style: the 98 ruff could not fix, so the linter is a signal again

The pass before this applied ruff's own fixes. These are the ones needing a
decision, and the point of doing them is that `ruff check .` now passes: a
linter reporting 98 known-acceptable findings reports nothing, because the next
real one arrives invisible.

**Lines over 100 (70).** Mostly wrapped where they stood. Two exceptions: the
aligned trailing comments in `protocol.py`'s message table were shortened rather
than wrapped, because wrapping one row of a table breaks the table; and in
`models.py` the column comments moved above their columns for the same reason.

**Imports below the first statement (14).** `csam.py` kept its FastAPI imports
under a section header halfway down the file; two node tests had a constant and
a `pytestmark` wedged between two import blocks. Moved, not suppressed.

**Bindings nothing reads (4).** Three in tests, where the call stays and only the
name goes — `_user(client, "listener")` is there to create the user, not to
return one. The fourth was in `revocation.py` and was not a lint finding at all:
`_connect_and_listen` opened an httpx stream to the WebSocket URL, did `pass`,
and then opened the real connection through the `websockets` library. One
pointless request per connect, left over from before that library was used
directly. Removed, and `httpx` with it.

**`l` as a name (4)**, **semicolons (6)** in the POC spikes, and the rest.

2893 passed, the same count as the two commits before it.

`meshbay_node/revocation.py` is worth a decision separately: 154 lines that
nothing imports, superseded by `hub_client.maintain_ws`'s `on_revocation`. This
commit only stopped it failing the linter.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

43 files changed, 175 insertions, 109 deletions

diff --git a/packages/meshbay-common/src/meshbay_common/protocol.py b/packages/meshbay-common/src/meshbay_common/protocol.py
index d6e30e7..5374742 100644
--- a/packages/meshbay-common/src/meshbay_common/protocol.py
+++ b/packages/meshbay-common/src/meshbay_common/protocol.py
@@ -68,7 +68,8 @@ class MNP:
     # and no client: removed rather than repaired.
     #
     # Not a Double Ratchet message, and never was — finding C1
-    # (`docs/MESHBAY_DESIGN.md` §13.1) rejected exactly that for groups. Since MNP 2.0 it is AES-256-GCM under a
+    # (`docs/MESHBAY_DESIGN.md` §13.1) rejected exactly that for groups. Since
+    # MNP 2.0 it is AES-256-GCM under a
     # per-device subkey of the group's chat epoch key, signed over the
     # ciphertext with the sending device's pinned Ed25519 key. There is no
     # plaintext form on the wire (`chatbox.py`, docs/MESHBAY_DESIGN.md §4.5);
@@ -158,21 +159,21 @@ class MNP:
     MEMBER_UNPIN_ACK     = "member_unpin_ack"
     APPS_ENABLED         = "apps_enabled"          # operator → node: which group apps to show
     APPS_ENABLED_ACK     = "apps_enabled_ack"
-    TRANSFER_LIMITS       = "transfer_limits"       # operator → node: per-member caps for this group
+    TRANSFER_LIMITS       = "transfer_limits"       # operator → node: per-member caps here
     TRANSFER_LIMITS_ACK   = "transfer_limits_ack"   # node → this group: the new caps
     SET_SCAN_SETTINGS     = "set_scan_settings"     # operator → node: reconcile/debounce timing
     SET_SCAN_SETTINGS_ACK = "set_scan_settings_ack"
     MEDIA_META_REQ        = "media_meta_req"        # client → node: TMDB metadata for a path
     MEDIA_META_RESP       = "media_meta_resp"       # node → client: TMDB metadata (or none)
-    TMDB_CONFIG           = "tmdb_config"            # operator → node: set custom TMDB token/language (node-wide)
-    TMDB_CONFIG_ACK       = "tmdb_config_ack"        # node → everyone: new TMDB config (never the token)
-    TMDB_ENABLED          = "tmdb_enabled"           # operator → node: enable/disable TMDB for this group
-    TMDB_ENABLED_ACK      = "tmdb_enabled_ack"       # node → this group: new per-group TMDB enabled state
-    SEASON_META_REQ       = "season_meta_req"        # client → node: TMDB overview/poster for one season
-    SEASON_META_RESP      = "season_meta_resp"       # node → client: season-level TMDB fields (or none)
-    TMDB_SEARCH_REQ       = "tmdb_search_req"        # client → node: candidate TMDB matches for a query
-    TMDB_SEARCH_RESP      = "tmdb_search_resp"       # node → client: candidate list (id, title, year, poster)
-    TMDB_OVERRIDE         = "tmdb_override"          # operator → node: replace a show/movie's TMDB match
+    TMDB_CONFIG           = "tmdb_config"            # operator → node: token/language, node-wide
+    TMDB_CONFIG_ACK       = "tmdb_config_ack"        # node → everyone: config, never the token
+    TMDB_ENABLED          = "tmdb_enabled"           # operator → node: TMDB on/off here
+    TMDB_ENABLED_ACK      = "tmdb_enabled_ack"       # node → this group: TMDB on/off here
+    SEASON_META_REQ       = "season_meta_req"        # client → node: one season's overview
+    SEASON_META_RESP      = "season_meta_resp"       # node → client: season fields, or none
+    TMDB_SEARCH_REQ       = "tmdb_search_req"        # client → node: candidates for a query
+    TMDB_SEARCH_RESP      = "tmdb_search_resp"       # node → client: id, title, year, poster
+    TMDB_OVERRIDE         = "tmdb_override"          # operator → node: replace a match
     TMDB_OVERRIDE_ACK     = "tmdb_override_ack"
     TMDB_REMATCH          = "tmdb_rematch"           # operator → node: drop one file's match
     TMDB_REMATCH_ACK      = "tmdb_rematch_ack"
@@ -255,7 +256,7 @@ class MNP:
     # key without having to reconnect.
     CHAT_EPOCH            = "chat_epoch"
     CHAT_EPOCH_ACK        = "chat_epoch_ack"
-    ROOT_UPDATE          = "root_update"           # operator → node: change writable/removable on a root
+    ROOT_UPDATE          = "root_update"           # operator → node: a root's flags
     ROOT_UPDATE_ACK      = "root_update_ack"
     ROOT_EJECT           = "root_eject"            # operator → node: mark removable root as ejected
     ROOT_EJECT_ACK       = "root_eject_ack"
@@ -269,7 +270,7 @@ class MNP:
     # node's `sender_id` (Tier 2, docs/MESHBAY_DESIGN.md §3.3).
     GROUP_ROSTER_REQ     = "group_roster_req"
     GROUP_ROSTER_RESP    = "group_roster_resp"
-    ROSTER_READ          = "roster_read"            # operator → node: list pinned identities + members
+    ROSTER_READ          = "roster_read"            # operator → node: identities + members
     ROSTER_READ_ACK      = "roster_read_ack"
     DENYLIST_READ        = "denylist_read"          # operator → node: show denylist entries
     DENYLIST_READ_ACK    = "denylist_read_ack"
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/admin.py b/packages/meshbay-hub/src/meshbay_hub/api/admin.py
index d8e13e9..b4b2f4f 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/admin.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/admin.py
@@ -317,7 +317,8 @@ async def admin_patch_user(
         if body.role not in ("user", "moderator", "admin"):
             raise HTTPException(status_code=422, detail="role must be user, moderator, or admin")
         user.role = body.role
-        log.info("User %s role changed to %s by %s", user.username, body.role, current_user.username)
+        log.info("User %s role changed to %s by %s",
+                 user.username, body.role, current_user.username)
         await create_notification(
             db, user.id, "role_change",
             f"Your role has been changed to {body.role}",
@@ -325,7 +326,9 @@ async def admin_patch_user(
 
