merge: Phase 11.5 security remediation, invite redesign, per-node identity

Brings in the security remediation branch. Three bodies of work, and what they
changed about what this project may claim.

Phase 11.5 closed the gap between the documents and the code: the unauthenticated
node HTTP API and the TCP transport deleted, one handshake shared by the
remaining two transports, mutual authentication, structured admin transcripts,
upload confinement, group isolation, revocation that reaches nodes. Six critical
and seven high findings closed, bounded, or deferred by decision.

The invite redesign closed H3 and M3 — the last open High. The hub was the key
directory: an inviter fetched the invitee's key from it and wrapped the group key
for whatever came back, so a hub answering with its own key was handed the group
key by an honest member following the protocol exactly. That lookup is gone. The
node holds the group key and wraps it itself, for a key its recipient proves
possession of, bound to an account by a one-time code the hub never sees. M3 fell
out of the same work: node authority comes from a local roster, never from the
hub.

Per-node identity cut what remains of C4 down to one operator. A single keypair
used to be copied to every node its owner joined; each node now gets its own, so
cracking the bundle on one machine yields a key that is a stranger everywhere
else — and on that machine, one that unlocks nothing its holder did not already
serve. The bundle KDF moved to Argon2id 128 MB, and the hub stopped storing or
publishing user keys at all.

What this project may now say: the hub cannot read your content unless it ships
you malicious client code. T3 remains, accepted (D1), and is what the native
client removes. C4 is reduced, not closed, until 13.3. Chat is still plaintext at
rest until Phase 15. Draft-v5 §2 states each claim against the adversary it holds
against, which is the convention this branch exists to keep.

Four defects were found by deploying it and using a browser, none by the test
suite: a node going deaf on its hub socket, a token that predated group
membership, a client reading values before they were assigned, and identity keys
a browser held but never re-read. The lessons are recorded in CLAUDE.md.

Tests: 343 across the three packages, plus QE/deploy/e2e.py — register, pair,
invite, join, download, stream, second browser, revoke — run against the live
deployment on a wiped hub and node.

63 files changed, 8470 insertions, 2279 deletions

diff --git a/CLAUDE.md b/CLAUDE.md
index 47c2a10..b2ff32a 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -3,7 +3,7 @@
 ## What this project is
 
 MeshBay is a decentralized peer-to-peer platform for file sharing, video streaming, and group messaging.
-See `docs/meshbay-draft-v3.md` for the architecture specification.
+See `docs/meshbay-draft-v5.md` for the architecture specification (v3/v4 superseded).
 
 ## Repository structure
 
@@ -116,7 +116,11 @@ Scope: `hub`, `node`, `common`, or omitted for cross-cutting
 - **NS1** GEK-HMAC proof in handshake — blocks hub admin from accessing any group content ✅ DONE
 - **NS2** Ed25519 challenge-response for admin operations — blocks hub admin impersonation ✅ DONE
 - **NS3** `gek_req` endpoint removed — node never serves GEK in plaintext ✅ DONE
-- **NS4** `admin_pk_ed25519` pinned in node.toml — auto-pinned from keystore ✅ DONE
+- **NS4** ~~`admin_pk_ed25519` auto-pinned from keystore~~ ❌ **that was finding M3.** The
+  keystore key is not the key the browser signs with, so every admin operation failed
+  closed. Authority now comes from the node's roster — `meshbay-node operator pair`
+  (2026-08-14). `admin_pk_ed25519` is still read as a legacy form; never auto-pin again,
+  and never resolve the operator's key through the hub
 - **NS5** DTLS channel binding in GEK-HMAC — `HMAC(GEK, nonce || offer_fp || answer_fp)` detects WebRTC signaling MitM ✅ DONE
 - **NS6** Chat `sender_id` enforced from authenticated session — prevents impersonation ✅ DONE
 - **NS7** Node Ed25519 auth — node daemon authenticates to hub via `POST /v1/nodes/auth` (Ed25519 signed timestamp), no auth_key/password on node. JWT `scope: "node"` blocks group management (create/add/delete/join). Operator manages groups from browser only. ✅ DONE
@@ -124,7 +128,10 @@ Scope: `hub`, `node`, `common`, or omitted for cross-cutting
 
 **Known remaining trust assumptions (Phase 12 — all actionable items done):**
 - **T1** ✅ DONE: password split (auth_key / bundle_key, independent PBKDF2). Legacy migration on first login.
-- **T2** Hub controls public key distribution → can substitute keys during invite. Fix: out-of-band key verification (safety numbers)
+- **T2** ✅ **CLOSED 2026-08-14** (the finding is H3). Not by safety numbers: the invite
+  path stopped reading the directory. The node holds the GEK and wraps it for a key the
+  recipient proves possession of; identities are bound to accounts by one-time codes the
+  hub never sees. See `docs/invite-pairing-v1.md`
 - **T3** SPA served by hub → fundamentally unsolvable in browser. Fix: native client or browser extension
 
 **T3 attack surface reduction (2026-08-12, all phases complete):**
@@ -136,7 +143,8 @@ Scope: `hub`, `node`, `common`, or omitted for cross-cutting
 - `_bundleKey` persisted in IndexedDB (CryptoKey survives page refresh)
 - `_sessionKeys` persisted in sessionStorage (survives refresh, cleared on tab close)
 - `_pkFromSk()`: derive X25519 public key from recovered private key via JWK export (no hub fetch)
-- Removed auto-`regenerateKeys()` on login (was silently rotating hub keys, breaking GEK unwrap)
+- `regenerateKeys()` is gone entirely (2026-08-14): identity keys are per node, so
+  rotation is `meshbay-node member unpin <user>` plus a fresh code
 - Raw answer SDP saved before `setRemoteDescription` (Chrome strips sha-256 from multi-hash SDP)
 - Upload chunk size: 48KB (fits aiortc SCTP limit after msgpack overhead)
 
@@ -165,6 +173,78 @@ on the WebRTC path only, and three other paths into the node were left behind.
 - **H3** Hub is the key directory → key substitution at invite yields the GEK. "Unreadable
   even by the hub" is true against a *passive* hub only
 
+## Invite redesign (2026-08-14) — closes H3 and M3
+
+See `docs/invite-pairing-v1.md`. Read it before touching invites, admin authority or
+`gek_bundle_store`.
+
+- **The node wraps the group key**, on every connection, for the X25519 key the joiner
+  signed with their pinned Ed25519 identity. **Nothing fetches a public key from the hub
+  to wrap for** — not the SPA, not `gek-init`. That lookup *was* H3
+- **`gek_bundle_store` is deleted**, not gated. No member hands the node key material
+- **The node's roster decides who gets the key**, not hub membership: a hub that invents
+  an account and mints it a token gets `not_authorized_for_group`
+- **One-time codes** bind a key to an account without the directory. 40 bits, single use,
+  one account, node-wide lockout. 7 days for invitations, 24 h for operator pairing, both
+  in `[node]` of node.toml
+- **`join_policy`** (`invite`|`open`) is read from **node.toml, never the hub** — a hub
+  able to declare a group open would be handed its key. Unknown group ⇒ `invite`
+- Operator surface over SSH: `operator pair`, `member list|invite|revoke|unpin`. Deleting
+  a file is the last browser-only operation
+- Revocation now works for key delivery (nothing stored survives it) — but **still rotate
+  the GEK**, the ex-member holds the current one
+
+## Keypair bundles and the browser KDF (2026-08-14)
+
+- The bundle key is **Argon2id 128 MB / t=3 / p=1**, WebAssembly vendored under
+  `static/vendor/` (CSP forbids external hosts; 12.2 must keep `wasm-unsafe-eval`).
+  **Do not change the parameters in one place**: `keyderive.js`, the QE harness and
+  `test_bundle_kdf_parity.py` are held byte-identical by that test, and a mismatch
+  presents as an account nobody can open
+- Bundles carry an `MBK2` marker; the PBKDF2 form is still readable and is
+  re-encrypted on the next backup. Both keys are derived at sign-in because the
+  passphrase is deliberately not retained
+- Cost is paid **once per sign-in** (650 ms bundle + 239 ms auth_key); reloading a
+  page derives nothing — the key lives in IndexedDB
+- The bundle is stored on **every node its owner joins**. That is what makes a
+  second browser work, and it is C4: cracking one yields identity keys, hence
+  content on *other* nodes and the ability to sign as that user. Draft-v5 §7.1 has
+  the measured numbers. **The passphrase is the wall; the KDF is a speed bump**
+- Floor: 12 characters and ~60 estimated bits, enforced client-side only — with the
+  password split (T1) the hub never sees a passphrase
+
+## Identity keys are PER NODE (2026-08-14)
+
+See `docs/per-node-identity-v1.md`. Read it before touching registration, the
+keypair bundle, or anything that looks like a user's public key.
+
+- A keypair is created at **first contact with a node**, encrypted under the
+  passphrase, and left on that node. Never reused elsewhere. Cracking one yields
+  the identity used with that operator and nothing anywhere else
+- **The hub stores and publishes no user keys.** `users.pk_ed25519`/`pk_x25519`
+  are dropped, `PUT /me/keys` is gone, `/pubkeys` returns an account id and the
+  node linking key. Do not reintroduce a key directory — that was H3
+- **Tokens carry no `pk_user`.** The node recorded it as the uploader's identity
+  and authorized deletion against it, so whoever issued tokens decided who could
+  delete a file. Attribution uses the roster pin (`_pinned_pk`)
+- Registration generates nothing, so a scripted signup is a real account —
+  `QE/deploy/demo.py bootstrap` takes a wiped hub and node to a working demo
+- The key handed back on a join belongs to the **group of the connection**, not
+  the group named in the invitation (an operator pairs node-wide while opening a
+  group)
+
+## Two lessons that cost four rounds of live testing
+
+- **`QE/deploy/e2e.py` cannot test `app.js`.** It is a second implementation of the
+  client, written in the right order by construction: it proves the protocol and
+  nothing about the SPA. Three ordering bugs passed it and failed in a browser.
+  `test_spa_ordering.py` exists for that class and is worth extending
+- **An unbounded `await` on the hub socket makes a node silently unreachable.**
+  Three instances found in `maintain_ws`: the offer handler awaited inside the read
+  loop, `ws.recv()` for auth with no timeout, and `return` on auth refusal ending
+  the task for good. Symptom is always the same — daemon running, logging nothing,
+  `connected_nodes: 0`, socket in CLOSE-WAIT. Look there first
+
 **Corrections to remember:**
 - `punch_nat()` is **not** a NAT traversal stack — one UDP probe, no STUN, no candidate
   gathering, one ISP validated. **ICE/STUN (WebRTC) is the traversal path**, for native
diff --git a/devel-phases-next.md b/devel-phases-next.md
index 04d7b9b..db9267d 100644
--- a/devel-phases-next.md
+++ b/devel-phases-next.md
@@ -1,7 +1,7 @@
 # MeshBay — Next Implementation Phases
 
 > Base: Phases 1–12 complete (except 10.9 → Phase 18). Web SPA + admin panel + self-service UI + MSE video streaming live on meshbay.org. Node daemon is production-ready (WebRTC, WS, chat, HTTP, index push, swarm all wired).
-> Architecture reference: docs/meshbay-draft-v4.md
+> Architecture reference: **docs/meshbay-draft-v5.md** (v4 superseded 2026-08-13)
 > First security review: first-review.md (2026-08-10)
 > **Second security review: second-review.md (2026-08-13) — 6 critical, 7 high findings.**
 >
@@ -11,7 +11,8 @@
 > and an active hub can obtain any group key through the key directory it controls (H3).
 >
 > **Phases renumbered 2026-08-13** (old → new): 12→14, 13→15, 14→16, 15→17, 16→18, 17→19.
-> New: 11.5 (security remediation), 12 (hub minimization), 13 (native desktop client).
+> New: 11.5 (security remediation), 12 (client key verification — reworked 2026-08-13,
+> hub minimization deferred by operator decision), 13 (native desktop client).
 
 ---
 
@@ -613,7 +614,45 @@ phase reduces the node to two paths and brings both to the same standard.
 |---|---|---|---|
 | 11.5.4 | Extract `meshbay_common/handshake.py`: JWT verify → `scope == "user"` → denylist → **mandatory** `group_id` in claims → group hosted → GEK challenge → proof verify → ack | **C6**, M1, M9 | Single implementation; `webrtc_server.py` and `quic_server.py` contain no JWT logic of their own |
 | 11.5.5 | Both transports call it; test parametrized over `[webrtc, quic]` | C6 | A test that adds a step to the handshake fails for any transport that skips it |
-| 11.5.6 | **Spike:** channel binding for QUIC. No DTLS fingerprint exists — bind to the QUIC server certificate hash as the analogue (`sha256(server_cert) ‖ sha256(client_cert)`); prefer an RFC 5705 TLS exporter if `aioquic` can expose one | C6/NS5 | QUIC handshake proof is bound to the connection, not replayable across connections |
+| 11.5.6 | **Spike DONE 2026-08-13 — see findings below.** Channel binding for QUIC | C6/NS5 | QUIC handshake proof is bound to the connection, not replayable across connections |
+
+#### 11.5.6 spike results (aioquic 1.3.0)
+
+**No RFC 5705 exporter.** `aioquic.tls.Context` has no `export_keying_material`, so the
+preferred anchor is unavailable.
+
+**Certificate access is asymmetric and partly private:**
+
+| Side | Path to the server certificate | API status |
+|---|---|---|
+| Server | `tls.certificate` | public attribute |
+| Client | `tls._peer_certificate` | **private** — set by `_set_peer_certificate()` |
+
+`QuicConnection` exposes no `tls`/`cert` attribute either, so the client's route is
+`protocol._quic.tls._peer_certificate` — two levels of private API.
+
+**The risk this creates.** Binding a security check to a private attribute means an
+aioquic upgrade can remove it silently. A channel binding that silently becomes
+unavailable is the worst failure mode: 11.5.21 already established that the handshake
+must *refuse* rather than degrade, so a rename would turn every QUIC connection into a
+hard failure — noisy, but only if the refusal path is right. If it were ever made
+tolerant, it would turn into a silent loss of MitM detection.
+
+**Options for the implementer, in order of preference:**
+
+1. **Certificate hash via the private attribute, guarded.** Pin `aioquic` in
+   `pyproject.toml`, and add a test that asserts `_peer_certificate` is reachable and
+   non-None on a live connection — so an upgrade fails CI rather than production. Keep
+   `make_proof()` refusing an empty binding.
+2. **Bind to `pk_node` instead of the channel.** For QUIC the MitM story differs from
+   WebRTC: signaling is not hub-relayed, and the client already learns `pk_node` from the
+   hub. The C3 mutual proof (node signs the transcript with `sk_node`) may be sufficient
+   connection authentication on its own — but note the QUIC client currently does **not**
+   verify the TLS certificate (`verify_mode` disabled, identity checked at the MNP layer),
+   so this option must be paired with pinning, or the TLS layer authenticates nobody.
+3. **Upstream an exporter.** Correct long-term answer, wrong timescale for 11.5.
+
+Recommendation: option 1 with the guard test, and open option 3 upstream.
 
 ### C — Mutual authentication
 
@@ -693,44 +732,56 @@ cannot delete or overwrite another member's file, and cannot change the group ke
 
 ---
 
-## Phase 12 — Hub minimization: registrar and nothing more
+## Phase 12 — Client key verification + served-SPA integrity
 
-**Objective:** reduce the hub to its legitimate role and make that reduction *structural*
-rather than a matter of good behaviour. The hub must not be able to see private keys,
-unencrypted content, or file listings — not "does not currently", but "cannot".
+> **Reworked 2026-08-13 by operator decision.** This phase was "Hub minimization:
+> registrar and nothing more". That work is **deferred and may be dropped** — see
+> decisions D1/D2 in `tmp-decisions.md`. The hub will keep serving the web UI, and a
+> native client will be offered *in addition to* it, not as a replacement.
+>
+> Two items are kept here because the decision makes them *more* relevant, not less:
+> the hub stays in the trusted path, so what it can substitute and what code it serves
+> both still matter. Everything else from the old Phase 12 (route blindness test,
+> opaque private-group metadata, chat_notify minimization, schema cleanup) is dropped
+> from the plan; the swarm item already shipped in 11.5.18.
 
-### What the hub is allowed to know
+**Objective:** make the hub's remaining power over confidentiality *detectable*, given
+that it stays in the trusted path by choice.
 
-| Category | Allowed | Notes |
-|---|---|---|
-| Account: username, encrypted email, public keys, status, role | ✅ | Required to be a registrar |
-| Group registry: id, admin, visibility, join policy, membership | ✅ | Required to issue the `groups` claim |
-| Public group name + description | ✅ | Required for discovery |
-| IP logs | ✅ | Legal retention, 1 year |
-| Signaling relay (SDP/ICE, in-memory, seconds) | ✅ | Never persisted |
-| **Private keys, keypair bundles, GEK bundles** | ❌ | Removed in Phase 12 (old); 13.3 removes the last copies |
-| **File content, file names, file hashes, index** | ❌ | H7 was leaking hashes; 11.5.18 closes it |
-| **Message content or per-message metadata** | ❌ | `chat_notify` currently leaks it — 12.3 |
-| **Private group name / description** | ❌ (target) | 12.5 |
+### 12.1 is DONE — and not as it was written
+
+**H3 is closed (2026-08-14), by removing the lookup rather than by verifying it.** The
+plan here was key transparency and safety numbers: keep fetching the invitee's key from
+the hub, and give humans a way to notice a substitution. What shipped instead is the
+invite redesign in `docs/invite-pairing-v1.md` — the node holds the GEK and wraps it
+itself, for a key the recipient proves possession of, and identities are bound to
+accounts by one-time codes the hub never sees.
+
+Why that is better than what was planned: safety numbers make a substitution *detectable
+by a human who bothers to check*, at the single worst moment (first contact, when there
+is no previous key to compare against). Removing the directory read from the invite path
+makes the substitution impossible instead, and costs the user one code to pass along
+rather than a fingerprint comparison ritual.
+
+It also closed **M3** as a side effect, and absorbed **14.3/14.4** (CLI invite, member
+management), which had to exist for a headless operator to admit anyone.
+
+Safety numbers may still return later as defence in depth for *identity* verification —
+"is this really Bob's account" — which is a different question from "which key gets the
+group key". They are no longer load-bearing.
 
 ### Milestones
 
 | # | Component | Description |
 |---|---|---|
-| 12.1 | Route inventory + blindness test | Enumerate every hub route; assert no response body can contain key material, content, a file name or a content hash. Runs in CI, fails the build on regression |
-| 12.2 | **Key transparency + safety numbers** [H3] | Append-only, hub-signed key log; clients pin the key they first saw and audit the log; key change raises a blocking warning; safety-number comparison UI between two members. This is the fix for the last structural way a hub can read content |
-| 12.3 | Chat metadata minimization | `chat_notify` (`webrtc_server.py:634-644` → `revocation.py:101-128`) currently tells the hub *who* posted in *which* group and *when*. Drop `sender_name`, make notification opt-in per group, coalesce and delay to blunt timing correlation |
-| 12.4 | Swarm hardening | Enforce 11.5.18 at the API layer too: reject registration for a group the hub knows is private; authenticate `GET /v1/swarm/{hash}` |
-| 12.5 | Opaque private-group metadata | For `visibility == "private"`, store name/description as a member-encrypted blob; the hub holds an opaque value and an id. Public groups unchanged (discovery needs plaintext) |
-| 12.6 | SPA integrity + honest labelling | Strict CSP, SRI on the bundle, hub publishes a signed digest of the served bundle that native clients and extensions can verify; `/app/` carries an explicit "reduced trust — this hub serves this code" notice |
-| 12.7 | Remove dead crypto plumbing | Drop residual columns/migrations/constants from the pre-Phase-12 GEK era so the schema cannot be quietly repopulated |
-| 12.8 | Written threat model | One page: passive hub, active hub, malicious node operator, malicious member, network attacker, local attacker — and for each claim, which adversary it holds against. Referenced from draft-v5 |
+| 12.1 | ~~Key transparency + safety numbers~~ [H3] | ✅ **DONE 2026-08-14**, by a different design — see above and `docs/invite-pairing-v1.md` |
+| 12.2 | Served-SPA integrity | Strict CSP, Subresource Integrity on the bundle, and a signed digest of the served bundle published by the hub so a native client or extension can verify what the browser was given. **Now the highest-value item here**: T3 is the only remaining way an active hub reads content, and it can also lift a pairing code out of the page it served. **The CSP must keep `wasm-unsafe-eval` in `script-src`** — the bundle KDF is Argon2id in WebAssembly since 2026-08-14, and a policy that forbids it locks every user out of their keys |
+| 12.3 | Honest labelling | `/app/` states plainly that the hub serves this code and what that implies. Docs stop claiming end-to-end integrity for the hub-served path — the claim that holds is "the hub cannot read your content unless it ships you malicious client code" |
+| 12.4 | Written threat model | One page: passive hub, active hub, malicious node operator, malicious member, network attacker, local attacker — and for each claim, which adversary it holds against. This is what stops the overclaiming pattern the second review kept finding |
 
-**Acceptance criteria:** a hub operator holding root on the server, the full PostgreSQL
-database, the Ed25519 signing key, and the ability to forge any JWT can obtain: no private
-key, no GEK, no file content, no file name, no content hash, no message content, and no
-private group name. Every remaining capability is on the list above and is documented in
-12.8. Any attempt to substitute a public key is detectable by clients via 12.2.
+**Dropped from the old Phase 12** (recorded so the intent is not lost if it returns):
+route-inventory blindness test, opaque private-group name/description, chat_notify
+metadata minimization, residual schema cleanup.
 
 ---
 
@@ -790,7 +841,7 @@ used for the API only, and the bundle is covered by 13.9 signing.
 |---|---|---|
 | 13.1 | Platform adapter split | Extract `platform-web.js` (WebRTC/WebCrypto/fetch — today's behaviour) and `platform-native.js` (pywebview bridge). `app.js` imports neither directly. **Acceptance: the browser SPA is byte-for-byte functional after the split** — this lands first, on its own, with no native code |
 | 13.2 | pywebview shell + Python bridge | `meshbay-client` package; `window.pywebview.api.*` implements the same surface as the three globals; single-instance, tray, window state |
-| 13.3 | Local keystore + Ed25519 client auth | Reuse `keystore.py` (Argon2id 256 MB, OS keychain later). Client authenticates like the daemon does: signed timestamp, `POST /v1/users/auth`. **No password on the wire, no `auth_key`/`bundle_key`, no keypair bundle anywhere** → closes **C4** permanently |
+| 13.3 | Local keystore + Ed25519 client auth — **the real close for C4**, now partially mitigated by Argon2id (draft-v5 §7.1) | Reuse `keystore.py` (Argon2id 256 MB, OS keychain later). Client authenticates like the daemon does: signed timestamp, `POST /v1/users/auth`. **No password on the wire, no `auth_key`/`bundle_key`, no keypair bundle anywhere** → closes **C4** permanently |
 | 13.4 | aiortc client transport | `RTCPeerConnection` + `createDataChannel` + `createOffer` in Python; ICE/STUN via `aioice` — the traversal path validated on 2 ISPs. Calls the unified handshake from 11.5.4. QUIC (`quic_client.py`) retained as opt-in for LAN / port-forwarded / hub-less `group://` |
 | 13.5 | Local index cache | SQLite in the client profile dir, replacing IndexedDB (also restricted under `file://` in some WebViews) |
 | 13.6 | Loopback media server | Python decrypts and serves with HTTP Range; `<video src="http://127.0.0.1:…">`. Drops MSE + the fMP4 remux for native (WebKitGTK MSE is unreliable). **Hardening is mandatory and mirrors C1: bind `127.0.0.1` only, random port, per-file capability token scoped to the session, no CORS, reject non-local `Origin`** |
@@ -817,31 +868,52 @@ These carry NAT traversal and are not browser workarounds.
 > Was Phase 12 before the 2026-08-13 renumbering.
 
 **Objective:** `meshbay-node` CLI becomes a full management tool, not just a
-daemon launcher. Users can manage groups, members, and node state from the
-command line. More important once native clients exist, since group and GEK
-management moves out of the browser.
+daemon launcher.
+
+**Partially delivered early (2026-08-13), forced by the first real deployment.**
+Every operator action lived behind a web UI on the node's own loopback interface,
+so a node on a server reached over SSH could not be operated at all without
+port-forwarding a browser session — and 11.5.3 added a token that had to be
+copied out of a log to get in. `status`, `ui` and `gek-init` shipped to unblock
+that.
+
+**Member management landed 2026-08-14** with the invite redesign, for the same
+reason: a node admits people from its own roster, and a headless operator had no
+way to put anyone on it. `operator pair`, `member list|invite|revoke|unpin` all
+work over SSH. **Deleting a file is now the only operator action that still needs
+a browser.**
 
 ### Milestones
 
 | # | Component | Description |
 |---|---|---|
-| 14.1 | `meshbay-node status` | Show daemon state: groups, peers, connected members, uptime |
+| 14.1 | `meshbay-node status` | ✅ DONE — hub, node public key, daemon state, groups, admin-key pinning. Reads the keystore directly so it works while the daemon is stopped |
+| 14.1b | `meshbay-node ui` | ✅ DONE — prints the admin UI URL and the `ssh -L` line. Does not open a browser |
+| 14.1c | `meshbay-node gek-init` | ✅ DONE — initialises a group key via the daemon's loopback API. Was previously only possible by clicking a button in a browser on the node's own machine |
 | 14.2 | `meshbay-node group list` | List configured groups with online status |
 | 14.3 | `meshbay-node group create` | Create group on hub, add to config, generate GEK |
 | 14.4 | `meshbay-node group join` | Join existing group, fetch GEK from local BundleStore, add to config |
-| 14.5 | `meshbay-node member invite` | Wrap GEK for new member, store bundle in the local BundleStore (**not** the hub — bundles have been P2P since Phase 12) |
-| 14.6 | `meshbay-node member remove` | Rotate GEK, re-wrap for remaining members, store locally |
-| 14.7 | `meshbay-node member list` | List group members with online status |
+| 14.5 | `meshbay-node member invite` | ✅ **DONE 2026-08-14** — issues a one-time code; the node wraps the GEK itself when the invitee connects. The original description ("wrap GEK for new member, store bundle") describes the design the invite redesign replaced |
+| 14.6 | `meshbay-node member revoke` | ✅ **DONE** — stops the node serving the key, and tells the operator to rotate it, since the ex-member still holds the current one |
+| 14.6b | `meshbay-node member unpin` | ✅ **DONE** — forget a pinned identity so someone can pair again after a key reset |
+| 14.7 | `meshbay-node member list` | ✅ **DONE** — roster: who is admitted, with what role, pinned when and how. Online status still to add |
 | 14.8 | Config reload (SIGHUP) | Daemon reloads config and adds/removes groups without restart |
-| 14.9 | `meshbay-node admin-key` | Pin the operator's **client** Ed25519 key as `admin_pk_ed25519` — fixes M3, where auto-pinning the node keystore key makes operator deletion impossible |
+| 14.9 | ~~`meshbay-node admin-key`~~ | ✅ **Superseded by `operator pair`** — pairing binds the operator's browser key with a one-time code instead of pasting a base64 key, and the auto-pin that made M3 possible is deleted |
 | 14.10 | `meshbay-node denylist` | Inspect and clear the persisted revocation denylist (11.5.17) |
+| 14.11 | `meshbay-node file rm` | The one operator action still requiring a browser |
 
 ### Architecture
 
-CLI commands communicate with the running daemon via a local Unix socket
-(`/run/meshbay-node.sock`, mode 0600, owner-only). The daemon exposes a small internal API
-for status queries and management operations. If the daemon is not running,
-commands that require it fail with a clear error.
+CLI commands talk to the running daemon over its **loopback admin API**, authenticated
+with the per-run session token (11.5.3) — `_daemon_api()` in `daemon.py`. The Unix-socket
+design below was the original plan; the loopback API already existed for the admin UI,
+carries the same authorization, and avoided a second control plane. A socket would still
+be an improvement (no port, file permissions instead of a token file) if the admin UI
+ever goes away.
+
+`status` deliberately does *not* use it: it reads the keystore, the config and the roster
+directly, so it works while the daemon is stopped — which is when an operator most needs
+to know why.
 
 ---
 
@@ -1002,11 +1074,10 @@ community developers. Core functionality must be complete and stable first.
 ```
 Phase 11.5 (Security remediation)  ⛔ BLOCKING — nothing else starts
 Phase 13.1 (Platform adapter split) ← free refactor, unblocks every D2 option
-Phase 12   (Hub minimization)      ← makes "the hub cannot read" structural
+Phase 12   (Key verification)      ← H3 safety numbers + served-SPA integrity
 Phase 14   (Node CLI)              ← best security-per-effort answer to T3
 Phase 15   (Sender Keys)           ← chat encryption; 15.0 decision first
-── decision point D2: extension / native / both ──
-Phase 13.2–13.11 (Desktop client)  ← product-driven; needs 18.7 for the security claim
+Phase 13.2–13.11 (Desktop client)  ← DECIDED: offered alongside the browser SPA
 Phase 16   (Android)               ← reuses the Phase 13 design
 Phase 17   (Resilience)            ← optional, edge cases only
 Phase 18   (Packaging + CI)        ← distro repos; 18.7 gates 13's security argument
diff --git a/docs/USERGUIDE.md b/docs/USERGUIDE.md
index ccbf112..71b0060 100644
--- a/docs/USERGUIDE.md
+++ b/docs/USERGUIDE.md
@@ -62,7 +62,9 @@ MeshBay has three components. Understanding which role each plays avoids a lot o
 
 ### Register
 
-Registration submits your Ed25519 (signing) and X25519 (key agreement) public keys. These let other members wrap GEK bundles for you and let nodes verify your JWT offline.
+Registration creates an account and nothing else: a username, an email, and a value derived from your passphrase that lets the hub check it without ever seeing it.
+
+**No keys are generated here.** An identity keypair belongs to a *node*, not to the hub: one is created the first time you join a given node, encrypted under your passphrase, and left with that node. So an operator who takes their own disk holds a key that is worthless on anyone else's, and the hub has no key directory to publish — which is what finding H3 read.
 
 **Deux modes de génération de clés :**
 
@@ -86,22 +88,13 @@ Implémenté dans `static/keyderive.js`.
 ```
 POST /v1/users/register
 {
-  "username":        "string",
-  "password":        "string (min 8 chars)",
-  "pk_user_ed25519": "base64 raw 32-byte Ed25519 public key",
-  "pk_user_x25519":  "base64 raw 32-byte X25519 public key",
-  "keypair_bundle":  "base64 AES-256-GCM encrypted bundle (web clients only, optional)"
+  "username": "string",
+  "email":    "string",
+  "auth_key": "base64 (PBKDF2-SHA512 of your passphrase — the hub never sees the passphrase itself)"
 }
 → 201 {"user_id": "uuid"}
 → 409 if username is taken
 ```
-
-Passwords are hashed with Argon2id (iterations=3, memory=64 MB in dev;
-target 256 MB / ~500ms in production). Intentionally slow to resist offline attacks.
-
-### Login
-
-```
 POST /v1/users/login
 {"username": "yourname", "password": "yourpassword"}
 → {
@@ -109,12 +102,12 @@ POST /v1/users/login
     "refresh_token":  "opaque 256-bit token (30 days)",
     "token_type":     "bearer",
     "expires_in":     3600,
-    "keypair_bundle": "base64 AES-GCM blob (présent uniquement si enregistré via web)"
   }
 ```
 
-Les clients web utilisent `keypair_bundle` pour récupérer leurs clés privées
-sur un nouvel appareil : déchiffrement local avec le mot de passe via `keyderive.js`.
+Le trousseau ne vient pas d'ici : chaque nœud conserve celui qui lui est propre,
+chiffré par votre phrase de passe, et un nouveau navigateur le récupère auprès du
+nœud auquel il se connecte.
 
 ```bash
 curl -s -X POST https://meshbay.org/v1/users/login \
@@ -189,59 +182,49 @@ Save `group_id` — you will need it in your `node.toml` and when adding members
 | Join | Open / approval-gated | By invitation only |
 | GEK | Not applicable | Required |
 
-For private groups, the group admin generates a Group Encryption Key (GEK) — a random 32-byte ChaCha20-Poly1305 key. The GEK is never sent over the wire in cleartext. Instead, the admin wraps a copy of it for each member using that member's X25519 public key and stores the opaque bundle on the hub.
+For private groups the node holds a Group Encryption Key (GEK) — a random 32-byte key that is never sent over the wire in cleartext. Each member receives a copy wrapped for their own X25519 public key (ECIES: X25519 + HKDF + AEAD).
+
+**The node does the wrapping, and it never asks the hub for anybody's key.** That matters: the hub is the account directory, so a hub that answered a key lookup with its own key would be handed the group key by an honest member following the protocol exactly (finding H3). Instead the recipient presents their own public keys over the authenticated P2P channel, signed by their identity key, and the node wraps for what it just verified.
 
 ### Add a member to a private group
 
-The group admin fetches the new member's X25519 public key from the hub, wraps the GEK for them, and uploads the bundle:
+The node operator issues a one-time code, from the server or from their browser:
 
-```python
-import base64, httpx
-from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey, X25519PublicKey
-from cryptography.hazmat.primitives.ciphers.aead import ChaCha20Poly1305
-from cryptography.hazmat.primitives.kdf.hkdf import HKDF
-from cryptography.hazmat.primitives import hashes, serialization
-import os
+```bash
+# On the node, over SSH — no browser needed
+meshbay-node member invite bob
 
-HUB      = "https://meshbay.org"
-GROUP_ID = "10484cb7-e45a-4cdc-8b06-f8ccdacc04d2"
-TOKEN    = "alice_test-access-token"
-GEK_RAW  = bytes.fromhex("your-32-byte-gek-in-hex")  # load from keystore
+INVITATION CODE  R3H8-TB6V
+valid until      2026-08-21T12:00:00+00:00
+```
+
+Send the code to Bob however you already talk to him — it never passes through the hub, which is what stops the hub from claiming to be Bob. He enters it the first time he opens the group, and the node then wraps the group key for the key he proved he holds.
 
-headers = {"Authorization": f"Bearer {TOKEN}"}
+After that first time the pin is his credential: he is recognised on every later connection, and asked for nothing. You do not need to be online when he joins.
 
-# 1. Fetch new member's X25519 public key
-r = httpx.get(f"{HUB}/v1/users/bob_test/pubkeys", headers=headers)
-r.raise_for_status()
-pk_member_raw = base64.b64decode(r.json()["pk_x25519"])
+| | |
+|---|---|
+| Code lifetime | 7 days (`[node] invite_ttl_hours`) |
+| Reuse | Single use; re-inviting supersedes the previous code |
+| If it expires | Issue another one — nothing else is affected |
+| Wrong code, repeatedly | Bounded per connection and node-wide, and logged in the node's audit log |
 
-# 2. Wrap GEK for them (ECIES-like)
-sk_eph     = X25519PrivateKey.generate()
-pk_eph_raw = sk_eph.public_key().public_bytes(
-    serialization.Encoding.Raw, serialization.PublicFormat.Raw)
-shared     = sk_eph.exchange(X25519PublicKey.from_public_bytes(pk_member_raw))
-wrap_key   = HKDF(algorithm=hashes.SHA256(), length=32,
-                  salt=pk_eph_raw, info=b"meshbay:gek_wrap:v1").derive(shared)
-nonce      = os.urandom(12)
-wrapped    = ChaCha20Poly1305(wrap_key).encrypt(nonce, GEK_RAW, pk_member_raw)
+The same operation is available in the web app: the group's **Members** tab, if your browser is paired with the node (`meshbay-node operator pair`).
 
-# 3. Upload the opaque bundle to the hub
-bundle = {
-    "pk_eph_b64":  base64.b64encode(pk_eph_raw).decode(),
-    "nonce_b64":   base64.b64encode(nonce).decode(),
-    "wrapped_b64": base64.b64encode(wrapped).decode(),
-}
-r = httpx.post(f"{HUB}/v1/groups/{GROUP_ID}/members/bob_test/gek",
-    json=bundle, headers=headers)
-r.raise_for_status()
-print("Bundle stored. bob_test can now access the group.")
+### Removing a member
+
+```bash
+meshbay-node member revoke bob
+meshbay-node gek-init            # rotate: Bob still holds the old key
 ```
 
-The hub stores the bundle as an opaque blob. It cannot decrypt it — it stores `pk_eph`, `nonce`, and `wrapped` as separate columns but has no key to derive `wrap_key`.
+Revoking stops the node serving Bob the key from his next connection onward — there is no stored bundle left behind that could outlive the decision. It does **not** take back the key he already has, which is why the second command exists.
+
+### What revocation does and does not do
 
-### Member revocation
+Rotating the GEK (`meshbay-node gek-init`) makes the node encrypt new content with a new key, which every remaining member picks up automatically on their next connection — nothing has to be re-uploaded or re-wrapped by hand.
 
-To revoke a member: generate a new GEK, re-encrypt it for all remaining members, and upload the new bundles. The node begins encrypting new content with the new GEK from that point. Former members can still decrypt previously received content (no retroactive re-encryption).
+A former member can still decrypt content they already received: there is no retroactive re-encryption, and there is no way to reach into someone's disk. Revocation controls what happens next, not what already happened.
 
 ---
 
@@ -764,7 +747,7 @@ All hub endpoints are under `https://meshbay.org`. Node endpoints are under `htt
 
