2 files changed, 39 insertions, 4 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/hub.py b/packages/meshbay-hub/src/meshbay_hub/api/hub.py
index 8223400..a48313d 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/hub.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/hub.py
@@ -54,8 +54,21 @@ async def hub_pubkey():
 # user "update to keep using this" before it becomes "this stopped working".
 # Raise `minimum` only for a change a client genuinely cannot survive, and
 # remember store review latency makes that expensive on Android.
-MIN_CLIENT_VERSION = "0.1.0"
-RECOMMENDED_CLIENT_VERSION = "0.1.0"
+# Raised on the MNP 3.0 flag day (2026-09-09). A client older than this speaks
+# MNP 2.x, cannot ask for a transfer lease, and is refused at the node's
+# handshake with `version_too_old` — a refusal in a protocol vocabulary that
+# surfaces as "the node will not talk to me". The client checks this field
+# before connecting and says something a person can act on instead.
+#
+# **This first raise does not reach the clients already installed**, and that is
+# understood rather than overlooked. `package.json` had drifted to "1.0.0" while
+# every other package was on 0.12.0, so an installed client announces a version
+# that sorts *above* this minimum and sails through the gate — then meets the
+# handshake refusal anyway. The operator is updating every client, node and hub
+# by hand for this flag day, which is what makes that acceptable exactly once.
+# The gate is in place for the next one, where it will work as intended.
+MIN_CLIENT_VERSION = "0.13.0"
+RECOMMENDED_CLIENT_VERSION = "0.13.0"
 
 
 @router.get("/version")
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/webapp.py b/packages/meshbay-hub/src/meshbay_hub/api/webapp.py
index 3cfb208..96b93bb 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/webapp.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/webapp.py
@@ -111,8 +111,30 @@ CSP = "; ".join([
     "font-src 'self'",
     "connect-src 'self' https: wss:",
     "worker-src 'self'",
-    f"frame-src {_RECAPTCHA_SRC}",
-    "frame-ancestors 'none'",
+    # `'self'` is not decoration: the streamed-download path works by navigating
+    # a hidden iframe to `/_mbdl/<id>` so the service worker is asked for the
+    # response it is holding. Without it Chrome refuses the frame, the worker is
+    # never asked, and the page waits out its timeout for a download that cannot
+    # happen — on Firefox and Safari that is the *only* way to write a large
+    # file to disk, so the whole path was dead. Added when reCAPTCHA needed a
+    # frame, which is why nobody connected the two.
+    f"frame-src 'self' {_RECAPTCHA_SRC}",
+    # `'self'`, not `'none'`, and the difference is one same-origin iframe.
+    #
+    # The threat frame-ancestors answers is clickjacking: a *foreign* page
+    # framing this one and stealing clicks. `'self'` refuses every foreign
+    # origin exactly as `'none'` does — what it additionally allows is this
+    # origin framing itself, which is precisely how a streamed download works
+    # (a hidden iframe navigates to `/_mbdl/<id>` so the service worker is
+    # asked for the response it holds).
+    #
+    # Under `'none'` Firefox blocked that frame, the worker was never asked,
+    # and every large download waited out two 15-second timeouts and then fell
+    # through — on Firefox and Safari that is the only way to write a large
+    # file to disk. Chrome did not show it: its worker intercepts the
+    # navigation before the network response and its CSP are ever considered,
+    # which is why this looked like a Firefox-only problem for an afternoon.
+    "frame-ancestors 'self'",
     "base-uri 'none'",
     "form-action 'none'",
 ])