refactor(mnp)!: one answer to "may this member write", and it is the root

The group-wide `member_upload` switch is gone: the message, the signed
operation, the field on the handshake ack, the `upload` alias on every root in
the index payload, and the client's fallback path to it.

Whether a member may write has been a property of each root for a while, and
that is the model that survives: a single flag over the group cannot express
"this library is published read-only and that folder is a drop box", which is
the ordinary arrangement. What was left of the switch was a handler that logged
a deprecation and acted on nothing, and a client that read `ack.member_upload`
whenever the roots carried no `writable` — a second source for one question,
with whichever the code consulted first deciding it.

`roots.describe()` drops `upload` for the same reason: it was `writable` under
an older name, and two names for one boolean is one too many.

The paperclip now says "nowhere to write" rather than picking a root, in a group
that has none writable. That is the honest answer; the fallback picked whatever
came first and failed at send time.

Node suite 1215 passed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AsoWC3GmhNdwVFomW3QjH3

2 files changed, 1 insertions, 8 deletions

diff --git a/packages/meshbay-common/src/meshbay_common/adminop.py b/packages/meshbay-common/src/meshbay_common/adminop.py
index 5c7345b..a80ffa9 100644
--- a/packages/meshbay-common/src/meshbay_common/adminop.py
+++ b/packages/meshbay-common/src/meshbay_common/adminop.py
@@ -45,10 +45,6 @@ OP_MEMBER_REVOKE = "member_revoke"
 OP_GEK_ROTATE = "gek_rotate"
 # Forgetting a pinned identity, so someone can pair again after losing a device.
 OP_MEMBER_UNPIN = "member_unpin"
-# Turning uploading by ordinary members on or off. Signed like the rest: the
-# setting decides who may write to the operator's disk, so a node that took it
-# from an unsigned message would let any member re-enable it for everyone.
-OP_MEMBER_UPLOAD = "member_upload"
 # Which group "applications" (Chat, Files, and whatever registers later) are
 # shown to members. Signed like the rest: it decides what a member sees, not
 # anything about key material, but an unsigned toggle would let any member
@@ -64,8 +60,7 @@ OP_SET_SCAN_SETTINGS = "set_scan_settings"
 # How many transfers one member may run at once in this group. Signed like the
 # rest: an unsigned cap is one any member can raise for themselves, which makes
 # the control a suggestion. The subject is "d=2,u=2" so what the operator is
-# shown before signing names the outcome and not the operation -- the same rule
-# member_upload's on/off subject follows.
+# shown before signing names the outcome and not the operation.
 OP_TRANSFER_LIMITS = "transfer_limits"
 # Whether the node uses the operator's own API token/language instead of the
 # shipped default — node-wide (docs/mediacenter.md §5.5), one credential
diff --git a/packages/meshbay-common/src/meshbay_common/protocol.py b/packages/meshbay-common/src/meshbay_common/protocol.py
index 5bd2903..5bd1206 100644
--- a/packages/meshbay-common/src/meshbay_common/protocol.py
+++ b/packages/meshbay-common/src/meshbay_common/protocol.py
@@ -148,8 +148,6 @@ class MNP:
     MEMBER_REVOKE_ACK    = "member_revoke_ack"
     MEMBER_UNPIN         = "member_unpin"          # operator → node: forget an identity
     MEMBER_UNPIN_ACK     = "member_unpin_ack"
-    MEMBER_UPLOAD        = "member_upload"         # operator → node: may members upload?
-    MEMBER_UPLOAD_ACK    = "member_upload_ack"
     APPS_ENABLED         = "apps_enabled"          # operator → node: which group apps to show
     APPS_ENABLED_ACK     = "apps_enabled_ack"
     TRANSFER_LIMITS       = "transfer_limits"       # operator → node: per-member caps for this group