 | Method | Path | Auth | Description |
 |---|---|---|---|
-| POST | `/v1/users/register` | None | Register account. Body: `username, password, pk_user_ed25519, pk_user_x25519`. Returns `user_id`. |
+| POST | `/v1/users/register` | None | Register account. Body: `username, email, auth_key`. No keys — identity keypairs are per node. Returns `user_id`. |
 | POST | `/v1/users/login` | None | Authenticate. Body: `username, password`. Returns `access_token, refresh_token`. |
 | POST | `/v1/users/token/refresh` | Refresh token | Issue new access token. Body: `refresh_token`. |
 | GET | `/v1/users/{username}/pubkeys` | Access token | Fetch `pk_ed25519` and `pk_x25519` for any user (used by group admins for GEK wrapping). |
diff --git a/docs/invite-pairing-v1.md b/docs/invite-pairing-v1.md
new file mode 100644
index 0000000..290c756
--- /dev/null
+++ b/docs/invite-pairing-v1.md
@@ -0,0 +1,546 @@
+# MeshBay — Invitation and Pairing (design)
+
+> Status: **implemented and deployed** (2026-08-14). Written 2026-08-13 as a proposal;
+> §9bis records what shipped, what departed from the plan, and what a browser found
+> that the automated run could not.
+> Supersedes the invite flow described in `meshbay-draft-v5.md` §5.1 and the
+> Phase 12.1 milestone in `devel-phases-next.md`, if adopted.
+>
+> Closes **H3** for the path where it is actually exploitable, and dissolves **M3**
+> rather than patching it. Follows the v5 convention: every claim names the
+> adversary it holds against.
+
+---
+
+## 1. What is wrong today
+
+Two problems, one visible to users and one invisible.
+
+### 1.1 The workflow problem
+
+An invite runs entirely inside the inviter's browser (`app.js:1391-1420`):
+
+1. fetch the invitee's `pk_x25519` from the hub — `GET /v1/users/{name}/pubkeys`
+2. take the raw GEK out of the live transport connection
+3. wrap the GEK for that key and push the bundle to the node over MNP
+4. add the member on the hub
+
+Step 2 requires the inviter to be **connected to the node with the group key in
+hand**. Step 3 requires the node to accept the bundle, which since C5b means the
+signature must be the node operator's (`webrtc_server.py:1023-1035`). Together:
+
+- only the node operator can invite — v5 §5.1 records this as deliberate
+- the operator must be at a browser, connected, at the moment of the invite
+- a group admin who does not run the node cannot add anyone, ever
+
+That is not a workflow. It is the reason the demo needs `demo.py set-admin-pk`.
+
+### 1.2 The security problem (H3)
+
+Step 1 asks the **hub** which key belongs to `bob`. The hub stores those keys as
+mutable columns on the user row (`api/users.py:352-354`) and serves them with no
+signature and no history. A hub that answers with a key it holds is handed the GEK
+by an honest inviter following the protocol exactly. Nothing forged, nothing
+injected, and nothing in the client notices.
+
+The account is unique and the account is right. The **key attached to the account**
+is what the hub controls.
+
+### 1.3 M3, underneath both
+
+The daemon auto-pins its own keystore key as the admin key (`daemon.py:470-474`);
+the browser signs with the user identity key (`app.js:1416`). They differ, so
+invites and deletions fail closed with a signature error that looks like a bug
+elsewhere. The demo works only because a deploy script writes the browser key into
+`node.toml`.
+
+The tempting fix — have the daemon fetch the operator's key from the hub — turns M3
+into a second H3: the hub would then be able to install itself as node
+administrator. **The node must never learn authority from the hub.**
+
+---
+
+## 2. Principle
+
+Three rules. Everything below follows from them.
+
+1. **The node wraps the group key.** The node already holds the GEK — it encrypts
+   and serves the content. So it, not the inviter's browser, produces each member's
+   bundle. No member ever handles another member's key material.
+2. **A key is bound to an identity by a one-time pairing code, then pinned.** The
+   code travels out of band (the inviter sends it to the invitee the way they
+   already talk). The hub never sees it and therefore cannot claim to be the
+   invitee.
+3. **The node keeps its own roster.** Hub membership is an input, not an
+   authorization. Otherwise a hub that invents an account and mints a token for it
+   collects the GEK on connect.
+
+Human cost of the whole scheme: **one code per person, once per node**, plus one
+code for the operator at install. No fingerprint comparison, no per-member
+signature ceremony, no operator required to be online when someone joins.
+
+---
+
+## 3. Flows
+
+### 3.1 Operator pairing (once per node, replaces M3)
+
+```
+operator (SSH)   meshbay-node operator pair
+node             prints   PAIR-CODE: K7M2-QX4P     (also written to data_dir/pair-code)
+operator (SPA)   group → Members tab → "Pair this browser" → types the code
+SPA → node       join_request {role_hint: operator, code, pk_ed25519, pk_x25519, sig}
+node             code valid, unused, unexpired → pins the keys, role = operator
+node             writes the pin to its roster DB, prints it in `status`
+```
+
+The operator types 8 characters into their own browser. Nothing is pasted, nothing
+is copied out of a terminal, no browser is needed on the node host, and the hub is
+not involved at any point. `admin_pk_ed25519` in `node.toml` becomes a legacy
+fallback, still read, no longer required.
+
+### 3.2 Invite (one click, operator or delegate)
+
+```
+grenet (SPA)     Groups → Members → "Invite bob"
+SPA → node       admin_request {op: invite_create, group_id, invitee: bob, ttl}
+node → SPA       admin_challenge  (structured transcript, H5 — the SPA shows one
+                                   line: "authorize bob to join <group>")
+SPA → node       admin_response {sig}       ← signed silently with grenet's key
+node             creates invite: code, group, invitee, expiry; status = pending
+node → SPA       invite_created {code: "R3H8-TB6V", expires_at}
+grenet           sends the code to bob however they already talk
+SPA → hub        POST /v1/groups/{id}/members/bob   (membership, unchanged)
+```
+
+Grenet's browser signs, but grenet does not *inspect* a signature — one click, one
+confirmation line, one code to pass on. Same gesture as any invite link on any
+platform.
+
+### 3.3 Join (fully automatic, operator may be asleep)
+
+```
+bob (SPA)        opens the group; client has no GEK for it
+bob → node       handshake {token, group_id, nonce_c}          (pre-proof window)
+node → bob       handshake_challenge {nonce_s, node_pk}   ← bob signs over both
+bob → node       join_request {group_id, pk_ed25519, pk_x25519, code, sig}
+node             1. rate-limit + attempt count on this connection
+                 2. code matches a pending invite for this user_id and group
+                 3. identity not already pinned to a different key
+                 4. pin (user_id → pk_ed25519, pk_x25519), mark invite used,
+                    member status = active
+                 5. wrap the ACTIVE GEK for pk_x25519  (ECIES, as today)
+node → bob       join_result {ok, pk_eph_b64, nonce_b64, wrapped_b64}
+bob              unwraps the GEK, completes the normal GEK proof, session proceeds
+```
+
+On every later connection bob sends `join_request` **without** a code; the node
+recognises the pinned identity, re-wraps the current GEK and answers. So GEK
+rotation propagates by itself, and a revoked member simply stops being served.
+
+### 3.4 Open-join groups: no code (decided 2026-08-13)
+
+A group whose hub-side `join_policy` is `"open"` (`groups.py:227-228`) admits anyone
+who asks. A pairing code there protects nothing — the hub can create an account,
+join through the front door and be a legitimate member — so it is pure friction.
+For those groups the node pins on first contact (TOFU, `pinned_via = 'tofu'`) and
+wraps the GEK immediately.
+
+Note the axis. `visibility` (public/private) controls **discoverability** and swarm
+hash registration (H7); `join_policy` (open/request/invite) controls **admission**.
+Only the second one decides whether a code is required. A `visibility = "public"`
+group with `join_policy = "invite"` keeps the code — being findable is not being
+open.
+
+**Stated plainly, per the v5 convention:** in an open-join group the hub can obtain
+the GEK, because it can become a member legitimately. That is a property of open
+joining, not of this design — it is equally true today. Content in such a group is
+protected from the network and from non-members, and from nobody else. The docs
+must say so, and the SPA should say so when someone sets `join_policy = "open"` on
+a group that already holds content.
+
+---
+
+## 4. Why a pairing code, and not something lighter
+
+The choice is forced by one question: when bob connects for the first time, what
+stops the hub from being bob?
+
+| Option | What the hub can do | Verdict |
+|---|---|---|
+| Node wraps for the key the peer presents, no binding | Forge a JWT for bob, present its own key, receive the GEK | **Worse than today** — today a forged JWT yields a bundle wrapped to bob's real key, which is useless |
+| Bind to the key the inviter fetched from the hub | Substitute at invite time — H3 unchanged, just relocated into the node | No |
+| TOFU: first connection wins | Race the real bob with a forged token; small window, total consequence | No |
+| Safety-number comparison at invite | Nothing — but it needs two humans reading digits at the worst moment | Correct, unusable as the default |
+| **One-time pairing code** | Nothing: the code never reaches the hub | **Adopted** |
+
+The code is the cheapest thing that binds an identity to a key without the
+directory. It is also the familiar shape — invite links work this way everywhere.
+
+**Boundary, stated honestly:** for a browser client the SPA is served by the hub, so
+a hub that ships malicious client code can read the code out of the page. That is
+**T3, accepted permanently** by decision D1 and unchanged by this design. The code
+defeats a hub that *lies in its directory* — a silent, undetectable, per-request
+attack — not one that *rewrites the client*, which is an artifact and is what the
+native client (Phase 13) removes. Do not blur the two in the docs.
+
+---
+
+## 5. Protocol
+
+### 5.1 New MNP messages (`meshbay_common/protocol.py`)
+
+```
+JOIN_REQUEST  = "join_request"    # client → node, served in the pre-proof window
+JOIN_RESULT   = "join_result"     # node → client
+INVITE_CREATE = "invite_create"   # inviter → node (admin op, see 5.3)
+INVITE_RESULT = "invite_result"   # node → inviter, carries the code once
+```
+
+`join_request`:
+
+| Field | Meaning |
+|---|---|
+| `group_id` | mandatory, as everywhere since 11.5.4 |
+| `pk_ed25519`, `pk_x25519` | the caller's own keys, base64 raw |
+| `code` | first pairing with this node only; omitted when `join_policy == "open"` (§3.4) |
+| `role_hint` | `operator` or absent; the node trusts the *code*, not the hint |
+| `sig` | Ed25519 over the transcript below |
+
+### 5.2 Join transcript
+
+```
+"meshbay:join:v1" ‖ len‖node_pk ‖ len‖group_id ‖ len‖user_id
+                  ‖ len‖pk_ed25519 ‖ len‖pk_x25519 ‖ len‖nonce_s ‖ len‖ts
+```
+
+Length-prefixed and domain-separated per 11.5.21. `nonce_s` is the handshake nonce
+the node just issued, so a `join_request` cannot be replayed onto another
+connection. `pk_x25519` is inside the signature, so the Ed25519 key vouches for the
+X25519 key it is paired with — this is what makes "wrap for the presented key" safe.
+
+The **code is never signed and never echoed** — it is a bearer secret, compared
+against a stored hash and destroyed on use.
+
+### 5.3 Invite creation reuses the existing admin machinery
+
+New op in `meshbay_common/adminop.py`, alongside `OP_FILE_DELETE` and
+`OP_GEK_BUNDLE_STORE`:
+
+```
+OP_INVITE_CREATE = "invite_create"
+"meshbay:admin:v1" ‖ len‖op ‖ len‖node_pk ‖ len‖group_id ‖ len‖subject ‖ len‖nonce ‖ len‖ts
+                                                    subject = invitee user_id
+```
+
+Authorized by the pinned **operator** role, or by a **delegate** (§6.2). TTL 120 s,
+same as every other admin op. The client rebuilds the transcript and refuses to
+sign if the subject is not the person the user typed — H5's rule, unchanged.
+
+### 5.4 Code format
+
+8 characters, Crockford base32 (no `I`, `L`, `O`, `U`), rendered `XXXX-XXXX` — 40
+bits. Single use, default TTL 24 h, stored only as `sha256(code)` — a password KDF
+would be pointless over 40 uniformly random bits, and `blake3` is not a node
+dependency. Guessing is
+bounded by: 5 attempts per connection, a node-wide limiter on failed
+`join_request`s, and the fact that a code is valid for exactly one `user_id` in one
+group. A brute-force attempt is an audit-log event, not a silent grind.
+
+---
+
+## 6. Node state
+
+### 6.1 Schema (new tables, `roster.py`, same SQLite file style as `bundle_store.py`)
+
+```sql
+CREATE TABLE identities (          -- one row per person, not per group
+    user_id    TEXT PRIMARY KEY,
+    username   TEXT NOT NULL,
+    pk_ed25519 TEXT NOT NULL,
+    pk_x25519  TEXT NOT NULL,
+    pinned_at  TEXT NOT NULL,
+    pinned_via TEXT NOT NULL       -- 'code' | 'tofu' | 'legacy-config' | 'operator-reset'
+);
+
+CREATE TABLE members (
+    group_id    TEXT NOT NULL,
+    user_id     TEXT NOT NULL,
+    role        TEXT NOT NULL,     -- 'operator' | 'delegate' | 'member'
+    status      TEXT NOT NULL,     -- 'pending' | 'active' | 'revoked'
+    approved_by TEXT NOT NULL,     -- user_id whose signature created the invite
+    approved_at TEXT NOT NULL,
+    PRIMARY KEY (group_id, user_id)
+);
+
+CREATE TABLE invites (
+    code_hash  TEXT PRIMARY KEY,
+    group_id   TEXT NOT NULL,
+    user_id    TEXT NOT NULL,
+    role       TEXT NOT NULL,
+    created_by TEXT NOT NULL,
+    expires_at TEXT NOT NULL,
+    used_at    TEXT
+);
+```
+
+Identity is pinned **per node, not per group**: someone already paired for one group
+needs no code for the next one. The operator's pairing is the same mechanism with
+`role = 'operator'` and no group.
+
+### 6.2 Delegation — **deferred** (decided 2026-08-13)
+
+A `delegate` row would let a group admin who is not the node operator create invites
+without the operator being involved again. Not needed while the operator is the
+inviter (the demo, and every single-operator deployment), so it is **not built in
+v1**.
+
+The `role` column reserves the value and `invite_create` authorization is written as
+a role check rather than an equality test against the operator, so adding it later
+is a roster row and a CLI command — no protocol change, no migration.
+
+### 6.3 What the node stops doing
+
+- `gek_bundle_store` **no longer accepts member-supplied bundles at all.** Nothing
+  arriving over MNP contributes key material. C5b's rule is not merely preserved,
+  it becomes structural — the message can be deleted from the client path entirely.
+- Per-member rows in `gek_bundles` are no longer written. The node wraps on demand.
+  The node's own `_node_{user_id}` bundle stays: that is how the daemon reloads its
+  GEK across restarts.
+- **Consequence worth having:** revocation starts working for key delivery. A
+  stored bundle today survives revocation; on-demand wrapping does not. (Rotating
+  the GEK after a revocation is still required — the ex-member has the old key.)
+
+---
+
+## 7. Security analysis
+
+### 7.1 Against each adversary
+
+| Attack | Today | With this design |
+|---|---|---|
+| Hub substitutes the invitee's key at invite time (**H3**) | Succeeds silently, hub gets the GEK | **Fails** — no key is ever fetched from the directory |
+| Hub forges a JWT for a real member | Gets a bundle wrapped to the member's real key: useless | Unchanged: no code, no pin match → refused |
+| Hub invents an account and adds it to the group | Blocked only accidentally, by the bundle requirement | **Blocked by the roster** — no invite, no code, no GEK |
+| Hub substitutes the *operator's* key (M3's tempting fix) | n/a | **Impossible** — the node pins by code, never asks the hub |
+| Member wraps a GEK of their choosing for the operator (**C5b**) | Blocked by operator signature | **Impossible** — the message no longer exists |
+| Member replays a `join_request` from another connection | n/a | Bound to `nonce_s` |
+| Member presents someone else's `pk_x25519` | n/a | Signed by the paired `pk_ed25519`, mismatch refused |
+| Ex-member reconnects after revocation | Stored bundle still unwraps | Not served; GEK rotation still needed |
+| Third party guesses a code | n/a | 40 bits, single use, per-user, rate-limited, audited |
+| Hub joins an **open-join** group and collects the GEK | Succeeds | Still succeeds — inherent to open joining (§3.4), must be documented, not hidden |
+
+### 7.2 What this does **not** fix
+
+- **T3** — the hub serves the SPA and can read the code out of the page. Accepted
+  (D1); removed only by the native client plus reproducible builds.
+- **C4** — the keypair-bundle pre-proof window is untouched. A first-time joiner
+  still needs their own identity keys before they can sign anything; that material
+  belongs on the user's device (Phase 13.3).
+- **The node operator reads everything.** Inherent to the model.
+- **The hub still knows who is in which group.** Membership is hub-side; the roster
+  only decides who receives the key.
+- **A member can still leak the GEK out of band.** Nothing prevents that, and
+  nothing in the current design pretends to.
+
+---
+
+## 8. Failure modes and edge cases
+
+| Case | Behaviour |
+|---|---|
+| Code lost or expired | Inviter clicks "Invite" again; the old invite is superseded and its hash deleted |
+| Bob pairs, then loses his keys and runs `regenerateKeys` | Pin mismatch → join refused with a clear message; needs a fresh invite (operator or delegate re-issues). This is the intended blocking warning, moved to the moment it matters |
+| Bob is in two groups on the same node | One pin, one code, ever |
+| Node reinstalled / roster lost | Everyone re-pairs. Same class of event as losing the keystore; `status` must say so plainly |
+| Operator pairs a second browser | New `operator pair` code; both browsers valid, both listed in `status` |
+| Two people race one code | Single-use row, `used_at` set under a transaction; the loser gets a plain refusal |
+| Invite created while the node is offline | Not possible — invites are created on the node. The SPA must say "node offline, cannot invite" instead of failing obscurely |
+| Member connects while the group has no active GEK | `join_result {ok: false, reason: "no_gek"}`; the operator runs `gek-init` |
+| Legacy deployment with `admin_pk_ed25519` set | Read at startup and inserted as an `identities` row with `pinned_via = 'legacy-config'`; no migration needed for the current demo |
+
+---
+
+## 9. Operator surface
+
+```
+meshbay-node operator pair                  # print a pairing code for a browser
+meshbay-node member list [--group G]        # roster: who is pinned, role, status
+meshbay-node member invite bob [--group G]  # same as the SPA button, from SSH
+meshbay-node member revoke bob [--group G]  # stop serving the GEK to bob
+meshbay-node member unpin bob               # force re-pairing after a key rotation
+```
+
+`--group` is optional whenever the node hosts exactly one group.
+
+`meshbay-node status` gains a line per group: pinned identities, pending invites,
+and — when nothing is paired — the exact command to fix it. Everything an operator
+needs is reachable over SSH with no browser on the host, per the standing
+constraint. This absorbs milestones 14.3 and 14.4.
+
+---
+
+## 9bis. Implementation status
+
+**Slices 1 and 2 landed 2026-08-13/14.** Not yet exercised against a live
+deployment — the operator tests after slice 3, so the slices are written to be
+coherent with each other rather than individually demo-able.
+
+### Slice 1 — roster and operator pairing (M3)
+
+| Shipped | Where |
+|---|---|
+| `identities` / `members` / `invites`, codes, single-use redemption | `meshbay_node/roster.py` |
+| `join_transcript` — both public keys signed together | `meshbay_common/join.py` |
+| `join_request` / `join_result` handler, valid pre-proof and post-handshake | `transport/webrtc_server.py` |
+| Admin authority read from the roster on every check, `admin_pk_ed25519` kept as legacy | `webrtc_server._verify_admin_sig` |
+| **Auto-pin of the keystore key deleted** (M3) | `daemon._legacy_admin_pk` |
+| `meshbay-node operator pair`, roster in `status` | `daemon.main`, `ui/app.py` |
+| Pairing form in the group's Members tab | `app.js`, `transport.js` |
+
+### Slice 2 — the node wraps the key (H3)
+
+| Shipped | Where |
+|---|---|
+| Node wraps the GEK for the key the joiner proved, on every connection | `webrtc_server._join_ok` |
+| Roster decides who may receive it — hub membership alone does not | `Roster.is_authorized` |
+| `invite_create` admin op; the SPA shows a code instead of handling keys | `adminop.py`, `app.js` |
+| **`gek_bundle_store` deleted** — no member ever hands the node key material | `protocol.py`, `webrtc_server.py` |
+| **`gek-init` no longer fetches member keys from the hub** — it was H3 with the node as victim | `ui/app.py` |
+| Open-join groups admit without a code; policy read from `node.toml` | `config.py`, `_group_join_policy` |
+| Client asks for the key when it has none; prompts for a code when required | `transport.js`, `app.js` |
+
+**Tests: 148 node, 174 hub/common** (from 121/168 before this work). The end-to-end
+one worth knowing about is `test_invite_then_join_delivers_the_gek`: over a real
+DataChannel, the operator gets a code, and a member who has never held the group
+key redeems it in the pre-proof window and receives the key wrapped for a key only
+they can open.
+
+### What a browser found that the harness could not
+
+The design was exercised end to end by `QE/deploy/e2e.py` and passed. It was then tried in
+a browser and failed four times, each for a different reason, none of them the pairing code:
+
+| Symptom | Cause |
+|---|---|
+| No code ever requested, "no GEK available" | the browser held no identity keys — session restore never re-read the encrypted bundle sitting in its own localStorage |
+| "No nodes available" | the node had gone deaf: its hub socket sat in CLOSE-WAIT because the WebRTC offer handler was awaited inside the read loop (a Phase 11 bug) |
+| "Not a member of this group" | the token predated being added to the group; `groups` is baked in at sign-in, and nothing refreshed it |
+| "Handshake incomplete — reconnect and retry" | `joinGroup()` read `node_pk` and `nonce_node` before they were assigned |
+
+The common thread is worth keeping: **e2e.py is a second implementation of the client**,
+written in the right order by construction, so it proves the protocol and nothing about
+`app.js`. Three of those four were ordering or plumbing mistakes it could never see. Hence
+`packages/meshbay-hub/tests/test_spa_ordering.py`, which asserts on source order — inelegant,
+and the only thing that catches them.
+
+### Deliberate departures from this document
+
+| Written | Built | Why |
+|---|---|---|
+| `blake3(code)` | `sha256(code)` | 40 uniformly random bits; blake3 is not a node dependency |
+| Pairing in Settings | Pairing in the group's Members tab | that is where a live node connection exists |
+| — | `gek-init` rewritten | not in the plan: it wrapped the GEK for keys fetched from the hub, which is the same substitution the design closes |
+
+Two C5b tests were rewritten rather than kept: they asserted that
+`gek_bundle_store` demanded an operator signature, and that message no longer
+exists. They now assert the stronger property — that no member can hand the node
+key material at all, and that the retired message reaches no handler.
+
+### Slice 3 — the operator surface
+
+| Shipped | Where |
+|---|---|
+| `member list` / `invite` / `revoke` / `unpin`, all over SSH, no browser | `daemon.main` |
+| Roster endpoints behind the per-run session token (11.5.3) | `ui/app.py` |
+| Roster section in the local admin UI, every value escaped (H2) | `ui/app.py._render_roster` |
+| `_daemon_api` / `_resolve_group` — one loopback call path for every command | `daemon.py` |
+| Codes written to `data_dir/invite-code` and `data_dir/pair-code` | `roster.write_code_file` |
+
+Revocation tells the operator what it does **not** do: the ex-member stops
+receiving the key on their next connection, but they still hold the current one,
+so the message ends with the `gek-init` command that rotates it.
+
+`member revoke`/`unpin` resolve a username against the roster and refuse an
+unknown one rather than acting on nobody — a typo must not look like success.
+
+**Tests: 158 node, 174 hub/common** (from 121/168 before this work).
+
+### Code lifetimes (settled 2026-08-14)
+
+| Code | Default | Configurable via |
+|---|---|---|
+| Member invitation | **7 days** | `[node] invite_ttl_hours` |
+| Operator pairing | 24 h | `[node] pair_ttl_hours` |
+
+They differ because the acts differ: an invitation waits for someone to read their
+messages, a pairing code is typed during the SSH session that printed it. The
+longer window costs little — single use, one account, never seen by the hub, and
+40 bits do not fall to guessing in a week against the node-wide lockout.
+
+---
+
+## 10. Work to do
+
+### Node
+- `roster.py` — new module, the three tables and their queries
+- `transport/webrtc_server.py` — `join_request` / `join_result` in the pre-proof
+  window (beside the existing bundle fetches, `:243-258`); delete member-supplied
+  `gek_bundle_store`; `OP_INVITE_CREATE` in the admin-op dispatch
+- `transport/quic_server.py` — same handler via the shared path (11.5.4 parity test
+  must cover `join_request`)
+- `daemon.py` — `_resolve_admin_pk` → roster lookup with the legacy config fallback;
+  new CLI commands; `status` output
+- `ui/app.py` — roster and invites in the local admin UI, escaped as per 11.5.16
+
+### Common
+- `protocol.py` — four message constants
+- `adminop.py` — `OP_INVITE_CREATE`
+- `handshake.py` — expose `nonce_s` to the join transcript builder
+
+### Hub
+- **No change.** Membership endpoints stay as they are. Worth stating in the commit
+  message: the fix for H3 removes a hub responsibility rather than adding one.
+
+### SPA
+- Invite dialog shows the code and a copy button, instead of doing crypto
+- Settings gains "Pair this browser with my node" (code entry)
+- `join_request` on connect when no GEK is held; drop the wrap-and-store path
+- Delete the `pubkeys` fetch from the invite flow — the line that is H3
+
+### Tests (negative assertions, per §10 of v5)
+```
+test_join_requires_code_first_time      — unpinned identity without a code is refused
+test_join_rejects_key_swap              — pinned user presenting a new key is refused
+test_join_replay_across_connections     — join_request bound to nonce_s
+test_invite_requires_operator_role
+test_gek_never_wrapped_for_hub_supplied_key  — the H3 regression test
+test_revoked_member_gets_no_gek
+test_code_bruteforce_bounded
+test_open_join_group_pins_on_first_contact   — no code required, TOFU pin recorded
+test_invite_group_still_requires_code        — public visibility does not skip it
+```
+
+### Docs to rewrite
+- `meshbay-draft-v5.md` §2 (H3 row in the claims table), §5.1 (the "a group admin
+  who does not run the node can no longer invite" consequence is reversed), §9
+  (H3 moves to closed; note what remains open — T3, C4)
+- `devel-phases-next.md` — Phase 12.1 becomes this; 14.3/14.4 absorbed
+- `second-review.md` — H3 and M3 marked closed by this design
+- `QE/deploy/README.md` — `demo.py set-admin-pk` retired in favour of `operator pair`
+
+---
+
+## 11. Decisions
+
+Settled 2026-08-13 with the operator:
+
+| # | Question | Decision |
+|---|---|---|
+| 1 | Groups that skip the pairing code | **`join_policy == "open"` only** — asked as "public groups"; corrected to the admission axis, since `visibility` governs discoverability, not entry (§3.4) |
+| 2 | Delegation (group admin ≠ node operator) | **Deferred.** Role value reserved, authorization written as a role check so it drops in later (§6.2) |
+| 3 | Code TTL and length | 24 h, 40 bits, `XXXX-XXXX`. Default unless the first real use says otherwise |
+| 4 | `gek_bundle_store` from members | Deleted, not disabled — it is the C5b surface and keeping it dead-but-present invites its return |
+
+Items 3 and 4 are defaults chosen for v1, not constraints; both are one-line changes
+if the deployment argues against them.
diff --git a/docs/meshbay-draft-v5.md b/docs/meshbay-draft-v5.md
new file mode 100644
index 0000000..2a0f3b1
--- /dev/null
+++ b/docs/meshbay-draft-v5.md
@@ -0,0 +1,534 @@
+# MeshBay — Architecture Draft v5
+
+> Status: **Phase 11.5 (security remediation) complete. Invite redesign complete
+> (2026-08-14) — H3 and M3 closed.** See `devel-phases-next.md` and, for the invite
+> and pairing design, `docs/invite-pairing-v1.md`.
+> Supersedes `meshbay-draft-v4.md`. Sections not restated here are unchanged from v4.
+>
+> v5 exists because the second security review (`second-review.md`, 2026-08-13) found
+> that v4 described a system the code did not implement, and because several v4 claims
+> were simply wrong. This document states what is true, what is chosen, and what is
+> knowingly accepted. **Where a property does not hold, it says so.**
+
+---
+
+## 0. How to read this document
+
+v4 described intent. Several of its statements were contradicted by the implementation:
+
+| v4 said | Reality found in the code |
+|---|---|
+| "ALL operations require passing the GEK proof first" (§4.2.x) | True on WebRTC only. QUIC, TCP and the node HTTP API each had their own weaker handshake |
+| "The node NEVER serves the GEK in plaintext" | True, but the node's HTTP API served the *decrypted files themselves* with no authentication at all |
+| "Argon2id parameters updated: memory_cost 262144" | Applied to the hub's password verifier only; the node keystore was still at 64 MB |
+| "GEK bundles: opaque blobs; hub cannot decrypt them" | True, and irrelevant — the hub was the key directory, so it could substitute a key at invite time and be handed the GEK legitimately *(fixed 2026-08-14; the invite path no longer reads the directory — §5.5)* |
+| "hub stores no content metadata" | The node registered blake3 hashes of **private** files with the hub |
+
+So v5 carries an explicit rule: **a claim in this document must name the adversary it
+holds against.** A property that holds against a passive hub and not an active one is
+written that way.
+
+---
+
+## 1. Changes from v4
+
+| # | Category | Change | Source |
+|---|---|---|---|
+| 1 | Transport | TCP+TLS transport and the node HTTP file API **removed**. Two listeners remain: WebRTC DataChannel (primary) and QUIC (LAN / port-forwarded / hub-less) | 11.5.1–2, findings C1/C6 |
+| 2 | NAT traversal | **ICE/STUN is the traversal mechanism**, for native clients too. `punch_nat()` is a direct-connection helper, not a traversal stack | Decision D3 |
+| 3 | Handshake | One implementation in `meshbay_common.handshake`, shared by every transport | 11.5.4, finding C6 |
+| 4 | Handshake | **Mutual authentication**: the node proves GEK possession and signs the transcript. Authentication used to run one way only | 11.5.7, finding C3 |
+| 5 | Handshake | Transcripts are length-prefixed and domain-separated; `group_id` is mandatory; missing channel binding is refused | L4, M1 |
+| 6 | Admin ops | Destructive operations sign a structured transcript naming operation, node, group, subject, nonce and time — not 32 opaque random bytes | Finding H5 |
+| 7 | Node authority | **Nothing arriving over MNP can activate a GEK.** Member-supplied bundles are not gated but *gone*: `gek_bundle_store` was deleted when the node took over wrapping | Finding C5b |
+| 7b | Admission | **The node wraps the group key itself**, for a key the recipient proved possession of, and admits people from its own roster using one-time codes the hub never sees (§5.5) | Findings **H3**, **M3** |
+| 8 | Uploads | Confined to a per-user quarantine directory; no overwrite | Finding C5a |
+| 9 | Node identity | Hub verifies node ownership on WebSocket registration; group claims are derived from the database | Finding C2 |
+| 10 | Revocation | Group revocations are honoured by nodes; denylist persists across restarts | Finding H4 |
+| 11 | Privacy | Only **public** groups register content hashes with the hub | Finding H7 |
+| 12 | Client architecture | The hub **keeps serving the web UI**. A native desktop client is offered **alongside** it | Decision D1/D2 |
+| 13 | Hub role | "Hub minimization" is **deferred and may be dropped**. The hub stays in the trusted path by choice | Decision D4 |
+
+---
+
+## 2. Security claims — what holds, against whom
+
+This replaces the informal assurances scattered through v4 §4.2.x and §13.
+
+| Claim | Passive hub | **Active hub** | Malicious node operator | Malicious group member | Network attacker |
+|---|---|---|---|---|---|
+| File content is unreadable | ✅ | ❌ **T3** (browser) · ✅ native | ❌ by design — the operator hosts the files | ❌ members share the GEK | ✅ |
+| Chat content is unreadable | ✅ | ❌ T3 · ✅ native | ❌ plaintext at rest until Phase 15 | ❌ | ✅ |
+| File index is unreadable | ✅ | ❌ T3 · ✅ native | ❌ | ❌ | ✅ |
+| Content cannot be modified | ✅ | ✅ | ❌ by design | ✅ | ✅ |
+| Node cannot be impersonated | ✅ | ✅ | — | ✅ | ✅ |
+| Client code integrity | ❌ **T3, accepted** | ❌ T3 | ✅ | ✅ | ✅ |
+| Node content authority | ✅ | ✅ | ✅ sovereign | ✅ | ✅ |
+| Hub cannot obtain the group key | ✅ | ✅ **since H3 closed** — except in `join_policy = "open"` groups, where it can join legitimately | — | — | ✅ |
+| Your identity keys stay yours | ✅ | ✅ | ⚠️ **offline attack on the bundle they hold** — see §7.1. Succeeds against a weak passphrase, and yields the identity used **on that node only**: nothing on anyone else's | ✅ | ✅ |
+
+**The claim this project can make:** *the hub cannot read your content unless it ships you
+malicious client code.* Since H3 closed (2026-08-14) that is the **only** remaining path,
+it is not silent, and it does not exist for a native client.
+
+**What changed.** The hub used to be the key directory on the invite path: the inviter
+fetched the invitee's `pk_x25519` from the hub and wrapped the GEK for whatever came back,
+so a hub answering with its own key was handed the group key by an honest member following
+the protocol exactly. That path is gone. The node holds the GEK and wraps it itself, for a
+key the recipient proved possession of over an authenticated channel, bound to an identity
+the operator admitted with a one-time code the hub never sees (§5.5).
+
+**The claim it must not make:** *"everything is encrypted and unreadable by other parties,
+even the hub."* Three reasons, all deliberate:
+
+- **T3 — the hub serves the SPA.** Accepted permanently for browser users (decision D1). A
+  hub that ships the code can lift keys from the page regardless of protocol design — and
+  can read a pairing code out of it. This is an artifact-level attack, not a silent
+  directory lie: the native client (Phase 13) plus reproducible builds (18.7) remove it.
+- **Open-join groups.** Where `join_policy = "open"`, anyone the hub calls a member is
+  served the key, so the hub can join through the front door. That is a property of open
+  joining, not a defect, and the setting is read from `node.toml` — the hub cannot declare
+  a group open.
+- **Members and the operator read everything.** Inherent: "end-to-end" here describes
+  *client ↔ node*, never *client ↔ client*.
+
+One boundary deserves naming: an operator hosts your content by design, but they should not
+be able to become *you*. They can still try — a bundle sits on their disk and a weak
+passphrase gives it up — but since 2026-08-14 what it gives up is **the identity you use
+with them**, which unlocks nothing they did not already have. Reading what they host is by
+design; reading what *other* operators host is not, and no longer follows.
+
+---
+
+## 3. Transport (replaces v4 §6.4, §6.5, §7.1)
+
+### 3.1 Listeners
+
+| Listener | Role | Status |
+|---|---|---|
+| **WebRTC DataChannel** (aiortc) | Primary, browser **and** native clients | Unified handshake enforced |
+| **QUIC** (aioquic) | LAN, port-forwarded, hub-less `group://` | Unified handshake enforced |
+| ~~TCP + TLS 1.3~~ | — | **Removed** (C6) |
+| ~~HTTP file API~~ | — | **Removed** (C1) |
+
+The HTTP API bound `0.0.0.0` for every group, private ones included, and served the
+Mesh Group Index and raw plaintext files with no authentication. It was deleted rather
+than repaired: it duplicated MNP without any of its controls.
+
+### 3.2 NAT traversal — correction
+
+v4 presented `punch_nat()` as the native-client traversal mechanism. It is not one. It
+is a single UDP probe to one address (`quic_server.py`), with:
+
+- no STUN client (the `aioice` dependency is pulled in by `aiortc` only)
+- no candidate gathering, no candidate pairs, no dual-stack fallback
+- a requirement that the client already know its own external IP:port and connect from a
+  fixed source port
+
+It was validated on one ISP and one NAT type. **ICE/STUN is the traversal path** —
+validated across two ISPs, two browsers, IPv4 STUN + IPv6 direct, and 4G CGNAT.
+
+Native clients therefore run `aiortc` in Python rather than reimplementing traversal.
+Every native benefit (local keystore, ChaCha20, Argon2id, Ed25519 auth) comes from being
+native, not from the transport. QUIC is retained for LAN, port-forwarded and hub-less
+access, where a signaling channel is unavailable or unwanted.
+
+---
+
+## 4. MNP handshake (replaces v4 §4.2.x handshake description)
+
+One implementation: `meshbay_common/handshake.py`.
+
+```
+client → node   handshake            {token, group_id, nonce_c}
+node            authorize_token()    JWT · scope · denylist · group_id · membership · hosting
+node → client   handshake_challenge  {nonce_s, node_pk}
+                                     ── pre-proof window: keypair/GEK bundle fetch, join ──
+client → node   handshake_response   {proof}
+node            verify               HMAC(GEK, client transcript)
+node → client   handshake_ack        {proof, sig, node_pk, is_node_admin}
+client          verify               HMAC(GEK, node transcript) + Ed25519(node_pk)
+                                     and that ack.node_pk is the key announced above
+```
+
+`node_pk` is announced in the challenge because joining needs it before the ack: a
+first-time member signs a transcript naming this node (§5.5) and has no GEK to complete a
+handshake with. It is unverified at that point and is never a substitute for the ack — the
+ack proves possession and signs the transcript, and the client refuses a peer whose key
+changed between the two. A wrong value there only makes the node's own verification fail.
+
+**Refusals carry a code**, not only a sentence. `not_a_member` in particular is usually a
+token issued before the person was added to the group — `groups` is baked in at sign-in and
+the hub pushes no updates — so the client refreshes once and retries rather than telling
+someone who was invited a minute ago that they are not a member.
+
+### 4.1 Transcript
+
+```
+"meshbay:mnp:handshake:v1" ‖ len‖role ‖ len‖group_id ‖ len‖nonce_c ‖ len‖nonce_s ‖ len‖binding
+```
+
+Every field length-prefixed; the role bound in so a client proof cannot be replayed as a
+node proof. v4's transcript was `nonce ‖ offer_fp ‖ answer_fp` — bare concatenation, and
+a missing fingerprint silently degraded it to nonce-only, dropping MitM detection.
+**An absent channel binding is now refused.**
+
+### 4.2 Channel binding
+
+| Transport | Anchor |
+|---|---|
+| WebRTC | both DTLS certificate fingerprints |
+| QUIC | SHA-256 of the server certificate. aioquic exposes no RFC 5705 exporter; the client's access to the peer certificate is a guarded private attribute, and on a **resumed** session — which carries no certificate — the anchor travels with the session ticket |
+
+### 4.3 Authorization rules
+
+- `group_id` is **mandatory**. Omitting it previously skipped the membership check and
+  fell back to the node's first group.
+- Node-scoped daemon tokens are **refused** on the client path.
+- The denylist is consulted for user, `jti` **and** group.
+
+### 4.4 Mutual authentication
+
+The node proves GEK possession over a client-chosen nonce **and** signs the transcript
+with its long-term key. Previously the client received an unverifiable `node_pk` and
+trusted `is_node_admin` from whoever answered — so a peer that had hijacked signaling
+could serve a forged index, forged chat history and forged permissions.
+
+The client also **pins** `pk_node` per node on first use (11.5.8) and refuses a changed
+key outright, with a deliberate reset path in Settings for a legitimate rotation.
+
+---
+
+## 5. Node authority (replaces v4 §4.2.x)
+
+### 5.1 Privileged operations
+
+Destructive and privileged operations require an Ed25519 signature over a structured
+transcript, never a JWT — the hub controls JWT issuance and can therefore never
+establish node-level authority.
+
+```
+"meshbay:admin:v1" ‖ len‖op ‖ len‖node_pk ‖ len‖group_id ‖ len‖subject ‖ len‖nonce ‖ len‖ts
+```
+
+TTL 120 s. The client reconstructs the transcript from announced fields and **refuses to
+sign** if the operation or subject does not match what the user requested. v4's challenge
+was 32 opaque random bytes signed blind — an unbound signing oracle.
+
+| Operation | Authority |
+|---|---|
+| `file_delete` | Node operator, or the user who uploaded the file (verified by the key recorded at upload) |
+| `invite_create` | **Node operator only** (delegation designed, deferred) |
+| GEK activation | **Local admin UI or CLI only** — no MNP message can activate a GEK |
+| ~~`gek_bundle_store`~~ | **Message deleted.** No member ever hands the node key material |
+
+`gek_bundle_store` previously accepted any member's bundle and auto-activated one
+addressed to the operator. Since the operator's X25519 public key is published in
+`handshake_ack`, any member could wrap a key of their choosing for it and take over the
+group. It was first gated behind an operator signature, then removed outright when the
+node took over wrapping (§5.5) — the message has no remaining purpose, and a path that
+does not exist cannot be mis-authorized.
+
+**Who can invite.** Still the node operator only: `invite_create` is verified against the
+operator keys in the node's roster. A group admin who does not run the node cannot admit
+anyone until delegation ships (§6.2 of `invite-pairing-v1.md`, deferred by decision
+2026-08-13). What *did* change is the timing: the operator issues a code and is then out
+of the loop, so nobody has to be online when the invitee actually joins.
+
+### 5.2 Uploads
+
+Confined to `shared_root/.uploads/{user_id}/`, filename allowlist, no overwrite, chunk
+ordering enforced, size capped. Previously uploads landed in the shared root under a
+client-chosen name and overwrote anything there — which also defeated deletion
+authorization, since overwriting a file made the attacker its recorded uploader.
+
+### 5.3 Operator interface
+
+Two personas, and they need different tools:
+
+| Operator | Reaches the node via |
+|---|---|
+| Desktop | the local admin UI in their own browser |
+| **Headless / SSH** | the CLI — `status`, `ui`, `gek-init`, `operator pair`, `member list\|invite\|revoke\|unpin` |
+
+The CLI is the primary interface for servers, which is the normal deployment.
+`status` deliberately reads the keystore and config directly so it works while
+the daemon is stopped — the state an operator is most often in, since the daemon
+will not stay up before its key is linked or before a group exists. Anything the
+UI can do should eventually have a CLI equivalent (Phase 14). Inviting, revoking and
+pairing now have one; deleting a file is the remaining browser-only operation.
+
+### 5.4 Local admin UI
+
+Loopback plus a **per-run session token** (`?t=` or `X-MeshBay-Token`), printed at
+startup. "Localhost only" is not authentication: any local process can reach it, as can
+a page in the operator's browser via DNS rebinding — and this API re-initialises group
+keys, issues invitations and reads the audit log. All interpolated values are
+HTML-escaped — filenames chosen by members, and usernames that originate at the hub;
+CSP contains exfiltration but cannot prevent injected inline script, so escaping is the
+actual fix.
+
+### 5.5 Admission and key delivery (closes H3)
+
+The node decides who receives the group key, and produces every copy of it itself.
+
+```
+grenet (SSH)   meshbay-node member invite bob      → CODE  R3H8-TB6V
+               (or the same from the SPA's Members tab, signed by the paired browser)
+grenet         sends the code to bob out of band
+bob            opens the group; the client holds no GEK
+bob → node     join_request {pk_ed25519, pk_x25519, code, sig}   ← pre-proof window
+node           code valid for this account → pin the identity, admit to the group
+node → bob     the GEK, wrapped for the X25519 key bob just proved he holds
+```
+
+Four properties, each load-bearing:
+
+1. **No public key is ever fetched from the directory.** The invitee's key arrives from
+   the invitee, signed by their identity key in the same transcript (`meshbay:join:v1`),
+   so the identity key vouches for the encryption key. This is the H3 fix.
+2. **The code binds the key to the account**, and the hub never sees it. 40 bits,
+   single-use, one account, node-wide lockout on repeated failures. Codes live 7 days
+   for invitations and 24 h for operator pairing, both configurable.
+3. **The node's roster is the authority**, not hub membership. A hub that invents an
+   account, adds it to a group and mints it a token gets `not_authorized_for_group`.
+   Exception by configuration: `join_policy = "open"` pins the first comer (TOFU) and
+   serves them — read from `node.toml`, never from the hub.
+4. **Wrapping happens on every connection**, so key rotation propagates by itself and
+   revocation actually takes effect. No member bundle is stored; nothing outlives the
+   decision to stop serving someone. (Rotating the GEK after a revocation is still
+   required — the ex-member holds the old one.)
+
+`gek-init` no longer pre-wraps the key for anyone but the node's own keystore. It used to
+fetch every member's public key from the hub and wrap for what came back, which was H3
+with the node as the victim rather than the inviter.
+
+Node authority is established the same way, once per node: `meshbay-node operator pair`
+prints a code, the operator types it into their browser, and the node pins that identity
+key. It is never learned from the hub — a hub able to name the operator's key could
+install itself as node administrator (finding M3, which the old keystore auto-pin left
+inert and failing closed).
+
+---
+
+## 6. Hub (replaces v4 §4.1)
+
+### 6.1 Role — chosen, not minimal
+
+Hub minimization was considered and **deferred** (decision D4). The hub keeps serving
+the web UI and remains in the trusted path by choice. This section describes what it
+*does*, not an aspiration.
+
+**Stores:** accounts (username, encrypted email, status, role), group registry and
+membership, IP logs (1 year, legal), node registrations, refresh tokens, notifications,
+moderation blocklist.
+
+**No longer stores user identity keys** (2026-08-14). `users.pk_ed25519` and
+`users.pk_x25519` are dropped, `PUT /me/keys` is gone, and `/pubkeys` returns an account id
+and a node's linking key — nothing to wrap for. Tokens carry no `pk_user` claim either: the
+node used to record it as the uploader's identity, which let whoever issued tokens decide
+who could delete a file.
+
+**Does not store:** file content, file names, private-group indexes, message content,
+private keys, GEK bundles, keypair bundles, node IPs beyond ephemeral signaling.
+
+**Knows, unavoidably:** who is a member of what, when nodes connect, when a chat message
+was posted and by whom (`chat_notify` — minimization was in the dropped phase), and
+content hashes for **public** groups only.
+
+**No longer decides:** who holds the group key. The hub still publishes public keys, and
+they are still used to look up an account by name — but nothing wraps a key for a key
+that came from there. Hub membership lets someone *reach* a node; the node's roster
+decides whether it wraps anything for them (§5.5). A pairing code never touches the hub.
+
+### 6.2 Node registration
+
+Registration on `/v1/nodes/ws` requires a node-scoped token, verifies `Node.user_id`
+against the token subject, and derives group claims from the database — a node may
+narrow the set to what it hosts but cannot widen it. It previously took `node_id` and
+`group_ids` verbatim from the client's first message, letting any user hijack a victim
+node's signaling and impersonate it to browsers.
+
+### 6.3 Signaling
+
+Rate-limited, SDP size bounded, capped per user, and the caller must share an **active**
+group with the target node. Previously reachable by any authenticated user for any node,
+making a third party's machine allocate peer connections on demand. `peer_ip` in the NAT
+punch request must match the caller's source address.
+
+### 6.4 Client addresses
+
+`X-Forwarded-For` is honoured only from a trusted proxy, rightmost hop. It was trusted
+unconditionally, so anyone could forge the IP written to the compliance log.
+
+---
+
+## 7. Cryptography (amends v4 §6)
+
+Unchanged: GEK wrapping (ECIES, X25519 + HKDF + AEAD), per-chunk key derivation, domain
+separation, on-the-fly encryption.
+
+| Parameter | Value |
+|---|---|
+| Node keystore KDF | Argon2id **256 MB**, iterations 3, lanes 4 — parameters recorded per envelope so they can be raised without orphaning existing keystores |
+| Hub password verifier | Argon2id 256 MB over a PBKDF2-derived `auth_key` |
+| Browser bundle key | **Argon2id 128 MB, t=3, p=1** (was PBKDF2-SHA512 600k until 2026-08-14) |
+| Browser `auth_key` | PBKDF2-SHA512, 600 000 iterations — the hub's Argon2id verifier is what protects it at rest |
+
+### 7.1 The keypair bundle, and what it is worth to an attacker (C4)
+
+A bundle carries **one node's** identity keys, encrypted under the owner's passphrase, and
+is stored on that node. It is what lets a second browser open the same account there — the
+ordinary expectation, and the only mechanism available to a browser that keeps nothing
+durable of its own.
+
+The adversary is concrete: an operator holding their own node's disk, attacking offline at
+their leisure.
+
+**What cracking one yields.** The identity that person uses **on that node** — where the
+operator already holds the content, the index and every byte they serve. It is not a key
+anywhere else: each node gets its own, generated the first time its owner joins it, and a
+key one node pinned is a stranger to the next (which asks for a code, like any first
+contact). Until 2026-08-14 a single identity was copied to every node joined, so one crack
+yielded content on *other* operators' nodes and the ability to sign as that user anywhere —
+that was the part worth attacking, and it is gone.
+
+Two smaller consequences fall out. Two operators can no longer tell they host the same
+person by comparing keys. And the hub publishes no user keys at all now (§6.1), so there is
+no directory left to substitute from.
+
+**Why Argon2id.** PBKDF2 is compute-only, which is exactly what a GPU is good at. Measured
+on the development machine: PBKDF2-SHA512 600k costs 241 ms per guess on one core,
+Argon2id 128 MB/t=3 costs 88 ms — the defender pays *less* — but only one of them forces
+an attacker to find 128 MB per guess.
+
+The honest size of the gain: on a single high-end card the ceiling moves from roughly 8k
+guesses/s to roughly 2k, a factor of four, not a thousand. What it really buys is the cost
+of scale — 128 MB per lane caps a 24 GB card near 187 concurrent guesses, and makes custom
+hardware unattractive, where SHA-512 silicon is cheap.
+
+**The passphrase decides this, not the KDF.** At ~2k guesses/s, a dictionary-and-rules run
+of 10⁹ candidates — which covers a large share of human-chosen passwords — takes about six
+days on one card. Four random words (~52 bits) outlasts the sun. No parameter choice saves
+a weak passphrase; it only moves it from hours to days. The client therefore refuses
+passphrases below 12 characters and ~60 estimated bits, and that floor can only live in the
+client: with the password split (T1) the hub never sees a passphrase and cannot enforce
+anything about one.
+
+**Operational notes.**
+
+- Argon2id runs in WebAssembly, vendored under `static/vendor/` with its provenance —
+  the CSP forbids external hosts, and 12.2 must keep `wasm-unsafe-eval` in `script-src`.
+- Two implementations exist (the browser's WASM, `argon2-cffi` in QE). A parity test holds
+  them byte-identical, because a disagreement would not look like an error — it would look
+  like an account nobody can open.
+- Bundles written under the old KDF carry no marker, are still readable, and are
+  re-encrypted the first time their owner's browser backs them up.
+- Cost is paid **once per sign-in**: 650 ms for the bundle key, plus 239 ms for `auth_key`.
+  Opening a group, downloading, streaming and reloading the page all reuse it — the key
+  lives in IndexedDB for the session.
+- The pre-proof window that serves bundles is still bounded (4 fetches) and audited.
+
+C4 is **reduced, not closed**: bundles still sit on disks their owner does not control, and
+a weak passphrase still gives up the key for that node. It closes when the native client
+stops storing them remotely (Phase 13.3) — the material belongs on the user's own device,
+not on the hub *or* on other people's nodes.
+
+---
+
+## 8. Clients (replaces v4 §4.3)
+
+### 8.1 Two clients, deliberately
+
+| | Hub-served web SPA | Native desktop client |
+|---|---|---|
+| Distribution | Served by the hub | Installed, signed release |
+| Code integrity | **T3 accepted** — the hub can inject | Detectable *if* reproducible builds ship |
+| Key storage | IndexedDB / sessionStorage | OS-protected local keystore |
+| Crypto | WebCrypto (AES-GCM) | Full (ChaCha20, Argon2id) |
+| Transport | WebRTC | WebRTC **+ QUIC** |
+| Positioning | **Convenience tier** — zero install | Recommended for sensitive use |
+
+**Several browsers, one identity per node.** A browser keeps nothing durable the user
+controls, so the identity it creates for a node is left with that node, encrypted under the
+passphrase. Any other browser recovers it there with the passphrase alone: same identity on
+that node, same pin, no second code. Joining a *different* node creates a different key and
+needs that operator's code, which is the first contact it has always needed.
+
+This is what makes the product behave the way people expect, and it is also finding C4
+(§7.1) — with a blast radius of one node. The native client removes the need for it
+entirely, which is a large part of why it exists.
+
+The SPA is not deprecated. It is the zero-install path and it stays. It must be labelled
+honestly: `/app/` states that the hub serves this code, and the docs never claim
+end-to-end *integrity* for that path.
+
+### 8.2 Native client
+
+pywebview + aiortc, sharing ~69% of the existing UI unchanged (the SPA contains no direct
+`crypto.subtle` or `RTCPeerConnection` usage; everything goes through three injected
+globals and one fetch helper). Assets ship **inside the package** and load from disk — a
+shell pointing its WebView at the hub's `/app/` would be a browser with a different icon
+and would fix nothing.
+
+Native does **not** remove trust in the hub operator; it converts an undetectable,
+per-request, per-user attack into a persistent artifact that can be hashed and compared.
+That value is realised by reproducible builds and published hashes, not by the packaging
+format.
+
+---
+
+## 9. Open items
+
+**Phase 11.5 is complete.** All six critical and all seven high findings from
+`second-review.md` are closed, bounded, or deferred by explicit decision.
+
+### Closed since this document was drafted
+
+| # | Item | Closed by |
+|---|---|---|
+| **C6** | GEK proof on the QUIC path | QUIC now runs the same challenge/response as WebRTC — client nonce, role-bound transcript, GEK proof, and the node proving itself with a GEK proof plus an Ed25519 signature |
+| 11.5.6 | QUIC channel-binding anchor | Certificate hash. Server reads its own certificate from disk; the client's access to the peer certificate is guarded and fails loudly if aioquic moves it. **A resumed TLS session carries no certificate**, so the anchor travels with the session ticket — sound, because the ticket is derived from the handshake where the certificate was presented |
+| 11.5.8 | `pk_node` TOFU pinning | Pinned per `node_id` on first handshake; a change is **refused**, with a deliberate reset in Settings |
+| **M8** | Node announce proof-of-possession | Announcer signs `meshbay:node_announce:{user_id}:{pk_node}:{timestamp}`; re-announcing updates in place |
+| **H3** | Hub key substitution | **Closed 2026-08-14** by the invite redesign (§5.5), not by safety numbers: no public key is fetched from the directory at all, so there is nothing to substitute. See `docs/invite-pairing-v1.md` |
+| **M3** | Node authority inert as shipped | Closed with it — authority comes from the roster, established locally by pairing |
+
+### Still open
+
+| # | Item | Status |
+|---|---|---|
+| C4 | Remote keypair bundles | Bounded (4 pre-proof fetches, audited); closes in Phase 13.3 when the native client stops storing them remotely |
+| — | Chat encryption (Sender Keys) | Phase 15. Distribution must be **pairwise to identity keys**, never GEK-derived |
+| — | Chat attachments | Plaintext on the node; decide in Phase 15.7 |
+| — | Delegation | Designed, deferred: a group admin who does not run the node still cannot invite |
+| **T3** | Hub serves the SPA | **Accepted permanently** (D1). Now the *only* way an active hub reads content — and it can also read a pairing code out of the page it served. Removed for native clients by Phase 13 + reproducible builds (18.7) |
+
+### Scope note on pinning
+
+With C6 closed, `pk_node` pinning is defence in depth rather than the primary control: a
+substituted node already fails the GEK proof. Pinning covers the case where an attacker
+*holds* the group key — an ex-member, or a leaked GEK — and swaps the node underneath,
+which the proof alone cannot distinguish from the genuine node.
+
+### Sender Keys — scope correction
+
+Sender Keys protects chat from someone holding the node's disk who is **not** a group
+member — a seized machine, a hosting provider, a compromised node. It does **not**
+protect chat from the node operator, who is a group member and therefore a legitimate
+recipient. Distributing sender keys under the GEK would make the encryption decorative,
+since anyone with the GEK would recover every sender key.
+
+---
+
+## 10. Testing posture
+
+The pre-remediation suite passed 209 tests while every finding in the review was live. It
+tested that features work, and in doing so **pinned four vulnerabilities in place** as
+expected behaviour: GEK auto-activation, the transport-wide chat store, the blind admin
+challenge, and private-group hashes registered with the hub. A refactor that accidentally
+fixed one would have been reported as a regression.
+
+Security tests are therefore written as **negative assertions** — "this attack does not
+work" — and verified to fail against the pre-fix source before being trusted.
+`test_security_regressions.py`, `test_node_ws_auth.py` and `test_handshake.py` hold them.
diff --git a/docs/per-node-identity-v1.md b/docs/per-node-identity-v1.md
new file mode 100644
index 0000000..673fec1
--- /dev/null
+++ b/docs/per-node-identity-v1.md
@@ -0,0 +1,215 @@
+# MeshBay — Per-node identity
+
+> Status: **implemented 2026-08-14**, deployed and exercised end to end against a wiped
+> hub and a wiped node. Written first as a proposal; §9 records what shipped.
+> Reduces **C4** from "one crack yields the network" to "one crack yields one node".
+> Removes the hub-published user keys, which stopped being load-bearing when H3 closed.
+> Follows the v5 convention: every claim names the adversary it holds against.
+
+---
+
+## 1. What this changes, in one paragraph
+
+Today one identity keypair is copied to every node its owner joins. Cracking the copy
+stored on *any* node yields the identity used on *all* of them. This proposal gives each
+node its own keypair, generated the first time its owner joins it. An operator who cracks
+what sits on their own disk then holds a key that is worthless anywhere else — and on
+their own node they already hold everything it could unlock.
+
+No new screen, no extra code to type, no change to how anyone signs in.
+
+---
+
+## 2. Where we are
+
+Two things are **already per node**, which is what makes this cheap:
+
+| | Today |
+|---|---|
+| Roster pin | per node — each node pins the key it was shown (`roster.identities`) |
+| Bundle storage | per node — each node has its own `bundles.db` |
+| **Key material** | **global — the same keypair is copied into every node's database** |
+
+So the plumbing is in place and only the contents are shared. The change is: generate a
+fresh keypair per node instead of reusing one.
+
+The global key exists because registration creates it (`keyderive.js registerUser`) and
+publishes it to the hub, from where everything else used to fetch it. Since H3 closed,
+almost nothing does.
+
+---
+
+## 3. The design
+
+### 3.1 One keypair per node
+
+The first time a browser joins node N, it generates a keypair for N, encrypts it under the
+passphrase-derived key, and stores it on N — which is the message it already sends
+(`keypair_bundle_store`). N pins the public half through the ordinary join, using the
+pairing code its operator already issues for a first contact.
+
+Nothing else in the join changes: same transcript, same code, same pin, same refusals.
+
+### 3.2 Flows
+
+**First join to a node** — unchanged from the user's side:
+
+```
+browser        no key for node N yet → generate one
+browser → N    join_request {pk_ed25519_N, pk_x25519_N, code, sig}
+N              code valid → pins the pair, wraps the GEK for pk_x25519_N
+browser → N    keypair_bundle_store  (that node's key, encrypted under the passphrase)
+```
+
+**Second browser, same node** — unchanged:
+
+```
+browser → N    keypair_bundle_fetch  → decrypt with the passphrase → same key as browser 1
+browser → N    join_request (no code) → recognised
+```
+
+**Joining a second node** — already requires a code from that node's operator, so the new
+key is generated in the same step. The user does nothing extra.
+
+**Operator pairing** — identical; the operator's key is per node like everyone else's.
+
+### 3.3 Where the browser keeps them
+
+A map `node_id → bundle` in IndexedDB, instead of one identity. A browser that has never
+seen node N simply fetches N's bundle from N; it only ever needs the key of the node it is
+talking to.
+
+---
+
+## 4. What this fixes, and what it does not
+
+**Fixes: the blast radius.** An operator who cracks the bundle on their own disk gets the
+key used with their own node. There they already control the content, the index and every
+byte they serve — the key adds almost nothing. What disappears is the part that mattered:
+reading that person's content on **other** operators' nodes, and signing as them anywhere
+else. That is the whole of what made C4 more than a redundancy.
+
+**Fixes, incidentally: linkability.** Two operators can no longer tell they host the same
+person by comparing keys. Today they can.
+
+**Does not fix:** a weak passphrase still gives up that node's key, and the bundles still
+sit on disks their owner does not control. Only Phase 13.3 (native client, keys on the
+device) removes that. C4 stays open, with a smaller consequence.
+
+**Does not change** the operator's ability to read what they host. That is by design and
+stated in draft-v5 §2.
+
+---
+
+## 5. Removing the hub-published user keys
+
+They were the directory H3 exploited. Since the node wraps the GEK itself, nothing wraps
+anything for a key fetched from the hub. What remains is inventory.
+
+### 5.1 What still uses them
+
+| Use | Verdict |
+|---|---|
+| `_sessionKeys.pkXB64` set from `/pubkeys` (`app.js:974, 2768`) | **replaceable** — the browser can derive its own public half from its own secret (`_pkXFromSk`, already written) |
+| Invite: username → `user_id` (`app.js:1602`, `ui/app.py`) | **keep the endpoint** — an account id is not a key, and it is how a name is resolved |
+| Settings: `pk_node_ed25519` (`app.js:2210`) | **keep** — that is the node linking key, a different field |
+| JWT claim `pk_user` (`auth.py:151`, filled from `user.pk_ed25519`) | **remove** — see 5.2, it is a live defect |
+
+### 5.2 A defect this uncovered
+
+`pk_user` travels in the JWT and the node records it as `uploader_pk` at upload
+(`webrtc_server.py:1178`), then uses it to authorize deletion by the uploader
+(`:1329-1340`). That key is chosen by the **hub**. A hub that issued a token naming its own
+key could then delete that user's files on any node — deny-by-default was supposed to make
+deletion node-authorized, and this is a hole in it.
+
+With per-node identity there is a better answer available for free: authorize deletion
+against the key the **roster pinned**, which the node established locally and the hub never
+touched. This should be fixed whether or not the rest of the proposal proceeds.
+
+### 5.3 What goes
+
+- `User.pk_ed25519`, `User.pk_x25519` columns (Alembic migration)
+- `pk_user_ed25519` / `pk_user_x25519` in the registration body
+- `PUT /v1/users/me/keys`, and `regenerateKeys()` in `keyderive.js` — rotation becomes
+  per node: `member unpin` plus a fresh code, which already exists
+- the `pk_user` JWT claim, and `AuthorizedPeer.pk_user`
+- the two key fields in the `/pubkeys` response; the endpoint stays for `user_id` and
+  `pk_node_ed25519`
+
+Old tokens keep working while they live (1 h): the node already reads the claim with
+`.get()`, so its absence is not an error.
+
+---
+
+## 6. Work plan
+
+| # | Slice | Where | Effort |
+|---|---|---|---|
+| 1 | `uploader_pk` from the roster pin, not the JWT | `webrtc_server.py` | small — and it is a fix on its own |
+| 2 | Per-node keypair: generate at first join, store per node, keep a `node_id → bundle` map | `app.js`, `transport.js`, `keyderive.js` | **the bulk of it**, all client-side |
+| 3 | Derive our own `pkX` locally instead of reading it back from the hub | `app.js` | small |
+| 4 | Remove the published keys: columns, endpoint fields, registration body, JWT claim, `regenerateKeys` | `db/models.py`, `api/users.py`, `auth.py`, migration, `keyderive.js`, `handshake.py` | medium, touches the schema |
+| 5 | Harness + docs: `e2e.py` per-node keys, draft-v5 §2/§7.1/§8.1, `second-review.md` | QE, docs | small |
+
+Slices 1 and 3 stand alone and could land first. Slice 4 is the only one with a migration.
+
+---
+
+## 7. Risks and open questions
+
+**Existing users.** No big-bang migration: a bundle already on a node simply becomes that
+node's key, and only *new* joins generate fresh ones. Someone already on three nodes keeps
+one shared key across those three until they re-pair — the improvement applies going
+forward. Forcing it would mean unpinning everyone, which is not worth it.
+
+**A browser that loses its map.** It refetches from the node it is connecting to; nothing
+is lost, since a node's key is only needed with that node.
+
+**Is per node the right granularity, rather than per group?** Per node matches the roster,
+which pins per account and not per group, and matches the trust boundary — the operator is
+the adversary, and one operator may host several of your groups. Per group would multiply
+keys with no adversary to justify them.
+
+**Does anything need one identity across nodes?** Nothing found. Chat identity and upload
+attribution are per node; account identity on the hub is the username plus `auth_key`, which
+is untouched. If a future feature needs a global identity — cross-node contacts, say — it
+would need its own key, published deliberately, not this one reused by accident.
+
+---
+
+## 8. How it gets tested
+
+- `e2e.py`: a member joins two groups on the node with one key (unchanged), and the
+  second-browser recovery still works. Add a check that the key stored on the node is the
+  one pinned there, not a global one
+- a negative test: a key pinned by node A, presented to node B, is refused without a code —
+  which is the property the whole proposal buys
+- `test_spa_ordering.py`: generation of the per-node key must happen before `joinGroup()`,
+  same class of ordering guard as the others
+- the hub tests must fail if `/pubkeys` starts returning user keys again
+
+
+---
+
+## 9. What shipped
+
+All five slices, against a deployment wiped for the next demo — so no compatibility path
+was kept and none is owed.
+
+| Slice | Outcome |
+|---|---|
+| 1 | `uploader_pk` comes from the roster pin (`_pinned_pk`), never from the token |
+| 2 | Identity is created at first contact with a node and left there; `transport.js` fetches it or generates it, `app.js` no longer holds a global one |
+| 3 | The browser derives its own public half; nothing is read back from the hub |
+| 4 | `users.pk_ed25519` / `pk_x25519` dropped (migration `a7c31f9e40b2`), `PUT /me/keys` and `regenerateKeys()` gone, `pk_user` claim gone, `/pubkeys` reduced to an account id and the node linking key |
+| 5 | Harness mirrors the client (recover, else generate, then leave the key with the node); tests for the property; docs |
+
+**A simplification worth noting.** Registration no longer generates anything, so a scripted
+signup is now a real account — `demo.py bootstrap` brings a wiped deployment to a working
+demo without a browser, which was impossible before. The old rule "only the admin can be
+registered by script" is gone with the keys it existed for.
+
+**Tests added:** a key pinned by one node, presented to another, is refused as a first
+contact; and someone else's code does not admit it either. That pair is the property this
+whole change buys.
diff --git a/packages/meshbay-common/src/meshbay_common/adminop.py b/packages/meshbay-common/src/meshbay_common/adminop.py
new file mode 100644
index 0000000..2d90102
--- /dev/null
+++ b/packages/meshbay-common/src/meshbay_common/adminop.py
@@ -0,0 +1,75 @@
+"""
+Admin operation challenge transcripts (MNP).
+
+Destructive and privileged node operations are authorized by an Ed25519 signature
+from the node operator, not by a JWT — the hub controls JWT issuance, so a JWT can
+never establish node-level authority (see draft-v4 §4.2.x).
+
+Finding H5: the node used to challenge the client with 32 raw random bytes and the
+client signed them blind. That is an unbound signing oracle — the signed message
+named no operation, no subject, no node and no time, so a signature obtained for one
+purpose was structurally valid for any other, and a malicious node could ask a user
+to sign bytes meaningful in a different protocol.
+
+The transcript below fixes that:
+
+  - a fixed domain-separation prefix, so these signatures can never collide with
+    node_auth, revocation tokens, chunk signatures or anything added later;
+  - the operation and its subject, so the client can display and verify what it is
+    authorizing before signing;
+  - the node's public key, so a signature for node A is not valid on node B;
+  - the group, so authority does not leak across groups on a multi-group node;
+  - a node-chosen nonce, so signatures cannot be replayed;
+  - a timestamp, so stale challenges can be rejected.
+
+Every field is length-prefixed. Plain concatenation would let a crafted subject
+impersonate a following field (finding L4 applies the same rule to the GEK proof).
+
+Both sides MUST build the transcript with this function — the client from the
+fields it received, the node from the state it stored. They are compared by
+producing the same bytes, never by trusting a value off the wire.
+"""
+
+ADMIN_TRANSCRIPT_PREFIX = b"meshbay:admin:v1"
+
+# Operations that require node-operator authority.
+OP_FILE_DELETE = "file_delete"
+OP_INVITE_CREATE = "invite_create"
+# OP_GEK_BUNDLE_STORE is gone. Members no longer hand the node key material at
+# all: the node holds the GEK and wraps it itself, for a key the recipient proved
+# they hold (see `join.py` and docs/invite-pairing-v1.md). The operation existed
+# only to make member-supplied bundles safe, and deleting the message is a
+# stronger guarantee than authorizing it.
+
+# A challenge older than this is refused, so a signature captured from a stale
+# exchange cannot be replayed later.
+ADMIN_CHALLENGE_TTL = 120  # seconds
+
+
+def admin_transcript(
+    op: str,
+    node_pk_b64: str,
+    group_id: str,
+    subject: str,
+    nonce: bytes,
+    ts: int,
+) -> bytes:
+    """
+    Build the exact byte string signed for an admin operation.
+
+    `subject` identifies what is being acted on: a file_id for OP_FILE_DELETE, the
+    invitee's user_id for OP_INVITE_CREATE.
+    """
+    fields = [
+        op.encode(),
+        node_pk_b64.encode(),
+        group_id.encode(),
+        subject.encode(),
+        nonce,
+        str(ts).encode(),
+    ]
+    out = bytearray(ADMIN_TRANSCRIPT_PREFIX)
+    for field in fields:
+        out += len(field).to_bytes(4, "big")
+        out += field
+    return bytes(out)
diff --git a/packages/meshbay-common/src/meshbay_common/crypto.py b/packages/meshbay-common/src/meshbay_common/crypto.py
index 682e1c0..b2ff3c0 100644
--- a/packages/meshbay-common/src/meshbay_common/crypto.py
+++ b/packages/meshbay-common/src/meshbay_common/crypto.py
@@ -168,21 +168,45 @@ def unwrap_gek_aes(bundle: dict, sk_recipient: bytes, pk_recipient: bytes) -> by
 