     if body.status is not None:
         if body.status not in ("active", "suspended", "revoked"):
-            raise HTTPException(status_code=422, detail="status must be active, suspended, or revoked")
+            raise HTTPException(
+                status_code=422,
+                detail="status must be active, suspended, or revoked")
         user.status = body.status
         log.info("User %s status changed to %s by %s",
                  user.username, body.status, current_user.username)
@@ -483,7 +486,9 @@ async def admin_patch_group(
 
     if body.status is not None:
         if body.status not in ("active", "suspended", "revoked"):
-            raise HTTPException(status_code=422, detail="status must be active, suspended, or revoked")
+            raise HTTPException(
+                status_code=422,
+                detail="status must be active, suspended, or revoked")
         group.status = body.status
         log.info("Group %s status changed to %s by %s",
                  group.name, body.status, current_user.username)
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/relay.py b/packages/meshbay-hub/src/meshbay_hub/api/relay.py
index 08d935b..7bb3f66 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/relay.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/relay.py
@@ -102,7 +102,8 @@ async def relay_register(
     approved = _relays.get(body.relay_id)
     if not approved or approved.get("pk") != body.pk_relay:
         raise HTTPException(status_code=403,
-                            detail="Relay not approved — ask hub admin to run POST /v1/relays/approve")
+                            detail="Relay not approved — ask the hub admin to "
+                                   "run POST /v1/relays/approve")
 
     if body.timestamp is None or not body.signature:
         raise HTTPException(
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/users.py b/packages/meshbay-hub/src/meshbay_hub/api/users.py
index ee8aabc..2666e86 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/users.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/users.py
@@ -1312,7 +1312,9 @@ async def register_node_key(
         if len(raw) != 32:
             raise ValueError
     except Exception:
-        raise HTTPException(status_code=400, detail="Invalid Ed25519 public key (need 32 bytes base64)")
+        raise HTTPException(
+            status_code=400,
+            detail="Invalid Ed25519 public key (need 32 bytes base64)")
 
     current_user.pk_node_ed25519 = body.pk_node_ed25519
     await db.commit()
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/webapp.py b/packages/meshbay-hub/src/meshbay_hub/api/webapp.py
index 3e23961..054d04a 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/webapp.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/webapp.py
@@ -168,7 +168,8 @@ _HTML = """\
        though it had scrolled away. This asks for the keyboard to resize the
        layout viewport instead, so what is pinned stays where it is looked at.
        Ignored by browsers that do not know it. -->
-  <meta name="viewport" content="width=device-width, initial-scale=1, interactive-widget=resizes-content">
+  <meta name="viewport"
+        content="width=device-width, initial-scale=1, interactive-widget=resizes-content">
   <title>MeshBay</title>
   <link rel="stylesheet" href="/a/{v}/style.css">
 </head>
diff --git a/packages/meshbay-hub/src/meshbay_hub/csam.py b/packages/meshbay-hub/src/meshbay_hub/csam.py
index e540068..b8e8d04 100644
--- a/packages/meshbay-hub/src/meshbay_hub/csam.py
+++ b/packages/meshbay-hub/src/meshbay_hub/csam.py
@@ -22,6 +22,11 @@ must be reported to NCMEC (US law) or relevant authority immediately.
 import logging
 from pathlib import Path
 
+from fastapi import APIRouter, Depends, HTTPException
+
+from meshbay_hub.api.deps import require_admin
+from meshbay_hub.db.models import User
+
 log = logging.getLogger(__name__)
 
 # Default path for the CSAM hash database (blake3 hex hashes, one per line)
@@ -121,11 +126,6 @@ def check_content_hash(blake3_hex: str) -> bool:
 
 # ── Hub API integration ───────────────────────────────────────────────────────
 
-from fastapi import APIRouter, Depends, HTTPException
-
-from meshbay_hub.api.deps import require_admin
-from meshbay_hub.db.models import User
-
 csam_router = APIRouter(prefix="/v1/admin/csam", tags=["csam"])
 
 
diff --git a/packages/meshbay-hub/src/meshbay_hub/db/models.py b/packages/meshbay-hub/src/meshbay_hub/db/models.py
index 38c4723..ac1828f 100644
--- a/packages/meshbay-hub/src/meshbay_hub/db/models.py
+++ b/packages/meshbay-hub/src/meshbay_hub/db/models.py
@@ -53,10 +53,12 @@ class User(Base):
     # the node does the wrapping, nothing reads a key from this directory. Keys
     # are generated per node and pinned there (meshbay_node/roster.py).
     email_hash:  Mapped[str | None] = mapped_column(String(64), nullable=True)  # HMAC blind index
-    pk_node_ed25519: Mapped[str | None] = mapped_column(String(64), nullable=True)  # node daemon key
+    pk_node_ed25519: Mapped[str | None] = mapped_column(String(64), nullable=True)
     hub_id:           Mapped[str] = mapped_column(String(128), nullable=False)
-    role:             Mapped[str] = mapped_column(String(16), default="user")  # user|moderator|admin
-    status:           Mapped[str] = mapped_column(String(16), default="active")  # active|suspended|revoked
+    # user|moderator|admin
+    role:             Mapped[str] = mapped_column(String(16), default="user")
+    # active|suspended|revoked
+    status:           Mapped[str] = mapped_column(String(16), default="active")
     created_at:  Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_now)
 
     nodes:         Mapped[list["Node"]]         = relationship(back_populates="user")
@@ -105,7 +107,8 @@ class Group(Base):
     visibility:  Mapped[str] = mapped_column(String(16), default="private")   # public|private
     join_policy: Mapped[str] = mapped_column(String(16), default="invite")    # open|request|invite
     description: Mapped[str | None] = mapped_column(String(512))
-    status:      Mapped[str] = mapped_column(String(16), default="active")    # active|suspended|revoked
+    # active|suspended|revoked
+    status:      Mapped[str] = mapped_column(String(16), default="active")
     created_at:  Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_now)
     # First time a node registered on /v1/nodes/ws announcing that it hosts this
     # group. Until then the group has no files, no key and nobody to serve it, so
@@ -382,7 +385,8 @@ class IPLog(Base):
     __tablename__ = "ip_logs"
 
     id:         Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
-    user_id:    Mapped[str | None] = mapped_column(ForeignKey("users.id"))   # null for failed logins
+    # null for failed logins
+    user_id:    Mapped[str | None] = mapped_column(ForeignKey("users.id"))
     # The name this account had, written when it is deleted. The username is
     # released on deletion and the row itself is tombstoned, so the join that
     # normally supplies the name would answer "deleted-3f9a1c" for exactly the
@@ -390,7 +394,8 @@ class IPLog(Base):
     username:   Mapped[str | None] = mapped_column(String(64))
     event:      Mapped[str] = mapped_column(String(32), nullable=False)
     ip_address: Mapped[str] = mapped_column(String(45), nullable=False)       # IPv4 or IPv6
-    detail:     Mapped[str | None] = mapped_column(String(256))               # e.g. username on fail
+    # e.g. username on fail
+    detail:     Mapped[str | None] = mapped_column(String(256))
     timestamp:  Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_now)
 
