Module streamer 

The Streamer consumption face (#1848): stream one blob’s verified, contiguous front to a consumer as it arrives, paced by consumption and bounded to one read-ahead window ahead of the read cursor. A fetch-like single-blob face over the same engine, with no chunk dedup. The Streamer consumption face (#1848): stream one blob’s verified, contiguous front to a consumer AS IT ARRIVES, paced by how fast the consumer reads — a fetch-like, single-blob face (no chunk dedup, unlike the Downloader).

One engine, two faces: the Streamer is an OUTPUT + SCHEDULING adapter over the same paid pull engine, not a second engine. It drives the fetch through the multi-source core with a [crate::pacer::WindowPacer] whose window is the caller’s PullConfig::read_ahead_bytes and whose downstream frontier is the CONSUMER’S read cursor. So the pull never runs more than the read-ahead bound ahead of what the consumer has read — fetch (and pay for) a two-hour movie’s first read_ahead_bytes only, for a viewer who stops after five minutes.

Streamer::open returns two halves. The StreamDrive is the fetch itself; the caller polls it for the whole stream, independently of reads, so an open paid leg keeps paying and draining while the consumer is slow or paused (a leg left unpolled would miss its voucher deadlines and fault). The window, not the reads, bounds how far it runs. VerifiedReader is the tokio::io::AsyncRead the caller drains. Its cursor is clamped to the store’s verified contiguous frontier BY CONSTRUCTION: it only ever reads bytes the engine has already bao-verified into the store, so a tampered chunk group fails the pull and surfaces as a read error rather than ever reaching the consumer.

Structs

LiveReader

The live half of a VerifiedReader: it reads the verified prefix out of the fill store as the paired StreamDrive lands it, and advances the cursor the drive paces on.

StreamCandidate

One provider’s paid lane: the paid source plus the (ctx, ledger) that pays it. A [SourceProvider] builds one per holder, and both faces fetch across them.

StreamDrive

The fetch half of an open stream: a Future that pulls the blob into the fill store, paced on the reader’s cursor, and resolves once the fetch ends. Its outcome reaches the consumer through the VerifiedReader: a failure surfaces as a read error after the verified prefix before it.

Streamer

Stream a single blob’s verified front to a consumer, paced by consumption.

Enums

VerifiedReader

An AsyncRead over a blob’s verified contiguous front, clamped to the verified frontier by construction (it only reads bytes the engine has already bao-verified). Its cursor paces the paired StreamDrive.