 # ── Keystore (local key storage) ──────────────────────────────────────────────
 
-# Argon2id parameters — calibrate to ~500ms on target hardware before production.
-# POC measured 78ms with these; increase memory_cost to 262144 (256MB) for prod.
+# Argon2id parameters for the node keystore.
+#
+# Finding M2: these sat at 64 MB long after the hub's password verifier was raised
+# to 256 MB, and the docs recorded the bump as done — true for the hub, false here.
+# The keystore protects the node's Ed25519 and X25519 private keys, so it is the
+# more valuable target of the two.
+#
+# Parameters are recorded in each keystore envelope, so raising them does not
+# invalidate existing files: LEGACY_* is used when an envelope predates the field.
 ARGON2_ITERATIONS   = 3
-ARGON2_MEMORY_COST  = 65536   # 64 MB — increase to 262144 for production
+ARGON2_MEMORY_COST  = 262144   # 256 MB
 ARGON2_LANES        = 4
 ARGON2_KEY_LENGTH   = 32
 
-def derive_keystore_key(password: str, salt: bytes) -> bytes:
-    """Derive AES-256 key from password using Argon2id."""
+LEGACY_ARGON2_ITERATIONS  = 3
+LEGACY_ARGON2_MEMORY_COST = 65536    # 64 MB — keystores written before M2
+LEGACY_ARGON2_LANES       = 4
+
+
+def derive_keystore_key(
+    password: str,
+    salt: bytes,
+    *,
+    iterations: int | None = None,
+    memory_cost: int | None = None,
+    lanes: int | None = None,
+) -> bytes:
+    """
+    Derive an AES-256 key from a password using Argon2id.
+
+    Parameters default to the current production values; callers pass the values
+    recorded in an existing envelope when opening an older keystore.
+    """
     return Argon2id(
         salt=salt,
         length=ARGON2_KEY_LENGTH,
-        iterations=ARGON2_ITERATIONS,
-        lanes=ARGON2_LANES,
-        memory_cost=ARGON2_MEMORY_COST,
+        iterations=ARGON2_ITERATIONS if iterations is None else iterations,
+        lanes=ARGON2_LANES if lanes is None else lanes,
+        memory_cost=ARGON2_MEMORY_COST if memory_cost is None else memory_cost,
     ).derive(password.encode())
 
 def encrypt_keystore(plaintext: bytes, key: bytes) -> tuple[bytes, bytes, bytes]:
diff --git a/packages/meshbay-common/src/meshbay_common/handshake.py b/packages/meshbay-common/src/meshbay_common/handshake.py
new file mode 100644
index 0000000..fca218f
--- /dev/null
+++ b/packages/meshbay-common/src/meshbay_common/handshake.py
@@ -0,0 +1,220 @@
+"""
+Unified MNP handshake — one implementation, every transport.
+
+Finding C6: the handshake existed three times over (WebRTC, QUIC, TCP), and only
+the newest copy enforced the GEK proof. QUIC and TCP accepted a bare JWT, so a
+forged or stolen token reached the node and could inject chat messages without
+ever holding the group key. TCP is gone (11.5.2); QUIC and WebRTC now share this
+module, and a parity test fails if either skips a step.
+
+The sequence:
+
+    client → node   handshake            {token, group_id, nonce_c}
+    node            authorize_token()    JWT, scope, denylist, membership, hosting
+    node → client   handshake_challenge  {nonce_s}
+    client → node   handshake_response   {proof}
+    node            verify client proof  HMAC(GEK, client transcript)
+    node → client   handshake_ack        {proof, sig, node_pk, is_node_admin}
+    client          verify node proof    HMAC(GEK, node transcript) + Ed25519
+
+Two properties this adds over the previous design:
+
+**Mutual authentication (C3).** Authentication used to run one way: the client
+proved itself, the node proved nothing. `handshake_ack.node_pk` was never verified
+against anything, and per-chunk signatures had been dropped in Phase 9.15, so a
+peer that had hijacked signaling (C2) or been substituted by the hub could accept
+the client's proof, ignore it, and serve a forged index, forged chat history and a
+forged `is_node_admin` flag. The node now proves GEK possession over a
+client-chosen nonce *and* signs the transcript with its long-term key, so the
+client can pin it.
+
+**Unambiguous transcripts (L4).** The old proof was `nonce ‖ offer_fp ‖ answer_fp`
+— bare concatenation, and a missing fingerprint silently degraded it to nonce-only.
+Every field is now length-prefixed and domain-separated, the role is bound so a
+client proof can never be replayed as a node proof, and an empty channel binding is
+refused rather than tolerated.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import hmac
+from dataclasses import dataclass
+from typing import Any, Protocol
+
+import jwt
+
+HANDSHAKE_PREFIX = b"meshbay:mnp:handshake:v1"
+
+ROLE_CLIENT = "client"
+ROLE_NODE = "node"
+
+NONCE_LEN = 32
+
+
+class HandshakeError(Exception):
+    """
+    Refusal, with a message safe to hand to the peer.
+
+    `code` is the same refusal in a form a client can act on. The text is for a
+    human and may be reworded; matching on it from the client would be a string
+    comparison that breaks silently the day someone improves the wording.
+    """
+
+    def __init__(self, message: str, code: str = ""):
+        super().__init__(message)
+        self.code = code
+
+
+class DenylistLike(Protocol):
+    def is_denied(self, user_id: str, jti: str, group_id: str = "") -> bool: ...
+
+
+@dataclass
+class AuthorizedPeer:
+    user_id: str
+    group_id: str
+    username: str
+    jti: str
+
+    # No `pk_user`. The hub used to put a user key in the token and the node
+    # recorded it as the uploader's identity, which let whoever issued tokens
+    # decide who could delete a file. Identity keys are pinned by the node
+    # (see roster.py); the hub certifies accounts, not keys.
+
+
+def handshake_transcript(
+    role: str,
+    group_id: str,
+    nonce_client: bytes,
+    nonce_node: bytes,
+    binding: bytes,
+) -> bytes:
+    """
+    Bytes covered by a handshake proof.
+
+    `binding` ties the proof to the concrete connection: the two DTLS fingerprints
+    for WebRTC, the TLS certificate hashes for QUIC. Without it a proof captured on
+    one connection is replayable on another (NS5).
+    """
+    fields = [
+        role.encode(),
+        group_id.encode(),
+        nonce_client,
+        nonce_node,
+        binding,
+    ]
+    out = bytearray(HANDSHAKE_PREFIX)
+    for field in fields:
+        out += len(field).to_bytes(4, "big")
+        out += field
+    return bytes(out)
+
+
+def make_proof(
+    gek: bytes,
+    role: str,
+    group_id: str,
+    nonce_client: bytes,
+    nonce_node: bytes,
+    binding: bytes,
+) -> bytes:
+    if not binding:
+        # An empty binding means the transport could not identify the channel.
+        # Proceeding would silently drop MitM detection (L4).
+        raise HandshakeError("Channel binding unavailable")
+    if not gek:
+        raise HandshakeError("Group encryption not initialized")
+    transcript = handshake_transcript(
+        role, group_id, nonce_client, nonce_node, binding)
+    return hmac.new(gek, transcript, hashlib.sha256).digest()
+
+
+def verify_proof(
+    gek: bytes,
+    proof: bytes,
+    role: str,
+    group_id: str,
+    nonce_client: bytes,
+    nonce_node: bytes,
+    binding: bytes,
+) -> bool:
+    try:
+        expected = make_proof(
+            gek, role, group_id, nonce_client, nonce_node, binding)
+    except HandshakeError:
+        return False
+    return hmac.compare_digest(proof, expected)
+
+
+def authorize_token(
+    token: str,
+    hub_pk_pem: bytes,
+    *,
+    group_id: str,
+    hosted_groups: Any | None = None,
+    denylist: DenylistLike | None = None,
+    require_scope: str | None = "user",
+) -> AuthorizedPeer:
+    """
+    Everything decided from the JWT, before any proof is exchanged.
+
+    Raises HandshakeError with a peer-safe message. Deliberately strict about
+    `group_id`: it used to be optional, and omitting it skipped the membership
+    check entirely and fell back to the node's first group (M1).
+    """
+    try:
+        decoded = jwt.decode(token, hub_pk_pem, algorithms=["EdDSA"])
+    except Exception as exc:
+        raise HandshakeError(f"Invalid JWT: {exc}") from exc
+
+    # A node-scoped daemon token must not be usable as a client token (M9).
+    if require_scope is not None and decoded.get("scope", "user") != require_scope:
+        raise HandshakeError("Wrong token scope")
+
+    user_id = decoded.get("sub", "")
+    jti = decoded.get("jti", "")
+    if not user_id:
+        raise HandshakeError("Token has no subject")
+
+    if not group_id:
+        raise HandshakeError("group_id is required")
+
+    if denylist is not None and denylist.is_denied(user_id, jti, group_id):
+        raise HandshakeError("Token revoked")
+
+    if group_id not in decoded.get("groups", []):
+        # Almost always a token issued before the person was added to the group:
+        # `groups` is baked in at login and the hub does not push updates. The
+        # client refreshes and retries on this code rather than telling someone
+        # who *is* a member that they are not one.
+        raise HandshakeError("Not a member of this group", code="not_a_member")
+
+    if hosted_groups is not None and group_id not in hosted_groups:
+        raise HandshakeError("Group not hosted on this node")
+
+    return AuthorizedPeer(
+        user_id=user_id,
+        group_id=group_id,
+        username=decoded.get("username", ""),
+        jti=jti,
+    )
+
+
+def webrtc_binding(offer_fp: bytes, answer_fp: bytes) -> bytes:
+    """Channel binding for WebRTC: both DTLS certificate fingerprints."""
+    return (len(offer_fp).to_bytes(4, "big") + offer_fp
+            + len(answer_fp).to_bytes(4, "big") + answer_fp)
+
+
+def quic_binding(server_cert_der: bytes) -> bytes:
+    """
+    Channel binding for QUIC.
+
+    QUIC has no DTLS fingerprint to reuse, so the anchor is a hash of the server's
+    self-signed certificate — the same value a client pins as the node identity.
+    An RFC 5705 exporter would be stronger; aioquic does not currently expose one
+    (11.5.6).
+    """
+    digest = hashlib.sha256(server_cert_der).digest()
+    return len(digest).to_bytes(4, "big") + digest
diff --git a/packages/meshbay-common/src/meshbay_common/join.py b/packages/meshbay-common/src/meshbay_common/join.py
new file mode 100644
index 0000000..6ee543f
--- /dev/null
+++ b/packages/meshbay-common/src/meshbay_common/join.py
@@ -0,0 +1,63 @@
+"""
+Join and pairing transcript (MNP).
+
+A client proves, in one signature, that the X25519 key it wants the group key
+wrapped for belongs to the Ed25519 identity the node pins. Both keys travel inside
+the transcript, so the identity key vouches for the encryption key it is paired
+with — that is what makes "wrap the GEK for the key the peer presented" safe.
+
+Why this exists at all (H3): the invite flow used to fetch the invitee's public key
+from the hub and wrap the group key for whatever came back. The hub is the key
+directory, so a hub answering with its own key was handed the GEK by an honest
+inviter following the protocol exactly. The key now comes from the peer over an
+authenticated channel and is bound to an identity by a one-time pairing code the
+hub never sees. See `docs/invite-pairing-v1.md`.
+
+Fields are length-prefixed and domain-separated, per L4 — the same rule as
+`handshake.py` and `adminop.py`. `nonce_node` is the handshake nonce the node just
+issued, so a signed join cannot be lifted onto another connection.
+"""
+
+from __future__ import annotations
+
+JOIN_PREFIX = b"meshbay:join:v1"
+
+# A join older than this is refused. Same value as the admin challenge: both are
+# interactive exchanges that complete in milliseconds.
+JOIN_TTL = 120  # seconds
+
+ROLE_OPERATOR = "operator"
+ROLE_DELEGATE = "delegate"   # reserved; delegation is deferred (§6.2 of the design)
+ROLE_MEMBER = "member"
+
+
+def join_transcript(
+    node_pk_b64: str,
+    group_id: str,
+    user_id: str,
+    pk_ed25519_b64: str,
+    pk_x25519_b64: str,
+    nonce_node: bytes,
+    ts: int,
+) -> bytes:
+    """
+    Bytes signed by a client asking to be pinned by, or recognised on, a node.
+
+    `group_id` is empty for operator pairing, which is node-wide rather than
+    per-group. The node builds this from its own state and the values in the
+    message; nothing signed is ever taken from the wire unverified.
+    """
+    fields = [
+        node_pk_b64.encode(),
+        group_id.encode(),
+        user_id.encode(),
+        pk_ed25519_b64.encode(),
+        pk_x25519_b64.encode(),
+        nonce_node,
+        str(ts).encode(),
+    ]
+    out = bytearray(JOIN_PREFIX)
+    for field in fields:
+        out += len(field).to_bytes(4, "big")
+        out += field
+    return bytes(out)
diff --git a/packages/meshbay-common/src/meshbay_common/protocol.py b/packages/meshbay-common/src/meshbay_common/protocol.py
index 55dcdde..50e8663 100644
--- a/packages/meshbay-common/src/meshbay_common/protocol.py
+++ b/packages/meshbay-common/src/meshbay_common/protocol.py
@@ -29,8 +29,10 @@ class MNP:
     CHAT_ATTACHMENT = "chat_attach"      # attachment metadata
     CHAT_HISTORY    = "chat_hist"       # request message history
     CHAT_HISTORY_RESPONSE = "chat_hist_resp"  # history response with messages
-    GEK_REQUEST     = "gek_req"         # browser requests group GEK
-    GEK_RESPONSE    = "gek_resp"        # node delivers GEK over secure channel
+    # GEK_REQUEST / GEK_RESPONSE were removed (NS3, and finding L1): the node must
+    # never serve the GEK in plaintext. Members obtain it by unwrapping their own
+    # ECIES bundle. The constants lingered after the handlers were deleted, leaving
+    # the wire contract looking as though the endpoint still existed.
     FILE_UPLOAD      = "file_upload"       # client pushes file chunk to node
     FILE_UPLOAD_ACK  = "file_upload_ack"   # node acknowledges chunk receipt
     FILE_DELETE      = "file_delete"       # client requests file deletion
@@ -44,12 +46,19 @@ class MNP:
     HANDSHAKE_RESPONSE   = "handshake_response"    # client → node: HMAC(GEK, nonce)
     ADMIN_CHALLENGE      = "admin_challenge"       # node → client: Ed25519 sign challenge
     ADMIN_RESPONSE       = "admin_response"        # client → node: Ed25519 signature
-    GEK_BUNDLE_STORE     = "gek_bundle_store"      # client → node: store wrapped GEK for a user
+    # GEK_BUNDLE_STORE was removed with the invite redesign: the node wraps the GEK
+    # itself, for a key the recipient proved possession of, so no member ever hands
+    # the node key material (C5b, and the H3 substitution it enabled).
     GEK_BUNDLE_FETCH     = "gek_bundle_fetch"      # client → node: request own wrapped GEK
     GEK_BUNDLE_RESP      = "gek_bundle_resp"       # node → client: wrapped GEK bundle
     KEYPAIR_BUNDLE_STORE = "keypair_bundle_store"  # client → node: store encrypted keypair bundle
     KEYPAIR_BUNDLE_FETCH = "keypair_bundle_fetch"  # client → node: request own keypair bundle
     KEYPAIR_BUNDLE_RESP  = "keypair_bundle_resp"   # node → client: encrypted keypair bundle
+    KEYPAIR_BUNDLE_DELETE = "keypair_bundle_delete"  # client → node: withdraw own backup
+    JOIN_REQUEST         = "join_request"          # client → node: pair/recognise this identity
+    JOIN_RESULT          = "join_result"           # node → client: outcome + wrapped GEK
+    INVITE_CREATE        = "invite_create"         # operator → node: issue a pairing code
+    INVITE_RESULT        = "invite_result"         # node → operator: the code, once
 
