feat(node): the operator can close uploading to everyone but themselves

A group where every member may add files stays the default. Some groups want a
library the operator curates, and until now the only way to get one was to
designate no upload root at all — which refuses the operator too.

**The node enforces it; the interface merely stops offering it.** The Upload
button in the Files toolbar and the paperclip in the chat composer both
disappear, which is a courtesy to the people who are not trying. The control is
`_do_file_upload` refusing with `member_upload_off`, so a member on an old tab,
or one speaking MNP directly, gets the same answer. There is a test for each,
and the enforcement test is in the node package rather than beside the UI one so
nobody reads the hidden button as the mechanism.

**Changing it is a signed operator instruction** — `OP_MEMBER_UPLOAD`, on the
same path as removing a member. An unsigned one would let any member turn it
back on and make the setting a suggestion. The transcript's subject is `on` or
`off`: what the operator is shown before signing has to name the outcome, not
the operation.

**It lives on the node**, in a new `group_settings` table in `roster.db`. Not
the hub, which has no business deciding who may write to someone else's disk.
Not `node.toml` either: that file is hand-written and full of comments recording
decisions, `ops.py` appends to it rather than round-tripping it through a
writer, and a setting toggled from a panel must not rewrite the operator's file
or need a restart. The value is cached in the group context because the upload
path is synchronous, and the signed operation updates both — storing it without
applying it would make the panel say one thing while the node did another.

**Absent means allowed**, at every layer: no row in the table, no key in the
context, no field in `handshake_ack`. An older node and an older client both
behave exactly as before, and upgrading never silently closes a group. Each of
those three has its own test, because they fail independently.

The operator is always exempt — otherwise turning it off locks them out of their
own node with a config file and a restart as the only way back. `is_node_admin`
was being computed in two places by then and is now one function, since two
copies of "is this the operator" is how the ack and the gate come to disagree.

A change reaches everyone already connected via `member_upload_ack`, so the
button goes without a reconnection. That message is both a broadcast and the
reply to the request that caused it, which is why the client does not return
early on it.

Docs updated for a cold start: draft-v6 §2.1b and change 9, a new "Where Phase
13 stands" section in CLAUDE.md recording what is built, deployed and still
missing, the module map row, and desktop-client-v1 §10b on the Settings tab and
where group settings live.

883 tests pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

22 files changed, 691 insertions, 3 deletions

diff --git a/CLAUDE.md b/CLAUDE.md
index a5469a1..9f63595 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -246,6 +246,28 @@ keypair bundle, or anything that looks like a user's public key.
   the group named in the invitation (an operator pairs node-wide while opening a
   group)
 
+## Where Phase 13 stands (2026-08-19)
+
+Stages A–D are **built and running**, not designed. `docs/desktop-client-v1.md` is still
+the decision record; the sections below it describe what was decided, and this says what
+exists.
+
+- Built: named roots, `ops.py` + CLI, device linking and hub device auth, the Electron
+  client (protocol handler, CSP header, `safeStorage` keys, streamed downloads to disk,
+  native folder picker), the group Settings tab, per-account resume positions, uploads
+  the operator can close
+- Deployed: the hub runs MNP 0.3 with migration `e5a2b7d31f88`. **The SPA served in
+  production is older than this tree** — check `/a/<hash>/` against
+  `meshbay_hub.api.webapp.ASSET_V` before concluding a fix is missing. `site/` and the
+  Caddy config have never been deployed
+- Not built: D5 (node management panel), D6 (first-run wizard), D8 (`.deb`/`.rpm` — the
+  package must ship `chrome-sandbox` root-owned 4755), D9 (Python sidecar `group://`),
+  D10 (video thumbnails), D11 (Windows), D12 (release key and repo)
+- One UI source: `packages/meshbay-hub/src/meshbay_hub/static/` is the interface, for the
+  web and the app alike. `packages/meshbay-client/build/sync-ui.js` copies it and CI
+  fails if the copy drifts — **never edit `packages/meshbay-client/ui/` by hand**
+- Throwaway `e2e*` accounts accumulate on the production hub; the operator deletes them
+
 ## Desktop client — decided, not built (2026-08-17)
 
 See `docs/desktop-client-v1.md`. Nothing here is implemented; it is the design and the
@@ -685,6 +707,7 @@ SFR residential Fedora 44 → meshbay.org OVH VPS:
 | Streamed download (browser) | `static/downloads.js` + `static/sw.js` | Needs the page *controlled*, and the worker confirms it served the request |
 | Leave a group (hub) | `meshbay_hub.api.groups` | `POST /v1/groups/{id}/leave` — self only; the owner is refused |
 | Public group cap (hub) | `meshbay_hub.api.groups` | `_check_public_group_quota` — 10 live public groups per owner, staff exempt. **Checked at creation only, because PATCH refuses to change visibility** |
+| Uploads on/off (node) | `meshbay_node.roster` + `transport.webrtc_server` | `member_upload_allowed` / `set_member_upload`, gate in `_do_file_upload`. Per group, **operator-signed** (`OP_MEMBER_UPLOAD`), stored in `roster.db`, cached in the group context because the upload path is synchronous. **Absent means allowed** at every layer |
 | Node presence (hub) | `meshbay_hub.api.groups` | `node_online` on `/v1/groups/mine`, read from the signaling registry — no poll, no timer |
 | Chat paging (node) | `meshbay_node.chat.store` | `get_recent` / `get_before` / `has_before`. `get_messages` pages *forwards* and is not what a chat opens with |
 | Liveness (MNP) | `meshbay_common.protocol` | `PING`/`PONG` on an **already-open** channel; never for discovery — a handshake costs 0.6-7 s |
diff --git a/docs/desktop-client-v1.md b/docs/desktop-client-v1.md
index c0bbb90..08dd548 100644
--- a/docs/desktop-client-v1.md
+++ b/docs/desktop-client-v1.md
@@ -1091,6 +1091,23 @@ Deletions enabled once native is the recommended client are unchanged from
 