     user: Mapped["User | None"] = relationship(back_populates="ip_logs")
diff --git a/packages/meshbay-hub/src/meshbay_hub/tasks/cleanup.py b/packages/meshbay-hub/src/meshbay_hub/tasks/cleanup.py
index 429575f..1ef7796 100644
--- a/packages/meshbay-hub/src/meshbay_hub/tasks/cleanup.py
+++ b/packages/meshbay-hub/src/meshbay_hub/tasks/cleanup.py
@@ -50,7 +50,8 @@ async def cleanup_loop(get_session):
                 async with get_session() as db:
                     deleted = await purge_old_ip_logs(db)
                     if deleted:
-                        log.info("Purged %d IP log entries older than %d days", deleted, RETENTION_DAYS)
+                        log.info("Purged %d IP log entries older than %d days",
+                                 deleted, RETENTION_DAYS)
                     expired = await purge_expired_verifications(db)
                     if expired:
                         log.info("Purged %d expired email verifications", expired)
diff --git a/packages/meshbay-hub/tests/harness/boot_guard_probe.py b/packages/meshbay-hub/tests/harness/boot_guard_probe.py
index 01751ba..b4a5e7c 100644
--- a/packages/meshbay-hub/tests/harness/boot_guard_probe.py
+++ b/packages/meshbay-hub/tests/harness/boot_guard_probe.py
@@ -83,7 +83,8 @@ const cases = [];
 const post = (o) => fetch('/log', { method: 'POST', body: JSON.stringify(o) });
 addEventListener('error', (e) => post({ error: 'page error: ' + (e.message || e) }));
 addEventListener('unhandledrejection',
-  (e) => post({ error: 'rejection: ' + ((e.reason && (e.reason.stack || e.reason.message)) || e.reason) }));
+  (e) => post({ error: 'rejection: '
+    + ((e.reason && (e.reason.stack || e.reason.message)) || e.reason) }));
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 const add = (src) => {
   const f = document.createElement('iframe');
diff --git a/packages/meshbay-hub/tests/harness/menu_scroll_probe.py b/packages/meshbay-hub/tests/harness/menu_scroll_probe.py
index 5fb9579..c4d3b87 100755
--- a/packages/meshbay-hub/tests/harness/menu_scroll_probe.py
+++ b/packages/meshbay-hub/tests/harness/menu_scroll_probe.py
@@ -48,7 +48,8 @@ import { Menu } from '/menu.js';
 const LOGS = [];
 addEventListener('error', (e) => LOGS.push('error: ' + (e.message || e)));
 addEventListener('unhandledrejection',
-  (e) => LOGS.push('rejection: ' + ((e.reason && (e.reason.stack || e.reason.message)) || e.reason)));
+  (e) => LOGS.push('rejection: '
+    + ((e.reason && (e.reason.stack || e.reason.message)) || e.reason)));
 
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 const frame = () => new Promise((r) => requestAnimationFrame(() => requestAnimationFrame(r)));
diff --git a/packages/meshbay-hub/tests/harness/music_grid_probe.py b/packages/meshbay-hub/tests/harness/music_grid_probe.py
index 365e028..0cf65bc 100644
--- a/packages/meshbay-hub/tests/harness/music_grid_probe.py
+++ b/packages/meshbay-hub/tests/harness/music_grid_probe.py
@@ -100,7 +100,8 @@ import { MusicPlayerBar } from '/music-player.js';
 const LOGS = [];
 addEventListener('error', (e) => LOGS.push('error: ' + (e.message || e)));
 addEventListener('unhandledrejection',
-  (e) => LOGS.push('rejection: ' + ((e.reason && (e.reason.stack || e.reason.message)) || e.reason)));
+  (e) => LOGS.push('rejection: '
+    + ((e.reason && (e.reason.stack || e.reason.message)) || e.reason)));
 
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 const waitFor = async (sel, tries = 60) => {
@@ -209,7 +210,8 @@ const clickMenu = async (i) => {
       const last = rows[rows.length - 1];
       const entry = { artist: label, top,
                       heading: heading ? heading.textContent : null,
-                      headingH: heading ? Math.round(heading.getBoundingClientRect().height) : null };
+                      headingH: heading
+                        ? Math.round(heading.getBoundingClientRect().height) : null };
       if (last && Math.abs(last.top - top) < 8) last.cells.push(entry);
       else rows.push({ top, cells: [entry] });
     }
diff --git a/packages/meshbay-hub/tests/harness/music_queue_probe.py b/packages/meshbay-hub/tests/harness/music_queue_probe.py
index a9146ce..9138db9 100755
--- a/packages/meshbay-hub/tests/harness/music_queue_probe.py
+++ b/packages/meshbay-hub/tests/harness/music_queue_probe.py
@@ -99,7 +99,8 @@ import { MusicPlayerBar } from '/music-player.js';
 const LOGS = [];
 addEventListener('error', (e) => LOGS.push('error: ' + (e.message || e)));
 addEventListener('unhandledrejection',
-  (e) => LOGS.push('rejection: ' + ((e.reason && (e.reason.stack || e.reason.message)) || e.reason)));
+  (e) => LOGS.push('rejection: '
+    + ((e.reason && (e.reason.stack || e.reason.message)) || e.reason)));
 
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 const waitFor = async (sel, tries = 60) => {
diff --git a/packages/meshbay-hub/tests/harness/playlist_store_probe.py b/packages/meshbay-hub/tests/harness/playlist_store_probe.py
index 6421426..9a54a0d 100755
--- a/packages/meshbay-hub/tests/harness/playlist_store_probe.py
+++ b/packages/meshbay-hub/tests/harness/playlist_store_probe.py
@@ -38,7 +38,8 @@ import { MANIFEST_KIND, bodyKind } from '/playlist-merge.js';
 const LOGS = [];
 addEventListener('error', (e) => LOGS.push('error: ' + (e.message || e)));
 addEventListener('unhandledrejection',
-  (e) => LOGS.push('rejection: ' + ((e.reason && (e.reason.stack || e.reason.message)) || e.reason)));
+  (e) => LOGS.push('rejection: '
+    + ((e.reason && (e.reason.stack || e.reason.message)) || e.reason)));
 
 const USER = 'user-1';
 const steps = [];
@@ -95,7 +96,8 @@ function fakeNode() {
     await P.addTracks(USER, P.FAVORITES_ID, [track(9)], 'g1', 'Favoris');
 
     steps.push({ step: 'after editing',
-                 list: (await P.listPlaylists(USER)).map((p) => ({ id: p.id, name: p.name, count: p.count })) });
+                 list: (await P.listPlaylists(USER))
+                   .map((p) => ({ id: p.id, name: p.name, count: p.count })) });
 
     steps.push({ step: 'tracks read back',
                  tracks: (await P.getPlaylistTracks(USER, eveningId)).map((t) => ({
diff --git a/packages/meshbay-hub/tests/harness/playlist_ui_probe.py b/packages/meshbay-hub/tests/harness/playlist_ui_probe.py
index f0fc9c3..b60baf6 100644
--- a/packages/meshbay-hub/tests/harness/playlist_ui_probe.py
+++ b/packages/meshbay-hub/tests/harness/playlist_ui_probe.py
@@ -98,7 +98,8 @@ import * as P from '/playlists.js';
 const LOGS = [];
 addEventListener('error', (e) => LOGS.push('error: ' + (e.message || e)));
 addEventListener('unhandledrejection',
-  (e) => LOGS.push('rejection: ' + ((e.reason && (e.reason.stack || e.reason.message)) || e.reason)));
+  (e) => LOGS.push('rejection: '
+    + ((e.reason && (e.reason.stack || e.reason.message)) || e.reason)));
 
