Merge origin/main into the chat encryption work

Both sides landed a breaking MNP change and both called it 2.0, which is right:
the sealed upload, the removal of `stream_seg` and mandatory chat encryption
share one flag day. They are recorded as one version in `__init__.py` rather
than as a race between two.

The resolutions that were decisions rather than mechanics:

* **`MNP_MIN_SUPPORTED` moves to "2.0".** The sealed upload alone was a
  *confined* break — a 1.x peer could still connect, browse, download, stream
  and chat, with only its uploads refused by `upload_not_sealed` — so the floor
  deliberately stayed at "1.0". Mandatory chat encryption ends that
  confinement: a 1.x peer can neither produce a sealed chat message nor read
  one, so it would connect, look fine, and be unable to say anything. Refusing
  it at the handshake is the honest form. The per-message `upload_not_sealed`
  path is untouched and still right if the floor is ever lowered.
* **`sendChat` throws on an `error` reply**, from origin, applied to the sealed
  send. It matters more after this change, not less: the node now refuses a
  stale epoch, a malformed envelope and a device claim that is not the
  connection's own, so there are three new ways for a message to be rejected
  and none of them may look like a message that was sent.
* **`req_id` supersedes the per-type routing** this branch added for
  `chat_keys_resp` and `device_hello_ack`. Both blocks are kept beside the
  existing `chat_hist_resp` one, for the same stated reason — a node too old to
  stamp — and their comments no longer claim to be the mechanism that closes
  the class. `req_id` is.
* **`chat_send_probe.py` is rebuilt on origin's structure**, not beside it: two
  scenarios, a stub that stamps `req_id`, `music_meta_req` as the older pending
  request. The encrypted path is layered on — a real Ed25519 device key
  generated in the page, and a `chat_keys_resp` sealed by the shipped Python,
  because a payload the page built itself would prove only that the page agrees
  with the page.
* **`test_reply_correlation.py` now sends a sealed message.** Its subject is
  which of the two messages leaving that handler carries the id; plaintext chat
  was only the fixture, and the node refuses one now.
* `groupbox` keeps both new purposes (`upload`, `chat_keys`); `protocol.py`
  keeps origin's removal of `STREAM_SEGMENT` and this branch's correction of
  the "Double Ratchet message" comment on `CHAT_MESSAGE`, which was wrong when
  it was written and is wrong differently now.

Full suite on the merged tree: 1993 passed, 11 failed — the same 11 that fail
on a pristine checkout (2 Windows service tests, 1 apps-enabled policy, 7
transcode tests that pass in isolation, and the WebRTC invite test that hangs
on its own).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TZZxYjz8YeWRz13xDi8LJr

1 files changed, 0 insertions, 76 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/transport/quic_server.py b/packages/meshbay-node/src/meshbay_node/transport/quic_server.py
index 284b488..e34153c 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/quic_server.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/quic_server.py
@@ -22,7 +22,6 @@ import base64
 import logging
 import os
 import struct
-import subprocess
 import uuid
 from pathlib import Path
 from typing import Any, Callable
@@ -54,7 +53,6 @@ from meshbay_common.groupbox import PURPOSE_ACK, seal
 from meshbay_common.protocol import MNP, file_chunk_wire
 from meshbay_node.indexer import GroupIndex
 from meshbay_node.transport.wire import index_sync_message
-from meshbay_node import platform
 
 log = logging.getLogger(__name__)
 
@@ -62,16 +60,6 @@ CHUNK_SIZE = 1024 * 1024
 MAX_MSG    = 64 * 1024 * 1024
 ALPN       = ["meshbay-mnp"]
 