 ---
 
+## 10b. Group settings, and where they live
+
+The group tab that was "Members" is **"Settings"**, and it is where anything about the
+group is administered: invitations, operator pairing, your devices on this node, whether
+members may upload, leaving or deleting the group, and the roster — last, because it is
+the only part with no upper bound.
+
+Two rules came out of building it and both are easy to undo by accident:
+
+- **The tab bar does not wait for the node.** Membership is hub-side. Gating the tab on a
+  live connection makes "leave this group" unreachable exactly when a node is down, which
+  is when someone most wants it. Sections that do need the node say so.
+- **A setting that governs the node is stored on the node and enforced by the node.**
+  `member_upload` is the worked example: signed operator instruction, row in `roster.db`,
+  refusal in `_do_file_upload`. Hiding the Upload button and the chat paperclip is a
+  courtesy to people who are not trying; it is not the control. See draft-v6 §2.1b.
+
 ## 11. Open items, each needing its own review
 
 | # | Item | Why it is not decided here |
diff --git a/docs/meshbay-draft-v6.md b/docs/meshbay-draft-v6.md
index 6a161cd..2ea73c4 100644
--- a/docs/meshbay-draft-v6.md
+++ b/docs/meshbay-draft-v6.md
@@ -42,6 +42,7 @@
 | 6 | Portability | exFAT/NTFS and Windows are the **common** case. Case folding and Unicode normalization become correctness requirements, not compatibility notes | E8 / decision 12 |
 | 7 | Accounts | Native registration is **hybrid**: passphrase-derived `auth_key` (the recovery path) plus a device Ed25519 key for day-to-day authentication | E3 / decision 4 |
 | 8 | Authorship | Chat senders are **cryptographically authenticated to each other**; an upload has a **provable owner** who may delete it, as the operator may. v5's node-asserted attribution is replaced | operator decision, §2.4b |
+| 9 | Node authority | The operator may **close uploading to everyone but themselves**, per group. Signed MNP op, stored on the node, enforced by the node — the hidden button is a courtesy, the refusal is the control | §2.1b |
 
 ---
 
@@ -67,6 +68,39 @@ v5's rule that nothing derived is written beside the originals is **unchanged**,
 decides the video-thumbnail question: a frame grab is produced on demand and cached on the
 device that asked, so the node keeps no thumbnail store.
 
+### 2.1b §5.2 Uploads — the operator may close them
+
+New. A group where every member may add files is the default and stays the default;
+some groups want a library the operator curates, and until now the only way to get one
+was to designate no upload root at all, which refuses the operator too.
+
+`member_upload` is a per-group setting, and three things about it are load-bearing:
+
+- **It lives on the node**, in `roster.db`, not in `node.toml` and not on the hub. Not
+  the hub because a hub that decides who may write to someone else's disk has authority
+  over that node, which is the arrangement this design exists to avoid (change 5). Not
+  `node.toml` because that file is hand-written, full of comments recording decisions,
+  and `ops.py` deliberately appends to it rather than round-tripping it through a
+  writer — a setting changed from a panel must not rewrite the operator's file, and must
+  not need a restart.
+- **Changing it is a signed operator instruction** (`OP_MEMBER_UPLOAD`, MNP
+  `member_upload`), on the same path as removing a member. An unsigned one would let any
+  member turn it back on, which makes the control a suggestion. The transcript's subject
+  is `on` or `off` — what the operator is shown before signing has to name the outcome,
+  not the operation.
+- **The node enforces it**; the interface merely stops offering it. `handshake_ack`
+  carries `member_upload` so a client knows whether to draw the Upload button and the
+  chat paperclip, and the node broadcasts `member_upload_ack` to everyone connected when
+  it changes. None of that is the control: a member on an old tab, or one speaking MNP
+  directly, is refused by the node with `member_upload_off`.
+
+**Absent means allowed**, at every layer — no row in `group_settings`, no key in the
+group context, no field in the ack. A node or client that predates the setting behaves
+exactly as it did, and an upgrade never silently closes a group.
+
+The operator is always exempt. Turning it off otherwise locks them out of their own
+node, with a config file and a restart as the only way back.
+
 ### 2.2 §5.5 Admission — devices, not one key per person
 
 v5 and `invite-pairing-v1.md` bind **one** key pair to an account per node: `identities`
diff --git a/packages/meshbay-common/src/meshbay_common/adminop.py b/packages/meshbay-common/src/meshbay_common/adminop.py
index 4e28f65..a793471 100644
--- a/packages/meshbay-common/src/meshbay_common/adminop.py
+++ b/packages/meshbay-common/src/meshbay_common/adminop.py
@@ -45,6 +45,10 @@ OP_MEMBER_REVOKE = "member_revoke"
 OP_GEK_ROTATE = "gek_rotate"
 # Forgetting a pinned identity, so someone can pair again after losing a device.
 OP_MEMBER_UNPIN = "member_unpin"
+# Turning uploading by ordinary members on or off. Signed like the rest: the
+# setting decides who may write to the operator's disk, so a node that took it
+# from an unsigned message would let any member re-enable it for everyone.
+OP_MEMBER_UPLOAD = "member_upload"
 # OP_GEK_BUNDLE_STORE is gone. Members no longer hand the node key material at
 # all: the node holds the GEK and wraps it itself, for a key the recipient proved
 # they hold (see `join.py` and docs/invite-pairing-v1.md). The operation existed
diff --git a/packages/meshbay-common/src/meshbay_common/protocol.py b/packages/meshbay-common/src/meshbay_common/protocol.py
index bbdff63..1c6dd3e 100644
--- a/packages/meshbay-common/src/meshbay_common/protocol.py
+++ b/packages/meshbay-common/src/meshbay_common/protocol.py
@@ -78,6 +78,8 @@ class MNP:
     MEMBER_REVOKE_ACK    = "member_revoke_ack"
     MEMBER_UNPIN         = "member_unpin"          # operator → node: forget an identity
     MEMBER_UNPIN_ACK     = "member_unpin_ack"
+    MEMBER_UPLOAD        = "member_upload"         # operator → node: may members upload?
+    MEMBER_UPLOAD_ACK    = "member_upload_ack"
     # Device linking. A new device files a request bound to a code it displays;
     # an already-pinned device of the same account approves it. Neither the hub
     # nor the node can produce the countersignature.
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/app.js b/packages/meshbay-hub/src/meshbay_hub/static/app.js
index 62bbfa5..0843d1d 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/app.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/app.js
@@ -1304,6 +1304,10 @@ function GroupPage({ groupId, group, token, username, userId, onRefreshAuth,
   const [nodeRoots, setNodeRoots] = useState([]);
 
   const [isNodeAdmin, setIsNodeAdmin] = useState(false);
+  // Whether ordinary members may upload here. The node decides and enforces it;
+  // this only says whether to offer the controls. Defaults to true so a node
+  // that predates the setting behaves as it always did.
+  const [memberUpload, setMemberUpload] = useState(true);
   // Paired ≠ operator account. `is_node_admin` says the hub account owning this
   // node is the one connecting; this says the node pinned *this browser's* key
   // as an operator key. Only the second one lets you sign an invite, and only
@@ -1392,6 +1396,11 @@ function GroupPage({ groupId, group, token, username, userId, onRefreshAuth,
         _pendingJoinCode = null;
         if (cancelled) return;
         setIsNodeAdmin(!!ack.is_node_admin);
+        setMemberUpload(ack.member_upload !== false);
+        // Changed while we are connected, by an operator who may be someone
+        // else entirely. Without this the button stays until a reconnection,
+        // and a button that is still there is a button people press.
+        transport.onUploadPolicy = (allowed) => setMemberUpload(allowed);
         setOperatorPaired(transport.memberRole === 'operator');
 
         // A first join to this node generated an identity for it; leave it with
@@ -1792,6 +1801,10 @@ function GroupPage({ groupId, group, token, username, userId, onRefreshAuth,
     ? selectedFiles[0] : null;
   const deletableFiles = selectedFiles.filter(
     e => isNodeAdmin || (userId && e.uploader_id === userId));
+
+  // Asked in two places — the Files toolbar and the chat composer — so it is
+  // answered once. The operator is never locked out of their own node.
+  const mayUpload = memberUpload || isNodeAdmin;
   const run = (fn) => {
     setSelecting(false);
     setSelected(new Set());
@@ -1963,11 +1976,13 @@ function GroupPage({ groupId, group, token, username, userId, onRefreshAuth,
         ${tab === 'files' && status === 'connected' && html`
           <div class="file-toolbar">
             <div class="toolbar-group">
+              ${mayUpload && html`
               <label class="tb-btn primary">
                 <${Icon} name="upload" /> ${t('group.upload')}
                 <input type="file" multiple style="display:none"
                   onChange=${uploadFile} />
               </label>
+              `}
               ${canCreateDir && html`
               <button class="tb-btn" onClick=${makeDirectory}>
                 <${Icon} name="folder-plus" /> ${t('group.mkdir')}
@@ -2085,6 +2100,7 @@ function GroupPage({ groupId, group, token, username, userId, onRefreshAuth,
         ${tab === 'chat' && status === 'connected' && html`
           <${ChatPanel} transportRef=${transportRef} username=${username}
             entries=${entries} gekRef=${gekRef} onRefreshIndex=${refreshIndex}
+            mayUpload=${mayUpload}
             onPreview=${(entry) => {
               if (entry.type === 'video') setVideoEntry(entry);
               else setPreviewEntry(entry);
@@ -2099,6 +2115,8 @@ function GroupPage({ groupId, group, token, username, userId, onRefreshAuth,
             transportRef=${transportRef} gekRef=${gekRef}
             isNodeAdmin=${isNodeAdmin} userId=${userId}
             operatorPaired=${operatorPaired} connected=${status === 'connected'}
+            memberUpload=${memberUpload}
+            onMemberUpload=${(allowed) => setMemberUpload(allowed)}
             onLeft=${onLeft}
             onPaired=${() => setOperatorPaired(true)} />
         `}
@@ -2272,7 +2290,7 @@ function _b64ToU8(b64) {
  */
 function GroupSettingsPanel({ groupId, group, token, transportRef, gekRef,
                              isNodeAdmin, userId, operatorPaired, connected,
-                             onPaired, onLeft }) {
+                             memberUpload, onMemberUpload, onPaired, onLeft }) {
   const [members, setMembers] = useState([]);
   const [adminId, setAdminId] = useState('');
   const [loading, setLoading] = useState(true);
@@ -2350,6 +2368,37 @@ function GroupSettingsPanel({ groupId, group, token, transportRef, gekRef,
     }
   }, [pairCode, transportRef, userId]);
 
+  const [uploadBusy, setUploadBusy] = useState(false);
+  const [uploadMsg, setUploadMsg] = useState('');
+
+  /**
+   * Close or open uploading for everyone who is not the operator.
+   *
+   * Signed, like removing a member: the node refuses an unsigned instruction,
+   * so this is a request to the node rather than a decision taken here. The
+   * button does not move until the node has said it did it.
+   */
+  const setUploads = useCallback(async (allowed) => {
+    const transport = transportRef && transportRef.current;
+    setUploadMsg('');
+    setUploadBusy(true);
+    try {
+      if (!transport || !transport.connected) {
+        throw new Error('Not connected to the node');
+      }
+      const sk = transport.sessionKeys && transport.sessionKeys.skEdB64;
+      const signFn = (sk && window.MeshBayKeys)
+        ? (transcript) => window.MeshBayKeys.signBytes(sk, transcript)
+        : null;
+      await transport.setMemberUpload(allowed, signFn);
+      if (onMemberUpload) onMemberUpload(allowed);
+    } catch (err) {
+      setUploadMsg(err.message);
+    } finally {
+      setUploadBusy(false);
+    }
+  }, [transportRef, onMemberUpload]);
+
   const [removing, setRemoving] = useState('');
 
   /**
@@ -2504,6 +2553,27 @@ function GroupSettingsPanel({ groupId, group, token, transportRef, gekRef,
         </div>
       `}
 
+      ${/* Operator only, and only with a live connection: the node is what
+            holds and enforces this, so there is nothing to show or change
+            without one. */ isNodeAdmin && connected && html`
+        <div class="settings-section">
+          <h3 class="settings-heading">${t('members.uploads_title')}</h3>
+          <div class="settings-row">
+            <span class="settings-label">
+              ${memberUpload ? t('members.uploads_on') : t('members.uploads_off')}
+            </span>
+            <button class="admin-btn" disabled=${uploadBusy}
+              onClick=${() => setUploads(!memberUpload)}>
+              ${uploadBusy ? '...'
+                           : (memberUpload ? t('members.uploads_disable')
+                                           : t('members.uploads_enable'))}
+            </button>
+          </div>
+          <p class="settings-hint">${t('members.uploads_hint')}</p>
+          ${uploadMsg && html`<p class="error-msg">${uploadMsg}</p>`}
+        </div>
+      `}
+
       ${connected && html`
         <div class="settings-section">
           <h3 class="settings-heading">${t('device.mine_title')}</h3>
@@ -2744,7 +2814,8 @@ function ChatImage({ filename, entries, transportRef, gekRef }) {
   return html`<img class="chat-att-thumb" src=${blobUrl} alt=${filename} />`;
 }
 
-function ChatPanel({ transportRef, username, entries, gekRef, onRefreshIndex, onPreview }) {
+function ChatPanel({ transportRef, username, entries, gekRef, onRefreshIndex,
+                    onPreview, mayUpload = true }) {
   const [messages, setMessages] = useState([]);
   const [hasMore, setHasMore] = useState(false);
   const [loadingOlder, setLoadingOlder] = useState(false);
@@ -3041,11 +3112,13 @@ function ChatPanel({ transportRef, username, entries, gekRef, onRefreshIndex, on
         </button>
       `}
       <div class="chat-input-row">
+        ${mayUpload && html`
         <label class="chat-attach" title="${t('chat.attach')}">
           ${attaching ? html`<span class="spinner"></span>`
                       : html`<${Icon} name="clip" />`}
           <input type="file" style="display:none" onChange=${attachFile} disabled=${attaching} />
         </label>
+        `}
         <textarea class="chat-input" rows="1"
           placeholder="${t('chat.placeholder')}"
           value=${input}
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
index ddeaeeb..df72382 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
@@ -79,6 +79,12 @@ export default {
   'group.tab_members': 'Mitglieder',
   'group.tab_settings': "Einstellungen",
   'members.danger_leave_hint': "Sie verlieren den Zugriff auf die Dateien und den Chat dieser Gruppe.",
+  'members.uploads_title': "Uploads",
+  'members.uploads_on': "Mitglieder können Dateien hinzufügen",
+  'members.uploads_off': "Nur Sie können Dateien hinzufügen",
+  'members.uploads_disable': "Ausschalten",
+  'members.uploads_enable': "Einschalten",
+  'members.uploads_hint': "Gilt für alle außer Ihnen. Der Knoten lehnt den Upload selbst ab — es geht nicht darum, eine Schaltfläche zu verbergen.",
   'members.danger_delete_hint': "Die Gruppe verschwindet für alle Mitglieder. Das lässt sich nicht rückgängig machen.",
   'group.filter': 'Dateien filtern …',
   'group.col_name': 'Name',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
index 9a0f754..ce14f0b 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
@@ -80,6 +80,12 @@ export default {
   'group.tab_members': 'Members',
   'group.tab_settings': "Settings",
   'members.danger_leave_hint': "You will lose access to this group's files and chat.",
+  'members.uploads_title': "Uploads",
+  'members.uploads_on': "Members can add files",
+  'members.uploads_off': "Only you can add files",
+  'members.uploads_disable': "Turn off",
+  'members.uploads_enable': "Turn on",
+  'members.uploads_hint': "Applies to everyone but you. The node refuses the upload itself, so this is not a matter of hiding a button.",
   'members.danger_delete_hint': "This removes the group for every member. It cannot be undone.",
   'group.filter': 'Filter files...',
   'group.col_name': 'Name',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
index 0c72445..2d9084b 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
@@ -77,6 +77,12 @@ export default {
   'group.tab_members': 'Miembros',
   'group.tab_settings': "Ajustes",
   'members.danger_leave_hint': "Perderá el acceso a los archivos y al chat de este grupo.",
+  'members.uploads_title': "Subidas",
+  'members.uploads_on': "Los miembros pueden añadir archivos",
+  'members.uploads_off': "Solo usted puede añadir archivos",
+  'members.uploads_disable': "Desactivar",
+  'members.uploads_enable': "Activar",
+  'members.uploads_hint': "Se aplica a todos menos a usted. El nodo rechaza la subida por sí mismo: no se trata de ocultar un botón.",
   'members.danger_delete_hint': "El grupo desaparece para todos sus miembros. No se puede deshacer.",
   'group.filter': 'Filtrar archivos...',
   'group.col_name': 'Nombre',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
index 0dec5cf..9aa2857 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
@@ -78,6 +78,12 @@ export default {
   'group.tab_members': 'Membres',
   'group.tab_settings': "Paramètres",
   'members.danger_leave_hint': "Vous perdrez l’accès aux fichiers et à la discussion de ce groupe.",
+  'members.uploads_title': "Envois de fichiers",
+  'members.uploads_on': "Les membres peuvent ajouter des fichiers",
+  'members.uploads_off': "Vous seul pouvez ajouter des fichiers",
+  'members.uploads_disable': "Désactiver",
+  'members.uploads_enable': "Activer",
+  'members.uploads_hint': "S’applique à tout le monde sauf vous. C’est le nœud qui refuse l’envoi : il ne s’agit pas de masquer un bouton.",
   'members.danger_delete_hint': "Le groupe disparaît pour tous ses membres. C’est irréversible.",
   'group.filter': 'Filtrer les fichiers...',
   'group.col_name': 'Nom',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
index 81b6a3a..379e7cb 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
@@ -78,6 +78,12 @@ export default {
   'group.tab_members': 'Membri',
   'group.tab_settings': "Impostazioni",
   'members.danger_leave_hint': "Perderai l’accesso ai file e alla chat di questo gruppo.",
+  'members.uploads_title': "Caricamenti",