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 const waitFor = async (sel, tries = 60) => {
@@ -253,7 +254,8 @@ const clickMenu = async (i) => {
     open.click();
     await waitFor('.music-detail .music-tracklist');
     steps.push({ step: 'loaded into the queue',
-                 play: [...document.querySelectorAll('.music-detail .music-tracklist .music-track-title')]
+                 play: [...document.querySelectorAll(
+                   '.music-detail .music-tracklist .music-track-title')]
                          .map((e) => e.textContent) });
     document.querySelector('.music-detail .video-close').click();
     await sleep(150);
@@ -267,8 +269,10 @@ const clickMenu = async (i) => {
     await clickLabel('A2-t2');
     await sleep(300);
     steps.push({ step: 'track removed',
-                 lists: (await P.listPlaylists('u1')).map((p) => ({ name: p.name, count: p.count })),
-                 tracks: (await P.getPlaylistTracks('u1', lists.find((p) => p.name === 'Soirée').id))
+                 lists: (await P.listPlaylists('u1'))
+                   .map((p) => ({ name: p.name, count: p.count })),
+                 tracks: (await P.getPlaylistTracks('u1',
+                   lists.find((p) => p.name === 'Soirée').id))
                            .map((tr) => tr.display_title) });
 
     // 6. Delete it.
diff --git a/packages/meshbay-hub/tests/test_files_drop_upload.py b/packages/meshbay-hub/tests/test_files_drop_upload.py
index 5dfaf23..fc15c47 100644
--- a/packages/meshbay-hub/tests/test_files_drop_upload.py
+++ b/packages/meshbay-hub/tests/test_files_drop_upload.py
@@ -66,7 +66,8 @@ def test_names_in_a_folder_count_files_folders_and_empty_folders(tmp_path, sourc
                {"path": "music/Album", "name": "t.flac"},
                {"path": "musicals", "name": "not-here.txt"}]
     got = _run(tmp_path, source,
-               f"namesIn({json.dumps(entries)}, ['music/Empty', 'music/Album/cd1'], 'music').sort()")
+               f"namesIn({json.dumps(entries)}, "
+               f"['music/Empty', 'music/Album/cd1'], 'music').sort()")
     assert got == ["Album", "Empty", "a.mp3"]
 
 
diff --git a/packages/meshbay-hub/tests/test_hook_ordering.py b/packages/meshbay-hub/tests/test_hook_ordering.py
index 3c82bb0..d03cdf5 100644
--- a/packages/meshbay-hub/tests/test_hook_ordering.py
+++ b/packages/meshbay-hub/tests/test_hook_ordering.py
@@ -123,7 +123,8 @@ def test_the_check_would_notice():
     # Inject a dependency on `last` into the first declaration's dep array.
     end = broken.index("\n  }, [", decls[0].start())
     close = broken.index("]", end)
-    broken = broken[:close] + (", " if broken[end + 7:close].strip() else "") + last + broken[close:]
+    broken = (broken[:close] + (", " if broken[end + 7:close].strip() else "")
+              + last + broken[close:])
 
     declared_at = {m.group(1): m.start() for m in DECL.finditer(broken)}
     caught = False
diff --git a/packages/meshbay-hub/tests/test_hub_api.py b/packages/meshbay-hub/tests/test_hub_api.py
index 9b73701..2afd27b 100644
--- a/packages/meshbay-hub/tests/test_hub_api.py
+++ b/packages/meshbay-hub/tests/test_hub_api.py
@@ -260,7 +260,9 @@ async def test_group_member_add(client):
             "pk_user_ed25519": pk_ed, "pk_user_x25519": pk_x})
 
     alice_token = (await client.post("/v1/users/login",
-                   json={"username": "alice2_test", "password": "alicepass99"})).json()["access_token"]
+                   json={"username": "alice2_test",
+                           "password": "alicepass99"})
+                   ).json()["access_token"]
 
     a_hdrs = {"Authorization": f"Bearer {alice_token}"}
 
@@ -298,9 +300,13 @@ async def test_non_admin_cannot_add_member(client):
             "pk_user_ed25519": pk_ed, "pk_user_x25519": pk_x})
 
     charlie_token = (await client.post("/v1/users/login",
-                     json={"username": "charlie_test", "password": "charliepass"})).json()["access_token"]
+                     json={"username": "charlie_test",
+                           "password": "charliepass"})
+                   ).json()["access_token"]
     dan_token     = (await client.post("/v1/users/login",
-                     json={"username": "dan_test", "password": "danpass1234"})).json()["access_token"]
+                     json={"username": "dan_test",
+                           "password": "danpass1234"})
+                   ).json()["access_token"]
 
     r = await client.post("/v1/groups", json={"name": "charlies-group"},
                           headers={"Authorization": f"Bearer {charlie_token}"})
@@ -338,7 +344,9 @@ async def test_jwt_contains_groups_claim(client):
 