-# ffmpeg is spawned per STREAM_SEGMENT request, and `_extract_segment` runs
-# `subprocess.run` synchronously — so without a bound, an authenticated peer can
-# both fork-bomb the node and block its event loop for up to 30 s per request
-# (finding M2c). Extraction now runs in a thread and passes through this
-# semaphore. Small on purpose: the QUIC path has no shipping client yet, this is
-# parity work with the WebRTC transcode cap.
-_MAX_CONCURRENT_SEGMENTS = 4
-_segment_sem = asyncio.Semaphore(_MAX_CONCURRENT_SEGMENTS)
-
-
 class Denylist:
     """
     Denylist for revoked users, groups and invalidated JWTs.
@@ -247,8 +235,6 @@ class _MNPServerProtocol(QuicConnectionProtocol):
                 self._do_index_sync_sync(stream_id)
             elif mtype == MNP.FILE_REQUEST:
                 self._do_file_request_sync(stream_id, msg)
-            elif mtype == MNP.STREAM_SEGMENT:
-                self._spawn(self._do_stream_segment(stream_id, msg))
             elif mtype == MNP.CHAT_MESSAGE:
                 self._do_chat_message_sync(stream_id, msg)
             elif mtype == MNP.PING:
@@ -435,49 +421,6 @@ class _MNPServerProtocol(QuicConnectionProtocol):
             ctx["gek"], file_path, chunk_index, file_hash, entry.id)
         self._send(stream_id, chunk_data)
 
-    async def _do_stream_segment(self, stream_id: int, msg: dict) -> None:
-        """
-        Extract and serve one segment via ffmpeg — off the event loop and behind
-        a concurrency bound, so one request can neither stall the whole node nor
-        fork-bomb it (finding M2c). The WebRTC path has had both since Phase 11.5.
-        """
-        try:
-            ctx = self._group_ctx()
-            file_id = msg["file_id"]
-            segment_index = msg["segment_index"]
-            segment_duration = msg.get("segment_duration", 4)
-
-            entry = ctx["index"].get_entry(file_id)
-            if not entry:
-                self._send(stream_id, {"type": "error", "detail": "File not found"})
-                return
-
-            file_path = entry_abs_path(ctx["roots"], entry)
-            if not file_path.exists():
-                self._send(stream_id, {"type": "error", "detail": "File not on disk"})
-                return
-
-            start_time = segment_index * segment_duration
-            loop = asyncio.get_event_loop()
-            async with _segment_sem:
-                segment_data = await loop.run_in_executor(
-                    None, _extract_segment, file_path, start_time, segment_duration)
-            if segment_data is None:
-                self._send(stream_id, {"type": "error", "detail": "Segment extraction failed"})
-                return
-
-            self._send(stream_id, {
-                "type": MNP.STREAM_SEGMENT,
-                "v": MNP_VERSION,
-                "file_id": file_id,
-                "segment_index": segment_index,
-                "data_b64": base64.b64encode(segment_data).decode(),
-                "size": len(segment_data),
-            })
-        except Exception as e:
-            log.error("stream_segment: %s", e)
-            self._send(stream_id, {"type": "error", "detail": "Segment extraction failed"})
-
     def _do_chat_message_sync(self, stream_id: int, msg: dict) -> None:
         """
         Store a chat message and broadcast it to the rest of THIS group.
@@ -548,25 +491,6 @@ def _read_and_encrypt(
     return file_chunk_wire(gek, plaintext, chunk_index, file_hash, file_id)
 
 
-def _extract_segment(file_path: Path, start_time: float, duration: float) -> bytes | None:
-    """Extract one HLS segment via ffmpeg. Returns MPEG-TS bytes or None on failure."""
-    try:
-        result = subprocess.run(
-            [platform.ffmpeg_cmd(), "-hide_banner", "-loglevel", "error",
-             "-ss", str(start_time),
-             "-i", str(file_path),
-             "-t", str(duration),
-             "-c:v", "copy", "-c:a", "copy",
-             "-f", "mpegts", "pipe:1"],
-            capture_output=True, timeout=30,
-        )
-        if result.returncode == 0 and result.stdout:
-            return result.stdout
-        return None
-    except Exception:
-        return None
-
-
 # ── QuicChunkServer ────────────────────────────────────────────────────────────
 
 class QuicChunkServer: