Merge branch 'refactor/groups-phase1'

Groups refactor, phases 1-3.

The root model replaces the old `upload` flag and group-wide `member_upload`
with per-root `writable`/`removable`/`ejected`, carried by a `RootSet` that
both front doors — the loopback API and signed MNP — reach through the same
`ops` functions. MNP goes to 1.1, additively: the roots table now rides on
`index_delta`, so a root added, removed, ejected or plugged reaches every
connected client instead of only whoever reloaded.

The group UI becomes a plugin architecture: an application is a registry
entry in `apps.js` plus its own files, with directories stored generically
by `ops.set_app_directories` under whatever the app is called. A reference
application, hidden behind `?dev=1`, is what makes that claim testable —
adding it is what found the two places still naming apps by hand.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pvMdvLBG92jyhvD5pD6us

1 files changed, 10 insertions, 7 deletions

diff --git a/packages/meshbay-node/tests/test_audio_root_policy.py b/packages/meshbay-node/tests/test_audio_root_policy.py
index 576c08a..e2e9254 100644
--- a/packages/meshbay-node/tests/test_audio_root_policy.py
+++ b/packages/meshbay-node/tests/test_audio_root_policy.py
@@ -125,17 +125,20 @@ async def test_the_setting_lives_on_the_node_and_survives_a_restart(tmp_path):
     roster = Roster(db_path=tmp_path / "roster.db")
     await roster.open()
     try:
-        assert await roster.audio_root("g1") == "", "absent must mean unset"
-        await roster.set_audio_root("g1", "shared/Music", set_by="op")
-        assert await roster.audio_root("g1") == "shared/Music"
+        assert await roster.app_directories("g1", "music") == [], (
+            "absent must mean unset")
+        await roster.set_app_directories("g1", "music", ["shared/Music"],
+                                         set_by="op")
+        assert await roster.app_directories("g1", "music") == ["shared/Music"]
     finally:
         await roster.close()
 
     reopened = Roster(db_path=tmp_path / "roster.db")
     await reopened.open()
     try:
-        assert await reopened.audio_root("g1") == "shared/Music"
-        assert await reopened.audio_root("g2") == "", "one group's setting must not answer for another"
+        assert await reopened.app_directories("g1", "music") == ["shared/Music"]
+        assert await reopened.app_directories("g2", "music") == [], (
+            "one group's setting must not answer for another")
     finally:
         await reopened.close()
 
@@ -239,7 +242,7 @@ async def test_a_real_signed_save_persists_and_survives_a_fresh_roster_read(tmp_
 
         assert session._ctx["groups"][GROUP]["audio_root"] == "shared/Music", (
             "the live in-memory context must reflect the new root immediately")
-        assert await roster.audio_root(GROUP) == "shared/Music", (
+        assert await roster.app_directories(GROUP, "music") == ["shared/Music"], (
             "the same Roster instance must read back what it just wrote")
     finally:
         await roster.close()
@@ -249,7 +252,7 @@ async def test_a_real_signed_save_persists_and_survives_a_fresh_roster_read(tmp_
     # actually answers "does it survive a reload".
     reopened = await open_roster(tmp_path)
     try:
-        assert await reopened.audio_root(GROUP) == "shared/Music", (
+        assert await reopened.app_directories(GROUP, "music") == ["shared/Music"], (
             "a freshly-opened Roster against the same db file must see the "
             "committed value — anything else means the write was never "
             "durable in the first place")