     # Alice creates a group and adds Bob
     alice_token = (await client.post("/v1/users/login",
-                   json={"username": "grp_alice", "password": "alicepass99"})).json()["access_token"]
+                   json={"username": "grp_alice",
+                           "password": "alicepass99"})
+                   ).json()["access_token"]
     r = await client.post("/v1/groups", json={"name": "testgroup"},
                           headers={"Authorization": f"Bearer {alice_token}"})
     group_id = r.json()["group_id"]
diff --git a/packages/meshbay-hub/tests/test_layout_measured.py b/packages/meshbay-hub/tests/test_layout_measured.py
index a71b6b9..9bf1bde 100644
--- a/packages/meshbay-hub/tests/test_layout_measured.py
+++ b/packages/meshbay-hub/tests/test_layout_measured.py
@@ -178,7 +178,8 @@ GROUPED = textwrap.dedent("""
                   <button class="transfer-cancel">&#10005;</button>
                 </div>
                 <div class="dl-progress"><div class="dl-fill" style="width:42%"></div></div>
-                <div class="transfer-meta"><span>210 MB / 493 MB</span><span>3.1 MB/s &middot; 4 min left</span></div>
+                <div class="transfer-meta"><span>210 MB / 493 MB</span>
+                  <span>3.1 MB/s &middot; 4 min left</span></div>
               </div>
             </div>
             <div class="transfer-group">
@@ -190,7 +191,8 @@ GROUPED = textwrap.dedent("""
                   <button class="transfer-cancel">&#10005;</button>
                 </div>
                 <div class="dl-progress dl-waiting"></div>
-                <div class="transfer-meta"><span>Waiting &mdash; your slots are busy</span><span>1.2 GB</span></div>
+                <div class="transfer-meta"><span>Waiting &mdash; your slots are busy</span>
+                  <span>1.2 GB</span></div>
               </div>
             </div>
           </div>
diff --git a/packages/meshbay-hub/tests/test_locales.py b/packages/meshbay-hub/tests/test_locales.py
index 59ea2bf..602d161 100644
--- a/packages/meshbay-hub/tests/test_locales.py
+++ b/packages/meshbay-hub/tests/test_locales.py
@@ -158,7 +158,8 @@ def test_locale_resolution_is_region_aware(tmp_path):
         const out = {};
         for (const tags of [['pt-BR'], ['pt'], ['zh-CN'], ['zh'], ['fr-CA'],
                             ['de-AT'], ['ru', 'it'], ['ko']]) {
-          Object.defineProperty(globalThis, 'navigator', { value: { languages: tags, language: tags[0] }, configurable: true });
+          Object.defineProperty(globalThis, 'navigator',
+            { value: { languages: tags, language: tags[0] }, configurable: true });
           delete store.mb_lang;
           out[tags.join(',')] = await i18n.initLocale();
         }
@@ -186,7 +187,8 @@ def test_counted_string_picks_the_right_polish_form(tmp_path):
           setItem: (k, v) => { store[k] = v; },
         };
         globalThis.document = { documentElement: {} };
-        Object.defineProperty(globalThis, 'navigator', { value: { languages: ['pl'], language: 'pl' }, configurable: true });
+        Object.defineProperty(globalThis, 'navigator',
+          { value: { languages: ['pl'], language: 'pl' }, configurable: true });
         const i18n = await import('./i18n.js');
         await i18n.initLocale();
         console.log(JSON.stringify(
@@ -205,7 +207,8 @@ def test_interpolated_value_is_not_read_as_a_replacement_pattern(tmp_path):
           setItem: (k, v) => { store[k] = v; },
         };
         globalThis.document = { documentElement: {} };
-        Object.defineProperty(globalThis, 'navigator', { value: { languages: ['en'], language: 'en' }, configurable: true });
+        Object.defineProperty(globalThis, 'navigator',
+          { value: { languages: ['en'], language: 'en' }, configurable: true });
         const i18n = await import('./i18n.js');
         await i18n.initLocale();
         console.log(JSON.stringify(
diff --git a/packages/meshbay-hub/tests/test_memory_ceiling.py b/packages/meshbay-hub/tests/test_memory_ceiling.py
index 1654825..5984292 100644
--- a/packages/meshbay-hub/tests/test_memory_ceiling.py
+++ b/packages/meshbay-hub/tests/test_memory_ceiling.py
@@ -246,11 +246,11 @@ def test_no_unguarded_memory_floor(target_fn):
     # definition out before looking. Comments go too — the branch that used to
     # be the bug is now described in one, and a test that reads prose is the
     # mistake already recorded in CLAUDE.md for the packaged systemd unit.
-    start = next(n for n, l in enumerate(lines) if "const _memoryFloor" in l)
+    start = next(n for n, ln in enumerate(lines) if "const _memoryFloor" in ln)
     end = next(n for n in range(start, len(lines)) if lines[n].strip() == "};")
     rest = lines[:start] + lines[end + 1:]
-    code = [re.sub(r"//.*$", "", l) for l in rest]
-    bare = [l.strip() for l in code if re.search(r"\breturn null\b", l)]
+    code = [re.sub(r"//.*$", "", ln) for ln in rest]
+    bare = [ln.strip() for ln in code if re.search(r"\breturn null\b", ln)]
     assert bare == [], (
         "an unguarded in-memory fallback was added to _openDownloadTarget; "
         "return _memoryFloor() instead: " + "; ".join(bare))
diff --git a/packages/meshbay-hub/tests/test_notifications_behaviour.py b/packages/meshbay-hub/tests/test_notifications_behaviour.py
index 67fd99e..4684d3f 100644
--- a/packages/meshbay-hub/tests/test_notifications_behaviour.py
+++ b/packages/meshbay-hub/tests/test_notifications_behaviour.py
@@ -35,7 +35,7 @@ async def test_chat_keeps_one_notification_per_group(client, db_session):
     """Forty messages are one line saying when the conversation last spoke."""
     from meshbay_hub.api.notifications import create_notification
 
-    token = await _user(client, "listener")
+    await _user(client, "listener")
     owner = await _user(client, "talker_test")
     g = await client.post("/v1/groups", json={"name": "busy"},
                           headers={"Authorization": f"Bearer {owner}"})
diff --git a/packages/meshbay-hub/tests/test_transfers.py b/packages/meshbay-hub/tests/test_transfers.py
index a776b50..9b65ca5 100644
--- a/packages/meshbay-hub/tests/test_transfers.py
+++ b/packages/meshbay-hub/tests/test_transfers.py
@@ -243,7 +243,10 @@ class L {
   acquire() { return this._wait; }
   release(reason) { if (!this.closed) { this.closed = true; this.released.push(reason); } }
   grant() { this.state = 'granted'; if (this._onState) this._onState(this); this._go(); }
-  push(state, ahead) { this.state = state; this.ahead = ahead; if (this._onState) this._onState(this); }
+  push(state, ahead) {
+    this.state = state; this.ahead = ahead;
+    if (this._onState) this._onState(this);
+  }
 }
 """
 
diff --git a/packages/meshbay-node/src/meshbay_node/daemon.py b/packages/meshbay-node/src/meshbay_node/daemon.py
index a0ce211..bb50bcf 100644
--- a/packages/meshbay-node/src/meshbay_node/daemon.py
+++ b/packages/meshbay-node/src/meshbay_node/daemon.py
@@ -2243,7 +2243,8 @@ def main() -> None:
                 _GUIDANCE = {
                     "node_key_link": (
                         "Link node key",
-                        f"Copy the node key above and paste it in Settings → Link Node on {cfg.hub.url}"),
+                        f"Copy the node key above and paste it in "
+                        f"Settings → Link Node on {cfg.hub.url}"),
                     "group_add": (
                         "Add a group",
                         "meshbay-node group add <name> --dir /path/to/files"),
diff --git a/packages/meshbay-node/src/meshbay_node/indexer/title_parse.py b/packages/meshbay-node/src/meshbay_node/indexer/title_parse.py
index 5df70c4..91bf2bd 100644
--- a/packages/meshbay-node/src/meshbay_node/indexer/title_parse.py
+++ b/packages/meshbay-node/src/meshbay_node/indexer/title_parse.py
@@ -218,7 +218,8 @@ class ParsedName:
     year: int | None = None
     season: int | None = None
     episode: int | None = None
-    confidence: bool = False        # True only when display_title is set and structurally corroborated
+    # True only when display_title is set and structurally corroborated
+    confidence: bool = False
 
 
 def parse_movie_filename(filename: str) -> ParsedName:
diff --git a/packages/meshbay-node/src/meshbay_node/revocation.py b/packages/meshbay-node/src/meshbay_node/revocation.py
index 1e8caee..dede5d0 100644
--- a/packages/meshbay-node/src/meshbay_node/revocation.py
+++ b/packages/meshbay-node/src/meshbay_node/revocation.py
@@ -19,7 +19,6 @@ import json
 import logging
 from typing import Literal
 
-import httpx
 import jwt
 
 log = logging.getLogger(__name__)
@@ -108,13 +107,9 @@ class RevocationSubscriber:
         ws_url = self._hub_url.replace("http://", "ws://").replace("https://", "wss://")
         ws_url += "/v1/nodes/ws"
 