 
 # ── Index entry ───────────────────────────────────────────────────────────────
diff --git a/packages/meshbay-common/tests/test_handshake.py b/packages/meshbay-common/tests/test_handshake.py
new file mode 100644
index 0000000..8981db8
--- /dev/null
+++ b/packages/meshbay-common/tests/test_handshake.py
@@ -0,0 +1,225 @@
+"""
+Unified handshake — properties every transport must inherit (11.5.4/5, C6, C3, L4).
+
+These test the shared module rather than any one transport. The point of the module
+is that WebRTC and QUIC cannot drift apart again: the handshake existed three times
+over and only the newest copy enforced the GEK proof.
+"""
+
+import time
+
+import jwt
+import pytest
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+from meshbay_common.handshake import (
+    HANDSHAKE_PREFIX,
+    NONCE_LEN,
+    ROLE_CLIENT,
+    ROLE_NODE,
+    AuthorizedPeer,
+    HandshakeError,
+    authorize_token,
+    handshake_transcript,
+    make_proof,
+    quic_binding,
+    verify_proof,
+    webrtc_binding,
+)
+
+GEK = b"\x11" * 32
+GROUP = "g" * 32
+NONCE_C = b"\x01" * NONCE_LEN
+NONCE_S = b"\x02" * NONCE_LEN
+BINDING = webrtc_binding(b"\xaa" * 32, b"\xbb" * 32)
+
+
+# ── Token authorization ───────────────────────────────────────────────────────
+
+@pytest.fixture
+def hub_key():
+    sk = Ed25519PrivateKey.generate()
+    pem = sk.private_bytes(
+        serialization.Encoding.PEM,
+        serialization.PrivateFormat.PKCS8,
+        serialization.NoEncryption(),
+    )
+    pub = sk.public_key().public_bytes(
+        serialization.Encoding.PEM,
+        serialization.PublicFormat.SubjectPublicKeyInfo,
+    )
+    return pem, pub
+
+
+def _token(sk_pem, **over):
+    now = int(time.time())
+    payload = {
+        "iss": "test-hub", "sub": "user-1", "jti": "jti-1",
+        "iat": now, "exp": now + 3600,
+        "groups": [GROUP], "scope": "user", "pk_user": "pk",
+    }
+    payload.update(over)
+    return jwt.encode(payload, sk_pem, algorithm="EdDSA")
+
+
+def test_valid_token_authorizes(hub_key):
+    sk_pem, pk_pem = hub_key
+    peer = authorize_token(_token(sk_pem), pk_pem, group_id=GROUP)
+    assert isinstance(peer, AuthorizedPeer)
+    assert peer.user_id == "user-1"
+
+
+def test_group_id_is_mandatory(hub_key):
+    """
+    M1: group_id used to be optional, and omitting it skipped the membership check
+    entirely while falling back to the node's first group.
+    """
+    sk_pem, pk_pem = hub_key
+    with pytest.raises(HandshakeError, match="group_id"):
+        authorize_token(_token(sk_pem), pk_pem, group_id="")
+
+
+def test_non_member_refused(hub_key):
+    sk_pem, pk_pem = hub_key
+    token = _token(sk_pem, groups=["other-group"])
+    with pytest.raises(HandshakeError, match="Not a member"):
+        authorize_token(token, pk_pem, group_id=GROUP)
+
+
+def test_node_scoped_token_refused_on_client_path(hub_key):
+    """M9: a daemon's node-scoped token must not be usable as a client token."""
+    sk_pem, pk_pem = hub_key
+    token = _token(sk_pem, scope="node")
+    with pytest.raises(HandshakeError, match="scope"):
+        authorize_token(token, pk_pem, group_id=GROUP)
+
+
+def test_unhosted_group_refused(hub_key):
+    sk_pem, pk_pem = hub_key
+    with pytest.raises(HandshakeError, match="not hosted"):
+        authorize_token(_token(sk_pem), pk_pem, group_id=GROUP,
+                        hosted_groups={"some-other-group"})
+
+
+def test_denylisted_token_refused(hub_key):
+    sk_pem, pk_pem = hub_key
+
+    class _Deny:
+        def is_denied(self, user_id, jti, group_id=""):
+            return group_id == GROUP
+
+    with pytest.raises(HandshakeError, match="revoked"):
+        authorize_token(_token(sk_pem), pk_pem, group_id=GROUP, denylist=_Deny())
+
+
+def test_forged_token_refused(hub_key):
+    _, pk_pem = hub_key
+    other = Ed25519PrivateKey.generate().private_bytes(
+        serialization.Encoding.PEM,
+        serialization.PrivateFormat.PKCS8,
+        serialization.NoEncryption(),
+    )
+    with pytest.raises(HandshakeError, match="Invalid JWT"):
+        authorize_token(_token(other), pk_pem, group_id=GROUP)
+
+
+# ── Proof transcript ──────────────────────────────────────────────────────────
+
+def test_transcript_is_domain_separated():
+    assert handshake_transcript(
+        ROLE_CLIENT, GROUP, NONCE_C, NONCE_S, BINDING
+    ).startswith(HANDSHAKE_PREFIX)
+
+
+def test_client_proof_is_not_a_node_proof():
+    """
+    C3: the node proves itself with the same key over the same connection. Without
+    the role bound in, a client's proof would satisfy the node check and vice
+    versa, so an impersonating peer could simply echo it back.
+    """
+    client = make_proof(GEK, ROLE_CLIENT, GROUP, NONCE_C, NONCE_S, BINDING)
+    assert not verify_proof(GEK, client, ROLE_NODE, GROUP, NONCE_C, NONCE_S, BINDING)
+
+    node = make_proof(GEK, ROLE_NODE, GROUP, NONCE_C, NONCE_S, BINDING)
+    assert not verify_proof(GEK, node, ROLE_CLIENT, GROUP, NONCE_C, NONCE_S, BINDING)
+    assert client != node
+
+
+@pytest.mark.parametrize("field,value", [
+    ("group_id", "other-group"),
+    ("nonce_client", b"\x09" * NONCE_LEN),
+    ("nonce_node", b"\x09" * NONCE_LEN),
+    ("binding", webrtc_binding(b"\xcc" * 32, b"\xdd" * 32)),
+])
+def test_proof_binds_every_field(field, value):
+    base = dict(role=ROLE_CLIENT, group_id=GROUP, nonce_client=NONCE_C,
+                nonce_node=NONCE_S, binding=BINDING)
+    proof = make_proof(GEK, **base)
+    altered = dict(base, **{field: value})
+    assert not verify_proof(GEK, proof, **altered), (
+        f"proof ignores {field} — replayable across connections")
+
+
+def test_proof_requires_channel_binding():
+    """
+    L4/NS5: the old transcript was nonce ‖ offer_fp ‖ answer_fp, and a missing
+    fingerprint silently degraded it to nonce-only, dropping MitM detection.
+    """
+    with pytest.raises(HandshakeError, match="binding"):
+        make_proof(GEK, ROLE_CLIENT, GROUP, NONCE_C, NONCE_S, b"")
+
+    assert not verify_proof(
+        GEK, b"\x00" * 32, ROLE_CLIENT, GROUP, NONCE_C, NONCE_S, b"")
+
+
+def test_proof_requires_gek():
+    with pytest.raises(HandshakeError):
+        make_proof(b"", ROLE_CLIENT, GROUP, NONCE_C, NONCE_S, BINDING)
+
+
+def test_wrong_gek_fails():
+    proof = make_proof(GEK, ROLE_CLIENT, GROUP, NONCE_C, NONCE_S, BINDING)
+    assert not verify_proof(
+        b"\x22" * 32, proof, ROLE_CLIENT, GROUP, NONCE_C, NONCE_S, BINDING)
+
+
+def test_transcript_is_unambiguous():
+    """
+    L4: with bare concatenation, a crafted group id could impersonate the
+    following field and two different handshakes would produce identical bytes.
+    """
+    a = handshake_transcript(ROLE_CLIENT, "gg", NONCE_C, NONCE_S, BINDING)
+    b = handshake_transcript(ROLE_CLIENT, "g", b"g" + NONCE_C, NONCE_S, BINDING)
+    assert a != b
+
+
+def test_bindings_differ_by_transport():
+    """A WebRTC proof must not be replayable on a QUIC connection."""
+    assert webrtc_binding(b"\xaa" * 32, b"\xbb" * 32) != quic_binding(b"cert-der")
+
+
+def test_membership_refusal_carries_a_code_a_client_can_act_on():
+    """
+    `groups` is baked into the token at login, so someone added to a group after
+    signing in is refused although they are a member. The client refreshes and
+    retries on this code — it must not have to match on the human wording, which
+    is exactly the kind of coupling that breaks when someone improves a message.
+    """
+    import jwt as _jwt
+    from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+    from cryptography.hazmat.primitives import serialization
+
+    sk = Ed25519PrivateKey.generate()
+    pem_priv = sk.private_bytes(
+        serialization.Encoding.PEM, serialization.PrivateFormat.PKCS8,
+        serialization.NoEncryption())
+    pem_pub = sk.public_key().public_bytes(
+        serialization.Encoding.PEM, serialization.PublicFormat.SubjectPublicKeyInfo)
+
+    token = _jwt.encode({"sub": "u1", "jti": "j1", "scope": "user", "groups": []},
+                        pem_priv, algorithm="EdDSA")
+
+    with pytest.raises(HandshakeError) as excinfo:
+        authorize_token(token, pem_pub, group_id="g" * 32)
+    assert excinfo.value.code == "not_a_member"
diff --git a/packages/meshbay-common/tests/test_js_python_parity.py b/packages/meshbay-common/tests/test_js_python_parity.py
new file mode 100644
index 0000000..340ea3e
--- /dev/null
+++ b/packages/meshbay-common/tests/test_js_python_parity.py
@@ -0,0 +1,236 @@
+"""
+Cross-language parity: the browser's transcripts must be byte-identical to Python's.
+
+The handshake proof and the admin signature are computed independently on both sides
+and compared by producing the same bytes. Nothing on the wire carries the transcript,
+which is the point — but it also means a one-byte disagreement between `crypto.js` and
+`meshbay_common` is invisible to every other test and produces a total outage: no
+browser can complete a handshake with any node.
+
+The rest of the suite runs in Python only, so nothing else crosses this boundary. These
+tests drive the real `crypto.js` under node and compare against the real Python.
+
+Skipped when node is unavailable; that is a coverage gap, not a pass.
+"""
+
+import json
+import shutil
+import subprocess
+from pathlib import Path
+
+import pytest
+
+from meshbay_common.adminop import admin_transcript
+from meshbay_common.handshake import handshake_transcript, webrtc_binding
+from meshbay_common.join import join_transcript
+
+CRYPTO_JS = (Path(__file__).resolve().parents[2]
+             / "meshbay-hub" / "src" / "meshbay_hub" / "static" / "crypto.js")
+
+pytestmark = pytest.mark.skipif(
+    shutil.which("node") is None or not CRYPTO_JS.exists(),
+    reason="node or crypto.js unavailable — parity cannot be checked",
+)
+
+# (role, group_id, nonce_c hex, nonce_s hex, offer_fp hex, answer_fp hex)
+HANDSHAKE_VECTORS = [
+    ("client", "g" * 32, "01" * 32, "02" * 32, "aa" * 32, "bb" * 32),
+    ("node",   "g" * 32, "01" * 32, "02" * 32, "aa" * 32, "bb" * 32),
+    # Short and empty group ids — length prefixing must keep these distinct.
+    ("client", "g",  "03" * 32, "04" * 32, "cc" * 32, "dd" * 32),
+    ("client", "",   "03" * 32, "04" * 32, "cc" * 32, "dd" * 32),
+    # Non-ASCII: JS TextEncoder and Python .encode() must agree on UTF-8.
+    ("client", "groupe-café-日本", "05" * 32, "06" * 32, "ee" * 32, "ff" * 32),
+    # Fields that could run together under naive concatenation.
+    ("client", "gg", "07" * 32, "08" * 32, "11" * 32, "22" * 32),
+]
+
+# (op, node_pk_b64, group_id, subject, nonce hex, ts)
+ADMIN_VECTORS = [
+    ("file_delete", "Tk9ERVBL", "g" * 32, "file-1", "01" * 32, 1_700_000_000),
+    ("gek_bundle_store", "Tk9ERVBL", "g" * 32, "user-2", "02" * 32, 1_700_000_001),
+    ("file_delete", "Tk9ERVBL", "", "", "03" * 32, 0),
+    ("file_delete", "Tk9ERVBL", "café", "fichier é.mp4", "04" * 32, 1_700_000_002),
+]
+
+# (node_pk_b64, group_id, user_id, pk_ed b64, pk_x b64, nonce hex, ts)
+JOIN_VECTORS = [
+    # Operator pairing: group_id is empty and must stay distinguishable from a
+    # request that names a group.
+    ("Tk9ERVBL", "", "grenet", "QUFB", "QkJC", "01" * 32, 1_700_000_000),
+    ("Tk9ERVBL", "g" * 32, "grenet", "QUFB", "QkJC", "01" * 32, 1_700_000_000),
+    # Identical to the previous vector except that the two keys are swapped —
+    # they are adjacent fields, so this isolates the ordering.
+    ("Tk9ERVBL", "g" * 32, "grenet", "QkJC", "QUFB", "01" * 32, 1_700_000_000),
+    ("Tk9ERVBL", "café", "utilisateur-é", "QUFB", "QkJC", "03" * 32, 0),
+]
+
+_HARNESS = r"""
+const fs = require('fs');
+
+// crypto.js ends with `window.MeshBayCrypto = {...}` and references SubtleCrypto in
+// functions we do not call. A stub is enough to evaluate the module body.
+globalThis.window = {};
+globalThis.crypto = globalThis.crypto || {};
+
+const src = fs.readFileSync(process.argv[2], 'utf8');
+const load = new Function(
+  src + '\nreturn { handshakeTranscript, adminTranscript, joinTranscript, '
+      + 'webrtcBinding, b64encode };');
+const M = load();
+
+const hex = (s) => {
+  const out = new Uint8Array(s.length / 2);
+  for (let i = 0; i < s.length; i += 2) out[i / 2] = parseInt(s.substr(i, 2), 16);
+  return out;
+};
+const toHex = (u8) =>
+  Array.from(u8).map(b => b.toString(16).padStart(2, '0')).join('');
+
+const input = JSON.parse(fs.readFileSync(process.argv[3], 'utf8'));
+const out = { handshake: [], admin: [], join: [] };
+
+for (const v of input.handshake) {
+  const binding = M.webrtcBinding(hex(v.offer_fp), hex(v.answer_fp));
+  out.handshake.push(toHex(M.handshakeTranscript(
+    v.role, v.group_id, hex(v.nonce_c), hex(v.nonce_s), binding)));
+}
+
+for (const v of input.admin) {
+  out.admin.push(toHex(M.adminTranscript(
+    v.op, v.node_pk, v.group_id, v.subject, M.b64encode(hex(v.nonce)), v.ts)));
+}
+
+for (const v of input.join) {
+  out.join.push(toHex(M.joinTranscript(
+    v.node_pk, v.group_id, v.user_id, v.pk_ed, v.pk_x, hex(v.nonce), v.ts)));
+}
+
+process.stdout.write(JSON.stringify(out));
+"""
+
+
+@pytest.fixture(scope="module")
+def js_output(tmp_path_factory):
+    """Run the real crypto.js under node and return its transcripts as hex."""
+    d = tmp_path_factory.mktemp("parity")
+    harness = d / "harness.js"
+    harness.write_text(_HARNESS)
+
+    payload = d / "vectors.json"
+    payload.write_text(json.dumps({
+        "handshake": [
+            {"role": r, "group_id": g, "nonce_c": nc,
+             "nonce_s": ns, "offer_fp": ofp, "answer_fp": afp}
+            for r, g, nc, ns, ofp, afp in HANDSHAKE_VECTORS
+        ],
+        "admin": [
+            {"op": op, "node_pk": pk, "group_id": g,
+             "subject": s, "nonce": n, "ts": ts}
+            for op, pk, g, s, n, ts in ADMIN_VECTORS
+        ],
+        "join": [
+            {"node_pk": pk, "group_id": g, "user_id": u,
+             "pk_ed": pe, "pk_x": px, "nonce": n, "ts": ts}
+            for pk, g, u, pe, px, n, ts in JOIN_VECTORS
+        ],
+    }))
+
+    proc = subprocess.run(
+        ["node", str(harness), str(CRYPTO_JS), str(payload)],
+        capture_output=True, text=True, timeout=60,
+    )
+    if proc.returncode != 0:
+        pytest.fail(f"node harness failed:\n{proc.stderr}")
+    return json.loads(proc.stdout)
+
+
+@pytest.mark.parametrize("idx,vector", list(enumerate(HANDSHAKE_VECTORS)))
+def test_handshake_transcript_parity(idx, vector, js_output):
+    """
+    A mismatch here means no browser can complete a handshake with any node —
+    the GEK proof would never verify, and no other test would notice.
+    """
+    role, group_id, nonce_c, nonce_s, offer_fp, answer_fp = vector
+
+    expected = handshake_transcript(
+        role=role,
+        group_id=group_id,
+        nonce_client=bytes.fromhex(nonce_c),
+        nonce_node=bytes.fromhex(nonce_s),
+        binding=webrtc_binding(bytes.fromhex(offer_fp), bytes.fromhex(answer_fp)),
+    )
+    assert js_output["handshake"][idx] == expected.hex(), (
+        f"crypto.js and meshbay_common.handshake disagree for role={role!r} "
+        f"group={group_id!r}"
+    )
+
+
+@pytest.mark.parametrize("idx,vector", list(enumerate(ADMIN_VECTORS)))
+def test_admin_transcript_parity(idx, vector, js_output):
+    """
+    A mismatch here means the browser signs bytes the node did not ask for, so every
+    file deletion and GEK bundle store is rejected.
+    """
+    op, node_pk, group_id, subject, nonce, ts = vector
+
+    expected = admin_transcript(
+        op=op,
+        node_pk_b64=node_pk,
+        group_id=group_id,
+        subject=subject,
+        nonce=bytes.fromhex(nonce),
+        ts=ts,
+    )
+    assert js_output["admin"][idx] == expected.hex(), (
+        f"crypto.js and meshbay_common.adminop disagree for op={op!r} "
+        f"subject={subject!r}"
+    )
+
+
+@pytest.mark.parametrize("idx,vector", list(enumerate(JOIN_VECTORS)))
+def test_join_transcript_parity(idx, vector, js_output):
+    """
+    A mismatch here means no browser can pair with a node and no member can be
+    recognised — the node would reject every signature as invalid, and, as with
+    the other two, nothing else in the suite crosses this boundary.
+    """
+    node_pk, group_id, user_id, pk_ed, pk_x, nonce, ts = vector
+
+    expected = join_transcript(
+        node_pk_b64=node_pk,
+        group_id=group_id,
+        user_id=user_id,
+        pk_ed25519_b64=pk_ed,
+        pk_x25519_b64=pk_x,
+        nonce_node=bytes.fromhex(nonce),
+        ts=ts,
+    )
+    assert js_output["join"][idx] == expected.hex(), (
+        f"crypto.js and meshbay_common.join disagree for user={user_id!r} "
+        f"group={group_id!r}"
+    )
+
+
+def test_join_transcript_binds_the_two_keys_in_order(js_output):
+    """
+    The X25519 key is trusted only because the Ed25519 identity signed it, so the
+    two must not be interchangeable: swapping them has to produce different bytes.
+    """
+    assert js_output["join"][1] != js_output["join"][2]
+
+
+def test_operator_pairing_is_distinguishable_from_a_group_join(js_output):
+    """An empty group_id (node-wide operator authority) must not collide."""
+    assert js_output["join"][0] != js_output["join"][1]
+
+
+def test_length_prefixing_actually_disambiguates(js_output):
+    """
+    The reason both sides length-prefix: two different field splits must not collide.
+    Verified across the language boundary, since a JS implementation that concatenated
+    naively would still agree with itself.
+    """
+    a = js_output["handshake"][2]   # group_id "g"
+    b = js_output["handshake"][3]   # group_id ""
+    assert a != b, "JS transcripts collide across different group ids"
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/groups.py b/packages/meshbay-hub/src/meshbay_hub/api/groups.py
index 88af764..000f3f7 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/groups.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/groups.py
@@ -6,6 +6,7 @@ from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from meshbay_hub.api.deps import get_current_user, require_user_scope
+from meshbay_hub.api.netutil import client_ip
 from meshbay_hub.db.engine import get_db
 from meshbay_hub.db.models import (
     FederatedGroup, Group, GroupMember,
@@ -14,6 +15,10 @@ from meshbay_hub.db.models import (
 
 router = APIRouter(prefix="/v1/groups", tags=["groups"])
 
+# Swarm endpoints live at /v1/swarm/*. They were previously declared on the groups
+# router with a full path, which mounted them at /v1/groups/v1/swarm/* (H7).
+swarm_router = APIRouter(prefix="/v1/swarm", tags=["swarm"])
+
 
 @router.get("/mine")
 async def my_groups(
@@ -117,13 +122,21 @@ class SwarmRegisterRequest(BaseModel):
     endpoint:     str    # "ip:port"
 
 
-@router.post("/v1/swarm/register", status_code=201)
+@swarm_router.post("/register", status_code=201)
 async def swarm_register(
     body: SwarmRegisterRequest,
     current_user: User = Depends(get_current_user),
     db: AsyncSession = Depends(get_db),
 ):
-    """Node registers itself as a source for a content hash (public swarm)."""
+    """
+    Node registers itself as a source for a PUBLIC content hash.
+
+    Finding H7: the node registered hashes for every group it hosted, private ones
+    included, and this route was mounted at /v1/groups/v1/swarm/register — so the
+    node's calls 404'd and the leak was masked by a routing bug rather than
+    prevented. Nodes now filter by group visibility before calling, and the path is
+    correct, so the filter has to be right.
+    """
     from meshbay_hub.csam import check_content_hash
     if check_content_hash(body.content_hash):
         raise HTTPException(status_code=451, detail="Content blocked")
@@ -144,12 +157,18 @@ async def swarm_register(
     return {"status": "registered", "hash": body.content_hash}
 
 
-@router.get("/v1/swarm/{content_hash}")
+@swarm_router.get("/{content_hash}")
 async def swarm_sources(
     content_hash: str,
+    current_user: User = Depends(get_current_user),
     db: AsyncSession = Depends(get_db),
 ):
-    """Return list of nodes that can serve a content hash."""
+    """
+    Return nodes that can serve a content hash.
+
+    Authenticated (H7): an open endpoint lets anyone probe whether a given file
+    exists anywhere in the network and which node holds it.
+    """
     from datetime import datetime, timezone, timedelta
     cutoff = datetime.now(timezone.utc) - timedelta(minutes=30)
     result = await db.execute(
@@ -214,7 +233,7 @@ async def join_group(
 
     db.add(GroupMember(group_id=group_id, user_id=current_user.id))
     db.add(IPLog(user_id=current_user.id, event="group_join",
-                 ip_address=_ip(request), detail=group.name))
+                 ip_address=client_ip(request), detail=group.name))
     await db.commit()
     return {"status": "joined", "group_id": group_id, "name": group.name}
 
@@ -246,7 +265,7 @@ async def create_group(
 
     db.add(GroupMember(group_id=group.id, user_id=current_user.id))
     db.add(IPLog(user_id=current_user.id, event="group_create",
-                 ip_address=_ip(request), detail=body.name))
+                 ip_address=client_ip(request), detail=body.name))
     await db.commit()
     await db.refresh(group)
     return {"group_id": group.id, "name": group.name}
@@ -304,13 +323,9 @@ async def delete_group(
     from sqlalchemy import delete as sa_delete
     await db.execute(sa_delete(GroupMember).where(GroupMember.group_id == group_id))
     db.add(IPLog(user_id=current_user.id, event="group_delete",
-                 ip_address=_ip(request), detail=group.name))
+                 ip_address=client_ip(request), detail=group.name))
     await db.delete(group)
     await db.commit()
     return {"status": "deleted", "group_id": group_id}
 
 
-def _ip(request: Request) -> str:
-    fwd = request.headers.get("X-Forwarded-For")
-    return fwd.split(",")[0].strip() if fwd else (
-        request.client.host if request.client else "unknown")
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/moderation.py b/packages/meshbay-hub/src/meshbay_hub/api/moderation.py
index 6bb007b..853f255 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/moderation.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/moderation.py
@@ -28,6 +28,7 @@ from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from meshbay_hub.api.deps import get_current_user, require_admin
+from meshbay_hub.api.netutil import client_ip
 from meshbay_hub.db.engine import get_db
 from meshbay_hub.db.models import ContentBlocklist, ContentReport, User
 
@@ -64,7 +65,7 @@ async def report_content(
     if len(body.content_hash) != 64 or not all(c in "0123456789abcdef" for c in body.content_hash):
         raise HTTPException(status_code=422, detail="content_hash must be 64 hex chars (blake3)")
 
-    ip = _ip(request)
+    ip = client_ip(request)
 
     # Count existing reports for this hash
     count_result = await db.execute(
@@ -193,8 +194,3 @@ async def admin_remove_blocklist(
     await db.commit()
     return {"status": "unblocked", "hash": content_hash}
 
-
-def _ip(request: Request) -> str:
-    fwd = request.headers.get("X-Forwarded-For")
-    return fwd.split(",")[0].strip() if fwd else (
-        request.client.host if request.client else "unknown")
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/netutil.py b/packages/meshbay-hub/src/meshbay_hub/api/netutil.py
new file mode 100644
index 0000000..aa8344a
--- /dev/null
+++ b/packages/meshbay-hub/src/meshbay_hub/api/netutil.py
@@ -0,0 +1,34 @@
+"""
+Client address resolution for the audit log and rate limiting.
+
+Finding M7: every call site did
+
+    fwd = request.headers.get("X-Forwarded-For")
+    return fwd.split(",")[0].strip() if fwd else request.client.host
+
+which trusts a header the client controls. Anyone could forge the IP written into
+the compliance log — the log that exists specifically to answer legal requests —
+and sidestep per-IP rate limiting at the same time.
+
+X-Forwarded-For is only consulted when the immediate peer is a trusted proxy, and
+then the *rightmost* entry is used: that is the one our own proxy appended, whereas
+the leftmost is whatever the client sent.
+"""
+
+from fastapi import Request
+
+# Caddy terminates TLS on the same host and proxies to 127.0.0.1:8000.
+TRUSTED_PROXIES = frozenset({"127.0.0.1", "::1", "localhost"})
+
+
+def client_ip(request: Request) -> str:
+    peer = request.client.host if request.client else ""
+
+    if peer in TRUSTED_PROXIES:
+        forwarded = request.headers.get("X-Forwarded-For")
+        if forwarded:
+            hops = [h.strip() for h in forwarded.split(",") if h.strip()]
+            if hops:
+                return hops[-1]
+
+    return peer or "unknown"
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/nodes.py b/packages/meshbay-hub/src/meshbay_hub/api/nodes.py
index 321e43c..0770148 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/nodes.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/nodes.py
@@ -13,6 +13,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from meshbay_hub.auth import issue_access_token
 from meshbay_hub.api.deps import get_current_user
 from meshbay_hub.api.middleware import limiter
+from meshbay_hub.api.netutil import client_ip
 from meshbay_hub.db.engine import get_db
 from meshbay_hub.db.models import GroupMember, IPLog, Node, User
 
@@ -59,7 +60,7 @@ async def node_auth(
         sig = base64.b64decode(body.signature)
         pk.verify(sig, message)
     except (InvalidSignature, Exception):
-        db.add(IPLog(event="node_auth_fail", ip_address=_ip(request), detail=body.username))
+        db.add(IPLog(event="node_auth_fail", ip_address=client_ip(request), detail=body.username))
         await db.commit()
         raise HTTPException(status_code=401, detail="Invalid signature")
 
@@ -68,9 +69,9 @@ async def node_auth(
     group_ids = [gid for (gid,) in memberships.all()]
 
     access_token = issue_access_token(
-        user.id, user.pk_node_ed25519, ttl=3600, groups=group_ids, scope="node")
+        user.id, ttl=3600, groups=group_ids, scope="node")
 
-    db.add(IPLog(user_id=user.id, event="node_auth", ip_address=_ip(request)))
+    db.add(IPLog(user_id=user.id, event="node_auth", ip_address=client_ip(request)))
     await db.commit()
 
     return {
@@ -83,6 +84,8 @@ async def node_auth(
 class NodeAnnounceRequest(BaseModel):
     pk_node:       str
     endpoint_hint: str | None = None
+    timestamp:     int | None = None   # unix seconds
+    signature:     str | None = None   # base64 Ed25519 over the announce message
 
 
 @router.post("/announce", status_code=201)
@@ -92,6 +95,48 @@ async def announce_node(
     current_user: User = Depends(get_current_user),
     db: AsyncSession = Depends(get_db),
 ):
+    """
+    Register a node record.
+
+    Finding M8: this accepted any pk_node with no proof the announcer held the
+    matching private key, so a user could announce a record carrying someone
+    else's node key — useful for muddying node identity, and records accumulated
+    without limit. The announcer must now sign a domain-separated message binding
+    the key to their account, the same pattern already used by /v1/nodes/auth.
+    """
+    if body.timestamp is None or not body.signature:
+        raise HTTPException(
+            status_code=400,
+            detail="announce requires timestamp and signature (proof of possession)")
+
+    now = int(time.time())
+    if abs(now - body.timestamp) > NODE_AUTH_TIMESTAMP_WINDOW:
+        raise HTTPException(status_code=401, detail="Timestamp too old or too far ahead")
+
+    message = (f"meshbay:node_announce:{current_user.id}:"
+               f"{body.pk_node}:{body.timestamp}").encode()
+    try:
+        pk = Ed25519PublicKey.from_public_bytes(base64.b64decode(body.pk_node))
+        pk.verify(base64.b64decode(body.signature), message)
+    except Exception:
+        db.add(IPLog(user_id=current_user.id, event="node_announce_fail",
+                     ip_address=client_ip(request), detail=body.pk_node[:16]))
+        await db.commit()
+        raise HTTPException(status_code=401, detail="Invalid node key proof of possession")
+
+    # One active record per key per account — announcing again updates in place
+    # instead of accumulating rows.
+    existing = await db.execute(
+        select(Node).where(Node.user_id == current_user.id,
+                           Node.pk_node == body.pk_node))
+    node = existing.scalar_one_or_none()
+    if node is not None:
+        node.endpoint_hint = body.endpoint_hint
+        db.add(IPLog(user_id=current_user.id, event="node_announce",
+                     ip_address=client_ip(request), detail=body.endpoint_hint))
+        await db.commit()
+        return {"node_id": node.id}
+
     node = Node(
         user_id=current_user.id,
         pk_node=body.pk_node,
@@ -101,7 +146,7 @@ async def announce_node(
     db.add(IPLog(
         user_id=current_user.id,
         event="node_announce",
-        ip_address=_ip(request),
+        ip_address=client_ip(request),
         detail=body.endpoint_hint,
     ))
     await db.commit()
@@ -128,8 +173,3 @@ async def get_node(
     }
 
 
-def _ip(request: Request) -> str:
-    fwd = request.headers.get("X-Forwarded-For")
-    if fwd:
-        return fwd.split(",")[0].strip()
-    return request.client.host if request.client else "unknown"
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/revocation.py b/packages/meshbay-hub/src/meshbay_hub/api/revocation.py
index c9c59c9..2e3323c 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/revocation.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/revocation.py
@@ -33,7 +33,7 @@ import time
 import uuid
 from typing import Any
 
-from fastapi import APIRouter, Depends, HTTPException, WebSocket, WebSocketDisconnect
+from fastapi import APIRouter, Depends, HTTPException, Request, WebSocket, WebSocketDisconnect
 from pydantic import BaseModel
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
@@ -42,7 +42,7 @@ import jwt
 from meshbay_hub.auth import hub_public_key_pem, decode_access_token
 from meshbay_hub.api.deps import get_current_user, require_admin
 from meshbay_hub.db.engine import get_db
-from meshbay_hub.db.models import Group, IPLog, User
+from meshbay_hub.db.models import Group, GroupMember, IPLog, Node, User
 
 log = logging.getLogger(__name__)
 
@@ -128,38 +128,109 @@ async def _handle_chat_notify(group_id: str, sender_name: str, sender_user_id: s
         log.warning("Chat notify failed: %s", e)
 
 
+async def _reject(ws: WebSocket, detail: str, code: int) -> None:
+    await ws.send_text(json.dumps({"type": "error", "detail": detail}))
+    await ws.close(code=code)
+
+
+async def _authorize_node_ws(token: str, claimed_id: str, claimed_groups) -> tuple:
+    """
+    Resolve a node WS registration against the database.
+
+    Returns (node_id, group_ids) on success, or (None, error_detail) on refusal.
+    Uses a short-lived session on purpose: a node WebSocket lives for hours, and a
+    request-scoped dependency would pin a PostgreSQL connection for its whole
+    lifetime, exhausting the pool once a handful of nodes connect.
+    """
+    from meshbay_hub.db.engine import get_session_factory
+
+    try:
+        decoded = decode_access_token(token)
+    except Exception as e:
+        return None, str(e)
+
+    if decoded.get("scope") != "node":
+        return None, "Node-scoped token required"
+
+    user_id = decoded.get("sub", "")
+    if not claimed_id:
+        return None, "node_id required"
+
+    async with get_session_factory()() as db:
+        node = await db.get(Node, claimed_id)
+        if node is None or node.user_id != user_id:
+            log.warning("Rejected WS registration for node %s by user %s",
+                        claimed_id[:8], (user_id or "?")[:8])
+            return None, "node_id does not belong to this account"
+
+        user = await db.get(User, user_id)
+        if user is None or user.status != "active":
+            return None, "Account not active"
+
+        # Groups come from the database. The node may narrow the set to what it
+        # actually hosts, but it cannot widen it to groups it is not a member of —
+        # otherwise it could advertise itself as a source for any group on the hub.
+        result = await db.execute(
+            select(GroupMember.group_id).where(GroupMember.user_id == user_id))
+        authorized = {gid for (gid,) in result.all()}
+
+    claimed = set(claimed_groups or authorized)
+    return claimed_id, sorted(authorized & claimed)
+
+
 @router.websocket("/v1/nodes/ws")
 async def node_websocket(ws: WebSocket):
     """
     Persistent WebSocket connection for nodes.
-    Nodes authenticate with a JWT bearer in the first message.
-    Hub sends revocation tokens as JSON messages.
+
+    Finding C2: this used to take `node_id` and `group_ids` straight from the
+    client's first message, with no check that the authenticated user owned that
+    node. Any registered user could connect with an ordinary browser token, claim a
+    victim node's id, and overwrite its entry in `_connected_nodes`. Every WebRTC
+    offer for that node was then relayed to the attacker, who answered with their
+    own SDP — a full node impersonation, and the DTLS channel binding does not help
+    because the attacker is the endpoint rather than a relay. The attacker received
+    the victim's encrypted keypair bundle, their chat, and their uploads.
+
+    Identity now comes from the token and the database, never from the message.
     """
     await ws.accept()
     node_id: str | None = None
 
     try:
-        # Auth: expect {"type": "auth", "token": "<jwt>"}
+        # Auth: expect {"type": "auth", "token": "<jwt>", "node_id": "..."}
         raw = await ws.receive_text()
         msg = json.loads(raw)
         if msg.get("type") != "auth" or "token" not in msg:
-            await ws.send_text(json.dumps({"type": "error", "detail": "Send auth first"}))
-            await ws.close(code=4001)
+            await _reject(ws, "Send auth first", 4001)
             return
 
         try:
             decoded = decode_access_token(msg["token"])
         except Exception as e:
-            await ws.send_text(json.dumps({"type": "error", "detail": str(e)}))
-            await ws.close(code=4001)
+            await _reject(ws, str(e), 4001)
             return
 
-        node_id = msg.get("node_id") or decoded.get("sub", "unknown")
+        claimed_id = msg.get("node_id") or ""
+
+        # Refuse to displace a live registration rather than silently overwriting it.
+        if claimed_id and claimed_id in _connected_nodes:
+            await _reject(ws, "Node already connected", 4009)
+            return
+
+        resolved_id, result = await _authorize_node_ws(
+            msg["token"], claimed_id, msg.get("group_ids"))
+        if resolved_id is None:
+            await _reject(ws, result, 4003)
+            return
+        group_ids = result
+
+        user_id = decoded.get("sub", "")
+        node_id = resolved_id
         _connected_nodes[node_id] = ws
-        group_ids = msg.get("group_ids", [])
-        if group_ids:
-            _node_groups[node_id] = group_ids
-        log.info("Node WS connected: %s (groups=%d)", node_id[:8], len(group_ids))
+        _node_groups[node_id] = group_ids
+        log.info("Node WS connected: %s (user=%s, groups=%d)",
+                 node_id[:8], user_id[:8], len(group_ids))
         await ws.send_text(json.dumps({"type": "auth_ok", "node_id": node_id}))
 
         # Message loop — handle ping, punch_ready, etc.
@@ -203,12 +274,28 @@ class IncomingRequest(BaseModel):
 async def notify_incoming(
     node_id: str,
     body: IncomingRequest,
+    request: Request,
     current_user: User = Depends(get_current_user),
 ):
     """
     Signal a node that a client wants to connect (NAT punch coordination).
     Hub forwards the request via WebSocket; node punches NAT and replies punch_ready.
+
+    Finding H6: peer_ip was taken verbatim, so any authenticated user could make an
+    arbitrary node emit UDP packets to an address of their choosing — a small
+    reflection primitive using someone else's machine. The probe target must now be
+    the caller's own source address.
     """
+    from meshbay_hub.api.netutil import client_ip
+
+    caller_ip = client_ip(request)
+    if body.peer_ip != caller_ip:
+        raise HTTPException(
+            status_code=403,
+            detail="peer_ip must match the requesting address")
+    if not (1 <= body.peer_port <= 65535):
+        raise HTTPException(status_code=422, detail="Invalid peer_port")
+
     ws = _connected_nodes.get(node_id)
     if not ws:
         raise HTTPException(status_code=404, detail="Node not connected")
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/signaling.py b/packages/meshbay-hub/src/meshbay_hub/api/signaling.py
index bd343c9..8f84163 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/signaling.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/signaling.py
@@ -17,11 +17,15 @@ import json
 import logging
 import uuid
 
-from fastapi import APIRouter, Depends, HTTPException
+from fastapi import APIRouter, Depends, HTTPException, Request
 from pydantic import BaseModel
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
 
 from meshbay_hub.api.deps import get_current_user
-from meshbay_hub.db.models import User
+from meshbay_hub.api.middleware import limiter
+from meshbay_hub.db.engine import get_db
+from meshbay_hub.db.models import Group, GroupMember, User
 
 log = logging.getLogger(__name__)
 
@@ -41,25 +45,66 @@ class WebRTCOfferResponse(BaseModel):
     peer_id: str
 
 
+MAX_SDP_BYTES = 16 * 1024          # an SDP offer is ~2 KB
+MAX_PENDING_PER_USER = 3           # concurrent in-flight offers per account
+
+_pending_per_user: dict[str, int] = {}
+
+
 @router.post("/{node_id}/webrtc/offer", response_model=WebRTCOfferResponse)
+@limiter.limit("30/minute")
 async def webrtc_offer(
     node_id: str,
     body: WebRTCOfferRequest,
+    request: Request,
     current_user: User = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
 ):
     """
     Browser sends WebRTC SDP offer for a node. Hub relays via WebSocket.
     Returns the node's SDP answer once received.
+
+    Finding H6: this was reachable by any authenticated user, for any node, with no
+    rate limit and no membership check. Each call makes the node allocate an
+    aiortc RTCPeerConnection and gather ICE, so it was a remote resource-exhaustion
+    primitive against an arbitrary third party's machine.
+
+    Finding H4: it also ignored group status, so "suspend a group" did not stop new
+    connections from being brokered to nodes hosting it.
     """
-    from meshbay_hub.api.revocation import _connected_nodes
+    from meshbay_hub.api.revocation import _connected_nodes, _node_groups
+
+    if len(body.sdp) > MAX_SDP_BYTES:
+        raise HTTPException(status_code=413, detail="SDP too large")
 
     ws = _connected_nodes.get(node_id)
     if not ws:
         raise HTTPException(status_code=404, detail="Node not connected")
 
+    # The caller must share at least one active group with the target node.
+    node_group_ids = set(_node_groups.get(node_id, []))
+    if node_group_ids:
+        result = await db.execute(
+            select(GroupMember.group_id).where(
+                GroupMember.user_id == current_user.id,
+                GroupMember.group_id.in_(node_group_ids),
+            ))
+        shared = [gid for (gid,) in result.all()]
+        if not shared:
+            raise HTTPException(status_code=403, detail="Not a member of any group on this node")
+
+        active = await db.execute(
+            select(Group.id).where(Group.id.in_(shared), Group.status == "active"))
+        if not active.first():
+            raise HTTPException(status_code=403, detail="Group is not active")
+
+    if _pending_per_user.get(current_user.id, 0) >= MAX_PENDING_PER_USER:
+        raise HTTPException(status_code=429, detail="Too many pending connections")
+
     peer_id = str(uuid.uuid4())
     answer_future: asyncio.Future = asyncio.get_event_loop().create_future()
     _webrtc_answers[peer_id] = answer_future
+    _pending_per_user[current_user.id] = _pending_per_user.get(current_user.id, 0) + 1
 
     try:
         await ws.send_text(json.dumps({
@@ -83,6 +128,11 @@ async def webrtc_offer(
         )
     finally:
         _webrtc_answers.pop(peer_id, None)
+        remaining = _pending_per_user.get(current_user.id, 1) - 1
+        if remaining > 0:
+            _pending_per_user[current_user.id] = remaining
+        else:
+            _pending_per_user.pop(current_user.id, None)
 
 
 def handle_webrtc_answer(msg: dict) -> None:
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/users.py b/packages/meshbay-hub/src/meshbay_hub/api/users.py
index 53238de..af9141c 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/users.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/users.py
@@ -5,7 +5,7 @@ import uuid
 from datetime import datetime, timezone, timedelta
 
 from fastapi import APIRouter, Depends, HTTPException, Request, status
-from pydantic import BaseModel, EmailStr, field_validator
+from pydantic import BaseModel, field_validator
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
@@ -22,6 +22,7 @@ from meshbay_hub.auth import (
     verify_password,
 )
 from meshbay_hub.api.middleware import limiter
+from meshbay_hub.api.netutil import client_ip
 from meshbay_hub.config import HubConfig
 from meshbay_hub.db.engine import get_db
 from meshbay_hub.db.models import GroupMember, IPLog, RefreshToken, User
@@ -49,8 +50,6 @@ class RegisterRequest(BaseModel):
     email:           str
     password:        str | None = None    # deprecated — legacy native clients
     auth_key:        str | None = None    # PBKDF2-derived, new clients
-    pk_user_ed25519: str        # base64 raw 32B
-    pk_user_x25519:  str        # base64 raw 32B
 
     @field_validator("username")
     @classmethod
@@ -62,6 +61,24 @@ class RegisterRequest(BaseModel):
             raise ValueError("username: only letters, digits, -, _, .")
         return v
 
+    @field_validator("email")
+    @classmethod
+    def email_valid(cls, v: str) -> str:
+        """
+        Sanity-check the address (L6): the field was plain `str`, so any junk was
+        accepted and stored encrypted forever. Deliberately not RFC 5322 — full
+        validation would pull in the email-validator dependency for little gain,
+        and the address is only ever used for recovery and legal contact.
+        """
+        v = v.strip()
+        local, sep, domain = v.partition("@")
+        if (not sep or not local or not domain
+                or "." not in domain
+                or len(v) > 254
+                or any(c.isspace() or ord(c) < 32 for c in v)):
+            raise ValueError("invalid email address")
+        return v
+
 
 class LoginRequest(BaseModel):
     username: str
@@ -101,26 +118,27 @@ async def register(
         pw_hash=pw_hash,
         pw_salt=pw_salt,
         pw_version=pw_ver,
-        pk_ed25519=body.pk_user_ed25519,
-        pk_x25519=body.pk_user_x25519,
         hub_id=hub_id,
     )
     db.add(user)
+    # flush assigns user.id so the log row can be attributed directly.
+    #
+    # Finding M6: this used to insert the row with a NULL user_id and then run
+    #   UPDATE ip_logs SET user_id = <new user> WHERE user_id IS NULL
+    # which claimed *every* unattributed row in the table — failed logins for other
+    # usernames, other registrations racing this one — and stamped them with the
+    # account just created. For logs retained a year to answer legal requests, that
+    # attributed other people's connections to the wrong person.
+    await db.flush()
     db.add(IPLog(
+        user_id=user.id,
         event="account_create",
-        ip_address=_client_ip(request),
+        ip_address=client_ip(request),
         detail=body.username,
     ))
     await db.commit()
     await db.refresh(user)
 
-    # Set user_id in IPLog after commit
-    await db.execute(
-        IPLog.__table__.update()
-        .where(IPLog.user_id == None)  # noqa: E711
-        .values(user_id=user.id))
-    await db.commit()
-
     return {"user_id": user.id}
 
 
@@ -135,7 +153,7 @@ async def login(
         select(User).where(User.username == body.username))
     user = result.scalar_one_or_none()
 
-    ip = _client_ip(request)
+    ip = client_ip(request)
 
     if not body.auth_key and not body.password:
         raise HTTPException(status_code=401, detail="No credentials provided")
@@ -189,8 +207,7 @@ async def login(
     memberships = await db.execute(
         select(GroupMember.group_id).where(GroupMember.user_id == user.id))
     group_ids = [gid for (gid,) in memberships.all()]
-    access_token = issue_access_token(
-        user.id, user.pk_ed25519, ttl=_ttl(), groups=group_ids)
+    access_token = issue_access_token(user.id, ttl=_ttl(), groups=group_ids)
     raw_rt, rt_hash = generate_refresh_token()
     family_id = str(uuid.uuid4())
 
@@ -255,8 +272,7 @@ async def token_refresh(
     memberships = await db.execute(
         select(GroupMember.group_id).where(GroupMember.user_id == user.id))
     group_ids = [gid for (gid,) in memberships.all()]
-    new_access = issue_access_token(
-        user.id, user.pk_ed25519, ttl=_ttl(), groups=group_ids)
+    new_access = issue_access_token(user.id, ttl=_ttl(), groups=group_ids)
     await db.commit()
 
     return {
@@ -302,39 +318,10 @@ async def register_node_key(
     return {"status": "stored", "pk_node_ed25519": body.pk_node_ed25519}
 
 
-class RotateKeysRequest(BaseModel):
-    pk_user_ed25519: str  # base64 raw 32B
-    pk_user_x25519: str   # base64 raw 32B
-
-
-@router.put("/me/keys")
-async def rotate_browser_keys(
-    body: RotateKeysRequest,
-    current_user: User = Depends(require_user_scope),
-    db: AsyncSession = Depends(get_db),
-):
-    for field, label in [
-        (body.pk_user_ed25519, "Ed25519"),
-        (body.pk_user_x25519, "X25519"),
-    ]:
-        try:
-            raw = base64.b64decode(field)
-            if len(raw) != 32:
-                raise ValueError
-        except Exception:
-            raise HTTPException(
-                status_code=400,
-                detail=f"Invalid {label} public key (need 32 bytes base64)",
-            )
-
-    current_user.pk_ed25519 = body.pk_user_ed25519
-    current_user.pk_x25519 = body.pk_user_x25519
-    await db.commit()
-    return {
-        "status": "updated",
-        "pk_ed25519": body.pk_user_ed25519,
-        "pk_x25519": body.pk_user_x25519,
-    }
+# Key rotation used to live here (`PUT /me/keys`). Identity keys are per node
+# now, so rotating means `meshbay-node member unpin <user>` and pairing again with
+# a fresh code — an operator decision on the machine that pinned it, not a hub
+# call that silently changes what every node believes about someone.
 
 
 @router.get("/{username}/pubkeys")
@@ -347,19 +334,16 @@ async def get_user_pubkeys(
     target = result.scalar_one_or_none()
     if not target:
         raise HTTPException(status_code=404, detail="User not found")
+    # Account lookup, not a key directory. `user_id` is how a username is resolved
+    # for an invitation, and `pk_node_ed25519` is a node's own linking key. The
+    # user identity keys this used to return were H3: whoever asked wrapped the
+    # group key for whatever came back.
     resp = {
-        "user_id":    target.id,
-        "username":   target.username,
-        "pk_ed25519": target.pk_ed25519,
-        "pk_x25519":  target.pk_x25519,
+        "user_id":  target.id,
+        "username": target.username,
     }
     if target.pk_node_ed25519:
         resp["pk_node_ed25519"] = target.pk_node_ed25519
     return resp
 
 
-def _client_ip(request: Request) -> str:
-    forwarded = request.headers.get("X-Forwarded-For")
-    if forwarded:
-        return forwarded.split(",")[0].strip()
-    return request.client.host if request.client else "unknown"
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/webapp.py b/packages/meshbay-hub/src/meshbay_hub/api/webapp.py
index 5ad7329..f804ec5 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/webapp.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/webapp.py
@@ -47,6 +47,10 @@ _HTML = """\
 </head>
 <body>
   <div id="app"></div>
+  <!-- Argon2id (WebAssembly, inlined) — WebCrypto has no memory-hard KDF, and the
+       keypair bundle needs one: it is protected by the passphrase alone and sits
+       on every node its owner joins (C4). Vendored, see static/vendor/PROVENANCE.md -->
+  <script src="/vendor/argon2.min.js"></script>
   <script src="/keyderive.js"></script>
   <script src="/crypto.js"></script>
   <script src="/transport.js"></script>
diff --git a/packages/meshbay-hub/src/meshbay_hub/app.py b/packages/meshbay-hub/src/meshbay_hub/app.py
index 7011bf0..668ae24 100644
--- a/packages/meshbay-hub/src/meshbay_hub/app.py
+++ b/packages/meshbay-hub/src/meshbay_hub/app.py
@@ -25,7 +25,7 @@ from meshbay_hub.api.hub        import router as hub_router
 from meshbay_hub.api.users      import router as users_router, set_config as users_set_config
 from meshbay_hub.api.deps       import set_admin_usernames
 from meshbay_hub.api.nodes      import router as nodes_router
-from meshbay_hub.api.groups     import router as groups_router
+from meshbay_hub.api.groups     import router as groups_router, swarm_router
 from meshbay_hub.api.revocation  import router as revocation_router
 from meshbay_hub.api.moderation  import router as moderation_router
 from meshbay_hub.api.federation  import router as federation_router
@@ -110,6 +110,7 @@ def create_app(cfg: HubConfig | None = None) -> FastAPI:
     app.include_router(users_router)
     app.include_router(nodes_router)
     app.include_router(groups_router)
+    app.include_router(swarm_router)
     app.include_router(revocation_router)
     app.include_router(moderation_router)
     app.include_router(federation_router)
diff --git a/packages/meshbay-hub/src/meshbay_hub/auth.py b/packages/meshbay-hub/src/meshbay_hub/auth.py
index 563a1eb..28f13a5 100644
--- a/packages/meshbay-hub/src/meshbay_hub/auth.py
+++ b/packages/meshbay-hub/src/meshbay_hub/auth.py
@@ -131,13 +131,17 @@ def current_pw_version() -> int:
 
 def issue_access_token(
     user_id: str,
-    pk_user: str,
     ttl: int = 3600,
     groups: list[str] | None = None,
     scope: str = "user",
 ) -> str:
     """
     Issue a signed JWT access token.
+
+    Carries no user key. It used to, and the node recorded that key as the
+    uploader's identity — so the party issuing tokens decided who could delete a
+    file. The hub certifies accounts; nodes pin keys.
+
     Includes jti (UUID4) — required to prevent replay and enable revocation.
     Includes groups — list of group_ids the user is a member of (node-side authz).
     scope: "user" (browser, full access) or "node" (daemon, restricted).
@@ -148,7 +152,6 @@ def issue_access_token(
     payload = {
         "iss":     _hub_id,
         "sub":     user_id,
-        "pk_user": pk_user,
         "hub_id":  _hub_id,
         "jti":     str(uuid.uuid4()),
         "iat":     now,
diff --git a/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/a7c31f9e40b2_drop_user_identity_keys.py b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/a7c31f9e40b2_drop_user_identity_keys.py
new file mode 100644
index 0000000..c581e55
--- /dev/null
+++ b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/a7c31f9e40b2_drop_user_identity_keys.py
@@ -0,0 +1,37 @@
+"""drop_user_identity_keys
+
+The hub published `users.pk_ed25519` / `users.pk_x25519` as a key directory, and
+the invite flow wrapped the group key for whatever it returned — finding H3. Since
+the node wraps the group key itself, for a key its owner proves possession of,
+nothing reads these columns. Identity keys are generated per node and pinned there
+(`meshbay_node/roster.py`), so there is no hub-side key to publish at all.
+
+Downgrade restores the columns, but not their contents: the keys they held were
+never the hub's to reproduce.
+
+Revision ID: a7c31f9e40b2
+Revises: 2041a4060b3c
+Create Date: 2026-08-14
+
+"""
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+revision: str = 'a7c31f9e40b2'
+down_revision: Union[str, Sequence[str], None] = '2041a4060b3c'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.drop_column('users', 'pk_ed25519')
+    op.drop_column('users', 'pk_x25519')
+
+
+def downgrade() -> None:
+    # Nullable on the way back: the previous schema required them, and nothing
+    # can invent a key that belonged to a user.
+    op.add_column('users', sa.Column('pk_ed25519', sa.String(64), nullable=True))
+    op.add_column('users', sa.Column('pk_x25519', sa.String(64), nullable=True))
diff --git a/packages/meshbay-hub/src/meshbay_hub/db/models.py b/packages/meshbay-hub/src/meshbay_hub/db/models.py
index cdebd3c..a75217b 100644
--- a/packages/meshbay-hub/src/meshbay_hub/db/models.py
+++ b/packages/meshbay-hub/src/meshbay_hub/db/models.py
@@ -42,8 +42,10 @@ class User(Base):
     pw_hash:     Mapped[bytes] = mapped_column(nullable=False)
     pw_salt:     Mapped[bytes] = mapped_column(nullable=False)
     pw_version:  Mapped[int]  = mapped_column(Integer, default=1)
-    pk_ed25519:  Mapped[str] = mapped_column(String(64), nullable=False)    # base64 raw 32B
-    pk_x25519:   Mapped[str] = mapped_column(String(64), nullable=False)    # base64 raw 32B
+    # No user identity keys here. The hub published them and the invite flow
+    # wrapped the group key for whatever it returned, which is finding H3; since
+    # the node does the wrapping, nothing reads a key from this directory. Keys
+    # are generated per node and pinned there (meshbay_node/roster.py).
     pk_node_ed25519: Mapped[str | None] = mapped_column(String(64), nullable=True)  # node daemon key
     hub_id:           Mapped[str] = mapped_column(String(128), nullable=False)
     role:             Mapped[str] = mapped_column(String(16), default="user")  # user|moderator|admin
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/app.js b/packages/meshbay-hub/src/meshbay_hub/static/app.js
index ddff928..3087e0e 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/app.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/app.js
@@ -65,9 +65,13 @@ async function getAllCachedIndexes() {
 
