fix: a root change reaches every client without a page reload

The directory table travelled on `index_sync` alone — a *full* index, which the
node only ever sends on request. Every ongoing change went out as an
`index_delta`, which carried files and nothing else. So the message that says
"something changed" was the one message that could not say a root had.

The acks hid it: `root_add_ack` and friends broadcast the new table to whoever
is connected, so the common cases looked right. What that could not cover was
the operator's own client, where the ack landed and was then overwritten — the
table calls `onRefreshIndex` after an add, that fetch returns the set from
*before* the node's reload (fire-and-forget, because a rescan is minutes on a
real library), and `applyIndex` writes it over what the ack had just delivered.
The new directory appeared for one paint and vanished.

Two halves. `index_delta` now carries the roots table, sealed with the rest and
identical to `index_sync`'s — additive, so a 1.0 client sees a field it does not
read. And the table no longer refreshes the index after a root change: the ack
gives it the new set immediately, and the delta the node pushes when the scan
finishes gives it again, along with the files.

The test that pins it uses an *eject* as its case, because an eject changes no
file at all — the entries freeze — so its delta is empty of additions,
deletions and updates. Without the table it says literally nothing, which is
how a library disappearing from under a group went unannounced to everyone but
whoever pressed the button.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pvMdvLBG92jyhvD5pD6us

2 files changed, 131 insertions, 1 deletions

diff --git a/packages/meshbay-node/tests/test_index_delta_carries_roots.py b/packages/meshbay-node/tests/test_index_delta_carries_roots.py
new file mode 100644
index 0000000..227f2d0
--- /dev/null
+++ b/packages/meshbay-node/tests/test_index_delta_carries_roots.py
@@ -0,0 +1,131 @@
+"""
+The message that says something changed has to be able to say what.
+
+A group's directory table travelled on `index_sync` alone — a *full* index,
+which the node only ever sends on request. Every ongoing change went out as an
+`index_delta`, which carried files and nothing else. So a root added, removed,
+ejected or plugged by the operator reached every other client's screen only
+when somebody happened to reload the page.
+
+It was hidden by the acks: `root_add_ack` and friends broadcast the new table
+to whoever was connected, so the common cases looked fine. What that could not
+cover is a client connecting mid-change, one whose ack was lost, or — the one
+that surfaced it — the operator's own client, where the ack landed and was then
+overwritten by an index fetched before the node had rebuilt anything.
+
+Additive on the wire (MNP 1.1): a 1.0 client sees a field it does not read.
+"""
+
+from pathlib import Path
+
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+from meshbay_common.crypto import generate_gek
+from meshbay_common.groupbox import PURPOSE_INDEX, unseal
+from meshbay_node.indexer.group_index import GroupIndex
+from meshbay_node.roots import RootSet
+from meshbay_node.transport.wire import index_delta_message, index_sync_message
+
+
+GROUP = "g" * 32
+
+
+def _roots(tmp_path: Path) -> RootSet:
+    for name in ("Films", "Albums"):
+        (tmp_path / name).mkdir()
+    return RootSet.build([
+        {"path": str(tmp_path / "Films"), "writable": True},
+        {"path": str(tmp_path / "Albums"), "removable": True},
+    ])
+
+
+def _index() -> GroupIndex:
+    return GroupIndex(group_id=GROUP, sk_node=Ed25519PrivateKey.generate(),
+                      gek=generate_gek())
+
+
+def _payload(msg: dict, index: GroupIndex) -> dict:
+    """What a member actually reads, through the seal rather than around it."""
+    return unseal(index.gek, PURPOSE_INDEX, msg["type"], GROUP, msg)
+
+
+class _Delta:
+    base_version = 1
+    version = 2
+    additions: list = []
+    deletions: list = []
+    updates: list = []
+
+
+def test_a_delta_carries_the_directory_table(tmp_path):
+    index = _index()
+    msg = index_delta_message(index, _Delta(), _roots(tmp_path))
+    payload = _payload(msg, index)
+
+    assert [r["name"] for r in payload["roots"]] == ["Films", "Albums"]
+    assert payload["roots"][0]["writable"] is True
+    assert payload["roots"][1]["removable"] is True
+
+
+def test_the_table_is_sealed_with_the_rest(tmp_path):
+    """
+    It is group content, not routing. Only `type`, `v` and `group_id` stay in
+    clear, because a receiver has to route and authenticate before it would
+    trust a decryption.
+    """
+    index = _index()
+    msg = index_delta_message(index, _Delta(), _roots(tmp_path))
+    assert set(msg) - {"type", "v", "group_id"}, "nothing was sealed"
+    assert "roots" not in msg, "the directory table is outside the envelope"
+
+
+def test_a_delta_still_works_without_a_table(tmp_path):
+    """
+    The argument is optional, so an older caller — or a path that has no root
+    set to hand — produces a message a client reads exactly as before.
+    """
+    index = _index()
+    payload = _payload(index_delta_message(index, _Delta()), index)
+    assert "roots" not in payload
+    assert payload["version"] == 2
+
+
+def test_the_table_says_the_same_thing_on_both_messages(tmp_path):
+    """
+    Two encodings of one idea is the drift `wire.py` exists to prevent — it
+    already happened twice, for `index_sync` and for `file_chunk`.
+    """
+    index = _index()
+    roots = _roots(tmp_path)
+    delta = _payload(index_delta_message(index, _Delta(), roots), index)
+    sync = _payload(index_sync_message(index, roots), index)
+    assert delta["roots"] == sync["roots"]
+
+
+def test_the_table_never_carries_a_path(tmp_path):
+    """
+    This message goes to every member. Where a directory lives on the
+    operator's disk is theirs — see test_root_paths_are_operator_only.py.
+    """
+    index = _index()
+    payload = _payload(index_delta_message(index, _Delta(), _roots(tmp_path)),
+                       index)
+    assert not any("path" in r for r in payload["roots"])
+
+
+def test_an_ejected_root_is_visible_in_the_delta(tmp_path):
+    """
+    The case this was written for. An eject changes no file — the entries
+    freeze — so the delta it produces is empty of additions, deletions and
+    updates. Without the table it says literally nothing, which is how a
+    library disappearing from under the group's feet went unannounced.
+    """
+    index = _index()
+    roots = _roots(tmp_path)
+    roots.roots[1].ejected = True
+    roots.roots[1].available = False
+
+    payload = _payload(index_delta_message(index, _Delta(), roots), index)
+    assert payload["additions"] == [] and payload["deletions"] == []
+    assert payload["roots"][1]["ejected"] is True
+    assert payload["roots"][1]["available"] is False
diff --git a/packages/meshbay-node/tests/test_root_paths_are_operator_only.py b/packages/meshbay-node/tests/test_root_paths_are_operator_only.py
index 6ba2e08..080d4be 100644
--- a/packages/meshbay-node/tests/test_root_paths_are_operator_only.py
+++ b/packages/meshbay-node/tests/test_root_paths_are_operator_only.py
@@ -21,7 +21,6 @@ import inspect
 import re
 from pathlib import Path
 
-import pytest
 
 from meshbay_node import daemon as daemon_mod
 from meshbay_node import ops