refactor(node): split ops.py into the ops package

Each section of ops.py becomes a module of meshbay_node/ops/ (core,
node_toml, members, chat, groups, roots, files, settings, apps), cut as
text; ops/__init__.py keeps the docstring and re-exports every name, so
`ops.<name>` is unchanged for every caller. Logger name unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

3 files changed, 11 insertions, 11 deletions

diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md
index 7d342aa..f260d6e 100644
--- a/docs/MESHBAY_DESIGN.md
+++ b/docs/MESHBAY_DESIGN.md
@@ -1069,8 +1069,8 @@ upload transcript the uploader signs — over node, group, root, path, content
 hash, account and timestamp, stored with the entry — would make it verifiable by
 any member instead. That is an open item (§15.3), not something the product has.
 
-**One implementation, several front doors.** `meshbay_node/ops.py` holds every
-operation. The loopback API, the CLI and the signed MNP handlers all call these
+**One implementation, several front doors.** The `meshbay_node/ops/` package holds
+every operation, one module per domain, all re-exported by `ops/__init__.py`. The loopback API, the CLI and the signed MNP handlers all call these
 functions; they take the daemon state, raise `OpError`, and know nothing about
 HTTP. Two implementations of one operation with two authorization checks is
 **C1**/**C6** one size down.
@@ -1645,7 +1645,7 @@ is not authentication: any local process can reach it, as can a page in the
 operator's browser via DNS rebinding — and this API re-initialises group keys,
 issues invitations and reads the audit log. There is no server-rendered dashboard;
 the desktop client's Node page and the CLI are the two consumers, and each
-operation endpoint is one `_op(...)` line onto `ops.py` (§5.4).
+operation endpoint is one `_op(...)` line onto `ops` (§5.4).
 
 **Over MNP, the node's own controls need a proved operator device.** The
 node-wide surface — `node_status`, which lists every group on the machine with
diff --git a/docs/MESHBAY_NODE_PROTOCOL.md b/docs/MESHBAY_NODE_PROTOCOL.md
index e11f2a6..2206971 100644
--- a/docs/MESHBAY_NODE_PROTOCOL.md
+++ b/docs/MESHBAY_NODE_PROTOCOL.md
@@ -1044,7 +1044,7 @@ effect immediately.
       |                                               | verify vs roster operator keys
       |                                               | (file_delete also accepts the
       |                                               |  uploader's recorded key)
-      |                                               | execute via ops.py
+      |                                               | execute via ops
       |<- <op>_ack {op-specific fields} --------------|
       |                                               |
       |         some acks are ALSO broadcast to every peer in the group
@@ -1134,7 +1134,7 @@ A second family of operator messages is **not** signed: `node_status`, `roster_r
 by `is_node_admin()` — the authenticated session's `user_id` equals the account the
 node records as its own operator (`node_user_id`), computed from the node's own state
 and never from a hub claim. Three of them only read; the other three run through the
-same `ops.py` entry points as the CLI and the loopback admin API. The distinction from
+same `ops` entry points as the CLI and the loopback admin API. The distinction from
 the signed table above is deliberate but worth stating plainly: a signed op proves
 possession of an operator *key*, while these prove only that the session belongs to the
 operator's *account*, which the handshake already established.
@@ -1159,7 +1159,7 @@ Rules that hold across the table:
 ### 10.5 One implementation, several front doors
 
 The loopback admin API, the CLI and the signed MNP handlers are three thin adapters
-over the same functions in `meshbay_node/ops.py`. Those functions take the daemon
+over the same functions in `meshbay_node/ops/`. Those functions take the daemon
 state, raise `OpError`, and know nothing about HTTP.
 
 One operation with two implementations means two authorization checks, and the weaker
@@ -2346,7 +2346,7 @@ meshbay-node/     transport/webrtc_server.py   the reference implementation of M
                   transport/wire.py            the one index encoder
                   transfers.py                 leases, queues, caps, leaseless reads
                   uploads.py                   partial uploads and orphaned .part files
-                  roster.py, ops.py, daemon.py roster, operations, group contexts
+                  roster.py, ops/, daemon.py   roster, operations, group contexts
 
 meshbay-hub/      api/signaling.py             SDP relay limits
                   static/transport.js          the client half of every exchange above
diff --git a/docs/transfers-v1.md b/docs/transfers-v1.md
index 47e82a6..e9caadb 100644
--- a/docs/transfers-v1.md
+++ b/docs/transfers-v1.md
@@ -73,7 +73,7 @@ this repo about slots — `_replace_stream`, `shutdown_tasks()`, `_spawn()` and
 the garbage-collected task, `await proc.wait()` after `kill()` — is a lesson
 about *not losing a slot*. That history is why §5 exists.
 
-**One bug found while reading, in scope for this work.** `ops.py:1362-1365`
+**One bug found while reading, in scope for this work.** `set_node_settings` (`ops/settings.py`)
 hot-swaps the stream cap by assigning `webrtc._stream_sem` — an attribute that
 does not exist. The real semaphore is `ctx["_transcode_sem"]`
 (`_transcode_semaphore`, `webrtc/apps/streaming.py`), and `hasattr(webrtc, '_stream_sem')` is always
@@ -585,8 +585,8 @@ Two new `[node]` keys, `max_concurrent_downloads` and
 
 - `roster.py`: `SETTING_MAX_DOWNLOADS` / `SETTING_MAX_UPLOADS`, added to
   `node_settings()` (`roster.py:943`);
-- `ops.py`: entries in `get_node_settings` / `set_node_settings`
-  (`ops.py:1290`, `ops.py:1309`), written to `roster.db` **and** `node.toml`;
+- `ops/settings.py`: entries in `get_node_settings` / `set_node_settings`,
+  written to `roster.db` **and** `node.toml`;
 - **hot-swap through one helper.** `ops.set_node_settings` currently pokes
   `webrtc._stream_sem`, which does not exist (§1). Replace all three with
   `webrtc.set_capacity(streams=…, downloads=…, uploads=…)` on
@@ -805,7 +805,7 @@ test.
 - `test_upload_resume.py` — reconnect mid-upload resumes at `next_index`;
   orphan `.part` reaped; `stored_name` preserved.
 - `test_node_settings.py` extension — `set_capacity` actually resizes a live
-  pool (the test `ops.py:1362` never had).
+  pool (the test `set_node_settings` never had).
 
 **Hub / SPA (`packages/meshbay-hub/tests/`)**