-        async with httpx.AsyncClient() as client:
-            async with client.stream("GET", ws_url,
-                                     headers={"Upgrade": "websocket"}) as resp:
-                # Use websockets library for proper WS protocol
-                pass
-
-        # Use websockets library directly
+        # An httpx stream was opened to this URL here and immediately dropped —
+        # one pointless request per connect, left over from before the websockets
+        # library was used directly.
         import websockets
         async with websockets.connect(ws_url) as ws:
             # Authenticate
diff --git a/packages/meshbay-node/src/meshbay_node/transfers.py b/packages/meshbay-node/src/meshbay_node/transfers.py
index 86c8d14..3345cb9 100644
--- a/packages/meshbay-node/src/meshbay_node/transfers.py
+++ b/packages/meshbay-node/src/meshbay_node/transfers.py
@@ -393,7 +393,7 @@ class TransferSlots:
                 # the one place it would be tempting to add one for a prettier
                 # log line.
                 for x in sorted(self.leases.values(),
-                                key=lambda l: (l.kind, l.state, l.created_at))
+                                key=lambda ls: (ls.kind, ls.state, ls.created_at))
             ],
         }
 
diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
index 2bd1419..e92ec13 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
@@ -3930,7 +3930,8 @@ class WebRTCPeerSession:
         if not entry:
             thumb = await self._try_serve_thumbnail(file_id, chunk_index, ctx.get("gek"))
             if thumb is not None:
-                log.debug("file_req file_id=%s chunk=%s: served as thumbnail", file_id[:16], chunk_index)
+                log.debug("file_req file_id=%s chunk=%s: served as thumbnail",
+                          file_id[:16], chunk_index)
                 self._send(thumb)
                 return
             log.warning("File not found: %s", file_id[:16])
@@ -3998,7 +3999,8 @@ class WebRTCPeerSession:
             self._leaseless.finish(str(file_id))
 
     @staticmethod
-    async def _fetch_and_cache_poster(media_cache, tmdb_client, poster_path: str | None) -> str | None:
+    async def _fetch_and_cache_poster(media_cache, tmdb_client,
+                                      poster_path: str | None) -> str | None:
         """
         Downloads a TMDB poster/backdrop once, caches it under its own
         blake3 like a video thumbnail (docs/MESHBAY_DESIGN.md §9.7), and
@@ -4026,7 +4028,8 @@ class WebRTCPeerSession:
         return thumb_hash
 
     @staticmethod
-    async def _fetch_and_cache_cover(media_cache, musicbrainz_client, mbid: str | None) -> str | None:
+    async def _fetch_and_cache_cover(media_cache, musicbrainz_client,
+                                     mbid: str | None) -> str | None:
         """
         Music app equivalent of `_fetch_and_cache_poster` — a release's
         Cover Art Archive image, fetched once per mbid and cached under its
@@ -4510,7 +4513,9 @@ class WebRTCPeerSession:
             # itself.
             if not fetched.get("overview"):
                 fallback = await tmdb_client.tv_season(tmdb_id, season, language="en-US") or {}
-                fetched = {**fallback, **{k: v for k, v in fetched.items() if v not in (None, "", [])}}
+                fetched = {**fallback,
+                           **{k: v for k, v in fetched.items()
+                              if v not in (None, "", [])}}
             await media_cache.set_season_meta(tmdb_id, season, fetched)
             details = fetched
 
@@ -4839,8 +4844,10 @@ class WebRTCPeerSession:
         # back to English per field rather than discarding an otherwise-good
         # localized response over one empty one — mirrored here the same
         # way, at field granularity, not by abandoning the whole response.
-        if not details.get("overview") or not details.get("poster_path") or not details.get("genres"):
-            fallback = (await tmdb_client.tv_details(tmdb_id, language="en-US") if media_type == "tv"
+        if (not details.get("overview") or not details.get("poster_path")
+                or not details.get("genres")):
+            fallback = (await tmdb_client.tv_details(tmdb_id, language="en-US")
+                        if media_type == "tv"
                        else await tmdb_client.movie_details(tmdb_id, language="en-US")) or {}
             details = {**fallback, **{k: v for k, v in details.items() if v not in (None, "", [])}}
         credits = (await tmdb_client.tv_credits(tmdb_id) if media_type == "tv"
@@ -5915,7 +5922,8 @@ class WebRTCPeerSession:
         transcript = admin_transcript(
             op=pending["op"],
             node_pk_b64=self._node_pk_b64(),
-            group_id=pending["group_id"] if pending.get("group_id") is not None else (self._group_id or ""),
+            group_id=(pending["group_id"] if pending.get("group_id") is not None
+                      else (self._group_id or "")),
             subject=pending["subject"],
             nonce=pending["nonce"],
             ts=pending["ts"],
diff --git a/packages/meshbay-node/tests/test_audio_transcode.py b/packages/meshbay-node/tests/test_audio_transcode.py
index a6557f0..acb39b7 100644
--- a/packages/meshbay-node/tests/test_audio_transcode.py
+++ b/packages/meshbay-node/tests/test_audio_transcode.py
@@ -145,7 +145,8 @@ async def test_missing_file_id_is_an_error(tmp_path, media_cache):
     sk_node = Ed25519PrivateKey.generate()
     session = WebRTCPeerSession.__new__(WebRTCPeerSession)
     session._ctx = {
-        "roots": one_root(tmp_path), "index": GroupIndex(group_id="g" * 32, sk_node=sk_node, gek=gek),
+        "roots": one_root(tmp_path),
+        "index": GroupIndex(group_id="g" * 32, sk_node=sk_node, gek=gek),
         "gek": gek, "sk_node": sk_node, "media_cache": media_cache,
     }
     session._group_id = None
@@ -170,7 +171,8 @@ async def test_multi_chunk_cached_blob_reassembles_correctly(tmp_path, media_cac
     sk_node = Ed25519PrivateKey.generate()
     session = WebRTCPeerSession.__new__(WebRTCPeerSession)
     session._ctx = {
-        "roots": one_root(tmp_path), "index": GroupIndex(group_id="g" * 32, sk_node=sk_node, gek=gek),
+        "roots": one_root(tmp_path),
+        "index": GroupIndex(group_id="g" * 32, sk_node=sk_node, gek=gek),
         "gek": gek, "sk_node": sk_node, "media_cache": media_cache,
     }
     session._group_id = None
diff --git a/packages/meshbay-node/tests/test_enrich_photo.py b/packages/meshbay-node/tests/test_enrich_photo.py
index fb0530c..d1bbd28 100644
--- a/packages/meshbay-node/tests/test_enrich_photo.py
+++ b/packages/meshbay-node/tests/test_enrich_photo.py
@@ -166,7 +166,8 @@ async def test_enricher_corrects_orientation(tmp_path, media_cache):
         "width/height must reflect the EXIF-corrected orientation, not the raw stored frame")
     thumb_bytes = await media_cache.get_thumb(fields["thumb_hash"])
     thumb = Image.open(io.BytesIO(thumb_bytes))
-    assert thumb.size[0] < thumb.size[1], "the stored thumbnail itself must be portrait, not sideways"
+    assert thumb.size[0] < thumb.size[1], (
+        "the stored thumbnail itself must be portrait, not sideways")
 
 
 def test_gps_is_never_read_by_this_module():
diff --git a/packages/meshbay-node/tests/test_indexer.py b/packages/meshbay-node/tests/test_indexer.py
index 48bf399..e97e2ef 100644
--- a/packages/meshbay-node/tests/test_indexer.py
+++ b/packages/meshbay-node/tests/test_indexer.py
@@ -396,7 +396,8 @@ async def test_scan_interrupted_partway_leaves_only_completed_files_cached(
         indexer_mod._scan_file = real_scan_file
 
     assert resumed.index.count == 5
-    assert len(calls) == 2, f"expected only the 2 not-yet-cached files to be hashed, got {len(calls)}"
+    assert len(calls) == 2, (
+        f"expected only the 2 not-yet-cached files to be hashed, got {len(calls)}")
 