 // ── Auth persistence ─────────────────────────────────────────────────────────
 
-let _sessionKeys = null;
+// The key that opens a node's keypair bundle, derived once at sign-in. There is
+// no global identity to keep: identity keys belong to a node and are fetched from
+// it (transport.js), so nothing of that kind lives here.
 let _bundleKey = null;
-let _pendingBundlePush = null;
+// A one-time pairing code the user just typed, consumed by the next connection
+// attempt. Deliberately not persisted: it is single-use and short-lived.
+let _pendingJoinCode = null;
 
 function _openKeyDB() {
   return new Promise((resolve, reject) => {
@@ -105,18 +109,45 @@ async function _clearKeyDB() {
     db.close();
   } catch {}
 }
-function _saveSessionKeys() {
-  try {
-    if (_sessionKeys) sessionStorage.setItem('meshbay_sk', JSON.stringify(_sessionKeys));
-  } catch {}
+/**
+ * Rough passphrase strength, in bits, and what it is up against.
+ *
+ * This number carries more weight here than in most applications. The encrypted
+ * keypair bundle is protected by PBKDF2-SHA512 (600k) and sits on every node
+ * whose group you join, so the people who host your groups can attack it offline
+ * (finding C4). PBKDF2 is memory-light, which is exactly what GPUs are good at.
+ *
+ * The estimate is deliberately conservative — character classes and length, with
+ * a penalty for repetition and for the handful of patterns everyone tries. It is
+ * a guide, not a guarantee, and it says so in the UI.
+ */
+function passwordBits(pw) {
+  if (!pw) return 0;
+  let pool = 0;
+  if (/[a-z]/.test(pw)) pool += 26;
+  if (/[A-Z]/.test(pw)) pool += 26;
+  if (/[0-9]/.test(pw)) pool += 10;
+  if (/[^A-Za-z0-9]/.test(pw)) pool += 32;
+  let bits = pw.length * Math.log2(pool || 1);
+
+  const unique = new Set(pw).size;
+  if (unique < pw.length / 2) bits *= 0.6;          // "aaaaaaaa", "abcabcabc"
+  if (/^[0-9]+$/.test(pw)) bits *= 0.5;             // dates, PINs
+  if (/(password|motdepasse|azerty|qwerty|123456|meshbay)/i.test(pw)) bits *= 0.3;
+  return Math.round(bits);
 }
-function _restoreSessionKeys() {
-  try {
-    if (!_sessionKeys) {
-      const sk = sessionStorage.getItem('meshbay_sk');
-      if (sk) _sessionKeys = JSON.parse(sk);
-    }
-  } catch {}
+
+const PASSWORD_MIN_BITS = 60;   // refuse below this
+const PASSWORD_MIN_LEN = 12;
+
+/** Public X25519 key from our own secret — never read back from the hub. */
+async function _pkXFromSk(skPkcs8B64) {
+  const raw = Uint8Array.from(atob(skPkcs8B64), c => c.charCodeAt(0));
+  const sk = await crypto.subtle.importKey('pkcs8', raw, { name: 'X25519' }, true, ['deriveBits']);
+  const jwk = await crypto.subtle.exportKey('jwk', sk);
+  const b64 = jwk.x.replace(/-/g, '+').replace(/_/g, '/');
+  const pad = b64.length % 4;
+  return pad ? b64 + '='.repeat(4 - pad) : b64;
 }
 
 function loadAuth() {
@@ -132,11 +163,8 @@ function saveAuth(auth) {
     localStorage.setItem(AUTH_KEY, JSON.stringify(auth));
   } else {
     localStorage.removeItem(AUTH_KEY);
-    _sessionKeys = null;
     _bundleKey = null;
-    _pendingBundlePush = null;
     _clearKeyDB();
-    try { sessionStorage.removeItem('meshbay_sk'); } catch {}
   }
 }
 
@@ -390,7 +418,14 @@ function RegisterPage() {
   const onSubmit = async (e) => {
     e.preventDefault();
     if (password !== confirm) { setError(t('register.err_mismatch')); return; }
-    if (password.length < 8) { setError(t('register.err_min_len')); return; }
+    if (password.length < PASSWORD_MIN_LEN) {
+      setError(t('register.err_min_len', { n: PASSWORD_MIN_LEN })); return;
+    }
+    // The floor can only live here: with the password split (T1) the hub never
+    // sees the password, so it cannot enforce anything about it.
+    if (passwordBits(password) < PASSWORD_MIN_BITS) {
+      setError(t('register.err_too_weak')); return;
+    }
     setError('');
     setLoading(true);
     try {
@@ -438,6 +473,18 @@ function RegisterPage() {
           <input type="password" placeholder="${t('register.password')}" value=${password}
                  onInput=${e => setPassword(e.target.value)}
                  autocomplete="new-password" required minlength="8" />
+          ${password && html`
+            <div style="margin:-4px 0 10px">
+              <div style="height:4px;background:var(--border);border-radius:2px;overflow:hidden">
+                <div style=${`height:100%;width:${Math.min(100, passwordBits(password) / 100 * 100)}%;
+                     background:${passwordBits(password) < PASSWORD_MIN_BITS ? 'var(--error)'
+                       : passwordBits(password) < 80 ? 'var(--yellow, #f59e0b)' : 'var(--success)'}`}></div>
+              </div>
+              <p style="font-size:0.8em;color:var(--text-dim);margin-top:4px">
+                ${t('register.strength', { bits: passwordBits(password) })}
+              </p>
+            </div>
+          `}
           <input type="password" placeholder="${t('register.confirm')}" value=${confirm}
                  onInput=${e => setConfirm(e.target.value)}
                  autocomplete="new-password" required />
@@ -762,7 +809,7 @@ async function pipelinedDownload(transport, gekKey, fileId, totalChunks, onChunk
   return results;
 }
 
-function GroupPage({ groupId, group, token, username, userId }) {
+function GroupPage({ groupId, group, token, username, userId, onRefreshAuth }) {
   const [status, setStatus] = useState('idle');
   const [entries, setEntries] = useState([]);
   const [cached, setCached] = useState(false);
@@ -778,8 +825,25 @@ function GroupPage({ groupId, group, token, username, userId }) {
   const [uploading, setUploading] = useState(false);
   const [menuOpen, setMenuOpen] = useState(null);
   const [isNodeAdmin, setIsNodeAdmin] = useState(false);
+  const [needsCode, setNeedsCode] = useState(false);
+  const [codeInput, setCodeInput] = useState('');
+  const [retryKey, setRetryKey] = useState(0);
   const transportRef = useRef(null);
   const gekRef = useRef(null);
+  // One refresh per mount: if a fresh token still says we are not a member, we
+  // really are not, and retrying forever would hide that.
+  const refreshedRef = useRef(false);
+
+  const submitJoinCode = useCallback((e) => {
+    e.preventDefault();
+    const code = codeInput.trim();
+    if (!code) return;
+    _pendingJoinCode = code;
+    setCodeInput('');
+    setNeedsCode(false);
+    setError('');
+    setRetryKey(k => k + 1);
+  }, [codeInput]);
 
   useEffect(() => {
     if (menuOpen === null) return;
@@ -803,7 +867,6 @@ function GroupPage({ groupId, group, token, username, userId }) {
       setError('');
       gekRef.current = null;
       if (!_bundleKey) _bundleKey = await _loadBundleKey();
-      _restoreSessionKeys();
       try {
         const nodesData = await hubFetch(`/v1/groups/${groupId}/nodes`, { token });
         if (cancelled) return;
@@ -812,11 +875,9 @@ function GroupPage({ groupId, group, token, username, userId }) {
           return;
         }
 
-        // Session keys for P2P GEK bundle fetch (node delivers wrapped GEK)
-        const sessionKeys = _sessionKeys ? {
-          skXB64: _sessionKeys.skXB64,
-          pkXB64: _sessionKeys.pkXB64,
-        } : null;
+        // No keys are carried in: the transport fetches this node's identity
+        // from the node, or creates one there on a first join.
+        const sessionKeys = null;
 
         setStatus('connecting');
         const nodeId = nodesData.nodes[0].node_id;
@@ -824,34 +885,21 @@ function GroupPage({ groupId, group, token, username, userId }) {
         transportRef.current = transport;
 
         const ack = await transport.connect(
-          nodeId, token, groupId, null, sessionKeys, _bundleKey, username);
+          nodeId, token, groupId, null, sessionKeys, _bundleKey, username,
+          userId, _pendingJoinCode);
+        _pendingJoinCode = null;
         if (cancelled) return;
         setIsNodeAdmin(!!ack.is_node_admin);
 
-        // If transport recovered different session keys from node during handshake
-        if (transport.sessionKeys) {
-          const recovered = transport.sessionKeys;
-          if (!_sessionKeys || recovered.skXB64 !== _sessionKeys.skXB64) {
-            _sessionKeys = recovered;
-            if (!_sessionKeys.pkXB64) {
-              const pubkeys = await hubFetch(
-                `/v1/users/${username}/pubkeys`, { token });
-              _sessionKeys.pkXB64 = pubkeys.pk_x25519;
-            }
-            _pendingBundlePush = null;
-            try { localStorage.removeItem(`meshbay_kp_${username}`); } catch {}
-            _saveSessionKeys();
-          }
-        }
-
-        // Push keypair bundle to node (new registration, localStorage → node)
-        if (_pendingBundlePush && transport.connected) {
+        // A first join to this node generated an identity for it; leave it with
+        // the node so any other browser can become the same person here with the
+        // passphrase. It is this node's key and no other's.
+        if (transport.connected && transport.newNodeBundle) {
           try {
-            await transport.storeKeypairBundle(_pendingBundlePush);
-            try { localStorage.removeItem(`meshbay_kp_${username}`); } catch {}
-            _pendingBundlePush = null;
+            await transport.storeKeypairBundle(transport.newNodeBundle);
+            transport.newNodeBundle = null;
           } catch (e) {
-            console.warn('[MeshBay] Bundle push to node deferred:', e.message);
+            console.warn('[MeshBay] could not leave our key with the node:', e.message);
           }
         }
 
@@ -880,10 +928,24 @@ function GroupPage({ groupId, group, token, username, userId }) {
 
         cacheGroupIndex(groupId, group ? group.name : groupId, freshEntries);
       } catch (err) {
-        if (!cancelled) {
-          setError(err.message);
-          setStatus('error');
+        if (cancelled) return;
+
+        // Our token predates being added to this group. Refresh once and retry
+        // rather than telling someone who was just invited that they are not a
+        // member — which is what the node honestly sees, and is useless to them.
+        if (err.reason === 'not_a_member' && !refreshedRef.current && onRefreshAuth) {
+          refreshedRef.current = true;
+          try {
+            if (await onRefreshAuth()) return;   // new token → effect re-runs
+          } catch { /* fall through to the message below */ }
         }
+
+        // The node has never seen this browser for this account: it needs a
+        // one-time code from the operator before it will hand over the group
+        // key. Not an error to shout about — a step in joining.
+        if (err.reason === 'code_required') setNeedsCode(true);
+        setError(err.message);
+        setStatus('error');
       }
     };
 
@@ -902,7 +964,7 @@ function GroupPage({ groupId, group, token, username, userId }) {
         transportRef.current = null;
       }
     };
-  }, [groupId, token]);
+  }, [groupId, token, retryKey]);
 
   const downloadFile = useCallback(async (entry) => {
     const transport = transportRef.current;
@@ -979,8 +1041,13 @@ function GroupPage({ groupId, group, token, username, userId }) {
     const transport = transportRef.current;
     if (!transport || !transport.connected) return;
     try {
-      const signFn = (_sessionKeys && window.MeshBayKeys)
-        ? (challenge) => window.MeshBayKeys.signChallenge(_sessionKeys.skEdB64, challenge)
+      // Signs an explicit transcript built by transport.js, not opaque bytes from
+      // the node — see MeshBayCrypto.adminTranscript and finding H5.
+      // Signed with the identity this node pinned for us — the only one it
+      // will accept, and the only one we hold here.
+      const sk = transport.sessionKeys && transport.sessionKeys.skEdB64;
+      const signFn = (sk && window.MeshBayKeys)
+        ? (transcript) => window.MeshBayKeys.signBytes(sk, transcript)
         : null;
       await transport.deleteFile(entry.id, signFn);
       const indexMsg = await transport.fetchIndex();
@@ -1077,6 +1144,17 @@ function GroupPage({ groupId, group, token, username, userId }) {
         `}
       </div>
       ${error && html`<div class="error-msg" style="margin-bottom:12px">${error}</div>`}
+      ${needsCode && html`
+        <form class="invite-form" style="margin-bottom:12px" onSubmit=${submitJoinCode}>
+          <h4>${t('group.join_code_title')}</h4>
+          <p class="settings-hint">${t('group.join_code_hint')}</p>
+          <div style="display:flex;gap:8px">
+            <input type="text" placeholder="XXXX-XXXX" style="font-family:monospace"
+              value=${codeInput} onInput=${e => setCodeInput(e.target.value)} required />
+            <button class="admin-btn" type="submit">${t('group.join_code_btn')}</button>
+          </div>
+        </form>
+      `}
       ${dlState && html`
         <div class="dl-bar">
           <span class="dl-name">${dlState.name}</span>
@@ -1222,7 +1300,8 @@ function GroupPage({ groupId, group, token, username, userId }) {
 
         ${tab === 'members' && html`
           <${MembersPanel} groupId=${groupId} group=${group} token=${token}
-            transportRef=${transportRef} gekRef=${gekRef} />
+            transportRef=${transportRef} gekRef=${gekRef}
+            isNodeAdmin=${isNodeAdmin} userId=${userId} />
         `}
       `}
       ${status === 'offline' && html`
@@ -1363,13 +1442,41 @@ function _b64ToU8(b64) {
 
 // ── Members Panel ────────────────────────────────────────────────────────
 
-function MembersPanel({ groupId, group, token, transportRef, gekRef }) {
+function MembersPanel({ groupId, group, token, transportRef, gekRef,
+                       isNodeAdmin, userId }) {
   const [members, setMembers] = useState([]);
   const [adminId, setAdminId] = useState('');
   const [loading, setLoading] = useState(true);
   const [inviteUser, setInviteUser] = useState('');
   const [inviting, setInviting] = useState(false);
   const [error, setError] = useState('');
+  const [inviteCode, setInviteCode] = useState(null);
+  const [pairCode, setPairCode] = useState('');
+  const [pairStatus, setPairStatus] = useState('');
+  const [pairing, setPairing] = useState(false);
+
+  // Pairing lives here rather than in Settings because this is where a live
+  // connection to the node exists — and it is offered only when the node itself
+  // says this account is its operator (is_node_admin comes from the authenticated
+  // handshake_ack, not from the hub).
+  const doPair = useCallback(async (e) => {
+    e.preventDefault();
+    const code = pairCode.trim();
+    if (!code) return;
+    setPairing(true);
+    setPairStatus('');
+    try {
+      const transport = transportRef && transportRef.current;
+      if (!transport || !transport.connected) throw new Error('Not connected to the node');
+      await transport.pairOperator(userId, code);
+      setPairCode('');
+      setPairStatus('paired');
+    } catch (err) {
+      setPairStatus(err.message);
+    } finally {
+      setPairing(false);
+    }
+  }, [pairCode, transportRef, userId]);
 
   const loadMembers = useCallback(() => {
     setLoading(true);
@@ -1391,29 +1498,37 @@ function MembersPanel({ groupId, group, token, transportRef, gekRef }) {
     if (!inviteUser.trim()) return;
     setInviting(true);
     setError('');
+    setInviteCode(null);
     try {
       const transport = transportRef && transportRef.current;
       const username = inviteUser.trim();
-
-      // Fetch invitee's public keys (hub = public key directory)
-      const pubkeys = await hubFetch(`/v1/users/${username}/pubkeys`, { token });
-      const pkXBytes = Uint8Array.from(atob(pubkeys.pk_x25519), c => c.charCodeAt(0));
-
-      // Get raw GEK from the active transport connection
-      if (!transport || !transport.connected || !transport.gekRaw) {
-        throw new Error('Not connected to node or no GEK available');
+      if (!transport || !transport.connected) {
+        throw new Error('Not connected to the node — it must be online to invite');
       }
-      const gekBytes = transport.gekRaw;
 
-      // Wrap GEK for invitee and store on node via P2P
-      const bundle = await window.MeshBayCrypto.wrapGEK(gekBytes, pkXBytes);
-      await transport.storeGekBundle(pubkeys.user_id, groupId, bundle);
+      // The hub is asked for the account id, and nothing else. It is no longer
+      // asked for the invitee's public key: the node wraps the group key itself,
+      // for a key the invitee proves possession of when they connect (H3). A hub
+      // that answered with the wrong account here would produce an invite whose
+      // code it never learns — the code goes to a human, out of band.
+      const account = await hubFetch(`/v1/users/${username}/pubkeys`, { token });
 
-      // Add member on hub (membership management only)
+      // Signed with the identity this node pinned for us — the only one it
+      // will accept, and the only one we hold here.
+      const sk = transport.sessionKeys && transport.sessionKeys.skEdB64;
+      const signFn = (sk && window.MeshBayKeys)
+        ? (transcript) => window.MeshBayKeys.signBytes(sk, transcript)
+        : null;
+      const result = await transport.createInvite(
+        account.user_id, groupId, username, signFn);
+
+      // Membership on the hub is what lets them reach the node at all; the code
+      // is what gets them the key.
       await hubFetch(`/v1/groups/${groupId}/members/${username}`, {
         method: 'POST', token, body: {},
       });
 
+      setInviteCode({ username, code: result.code, expires: result.expires_at });
       setInviteUser('');
       loadMembers();
     } catch (err) {
@@ -1421,7 +1536,7 @@ function MembersPanel({ groupId, group, token, transportRef, gekRef }) {
     } finally {
       setInviting(false);
     }
-  }, [groupId, token, inviteUser, loadMembers]);
+  }, [groupId, token, inviteUser, loadMembers, transportRef]);
 
   if (loading) return html`<p class="page-message">${t('explore.loading')}</p>`;
 
@@ -1452,6 +1567,15 @@ function MembersPanel({ groupId, group, token, transportRef, gekRef }) {
         <form class="invite-form" onSubmit=${doInvite}>
           <h4>${t('members.invite_title')}</h4>
           ${error && html`<p class="error-msg">${error}</p>`}
+          ${inviteCode && html`
+            <div class="success-msg" style="margin-bottom:8px">
+              <p>${t('members.invite_code_ready', { user: inviteCode.username })}</p>
+              <p style="font-family:monospace;font-size:1.4em;letter-spacing:2px;margin:6px 0">
+                ${inviteCode.code}
+              </p>
+              <p>${t('members.invite_code_hint')}</p>
+            </div>
+          `}
           <div style="display:flex;gap:8px">
             <input type="text" placeholder="${t('members.username_placeholder')}"
               value=${inviteUser} onInput=${e => setInviteUser(e.target.value)} required />
@@ -1461,6 +1585,24 @@ function MembersPanel({ groupId, group, token, transportRef, gekRef }) {
           </div>
         </form>
       `}
+      ${isNodeAdmin && html`
+        <form class="invite-form" onSubmit=${doPair}>
+          <h4>${t('members.pair_title')}</h4>
+          <p class="settings-hint">${t('members.pair_hint')}</p>
+          ${pairStatus && html`
+            <p class=${pairStatus === 'paired' ? 'success-msg' : 'error-msg'}>
+              ${pairStatus === 'paired' ? t('members.pair_success') : pairStatus}
+            </p>
+          `}
+          <div style="display:flex;gap:8px">
+            <input type="text" placeholder="XXXX-XXXX" style="font-family:monospace"
+              value=${pairCode} onInput=${e => setPairCode(e.target.value)} required />
+            <button class="admin-btn" type="submit" disabled=${pairing}>
+              ${pairing ? '...' : t('members.pair_btn')}
+            </button>
+          </div>
+        </form>
+      `}
     </div>
   `;
 }
@@ -1969,6 +2111,15 @@ function SettingsPage({ user, theme, onThemeChange, groups }) {
   const [currentNodeKey, setCurrentNodeKey] = useState(null);
   const [nodeKeyStatus, setNodeKeyStatus] = useState('');
   const [nodeKeyLoading, setNodeKeyLoading] = useState(false);
+  const [pinCount, setPinCount] = useState(
+    () => (window.MeshBayTransport?.pinnedNodeCount?.() ?? 0));
+
+  // 11.5.8: node identity pins are refused strictly on change, so users need a
+  // deliberate way to accept a legitimate rotation (operator reinstalled a node).
+  const clearPins = useCallback(() => {
+    window.MeshBayTransport?.clearNodePin?.();
+    setPinCount(window.MeshBayTransport?.pinnedNodeCount?.() ?? 0);
+  }, []);
 
   useEffect(() => {
     hubFetch(`/v1/users/${user.username}/pubkeys`, { token: user.token })
@@ -2060,6 +2211,17 @@ function SettingsPage({ user, theme, onThemeChange, groups }) {
       </div>
 
       <div class="settings-section">
+        <h3 class="settings-heading">${t('settings.node_pins')}</h3>
+        <p class="settings-hint">${t('settings.node_pins_hint')}</p>
+        <div class="settings-row">
+          <span class="settings-label">${t('settings.node_pins_count', { n: pinCount })}</span>
+          <button class="btn-secondary" onClick=${clearPins} disabled=${pinCount === 0}>
+            ${t('settings.node_pins_clear')}
+          </button>
+        </div>
+      </div>
+
+      <div class="settings-section">
         <h3 class="settings-heading">${t('settings.appearance')}</h3>
         <div class="settings-row">
           <span class="settings-label">${t('settings.theme')}</span>
@@ -2501,12 +2663,10 @@ function App() {
         const data = await window.MeshBayKeys.loginAndRecover(username, password);
         token = data.accessToken;
         refreshToken = data.refreshToken;
+        // The only thing sign-in produces: the key that opens a node's bundle.
+        // Which identity we use is decided per node, when we get there.
         _bundleKey = data.bundleKey;
         await _storeBundleKey(_bundleKey);
-        if (data.skXB64) {
-          _sessionKeys = { skXB64: data.skXB64, skEdB64: data.skEdB64 };
-          _pendingBundlePush = data.keypairBundleEnc;
-        }
       } else {
         const data = await hubFetch('/v1/users/login', {
           method: 'POST',
@@ -2516,11 +2676,6 @@ function App() {
         refreshToken = data.refresh_token;
       }
       const me = await hubFetch('/v1/users/me', { token });
-      if (_sessionKeys) {
-        const pubkeys = await hubFetch(`/v1/users/${username}/pubkeys`, { token });
-        _sessionKeys.pkXB64 = pubkeys.pk_x25519;
-        _saveSessionKeys();
-      }
       const u = { username, userId: me.user_id, token, refreshToken, role: me.role };
       setUser(u);
       saveAuth(u);
@@ -2533,6 +2688,20 @@ function App() {
     },
   };
 
+  // Group membership is baked into the access token at login and the hub does not
+  // push updates, so someone invited after they signed in carries a token that
+  // says they are in nothing. Refreshing re-reads membership from the database.
+  const refreshAuth = useCallback(async () => {
+    if (!user || !user.refreshToken) return null;
+    const data = await hubFetch('/v1/users/token/refresh', {
+      method: 'POST', body: { refresh_token: user.refreshToken },
+    });
+    const u = { ...user, token: data.access_token };
+    setUser(u);
+    saveAuth(u);
+    return data.access_token;
+  }, [user]);
+
   let page;
   if (route === '/login' || route === '/register') {
     page = route === '/register'
@@ -2557,7 +2726,8 @@ function App() {
     const group = groups.find(g => g.id === groupId);
     page = html`<${GroupPage}
       groupId=${groupId} group=${group} token=${user.token}
-      username=${user.username} userId=${user.userId} />`;
+      username=${user.username} userId=${user.userId}
+      onRefreshAuth=${refreshAuth} />`;
   } else if (route === '/admin') {
     page = (user.role === 'moderator' || user.role === 'admin')
       ? html`<${AdminPage} token=${user.token} />`
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/crypto.js b/packages/meshbay-hub/src/meshbay_hub/static/crypto.js
index 5ebf624..21bf05d 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/crypto.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/crypto.js
@@ -230,24 +230,133 @@ function b64encode(bytes) {
   return btoa(String.fromCharCode(...bytes));
 }
 
+// ── Admin operation transcript ───────────────────────────────────────────────
+// Mirrors meshbay_common/adminop.py::admin_transcript(). Both sides build these
+// bytes independently; they are never taken off the wire.
+//
+// Finding H5: the client used to sign 32 raw random bytes chosen by the node — a
+// blind signing oracle. It now reconstructs a domain-separated, length-prefixed
+// transcript naming the operation, subject, node and group, so the UI can show the
+// user what they are authorizing and a signature cannot be reused elsewhere.
+
+const ADMIN_TRANSCRIPT_PREFIX = new TextEncoder().encode('meshbay:admin:v1');
+
+function adminTranscript(op, nodePkB64, groupId, subject, nonceB64, ts) {
+  const enc = new TextEncoder();
+  const fields = [
+    enc.encode(op),
+    enc.encode(nodePkB64),
+    enc.encode(groupId),
+    enc.encode(subject),
+    b64decode(nonceB64),
+    enc.encode(String(ts)),
+  ];
+  let total = ADMIN_TRANSCRIPT_PREFIX.length;
+  for (const f of fields) total += 4 + f.length;
+
+  const out = new Uint8Array(total);
+  out.set(ADMIN_TRANSCRIPT_PREFIX, 0);
+  let off = ADMIN_TRANSCRIPT_PREFIX.length;
+  for (const f of fields) {
+    new DataView(out.buffer).setUint32(off, f.length, false);
+    off += 4;
+    out.set(f, off);
+    off += f.length;
+  }
+  return out;
+}
+
 // ── GEK proof (HMAC-SHA256 for handshake challenge) ─────────────────────────
 
-async function hmacGEK(gekRaw, nonceB64, offerFp, answerFp) {
-  const nonce = b64decode(nonceB64);
-  const data = concatBuffers([
-    nonce,
-    offerFp || new Uint8Array(0),
-    answerFp || new Uint8Array(0),
+// Mirrors meshbay_common/handshake.py. Every field length-prefixed and the role
+// bound in, so a client proof can never be replayed as a node proof and a missing
+// fingerprint cannot silently degrade the proof to nonce-only (L4).
+const HANDSHAKE_PREFIX = new TextEncoder().encode('meshbay:mnp:handshake:v1');
+
+function _lenPrefixed(parts) {
+  let total = 0;
+  for (const p of parts) total += 4 + p.length;
+  const out = new Uint8Array(total);
+  const view = new DataView(out.buffer);
+  let off = 0;
+  for (const p of parts) {
+    view.setUint32(off, p.length, false);
+    off += 4;
+    out.set(p, off);
+    off += p.length;
+  }
+  return out;
+}
+
+function webrtcBinding(offerFp, answerFp) {
+  if (!offerFp || !offerFp.length || !answerFp || !answerFp.length) {
+    throw new Error('Channel binding unavailable — refusing to handshake');
+  }
+  return _lenPrefixed([offerFp, answerFp]);
+}
+
+function handshakeTranscript(role, groupId, nonceClient, nonceNode, binding) {
+  const enc = new TextEncoder();
+  const body = _lenPrefixed([
+    enc.encode(role), enc.encode(groupId), nonceClient, nonceNode, binding,
   ]);
+  const out = new Uint8Array(HANDSHAKE_PREFIX.length + body.length);
+  out.set(HANDSHAKE_PREFIX, 0);
+  out.set(body, HANDSHAKE_PREFIX.length);
+  return out;
+}
+
+async function handshakeProof(gekRaw, role, groupId, nonceClient, nonceNode, binding) {
+  const transcript = handshakeTranscript(role, groupId, nonceClient, nonceNode, binding);
   const key = await crypto.subtle.importKey(
     'raw', gekRaw, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
-  const sig = await crypto.subtle.sign('HMAC', key, data);
-  return b64encode(new Uint8Array(sig));
+  const sig = await crypto.subtle.sign('HMAC', key, transcript);
+  return new Uint8Array(sig);
+}
+
+// ── Join / pairing transcript ───────────────────────────────────────────────
+
+// Mirrors meshbay_common/join.py. Signing both of our public keys together binds
+// the X25519 key to the Ed25519 identity the node pins, so the node can safely
+// wrap the group key for a key that came over the wire instead of one fetched
+// from the hub's directory (H3). nonce_node ties it to this connection.
+const JOIN_PREFIX = new TextEncoder().encode('meshbay:join:v1');
+
+function joinTranscript(nodePkB64, groupId, userId, pkEdB64, pkXB64, nonceNode, ts) {
+  const enc = new TextEncoder();
+  const body = _lenPrefixed([
+    enc.encode(nodePkB64),
+    enc.encode(groupId),
+    enc.encode(userId),
+    enc.encode(pkEdB64),
+    enc.encode(pkXB64),
+    nonceNode,
+    enc.encode(String(ts)),
+  ]);
+  const out = new Uint8Array(JOIN_PREFIX.length + body.length);
+  out.set(JOIN_PREFIX, 0);
+  out.set(body, JOIN_PREFIX.length);
+  return out;
+}
+
+function constantTimeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+
+/** Verify the node's Ed25519 signature over the handshake transcript (C3). */
+async function verifyNodeSignature(nodePkB64, sigB64, transcript) {
+  const raw = b64decode(nodePkB64);
+  const key = await crypto.subtle.importKey('raw', raw, { name: 'Ed25519' }, false, ['verify']);
+  return crypto.subtle.verify('Ed25519', key, b64decode(sigB64), transcript);
 }
 
 // Export for use in app.js
 window.MeshBayCrypto = {
   importGEK, deriveChunkKey, decryptChunk, decryptChunkBin, decryptFile,
   generateGEK, wrapGEK, unwrapGEK, encryptChunk, b64encode, b64decode,
-  hmacGEK,
+  adminTranscript, handshakeTranscript, handshakeProof, webrtcBinding,
+  joinTranscript, verifyNodeSignature, constantTimeEqual,
 };
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/i18n.js b/packages/meshbay-hub/src/meshbay_hub/static/i18n.js
index 3450735..f0c5cef 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/i18n.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/i18n.js
@@ -38,7 +38,7 @@ const en = {
   'register.title': 'Register',
   'register.username': 'Username',
   'register.email': 'Email',
-  'register.password': 'Password (min 8 chars)',
+  'register.password': 'Passphrase (min 12 chars)',
   'register.confirm': 'Confirm password',
   'register.submit': 'Register',
   'register.loading': 'Creating account...',
@@ -48,7 +48,11 @@ const en = {
   'register.success_msg': 'You can now log in with your credentials.',
   'register.go_login': 'Go to login',
   'register.err_mismatch': 'Passwords do not match',
-  'register.err_min_len': 'Password must be at least 8 characters',
+  'register.err_min_len': 'Use at least {n} characters',
+  'register.err_too_weak': 'Too easy to guess. Your passphrase is what protects '
+    + 'your keys where they are stored — a few unrelated words work well.',
+  'register.strength': 'Strength: about {bits} bits. This protects the copy of '
+    + 'your keys kept on the nodes you join, so it is worth getting right.',
 
   // Home
   'home.welcome': 'Welcome to MeshBay',
@@ -120,6 +124,10 @@ const en = {
   'settings.coming_soon': 'Coming soon.',
   'settings.profile': 'Profile',
   'settings.username': 'Username',
+  'settings.node_pins': 'Node identities',
+  'settings.node_pins_hint': "Each node's identity key is remembered the first time you connect. If it changes, the connection is refused — that is expected only when an operator reinstalls a node. Verify with them before clearing.",
+  'settings.node_pins_count': '{n} pinned',
+  'settings.node_pins_clear': 'Clear pinned identities',
   'settings.appearance': 'Appearance',
   'settings.theme': 'Theme',
   'settings.theme_light': 'Light',
@@ -236,6 +244,22 @@ const en = {
   'members.invite_title': 'Invite member',
   'members.username_placeholder': 'Username',
   'members.invite_btn': 'Invite',
+  'members.pair_title': 'Pair this browser with your node',
+  'members.pair_hint': 'Your node only accepts operator actions — invites, file '
+    + 'deletion — from a browser it has been paired with. Run '
+    + '`meshbay-node operator pair` on the node and type the code here. The code '
+    + 'never passes through the hub, which is what stops the hub from claiming to '
+    + 'be you.',
+  'members.pair_btn': 'Pair',
+  'members.pair_success': 'This browser is now paired with the node.',
+  'members.invite_code_ready': 'Invitation code for {user} — send it to them the way '
+    + 'you normally talk. It works once, and it never passes through the hub.',
+  'members.invite_code_hint': 'They enter it the first time they open this group. '
+    + 'You do not need to be online then.',
+  'group.join_code_title': 'This node needs to recognise you',
+  'group.join_code_hint': 'Ask whoever invited you for the one-time code, and enter '
+    + 'it here. After that this browser is recognised and you will not be asked again.',
+  'group.join_code_btn': 'Join',
 
   'notif.title': 'Notifications',
   'notif.empty': 'No notifications',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js b/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js
index ff3da33..a27522d 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js
@@ -67,11 +67,35 @@ async function generateKeypairs() {
 
 // ── Password → AES key ────────────────────────────────────────────────────────
 
-/**
- * Derive an AES-256 key from password + username using PBKDF2-SHA512.
- * Used for encrypting the keypair bundle.
- */
-async function deriveEncryptionKey(password, username) {
+// Argon2id parameters for the keypair bundle.
+//
+// This is the one KDF in the browser that guards something an adversary can take
+// away and attack at leisure: the bundle is stored on every node whose group its
+// owner joins (finding C4). PBKDF2 was the wrong tool — it is compute-only, which
+// is exactly what a GPU is good at, so 600k iterations bought far less than the
+// wall-clock time suggested.
+//
+// 128 MB / t=3 / p=1 measured at ~640 ms through this WASM build on a desktop.
+// Memory is the lever, not time: each guess must hold 128 MB, so a 24 GB card
+// fits ~187 in parallel and its bandwidth caps it near 2k guesses/s, against no
+// ceiling at all for PBKDF2. 256 MB would double that again at ~1.3 s, which is
+// too much to ask of a phone for something paid at every sign-in.
+const ARGON2_MEM_KIB = 131072;   // 128 MB
+const ARGON2_TIME    = 3;
+const ARGON2_LANES   = 1;
+
+// Bundles written before this carry no marker and are read with the old KDF.
+// They are re-encrypted the first time their owner signs in (see upgradeBundle).
+const BUNDLE_V2_MAGIC = 'MBK2';
+
+function _argon2() {
+  const a = (typeof window !== 'undefined' && window.argon2) || globalThis.argon2;
+  if (!a) throw new Error('Argon2 unavailable — vendor/argon2.min.js did not load');
+  return a;
+}
+
+/** Legacy: PBKDF2-SHA512. Kept to read bundles written before the change. */
+async function deriveEncryptionKeyV1(password, username) {
   const enc   = new TextEncoder();
   const km    = await crypto.subtle.importKey(
     'raw', enc.encode(password), 'PBKDF2', false, ['deriveKey']);
@@ -86,6 +110,27 @@ async function deriveEncryptionKey(password, username) {
   );
 }
 
+/**
+ * Derive the bundle key with Argon2id.
+ *
+ * The salt stays deterministic and domain-separated per user, as before: it is
+ * what lets the key be derived once at sign-in and kept, instead of holding the
+ * passphrase in memory to re-derive it whenever a bundle turns up. It is unique
+ * per account, so it does what a salt is for — no shared precomputation.
+ */
+async function deriveEncryptionKey(password, username) {
+  const enc  = new TextEncoder();
+  const salt = new Uint8Array(await crypto.subtle.digest(
+    'SHA-256', enc.encode(`meshbay:bundle:v2:${username}`))).slice(0, 16);
+  const out = await _argon2().hash({
+    pass: password, salt,
+    time: ARGON2_TIME, mem: ARGON2_MEM_KIB, parallelism: ARGON2_LANES,
+    hashLen: 32, type: _argon2().ArgonType.Argon2id,
+  });
+  return crypto.subtle.importKey(
+    'raw', out.hash, { name: 'AES-GCM' }, false, ['encrypt', 'decrypt']);
+}
+
 // ── Bundle encryption ─────────────────────────────────────────────────────────
 
 /**
@@ -94,29 +139,42 @@ async function deriveEncryptionKey(password, username) {
  */
 async function encryptBundle(skEdRaw, skXRaw, password, username) {
   const aesKey = await deriveEncryptionKey(password, username);
+  return encryptBundleWithKey(skEdRaw, skXRaw, aesKey);
+}
+
+/** Same, when the key was already derived at sign-in. Always writes v2. */
+async function encryptBundleWithKey(skEdRaw, skXRaw, aesKey) {
   const nonce  = crypto.getRandomValues(new Uint8Array(12));
   const data   = new TextEncoder().encode(JSON.stringify({
     skEd: btoa(String.fromCharCode(...new Uint8Array(skEdRaw))),
     skX:  btoa(String.fromCharCode(...new Uint8Array(skXRaw))),
   }));
   const ct = await crypto.subtle.encrypt({ name: 'AES-GCM', iv: nonce }, aesKey, data);
-  // Return base64(nonce || ciphertext)
-  const out = new Uint8Array(nonce.length + ct.byteLength);
-  out.set(nonce);
-  out.set(new Uint8Array(ct), nonce.length);
+  // base64( "MBK2" || nonce || ciphertext ). The marker is what tells a reader
+  // which KDF produced the key, so old bundles stay readable and new ones are
+  // never fed to the old derivation.
+  const magic = new TextEncoder().encode(BUNDLE_V2_MAGIC);
+  const out = new Uint8Array(magic.length + nonce.length + ct.byteLength);
+  out.set(magic);
+  out.set(nonce, magic.length);
+  out.set(new Uint8Array(ct), magic.length + nonce.length);
   return btoa(String.fromCharCode(...out));
 }
 
+function bundleVersion(bundleB64) {
+  try {
+    return atob(bundleB64).startsWith(BUNDLE_V2_MAGIC) ? 2 : 1;
+  } catch { return 1; }
+}
+
 /**
  * Decrypt a keypair bundle. Throws if password is wrong.
  */
 async function decryptBundle(bundleB64, password, username) {
-  const aesKey = await deriveEncryptionKey(password, username);
-  const raw    = Uint8Array.from(atob(bundleB64), c => c.charCodeAt(0));
-  const nonce  = raw.slice(0, 12);
-  const ct     = raw.slice(12);
-  const plain  = await crypto.subtle.decrypt({ name: 'AES-GCM', iv: nonce }, aesKey, ct);
-  return JSON.parse(new TextDecoder().decode(plain));
+  const key = bundleVersion(bundleB64) === 2
+    ? await deriveEncryptionKey(password, username)
+    : await deriveEncryptionKeyV1(password, username);
+  return decryptBundleWithKey(bundleB64, key);
 }
 
 // ── Registration ──────────────────────────────────────────────────────────────
@@ -131,45 +189,62 @@ async function decryptBundle(bundleB64, password, username) {
  * Returns the raw private keys for immediate use after registration.
  */
 async function registerUser(username, email, password) {
-  const { skEdRaw, pkEdRaw, skXRaw, pkXRaw } = await generateKeypairs();
-
-  const pkEdCrypto = await crypto.subtle.importKey('spki', pkEdRaw, 'Ed25519', true, ['verify']);
-  const pkXCrypto  = await crypto.subtle.importKey('spki', pkXRaw,  'X25519',  true, []);
-  const pkEdBytes  = new Uint8Array(await crypto.subtle.exportKey('raw', pkEdCrypto));
-  const pkXBytes   = new Uint8Array(await crypto.subtle.exportKey('raw', pkXCrypto));
-
-  const encBundle = await encryptBundle(skEdRaw, skXRaw, password, username);
+  // No keypair here any more. Identity keys are per node: one is generated the
+  // first time this account joins a given node, encrypted under the passphrase,
+  // and left with that node. So an operator who cracks what sits on their own
+  // disk holds a key that is worthless anywhere else — and on their own node,
+  // one that unlocks nothing they did not already have.
+  //
+  // It also means the hub stores no user key to publish, which is what H3 read.
   const authKey = await deriveAuthKey(password, username);
 
   const resp = await fetch(`${HUB}/v1/users/register`, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({
-      username,
-      email,
-      auth_key: authKey,
-      pk_user_ed25519: btoa(String.fromCharCode(...pkEdBytes)),
-      pk_user_x25519:  btoa(String.fromCharCode(...pkXBytes)),
-    }),
+    body: JSON.stringify({ username, email, auth_key: authKey }),
   });
 
   if (!resp.ok) throw new Error(`Registration failed: ${await resp.text()}`);
+  return { registered: true };
+}
 
-  // Store encrypted bundle locally — will be backed up to node on first group connect
-  try { localStorage.setItem(`meshbay_kp_${username}`, encBundle); } catch {}
-
-  return { skEdRaw, skXRaw, pkEdBytes, pkXBytes, keypairBundleEnc: encBundle };
+/**
+ * A fresh identity for one node, encrypted under the passphrase-derived key.
+ *
+ * Returns { skEdB64, skXB64, pkXB64, bundleEnc } — the bundle goes to that node
+ * and nowhere else, and is what any other browser fetches to become the same
+ * person there.
+ */
+async function generateNodeIdentity(bundleKey) {
+  const { skEdRaw, pkEdRaw, skXRaw, pkXRaw } = await generateKeypairs();
+  const b64 = (buf) => btoa(String.fromCharCode(...new Uint8Array(buf)));
+  const pkXCrypto = await crypto.subtle.importKey('spki', pkXRaw, { name: 'X25519' }, true, []);
+  const pkXBytes = new Uint8Array(await crypto.subtle.exportKey('raw', pkXCrypto));
+  return {
+    skEdB64: b64(skEdRaw),
+    skXB64: b64(skXRaw),
+    pkXB64: b64(pkXBytes),
+    bundleEnc: await encryptBundleWithKey(skEdRaw, skXRaw, bundleKey.v2 || bundleKey),
+  };
 }
 
 /**
  * Decrypt a keypair bundle using a pre-derived AES-256 CryptoKey.
  * Used when the bundle is fetched from the node (bundleKey was derived at login).
  */
-async function decryptBundleWithKey(bundleB64, aesKey) {
+async function decryptBundleWithKey(bundleB64, aesKeyOrPair) {
+  const v2  = bundleVersion(bundleB64) === 2;
+  // Callers derive both keys at sign-in and pass the pair, because which one a
+  // bundle needs is only known once it has been read — and the passphrase is
+  // deliberately not kept around to derive the other one later.
+  const key = (aesKeyOrPair && aesKeyOrPair.v2)
+    ? (v2 ? aesKeyOrPair.v2 : aesKeyOrPair.v1)
+    : aesKeyOrPair;
   const raw   = Uint8Array.from(atob(bundleB64), c => c.charCodeAt(0));
-  const nonce = raw.slice(0, 12);
-  const ct    = raw.slice(12);
-  const plain = await crypto.subtle.decrypt({ name: 'AES-GCM', iv: nonce }, aesKey, ct);
+  const off   = v2 ? BUNDLE_V2_MAGIC.length : 0;
+  const nonce = raw.slice(off, off + 12);
+  const ct    = raw.slice(off + 12);
+  const plain = await crypto.subtle.decrypt({ name: 'AES-GCM', iv: nonce }, key, ct);
   return JSON.parse(new TextDecoder().decode(plain));
 }
 
@@ -195,67 +270,34 @@ async function loginAndRecover(username, password) {
   const result = {
     accessToken:  data.access_token,
     refreshToken: data.refresh_token,
-    bundleKey:    await deriveEncryptionKey(password, username),
+    // Both, so a bundle written before the KDF changed can still be opened —
+    // and re-written with the new one on the next backup.
+    bundleKey: {
+      v2: await deriveEncryptionKey(password, username),
+      v1: await deriveEncryptionKeyV1(password, username),
+    },
   };
 
-  // localStorage bundle = new registration, not yet pushed to node
-  const bundleEnc = (typeof localStorage !== 'undefined'
-    && localStorage.getItem(`meshbay_kp_${username}`)) || null;
-
-  if (bundleEnc) {
-    const keys = await decryptBundle(bundleEnc, password, username);
-    result.skEdB64 = keys.skEd;
-    result.skXB64  = keys.skX;
-    result.keypairBundleEnc = bundleEnc;
-  }
-
+  // Nothing else to recover at sign-in. Identity keys belong to a node, so they
+  // are fetched from the node being connected to (or generated there on a first
+  // join) — see transport.js. All that is needed here is the key that opens them.
   return result;
 }
 
-async function regenerateKeys(token, username, password) {
-  const { skEdRaw, pkEdRaw, skXRaw, pkXRaw } = await generateKeypairs();
-
-  const pkEdCrypto = await crypto.subtle.importKey('spki', pkEdRaw, 'Ed25519', true, ['verify']);
-  const pkXCrypto  = await crypto.subtle.importKey('spki', pkXRaw,  'X25519',  true, []);
-  const pkEdBytes  = new Uint8Array(await crypto.subtle.exportKey('raw', pkEdCrypto));
-  const pkXBytes   = new Uint8Array(await crypto.subtle.exportKey('raw', pkXCrypto));
-
-  const resp = await fetch(`${HUB}/v1/users/me/keys`, {
-    method: 'PUT',
-    headers: {
-      'Content-Type': 'application/json',
-      'Authorization': `Bearer ${token}`,
-    },
-    body: JSON.stringify({
-      pk_user_ed25519: btoa(String.fromCharCode(...pkEdBytes)),
-      pk_user_x25519:  btoa(String.fromCharCode(...pkXBytes)),
-    }),
-  });
-
-  if (!resp.ok) throw new Error(`Key rotation failed: ${await resp.text()}`);
-
-  const encBundle = await encryptBundle(skEdRaw, skXRaw, password, username);
-  try { localStorage.setItem(`meshbay_kp_${username}`, encBundle); } catch {}
-
-  return {
-    skEdB64: btoa(String.fromCharCode(...new Uint8Array(skEdRaw))),
-    skXB64:  btoa(String.fromCharCode(...new Uint8Array(skXRaw))),
-    pkEdB64: btoa(String.fromCharCode(...pkEdBytes)),
-    pkXB64:  btoa(String.fromCharCode(...pkXBytes)),
-    keypairBundleEnc: encBundle,
-  };
-}
+// regenerateKeys() removed. Rotating an identity is now per node: the operator
+// runs `meshbay-node member unpin <user>` and issues a fresh code. A hub call
+// that silently changed what every node believed about someone was the wrong
+// shape for this.
 
