c0mpute-cli"
-version = "0.3.6"
+version = "0.3.7"
 dependencies = [
  "anyhow",
  "axum",
@@ -546,7 +546,7 @@ dependencies = [
 
 [[package]]
 name = "c0mpute-core"
-version = "0.3.6"
+version = "0.3.7"
 dependencies = [
  "aes-gcm",
  "anyhow",
@@ -597,7 +597,7 @@ dependencies = [
 
 [[package]]
 name = "c0mpute-doctor"
-version = "0.3.6"
+version = "0.3.7"
 dependencies = [
  "anyhow",
  "serde",
@@ -609,7 +609,7 @@ dependencies = [
 
 [[package]]
 name = "c0mpute-envelope"
-version = "0.3.6"
+version = "0.3.7"
 dependencies = [
  "blake3",
  "bs58",
@@ -622,7 +622,7 @@ dependencies = [
 
 [[package]]
 name = "c0mpute-gateway"
-version = "0.3.6"
+version = "0.3.7"
 dependencies = [
  "anyhow",
  "axum",
@@ -644,7 +644,7 @@ dependencies = [
 
 [[package]]
 name = "c0mpute-market"
-version = "0.3.6"
+version = "0.3.7"
 dependencies = [
  "c0mpute-envelope",
  "serde",
@@ -654,7 +654,7 @@ dependencies = [
 
 [[package]]
 name = "c0mpute-net"
-version = "0.3.6"
+version = "0.3.7"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -672,7 +672,7 @@ dependencies = [
 
 [[package]]
 name = "c0mpute-placement"
-version = "0.3.6"
+version = "0.3.7"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -693,7 +693,7 @@ dependencies = [
 
 [[package]]
 name = "c0mpute-proto"
-version = "0.3.6"
+version = "0.3.7"
 dependencies = [
  "blake3",
  "hex",
@@ -705,7 +705,7 @@ dependencies = [
 
 [[package]]
 name = "c0mpute-sealed"
-version = "0.3.6"
+version = "0.3.7"
 dependencies = [
  "aes",
  "aes-gcm",
@@ -727,7 +727,7 @@ dependencies = [
 
 [[package]]
 name = "c0mpute-secure-chat"
-version = "0.3.6"
+version = "0.3.7"
 dependencies = [
  "aes-gcm",
  "anyhow",
@@ -750,7 +750,7 @@ dependencies = [
 
 [[package]]
 name = "c0mpute-store"
-version = "0.3.6"
+version = "0.3.7"
 dependencies = [
  "anyhow",
  "blake3",
@@ -768,7 +768,7 @@ dependencies = [
 
 [[package]]
 name = "c0mpute-transcode"
-version = "0.3.6"
+version = "0.3.7"
 dependencies = [
  "anyhow",
  "c0mpute-proto",
@@ -781,7 +781,7 @@ dependencies = [
 
 [[package]]
 name = "c0mpute-update"
-version = "0.3.6"
+version = "0.3.7"
 dependencies = [
  "anyhow",
  "hex",
@@ -796,7 +796,7 @@ dependencies = [
 
 [[package]]
 name = "c0mpute-verify"
-version = "0.3.6"
+version = "0.3.7"
 dependencies = [
  "anyhow",
  "blake3",
diff --git a/Cargo.toml b/Cargo.toml
index a59cc73c..ed7ea4f9 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -24,7 +24,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.3.6"
+version = "0.3.7"
 edition = "2024"
 license = "MIT"
 repository = "https://github.com/profullstack/c0mpute"
diff --git a/apps/tui/package.json b/apps/tui/package.json
index b7fe7a9c..8f3b4ff5 100644
--- a/apps/tui/package.json
+++ b/apps/tui/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@c0mpute/tui",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "private": true,
   "type": "module",
   "bin": {
diff --git a/apps/web/package.json b/apps/web/package.json
index de9fb97c..7ae4b78d 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -1,6 +1,6 @@
 {
   "name": "c0mpute",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "private": true,
   "type": "module",
   "scripts": {
diff --git a/apps/web/src/app/releases/latest.json/route.ts b/apps/web/src/app/releases/latest.json/route.ts
index d02f75ef..fcf78e57 100644
--- a/apps/web/src/app/releases/latest.json/route.ts
+++ b/apps/web/src/app/releases/latest.json/route.ts
@@ -28,7 +28,7 @@ export const dynamic = "force-dynamic";
  * this in sync with the workspace version in `Cargo.toml` on each release so a
  * freshly built CLI reports "already latest" rather than a phantom upgrade.
  */
-const FALLBACK_VERSION = "0.3.6";
+const FALLBACK_VERSION = "0.3.7";
 const FALLBACK_MIN_REQUIRED = "0.0.1";
 
 type Channel = "stable" | "beta" | "nightly";
diff --git a/package.json b/package.json
index 106c219d..6b0869fe 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "c0mpute-monorepo",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "private": true,
   "workspaces": [
     "apps/*",
diff --git a/packages/captcha/package.json b/packages/captcha/package.json
index 0f369a5d..13c65f53 100644
--- a/packages/captcha/package.json
+++ b/packages/captcha/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@profullstack/c0mpute-captcha",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "description": "Solve image, slider, gap, click-text, audio and math captchas on the c0mpute network: library (fetch().then(solveCaptcha)), CLI and stdio MCP server.",
   "type": "module",
   "license": "MIT",
diff --git a/packages/shared/package.json b/packages/shared/package.json
index ddc1005f..096b7983 100644
--- a/packages/shared/package.json
+++ b/packages/shared/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@c0mpute/shared",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "private": true,
   "type": "module",
   "main": "./dist/index.js",
diff --git a/plugins/ad-generator-agent/module.toml b/plugins/ad-generator-agent/module.toml
index 2179e311..59949184 100644
--- a/plugins/ad-generator-agent/module.toml
+++ b/plugins/ad-generator-agent/module.toml
@@ -21,7 +21,7 @@
 [module]
 id          = "ad-generator-agent"
 name        = "Ad Generator Agent — every ad type from one URL"
-version     = "0.3.6"
+version     = "0.3.7"
 kind        = "service"
 category    = "applications"
 status      = "available"
diff --git a/plugins/ads-manager/module.toml b/plugins/ads-manager/module.toml
index 6d42430d..0326adc7 100644
--- a/plugins/ads-manager/module.toml
+++ b/plugins/ads-manager/module.toml
@@ -38,7 +38,7 @@
 [module]
 id          = "ads-manager"
 name        = "Ads Manager — shared ad operations layer"
-version     = "0.3.6"
+version     = "0.3.7"
 kind        = "service"
 category    = "applications"
 status      = "partial"
diff --git a/plugins/apps/module.toml b/plugins/apps/module.toml
index 4468bab4..8fd03b16 100644
--- a/plugins/apps/module.toml
+++ b/plugins/apps/module.toml
@@ -18,7 +18,7 @@
 [module]
 id          = "apps"
 name        = "Apps — backends with 3x redundancy"
-version     = "0.3.6"
+version     = "0.3.7"
 kind        = "workload"
 category    = "infrastructure"
 status      = "available"
diff --git a/plugins/captcha/module.toml b/plugins/captcha/module.toml
index d914104e..a26dc6c4 100644
--- a/plugins/captcha/module.toml
+++ b/plugins/captcha/module.toml
@@ -22,7 +22,7 @@
 [module]
 id          = "captcha"
 name        = "Captcha — image, slider, audio and math solving"
-version     = "0.3.6"
+version     = "0.3.7"
 kind        = "workload"
 category    = "ai"
 status      = "available"
diff --git a/plugins/coinpay/module.toml b/plugins/coinpay/module.toml
index 854388f0..261808f1 100644
--- a/plugins/coinpay/module.toml
+++ b/plugins/coinpay/module.toml
@@ -7,7 +7,7 @@
 [module]
 id          = "coinpay"
 name        = "CoinPay — DID, payments, escrow, reputation"
-version     = "0.3.6"
+version     = "0.3.7"
 kind        = "service"