 
 # ── Progress state ───────────────────────────────────────────────────────────
diff --git a/packages/meshbay-node/tests/test_multi_group.py b/packages/meshbay-node/tests/test_multi_group.py
index e095426..b75bad0 100644
--- a/packages/meshbay-node/tests/test_multi_group.py
+++ b/packages/meshbay-node/tests/test_multi_group.py
@@ -72,10 +72,12 @@ async def multi_group_server(sk_node, sk_hub, gek_a, gek_b, dir_a, dir_b, tmp_pa
     hub_pk_pem = sk_hub.public_key().public_bytes(
         serialization.Encoding.PEM, serialization.PublicFormat.SubjectPublicKeyInfo)
 
-    indexer_a = DirectoryIndexer(roots=one_root(dir_a), group_id="group-a", sk_node=sk_node, gek=gek_a)
+    indexer_a = DirectoryIndexer(roots=one_root(dir_a), group_id="group-a",
+                                 sk_node=sk_node, gek=gek_a)
     await indexer_a.initial_scan()
 
-    indexer_b = DirectoryIndexer(roots=one_root(dir_b), group_id="group-b", sk_node=sk_node, gek=gek_b)
+    indexer_b = DirectoryIndexer(roots=one_root(dir_b), group_id="group-b",
+                                 sk_node=sk_node, gek=gek_b)
     await indexer_b.initial_scan()
 
     # RootSet, not a bare Path — what the daemon actually puts in a group context.
diff --git a/packages/meshbay-node/tests/test_node_status.py b/packages/meshbay-node/tests/test_node_status.py
index 7a27623..8bb2f39 100644
--- a/packages/meshbay-node/tests/test_node_status.py
+++ b/packages/meshbay-node/tests/test_node_status.py
@@ -207,7 +207,6 @@ async def test_node_status_catches_send_failure(tmp_path, roster):
     not silently vanish — it used to, because _send was outside the try block."""
     session = await _session(tmp_path, roster, operator=True,
                              node_user_id="grenet")
-    original_send = session._send
     sent = []
     call_count = [0]
 
diff --git a/packages/meshbay-node/tests/test_packaging_win.py b/packages/meshbay-node/tests/test_packaging_win.py
index 7b44bbe..aa77c29 100644
--- a/packages/meshbay-node/tests/test_packaging_win.py
+++ b/packages/meshbay-node/tests/test_packaging_win.py
@@ -1230,13 +1230,14 @@ def test_service_mode_ps1_starts_the_task_after_installing_it():
     already-running task pointlessly on every mode switch away from service.
     """
     src = (WIN / "service-mode.ps1").read_text(encoding="utf-8")
-    install_branch, remove_branch = src.split('$Action -eq "install"', 1)[1], None
+    install_branch = src.split('$Action -eq "install"', 1)[1]
     assert '"run"' in install_branch or "'run'" in install_branch, (
         "service-mode.ps1 registers the task but never starts it -- the "
         "daemon stays down until the next reboot")
     # The run step must be conditioned on install having actually succeeded,
     # not fired unconditionally regardless of $Action.
-    guard_line = src[src.index('$Action -eq "install"') - 40:src.index('$Action -eq "install"') + 40]
+    at = src.index('$Action -eq "install"')
+    guard_line = src[at - 40:at + 40]
     assert "-and" in guard_line or "-not $failed" in install_branch, (
         "the follow-up `run` must be gated on Action=install and success, "
         "not run unconditionally on every invocation including remove")
diff --git a/packages/meshbay-node/tests/test_roster_pairing.py b/packages/meshbay-node/tests/test_roster_pairing.py
index 67c3b08..82336e2 100644
--- a/packages/meshbay-node/tests/test_roster_pairing.py
+++ b/packages/meshbay-node/tests/test_roster_pairing.py
@@ -569,7 +569,8 @@ def test_challenge_carries_node_pk_in_source():
     builds, whatever the surrounding handshake does.
     """
     source = (Path(__file__).parent.parent
-              / "src" / "meshbay_node" / "transport" / "webrtc_server.py").read_text(encoding="utf-8")
+              / "src" / "meshbay_node" / "transport"
+              / "webrtc_server.py").read_text(encoding="utf-8")
     challenge = source[source.find("MNP.HANDSHAKE_CHALLENGE,"):]
     challenge = challenge[:challenge.find("})")]
     assert "node_pk" in challenge, (
diff --git a/packages/meshbay-node/tests/test_security_regressions.py b/packages/meshbay-node/tests/test_security_regressions.py
index bfe25b9..7010523 100644
--- a/packages/meshbay-node/tests/test_security_regressions.py
+++ b/packages/meshbay-node/tests/test_security_regressions.py
@@ -462,7 +462,8 @@ def test_no_member_can_hand_the_node_key_material(tmp_path):
     )
 
     source = (Path(__file__).parent.parent
-              / "src" / "meshbay_node" / "transport" / "webrtc_server.py").read_text(encoding="utf-8")
+              / "src" / "meshbay_node" / "transport"
+              / "webrtc_server.py").read_text(encoding="utf-8")
     assert "_do_gek_bundle_store" not in source
     assert "_admin_exec_bundle_store" not in source
 
diff --git a/packages/meshbay-node/tests/test_transfer_slots_wire.py b/packages/meshbay-node/tests/test_transfer_slots_wire.py
index c9fc85a..d96456c 100644
--- a/packages/meshbay-node/tests/test_transfer_slots_wire.py
+++ b/packages/meshbay-node/tests/test_transfer_slots_wire.py
@@ -19,6 +19,9 @@ Three things can only be checked here:
 """
 
 import pytest
+from meshbay_common.protocol import MNP
+from meshbay_node.transfers import DOWNLOAD, UPLOAD
+from meshbay_node.transport.webrtc_server import WebRTCPeerSession
 
 # Every test drives a message handler, and in the node a message handler always
 # runs inside the event loop: `_do_transfer_open` starts the sweeper task there.
@@ -26,10 +29,6 @@ import pytest
 # on "no current event loop" the moment the sweeper stopped being faked.
 pytestmark = pytest.mark.asyncio
 
