feat(protocol): MNP 4.0 flag day for the node-audience token (B2)

The node-audience token (previous commit) is a change to what a peer must
present, so it is a MAJOR per the versioning rule (§5.6): a pre-4.0 client
presents its hub session token and a 4.0 node refuses it, and there is no
compatibility branch, because leaving one would keep a hub credential reachable
by every node (C6's lesson). So the floor moves with the version.

- MNP_VERSION 3.4 -> 4.0 and MNP_MIN_SUPPORTED 3.0 -> 4.0 (meshbay_common);
  transport.js MNP_V/MNP_V_MIN -> 4.0 to match.
- MIN_CLIENT_VERSION 0.13.0 -> 0.16.0 so a stale desktop client is told to
  update before connecting rather than meeting a handshake refusal it cannot
  read; the browser reloads this build from the hub.
- Regenerate tests/golden/dispatch.json: the only change is the `v` the node
  stamps on outbound messages, 3.4 -> 4.0 (56 cases, v field only).
- Document the split and the flag day: MESHBAY_DESIGN.md §5.2 (the handshake
  token is the MNP-audience token), §5.6 (the 4.0 flag day), register E10 and
  decision 23; MESHBAY_NODE_PROTOCOL.md §6.3 (authorize_token binds MNP_AUD)
  and the wire-version banner.

Deploy is coordinated and atomic (common+hub+node+SPA together); a live
browser-to-node validation and the deploy itself remain. common (173), node
(1489, the pre-existing test_cli_golden argparse/prog artifact aside) and hub
(1471) suites all green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2 files changed, 16 insertions, 12 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/api/hub.py b/packages/meshbay-hub/src/meshbay_hub/api/hub.py
index cab60c8..efebc4d 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/hub.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/hub.py
@@ -78,8 +78,13 @@ async def hub_pubkey():
 # handshake refusal anyway. The operator is updating every client, node and hub
 # by hand for this flag day, which is what makes that acceptable exactly once.
 # The gate is in place for the next one, where it will work as intended.
-MIN_CLIENT_VERSION = "0.13.0"
-RECOMMENDED_CLIENT_VERSION = "0.13.0"
+#
+# 0.16.0 is the MNP 4.0 flag day: a client older than this presents its hub
+# session token to a node, which a 4.0 node refuses. A desktop client below
+# 0.16.0 is told to update *before* it connects rather than meeting a handshake
+# refusal it cannot read; the browser reloads this build from the hub.
+MIN_CLIENT_VERSION = "0.16.0"
+RECOMMENDED_CLIENT_VERSION = "0.16.0"
 
 
 @router.get("/version")
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport.js b/packages/meshbay-hub/src/meshbay_hub/static/transport.js
index 27edc4e..f3683eb 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/transport.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/transport.js
@@ -305,16 +305,15 @@ window.addEventListener('hashchange', () => {
 // The `v: '0.1'` on every other message in this file is the historical value
 // and is read by nothing; it is left alone deliberately. The range is
 // negotiated once, at the start, not restated per message.
-const MNP_V = '3.1';
-// **Not** raised with it, and that is the whole difference between 3.0 and 3.1.
-// 3.0 was a flag day because a node older than it cannot grant the lease this
-// client opens for every download and upload, so talking to one would mean
-// every transfer failing for a reason the person cannot act on. 3.1 only adds
-// `user_blob_*`: a 3.0 node answers "unknown message type" and the client
-// stores its playlists on the next node it reaches, keeping its own copy
-// meanwhile (docs/playlists.md §6.4). Refusing every 3.0 node over a feature
-// that degrades this quietly would be the flag day nobody needed.
-const MNP_V_MIN = '3.0';
+const MNP_V = '4.0';
+// Raised with it: 4.0 is a flag day. A member now presents a short-lived
+// MNP-audience token in the handshake, not its hub session token — a node
+// older than 4.0 expected the session token, and one newer refuses it, so the
+// two cannot authenticate across the break. This is the C6 rule: no
+// compatibility branch, or the old path (a hub credential handed to a node)
+// stays reachable. The desktop client is gated by client.minimum before it
+// even connects; the browser picks up this build on reload.
+const MNP_V_MIN = '4.0';
 
 // Codes a NODE sends us, in its own vocabulary (meshbay_common/handshake.py's
 // check_version): `version_too_old` means *we* are too old for it,