+  'members.uploads_on': "I membri possono aggiungere file",
+  'members.uploads_off': "Solo tu puoi aggiungere file",
+  'members.uploads_disable': "Disattiva",
+  'members.uploads_enable': "Attiva",
+  'members.uploads_hint': "Vale per tutti tranne te. È il nodo a rifiutare il caricamento: non si tratta di nascondere un pulsante.",
   'members.danger_delete_hint': "Il gruppo scompare per tutti i membri. Non è reversibile.",
   'group.filter': 'Filtra i file...',
   'group.col_name': 'Nome',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
index 11c6e31..45e7aa5 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
@@ -76,6 +76,12 @@ export default {
   'group.tab_members': 'メンバー',
   'group.tab_settings': "設定",
   'members.danger_leave_hint': "このグループのファイルとチャットにアクセスできなくなります。",
+  'members.uploads_title': "アップロード",
+  'members.uploads_on': "メンバーはファイルを追加できます",
+  'members.uploads_off': "あなただけがファイルを追加できます",
+  'members.uploads_disable': "無効にする",
+  'members.uploads_enable': "有効にする",
+  'members.uploads_hint': "あなた以外の全員に適用されます。ノード自身がアップロードを拒否するため、ボタンを隠すだけの話ではありません。",
   'members.danger_delete_hint': "グループはすべてのメンバーから消えます。元に戻せません。",
   'group.filter': 'ファイルを絞り込み…',
   'group.col_name': '名前',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
index 1af0eb1..37d3e24 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
@@ -79,6 +79,12 @@ export default {
   'group.tab_members': 'Leden',
   'group.tab_settings': "Instellingen",
   'members.danger_leave_hint': "U verliest de toegang tot de bestanden en de chat van deze groep.",
+  'members.uploads_title': "Uploads",
+  'members.uploads_on': "Leden kunnen bestanden toevoegen",
+  'members.uploads_off': "Alleen u kunt bestanden toevoegen",
+  'members.uploads_disable': "Uitschakelen",
+  'members.uploads_enable': "Inschakelen",
+  'members.uploads_hint': "Geldt voor iedereen behalve u. De node weigert de upload zelf — het gaat niet om het verbergen van een knop.",
   'members.danger_delete_hint': "De groep verdwijnt voor alle leden. Dit kan niet ongedaan worden gemaakt.",
   'group.filter': 'Bestanden filteren...',
   'group.col_name': 'Naam',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
index f57dc90..6766515 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
@@ -83,6 +83,12 @@ export default {
   'group.tab_members': 'Członkowie',
   'group.tab_settings': "Ustawienia",
   'members.danger_leave_hint': "Utracisz dostęp do plików i czatu tej grupy.",
+  'members.uploads_title': "Przesyłanie plików",
+  'members.uploads_on': "Członkowie mogą dodawać pliki",
+  'members.uploads_off': "Tylko Ty możesz dodawać pliki",
+  'members.uploads_disable': "Wyłącz",
+  'members.uploads_enable': "Włącz",
+  'members.uploads_hint': "Dotyczy wszystkich poza Tobą. To węzeł odrzuca przesłanie — nie chodzi o ukrycie przycisku.",
   'members.danger_delete_hint': "Grupa zniknie dla wszystkich członków. Tego nie można cofnąć.",
   'group.filter': 'Filtruj pliki...',
   'group.col_name': 'Nazwa',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
index 0f1586f..fa46887 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
@@ -79,6 +79,12 @@ export default {
   'group.tab_members': 'Membros',
   'group.tab_settings': "Configurações",
   'members.danger_leave_hint': "Você perderá o acesso aos arquivos e ao chat deste grupo.",
+  'members.uploads_title': "Envios",
+  'members.uploads_on': "Os membros podem adicionar arquivos",
+  'members.uploads_off': "Somente você pode adicionar arquivos",
+  'members.uploads_disable': "Desativar",
+  'members.uploads_enable': "Ativar",
+  'members.uploads_hint': "Vale para todos menos você. O nó recusa o envio por conta própria: não se trata de esconder um botão.",
   'members.danger_delete_hint': "O grupo desaparece para todos os membros. Não há como desfazer.",
   'group.filter': 'Filtrar arquivos...',
   'group.col_name': 'Nome',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
index 89927bb..3276db8 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
@@ -76,6 +76,12 @@ export default {
   'group.tab_members': '成员',
   'group.tab_settings': "设置",
   'members.danger_leave_hint': "您将无法再访问该群组的文件和聊天。",
+  'members.uploads_title': "上传",
+  'members.uploads_on': "成员可以添加文件",
+  'members.uploads_off': "只有您可以添加文件",
+  'members.uploads_disable': "关闭",
+  'members.uploads_enable': "开启",
+  'members.uploads_hint': "适用于除您之外的所有人。节点自身会拒绝上传，并非只是隐藏按钮。",
   'members.danger_delete_hint': "该群组将对所有成员消失，且无法恢复。",
   'group.filter': '筛选文件…',
   'group.col_name': '名称',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport.js b/packages/meshbay-hub/src/meshbay_hub/static/transport.js
index 853ae75..a0509a0 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/transport.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/transport.js
@@ -103,6 +103,7 @@ class MeshBayTransport {
   set onStreamEnd(fn) { this._onStreamEnd = fn; }
   set onStreamError(fn) { this._onStreamError = fn; }
   set onIndexSync(fn) { this._onIndexSync = fn; }
+  set onUploadPolicy(fn) { this._onUploadPolicy = fn; }
 
