refactor(mnp)!: remove stream_seg, the last unencrypted content message

`stream_seg` answered with an MPEG-TS segment as base64 with no encryption at
all — the one message on the content plane that never went through a
GEK-derived key. Live on both transports, answering any authenticated member.

It predates `stream_data`, which does the same job properly (`chunk_ciphertext`,
keyed per segment, AES-256-GCM) and has since Phase 12. Its only browser caller,
`fetchStreamSegment`, was defined and never once invoked — a plaintext media
endpoint with no client. Removed rather than repaired.

Gone with it: `_extract_segment` and the ffmpeg semaphore in quic_server, the
`fetch_stream_segment` QUIC client method, and `_b64decode` in transport.js,
which had no other caller.

The H6 regression test lived on this handler — it pinned `_do_stream_segment_async`
to a coroutine so `subprocess.run` could not stall the event loop for thirty
seconds per request. It is replaced by the property that outlives the handler:
no transport carries media outside an AEAD, asserted on `stream_seg` and
`data_b64` across all three transport modules. The half of H6 that survives —
the live streaming path still spawns ffmpeg — keeps its own test.

BREAKING CHANGE: `stream_seg` is no longer answered on either transport. No
shipping client sends it. Recorded as part of MNP 2.0, whose other half — the
sealed upload — carries the version bump.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AsoWC3GmhNdwVFomW3QjH3

1 files changed, 7 insertions, 1 deletions

diff --git a/packages/meshbay-common/src/meshbay_common/protocol.py b/packages/meshbay-common/src/meshbay_common/protocol.py
index 6eff5b6..bb52a51 100644
--- a/packages/meshbay-common/src/meshbay_common/protocol.py
+++ b/packages/meshbay-common/src/meshbay_common/protocol.py
@@ -59,7 +59,13 @@ class MNP:
     INDEX_PROGRESS  = "index_progress"
     FILE_REQUEST    = "file_req"         # request chunk(s)
     FILE_CHUNK      = "file_chunk"       # encrypted chunk response
-    STREAM_SEGMENT  = "stream_seg"       # HLS/DASH segment
+    # STREAM_SEGMENT ("stream_seg") was removed in MNP 2.0. It served an
+    # MPEG-TS segment as base64 **with no encryption at all** — the one message
+    # on the content plane that never was under a GEK-derived key. It predates
+    # STREAM_DATA, which does the same job properly (`chunk_ciphertext`, keyed
+    # per segment), and its browser caller `fetchStreamSegment` was defined and
+    # never once invoked. A live handler on both transports, plaintext media,
+    # and no client: removed rather than repaired.
     CHAT_MESSAGE    = "chat_msg"         # Double Ratchet message
     CHAT_ATTACHMENT = "chat_attach"      # attachment metadata
     CHAT_HISTORY    = "chat_hist"       # request message history (newest, or before a cursor)