-async function signChallenge(skEdPkcs8B64, challengeB64) {
+async function signBytes(skEdPkcs8B64, message) {
   const skRaw = Uint8Array.from(atob(skEdPkcs8B64), c => c.charCodeAt(0));
   const sk = await crypto.subtle.importKey(
     'pkcs8', skRaw, { name: 'Ed25519' }, false, ['sign']);
-  const challenge = Uint8Array.from(atob(challengeB64), c => c.charCodeAt(0));
-  const sig = await crypto.subtle.sign('Ed25519', sk, challenge);
+  const sig = await crypto.subtle.sign('Ed25519', sk, message);
   return btoa(String.fromCharCode(...new Uint8Array(sig)));
 }
 
 window.MeshBayKeys = {
-  registerUser, loginAndRecover, regenerateKeys, generateKeypairs, signChallenge,
-  deriveAuthKey, decryptBundleWithKey,
+  registerUser, loginAndRecover, generateNodeIdentity, generateKeypairs, signBytes,
+  deriveAuthKey, decryptBundleWithKey, encryptBundleWithKey, bundleVersion,
 };
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/style.css b/packages/meshbay-hub/src/meshbay_hub/static/style.css
index e430201..81c4130 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/style.css
+++ b/packages/meshbay-hub/src/meshbay_hub/static/style.css
@@ -316,6 +316,21 @@ button:disabled { opacity: 0.5; cursor: not-allowed; }
   font-size: 0.85em;
 }
 
+.success-msg {
+  background: #16a34a20;
+  color: var(--success);
+  border: 1px solid var(--success);
+  border-radius: 6px;
+  padding: 8px 12px;
+  font-size: 0.85em;
+}
+
+.settings-hint {
+  font-size: 0.85em;
+  color: var(--text-dim);
+  margin-bottom: 8px;
+}
+
 /* ── Group cards (9.7 prep) ───────────────────────────────────────────────── */
 
 .group-grid {
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport.js b/packages/meshbay-hub/src/meshbay_hub/static/transport.js
index ca9c60e..0a8796e 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/transport.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/transport.js
@@ -26,6 +26,31 @@ async function _pkFromSk(skPkcs8B64) {
   return pad ? b64 + '='.repeat(4 - pad) : b64;
 }
 
+async function _pkEdFromSk(skPkcs8B64) {
+  const raw = Uint8Array.from(atob(skPkcs8B64), c => c.charCodeAt(0));
+  const sk = await crypto.subtle.importKey('pkcs8', raw, { name: 'Ed25519' }, true, ['sign']);
+  const jwk = await crypto.subtle.exportKey('jwk', sk);
+  const b64 = jwk.x.replace(/-/g, '+').replace(/_/g, '/');
+  const pad = b64.length % 4;
+  return pad ? b64 + '='.repeat(4 - pad) : b64;
+}
+
+const JOIN_REFUSALS = {
+  code_required: 'This node does not know this browser yet. Ask the node operator '
+    + 'for a pairing code (meshbay-node operator pair).',
+  code_invalid: 'That pairing code is not valid — it may be mistyped, expired, '
+    + 'already used, or issued for a different account.',
+  key_changed: 'This account is already paired with a different key on this node. '
+    + 'If you reset your keys, the operator must unpin you before pairing again.',
+  not_authorized_for_group: 'The node does not list you as a member of this group. '
+    + 'Being a member on the hub is not enough — ask the operator for an invite.',
+  no_gek: 'This group has no key yet. The node operator must run '
+    + '`meshbay-node gek-init` for it.',
+  signature_invalid: 'The node rejected the signature over your keys.',
+  stale_request: 'Your clock is too far from the node\'s — check the system time.',
+  group_mismatch: 'The node refused a request naming a different group.',
+};
+
 class MeshBayTransport {
   constructor(hubUrl, accessToken) {
     this._hubUrl = hubUrl;
@@ -53,11 +78,19 @@ class MeshBayTransport {
 
   get sessionKeys() { return this._sessionKeys; }
 
-  async connect(nodeId, jwtToken, groupId, gekRaw, sessionKeys, bundleKey, username) {
+  /** Set on a first join: the identity created for this node, still to be left with it. */
+  get newNodeBundle() { return this._newNodeBundle || null; }
+  set newNodeBundle(v) { this._newNodeBundle = v; }
+
+  async connect(nodeId, jwtToken, groupId, gekRaw, sessionKeys, bundleKey, username,
+                userId, joinCode) {
     this._gekRaw = gekRaw || null;
     this._sessionKeys = sessionKeys || null;
     this._bundleKey = bundleKey || null;
     this._username = username || null;
+    this._userId = userId || null;
+    this._newNodeBundle = null;
+    this._joinError = null;
     this._pc = new RTCPeerConnection({
       iceServers: [{ urls: 'stun:stun.l.google.com:19302' }],
     });
@@ -129,11 +162,16 @@ class MeshBayTransport {
 
     await channelReady;
 
+    // The client nonce is what makes the NODE's proof fresh (C3) — without it a
+    // recorded handshake_ack could be replayed by an impersonating peer.
+    this._nonceClient = crypto.getRandomValues(new Uint8Array(32));
+
     const reply = await this._sendAndWait({
       type: 'handshake',
       v: '0.1',
       token: jwtToken,
       group_id: groupId || '',
+      nonce: window.MeshBayCrypto.b64encode(this._nonceClient),
     });
 
     if (reply.type === 'handshake_challenge') {
@@ -141,7 +179,23 @@ class MeshBayTransport {
         throw new Error('Node requires GEK proof but no crypto available');
       }
 
-      // Recover session keys from node if not available locally (P2P keypair bundle)
+      // Recorded the moment the challenge arrives, because everything below may
+      // need them — joining, in particular, happens before the proof and signs a
+      // transcript over both. Reading them further down, next to the proof that
+      // also uses them, meant join_request ran with neither.
+      //
+      // nonce_node ties a join to this connection, so one cannot be lifted onto
+      // another. node_pk is announced here because a first-time member has no
+      // GEK and so cannot complete the handshake that would prove it; it is
+      // unverified at this point and checked against the ack below.
+      this._nonceNode = window.MeshBayCrypto.b64decode(reply.nonce);
+      this.nodePk = reply.node_pk || null;
+
+      // Our identity for THIS node: fetched from it, or created if this is a
+      // first join. Keys are per node, so there is nothing to carry between
+      // them — and an operator who cracks the copy on their own disk gets a key
+      // that opens nothing anywhere else.
+      let fresh = false;
       if (!this._sessionKeys && this._bundleKey && window.MeshBayKeys) {
         const kpResp = await this._sendAndWait({
           type: 'keypair_bundle_fetch', v: '0.1',
@@ -151,11 +205,22 @@ class MeshBayTransport {
             kpResp.bundle_enc, this._bundleKey);
           const pkXB64 = await _pkFromSk(keys.skX);
           this._sessionKeys = { skXB64: keys.skX, skEdB64: keys.skEd, pkXB64 };
+        } else {
+          // This node has never seen us. Generate the identity we will use here
+          // and nowhere else; it is stored on this node once the join succeeds,
+          // which is what lets another browser become the same person here.
+          const id = await window.MeshBayKeys.generateNodeIdentity(this._bundleKey);
+          this._sessionKeys = {
+            skEdB64: id.skEdB64, skXB64: id.skXB64, pkXB64: id.pkXB64,
+          };
+          this._newNodeBundle = id.bundleEnc;
+          fresh = true;
         }
       }
 
-      // Fetch wrapped GEK bundle from node (P2P only — hub never touches crypto)
-      if (!gekRaw && this._sessionKeys) {
+      // An identity this node already knows still needs its group key, which the
+      // node wraps on every connection.
+      if (!gekRaw && this._sessionKeys && !fresh) {
         const bundleResp = await this._sendAndWait({
           type: 'gek_bundle_fetch', v: '0.1',
         });
@@ -166,52 +231,159 @@ class MeshBayTransport {
             gekRaw = await window.MeshBayCrypto.unwrapGEK(bundleResp, skXRaw, myPkX);
             this._gekRaw = gekRaw;
           } catch (e) {
-            console.warn('[MeshBay] GEK unwrap failed with local keys, trying node keypair bundle');
-            if (this._bundleKey && window.MeshBayKeys) {
-              const kpResp = await this._sendAndWait({
-                type: 'keypair_bundle_fetch', v: '0.1',
-              });
-              if (kpResp.type === 'keypair_bundle_resp' && kpResp.found) {
-                const keys = await window.MeshBayKeys.decryptBundleWithKey(
-                  kpResp.bundle_enc, this._bundleKey);
-                const pkXB64 = await _pkFromSk(keys.skX);
-                this._sessionKeys = { skXB64: keys.skX, skEdB64: keys.skEd, pkXB64 };
-                const skXRaw2 = Uint8Array.from(atob(keys.skX), c => c.charCodeAt(0));
-                const myPkX2 = Uint8Array.from(atob(pkXB64), c => c.charCodeAt(0));
-                gekRaw = await window.MeshBayCrypto.unwrapGEK(bundleResp, skXRaw2, myPkX2);
-                this._gekRaw = gekRaw;
-              }
-            }
+            console.warn('[MeshBay] stored GEK bundle did not open; joining instead');
           }
         }
       }
 
-      if (!gekRaw) {
-        throw new Error('Node requires GEK proof but no GEK available');
+      // No stored bundle: ask the node to recognise us and wrap the key itself.
+      // This is the normal path for anyone who joined after the invite redesign —
+      // no bundle is pre-stored for members any more. A code is needed only the
+      // first time this node sees this account.
+      if (!gekRaw && this._sessionKeys && userId) {
+        try {
+          gekRaw = await this.joinGroup(userId, groupId, joinCode);
+        } catch (e) {
+          // The UI turns this into "ask the operator for an invite code".
+          this._joinError = e;
+        }
       }
 
-      let proof = '';
-      if (gekRaw) {
-        const offerFp = _extractDtlsFingerprint(this._pc.localDescription.sdp);
-        const answerFp = _extractDtlsFingerprint(this._rawAnswerSdp);
-        proof = await window.MeshBayCrypto.hmacGEK(gekRaw, reply.nonce, offerFp, answerFp);
+      if (!gekRaw && !this._sessionKeys) {
+        // No identity keys in this browser and none recoverable from the node:
+        // the keypair bundle is created where you register and only reaches a
+        // node after a first successful connection, so a brand-new member opening
+        // a second browser has nothing to sign or unwrap with. Say that, rather
+        // than blaming the GEK — a code prompt here would be useless, since a
+        // code proves who you are and we have no key to bind to.
+        const err = new Error(
+          'This browser does not hold your keys. Open the group once from the '
+          + 'browser where you registered — after that this one can recover them.');
+        err.reason = 'no_keys';
+        throw err;
+      }
+
+      if (!gekRaw) {
+        throw this._joinError
+          || new Error('Node requires GEK proof but no GEK available');
       }
+
+      const C = window.MeshBayCrypto;
+      // Node's answer SDP carries ITS fingerprint; our offer carries ours. Throws
+      // if either is missing rather than proceeding with an unbound proof (L4).
+      const binding = C.webrtcBinding(
+        _extractDtlsFingerprint(this._pc.localDescription.sdp),
+        _extractDtlsFingerprint(this._rawAnswerSdp),
+      );
+      const nonceNode = this._nonceNode;   // captured when the challenge arrived
+      const gid = groupId || '';
+
+      const proof = await C.handshakeProof(
+        gekRaw, 'client', gid, this._nonceClient, nonceNode, binding);
+
       const ack = await this._sendAndWait({
         type: 'handshake_response',
         v: '0.1',
-        proof,
+        proof: C.b64encode(proof),
       });
       if (ack.type !== 'handshake_ack') {
         throw new Error('GEK proof rejected: ' + (ack.detail || JSON.stringify(ack)));
       }
+
+      // Authenticate the NODE before trusting anything it says (C3). Until this
+      // ran, node_pk was decorative: a peer that had hijacked signaling could
+      // accept our proof, ignore it, and serve a forged index, chat history and
+      // is_node_admin flag.
+      const expected = await C.handshakeProof(
+        gekRaw, 'node', gid, this._nonceClient, nonceNode, binding);
+      if (!ack.proof || !C.constantTimeEqual(C.b64decode(ack.proof), expected)) {
+        throw new Error('Node failed to prove GEK possession — refusing connection');
+      }
+      const transcript = C.handshakeTranscript(
+        'node', gid, this._nonceClient, nonceNode, binding);
+      if (!ack.node_pk || !ack.sig
+          || !await C.verifyNodeSignature(ack.node_pk, ack.sig, transcript)) {
+        throw new Error('Node signature invalid — refusing connection');
+      }
+      // Trust On First Use (11.5.8). With C6 closed, a substituted node already
+      // fails the GEK proof — this covers the case where an attacker HAS the GEK
+      // (an ex-member, or a leaked key) and swaps the node underneath.
+      // Strict refusal: a warning users can click through is decorative.
+      // The key announced in the challenge must be the one that just proved
+      // itself. A peer that changed identity mid-handshake is not one to trust
+      // with anything, including a join we may already have signed for it.
+      if (this.nodePk && this.nodePk !== ack.node_pk) {
+        throw new Error('Node identity changed during the handshake — refusing');
+      }
+      _checkNodePin(nodeId, ack.node_pk);
+      this.nodePk = ack.node_pk;
+
       return ack;
     }
 
-    if (reply.type !== 'handshake_ack') {
-      throw new Error('MNP handshake rejected: ' + (reply.detail || JSON.stringify(reply)));
+    // A node that answers a handshake with anything other than a challenge is not
+    // running the mutual protocol. Accepting a bare handshake_ack here would let a
+    // peer skip proving GEK possession entirely (C3/C6).
+    const rejected = new Error(
+      'MNP handshake rejected: ' + (reply.detail || `unexpected ${reply.type}`));
+    // `not_a_member` usually means our token predates being added to the group;
+    // the caller refreshes it and tries again rather than showing that to someone
+    // who was invited thirty seconds ago.
+    rejected.reason = reply.code || '';
+    throw rejected;
+  }
+
+  /**
+   * Pair this browser with the node using a one-time code (M3, and the same
+   * substitution as H3).
+   *
+   * The node has no way to know which key belongs to its operator unless someone
+   * tells it locally — asking the hub would let the hub name itself node
+   * administrator. The code comes from `meshbay-node operator pair`, over SSH, and
+   * the hub never sees it.
+   */
+  async pairOperator(userId, code) {
+    if (!this._connected) throw new Error('Not connected to the node');
+    if (!userId) throw new Error('Missing user id');
+    if (!this._sessionKeys || !this._sessionKeys.skEdB64 || !this._sessionKeys.skXB64) {
+      throw new Error('Identity keys unavailable in this browser — sign in again');
     }
+    if (!this._nonceNode || !this.nodePk) {
+      throw new Error('Handshake incomplete — reconnect and retry');
+    }
+
+    const C = window.MeshBayCrypto;
+    // Both public keys are derived from OUR OWN secret keys, never read back from
+    // the hub: signing a public key the directory handed us would reintroduce the
+    // substitution this whole mechanism exists to close.
+    const pkEdB64 = await _pkEdFromSk(this._sessionKeys.skEdB64);
+    const pkXB64 = await _pkFromSk(this._sessionKeys.skXB64);
+    const ts = Math.floor(Date.now() / 1000);
+
+    // group_id is empty: operator authority is node-wide, not per group.
+    const transcript = C.joinTranscript(
+      this.nodePk, '', userId, pkEdB64, pkXB64, this._nonceNode, ts);
+    const sig = await window.MeshBayKeys.signBytes(this._sessionKeys.skEdB64, transcript);
 
-    return reply;
+    const resp = await this._sendAndWait({
+      type: 'join_request',
+      v: '0.1',
+      group_id: '',
+      pk_ed25519: pkEdB64,
+      pk_x25519: pkXB64,
+      code: code || '',
+      ts,
+      sig,
+    });
+
+    if (resp.type === 'error') throw new Error(resp.detail || 'Pairing refused');
+    if (resp.type !== 'join_result' || !resp.ok) {
+      const reason = resp.reason || 'unknown';
+      const err = new Error(JOIN_REFUSALS[reason] || `Pairing refused: ${reason}`);
+      err.reason = reason;
+      throw err;
+    }
+    return resp;
   }
 
   async fetchIndex() {
@@ -266,6 +438,39 @@ class MeshBayTransport {
     return msg;
   }
 
+  /**
+   * Authorize a privileged node operation with the user's Ed25519 identity key.
+   *
+   * The client rebuilds the signed transcript from the challenge fields and refuses
+   * to sign unless the operation and subject match what the user actually asked for.
+   * Previously the node sent 32 opaque random bytes and the client signed them
+   * blind, which let any peer obtain a signature over content of its choosing
+   * (finding H5).
+   */
+  async _authorizeAdminOp(challenge, expectedOp, expectedSubject, signFn) {
+    if (challenge.op !== expectedOp || challenge.subject !== expectedSubject) {
+      throw new Error(
+        `Refusing to sign: node asked to authorize "${challenge.op}" on ` +
+        `"${challenge.subject}", but the requested action was "${expectedOp}" ` +
+        `on "${expectedSubject}"`);
+    }
+    if (!signFn) throw new Error('Admin challenge received but no signing key available');
+
+    const transcript = window.MeshBayCrypto.adminTranscript(
+      challenge.op, challenge.node_pk, challenge.group_id,
+      challenge.subject, challenge.nonce, challenge.ts);
+
+    const signature = await signFn(transcript);
+    const ack = await this._sendAndWait({
+      type: 'admin_response',
+      v: '0.1',
+      op_id: challenge.op_id,
+      signature,
+    });
+    if (ack.type === 'error') throw new Error(ack.detail);
+    return ack;
+  }
+
   async deleteFile(fileId, signFn) {
     const msg = await this._sendAndWait({
       type: 'file_delete',
@@ -274,16 +479,7 @@ class MeshBayTransport {
     });
     if (msg.type === 'error') throw new Error(msg.detail);
     if (msg.type === 'admin_challenge') {
-      if (!signFn) throw new Error('Admin challenge received but no signing key available');
-      const signature = await signFn(msg.challenge);
-      const ack = await this._sendAndWait({
-        type: 'admin_response',
-        v: '0.1',
-        file_id: fileId,
-        signature,
-      });
-      if (ack.type === 'error') throw new Error(ack.detail);
-      return ack;
+      return this._authorizeAdminOp(msg, 'file_delete', fileId, signFn);
     }
     return msg;
   }
@@ -304,15 +500,95 @@ class MeshBayTransport {
     return msg;
   }
 
-  async storeGekBundle(userId, groupId, bundle) {
+  /**
+   * Ask the node for a one-time pairing code admitting `userId` to this group.
+   *
+   * This replaces wrapping the group key in the browser. We no longer fetch the
+   * invitee's public key from the hub, so the hub can no longer answer with its own
+   * and be handed the group key (H3). The node wraps the key later, itself, for a
+   * key the invitee proves possession of.
+   *
+   * Returns {code, expires_at} — the code is displayed once and passed to the
+   * invitee out of band.
+   */
+  async createInvite(userId, groupId, username, signFn) {
     const msg = await this._sendAndWait({
-      type: 'gek_bundle_store',
+      type: 'invite_create',
       v: '0.1',
       user_id: userId,
       group_id: groupId,
-      pk_eph_b64: bundle.pk_eph_b64,
-      nonce_b64: bundle.nonce_b64,
-      wrapped_b64: bundle.wrapped_b64,
+      username: username || '',
+    });
+    if (msg.type === 'error') throw new Error(msg.detail);
+    if (msg.type === 'admin_challenge') {
+      return this._authorizeAdminOp(msg, 'invite_create', userId, signFn);
+    }
+    return msg;
+  }
+
+  /**
+   * Ask the node to recognise us and hand over the group key.
+   *
+   * Sent when we hold no GEK for a group. `code` is needed only the first time
+   * this node sees this account (and not at all in an open-join group).
+   */
+  async joinGroup(userId, groupId, code) {
+    if (!this._sessionKeys || !this._sessionKeys.skEdB64 || !this._sessionKeys.skXB64) {
+      throw new Error('Identity keys unavailable in this browser — sign in again');
+    }
+    if (!this._nonceNode || !this.nodePk) {
+      throw new Error('Handshake incomplete — reconnect and retry');
+    }
+
+    const C = window.MeshBayCrypto;
+    const pkEdB64 = await _pkEdFromSk(this._sessionKeys.skEdB64);
+    const pkXB64 = await _pkFromSk(this._sessionKeys.skXB64);
+    const ts = Math.floor(Date.now() / 1000);
+
+    const transcript = C.joinTranscript(
+      this.nodePk, groupId || '', userId, pkEdB64, pkXB64, this._nonceNode, ts);
+    const sig = await window.MeshBayKeys.signBytes(this._sessionKeys.skEdB64, transcript);
+
+    const resp = await this._sendAndWait({
+      type: 'join_request',
+      v: '0.1',
+      group_id: groupId || '',
+      pk_ed25519: pkEdB64,
+      pk_x25519: pkXB64,
+      code: code || '',
+      ts,
+      sig,
+    });
+
+    if (resp.type === 'error') throw new Error(resp.detail || 'Join refused');
+    if ((resp.type !== 'join_result' || !resp.ok) || !resp.gek) {
+      const reason = resp.reason || 'unknown';
+      const err = new Error(JOIN_REFUSALS[reason] || `Join refused: ${reason}`);
+      // The UI reacts to `code_required` by asking for one; everything else is
+      // shown as-is.
+      err.reason = reason;
+      throw err;
+    }
+
+    // Unwrap with our own secret key — the node wrapped for the public key we
+    // just proved we hold, so nobody else can open this.
+    const skXRaw = Uint8Array.from(atob(this._sessionKeys.skXB64), c => c.charCodeAt(0));
+    const myPkX = Uint8Array.from(atob(pkXB64), c => c.charCodeAt(0));
+    const gekRaw = await C.unwrapGEK(resp, skXRaw, myPkX);
+    this._gekRaw = gekRaw;
+    return gekRaw;
+  }
+
+  /**
+   * Withdraw our key backup from this node.
+   *
+   * The counterpart of storeKeypairBundle: turning the setting off has to remove
+   * what is already stored, not merely stop adding to it — otherwise the blob
+   * stays on every node the account has ever joined (C4).
+   */
+  async deleteKeypairBundle() {
+    const msg = await this._sendAndWait({
+      type: 'keypair_bundle_delete', v: '0.1',
     });
     if (msg.type === 'error') throw new Error(msg.detail);
     return msg;
@@ -627,5 +903,48 @@ function _extractDtlsFingerprint(sdp) {
   return bytes;
 }
 