   get sessionKeys() { return this._sessionKeys; }
 
@@ -592,6 +593,24 @@ class MeshBayTransport {
    * Only the node can do this: its roster decides who it serves. Removing them
    * on the hub is the other half, and neither implies the other.
    */
+  /**
+   * Turn uploading by ordinary members on or off.
+   *
+   * Signed by the operator like any other privileged operation — the node
+   * refuses an unsigned one, which is what stops a member turning it back on.
+   */
+  async setMemberUpload(allowed, signFn) {
+    const msg = await this._sendAndWait({
+      type: 'member_upload', v: '0.1', allowed: Boolean(allowed),
+    });
+    if (msg.type === 'error') throw new Error(msg.detail);
+    if (msg.type === 'admin_challenge') {
+      return this._authorizeAdminOp(
+        msg, 'member_upload', allowed ? 'on' : 'off', signFn);
+    }
+    return msg;
+  }
+
   async revokeMember(userId, signFn) {
     const msg = await this._sendAndWait({
       type: 'member_revoke', v: '0.1', user_id: userId,
@@ -1079,6 +1098,14 @@ class MeshBayTransport {
       return;
     }
 
+    // The operator changed who may upload. Unsolicited: it arrives at everyone
+    // connected, not only at whoever asked. It still has to reach a pending
+    // caller — the operator's own request resolves on this reply — so it falls
+    // through to the matching below rather than returning here.
+    if (msg.type === 'member_upload_ack' && this._onUploadPolicy) {
+      this._onUploadPolicy(Boolean(msg.allowed));
+    }
+
     if (msg.type === 'index_sync' && msg.entries) {
       if (this._onIndexSync) this._onIndexSync(msg);
       const oldest = this._pending.entries().next();
diff --git a/packages/meshbay-hub/tests/test_upload_controls_hidden.py b/packages/meshbay-hub/tests/test_upload_controls_hidden.py
new file mode 100644
index 0000000..d859125
--- /dev/null
+++ b/packages/meshbay-hub/tests/test_upload_controls_hidden.py
@@ -0,0 +1,122 @@
+"""
+When the operator closes uploading, the controls go — both of them.
+
+There are two ways to put a file into a group and they are in different
+components: the Upload button in the Files toolbar, and the paperclip in the
+chat composer. Hiding one and forgetting the other is the obvious mistake, and
+the second one is the easier to forget because it does not look like an upload.
+
+Nothing here is a security property. **The node refuses the upload** — that is
+`test_member_upload_policy.py` in the node package. This is about not offering
+somebody a button whose only outcome is an error message.
+"""
+
+import re
+from pathlib import Path
+
+import pytest
+
+STATIC = Path(__file__).resolve().parents[1] / "src" / "meshbay_hub" / "static"
+APP = STATIC / "app.js"
+TRANSPORT = STATIC / "transport.js"
+
+pytestmark = pytest.mark.skipif(not APP.exists(), reason="SPA sources unavailable")
+
+
+@pytest.fixture(scope="module")
+def app() -> str:
+    return APP.read_text(encoding="utf-8")
+
+
+def _component(app: str, name: str) -> str:
+    start = app.index(f"\nfunction {name}(")
+    end = app.find("\nfunction ", start + 1)
+    return app[start:end if end != -1 else len(app)]
+
+
+# ── Both controls ───────────────────────────────────────────────────────────
+
+def test_the_files_toolbar_hides_its_upload_button(app):
+    page = _component(app, "GroupPage")
+    toolbar = page[page.index("file-toolbar"):]
+    toolbar = toolbar[:toolbar.index("group.mkdir")]
+    assert "mayUpload &&" in toolbar, "the Upload button is offered regardless"
+
+
+def test_the_chat_composer_hides_its_paperclip(app):
+    chat = _component(app, "ChatPanel")
+    composer = chat[chat.index("chat-input-row"):]
+    assert "mayUpload &&" in composer, (
+        "the chat attachment is the second way in and is still offered")
+
+
+def test_both_read_the_same_answer(app):
+    """Two derivations would eventually disagree, and the disagreement would
+    be one of them offering an upload the node refuses."""
+    page = _component(app, "GroupPage")
+    assert re.search(r"const mayUpload = memberUpload \|\| isNodeAdmin;", page), (
+        "mayUpload is no longer derived in one place")
+    assert "mayUpload=${mayUpload}" in page, "the chat panel is told separately"
+
+
+def test_the_operator_keeps_their_own_controls(app):
+    page = _component(app, "GroupPage")
+    assert "memberUpload || isNodeAdmin" in page, (
+        "turning uploads off would hide the operator's own upload button")
+
+
+# ── Learning the answer ─────────────────────────────────────────────────────
+
+def test_the_answer_comes_from_the_node(app):
+    """Not from the hub, which has no say in what may be written to someone
+    else's disk, and no way to be believed about it."""
+    page = _component(app, "GroupPage")
+    assert "ack.member_upload !== false" in page, (
+        "the handshake ack is what carries this")
+    assert "hubFetch" not in page[page.index("ack.member_upload") - 400:
+                                  page.index("ack.member_upload")]
+
+
+def test_an_older_node_is_treated_as_permissive(app):
+    """A node that predates the setting sends no such field. Reading a missing
+    field as "off" would close every group on the older half of the network."""
+    page = _component(app, "GroupPage")
+    assert "!== false" in page[page.index("ack.member_upload"):
+                               page.index("ack.member_upload") + 60]
+
+
+def test_a_change_reaches_people_already_connected(app):
+    """The operator may be someone else entirely, changing it while you have
+    the group open. A button that survives until the next reconnection is a
+    button somebody presses."""
+    page = _component(app, "GroupPage")
+    assert "transport.onUploadPolicy" in page
+    transport = TRANSPORT.read_text(encoding="utf-8")
+    assert "member_upload_ack" in transport, "nothing routes the node's notice"
+
+
+def test_the_notice_still_answers_the_operators_own_request(app):
+    """The same message is both a broadcast and the reply to the request that
+    caused it — returning early on it would leave that request hanging until it
+    timed out."""
+    transport = TRANSPORT.read_text(encoding="utf-8")
+    block = transport[transport.index("member_upload_ack"):]
+    block = block[:block.index("index_sync")]
+    assert "return" not in block
+
+
+# ── Changing it ─────────────────────────────────────────────────────────────
+
+def test_changing_it_is_signed(app):
+    transport = TRANSPORT.read_text(encoding="utf-8")
+    method = transport[transport.index("async setMemberUpload("):]
+    method = method[:method.index("\n  async ", 1)]
+    assert "admin_challenge" in method and "_authorizeAdminOp" in method, (
+        "an unsigned instruction would let any member turn uploads back on")
+
+
+def test_only_the_operator_is_offered_the_setting(app):
+    panel = _component(app, "GroupSettingsPanel")
+    section = panel[panel.index("members.uploads_title") - 400:
+                    panel.index("members.uploads_title")]
+    assert "isNodeAdmin && connected" in section
diff --git a/packages/meshbay-node/src/meshbay_node/daemon.py b/packages/meshbay-node/src/meshbay_node/daemon.py
index f4dcca5..45aca7a 100644
--- a/packages/meshbay-node/src/meshbay_node/daemon.py
+++ b/packages/meshbay-node/src/meshbay_node/daemon.py
@@ -256,6 +256,13 @@ class NodeDaemon:
                     # Admission policy comes from node.toml, never from the hub:
                     # a hub that could declare a group open would be handed its key.
                     "join_policy": group_cfg.join_policy,
+                    # Whether ordinary members may upload. Read once here, into
+                    # the context, because the upload handler is synchronous and
+                    # a database round trip per chunk would be absurd. The
+                    # signed operation that changes it updates this dict in
+                    # place, so the two never drift within a run.
+                    "member_upload": await self._roster.member_upload_allowed(
+                        group_cfg.id) if self._roster else True,
                 }
 
             if not groups_ctx:
diff --git a/packages/meshbay-node/src/meshbay_node/roster.py b/packages/meshbay-node/src/meshbay_node/roster.py
index 226b784..c811016 100644
--- a/packages/meshbay-node/src/meshbay_node/roster.py
+++ b/packages/meshbay-node/src/meshbay_node/roster.py
@@ -100,6 +100,26 @@ CREATE TABLE IF NOT EXISTS members (
     PRIMARY KEY (group_id, user_id)
 );
 
+-- Per-group settings the operator changes while the node runs.
+--
+-- Not node.toml: that file is hand-written, full of comments explaining
+-- decisions, and `ops.py` deliberately appends to it rather than round-tripping
+-- it through a TOML writer. A setting toggled from a panel has to take effect
+-- without an edit to the operator's file and without a restart, so it lives
+-- here, where the node already keeps what it decided rather than what it was
+-- configured with.
+--
+-- Absent means default. Nothing writes a row until someone changes something,
+-- so an existing node has the same behaviour it had before this table existed.
+CREATE TABLE IF NOT EXISTS group_settings (
+    group_id TEXT NOT NULL,
+    key      TEXT NOT NULL,
+    value    TEXT NOT NULL,
+    set_by   TEXT NOT NULL DEFAULT '',
+    set_at   TEXT NOT NULL DEFAULT '',
+    PRIMARY KEY (group_id, key)
+);
+
 CREATE TABLE IF NOT EXISTS invites (
     code_hash  TEXT PRIMARY KEY,
     group_id   TEXT NOT NULL,
@@ -518,6 +538,43 @@ class Roster:
 
     # ── Invites ──────────────────────────────────────────────────────────────
 
+    # ── Group settings ──────────────────────────────────────────────────────
+
+    # Whether members who are not the operator may upload. Default is yes: a
+    # group that nobody may add to is the unusual case, and an existing node
+    # must not change behaviour because a table was added under it.
+    SETTING_MEMBER_UPLOAD = "member_upload"
+
+    async def get_setting(self, group_id: str, key: str,
+                          default: str | None = None) -> str | None:
+        async with self._db.execute(
+                "SELECT value FROM group_settings WHERE group_id = ? AND key = ?",
+                (group_id, key)) as cur:
+            row = await cur.fetchone()
+        return row["value"] if row else default
+
+    async def set_setting(self, group_id: str, key: str, value: str,
+                          set_by: str = "") -> None:
+        await self._db.execute(
+            "INSERT INTO group_settings (group_id, key, value, set_by, set_at) "
+            "VALUES (?, ?, ?, ?, ?) "
+            "ON CONFLICT(group_id, key) DO UPDATE SET "
+            "value = excluded.value, set_by = excluded.set_by, "
+            "set_at = excluded.set_at",
+            (group_id, key, value, set_by, _now()))
+        await self._db.commit()
+
+    async def member_upload_allowed(self, group_id: str) -> bool:
+        """Whether an ordinary member may upload to this group."""
+        value = await self.get_setting(group_id, self.SETTING_MEMBER_UPLOAD, "1")
+        return value != "0"
+
+    async def set_member_upload(self, group_id: str, allowed: bool,
+                                set_by: str = "") -> bool:
+        await self.set_setting(group_id, self.SETTING_MEMBER_UPLOAD,
+                               "1" if allowed else "0", set_by)
+        return allowed
+
     async def create_invite(
         self,
         group_id: str,
diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
index 9d16f82..22e5e15 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
@@ -62,6 +62,7 @@ from meshbay_common.adminop import (
     OP_MEMBER_REVOKE,
     OP_GEK_ROTATE,
     OP_MEMBER_UNPIN,
+    OP_MEMBER_UPLOAD,
     admin_transcript,
 )
 from meshbay_common.crypto import pk_to_b64, wrap_gek_aes
@@ -469,6 +470,8 @@ class WebRTCPeerSession:
                 self._spawn(self._do_device_list(msg))
             elif mtype == MNP.DEVICE_REVOKE:
                 self._spawn(self._do_device_revoke(msg))
+            elif mtype == MNP.MEMBER_UPLOAD:
+                self._do_member_upload(msg)
             elif mtype == MNP.MEMBER_UNPIN:
                 self._do_member_unpin(msg)
             elif mtype == MNP.GEK_ROTATE:
@@ -687,7 +690,11 @@ class WebRTCPeerSession:
             "proof": base64.b64encode(node_proof).decode(),
             "sig": base64.b64encode(
                 self._ctx["sk_node"].sign(node_transcript)).decode(),
-            "is_node_admin": bool(node_user_id and self._user_id == node_user_id),
+            "is_node_admin": self._is_node_admin(),
+            # So the interface knows whether to offer uploading at all. Not a
+            # permission — the node refuses regardless — but without it the
+            # only way to discover the answer is to try.
+            "member_upload": bool(self._group_ctx().get("member_upload", True)),
         }
         if node_user_id:
             ack["node_user_id"] = node_user_id
@@ -1568,6 +1575,58 @@ class WebRTCPeerSession:
         self._send({"type": MNP.MEMBER_UNPIN_ACK, "v": MNP_VERSION,
                     "user_id": user_id})
 
+    def _do_member_upload(self, msg: dict) -> None:
+        """
+        Turn uploading by ordinary members on or off, for this group.
+
+        Signed like every other operator action. The setting decides who may
+        write to the operator's disk, so a node that took it from an unsigned
+        message would let any member turn it back on for everyone — the control
+        would be a suggestion.
+        """
+        if "allowed" not in msg:
+            self._send({"type": "error", "detail": "Missing allowed"})
+            return
+        if not self._has_admin_authority():
+            self._send({"type": "error", "detail": "No authorized key for this"})
+            return
+        # The subject is what the operator is shown before signing, so it has to
+        # name the outcome rather than the operation.
+        self._issue_admin_challenge(
+            OP_MEMBER_UPLOAD, "on" if msg.get("allowed") else "off")
+
+    async def _admin_exec_member_upload(
+        self, pending: dict, transcript: bytes, sig: bytes,
+    ) -> None:
+        allowed = pending["subject"] == "on"
+        if not await self._verify_admin_sig(transcript, sig):
+            self._send({"type": "error", "detail": "Signature verification failed"})
+            self._audit("admin_auth_failed", f"member_upload:{pending['subject']}")
+            return
+        roster = self._ctx.get("roster")
+        if roster is None:
+            self._send({"type": "error", "detail": "No roster on this node"})
+            return
+        await roster.set_member_upload(self._group_id or "", allowed,
+                                       set_by=self._user_id)
+        # Stored *and* applied. The upload path is synchronous and reads this
+        # dict; leaving it to the next restart would make the panel say one
+        # thing while the node did another.
+        self._group_ctx()["member_upload"] = allowed
+        self._audit("member_upload", pending["subject"])
+
+        # Everyone already connected is told, rather than finding out by having
+        # an upload refused. Enforcement does not depend on this reaching them —
+        # it is the node that refuses — but a button that stays visible until
+        # the next reconnection is a button people press.
+        notice = {"type": MNP.MEMBER_UPLOAD_ACK, "v": MNP_VERSION,
+                  "allowed": allowed}
+        for uid, session in list(self._peer_registry().items()):
+            try:
+                session._send(notice)
+            except Exception:
+                pass
+
     async def _run_op(self, fn, *args, **kwargs):
         """
         Call an operation from `meshbay_node.ops` with the daemon's own view.
@@ -1995,6 +2054,19 @@ class WebRTCPeerSession:
                         "filename": filename})
             return
 
+        # The operator can close uploading to everyone but themselves. Enforced
+        # here rather than by hiding a button: the button is a courtesy to the
+        # people who are not trying, and this is the part that holds against
+        # someone who is. `is_node_admin` is computed from the identity this
+        # node pinned, never from a hub claim.
+        if not ctx.get("member_upload", True) and not self._is_node_admin():
+            self._send({"type": "error",
+                        "detail": "Uploading is turned off for this group",
+                        "code": "member_upload_off",
+                        "filename": filename})
+            self._audit("upload_refused", filename[:64])
+            return
+
         roots: RootSet | None = ctx.get("roots")
         upload_root = roots.upload_root if roots else None
         if upload_root is None:
@@ -2189,6 +2261,17 @@ class WebRTCPeerSession:
         if ident:
             self._pinned_pk = ident["pk_ed25519"]
 
+    def _is_node_admin(self) -> bool:
+        """
+        Whether the peer on this connection is the node's operator.
+
+        Was written out twice — once in the handshake ack and once at the gate
+        below it — which is how the two come to disagree. From the node's own
+        record of who it belongs to, never from a hub claim.
+        """
+        node_user_id = self._ctx.get("node_user_id")
+        return bool(node_user_id and self._user_id == node_user_id)
+
     def _has_admin_authority(self) -> bool:
         """
         Cheap synchronous pre-check: is there anyone who could authorize this?
@@ -2269,6 +2352,9 @@ class WebRTCPeerSession:
         elif pending["op"] == OP_MEMBER_UNPIN:
             self._spawn(
                 self._admin_exec_member_unpin(pending, transcript, sig_bytes))
+        elif pending["op"] == OP_MEMBER_UPLOAD:
+            self._spawn(
+                self._admin_exec_member_upload(pending, transcript, sig_bytes))
         else:
             self._send({"type": "error", "detail": "Unknown admin operation"})
 