 category    = "applications"
 status      = "available"
diff --git a/plugins/crawl/module.toml b/plugins/crawl/module.toml
index 2d052560..6f975cb0 100644
--- a/plugins/crawl/module.toml
+++ b/plugins/crawl/module.toml
@@ -8,7 +8,7 @@
 [module]
 id          = "crawl"
 name        = "Crawl — distributed web fetching"
-version     = "0.3.6"
+version     = "0.3.7"
 kind        = "workload"
 category    = "data"
 status      = "available"
diff --git a/plugins/crowdgpt/module.toml b/plugins/crowdgpt/module.toml
index 39a70c92..a9d415d6 100644
--- a/plugins/crowdgpt/module.toml
+++ b/plugins/crowdgpt/module.toml
@@ -43,7 +43,7 @@
 [module]
 id          = "crowdgpt"
 name        = "CrowdGPT: donate idle compute"
-version     = "0.3.6"
+version     = "0.3.7"
 kind        = "donation"
 category    = "ai"
 status      = "available"
diff --git a/plugins/ctv-ads/module.toml b/plugins/ctv-ads/module.toml
index cc2909fe..2cc0a1c8 100644
--- a/plugins/ctv-ads/module.toml
+++ b/plugins/ctv-ads/module.toml
@@ -28,7 +28,7 @@
 [module]
 id          = "ctv-ads"
 name        = "CTV Ads — VAST and VMAP from every gateway"
-version     = "0.3.6"
+version     = "0.3.7"
 kind        = "service"
 category    = "applications"
 status      = "partial"
diff --git a/plugins/diffusion/module.toml b/plugins/diffusion/module.toml
index 456db20f..c225cba9 100644
--- a/plugins/diffusion/module.toml
+++ b/plugins/diffusion/module.toml
@@ -11,7 +11,7 @@
 [module]
 id          = "diffusion"
 name        = "Diffusion — image generation"
-version     = "0.3.6"
+version     = "0.3.7"
 kind        = "workload"
 category    = "ai"
 status      = "available"
diff --git a/plugins/embed/module.toml b/plugins/embed/module.toml
index 6ea0b910..9885e09f 100644
--- a/plugins/embed/module.toml
+++ b/plugins/embed/module.toml
@@ -19,7 +19,7 @@
 [module]
 id          = "embed"
 name        = "Embeddings — vector generation"
-version     = "0.3.6"
+version     = "0.3.7"
 kind        = "workload"
 category    = "ai"
 status      = "available"
diff --git a/plugins/gameserver/module.toml b/plugins/gameserver/module.toml
index 20ab9e6b..f1fe5906 100644
--- a/plugins/gameserver/module.toml
+++ b/plugins/gameserver/module.toml
@@ -55,7 +55,7 @@
 [module]
 id          = "gameserver"
 name        = "Game server — Minecraft / Factorio / Valheim"
-version     = "0.3.6"
+version     = "0.3.7"
 kind        = "workload"
 category    = "infrastructure"
 status      = "available"
diff --git a/plugins/hosting/module.toml b/plugins/hosting/module.toml
index ebeb4a92..f37378ad 100644
--- a/plugins/hosting/module.toml
+++ b/plugins/hosting/module.toml
@@ -30,7 +30,7 @@
 [module]
 id          = "hosting"
 name        = "Hosting — p2p static sites"
-version     = "0.3.6"
+version     = "0.3.7"
 kind        = "service"
 category    = "data"
 status      = "available"
diff --git a/plugins/infernet/module.toml b/plugins/infernet/module.toml
index 4cf01b3a..0b1411b5 100644
--- a/plugins/infernet/module.toml
+++ b/plugins/infernet/module.toml
@@ -22,7 +22,7 @@
 [module]
 id          = "infernet"
 name        = "Infernet Protocol — AI inference"
-version     = "0.3.6"
+version     = "0.3.7"
 kind        = "workload"
 category    = "ai"
 status      = "available"
diff --git a/plugins/live-stream/module.toml b/plugins/live-stream/module.toml
index 2705fcd0..96b77efb 100644
--- a/plugins/live-stream/module.toml
+++ b/plugins/live-stream/module.toml
@@ -34,7 +34,7 @@
 [module]
 id          = "live-stream"
 name        = "Live Stream — p2p HLS live streaming"
-version     = "0.3.6"
+version     = "0.3.7"
 kind        = "service"
 category    = "media"
 status      = "available"
diff --git a/plugins/music/module.toml b/plugins/music/module.toml
index 2eb7fcdb..9caecb52 100644
--- a/plugins/music/module.toml
+++ b/plugins/music/module.toml
@@ -15,7 +15,7 @@
 [module]
 id          = "music"
 name        = "Music — song generation (ACE-Step 1.5)"
-version     = "0.3.6"
+version     = "0.3.7"
 kind        = "workload"
 category    = "ai"
 status      = "available"
diff --git a/plugins/ocr/module.toml b/plugins/ocr/module.toml
index b143ff81..6742cce9 100644
--- a/plugins/ocr/module.toml
+++ b/plugins/ocr/module.toml
@@ -19,7 +19,7 @@
 [module]
 id          = "ocr"
 name        = "OCR — document text extraction"
-version     = "0.3.6"
+version     = "0.3.7"
 kind        = "workload"
 category    = "ai"
 status      = "available"
diff --git a/plugins/podcast-ads/module.toml b/plugins/podcast-ads/module.toml
index 54005025..73d4c612 100644
--- a/plugins/podcast-ads/module.toml
+++ b/plugins/podcast-ads/module.toml
@@ -31,7 +31,7 @@
 [module]
 id          = "podcast-ads"
 name        = "Podcast Ads — dynamic ad insertion"
-version     = "0.3.6"
+version     = "0.3.7"
 kind        = "service"
 category    = "applications"
 status      = "partial"
diff --git a/plugins/podcasting/module.toml b/plugins/podcasting/module.toml
index c26abf18..3d20208f 100644
--- a/plugins/podcasting/module.toml
+++ b/plugins/podcasting/module.toml
@@ -24,7 +24,7 @@
 [module]
 id          = "podcasting"
 name        = "Podcasting — p2p podcast publishing"
-version     = "0.3.6"
+version     = "0.3.7"
 kind        = "service"
 category    = "media"
 status      = "available"
diff --git a/plugins/podcasts/module.toml b/plugins/podcasts/module.toml
index cfff6167..c7a4642f 100644
--- a/plugins/podcasts/module.toml
+++ b/plugins/podcasts/module.toml
@@ -24,7 +24,7 @@
 [module]
 id          = "podcasts"
 name        = "Podcasts — p2p podcast listener"
-version     = "0.3.6"
+version     = "0.3.7"
 kind        = "service"
 category    = "media"
 status      = "available"
diff --git a/plugins/render/module.toml b/plugins/render/module.toml
index 281c466b..0afbca39 100644
--- a/plugins/render/module.toml
+++ b/plugins/render/module.toml
@@ -33,7 +33,7 @@
 [module]
 id          = "render"
 name        = "Render — Blender 3D rendering"
-version     = "0.3.6"
+version     = "0.3.7"
 kind        = "workload"
 category    = "media"
 status      = "available"
diff --git a/plugins/secure-chat/module.toml b/plugins/secure-chat/module.toml
index 151a352e..8b5fba9f 100644
--- a/plugins/secure-chat/module.toml
+++ b/plugins/secure-chat/module.toml
@@ -21,7 +21,7 @@
 [module]
 id          = "secure-chat"
 name        = "Secure Chat — E2E encrypted p2p messaging"
-version     = "0.3.6"
+version     = "0.3.7"
 kind        = "service"
 category    = "applications"