+// ── Node identity pinning (11.5.8) ───────────────────────────────────────────
+
+const NODE_PIN_PREFIX = 'mb_nodepin_';
+
+function _checkNodePin(nodeId, nodePk) {
+  if (!nodeId || !nodePk) return;
+  const key = NODE_PIN_PREFIX + nodeId;
+
+  let pinned = null;
+  try { pinned = localStorage.getItem(key); } catch { return; }
+
+  if (pinned === null) {
+    try { localStorage.setItem(key, nodePk); } catch {}
+    return;
+  }
+  if (pinned !== nodePk) {
+    throw new Error(
+      'This node\'s identity key has changed. That is expected only if its ' +
+      'operator reinstalled the node — otherwise someone may be impersonating ' +
+      'it. Verify with the operator out of band, then clear the pin in ' +
+      'Settings to accept the new key.');
+  }
+}
+
+/** Forget a pinned node identity — the deliberate escape hatch for a legitimate rotation. */
+function clearNodePin(nodeId) {
+  try {
+    if (nodeId) localStorage.removeItem(NODE_PIN_PREFIX + nodeId);
+    else {
+      for (const k of Object.keys(localStorage))
+        if (k.startsWith(NODE_PIN_PREFIX)) localStorage.removeItem(k);
+    }
+  } catch {}
+}
+
+function pinnedNodeCount() {
+  try {
+    return Object.keys(localStorage).filter(k => k.startsWith(NODE_PIN_PREFIX)).length;
+  } catch { return 0; }
+}
+
 // Export
+MeshBayTransport.clearNodePin = clearNodePin;
+MeshBayTransport.pinnedNodeCount = pinnedNodeCount;
 window.MeshBayTransport = MeshBayTransport;
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/vendor/PROVENANCE.md b/packages/meshbay-hub/src/meshbay_hub/static/vendor/PROVENANCE.md
new file mode 100644
index 0000000..6935e91
--- /dev/null
+++ b/packages/meshbay-hub/src/meshbay_hub/static/vendor/PROVENANCE.md
@@ -0,0 +1,36 @@
+# Vendored third-party assets
+
+The SPA is served under a CSP that forbids every external host, so anything it
+uses has to live here. Each entry records exactly what was taken and from where,
+so it can be checked or rebuilt without guesswork.
+
+## argon2.min.js
+
+| | |
+|---|---|
+| Package | `argon2-browser` 1.18.0 (npm) |
+| Source | https://registry.npmjs.org/argon2-browser/-/argon2-browser-1.18.0.tgz |
+| Tarball sha256 | `cdb11795a4971bde095fe6b836aa424de50c4558ed4b9505bc74111eee7f6d35` |
+| Tarball sha1 (npm dist.shasum) | `f35820211e0a431aed7f82b9348477234be69bec` |
+| File taken | `package/dist/argon2-bundled.min.js` |
+| File sha256 | `77c64b946baf1a5116dc591f4b9965d636b1b455f75edd2d4a587cb75e01687b` |
+
+The bundled build carries the WebAssembly inline as base64, so there is no second
+request and nothing to locate at runtime.
+
+**Why it is here at all:** WebCrypto has no memory-hard KDF. The encrypted
+keypair bundle is protected by the passphrase alone and rests on every node whose
+group its owner joins (finding C4), so PBKDF2 — compute-only, and therefore cheap
+on a GPU — was the wrong tool for it. Measured through this build on the dev
+machine: Argon2id 128 MB / t=3 / p=1 takes ~640 ms, against ~240 ms for
+PBKDF2-SHA512 at 600k, for a memory cost a GPU cannot ignore.
+
+### argon2.wasm
+
+The same build's standalone WebAssembly, sha256
+`0c2149886c13e4eae4a6ca25ee71d47423c5c8740a874cf04ff816d1b2c901d7`.
+
+The browser never requests it — `argon2.min.js` carries the same bytes inline as
+a data URL. It is kept because the cross-language parity test drives the vendored
+library under node, where the emscripten loader takes its file path instead of the
+inline copy, and a test that cannot run is a test that stops being true.
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/vendor/argon2.min.js b/packages/meshbay-hub/src/meshbay_hub/static/vendor/argon2.min.js
new file mode 100644
index 0000000..607e16f
--- /dev/null
+++ b/packages/meshbay-hub/src/meshbay_hub/static/vendor/argon2.min.js
@@ -0,0 +1 @@
+!function(A,I){"object"==typeof exports&&"object"==typeof module?module.exports=I():"function"==typeof define&&define.amd?define([],I):"object"==typeof exports?exports.argon2=I():A.argon2=I()}(this,(function(){return(()=>{var A,I,g={773:(A,I,g)=>{var B,Q="undefined"!=typeof self&&void 0!==self.Module?self.Module:{},C={};for(B in Q)Q.hasOwnProperty(B)&&(C[B]=Q[B]);var E,i,o,D,e=[];E="object"==typeof window,i="function"==typeof importScripts,o="object"==typeof process&&"object"==typeof process.versions&&"string"==typeof process.versions.node,D=!E&&!o&&!i;var n,t,a,r,s,y="";o?(y=i?g(967).dirname(y)+"/":"//",n=function(A,I){return r||(r=g(145)),s||(s=g(967)),A=s.normalize(A),r.readFileSync(A,I?null:"utf8")},a=function(A){var I=n(A,!0);return I.buffer||(I=new Uint8Array(I)),G(I.buffer),I},process.argv.length>1&&process.argv[1].replace(/\\/g,"/"),e=process.argv.slice(2),A.exports=Q,process.on("uncaughtException",(function(A){if(!(A instanceof V))throw A})),process.on("unhandledRejection",u),Q.inspect=function(){return"[Emscripten Module object]"}):D?("undefined"!=typeof read&&(n=function(A){return read(A)}),a=function(A){var I;return"function"==typeof readbuffer?new Uint8Array(readbuffer(A)):(G("object"==typeof(I=read(A,"binary"))),I)},"undefined"!=typeof scriptArgs?e=scriptArgs:void 0!==arguments&&(e=arguments),"undefined"!=typeof print&&("undefined"==typeof console&&(console={}),console.log=print,console.warn=console.error="undefined"!=typeof printErr?printErr:print)):(E||i)&&(i?y=self.location.href:"undefined"!=typeof document&&document.currentScript&&(y=document.currentScript.src),y=0!==y.indexOf("blob:")?y.substr(0,y.lastIndexOf("/")+1):"",n=function(A){var I=new XMLHttpRequest;return I.open("GET",A,!1),I.send(null),I.responseText},i&&(a=function(A){var I=new XMLHttpRequest;return I.open("GET",A,!1),I.responseType="arraybuffer",I.send(null),new Uint8Array(I.response)}),t=function(A,I,g){var B=new XMLHttpRequest;B.open("GET",A,!0),B.responseType="arraybuffer",B.onload=function(){200==B.status||0==B.status&&B.response?I(B.response):g()},B.onerror=g,B.send(null)}),Q.print||console.log.bind(console);var F,c,w=Q.printErr||console.warn.bind(console);for(B in C)C.hasOwnProperty(B)&&(Q[B]=C[B]);C=null,Q.arguments&&(e=Q.arguments),Q.thisProgram&&Q.thisProgram,Q.quit&&Q.quit,Q.wasmBinary&&(F=Q.wasmBinary),Q.noExitRuntime,"object"!=typeof WebAssembly&&u("no native wasm support detected");var h=!1;function G(A,I){A||u("Assertion failed: "+I)}var N,R,f="undefined"!=typeof TextDecoder?new TextDecoder("utf8"):void 0;function U(A){N=A,Q.HEAP8=new Int8Array(A),Q.HEAP16=new Int16Array(A),Q.HEAP32=new Int32Array(A),Q.HEAPU8=R=new Uint8Array(A),Q.HEAPU16=new Uint16Array(A),Q.HEAPU32=new Uint32Array(A),Q.HEAPF32=new Float32Array(A),Q.HEAPF64=new Float64Array(A)}Q.INITIAL_MEMORY;var M,Y=[],S=[],H=[],d=0,k=null,J=null;function u(A){throw Q.onAbort&&Q.onAbort(A),w(A+=""),h=!0,A="abort("+A+"). Build with -s ASSERTIONS=1 for more info.",new WebAssembly.RuntimeError(A)}function p(A){return A.startsWith("data:application/octet-stream;base64,")}function L(A){return A.startsWith("file://")}Q.preloadedImages={},Q.preloadedAudios={};var l,K="argon2.wasm";function q(A){try{if(A==K&&F)return new Uint8Array(F);if(a)return a(A);throw"both async and sync fetching of the wasm failed"}catch(A){u(A)}}function b(A){for(;A.length>0;){var I=A.shift();if("function"!=typeof I){var g=I.func;"number"==typeof g?void 0===I.arg?M.get(g)():M.get(g)(I.arg):g(void 0===I.arg?null:I.arg)}else I(Q)}}function x(A){try{return c.grow(A-N.byteLength+65535>>>16),U(c.buffer),1}catch(A){}}p(K)||(l=K,K=Q.locateFile?Q.locateFile(l,y):y+l);var m,X={a:function(A,I,g){R.copyWithin(A,I,I+g)},b:function(A){var I,g=R.length,B=2147418112;if((A>>>=0)>B)return!1;for(var Q=1;Q<=4;Q*=2){var C=g*(1+.2/Q);if(C=Math.min(C,A+100663296),x(Math.min(B,((I=Math.max(A,C))%65536>0&&(I+=65536-I%65536),I))))return!0}return!1}},W=(function(){var A={a:X};function I(A,I){var g,B=A.exports;Q.asm=B,U((c=Q.asm.c).buffer),M=Q.asm.k,g=Q.asm.d,S.unshift(g),function(A){if(d--,Q.monitorRunDependencies&&Q.monitorRunDependencies(d),0==d&&(null!==k&&(clearInterval(k),k=null),J)){var I=J;J=null,I()}}()}function g(A){I(A.instance)}function B(I){return function(){if(!F&&(E||i)){if("function"==typeof fetch&&!L(K))return fetch(K,{credentials:"same-origin"}).then((function(A){if(!A.ok)throw"failed to load wasm binary file at '"+K+"'";return A.arrayBuffer()})).catch((function(){return q(K)}));if(t)return new Promise((function(A,I){t(K,(function(I){A(new Uint8Array(I))}),I)}))}return Promise.resolve().then((function(){return q(K)}))}().then((function(I){return WebAssembly.instantiate(I,A)})).then(I,(function(A){w("failed to asynchronously prepare wasm: "+A),u(A)}))}if(d++,Q.monitorRunDependencies&&Q.monitorRunDependencies(d),Q.instantiateWasm)try{return Q.instantiateWasm(A,I)}catch(A){return w("Module.instantiateWasm callback failed with error: "+A),!1}F||"function"!=typeof WebAssembly.instantiateStreaming||p(K)||L(K)||"function"!=typeof fetch?B(g):fetch(K,{credentials:"same-origin"}).then((function(I){return WebAssembly.instantiateStreaming(I,A).then(g,(function(A){return w("wasm streaming compile failed: "+A),w("falling back to ArrayBuffer instantiation"),B(g)}))}))}(),Q.___wasm_call_ctors=function(){return(Q.___wasm_call_ctors=Q.asm.d).apply(null,arguments)},Q._argon2_hash=function(){return(Q._argon2_hash=Q.asm.e).apply(null,arguments)},Q._malloc=function(){return(W=Q._malloc=Q.asm.f).apply(null,arguments)}),T=(Q._free=function(){return(Q._free=Q.asm.g).apply(null,arguments)},Q._argon2_verify=function(){return(Q._argon2_verify=Q.asm.h).apply(null,arguments)},Q._argon2_error_message=function(){return(Q._argon2_error_message=Q.asm.i).apply(null,arguments)},Q._argon2_encodedlen=function(){return(Q._argon2_encodedlen=Q.asm.j).apply(null,arguments)},Q._argon2_hash_ext=function(){return(Q._argon2_hash_ext=Q.asm.l).apply(null,arguments)},Q._argon2_verify_ext=function(){return(Q._argon2_verify_ext=Q.asm.m).apply(null,arguments)},Q.stackAlloc=function(){return(T=Q.stackAlloc=Q.asm.n).apply(null,arguments)});function V(A){this.name="ExitStatus",this.message="Program terminated with exit("+A+")",this.status=A}function j(A){function I(){m||(m=!0,Q.calledRun=!0,h||(b(S),Q.onRuntimeInitialized&&Q.onRuntimeInitialized(),function(){if(Q.postRun)for("function"==typeof Q.postRun&&(Q.postRun=[Q.postRun]);Q.postRun.length;)A=Q.postRun.shift(),H.unshift(A);var A;b(H)}()))}A=A||e,d>0||(function(){if(Q.preRun)for("function"==typeof Q.preRun&&(Q.preRun=[Q.preRun]);Q.preRun.length;)A=Q.preRun.shift(),Y.unshift(A);var A;b(Y)}(),d>0||(Q.setStatus?(Q.setStatus("Running..."),setTimeout((function(){setTimeout((function(){Q.setStatus("")}),1),I()}),1)):I()))}if(Q.allocate=function(A,I){var g;return g=1==I?T(A.length):W(A.length),A.subarray||A.slice?R.set(A,g):R.set(new Uint8Array(A),g),g},Q.UTF8ToString=function(A,I){return A?function(A,I,g){for(var B=I+g,Q=I;A[Q]&&!(Q>=B);)++Q;if(Q-I>16&&A.subarray&&f)return f.decode(A.subarray(I,Q));for(var C="";I<Q;){var E=A[I++];if(128&E){var i=63&A[I++];if(192!=(224&E)){var o=63&A[I++];if((E=224==(240&E)?(15&E)<<12|i<<6|o:(7&E)<<18|i<<12|o<<6|63&A[I++])<65536)C+=String.fromCharCode(E);else{var D=E-65536;C+=String.fromCharCode(55296|D>>10,56320|1023&D)}}else C+=String.fromCharCode((31&E)<<6|i)}else C+=String.fromCharCode(E)}return C}(R,A,I):""},Q.ALLOC_NORMAL=0,J=function A(){m||j(),m||(J=A)},Q.run=j,Q.preInit)for("function"==typeof Q.preInit&&(Q.preInit=[Q.preInit]);Q.preInit.length>0;)Q.preInit.pop()();j(),A.exports=Q,Q.unloadRuntime=function(){"undefined"!=typeof self&&delete self.Module,Q=c=M=N=R=void 0,delete A.exports}},631:function(A,I,g){var B,Q;"undefined"!=typeof self&&self,void 0===(Q="function"==typeof(B=function(){const A="undefined"!=typeof self?self:this,I={Argon2d:0,Argon2i:1,Argon2id:2};function B(I){if(B._promise)return B._promise;if(B._module)return Promise.resolve(B._module);let C;return C=A.process&&A.process.versions&&A.process.versions.node?Q().then((A=>new Promise((I=>{A.postRun=()=>I(A)})))):(A.loadArgon2WasmBinary?A.loadArgon2WasmBinary():Promise.resolve(g(721)).then((A=>function(A){const I=atob(A),g=new Uint8Array(new ArrayBuffer(I.length));for(let A=0;A<I.length;A++)g[A]=I.charCodeAt(A);return g}(A)))).then((g=>function(I,g){return new Promise((B=>(A.Module={wasmBinary:I,wasmMemory:g,postRun(){B(Module)}},Q())))}(g,I?function(A){const I=1024,g=64*I,B=(1024*I*1024*2-64*I)/g,Q=Math.min(Math.max(Math.ceil(A*I/g),256)+256,B);return new WebAssembly.Memory({initial:Q,maximum:B})}(I):void 0))),B._promise=C,C.then((A=>(B._module=A,delete B._promise,A)))}function Q(){return A.loadArgon2WasmModule?A.loadArgon2WasmModule():Promise.resolve(g(773))}function C(A,I){return A.allocate(I,"i8",A.ALLOC_NORMAL)}function E(A,I){return C(A,new Uint8Array([...I,0]))}function i(A){if("string"!=typeof A)return A;if("function"==typeof TextEncoder)return(new TextEncoder).encode(A);if("function"==typeof Buffer)return Buffer.from(A);throw new Error("Don't know how to encode UTF8")}return{ArgonType:I,hash:function(A){const g=A.mem||1024;return B(g).then((B=>{const Q=A.time||1,o=A.parallelism||1,D=i(A.pass),e=E(B,D),n=D.length,t=i(A.salt),a=E(B,t),r=t.length,s=A.type||I.Argon2d,y=B.allocate(new Array(A.hashLen||24),"i8",B.ALLOC_NORMAL),F=A.secret?C(B,A.secret):0,c=A.secret?A.secret.byteLength:0,w=A.ad?C(B,A.ad):0,h=A.ad?A.ad.byteLength:0,G=A.hashLen||24,N=B._argon2_encodedlen(Q,g,o,r,G,s),R=B.allocate(new Array(N+1),"i8",B.ALLOC_NORMAL);let f,U,M;try{U=B._argon2_hash_ext(Q,g,o,e,n,a,r,y,G,R,N,s,F,c,w,h,19)}catch(A){f=A}if(0!==U||f){try{f||(f=B.UTF8ToString(B._argon2_error_message(U)))}catch(A){}M={message:f,code:U}}else{let A="";const I=new Uint8Array(G);for(let g=0;g<G;g++){const Q=B.HEAP8[y+g];I[g]=Q,A+=("0"+(255&Q).toString(16)).slice(-2)}M={hash:I,hashHex:A,encoded:B.UTF8ToString(R)}}try{B._free(e),B._free(a),B._free(y),B._free(R),w&&B._free(w),F&&B._free(F)}catch(A){}if(f)throw M;return M}))},verify:function(A){return B().then((g=>{const B=i(A.pass),Q=E(g,B),o=B.length,D=A.secret?C(g,A.secret):0,e=A.secret?A.secret.byteLength:0,n=A.ad?C(g,A.ad):0,t=A.ad?A.ad.byteLength:0,a=E(g,i(A.encoded));let r,s,y,F=A.type;if(void 0===F){let g=A.encoded.split("$")[1];g&&(g=g.replace("a","A"),F=I[g]||I.Argon2d)}try{s=g._argon2_verify_ext(a,Q,o,D,e,n,t,F)}catch(A){r=A}if(s||r){try{r||(r=g.UTF8ToString(g._argon2_error_message(s)))}catch(A){}y={message:r,code:s}}try{g._free(Q),g._free(a)}catch(A){}if(r)throw y;return y}))},unloadRuntime:function(){B._module&&(B._module.unloadRuntime(),delete B._promise,delete B._module)}}})?B.apply(I,[]):B)||(A.exports=Q)},721:function(A,I){A.exports="AGFzbQEAAAABkwESYAN/f38Bf2ABfwF/YAJ/fwBgAn9/AX9gAX8AYAR/f39/AX9gA39/fwBgBH9/f38AYAJ/fgBgAn5/AX5gAn5+AX5gBX9/f39/AGAGf3x/f39/AX9gAABgCH9/f39/f39/AX9gEX9/f39/f39/f39/f39/f39/AX9gBn9/f39/fwF/YA1/f39/f39/f39/f39/AX8CDQIBYQFhAAABYQFiAAEDPDsJCgIAAAIEAQEAAQsGAQAHAAIBAwICAwIIBQECAwEHDQMBBgQGAQEFBQEAAAIEAAAIAQAODwQQAQURAwQFAXABAwMFBwEBgAL//wEGCQF/AUGQo8ACCwcxDAFjAgABZAAhAWUAOwFmAAkBZwAIAWgAOgFpADkBagA4AWsBAAFsADYBbQA1AW4AMwkIAQBBAQsCCzQKwbMBOwgAIAAgAa2KCx4AIAAgAXwgAEIBhkL+////H4MgAUL/////D4N+fAsXAEHwHCgCAEUgAEVyRQRAIAAgARAdCwuDBAEDfyACQYAETwRAIAAgASACEAAaIAAPCyAAIAJqIQMCQCAAIAFzQQNxRQRAAkAgAEEDcUUEQCAAIQIMAQsgAkEBSARAIAAhAgwBCyAAIQIDQCACIAEtAAA6AAAgAUEBaiEBIAJBAWoiAkEDcUUNASACIANJDQALCwJAIANBfHEiBEHAAEkNACACIARBQGoiBUsNAANAIAIgASgCADYCACACIAEoAgQ2AgQgAiABKAIINgIIIAIgASgCDDYCDCACIAEoAhA2AhAgAiABKAIUNgIUIAIgASgCGDYCGCACIAEoAhw2AhwgAiABKAIgNgIgIAIgASgCJDYCJCACIAEoAig2AiggAiABKAIsNgIsIAIgASgCMDYCMCACIAEoAjQ2AjQgAiABKAI4NgI4IAIgASgCPDYCPCABQUBrIQEgAkFAayICIAVNDQALCyACIARPDQEDQCACIAEoAgA2AgAgAUEEaiEBIAJBBGoiAiAESQ0ACwwBCyADQQRJBEAgACECDAELIAAgA0EEayIESwRAIAAhAgwBCyAAIQIDQCACIAEtAAA6AAAgAiABLQABOgABIAIgAS0AAjoAAiACIAEtAAM6AAMgAUEEaiEBIAJBBGoiAiAETQ0ACwsgAiADSQRAA0AgAiABLQAAOgAAIAFBAWohASACQQFqIgIgA0cNAAsLIAALzwEBA38CQCACRQ0AQX8hAyAARSABRXINACAAKQNQQgBSDQACQCAAKALgASIDIAJqQYEBSQ0AIABB4ABqIgUgA2ogAUGAASADayIEEAUaIABCgAEQGiAAIAUQGUEAIQMgAEEANgLgASABIARqIQEgAiAEayICQYEBSQ0AA0AgAEKAARAaIAAgARAZIAFBgAFqIQEgAkGAAWsiAkGAAUsNAAsgACgC4AEhAwsgACADakHgAGogASACEAUaIAAgACgC4AEgAmo2AuABQQAhAwsgAwsJACAAIAE2AAALpwwBB38CQCAARQ0AIABBCGsiAyAAQQRrKAIAIgFBeHEiAGohBQJAIAFBAXENACABQQNxRQ0BIAMgAygCACIBayIDQbAfKAIASQ0BIAAgAWohACADQbQfKAIARwRAIAFB/wFNBEAgAygCCCICIAFBA3YiBEEDdEHIH2pGGiACIAMoAgwiAUYEQEGgH0GgHygCAEF+IAR3cTYCAAwDCyACIAE2AgwgASACNgIIDAILIAMoAhghBgJAIAMgAygCDCIBRwRAIAMoAggiAiABNgIMIAEgAjYCCAwBCwJAIANBFGoiAigCACIEDQAgA0EQaiICKAIAIgQNAEEAIQEMAQsDQCACIQcgBCIBQRRqIgIoAgAiBA0AIAFBEGohAiABKAIQIgQNAAsgB0EANgIACyAGRQ0BAkAgAyADKAIcIgJBAnRB0CFqIgQoAgBGBEAgBCABNgIAIAENAUGkH0GkHygCAEF+IAJ3cTYCAAwDCyAGQRBBFCAGKAIQIANGG2ogATYCACABRQ0CCyABIAY2AhggAygCECICBEAgASACNgIQIAIgATYCGAsgAygCFCICRQ0BIAEgAjYCFCACIAE2AhgMAQsgBSgCBCIBQQNxQQNHDQBBqB8gADYCACAFIAFBfnE2AgQgAyAAQQFyNgIEIAAgA2ogADYCAA8LIAMgBU8NACAFKAIEIgFBAXFFDQACQCABQQJxRQRAIAVBuB8oAgBGBEBBuB8gAzYCAEGsH0GsHygCACAAaiIANgIAIAMgAEEBcjYCBCADQbQfKAIARw0DQagfQQA2AgBBtB9BADYCAA8LIAVBtB8oAgBGBEBBtB8gAzYCAEGoH0GoHygCACAAaiIANgIAIAMgAEEBcjYCBCAAIANqIAA2AgAPCyABQXhxIABqIQACQCABQf8BTQRAIAUoAggiAiABQQN2IgRBA3RByB9qRhogAiAFKAIMIgFGBEBBoB9BoB8oAgBBfiAEd3E2AgAMAgsgAiABNgIMIAEgAjYCCAwBCyAFKAIYIQYCQCAFIAUoAgwiAUcEQCAFKAIIIgJBsB8oAgBJGiACIAE2AgwgASACNgIIDAELAkAgBUEUaiICKAIAIgQNACAFQRBqIgIoAgAiBA0AQQAhAQwBCwNAIAIhByAEIgFBFGoiAigCACIEDQAgAUEQaiECIAEoAhAiBA0ACyAHQQA2AgALIAZFDQACQCAFIAUoAhwiAkECdEHQIWoiBCgCAEYEQCAEIAE2AgAgAQ0BQaQfQaQfKAIAQX4gAndxNgIADAILIAZBEEEUIAYoAhAgBUYbaiABNgIAIAFFDQELIAEgBjYCGCAFKAIQIgIEQCABIAI2AhAgAiABNgIYCyAFKAIUIgJFDQAgASACNgIUIAIgATYCGAsgAyAAQQFyNgIEIAAgA2ogADYCACADQbQfKAIARw0BQagfIAA2AgAPCyAFIAFBfnE2AgQgAyAAQQFyNgIEIAAgA2ogADYCAAsgAEH/AU0EQCAAQQN2IgFBA3RByB9qIQACf0GgHygCACICQQEgAXQiAXFFBEBBoB8gASACcjYCACAADAELIAAoAggLIQIgACADNgIIIAIgAzYCDCADIAA2AgwgAyACNgIIDwtBHyECIANCADcCECAAQf///wdNBEAgAEEIdiIBIAFBgP4/akEQdkEIcSIBdCICIAJBgOAfakEQdkEEcSICdCIEIARBgIAPakEQdkECcSIEdEEPdiABIAJyIARyayIBQQF0IAAgAUEVanZBAXFyQRxqIQILIAMgAjYCHCACQQJ0QdAhaiEBAkACQAJAQaQfKAIAIgRBASACdCIHcUUEQEGkHyAEIAdyNgIAIAEgAzYCACADIAE2AhgMAQsgAEEAQRkgAkEBdmsgAkEfRht0IQIgASgCACEBA0AgASIEKAIEQXhxIABGDQIgAkEddiEBIAJBAXQhAiAEIAFBBHFqIgdBEGooAgAiAQ0ACyAHIAM2AhAgAyAENgIYCyADIAM2AgwgAyADNgIIDAELIAQoAggiACADNgIMIAQgAzYCCCADQQA2AhggAyAENgIMIAMgADYCCAtBwB9BwB8oAgBBAWsiAEF/IAAbNgIACwuULQEMfyMAQRBrIgwkAAJAAkACQAJAAkACQAJAAkACQAJAAkACQCAAQfQBTQRAQaAfKAIAIgVBECAAQQtqQXhxIABBC0kbIghBA3YiAnYiAUEDcQRAIAFBf3NBAXEgAmoiA0EDdCIBQdAfaigCACIEQQhqIQACQCAEKAIIIgIgAUHIH2oiAUYEQEGgHyAFQX4gA3dxNgIADAELIAIgATYCDCABIAI2AggLIAQgA0EDdCIBQQNyNgIEIAEgBGoiASABKAIEQQFyNgIEDA0LIAhBqB8oAgAiCk0NASABBEACQEECIAJ0IgBBACAAa3IgASACdHEiAEEAIABrcUEBayIAIABBDHZBEHEiAnYiAUEFdkEIcSIAIAJyIAEgAHYiAUECdkEEcSIAciABIAB2IgFBAXZBAnEiAHIgASAAdiIBQQF2QQFxIgByIAEgAHZqIgNBA3QiAEHQH2ooAgAiBCgCCCIBIABByB9qIgBGBEBBoB8gBUF+IAN3cSIFNgIADAELIAEgADYCDCAAIAE2AggLIARBCGohACAEIAhBA3I2AgQgBCAIaiICIANBA3QiASAIayIDQQFyNgIEIAEgBGogAzYCACAKBEAgCkEDdiIBQQN0QcgfaiEHQbQfKAIAIQQCfyAFQQEgAXQiAXFFBEBBoB8gASAFcjYCACAHDAELIAcoAggLIQEgByAENgIIIAEgBDYCDCAEIAc2AgwgBCABNgIIC0G0HyACNgIAQagfIAM2AgAMDQtBpB8oAgAiBkUNASAGQQAgBmtxQQFrIgAgAEEMdkEQcSICdiIBQQV2QQhxIgAgAnIgASAAdiIBQQJ2QQRxIgByIAEgAHYiAUEBdkECcSIAciABIAB2IgFBAXZBAXEiAHIgASAAdmpBAnRB0CFqKAIAIgEoAgRBeHEgCGshAyABIQIDQAJAIAIoAhAiAEUEQCACKAIUIgBFDQELIAAoAgRBeHEgCGsiAiADIAIgA0kiAhshAyAAIAEgAhshASAAIQIMAQsLIAEgCGoiCSABTQ0CIAEoAhghCyABIAEoAgwiBEcEQCABKAIIIgBBsB8oAgBJGiAAIAQ2AgwgBCAANgIIDAwLIAFBFGoiAigCACIARQRAIAEoAhAiAEUNBCABQRBqIQILA0AgAiEHIAAiBEEUaiICKAIAIgANACAEQRBqIQIgBCgCECIADQALIAdBADYCAAwLC0F/IQggAEG/f0sNACAAQQtqIgBBeHEhCEGkHygCACIJRQ0AQQAgCGshAwJAAkACQAJ/QQAgCEGAAkkNABpBHyAIQf///wdLDQAaIABBCHYiACAAQYD+P2pBEHZBCHEiAnQiACAAQYDgH2pBEHZBBHEiAXQiACAAQYCAD2pBEHZBAnEiAHRBD3YgASACciAAcmsiAEEBdCAIIABBFWp2QQFxckEcagsiBUECdEHQIWooAgAiAkUEQEEAIQAMAQtBACEAIAhBAEEZIAVBAXZrIAVBH0YbdCEBA0ACQCACKAIEQXhxIAhrIgcgA08NACACIQQgByIDDQBBACEDIAIhAAwDCyAAIAIoAhQiByAHIAIgAUEddkEEcWooAhAiAkYbIAAgBxshACABQQF0IQEgAg0ACwsgACAEckUEQEEAIQRBAiAFdCIAQQAgAGtyIAlxIgBFDQMgAEEAIABrcUEBayIAIABBDHZBEHEiAnYiAUEFdkEIcSIAIAJyIAEgAHYiAUECdkEEcSIAciABIAB2IgFBAXZBAnEiAHIgASAAdiIBQQF2QQFxIgByIAEgAHZqQQJ0QdAhaigCACEACyAARQ0BCwNAIAAoAgRBeHEgCGsiASADSSECIAEgAyACGyEDIAAgBCACGyEEIAAoAhAiAQR/IAEFIAAoAhQLIgANAAsLIARFDQAgA0GoHygCACAIa08NACAEIAhqIgYgBE0NASAEKAIYIQUgBCAEKAIMIgFHBEAgBCgCCCIAQbAfKAIASRogACABNgIMIAEgADYCCAwKCyAEQRRqIgIoAgAiAEUEQCAEKAIQIgBFDQQgBEEQaiECCwNAIAIhByAAIgFBFGoiAigCACIADQAgAUEQaiECIAEoAhAiAA0ACyAHQQA2AgAMCQsgCEGoHygCACICTQRAQbQfKAIAIQMCQCACIAhrIgFBEE8EQEGoHyABNgIAQbQfIAMgCGoiADYCACAAIAFBAXI2AgQgAiADaiABNgIAIAMgCEEDcjYCBAwBC0G0H0EANgIAQagfQQA2AgAgAyACQQNyNgIEIAIgA2oiACAAKAIEQQFyNgIECyADQQhqIQAMCwsgCEGsHygCACIGSQRAQawfIAYgCGsiATYCAEG4H0G4HygCACICIAhqIgA2AgAgACABQQFyNgIEIAIgCEEDcjYCBCACQQhqIQAMCwtBACEAIAhBL2oiCQJ/QfgiKAIABEBBgCMoAgAMAQtBhCNCfzcCAEH8IkKAoICAgIAENwIAQfgiIAxBDGpBcHFB2KrVqgVzNgIAQYwjQQA2AgBB3CJBADYCAEGAIAsiAWoiBUEAIAFrIgdxIgIgCE0NCkHYIigCACIEBEBB0CIoAgAiAyACaiIBIANNIAEgBEtyDQsLQdwiLQAAQQRxDQUCQAJAQbgfKAIAIgMEQEHgIiEAA0AgAyAAKAIAIgFPBEAgASAAKAIEaiADSw0DCyAAKAIIIgANAAsLQQAQDCIBQX9GDQYgAiEFQfwiKAIAIgNBAWsiACABcQRAIAIgAWsgACABakEAIANrcWohBQsgBSAITSAFQf7///8HS3INBkHYIigCACIEBEBB0CIoAgAiAyAFaiIAIANNIAAgBEtyDQcLIAUQDCIAIAFHDQEMCAsgBSAGayAHcSIFQf7///8HSw0FIAUQDCIBIAAoAgAgACgCBGpGDQQgASEACyAAQX9GIAhBMGogBU1yRQRAQYAjKAIAIgEgCSAFa2pBACABa3EiAUH+////B0sEQCAAIQEMCAsgARAMQX9HBEAgASAFaiEFIAAhAQwIC0EAIAVrEAwaDAULIAAiAUF/Rw0GDAQLAAtBACEEDAcLQQAhAQwFCyABQX9HDQILQdwiQdwiKAIAQQRyNgIACyACQf7///8HSw0BIAIQDCIBQX9GQQAQDCIAQX9GciAAIAFNcg0BIAAgAWsiBSAIQShqTQ0BC0HQIkHQIigCACAFaiIANgIAQdQiKAIAIABJBEBB1CIgADYCAAsCQAJAAkBBuB8oAgAiBwRAQeAiIQADQCABIAAoAgAiAyAAKAIEIgJqRg0CIAAoAggiAA0ACwwCC0GwHygCACIAQQAgACABTRtFBEBBsB8gATYCAAtBACEAQeQiIAU2AgBB4CIgATYCAEHAH0F/NgIAQcQfQfgiKAIANgIAQewiQQA2AgADQCAAQQN0IgNB0B9qIANByB9qIgI2AgAgA0HUH2ogAjYCACAAQQFqIgBBIEcNAAtBrB8gBUEoayIDQXggAWtBB3FBACABQQhqQQdxGyIAayICNgIAQbgfIAAgAWoiADYCACAAIAJBAXI2AgQgASADakEoNgIEQbwfQYgjKAIANgIADAILIAAtAAxBCHEgAyAHS3IgASAHTXINACAAIAIgBWo2AgRBuB8gB0F4IAdrQQdxQQAgB0EIakEHcRsiAGoiAjYCAEGsH0GsHygCACAFaiIBIABrIgA2AgAgAiAAQQFyNgIEIAEgB2pBKDYCBEG8H0GIIygCADYCAAwBC0GwHygCACABSwRAQbAfIAE2AgALIAEgBWohAkHgIiEAAkACQAJAAkACQAJAA0AgAiAAKAIARwRAIAAoAggiAA0BDAILCyAALQAMQQhxRQ0BC0HgIiEAA0AgByAAKAIAIgJPBEAgAiAAKAIEaiIEIAdLDQMLIAAoAgghAAwACwALIAAgATYCACAAIAAoAgQgBWo2AgQgAUF4IAFrQQdxQQAgAUEIakEHcRtqIgkgCEEDcjYCBCACQXggAmtBB3FBACACQQhqQQdxG2oiBSAIIAlqIgZrIQIgBSAHRgRAQbgfIAY2AgBBrB9BrB8oAgAgAmoiADYCACAGIABBAXI2AgQMAwsgBUG0HygCAEYEQEG0HyAGNgIAQagfQagfKAIAIAJqIgA2AgAgBiAAQQFyNgIEIAAgBmogADYCAAwDCyAFKAIEIgBBA3FBAUYEQCAAQXhxIQcCQCAAQf8BTQRAIAUoAggiAyAAQQN2IgBBA3RByB9qRhogAyAFKAIMIgFGBEBBoB9BoB8oAgBBfiAAd3E2AgAMAgsgAyABNgIMIAEgAzYCCAwBCyAFKAIYIQgCQCAFIAUoAgwiAUcEQCAFKAIIIgAgATYCDCABIAA2AggMAQsCQCAFQRRqIgAoAgAiAw0AIAVBEGoiACgCACIDDQBBACEBDAELA0AgACEEIAMiAUEUaiIAKAIAIgMNACABQRBqIQAgASgCECIDDQALIARBADYCAAsgCEUNAAJAIAUgBSgCHCIDQQJ0QdAhaiIAKAIARgRAIAAgATYCACABDQFBpB9BpB8oAgBBfiADd3E2AgAMAgsgCEEQQRQgCCgCECAFRhtqIAE2AgAgAUUNAQsgASAINgIYIAUoAhAiAARAIAEgADYCECAAIAE2AhgLIAUoAhQiAEUNACABIAA2AhQgACABNgIYCyAFIAdqIQUgAiAHaiECCyAFIAUoAgRBfnE2AgQgBiACQQFyNgIEIAIgBmogAjYCACACQf8BTQRAIAJBA3YiAEEDdEHIH2ohAgJ/QaAfKAIAIgFBASAAdCIAcUUEQEGgHyAAIAFyNgIAIAIMAQsgAigCCAshACACIAY2AgggACAGNgIMIAYgAjYCDCAGIAA2AggMAwtBHyEAIAJB////B00EQCACQQh2IgAgAEGA/j9qQRB2QQhxIgN0IgAgAEGA4B9qQRB2QQRxIgF0IgAgAEGAgA9qQRB2QQJxIgB0QQ92IAEgA3IgAHJrIgBBAXQgAiAAQRVqdkEBcXJBHGohAAsgBiAANgIcIAZCADcCECAAQQJ0QdAhaiEEAkBBpB8oAgAiA0EBIAB0IgFxRQRAQaQfIAEgA3I2AgAgBCAGNgIAIAYgBDYCGAwBCyACQQBBGSAAQQF2ayAAQR9GG3QhACAEKAIAIQEDQCABIgMoAgRBeHEgAkYNAyAAQR12IQEgAEEBdCEAIAMgAUEEcWoiBCgCECIBDQALIAQgBjYCECAGIAM2AhgLIAYgBjYCDCAGIAY2AggMAgtBrB8gBUEoayIDQXggAWtBB3FBACABQQhqQQdxGyIAayICNgIAQbgfIAAgAWoiADYCACAAIAJBAXI2AgQgASADakEoNgIEQbwfQYgjKAIANgIAIAcgBEEnIARrQQdxQQAgBEEna0EHcRtqQS9rIgAgACAHQRBqSRsiAkEbNgIEIAJB6CIpAgA3AhAgAkHgIikCADcCCEHoIiACQQhqNgIAQeQiIAU2AgBB4CIgATYCAEHsIkEANgIAIAJBGGohAANAIABBBzYCBCAAQQhqIQEgAEEEaiEAIAEgBEkNAAsgAiAHRg0DIAIgAigCBEF+cTYCBCAHIAIgB2siBEEBcjYCBCACIAQ2AgAgBEH/AU0EQCAEQQN2IgBBA3RByB9qIQICf0GgHygCACIBQQEgAHQiAHFFBEBBoB8gACABcjYCACACDAELIAIoAggLIQAgAiAHNgIIIAAgBzYCDCAHIAI2AgwgByAANgIIDAQLQR8hACAHQgA3AhAgBEH///8HTQRAIARBCHYiACAAQYD+P2pBEHZBCHEiAnQiACAAQYDgH2pBEHZBBHEiAXQiACAAQYCAD2pBEHZBAnEiAHRBD3YgASACciAAcmsiAEEBdCAEIABBFWp2QQFxckEcaiEACyAHIAA2AhwgAEECdEHQIWohAwJAQaQfKAIAIgJBASAAdCIBcUUEQEGkHyABIAJyNgIAIAMgBzYCACAHIAM2AhgMAQsgBEEAQRkgAEEBdmsgAEEfRht0IQAgAygCACEBA0AgASICKAIEQXhxIARGDQQgAEEddiEBIABBAXQhACACIAFBBHFqIgMoAhAiAQ0ACyADIAc2AhAgByACNgIYCyAHIAc2AgwgByAHNgIIDAMLIAMoAggiACAGNgIMIAMgBjYCCCAGQQA2AhggBiADNgIMIAYgADYCCAsgCUEIaiEADAULIAIoAggiACAHNgIMIAIgBzYCCCAHQQA2AhggByACNgIMIAcgADYCCAtBrB8oAgAiACAITQ0AQawfIAAgCGsiATYCAEG4H0G4HygCACICIAhqIgA2AgAgACABQQFyNgIEIAIgCEEDcjYCBCACQQhqIQAMAwtB3B5BMDYCAEEAIQAMAgsCQCAFRQ0AAkAgBCgCHCICQQJ0QdAhaiIAKAIAIARGBEAgACABNgIAIAENAUGkHyAJQX4gAndxIgk2AgAMAgsgBUEQQRQgBSgCECAERhtqIAE2AgAgAUUNAQsgASAFNgIYIAQoAhAiAARAIAEgADYCECAAIAE2AhgLIAQoAhQiAEUNACABIAA2AhQgACABNgIYCwJAIANBD00EQCAEIAMgCGoiAEEDcjYCBCAAIARqIgAgACgCBEEBcjYCBAwBCyAEIAhBA3I2AgQgBiADQQFyNgIEIAMgBmogAzYCACADQf8BTQRAIANBA3YiAEEDdEHIH2ohAgJ/QaAfKAIAIgFBASAAdCIAcUUEQEGgHyAAIAFyNgIAIAIMAQsgAigCCAshACACIAY2AgggACAGNgIMIAYgAjYCDCAGIAA2AggMAQtBHyEAIANB////B00EQCADQQh2IgAgAEGA/j9qQRB2QQhxIgJ0IgAgAEGA4B9qQRB2QQRxIgF0IgAgAEGAgA9qQRB2QQJxIgB0QQ92IAEgAnIgAHJrIgBBAXQgAyAAQRVqdkEBcXJBHGohAAsgBiAANgIcIAZCADcCECAAQQJ0QdAhaiECAkACQCAJQQEgAHQiAXFFBEBBpB8gASAJcjYCACACIAY2AgAgBiACNgIYDAELIANBAEEZIABBAXZrIABBH0YbdCEAIAIoAgAhCANAIAgiASgCBEF4cSADRg0CIABBHXYhAiAAQQF0IQAgASACQQRxaiICKAIQIggNAAsgAiAGNgIQIAYgATYCGAsgBiAGNgIMIAYgBjYCCAwBCyABKAIIIgAgBjYCDCABIAY2AgggBkEANgIYIAYgATYCDCAGIAA2AggLIARBCGohAAwBCwJAIAtFDQACQCABKAIcIgJBAnRB0CFqIgAoAgAgAUYEQCAAIAQ2AgAgBA0BQaQfIAZBfiACd3E2AgAMAgsgC0EQQRQgCygCECABRhtqIAQ2AgAgBEUNAQsgBCALNgIYIAEoAhAiAARAIAQgADYCECAAIAQ2AhgLIAEoAhQiAEUNACAEIAA2AhQgACAENgIYCwJAIANBD00EQCABIAMgCGoiAEEDcjYCBCAAIAFqIgAgACgCBEEBcjYCBAwBCyABIAhBA3I2AgQgCSADQQFyNgIEIAMgCWogAzYCACAKBEAgCkEDdiIAQQN0QcgfaiEEQbQfKAIAIQICf0EBIAB0IgAgBXFFBEBBoB8gACAFcjYCACAEDAELIAQoAggLIQAgBCACNgIIIAAgAjYCDCACIAQ2AgwgAiAANgIIC0G0HyAJNgIAQagfIAM2AgALIAFBCGohAAsgDEEQaiQAIAALfwEDfyAAIQECQCAAQQNxBEADQCABLQAARQ0CIAFBAWoiAUEDcQ0ACwsDQCABIgJBBGohASACKAIAIgNBf3MgA0GBgoQIa3FBgIGChHhxRQ0ACyADQf8BcUUEQCACIABrDwsDQCACLQABIQMgAkEBaiIBIQIgAw0ACwsgASAAawvyAgICfwF+AkAgAkUNACAAIAJqIgNBAWsgAToAACAAIAE6AAAgAkEDSQ0AIANBAmsgAToAACAAIAE6AAEgA0EDayABOgAAIAAgAToAAiACQQdJDQAgA0EEayABOgAAIAAgAToAAyACQQlJDQAgAEEAIABrQQNxIgRqIgMgAUH/AXFBgYKECGwiATYCACADIAIgBGtBfHEiBGoiAkEEayABNgIAIARBCUkNACADIAE2AgggAyABNgIEIAJBCGsgATYCACACQQxrIAE2AgAgBEEZSQ0AIAMgATYCGCADIAE2AhQgAyABNgIQIAMgATYCDCACQRBrIAE2AgAgAkEUayABNgIAIAJBGGsgATYCACACQRxrIAE2AgAgBCADQQRxQRhyIgRrIgJBIEkNACABrUKBgICAEH4hBSADIARqIQEDQCABIAU3AxggASAFNwMQIAEgBTcDCCABIAU3AwAgAUEgaiEBIAJBIGsiAkEfSw0ACwsgAAtPAQJ/QdgeKAIAIgEgAEEDakF8cSICaiEAAkAgAkEAIAAgAU0bDQAgAD8AQRB0SwRAIAAQAUUNAQtB2B4gADYCACABDwtB3B5BMDYCAEF/C20BAX8jAEGAAmsiBSQAIARBgMAEcSACIANMckUEQCAFIAFB/wFxIAIgA2siAkGAAiACQYACSSIBGxALGiABRQRAA0AgACAFQYACEA4gAkGAAmsiAkH/AUsNAAsLIAAgBSACEA4LIAVBgAJqJAALnQIBA38gAC0AAEEgcUUEQAJAIAEhBAJAIAIgACIBKAIQIgAEfyAABQJ/IAEiACABLQBKIgNBAWsgA3I6AEogASgCACIDQQhxBEAgACADQSByNgIAQX8MAQsgAEIANwIEIAAgACgCLCIDNgIcIAAgAzYCFCAAIAMgACgCMGo2AhBBAAsNASABKAIQCyABKAIUIgVrSwRAIAEgBCACIAEoAiQRAAAaDAILAn8gASwAS0F/SgRAIAIhAANAIAIgACIDRQ0CGiAEIANBAWsiAGotAABBCkcNAAsgASAEIAMgASgCJBEAACADSQ0CIAMgBGohBCABKAIUIQUgAiADawwBCyACCyEAIAUgBCAAEAUaIAEgASgCFCAAajYCFAsLCwsKACAAQTBrQQpJC2MBAn8gAkUEQEEADwsCfyAALQAAIgMEQANAAkACQCABLQAAIgRFDQAgAkEBayICRQ0AIAMgBEYNAQsgAwwDCyABQQFqIQEgAC0AASEDIABBAWohACADDQALC0EACyABLQAAawucDQIQfhB/IwBBgBBrIhQkACAUQYAIaiABEBcgFEGACGogABAWIBQgFEGACGoQFyADBEAgFCACEBYLQQAhAEEAIQEDQCAUQYAIaiABQQd0IgNBwAByaiIVKQMAIBRBgAhqIANB4AByaiIWKQMAIBRBgAhqIANqIhcpAwAgFEGACGogA0EgcmoiGCkDACIIEAMiBIVBIBACIgUQAyIGIAiFQRgQAiEIIAggBiAFIAQgCBADIgeFQRAQAiIKEAMiEYVBPxACIQggFEGACGogA0HIAHJqIhkpAwAgFEGACGogA0HoAHJqIhopAwAgFEGACGogA0EIcmoiGykDACAUQYAIaiADQShyaiIcKQMAIgQQAyIFhUEgEAIiBhADIgsgBIVBGBACIQQgBCALIAYgBSAEEAMiC4VBEBACIhIQAyIThUE/EAIhBCAUQYAIaiADQdAAcmoiHSkDACAUQYAIaiADQfAAcmoiHikDACAUQYAIaiADQRByaiIfKQMAIBRBgAhqIANBMHJqIiApAwAiBRADIgaFQSAQAiIMEAMiDSAFhUEYEAIhBSAFIA0gDCAGIAUQAyINhUEQEAIiDBADIg6FQT8QAiEFIBRBgAhqIANB2AByaiIhKQMAIBRBgAhqIANB+AByaiIiKQMAIBRBgAhqIANBGHJqIiMpAwAgFEGACGogA0E4cmoiAykDACIGEAMiD4VBIBACIgkQAyIQIAaFQRgQAiEGIAYgECAJIA8gBhADIg+FQRAQAiIJEAMiEIVBPxACIQYgFyAHIAQQAyIHIAQgDiAHIAmFQSAQAiIHEAMiDoVBGBACIgQQAyIJNwMAICIgByAJhUEQEAIiBzcDACAdIA4gBxADIgc3AwAgHCAEIAeFQT8QAjcDACAbIAsgBRADIgQgBSAQIAQgCoVBIBACIgQQAyIHhUEYEAIiBRADIgo3AwAgFiAEIAqFQRAQAiIENwMAICEgByAEEAMiBDcDACAgIAQgBYVBPxACNwMAIB8gDSAGEAMiBCAGIBEgBCAShUEgEAIiBBADIgWFQRgQAiIGEAMiBzcDACAaIAQgB4VBEBACIgQ3AwAgFSAFIAQQAyIENwMAIAMgBCAGhUE/EAI3AwAgIyAPIAgQAyIEIAggEyAEIAyFQSAQAiIEEAMiBYVBGBACIggQAyIGNwMAIB4gBCAGhUEQEAIiBDcDACAZIAUgBBADIgQ3AwAgGCAEIAiFQT8QAjcDACABQQFqIgFBCEcNAAsDQCAAQQR0IgMgFEGACGpqIgEiFUGABGopAwAgASkDgAYgASkDACABKQOAAiIIEAMiBIVBIBACIgUQAyIGIAiFQRgQAiEIIAggBiAFIAQgCBADIgeFQRAQAiIKEAMiEYVBPxACIQggASkDiAQgASkDiAYgFEGACGogA0EIcmoiAykDACABKQOIAiIEEAMiBYVBIBACIgYQAyILIASFQRgQAiEEIAQgCyAGIAUgBBADIguFQRAQAiISEAMiE4VBPxACIQQgASkDgAUgASkDgAcgASkDgAEgASkDgAMiBRADIgaFQSAQAiIMEAMiDSAFhUEYEAIhBSAFIA0gDCAGIAUQAyINhUEQEAIiDBADIg6FQT8QAiEFIAEpA4gFIAEpA4gHIAEpA4gBIAEpA4gDIgYQAyIPhUEgEAIiCRADIhAgBoVBGBACIQYgBiAQIAkgDyAGEAMiD4VBEBACIgkQAyIQhUE/EAIhBiABIAcgBBADIgcgBCAOIAcgCYVBIBACIgcQAyIOhUEYEAIiBBADIgk3AwAgASAHIAmFQRAQAiIHNwOIByABIA4gBxADIgc3A4AFIAEgBCAHhUE/EAI3A4gCIAMgCyAFEAMiBCAFIBAgBCAKhUEgEAIiBBADIgeFQRgQAiIFEAMiCjcDACABIAQgCoVBEBACIgQ3A4AGIAEgByAEEAMiBDcDiAUgASAEIAWFQT8QAjcDgAMgASANIAYQAyIEIAYgESAEIBKFQSAQAiIEEAMiBYVBGBACIgYQAyIHNwOAASABIAQgB4VBEBACIgQ3A4gGIBUgBSAEEAMiBDcDgAQgASAEIAaFQT8QAjcDiAMgASAPIAgQAyIEIAggEyAEIAyFQSAQAiIEEAMiBYVBGBACIggQAyIGNwOIASABIAQgBoVBEBACIgQ3A4AHIAEgBSAEEAMiBDcDiAQgASAEIAiFQT8QAjcDgAIgAEEBaiIAQQhHDQALIAIgFBAXIAIgFEGACGoQFiAUQYAQaiQAC8MBAQN/IwBBQGoiAyQAIANBAEHAABALIQRBfyEDAkAgAEUgAUVyDQAgACgC5AEgAksNACAAKQNQQgBSDQAgACAANQLgARAaIAAQJUEAIQMgAEHgAGoiAiAAKALgASIFakEAQYABIAVrEAsaIAAgAhAZA0AgBCADQQN0IgVqIAAgBWopAwAQMiADQQFqIgNBCEcNAAsgASAEIAAoAuQBEAUaIARBwAAQBCACQYABEAQgAEHAABAEQQAhAwsgBEFAayQAIAML1AMBBn8jAEEQayIEJAAgBCABNgIMIwBBoAFrIgMkACADQQhqQYAYQZABEAUaIAMgADYCNCADIAA2AhwgA0F+IABrIgJB/////wcgAkH/////B0kbIgU2AjggAyAAIAVqIgA2AiQgAyAANgIYIANBCGohACMAQdABayICJAAgAiABNgLMASACQaABakEAQSgQCxogAiACKALMATYCyAECQEEAIAJByAFqIAJB0ABqIAJBoAFqEBtBAEgNACAAKAJMQQBOIQYgACgCACEBIAAsAEpBAEwEQCAAIAFBX3E2AgALIAFBIHEhBwJ/IAAoAjAEQCAAIAJByAFqIAJB0ABqIAJBoAFqEBsMAQsgAEHQADYCMCAAIAJB0ABqNgIQIAAgAjYCHCAAIAI2AhQgACgCLCEBIAAgAjYCLCAAIAJByAFqIAJB0ABqIAJBoAFqEBsgAUUNABogAEEAQQAgACgCJBEAABogAEEANgIwIAAgATYCLCAAQQA2AhwgAEEANgIQIAAoAhQaIABBADYCFEEACxogACAAKAIAIAdyNgIAIAZFDQALIAJB0AFqJAAgBQRAIAMoAhwiACAAIAMoAhhGa0EAOgAACyADQaABaiQAIARBEGokAAs0AQF/QQEhAQJAIABBCkkNAEECIQEDQCAAQeQASQ0BIAFBAWohASAAQQpuIQAMAAsACyABC4UBAQd/AkAgAC0AACIGQTBrQf8BcUEJSw0AIAYhAgNAIAQhByADQZmz5swBSw0BIAJB/wFxQTBrIgIgA0EKbCIEQX9zSw0BIAIgBGohAyAAIAdBAWoiBGoiCC0AACICQTBrQf8BcUEKSQ0ACyAGQTBGQQAgBxsNACABIAM2AgAgCCEFCyAFCzEBA38DQCAAIAJBA3QiA2oiBCAEKQMAIAEgA2opAwCFNwMAIAJBAWoiAkGAAUcNAAsLDAAgACABQYAIEAUaC14BAn8jAEFAaiICJABBfyEDAkAgAEUNACABQQFrQcAATwRAIAAQNwwBCyACQQE6AAMgAkGAAjsAASACIAE6AAAgAkEEckEAQTwQCxogACACEDwhAwsgAkFAayQAIAMLpAoCA38RfiMAQYACayIDJAADQCACQQN0IgQgA0GAAWpqIAEgBGopAAA3AwAgAkEBaiICQRBHDQALIAMgAEHAABAFIQEgACkDWEL5wvibkaOz8NsAhSELIAApA1BC6/qG2r+19sEfhSEMIAApA0hCn9j52cKR2oKbf4UhDSAAKQNAQtGFmu/6z5SH0QCFIQ5C8e30+KWn/aelfyEPQqvw0/Sv7ry3PCESQrvOqqbY0Ouzu38hEEKIkvOd/8z5hOoAIQVBACEDIAEpAzghBiABKQMYIRQgASkDMCEHIAEpAxAhFSABKQMoIQggASkDCCERIAEpAyAhCSABKQMAIQoDQCAJIAUgDiABQYABaiADQQZ0IgJBwAhqKAIAQQN0aikDACAJIAp8fCIKhUEgEAIiDnwiE4VBGBACIQUgBSATIA4gAUGAAWogAkHECGooAgBBA3RqKQMAIAUgCnx8IgqFQRAQAiIOfCIThUE/EAIhCSAIIBAgDSABQYABaiACQcgIaigCAEEDdGopAwAgCCARfHwiEYVBIBACIg18IhCFQRgQAiEFIAUgECANIAFBgAFqIAJBzAhqKAIAQQN0aikDACAFIBF8fCIRhUEQEAIiDXwiEIVBPxACIQUgEiAMIAFBgAFqIAJB0AhqKAIAQQN0aikDACAHIBV8fCIIhUEgEAIiDHwiEiAHhUEYEAIhByAHIBIgDCABQYABaiACQdQIaigCAEEDdGopAwAgByAIfHwiFYVBEBACIgx8IgiFQT8QAiEHIA8gCyABQYABaiACQdgIaigCAEEDdGopAwAgBiAUfHwiEoVBIBACIgt8Ig8gBoVBGBACIQYgBiALIAFBgAFqIAJB3AhqKAIAQQN0aikDACAGIBJ8fCIUhUEQEAIiCyAPfCIPhUE/EAIhBiAFIAggCyABQYABaiACQeAIaigCAEEDdGopAwAgBSAKfHwiCoVBIBACIgt8IgiFQRgQAiEFIAUgCCALIAFBgAFqIAJB5AhqKAIAQQN0aikDACAFIAp8fCIKhUEQEAIiC3wiEoVBPxACIQggByAPIA4gAUGAAWogAkHoCGooAgBBA3RqKQMAIAcgEXx8Ig+FQSAQAiIOfCIRhUEYEAIhBSAFIBEgDiABQYABaiACQewIaigCAEEDdGopAwAgBSAPfHwiEYVBEBACIg58Ig+FQT8QAiEHIAYgDSABQYABaiACQfAIaigCAEEDdGopAwAgBiAVfHwiBYVBIBACIg0gE3wiE4VBGBACIQYgBiATIA0gAUGAAWogAkH0CGooAgBBA3RqKQMAIAUgBnx8IhWFQRAQAiINfCIFhUE/EAIhBiAJIBAgDCABQYABaiACQfgIaigCAEEDdGopAwAgCSAUfHwiEIVBIBACIgx8IhOFQRgQAiEJIAkgEyAMIAFBgAFqIAJB/AhqKAIAQQN0aikDACAJIBB8fCIUhUEQEAIiDHwiEIVBPxACIQkgA0EBaiIDQQxHDQALIAEgDjcDYCABIAk3AyAgASANNwNoIAEgCDcDKCABIBE3AwggASAQNwNIIAEgDDcDcCABIAc3AzAgASAVNwMQIAEgEjcDUCABIAs3A3ggASAGNwM4IAEgFDcDGCABIA83A1ggASAFNwNAIAEgCjcDACAAIAogACkDAIUgBYU3AwBBASECA0AgACACQQN0IgNqIgQgASADaiIDKQMAIAQpAwCFIANBQGspAwCFNwMAIAJBAWoiAkEIRw0ACyABQYACaiQACyYBAX4gACABIAApA0AiAXwiAjcDQCAAIAApA0ggASACVq18NwNIC6AUAhB/An4jAEHQAGsiBiQAIAZByg42AkwgBkE3aiETIAZBOGohEANAAkAgDkEASA0AQf////8HIA5rIARIBEBB3B5BPTYCAEF/IQ4MAQsgBCAOaiEOCyAGKAJMIgchBAJAAkACQAJAAkACQAJAAkAgBgJ/AkAgBy0AACIFBEADQAJAAkAgBUH/AXEiBUUEQCAEIQUMAQsgBUElRw0BIAQhBQNAIAQtAAFBJUcNASAGIARBAmoiCDYCTCAFQQFqIQUgBC0AAiELIAghBCALQSVGDQALCyAFIAdrIQQgAARAIAAgByAEEA4LIAQNDSAGKAJMLAABEA8hBSAGKAJMIQQgBUUNAyAELQACQSRHDQMgBCwAAUEwayEPQQEhESAEQQNqDAQLIAYgBEEBaiIINgJMIAQtAAEhBSAIIQQMAAsACyAOIQwgAA0IIBFFDQJBASEEA0AgAyAEQQJ0aigCACIABEAgAiAEQQN0aiAAIAEQJEEBIQwgBEEBaiIEQQpHDQEMCgsLQQEhDCAEQQpPDQgDQCADIARBAnRqKAIADQggBEEBaiIEQQpHDQALDAgLQX8hDyAEQQFqCyIENgJMQQAhCAJAIAQsAAAiDUEgayIFQR9LDQBBASAFdCIFQYnRBHFFDQADQAJAIAYgBEEBaiIINgJMIAQsAAEiDUEgayIEQSBPDQBBASAEdCIEQYnRBHFFDQAgBCAFciEFIAghBAwBCwsgCCEEIAUhCAsCQCANQSpGBEAgBgJ/AkAgBCwAARAPRQ0AIAYoAkwiBC0AAkEkRw0AIAQsAAFBAnQgA2pBwAFrQQo2AgAgBCwAAUEDdCACakGAA2soAgAhCkEBIREgBEEDagwBCyARDQhBACERQQAhCiAABEAgASABKAIAIgRBBGo2AgAgBCgCACEKCyAGKAJMQQFqCyIENgJMIApBf0oNAUEAIAprIQogCEGAwAByIQgMAQsgBkHMAGoQIyIKQQBIDQYgBigCTCEEC0F/IQkCQCAELQAAQS5HDQAgBC0AAUEqRgRAAkAgBCwAAhAPRQ0AIAYoAkwiBC0AA0EkRw0AIAQsAAJBAnQgA2pBwAFrQQo2AgAgBCwAAkEDdCACakGAA2soAgAhCSAGIARBBGoiBDYCTAwCCyARDQcgAAR/IAEgASgCACIEQQRqNgIAIAQoAgAFQQALIQkgBiAGKAJMQQJqIgQ2AkwMAQsgBiAEQQFqNgJMIAZBzABqECMhCSAGKAJMIQQLQQAhBQNAIAUhEkF/IQwgBCwAAEHBAGtBOUsNByAGIARBAWoiDTYCTCAELAAAIQUgDSEEIAUgEkE6bGpBzxhqLQAAIgVBAWtBCEkNAAsgBUETRg0CIAVFDQYgD0EATgRAIAMgD0ECdGogBTYCACAGIAIgD0EDdGopAwA3A0AMBAsgAA0BC0EAIQwMBQsgBkFAayAFIAEQJCAGKAJMIQ0MAgsgD0F/Sg0DC0EAIQQgAEUNBAsgCEH//3txIgsgCCAIQYDAAHEbIQVBACEMQcAOIQ8gECEIAkACQAJAAn8CQAJAAkACQAJ/AkACQAJAAkACQAJAAkAgDUEBaywAACIEQV9xIAQgBEEPcUEDRhsgBCASGyIEQdgAaw4hBBISEhISEhISDhIPBg4ODhIGEhISEgIFAxISCRIBEhIEAAsCQCAEQcEAaw4HDhILEg4ODgALIARB0wBGDQkMEQsgBikDQCEUQcAODAULQQAhBAJAAkACQAJAAkACQAJAIBJB/wFxDggAAQIDBBcFBhcLIAYoAkAgDjYCAAwWCyAGKAJAIA42AgAMFQsgBigCQCAOrDcDAAwUCyAGKAJAIA47AQAMEwsgBigCQCAOOgAADBILIAYoAkAgDjYCAAwRCyAGKAJAIA6sNwMADBALIAlBCCAJQQhLGyEJIAVBCHIhBUH4ACEECyAQIQcgBEEgcSELIAYpA0AiFFBFBEADQCAHQQFrIgcgFKdBD3FB4BxqLQAAIAtyOgAAIBRCD1YhDSAUQgSIIRQgDQ0ACwsgBUEIcUUgBikDQFByDQMgBEEEdkHADmohD0ECIQwMAwsgECEEIAYpA0AiFFBFBEADQCAEQQFrIgQgFKdBB3FBMHI6AAAgFEIHViEHIBRCA4ghFCAHDQALCyAEIQcgBUEIcUUNAiAJIBAgB2siBEEBaiAEIAlIGyEJDAILIAYpA0AiFEJ/VwRAIAZCACAUfSIUNwNAQQEhDEHADgwBCyAFQYAQcQRAQQEhDEHBDgwBC0HCDkHADiAFQQFxIgwbCyEPIBAhBAJAIBRCgICAgBBUBEAgFCEVDAELA0AgBEEBayIEIBQgFEIKgCIVQgp+fadBMHI6AAAgFEL/////nwFWIQcgFSEUIAcNAAsLIBWnIgcEQANAIARBAWsiBCAHIAdBCm4iC0EKbGtBMHI6AAAgB0EJSyENIAshByANDQALCyAEIQcLIAVB//97cSAFIAlBf0obIQUgBikDQCIUQgBSIAlyRQRAQQAhCSAQIQcMCgsgCSAUUCAQIAdraiIEIAQgCUgbIQkMCQsCfyAJIgRBAEchCAJAAkACQCAGKAJAIgVB4xYgBRsiByIFQQNxRSAERXINAANAIAUtAABFDQIgBEEBayIEQQBHIQggBUEBaiIFQQNxRQ0BIAQNAAsLIAhFDQELAkAgBS0AAEUgBEEESXINAANAIAUoAgAiCEF/cyAIQYGChAhrcUGAgYKEeHENASAFQQRqIQUgBEEEayIEQQNLDQALCyAERQ0AA0AgBSAFLQAARQ0CGiAFQQFqIQUgBEEBayIEDQALC0EACyIEIAcgCWogBBshCCALIQUgBCAHayAJIAQbIQkMCAsgCQRAIAYoAkAMAgtBACEEIABBICAKQQAgBRANDAILIAZBADYCDCAGIAYpA0A+AgggBiAGQQhqNgJAQX8hCSAGQQhqCyEIQQAhBAJAA0AgCCgCACIHRQ0BIAZBBGogBxAiIgdBAEgiCyAHIAkgBGtLckUEQCAIQQRqIQggCSAEIAdqIgRLDQEMAgsLQX8hDCALDQULIABBICAKIAQgBRANIARFBEBBACEEDAELQQAhCCAGKAJAIQ0DQCANKAIAIgdFDQEgBkEEaiAHECIiByAIaiIIIARKDQEgACAGQQRqIAcQDiANQQRqIQ0gBCAISw0ACwsgAEEgIAogBCAFQYDAAHMQDSAKIAQgBCAKSBshBAwFCyAAIAYrA0AgCiAJIAUgBEEAEQwAIQQMBAsgBiAGKQNAPAA3QQEhCSATIQcgCyEFDAILQX8hDAsgBkHQAGokACAMDwsgAEEgIAwgCCAHayILIAkgCSALSBsiCWoiCCAKIAggCkobIgQgCCAFEA0gACAPIAwQDiAAQTAgBCAIIAVBgIAEcxANIABBMCAJIAtBABANIAAgByALEA4gAEEgIAQgCCAFQYDAAHMQDQwACwALkwIBAn8gAEUEQEFnDwsgACgCAEUEQEF/DwsCQAJ/QX4gACgCBEEESQ0AGiAAKAIIRQRAQW4gACgCDA0BGgsgACgCFCEBIAAoAhBFDQFBeiABQQhJDQAaIAAoAhhFBEBBbCAAKAIcDQEaCyAAKAIgRQRAQWsgACgCJA0BGgtBciAAKAIsIgFBCEkNABpBcSABQYCAgAFLDQAaQXIgASAAKAIwIgJBA3RJDQAaIAAoAihFBEBBdA8LIAJFBEBBcA8LQW8gAkH///8HSw0AGiAAKAI0IgFFBEBBZA8LQWMgAUH///8HSw0AGiAAKAJAIQECQCAAKAI8BEAgAQ0BQWkPC0FoIAENARoLQQALDwtBbUF6IAEbCzgBAX8jAEEQayICJAAgAiAANgIMIAIgATYCCCACKAIMQQAgAigCCEH8FygCABEAABogAkEQaiQAC4MSAhN/An4jAEEwayIJJAACQCAAEBwiBA0AQWYhBCABQQJLDQAgACgCLCEDIAAoAjAhBCAAKAI4IQIgCUEANgIAIAkgAjYCBCAAKAIoIQIgCSAENgIYIAkgAjYCCCAJIARBA3QiAiADIAIgA0sbIARBAnQiAm4iAzYCECAJIANBAnQ2AhQgCSACIANsNgIMIAAoAjQhAyAJIAE2AiAgCSADNgIcIAMgBEsEQCAJIAQ2AhwLIwBB0ABrIgskAEFnIQQCQCAJIgFFIAAiA0VyDQAgASADNgIoIAMhBSABKAIMIQZBaiECAkAgASIERQ0AIAatQgqGIhVCIIinDQAgFachAgJAIAUoAjwiBQRAIAQgAiAFEQMAGiAEKAIAIQIMAQsgBCACEAkiAjYCAAtBAEFqIAIbIQILIAIiBA0AIAEoAiAhBSMAQYACayICJAAgA0UgCyIERXJFBEAgAkEQakHAABAYGiACQQxqIAMoAjAQByACQRBqIAJBDGpBBBAGGiACQQxqIAMoAgQQByACQRBqIAJBDGpBBBAGGiACQQxqIAMoAiwQByACQRBqIAJBDGpBBBAGGiACQQxqIAMoAigQByACQRBqIAJBDGpBBBAGGiACQQxqIAMoAjgQByACQRBqIAJBDGpBBBAGGiACQQxqIAUQByACQRBqIAJBDGpBBBAGGiACQQxqIAMoAgwQByACQRBqIAJBDGpBBBAGGgJAIAMoAggiBUUNACACQRBqIAUgAygCDBAGGiADLQBEQQFxRQ0AIAMoAgggAygCDBAdIANBADYCDAsgAkEMaiADKAIUEAcgAkEQaiACQQxqQQQQBhogAygCECIFBEAgAkEQaiAFIAMoAhQQBhoLIAJBDGogAygCHBAHIAJBEGogAkEMakEEEAYaAkAgAygCGCIFRQ0AIAJBEGogBSADKAIcEAYaIAMtAERBAnFFDQAgAygCGCADKAIcEB0gA0EANgIcCyACQQxqIAMoAiQQByACQRBqIAJBDGpBBBAGGiADKAIgIgUEQCACQRBqIAUgAygCJBAGGgsgAkEQaiAEQcAAEBIaCyACQYACaiQAIAtBQGtBCBAEQQAhAiMAQYAIayIDJAAgASgCGARAIARBxABqIQYgBEFAayEFA0AgBUEAEAcgBiACEAcgA0GACCAEQcgAECAgASgCACABKAIUIAJsQQp0aiADEC4gBUEBEAcgA0GACCAEQcgAECAgASgCACABKAIUIAJsQQp0akGACGogAxAuIAJBAWoiAiABKAIYSQ0ACwsgA0GACBAEIANBgAhqJAAgC0HIABAEQQAhBAsgC0HQAGokACAEDQBBZyEEAkAgCUUNACABKAIYRQ0AIwBBIGsiBSQAIAEiCygCCARAIAsoAhghBANAIAQhA0EAIQ8DQEEAIRBBACECIAMEQANAIAUgDzoAGCAFQQA2AhwgBSAFKQMYNwMIIAUgEjYCECAFIBA2AhQgBSAFKQMQNwMAIAUhBEEAIREjAEGAGGsiByQAAkAgCyIDRQ0AAkACQAJAAn8CfwJAAkACQCADKAIgQQFrDgICAQALIAQoAgAhCEEADAMLIAQoAgANA0EAIAQtAAgiDEECSQ0BGiAELQAIIghFQQF0IQwMBQsgBC0ACCEMIAQoAgALIQggBxAvIAdBgAhqEC8gByAIrTcDgAggBDUCBCEVIAcgDK1C/wGDNwOQCCAHIBU3A4gIIAcgAzUCDDcDmAggByADNQIINwOgCCAHIAM1AiA3A6gIQQELIREgCEUNAQsgBC0ACCEIQQAhDAwBCyAELQAIIghFQQF0IQwgCCARRXINACAHQYAQaiAHQYAIaiAHECZBAiEMQQAhCAsgDCADKAIQIgZPDQBBfyADKAIUIgJBAWsgAiAEKAIEbCAMaiAGIAhB/wFxbGoiCCACcBsgCGohBgNAIAhBAWsgBiAIIAJwQQFGGyEOAn8gEQRAIAxB/wBxIgJFBEAgB0GAEGogB0GACGogBxAmCyAHQYAQaiACQQN0agwBCyADKAIAIA5BCnRqCyECIAMoAhghCiACKQMAIRUgBCAMNgIMIAMhBiAVpyEUIBVCIIinIApwrSIVIBUgBDUCBCIVIAQtAAgbIAQoAgAbIhYgFVEhCgJ+IAQiAigCAEUEQCACLQAIIg1FBEAgAigCDEEBayEKQgAMAgsgBigCECANbCENIAIoAgwhAiAKBEAgAiANakEBayEKQgAMAgsgDSACRWshCkIADAELIAYoAhAhDSAGKAIUIRMCfyAKBEAgAigCDCATIA1Bf3NqagwBCyATIA1rIAIoAgxFawshCkIAIAItAAgiAkEDRg0AGiANIAJBAWpsrQshFSAVIApBAWutfCAKrSAUrSIVIBV+QiCIfkIgiH0gBjUCFIKnIQYgAygCACICIAMoAhQgFqdsQQp0aiAGQQp0aiEGIAIgCEEKdGohCgJAIAMoAgRBEEYEQCACIA5BCnRqIAYgCkEAEBEMAQsgAiAOQQp0aiECIAQoAgBFBEAgAiAGIApBABARDAELIAIgBiAKQQEQEQsgDEEBaiIMIAMoAhBPDQEgCEEBaiEIIA5BAWohBiADKAIUIQIMAAsACyAHQYAYaiQAIAsoAhgiBCECIBBBAWoiECAESQ0ACwsgAiEDIA9BAWoiD0EERw0ACyASQQFqIhIgCygCCEkNAAsLIAVBIGokAEEAIQQLIAQNACMAQYAQayIDJAAgAEUgCUVyRQRAIANBgAhqIAEoAgAgASgCFEEKdGpBgAhrEBcgASgCGEECTwRAQQEhBANAIANBgAhqIAEoAgAgASgCFCICIAIgBGxqQQp0akGACGsQFiAEQQFqIgQgASgCGEkNAAsLIAMiAkGACGohC0EAIQQDQCACIARBA3QiBWogBSALaikDABAyIARBAWoiBEGAAUcNAAsgACgCACAAKAIEIANBgAgQICADQYAIakGACBAEIANBgAgQBCABKAIAIgQgASgCDEEKdCIBEAQCQCAAKAJAIgAEQCAEIAEgABECAAwBCyAEEAgLCyADQYAQaiQAQQAhBAsgCUEwaiQAIAQLJwEBfwJAAkACQAJAIAAOAwABAgMLQdATDwtBixEPC0GeEyEBCyABC48DAQF/IwBBgANrIgQkACAEQQA2AowBIARBjAFqIAEQBwJAIAFBwABNBEAgBEGQAWogARAYQQBIDQEgBEGQAWogBEGMAWpBBBAGQQBIDQEgBEGQAWogAiADEAZBAEgNASAEQZABaiAAIAEQEhoMAQsgBEGQAWpBwAAQGEEASA0AIARBkAFqIARBjAFqQQQQBkEASA0AIARBkAFqIAIgAxAGQQBIDQAgBEGQAWogBEFAa0HAABASQQBIDQAgACAEKQNANwAAIAAgBCkDSDcACCAAIAQpA1g3ABggACAEKQNQNwAQIABBIGohACABQSBrIgJBwQBPBEADQCAEIARBQGtBwAAQBSIBQUBrQcAAIAEQMUEASA0CIAAgASkDQDcAACAAIAEpA0g3AAggACAEKQNYNwAYIAAgBCkDUDcAECAAQSBqIQAgAkEgayICQcAASw0ACwsgBCAEQUBrQcAAEAUiAUFAayACIAEQMUEASA0AIAAgAUFAayACEAUaCyAEQZABakHwARAEIARBgANqJAALAwABC5kCACAARQRAQQAPCwJ/AkAgAAR/IAFB/wBNDQECQEGgHigCACgCAEUEQCABQYB/cUGAvwNGDQMMAQsgAUH/D00EQCAAIAFBP3FBgAFyOgABIAAgAUEGdkHAAXI6AABBAgwECyABQYCwA09BACABQYBAcUGAwANHG0UEQCAAIAFBP3FBgAFyOgACIAAgAUEMdkHgAXI6AAAgACABQQZ2QT9xQYABcjoAAUEDDAQLIAFBgIAEa0H//z9NBEAgACABQT9xQYABcjoAAyAAIAFBEnZB8AFyOgAAIAAgAUEGdkE/cUGAAXI6AAIgACABQQx2QT9xQYABcjoAAUEEDAQLC0HcHkEZNgIAQX8FQQELDAELIAAgAToAAEEBCwtQAQN/AkAgACgCACwAABAPRQRADAELA0AgACgCACICLAAAIQMgACACQQFqNgIAIAEgA2pBMGshASACLAABEA9FDQEgAUEKbCEBDAALAAsgAQu7AgACQCABQRRLDQACQAJAAkACQAJAAkACQAJAAkACQCABQQlrDgoAAQIDBAUGBwgJCgsgAiACKAIAIgFBBGo2AgAgACABKAIANgIADwsgAiACKAIAIgFBBGo2AgAgACABNAIANwMADwsgAiACKAIAIgFBBGo2AgAgACABNQIANwMADwsgAiACKAIAQQdqQXhxIgFBCGo2AgAgACABKQMANwMADwsgAiACKAIAIgFBBGo2AgAgACABMgEANwMADwsgAiACKAIAIgFBBGo2AgAgACABMwEANwMADwsgAiACKAIAIgFBBGo2AgAgACABMAAANwMADwsgAiACKAIAIgFBBGo2AgAgACABMQAANwMADwsgAiACKAIAQQdqQXhxIgFBCGo2AgAgACABKwMAOQMADwsgACACQQARAgALCxkAIAAtAOgBBEAgAEJ/NwNYCyAAQn83A1ALIwAgASABKQMwQgF8NwMwIAIgASAAQQAQESACIAAgAEEAEBELOQECfyAAQQNuIgJBAnQhAQJAAkACQCACQQNsQX9zIABqDgIBAAILIAFBAXIhAQsgAUECaiEBCyABC3oBAn8gAEHA/wBzQQFqQQh2QX9zQS9xIABBwf8Ac0EBakEIdkF/c0ErcSAAQeb/A2pBCHZB/wFxIgEgAEHBAGpxcnIgAEHM/wNqQQh2IgIgAEHHAGpxIAFB/wFzcXIgAEH8AWogAEHC/wNqQQh2cSACQX9zcUH/AXFyC9YBAQV/QX8hBCADQQNuIgZBAnQhBQJAAkACQCAGQQNsQX9zIANqDgIBAAILIAVBAXIhBQsgBUECaiEFCyABIAVLBH8CQCADRQ0AQQAhAUEIIQQDQCABIAItAAAiCHIhBwNAIAAiASAHIAQiBkEGayIEdkE/cRAoOgAAIAFBAWohACAEQQVLDQALIANBAWsiAwRAIAJBAWohAiAHQQh0IQEgBEEIaiEEDAELCyAERQ0AIAEgCEEMIAZrdEE/cRAoOgABIAFBAmohAAsgAEEAOgAAIAUFIAQLC8oEAQN/IwBB4ABrIgQkACADEB8hBSACEBwhAwJAAkAgBUUNACADDQEgAUECSQ0AIABBJDsAACABQQFrIgMgBRAKIgFNDQAgAEEBaiAFIAFBAWoQBSEAIAMgAWsiA0EESQ0AIAAgAWoiAUGk7PUBNgAAIAQgAigCODYCMCAEQUBrIARBMGoQEyADQQNrIgMgBEFAaxAKIgBNDQAgAUEDaiAEQUBrIABBAWoQBSEBIAMgAGsiA0EESQ0AIAAgAWoiAUGk2vUBNgAAIAQgAigCLDYCICAEQUBrIARBIGoQEyADQQNrIgMgBEFAaxAKIgBNDQAgAUEDaiAEQUBrIABBAWoQBSEBIAMgAGsiA0EESQ0AIAAgAWoiAUGs6PUBNgAAIAQgAigCKDYCECAEQUBrIARBEGoQEyADQQNrIgMgBEFAaxAKIgBNDQAgAUEDaiAEQUBrIABBAWoQBSEBIAMgAGsiA0EESQ0AIAAgAWoiAUGs4PUBNgAAIAQgAigCMDYCACAEQUBrIAQQEyADQQNrIgMgBEFAaxAKIgBNDQAgAUEDaiAEQUBrIABBAWoQBSEBIAMgAGsiA0ECSQ0AIAAgAWoiAEEkOwAAIABBAWoiACADQQFrIgYgAigCECACKAIUECkiAUF/RiIFDQBBYSEDIAZBACABIAUbayIGQQJJDQEgACAAIAFqIAUbIgBBJDsAACAAQQFqIAZBAWsgAigCACACKAIEECkhACAEQeAAaiQAQWFBACAAQX9GGw8LQWEhAwsgBEHgAGokACADC7gBAQF/QQAgAEEEaiAAQdD/A2pBCHZBf3NxQTkgAGtBCHZBf3NxQf8BcSAAQcEAayIBIAFBCHZBf3NxQdoAIABrQQh2QX9zcUH/AXEgAEG5AWogAEGf/wNqQQh2QX9zcUH6ACAAa0EIdkF/c3FB/wFxIABB0P8Ac0EBakEIdkF/c0E/cSAAQdT/AHNBAWpBCHZBf3NBPnFycnJyIgFrQQh2QX9zIABBvv8Dc0EBakEIdnFB/wFxIAFyC64BAQR/An8CfyACLAAAECsiBkH/AUYEQEF/DAELA0AgBCAGaiEEAkAgA0EGaiIGQQhJBEAgBiEDDAELIAEoAgAgBU0EQEEADwsgACAEIANBAmsiA3Y6AAAgAEEBaiEAIAVBAWohBQsgAkEBaiICLAAAECsiBkH/AUcEQCAEQQZ0IQQMAQsLQQAgA0EESw0BGkF/IAN0CyEDQQAgBCADQX9zcQ0AGiABIAU2AgAgAgsLrAMBBX8jAEEQayIDJAAgACgCBCEGIAAoAhQhBwJAIAIQHyIERQRAQWYhAgwBC0FgIQIgAS0AACIFQSRHDQAgAUEBaiABIAVBJEYbIgEgBCAEEAoiBBAQIgUNACAAQRA2AjggASABIARqIgEgBRsiBEHfFEEDEBBFBEAgBEEDaiADQQxqEBUiAUUNASAAIAMoAgw2AjgLIAFB6xRBAxAQDQAgAUEDaiADQQxqEBUiAUUNACAAIAMoAgw2AiwgAUHjFEEDEBANACABQQNqIANBDGoQFSIBRQ0AIAAgAygCDDYCKCABQecUQQMQEA0AIAFBA2ogA0EMahAVIgFFDQAgACADKAIMIgQ2AjAgACAENgI0IAEtAABBJEcNACADIAc2AgwgACgCECADQQxqIAFBAWoQLCIBRQ0AIAAgAygCDDYCFCABLQAAQSRHDQAgAyAGNgIMIAAoAgAgA0EMaiABQQFqECwiAUUNACAAIAMoAgw2AgQgAEEANgJEIABCADcCPCAAQgA3AhggAEIANwIgIAAQHCICDQBBYEEAIAEtAAAbIQILIANBEGokACACCykBAn8DQCAAIAJBA3QiA2ogASADaikAADcDACACQQFqIgJBgAFHDQALCwwAIABBAEGACBALGgtlAQJ/IAAgAhAeIgIEfyACBUFdQQACfyAAKAIAIQRBACECIAAoAgQiAAR/A0AgAyACIARqLQAAIAEgAmotAABzciEDIAJBAWoiAiAARw0ACyADQQFrQQh2QQFxQQFrBUEACwsbCwtdAQJ/IwBB8AFrIgMkAEF/IQQCQCACRSAARSABRXJyIAFBwABLcg0AIAMgARAYQQBIDQAgAyACQcAAEAZBAEgNACADIAAgARASIQQLIANB8AEQBCADQfABaiQAIAQLCQAgACABNwAACxAAIwAgAGtBcHEiACQAIAALMwEBfyAAKAIUIgMgASACIAAoAhAgA2siASABIAJLGyIBEAUaIAAgACgCFCABajYCFCACC9oBAQR/IwBB0ABrIggkAAJAIABFBEBBYCEADAELIAggABAKIgk2AgwgCCAJNgIcIAggCRAJIgo2AhggCCAJEAkiCzYCCEEAIQkCQAJAIApFIAtFcg0AIAggAjYCFCAIIAE2AhAgCEEIaiAAIAcQLSIADQEgCCgCCCEJIAggCCgCDBAJIgA2AgggAEUNACAIIAY2AiwgCCAFNgIoIAggBDYCJCAIIAM2AiAgCEEIaiAJIAcQMCEADAELQWohAAsgCCgCGBAIIAgoAggQCCAJEAgLIAhB0ABqJAAgAAuQAgEDfyMAQdAAayIRJABBfiETAkAgCEEESQ0AIAgQCSISRQRAQWohEwwBCyARQQA2AkwgEUIANwJEIBEgAjYCPCARIAI2AjggESABNgI0IBEgADYCMCARIA82AiwgESAONgIoIBEgDTYCJCARIAw2AiAgESAGNgIcIBEgBTYCGCARIAQ2AhQgESADNgIQIBEgCDYCDCARIBI2AgggESAQNgJAAkAgEUEIaiALEB4iEwRAIBIgCBAEDAELIAcEQCAHIBIgCBAFGgsCQCAJRSAKRXINACAJIAogEUEIaiALECpFDQAgEiAIEAQgCSAKEARBYSETDAELIBIgCBAEQQAhEwsgEhAICyARQdAAaiQAIBMLDQAgAEHwARAEIAAQJQspACAFEB8QCiAAEBRqIAEQFGogAhAUaiADECdqIAQQJ2pBExAUakEQagsfACAAQSNqIgBBI00EQCAAQQJ0QewWaigCAA8LQYsTC74BAQR/IwBB0ABrIgQkAAJAIABFBEBBYCEADAELIAQgABAKIgU2AgwgBCAFNgIcIAQgBRAJIgY2AhggBCAFEAkiBzYCCEEAIQUCQAJAIAZFIAdFcg0AIAQgAjYCFCAEIAE2AhAgBEEIaiAAIAMQLSIADQEgBCgCCCEFIAQgBCgCDBAJIgA2AgggAEUNACAEQQhqIAUgAxAwIQAMAQtBaiEACyAEKAIYEAggBCgCCBAIIAUQCAsgBEHQAGokACAAC4ICAQN/IwBB0ABrIg0kAEF+IQ8CQCAIQQRJDQAgCBAJIg5FBEBBaiEPDAELIA1CADcDKCANQgA3AyAgDSAGNgIcIA0gBTYCGCANIAQ2AhQgDSADNgIQIA0gCDYCDCANIA42AgggDUEANgJMIA1CADcCRCANIAI2AjwgDSACNgI4IA0gATYCNCANIAA2AjAgDSAMNgJAAkAgDUEIaiALEB4iDwRAIA4gCBAEDAELIAcEQCAHIA4gCBAFGgsCQCAJRSAKRXINACAJIAogDUEIaiALECpFDQAgDiAIEAQgCSAKEARBYSEPDAELIA4gCBAEQQAhDwsgDhAICyANQdAAaiQAIA8LYgEDfyABRSAARXIEf0F/BSAAQUBrQQBBsAEQCxogAEGACEHAABAFGgNAIAAgAkEDdCIDaiIEIAEgA2opAAAgBCkDAIU3AwAgAkEBaiICQQhHDQALIAAgAS0AADYC5AFBAAsLC/ISFABBgAgLuQUIybzzZ+YJajunyoSFrme7K/iU/nLzbjzxNh1fOvVPpdGC5q1/Ug5RH2w+K4xoBZtrvUH7q9mDH3khfhMZzeBbAAAAAAEAAAACAAAAAwAAAAQAAAAFAAAABgAAAAcAAAAIAAAACQAAAAoAAAALAAAADAAAAA0AAAAOAAAADwAAAA4AAAAKAAAABAAAAAgAAAAJAAAADwAAAA0AAAAGAAAAAQAAAAwAAAAAAAAAAgAAAAsAAAAHAAAABQAAAAMAAAALAAAACAAAAAwAAAAAAAAABQAAAAIAAAAPAAAADQAAAAoAAAAOAAAAAwAAAAYAAAAHAAAAAQAAAAkAAAAEAAAABwAAAAkAAAADAAAAAQAAAA0AAAAMAAAACwAAAA4AAAACAAAABgAAAAUAAAAKAAAABAAAAAAAAAAPAAAACAAAAAkAAAAAAAAABQAAAAcAAAACAAAABAAAAAoAAAAPAAAADgAAAAEAAAALAAAADAAAAAYAAAAIAAAAAwAAAA0AAAACAAAADAAAAAYAAAAKAAAAAAAAAAsAAAAIAAAAAwAAAAQAAAANAAAABwAAAAUAAAAPAAAADgAAAAEAAAAJAAAADAAAAAUAAAABAAAADwAAAA4AAAANAAAABAAAAAoAAAAAAAAABwAAAAYAAAADAAAACQAAAAIAAAAIAAAACwAAAA0AAAALAAAABwAAAA4AAAAMAAAAAQAAAAMAAAAJAAAABQAAAAAAAAAPAAAABAAAAAgAAAAGAAAAAgAAAAoAAAAGAAAADwAAAA4AAAAJAAAACwAAAAMAAAAAAAAACAAAAAwAAAACAAAADQAAAAcAAAABAAAABAAAAAoAAAAFAAAACgAAAAIAAAAIAAAABAAAAAcAAAAGAAAAAQAAAAUAAAAPAAAACwAAAAkAAAAOAAAAAwAAAAwAAAANAEHEDQu5CgEAAAACAAAAAwAAAAQAAAAFAAAABgAAAAcAAAAIAAAACQAAAAoAAAALAAAADAAAAA0AAAAOAAAADwAAAA4AAAAKAAAABAAAAAgAAAAJAAAADwAAAA0AAAAGAAAAAQAAAAwAAAAAAAAAAgAAAAsAAAAHAAAABQAAAAMAAAAtKyAgIDBYMHgAJWx1AE91dHB1dCBpcyB0b28gc2hvcnQAU2FsdCBpcyB0b28gc2hvcnQAU2VjcmV0IGlzIHRvbyBzaG9ydABQYXNzd29yZCBpcyB0b28gc2hvcnQAQXNzb2NpYXRlZCBkYXRhIGlzIHRvbyBzaG9ydABTb21lIG9mIGVuY29kZWQgcGFyYW1ldGVycyBhcmUgdG9vIGxvbmcgb3IgdG9vIHNob3J0AE1pc3NpbmcgYXJndW1lbnRzAFRvbyBtYW55IGxhbmVzAFRvbyBmZXcgbGFuZXMAVG9vIG1hbnkgdGhyZWFkcwBOb3QgZW5vdWdoIHRocmVhZHMATWVtb3J5IGFsbG9jYXRpb24gZXJyb3IATWVtb3J5IGNvc3QgaXMgdG9vIHNtYWxsAFRpbWUgY29zdCBpcyB0b28gc21hbGwAYXJnb24yaQBBcmdvbjJpAFRoZSBwYXNzd29yZCBkb2VzIG5vdCBtYXRjaCB0aGUgc3VwcGxpZWQgaGFzaABPdXRwdXQgcG9pbnRlciBtaXNtYXRjaABPdXRwdXQgaXMgdG9vIGxvbmcAU2FsdCBpcyB0b28gbG9uZwBTZWNyZXQgaXMgdG9vIGxvbmcAUGFzc3dvcmQgaXMgdG9vIGxvbmcAQXNzb2NpYXRlZCBkYXRhIGlzIHRvbyBsb25nAFRocmVhZGluZyBmYWlsdXJlAE1lbW9yeSBjb3N0IGlzIHRvbyBsYXJnZQBUaW1lIGNvc3QgaXMgdG9vIGxhcmdlAFVua25vd24gZXJyb3IgY29kZQBhcmdvbjJpZABBcmdvbjJpZABFbmNvZGluZyBmYWlsZWQARGVjb2RpbmcgZmFpbGVkAGFyZ29uMmQAQXJnb24yZABBcmdvbjJfQ29udGV4dCBjb250ZXh0IGlzIE5VTEwAT3V0cHV0IHBvaW50ZXIgaXMgTlVMTABUaGUgYWxsb2NhdGUgbWVtb3J5IGNhbGxiYWNrIGlzIE5VTEwAVGhlIGZyZWUgbWVtb3J5IGNhbGxiYWNrIGlzIE5VTEwAT0sAJHY9ACx0PQAscD0AJG09AFRoZXJlIGlzIG5vIHN1Y2ggdmVyc2lvbiBvZiBBcmdvbjIAU2FsdCBwb2ludGVyIGlzIE5VTEwsIGJ1dCBzYWx0IGxlbmd0aCBpcyBub3QgMABTZWNyZXQgcG9pbnRlciBpcyBOVUxMLCBidXQgc2VjcmV0IGxlbmd0aCBpcyBub3QgMABQYXNzd29yZCBwb2ludGVyIGlzIE5VTEwsIGJ1dCBwYXNzd29yZCBsZW5ndGggaXMgbm90IDAAQXNzb2NpYXRlZCBkYXRhIHBvaW50ZXIgaXMgTlVMTCwgYnV0IGFkIGxlbmd0aCBpcyBub3QgMAAobnVsbCkAAACbCAAAuwcAAEkJAADACQAAsAkAAPAHAAAfCAAAMAgAAMkIAABvCgAA4AkAABYKAAA7CgAAQwgAACsLAADBCgAAkgoAAPQKAAACCAAAEQgAAFsJAABbCAAAdAkAAHQIAAAFCQAAdAcAAC0JAACeBwAA9AgAAGIHAAAYCQAAiAcAAOEIAABOBwAA/wkAAFwKAAABAEGkGAsBAgBByxgLBf//////AEGQGQtBEQAKABEREQAAAAAFAAAAAAAACQAAAAALAAAAAAAAAAARAA8KERERAwoHAAEACQsLAAAJBgsAAAsABhEAAAAREREAQeEZCyELAAAAAAAAAAARAAoKERERAAoAAAIACQsAAAAJAAsAAAsAQZsaCwEMAEGnGgsVDAAAAAAMAAAAAAkMAAAAAAAMAAAMAEHVGgsBDgBB4RoLFQ0AAAAEDQAAAAAJDgAAAAAADgAADgBBjxsLARAAQZsbCx4PAAAAAA8AAAAACRAAAAAAABAAABAAABIAAAASEhIAQdIbCw4SAAAAEhISAAAAAAAACQBBgxwLAQsAQY8cCxUKAAAAAAoAAAAACQsAAAAAAAsAAAsAQb0cCwEMAEHJHAsnDAAAAAAMAAAAAAkMAAAAAAAMAAAMAAAwMTIzNDU2Nzg5QUJDREVGAEHwHAsBAQBBoB4LAogPAEHYHgsDkBFQ"},145:()=>{},967:()=>{}},B={};function Q(A){var I=B[A];if(void 0!==I)return I.exports;var C=B[A]={exports:{}};return g[A].call(C.exports,C,C.exports,Q),C.exports}return I=Object.getPrototypeOf?A=>Object.getPrototypeOf(A):A=>A.__proto__,Q.t=function(g,B){if(1&B&&(g=this(g)),8&B)return g;if("object"==typeof g&&g){if(4&B&&g.__esModule)return g;if(16&B&&"function"==typeof g.then)return g}var C=Object.create(null);Q.r(C);var E={};A=A||[null,I({}),I([]),I(I)];for(var i=2&B&&g;"object"==typeof i&&!~A.indexOf(i);i=I(i))Object.getOwnPropertyNames(i).forEach((A=>E[A]=()=>g[A]));return E.default=()=>g,Q.d(C,E),C},Q.d=(A,I)=>{for(var g in I)Q.o(I,g)&&!Q.o(A,g)&&Object.defineProperty(A,g,{enumerable:!0,get:I[g]})},Q.o=(A,I)=>Object.prototype.hasOwnProperty.call(A,I),Q.r=A=>{"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(A,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(A,"__esModule",{value:!0})},Q(631)})()}));
\ No newline at end of file
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/vendor/argon2.wasm b/packages/meshbay-hub/src/meshbay_hub/static/vendor/argon2.wasm
new file mode 100755
index 0000000..75c3111
--- /dev/null
+++ b/packages/meshbay-hub/src/meshbay_hub/static/vendor/argon2.wasm
diff --git a/packages/meshbay-hub/tests/test_bundle_kdf_parity.py b/packages/meshbay-hub/tests/test_bundle_kdf_parity.py
new file mode 100644
index 0000000..27e10d4
--- /dev/null
+++ b/packages/meshbay-hub/tests/test_bundle_kdf_parity.py
@@ -0,0 +1,131 @@
+"""
+Cross-language parity for the keypair bundle KDF.
+
+The bundle is the one thing a user carries between browsers, and the passphrase
+is all that stands between it and whoever holds the disk of a node they joined
+(finding C4). It moved from PBKDF2-SHA512 to Argon2id for that reason — PBKDF2 is
+compute-only, which is what makes it cheap on a GPU.
+
+Two implementations now have to agree byte for byte: the vendored WebAssembly the
+browser runs, and `argon2-cffi` used by the QE harness. A disagreement would not
+show up as an error — it would show up as a bundle nobody can open, which is
+somebody's account gone.
+
+Skipped when node or argon2-cffi is missing; that is a coverage gap, not a pass.
+"""
+
+import hashlib
+import json
+import shutil
+import subprocess
+from pathlib import Path
+
+import pytest
+
+STATIC = Path(__file__).resolve().parents[1] / "src" / "meshbay_hub" / "static"
+VENDOR = STATIC / "vendor"
+
+try:
+    from argon2.low_level import Type, hash_secret_raw
+    HAVE_ARGON2 = True
+except ImportError:
+    HAVE_ARGON2 = False
+
+pytestmark = pytest.mark.skipif(
+    shutil.which("node") is None
+    or not (VENDOR / "argon2.min.js").exists()
+    or not HAVE_ARGON2,
+    reason="node, the vendored argon2, or argon2-cffi is unavailable",
+)
+
+# Parameters must match keyderive.js. If someone tunes them there and not here,
+# this test fails — which is the point: changing them silently orphans every
+# bundle already written.
+MEM_KIB, TIME_COST, LANES = 131072, 3, 1
+
+CASES = ["alice", "grenet", "utilisateur-é", ""]
+PASSWORDS = ["correct horse battery staple", "p", "üñïçø∂é ✓ 🔐"]
+
+_HARNESS = r"""
+const fs = require('fs'), webcrypto = require('crypto').webcrypto;
+global.self = global; global.crypto = webcrypto;
+// The browser uses the copy inlined in the bundle; under node the emscripten
+// loader looks for a file, so hand it the same bytes explicitly.
+global.Module = { wasmBinary: fs.readFileSync(process.argv[2]) };
+const argon2 = require(process.argv[3]);
+
+(async () => {
+  const input = JSON.parse(fs.readFileSync(process.argv[4], 'utf8'));
+  const out = [];
+  for (const v of input) {
+    const salt = new Uint8Array(await webcrypto.subtle.digest(
+      'SHA-256', new TextEncoder().encode(`meshbay:bundle:v2:${v.username}`)
+    )).slice(0, 16);
+    const r = await argon2.hash({
+      pass: v.password, salt,
+      time: v.time, mem: v.mem, parallelism: v.lanes,
+      hashLen: 32, type: argon2.ArgonType.Argon2id,
+    });
+    out.push(Buffer.from(r.hash).toString('hex'));
+  }
+  process.stdout.write(JSON.stringify(out));
+})();
+"""
+
+
+@pytest.fixture(scope="module")
+def js_hashes(tmp_path_factory):
+    d = tmp_path_factory.mktemp("kdf")
+    harness = d / "harness.cjs"
+    harness.write_text(_HARNESS)
+    vectors = [
+        {"username": u, "password": p,
+         "mem": MEM_KIB, "time": TIME_COST, "lanes": LANES}
+        for u in CASES for p in PASSWORDS
+    ]
+    payload = d / "vectors.json"
+    payload.write_text(json.dumps(vectors))
+
+    proc = subprocess.run(
+        ["node", str(harness), str(VENDOR / "argon2.wasm"),
+         str(VENDOR / "argon2.min.js"), str(payload)],
+        capture_output=True, text=True, timeout=300,
+    )
+    if proc.returncode != 0:
+        pytest.fail(f"node harness failed:\n{proc.stderr[-2000:]}")
+    return vectors, json.loads(proc.stdout)
+
+
+def _python_hash(username: str, password: str) -> str:
+    salt = hashlib.sha256(f"meshbay:bundle:v2:{username}".encode()).digest()[:16]
+    return hash_secret_raw(
+        password.encode(), salt, time_cost=TIME_COST, memory_cost=MEM_KIB,
+        parallelism=LANES, hash_len=32, type=Type.ID,
+    ).hex()
+
+
+def test_bundle_key_matches_across_languages(js_hashes):
+    vectors, js = js_hashes
+    for i, v in enumerate(vectors):
+        assert js[i] == _python_hash(v["username"], v["password"]), (
+            f"argon2id disagrees for username={v['username']!r} — a bundle "
+            f"written by one implementation would be unreadable by the other"
+        )
+
+
+def test_the_salt_separates_users(js_hashes):
+    """Two accounts with the same passphrase must not share a bundle key."""
+    assert _python_hash("alice", "same passphrase") != \
+        _python_hash("bob", "same passphrase")
+
+
+def test_parameters_still_match_the_client():
+    """
+    The numbers live in keyderive.js; this test is the second copy. Tuning one
+    without the other orphans every bundle already written, so make it fail.
+    """
+    source = (STATIC / "keyderive.js").read_text()
+    assert f"ARGON2_MEM_KIB = {MEM_KIB}" in source
+    assert f"ARGON2_TIME    = {TIME_COST}" in source
+    assert f"ARGON2_LANES   = {LANES}" in source
+    assert "meshbay:bundle:v2:" in source
diff --git a/packages/meshbay-hub/tests/test_hub_api.py b/packages/meshbay-hub/tests/test_hub_api.py
index a8232c1..5a2cf86 100644
--- a/packages/meshbay-hub/tests/test_hub_api.py
+++ b/packages/meshbay-hub/tests/test_hub_api.py
@@ -24,6 +24,35 @@ def _gen_user_keys():
     )
 
