1 files changed, 22 insertions, 14 deletions

diff --git a/packages/meshbay-node/tests/test_root_writable_policy.py b/packages/meshbay-node/tests/test_root_writable_policy.py
index 8345880..730e636 100644
--- a/packages/meshbay-node/tests/test_root_writable_policy.py
+++ b/packages/meshbay-node/tests/test_root_writable_policy.py
@@ -1,10 +1,11 @@
 """
 Who may write to the operator's disk, now that RO/RW on the root decides it.
 
-This replaces `test_member_upload_policy.py`. The old model had two orthogonal
-controls — one root designated as the upload target, and a group-wide
-`member_upload` switch — and collapsed into one property per root: `writable`.
-The properties worth keeping from the old file survive the change unaltered:
+One property per root — `writable` — and no second control anywhere: not a
+group-wide switch, not a designated upload target. Two controls for one question
+is a question answered differently depending on which is read first.
+
+The properties this holds:
 
 * the interface hiding a control is a courtesy to the people who are not
   trying; **the node refusing is the part that holds** against someone who is.
@@ -220,25 +221,32 @@ async def test_a_request_with_nobody_to_authorize_it_is_refused(tmp_path):
     assert [m for m in session.sent if m.get("type") == "error"]
 
 
-# ── The deprecated message must not still work ───────────────────────────────
+# ── There is no group-wide upload switch ─────────────────────────────────────
 
-async def test_the_old_member_upload_message_changes_nothing(tmp_path):
+async def test_no_message_can_reopen_uploads_for_a_whole_group(tmp_path):
     """
-    MNP still parses `member_upload` so an old client gets an answer instead of
-    a dropped request. What it must not do is act: this instruction could
-    reopen uploads for a whole group, and a client old enough to send it is
-    exactly one that knows nothing about read-only roots.
+    Whether a member may write is a property of each root, and there is no
+    second way to say it.
+
+    A group-wide switch is the thing this model replaced, and it cannot come
+    back by accident: the type does not exist, so a peer asking for it is a peer
+    the dispatcher logs and ignores. What must never happen is what a switch
+    would have allowed — one instruction turning a published, read-only library
+    into a writable one.
     """
+    assert not hasattr(MNP, "MEMBER_UPLOAD"), (
+        "a group-wide upload switch is back in the protocol")
+
     session = _session(tmp_path, "member-1", writable=False)
     session._has_admin_authority = lambda: True
     issued = _capture_challenges(session)
 
-    session._do_member_upload({"allowed": True})
+    session._dispatch_message({"type": "member_upload", "allowed": True})
 
-    assert issued == [], "a deprecated instruction asked to be signed"
+    assert issued == [], "an unknown instruction asked to be signed"
     assert session._ctx["roots"].roots[0].writable is False
-    acks = [m for m in session.sent if m.get("type") == MNP.MEMBER_UPLOAD_ACK]
-    assert acks and acks[0].get("deprecated") is True
+    assert not [m for m in session.sent if "upload" in str(m.get("type"))], (
+        "the node answered an instruction it does not implement")
 
     # And the door is still shut.
     _upload(session)