fix: stop a stream on close, count only real users, record where a node is

**Closing the viewer left the node working.** Nothing told it to stop:
the player dropped its handlers, which only made the browser deaf. ffmpeg
kept running and held one of the node's two transcode slots until the
credit timeout expired two minutes later — which is why the next video
answered "server busy". `stream_stop` ends it at once, and the viewer
also drops its queue, ends the MediaSource and revokes the object URL on
the way out, any of which could be holding megabytes of decrypted video.

While there: `file_chunk` replies were matched to their requests by
arrival order, which was true by luck rather than by construction. The
reply now names the file it belongs to and is matched on that and the
chunk index; a chunk nobody is waiting for is dropped instead of being
handed to whatever request happens to be oldest.

**The administration panel counted its own history.** A deleted account
is tombstoned so the connection log stays readable, and every count and
list treated that row as a user — including a group's member count, and
the member list of the group itself. They do not any more.

**Where a node is.** `endpoint_hint` is what a node believes its address
to be, learned from a STUN server and sent to us: useful for reaching it,
and a claim. The announcement that carries it is signed with the node key
over a fresh timestamp, so the address that request *arrives from* is the
address of whoever holds that key — that is now recorded on the node row
and shown in a Nodes tab, next to the hint, with the difference spelled
out. Clients get the same treatment: `webrtc_offer` is logged with the
address the hub saw when a browser starts a peer connection.

Verified against the live deployment: the node's row reads 90.112.206.172
after a restart, and in e2e a stopped stream goes quiet in one message
and the next one starts immediately instead of being refused.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 35 insertions, 0 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport.js b/packages/meshbay-hub/src/meshbay_hub/static/transport.js
index 844a201..df2abb0 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/transport.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/transport.js
@@ -562,6 +562,18 @@ class MeshBayTransport {
   }
 
   /**
+   * Nobody is watching any more.
+   *
+   * Closing the viewer used to say nothing to the node, which went on
+   * transcoding and holding one of its two slots until the credit timeout — so
+   * the next video answered "server busy".
+   */
+  stopStream() {
+    if (!this._connected) return;
+    try { this._send({ type: 'stream_stop', v: '0.1' }); } catch { /* gone */ }
+  }
+
+  /**
    * Push a whole file, several chunks in flight at once.
    *
    * One chunk per round trip is 48 KB of throughput per RTT no matter how much
@@ -778,6 +790,11 @@ class MeshBayTransport {
       }, 30000);
       this._pending.set(id, {
         _reqType: obj.type,
+        // Chunks are the one request that runs several at a time and can be
+        // interleaved with anything else on the channel. Matching them by
+        // arrival order was only ever true by luck; this makes it true.
+        _key: obj.type === 'file_req'
+          ? `chunk:${obj.file_id}:${obj.chunk_index}` : null,
         resolve: (msg) => { clearTimeout(timeout); this._pending.delete(id); resolve(msg); },
         reject: (err) => { clearTimeout(timeout); this._pending.delete(id); reject(err); },
       });
@@ -857,6 +874,24 @@ class MeshBayTransport {
       return;
     }
 
+    if (msg.type === 'file_chunk') {
+      const key = `chunk:${msg.file_id}:${msg.chunk_index}`;
+      for (const [, handler] of this._pending) {
+        // A node from before the reply carried a file_id: fall back to the
+        // index, which is still better than the oldest pending request.
+        const match = msg.file_id
+          ? handler._key === key
+          : handler._key && handler._key.endsWith(`:${msg.chunk_index}`);
+        if (match) {
+          handler.resolve(msg);
+          return;
+        }
+      }
+      // Nobody asked for it any more — a cancelled download, most likely. It
+      // must not be handed to whatever request happens to be waiting.
+      return;
+    }
+
     const oldest = this._pending.entries().next();
     if (!oldest.done) {
       const [, handler] = oldest.value;