feat(node): the operator can close uploading to everyone but themselves

A group where every member may add files stays the default. Some groups want a
library the operator curates, and until now the only way to get one was to
designate no upload root at all — which refuses the operator too.

**The node enforces it; the interface merely stops offering it.** The Upload
button in the Files toolbar and the paperclip in the chat composer both
disappear, which is a courtesy to the people who are not trying. The control is
`_do_file_upload` refusing with `member_upload_off`, so a member on an old tab,
or one speaking MNP directly, gets the same answer. There is a test for each,
and the enforcement test is in the node package rather than beside the UI one so
nobody reads the hidden button as the mechanism.

**Changing it is a signed operator instruction** — `OP_MEMBER_UPLOAD`, on the
same path as removing a member. An unsigned one would let any member turn it
back on and make the setting a suggestion. The transcript's subject is `on` or
`off`: what the operator is shown before signing has to name the outcome, not
the operation.

**It lives on the node**, in a new `group_settings` table in `roster.db`. Not
the hub, which has no business deciding who may write to someone else's disk.
Not `node.toml` either: that file is hand-written and full of comments recording
decisions, `ops.py` appends to it rather than round-tripping it through a
writer, and a setting toggled from a panel must not rewrite the operator's file
or need a restart. The value is cached in the group context because the upload
path is synchronous, and the signed operation updates both — storing it without
applying it would make the panel say one thing while the node did another.

**Absent means allowed**, at every layer: no row in the table, no key in the
context, no field in `handshake_ack`. An older node and an older client both
behave exactly as before, and upgrading never silently closes a group. Each of
those three has its own test, because they fail independently.

The operator is always exempt — otherwise turning it off locks them out of their
own node with a config file and a restart as the only way back. `is_node_admin`
was being computed in two places by then and is now one function, since two
copies of "is this the operator" is how the ack and the gate come to disagree.

A change reaches everyone already connected via `member_upload_ack`, so the
button goes without a reconnection. That message is both a broadcast and the
reply to the request that caused it, which is why the client does not return
early on it.

Docs updated for a cold start: draft-v6 §2.1b and change 9, a new "Where Phase
13 stands" section in CLAUDE.md recording what is built, deployed and still
missing, the module map row, and desktop-client-v1 §10b on the Settings tab and
where group settings live.

883 tests pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 122 insertions, 0 deletions

diff --git a/packages/meshbay-hub/tests/test_upload_controls_hidden.py b/packages/meshbay-hub/tests/test_upload_controls_hidden.py
new file mode 100644
index 0000000..d859125
--- /dev/null
+++ b/packages/meshbay-hub/tests/test_upload_controls_hidden.py
@@ -0,0 +1,122 @@
+"""
+When the operator closes uploading, the controls go — both of them.
+
+There are two ways to put a file into a group and they are in different
+components: the Upload button in the Files toolbar, and the paperclip in the
+chat composer. Hiding one and forgetting the other is the obvious mistake, and
+the second one is the easier to forget because it does not look like an upload.
+
+Nothing here is a security property. **The node refuses the upload** — that is
+`test_member_upload_policy.py` in the node package. This is about not offering
+somebody a button whose only outcome is an error message.
+"""
+
+import re
+from pathlib import Path
+
+import pytest
+
+STATIC = Path(__file__).resolve().parents[1] / "src" / "meshbay_hub" / "static"
+APP = STATIC / "app.js"
+TRANSPORT = STATIC / "transport.js"
+
+pytestmark = pytest.mark.skipif(not APP.exists(), reason="SPA sources unavailable")
+
+
+@pytest.fixture(scope="module")
+def app() -> str:
+    return APP.read_text(encoding="utf-8")
+
+
+def _component(app: str, name: str) -> str:
+    start = app.index(f"\nfunction {name}(")
+    end = app.find("\nfunction ", start + 1)
+    return app[start:end if end != -1 else len(app)]
+
+
+# ── Both controls ───────────────────────────────────────────────────────────
+
+def test_the_files_toolbar_hides_its_upload_button(app):
+    page = _component(app, "GroupPage")
+    toolbar = page[page.index("file-toolbar"):]
+    toolbar = toolbar[:toolbar.index("group.mkdir")]
+    assert "mayUpload &&" in toolbar, "the Upload button is offered regardless"
+
+
+def test_the_chat_composer_hides_its_paperclip(app):
+    chat = _component(app, "ChatPanel")
+    composer = chat[chat.index("chat-input-row"):]
+    assert "mayUpload &&" in composer, (
+        "the chat attachment is the second way in and is still offered")
+
+
+def test_both_read_the_same_answer(app):
+    """Two derivations would eventually disagree, and the disagreement would
+    be one of them offering an upload the node refuses."""
+    page = _component(app, "GroupPage")
+    assert re.search(r"const mayUpload = memberUpload \|\| isNodeAdmin;", page), (
+        "mayUpload is no longer derived in one place")
+    assert "mayUpload=${mayUpload}" in page, "the chat panel is told separately"
+
+
+def test_the_operator_keeps_their_own_controls(app):
+    page = _component(app, "GroupPage")
+    assert "memberUpload || isNodeAdmin" in page, (
+        "turning uploads off would hide the operator's own upload button")
+
+
+# ── Learning the answer ─────────────────────────────────────────────────────
+
+def test_the_answer_comes_from_the_node(app):
+    """Not from the hub, which has no say in what may be written to someone
+    else's disk, and no way to be believed about it."""
+    page = _component(app, "GroupPage")
+    assert "ack.member_upload !== false" in page, (
+        "the handshake ack is what carries this")
+    assert "hubFetch" not in page[page.index("ack.member_upload") - 400:
+                                  page.index("ack.member_upload")]
+
+
+def test_an_older_node_is_treated_as_permissive(app):
+    """A node that predates the setting sends no such field. Reading a missing
+    field as "off" would close every group on the older half of the network."""
+    page = _component(app, "GroupPage")
+    assert "!== false" in page[page.index("ack.member_upload"):
+                               page.index("ack.member_upload") + 60]
+
+
+def test_a_change_reaches_people_already_connected(app):
+    """The operator may be someone else entirely, changing it while you have
+    the group open. A button that survives until the next reconnection is a
+    button somebody presses."""
+    page = _component(app, "GroupPage")
+    assert "transport.onUploadPolicy" in page
+    transport = TRANSPORT.read_text(encoding="utf-8")
+    assert "member_upload_ack" in transport, "nothing routes the node's notice"
+
+
+def test_the_notice_still_answers_the_operators_own_request(app):
+    """The same message is both a broadcast and the reply to the request that
+    caused it — returning early on it would leave that request hanging until it
+    timed out."""
+    transport = TRANSPORT.read_text(encoding="utf-8")
+    block = transport[transport.index("member_upload_ack"):]
+    block = block[:block.index("index_sync")]
+    assert "return" not in block
+
+
+# ── Changing it ─────────────────────────────────────────────────────────────
+
+def test_changing_it_is_signed(app):
+    transport = TRANSPORT.read_text(encoding="utf-8")
+    method = transport[transport.index("async setMemberUpload("):]
+    method = method[:method.index("\n  async ", 1)]
+    assert "admin_challenge" in method and "_authorizeAdminOp" in method, (
+        "an unsigned instruction would let any member turn uploads back on")
+
+
+def test_only_the_operator_is_offered_the_setting(app):
+    panel = _component(app, "GroupSettingsPanel")
+    section = panel[panel.index("members.uploads_title") - 400:
+                    panel.index("members.uploads_title")]
+    assert "isNodeAdmin && connected" in section