-from meshbay_common.protocol import MNP
-from meshbay_node.transfers import DOWNLOAD, UPLOAD
-from meshbay_node.transport.webrtc_server import WebRTCPeerSession
-
 
 class _Session(WebRTCPeerSession):
     """A session with the DataChannel replaced by a list, and nothing else."""
diff --git a/packages/meshbay-node/tests/test_webrtc_transport.py b/packages/meshbay-node/tests/test_webrtc_transport.py
index 4aba99f..91a6e1c 100644
--- a/packages/meshbay-node/tests/test_webrtc_transport.py
+++ b/packages/meshbay-node/tests/test_webrtc_transport.py
@@ -26,6 +26,11 @@ from cryptography.hazmat.primitives.asymmetric.ed25519 import (
     Ed25519PublicKey,
 )
 from meshbay_common import MNP_VERSION
+from meshbay_common.adminop import (
+    OP_FILE_DELETE,
+    OP_INVITE_CREATE,
+    admin_transcript,
+)
 from meshbay_common.crypto import (
     generate_gek,
     pk_to_b64,
@@ -35,16 +40,6 @@ from meshbay_common.crypto import (
     wrap_gek_aes,
 )
 from meshbay_common.groupbox import PURPOSE_ACK, PURPOSE_INDEX, unseal
-from meshbay_common.protocol import MNP
-from meshbay_common.webcrypto import chunk_key_aes, decrypt_chunk_aes
-
-TEST_GROUP = "g"
-
-from meshbay_common.adminop import (
-    OP_FILE_DELETE,
-    OP_INVITE_CREATE,
-    admin_transcript,
-)
 from meshbay_common.handshake import (
     NONCE_LEN,
     ROLE_CLIENT,
@@ -55,6 +50,8 @@ from meshbay_common.handshake import (
     webrtc_binding,
 )
 from meshbay_common.join import ROLE_MEMBER, ROLE_OPERATOR, join_transcript
+from meshbay_common.protocol import MNP
+from meshbay_common.webcrypto import chunk_key_aes, decrypt_chunk_aes
 from meshbay_node.bundle_store import BundleStore
 from meshbay_node.indexer import DirectoryIndexer
 from meshbay_node.roster import Roster
@@ -62,6 +59,8 @@ from meshbay_node.transport.webrtc_server import WebRTCTransport
 
 from conftest import one_root
 
+TEST_GROUP = "g"
+
 
 @pytest.fixture
 def sk_node():
diff --git a/poc/spike1_crypto.py b/poc/spike1_crypto.py
index 1e8491c..4006506 100644
--- a/poc/spike1_crypto.py
+++ b/poc/spike1_crypto.py
@@ -243,7 +243,8 @@ print("\n=== Test 7: AES-256-GCM — Keystore encryption ===")
 def test_aes_gcm_keystore():
     # Derive an AES key from Argon2id (as done for keystore unlock)
     salt = os.urandom(16)
-    aes_key = Argon2id(salt=salt, length=32, iterations=3, lanes=4, memory_cost=65536).derive(b"password")
+    aes_key = Argon2id(salt=salt, length=32, iterations=3, lanes=4,
+                       memory_cost=65536).derive(b"password")
 
     # Encrypt a mock keystore blob
     keystore_data = b'{"sk_user": "base64...", "sk_group": "base64..."}'
diff --git a/poc/spike3_node.py b/poc/spike3_node.py
index 0b6d694..562239f 100644
--- a/poc/spike3_node.py
+++ b/poc/spike3_node.py
@@ -27,7 +27,8 @@ from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey
 HUB_URL    = "http://meshbay.org"
 STATE_FILE = Path("node_state.json")   # persists keys and tokens between runs
 
-PASS = "✓"; FAIL = "✗"
+PASS = "✓"
+FAIL = "✗"
 
 # ── Key helpers ───────────────────────────────────────────────────────────────
 
diff --git a/poc/spike4_nat.py b/poc/spike4_nat.py
index e34a4c4..ee7485f 100644
--- a/poc/spike4_nat.py
+++ b/poc/spike4_nat.py
@@ -21,7 +21,9 @@ from pathlib import Path
 
 import httpx
 
-PASS = "✓"; FAIL = "✗"; SKIP = "–"
+PASS = "✓"
+FAIL = "✗"
+SKIP = "–"
 
 LOCAL_PORT      = 19000
 MESHBAY_IP      = "164.132.246.44"   # meshbay.org resolved
@@ -229,7 +231,8 @@ async def main():
                 # May differ from STUN if symmetric NAT
                 actual_ext = seen_ext_addr.replace("('", "").replace("'", "").replace(", ", ":")
                 if endpoint_hint and actual_ext != endpoint_hint:
-                    print(f"  ⚠  STUN addr {endpoint_hint} ≠ actual {actual_ext} (symmetric NAT confirmed)")
+                    print(f"  ⚠  STUN addr {endpoint_hint} ≠ actual {actual_ext} "
+                          f"(symmetric NAT confirmed)")
                 endpoint_hint = actual_ext
             else:
                 print(f"  {FAIL} No echo received (timeout)")
diff --git a/poc/spike5_client.py b/poc/spike5_client.py
index 6ac2fba..cc79ebf 100644
--- a/poc/spike5_client.py
+++ b/poc/spike5_client.py
@@ -27,7 +27,8 @@ from cryptography.hazmat.primitives.kdf.hkdf import HKDF
 
 PORT        = 19003
 CHUNK_INDEX = 0
-PASS = "✓"; FAIL = "✗"
+PASS = "✓"
+FAIL = "✗"
 
 # ── Wire helpers ───────────────────────────────────────────────────────────────
 
diff --git a/poc/spike5_node.py b/poc/spike5_node.py
index b560dc1..cded922 100644
--- a/poc/spike5_node.py
+++ b/poc/spike5_node.py
@@ -33,7 +33,8 @@ MESHBAY_PORT = 19003
 CHUNK_SIZE   = 1024 * 1024   # 1 MB
 TEST_FILE    = Path("testfile.bin")
 STATE_FILE   = Path("node_state.json")
-PASS = "✓"; FAIL = "✗"
+PASS = "✓"
+FAIL = "✗"
 
 # ── Wire helpers ───────────────────────────────────────────────────────────────
 
diff --git a/poc/spike6_gek.py b/poc/spike6_gek.py
index 3595d6d..e58823b 100644
--- a/poc/spike6_gek.py
+++ b/poc/spike6_gek.py
@@ -33,7 +33,8 @@ from cryptography.hazmat.primitives.kdf.hkdf import HKDF
 
 HUB_URL    = "http://meshbay.org"
 STATE_FILE = Path("node_state.json")
-PASS = "✓"; FAIL = "✗"
+PASS = "✓"
+FAIL = "✗"
 
 
 # ── Key helpers ────────────────────────────────────────────────────────────────
@@ -200,7 +201,9 @@ async def main():
         bundle_alice = wrap_gek(gek_raw, pk_alice_x_raw)
         print(f"  {PASS} Wrapped in {(time.perf_counter()-t0)*1000:.2f}ms")
         print(f"         pk_eph   : {bundle_alice['pk_eph_b64'][:24]}...")
-        print(f"         wrapped  : {bundle_alice['wrapped_b64'][:24]}... ({len(base64.b64decode(bundle_alice['wrapped_b64']))}B)")
+        wrapped = bundle_alice["wrapped_b64"]
+        print(f"         wrapped  : {wrapped[:24]}... "
+              f"({len(base64.b64decode(wrapped))}B)")
 
         r = await c.post(
             f"{HUB_URL}/v1/groups/{group_id}/members/{state.get('username','node_cbesson')}/gek",