 status      = "available"
diff --git a/plugins/storage/module.toml b/plugins/storage/module.toml
index a8fe7ad7..3864f201 100644
--- a/plugins/storage/module.toml
+++ b/plugins/storage/module.toml
@@ -20,7 +20,7 @@
 [module]
 id          = "storage"
 name        = "Storage — Reed-Solomon shard service"
-version     = "0.3.6"
+version     = "0.3.7"
 kind        = "service"
 category    = "data"
 status      = "available"
diff --git a/plugins/train/module.toml b/plugins/train/module.toml
index f32bf09c..daaf38e6 100644
--- a/plugins/train/module.toml
+++ b/plugins/train/module.toml
@@ -55,7 +55,7 @@
 [module]
 id          = "train"
 name        = "Fine-tune — LoRA training"
-version     = "0.3.6"
+version     = "0.3.7"
 kind        = "workload"
 category    = "ai"
 status      = "available"
diff --git a/plugins/transcode/module.toml b/plugins/transcode/module.toml
index 7b3e1fec..2ff9de37 100644
--- a/plugins/transcode/module.toml
+++ b/plugins/transcode/module.toml
@@ -7,7 +7,7 @@
 [module]
 id          = "transcode"
 name        = "FFmpeg Transcoding"
-version     = "0.3.6"
+version     = "0.3.7"
 kind        = "workload"
 category    = "media"
 status      = "available"
diff --git a/plugins/tts/module.toml b/plugins/tts/module.toml
index b0efd7f6..9cc3fb9f 100644
--- a/plugins/tts/module.toml
+++ b/plugins/tts/module.toml
@@ -15,7 +15,7 @@
 [module]
 id          = "tts"
 name        = "TTS — text-to-speech"
-version     = "0.3.6"
+version     = "0.3.7"
 kind        = "workload"
 category    = "ai"
 status      = "available"
diff --git a/plugins/video/module.toml b/plugins/video/module.toml
index 64d0f860..44b80e82 100644
--- a/plugins/video/module.toml
+++ b/plugins/video/module.toml
@@ -65,7 +65,7 @@
 [module]
 id          = "video"
 name        = "Video — generation (Wan 2.2, Wan 2.1 1.3B on 8 GiB or CPU, LTX-2.3 with audio)"
-version     = "0.3.6"
+version     = "0.3.7"
 kind        = "workload"
 category    = "ai"
 status      = "available"
diff --git a/plugins/webhook/module.toml b/plugins/webhook/module.toml
index 76f19095..a03d2b01 100644
--- a/plugins/webhook/module.toml
+++ b/plugins/webhook/module.toml
@@ -7,7 +7,7 @@
 [module]
 id          = "webhook"
 name        = "Webhooks — paid, end-to-end encrypted delivery"
-version     = "0.3.6"
+version     = "0.3.7"
 kind        = "workload"
 category    = "infrastructure"
 status      = "available"
diff --git a/plugins/whisper/module.toml b/plugins/whisper/module.toml
index f58542b6..bf31c1b7 100644
--- a/plugins/whisper/module.toml
+++ b/plugins/whisper/module.toml
@@ -7,7 +7,7 @@
 [module]
 id          = "whisper"
 name        = "Whisper — speech-to-text"
-version     = "0.3.6"
+version     = "0.3.7"
 kind        = "workload"
 category    = "ai"
 status      = "available"
diff --git a/plugins/workflow-step/module.toml b/plugins/workflow-step/module.toml
index 7c25255d..64445e2e 100644
--- a/plugins/workflow-step/module.toml
+++ b/plugins/workflow-step/module.toml
@@ -14,7 +14,7 @@
 [module]
 id          = "workflow-step"
 name        = "Workflow step — webhook workflow steps (meshhook)"
-version     = "0.3.6"
+version     = "0.3.7"
 kind        = "workload"
 category    = "infrastructure"
 status      = "available"