diff --git a/packages/meshbay-node/tests/test_member_upload_policy.py b/packages/meshbay-node/tests/test_member_upload_policy.py
new file mode 100644
index 0000000..b1dc0cb
--- /dev/null
+++ b/packages/meshbay-node/tests/test_member_upload_policy.py
@@ -0,0 +1,176 @@
+"""
+The operator can close uploading to everyone but themselves.
+
+The point of these tests is the difference between a hidden button and a closed
+door. The interface stops offering the control, which is a courtesy to the
+people who are not trying; **the node refuses the upload**, which is the part
+that holds against someone who is. A member who kept an old tab open, or who
+speaks MNP directly, gets the same answer as everyone else.
+
+Two further things are worth holding:
+
+* the setting is changed by a **signed** operator instruction. A node that took
+  it from an unsigned message would let any member turn it back on, and the
+  control would be a suggestion;
+* it is stored on the **node**, not the hub. A hub that could decide who may
+  write to the operator's disk is a hub with authority over the node, which is
+  the thing this whole design is arranged to avoid.
+"""
+
+import base64
+from pathlib import Path
+
+import pytest
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+from meshbay_common.adminop import OP_MEMBER_UPLOAD
+from meshbay_node.indexer.group_index import GroupIndex
+from meshbay_node.roster import Roster
+from meshbay_node.transport.webrtc_server import WebRTCPeerSession
+
+from conftest import one_root
+
+pytestmark = pytest.mark.asyncio
+
+
+def _session(tmp_path: Path, user_id: str, *, member_upload: bool,
+             operator: str | None = None) -> WebRTCPeerSession:
+    shared_root = tmp_path / "shared"
+    shared_root.mkdir(exist_ok=True)
+    index = GroupIndex(group_id="g" * 32, sk_node=Ed25519PrivateKey.generate())
+    ctx = {
+        "roots": one_root(shared_root),
+        "index": index,
+        "sk_node": index.sk_node,
+        "member_upload": member_upload,
+        "node_user_id": operator,
+    }
+    session = WebRTCPeerSession.__new__(WebRTCPeerSession)
+    session._ctx = ctx
+    session._group_id = None
+    session._user_id = user_id
+    session._pk_user = ""
+    session._uploads = {}
+    session.sent = []
+    session._send = session.sent.append
+    session._audit = lambda *a, **k: None
+    return session
+
+
+def _upload(session, filename="clip.mp4", body=b"bytes"):
+    session._do_file_upload({
+        "filename": filename, "chunk_index": 0, "total_chunks": 1,
+        "data": base64.b64encode(body).decode(),
+    })
+
+
+def _uploads_dir(session) -> Path:
+    return session._ctx["roots"].upload_root.path / "uploads"
+
+
+# ── The door, not the button ────────────────────────────────────────────────
+
+async def test_a_member_cannot_upload_when_it_is_turned_off(tmp_path):
+    session = _session(tmp_path, "member-1", member_upload=False,
+                       operator="the-operator")
+    _upload(session)
+
+    assert not (_uploads_dir(session) / "clip.mp4").exists(), (
+        "the file was written even though uploading is off — the setting is "
+        "decorative and the hidden button was the whole control")
+    refusal = [m for m in session.sent if m.get("type") == "error"]
+    assert refusal and refusal[0].get("code") == "member_upload_off"
+
+
+async def test_the_operator_can_still_upload(tmp_path):
+    """Otherwise turning it off locks the operator out of their own node, and
+    the only way back is a config file and a restart."""
+    session = _session(tmp_path, "the-operator", member_upload=False,
+                       operator="the-operator")
+    _upload(session)
+
+    assert (_uploads_dir(session) / "clip.mp4").read_bytes() == b"bytes"
+
+
+async def test_members_upload_normally_when_it_is_on(tmp_path):
+    session = _session(tmp_path, "member-1", member_upload=True,
+                       operator="the-operator")
+    _upload(session)
+
+    assert (_uploads_dir(session) / "clip.mp4").read_bytes() == b"bytes"
+
+
+async def test_a_node_that_never_heard_of_the_setting_still_accepts_uploads(tmp_path):
+    """An existing node's context has no such key. The absence must read as
+    "allowed", or upgrading the node silently closes every group."""
+    session = _session(tmp_path, "member-1", member_upload=True,
+                       operator="the-operator")
+    del session._ctx["member_upload"]
+    _upload(session)
+
+    assert (_uploads_dir(session) / "clip.mp4").read_bytes() == b"bytes"
+
+
+# ── Who may change it ───────────────────────────────────────────────────────
+
+async def test_changing_it_needs_a_signature(tmp_path):
+    """
+    The request only ever produces a challenge. Nothing is applied until a
+    signature over the transcript verifies — the same path as removing a member.
+    """
+    session = _session(tmp_path, "member-1", member_upload=True,
+                       operator="the-operator")
+    session._has_admin_authority = lambda: True
+    issued = []
+    session._issue_admin_challenge = lambda op, subject: issued.append((op, subject))
+
+    session._do_member_upload({"allowed": False})
+
+    assert issued == [(OP_MEMBER_UPLOAD, "off")]
+    assert session._ctx["member_upload"] is True, "applied before it was signed"
+
+
+async def test_the_subject_names_the_outcome_not_the_operation(tmp_path):
+    """The operator is shown the subject before signing. "member_upload" tells
+    them nothing; "off" tells them what they are about to do."""
+    session = _session(tmp_path, "op", member_upload=False, operator="op")
+    session._has_admin_authority = lambda: True
+    issued = []
+    session._issue_admin_challenge = lambda op, subject: issued.append((op, subject))
+
+    session._do_member_upload({"allowed": True})
+
+    assert issued == [(OP_MEMBER_UPLOAD, "on")]
+
+
+async def test_a_request_with_nobody_to_authorize_it_is_refused(tmp_path):
+    session = _session(tmp_path, "member-1", member_upload=True,
+                       operator="the-operator")
+    session._has_admin_authority = lambda: False
+
+    session._do_member_upload({"allowed": False})
+
+    assert [m for m in session.sent if m.get("type") == "error"]
+
+
+# ── Where it is stored ──────────────────────────────────────────────────────
+
+async def test_the_setting_lives_on_the_node_and_survives_a_restart(tmp_path):
+    roster = Roster(db_path=tmp_path / "roster.db")
+    await roster.open()
+    try:
+        assert await roster.member_upload_allowed("g1") is True, (
+            "absent must mean allowed, or an upgrade closes every group")
+        await roster.set_member_upload("g1", False, set_by="op")
+        assert await roster.member_upload_allowed("g1") is False
+    finally:
+        await roster.close()
+
+    reopened = Roster(db_path=tmp_path / "roster.db")
+    await reopened.open()
+    try:
+        assert await reopened.member_upload_allowed("g1") is False
+        assert await reopened.member_upload_allowed("g2") is True, (
+            "one group's setting must not answer for another")
+    finally:
+        await reopened.close()