 
+
+async def _announce_signed(client, token: str) -> tuple[str, str]:
+    """
+    Announce a node with proof of possession (M8).
+
+    The node key is independent of the user's identity key, so this mints a fresh
+    one and signs the domain-separated announce message with it.
+    """
+    import base64 as _b64, time as _t
+
+    me = await client.get("/v1/users/me",
+                          headers={"Authorization": f"Bearer {token}"})
+    user_id = me.json()["user_id"]
+
+    sk_node = Ed25519PrivateKey.generate()
+    pk_node = pk_to_b64(sk_node.public_key())
+    ts = _t.time().__trunc__()
+    msg = f"meshbay:node_announce:{user_id}:{pk_node}:{ts}".encode()
+
+    r = await client.post("/v1/nodes/announce", json={
+        "pk_node": pk_node,
+        "endpoint_hint": "1.2.3.4:19000",
+        "timestamp": ts,
+        "signature": _b64.b64encode(sk_node.sign(msg)).decode(),
+    }, headers={"Authorization": f"Bearer {token}"})
+    assert r.status_code == 201, r.text
+    return r.json()["node_id"], pk_node
+
+
 # ── Hub info ──────────────────────────────────────────────────────────────────
 
 @pytest.mark.asyncio
@@ -115,8 +144,11 @@ async def test_jwt_offline_verify(client, hub_key_path):
     hub_pk_pem = r_pk.json()["pk_hub_pem"].encode()
 
     decoded = pyjwt.decode(token, hub_pk_pem, algorithms=["EdDSA"])
-    assert decoded["pk_user"] == pk_ed
     assert "jti" in decoded   # mandatory
+    # The token carries no user key. It used to, and the node recorded it as the
+    # uploader's identity — so whoever issued tokens decided who could delete a
+    # file. The hub certifies accounts; nodes pin keys.
+    assert "pk_user" not in decoded
 
 
 @pytest.mark.asyncio
@@ -165,11 +197,17 @@ async def test_refresh_token_rotation_old_rejected(client):
 
 @pytest.mark.asyncio
 async def test_get_user_pubkeys(client):
+    """
+    The endpoint resolves an account; it is not a key directory any more.
+
+    Publishing user identity keys is what finding H3 exploited — the invite flow
+    wrapped the group key for whatever came back. Keys are now generated per node
+    and pinned there, so there is nothing here to substitute.
+    """
     pk_ed, pk_x, _ = _gen_user_keys()
     await client.post("/v1/users/register", json={
         "username": "frank", "email": "frank@example.com",
-        "password": "frankpass99",
-        "pk_user_ed25519": pk_ed, "pk_user_x25519": pk_x})
+        "password": "frankpass99"})
     login = await client.post("/v1/users/login", json={
         "username": "frank", "password": "frankpass99"})
     token = login.json()["access_token"]
@@ -177,8 +215,10 @@ async def test_get_user_pubkeys(client):
     r = await client.get("/v1/users/frank/pubkeys",
                          headers={"Authorization": f"Bearer {token}"})
     assert r.status_code == 200
-    assert r.json()["pk_ed25519"] == pk_ed
-    assert r.json()["pk_x25519"]  == pk_x
+    body = r.json()
+    assert body["user_id"] and body["username"] == "frank"
+    assert "pk_ed25519" not in body, "user identity keys must not be published (H3)"
+    assert "pk_x25519" not in body, "user identity keys must not be published (H3)"
 
 
 # ── Nodes ─────────────────────────────────────────────────────────────────────
@@ -195,15 +235,12 @@ async def test_announce_and_get_node(client):
     token = login.json()["access_token"]
     hdrs = {"Authorization": f"Bearer {token}"}
 
-    r = await client.post("/v1/nodes/announce",
-                          json={"pk_node": pk_ed, "endpoint_hint": "1.2.3.4:19000"},
-                          headers=hdrs)
-    assert r.status_code == 201
-    node_id = r.json()["node_id"]
+    node_id, pk_node = await _announce_signed(client, token)
 
     r2 = await client.get(f"/v1/nodes/{node_id}", headers=hdrs)
     assert r2.status_code == 200
-    assert r2.json()["pk_node"] == pk_ed
+    # The node key is independent of the user identity key (M8).
+    assert r2.json()["pk_node"] == pk_node
     assert r2.json()["endpoint_hint"] == "1.2.3.4:19000"
 
 
@@ -409,10 +446,7 @@ async def test_group_online_nodes(client):
              json={"username": "gn_user", "password": "gnpass999"})).json()["access_token"]
 
     # Announce a node
-    r = await client.post("/v1/nodes/announce", json={
-        "pk_node": pk_ed, "endpoint_hint": "1.2.3.4:19000"},
-        headers={"Authorization": f"Bearer {token}"})
-    node_id = r.json()["node_id"]
+    node_id, pk_node = await _announce_signed(client, token)
 
     # No nodes online yet
     r = await client.get(f"/v1/groups/{group_id}/nodes",
@@ -433,7 +467,7 @@ async def test_group_online_nodes(client):
         nodes = r.json()["nodes"]
         assert len(nodes) == 1
         assert nodes[0]["node_id"] == node_id
-        assert nodes[0]["pk_node"] == pk_ed
+        assert nodes[0]["pk_node"] == pk_node
     finally:
         _connected_nodes.pop(node_id, None)
         _node_groups.pop(node_id, None)
diff --git a/packages/meshbay-hub/tests/test_node_auth.py b/packages/meshbay-hub/tests/test_node_auth.py
index e629d20..72ce412 100644
--- a/packages/meshbay-hub/tests/test_node_auth.py
+++ b/packages/meshbay-hub/tests/test_node_auth.py
@@ -214,7 +214,8 @@ async def test_node_scope_allows_pubkey_lookup(client):
     r = await client.get("/v1/users/op4/pubkeys",
                          headers={"Authorization": f"Bearer {node_token}"})
     assert r.status_code == 200
-    assert "pk_ed25519" in r.json()
+    # An account id and the node's linking key — no user identity keys (H3).
+    assert "pk_ed25519" not in r.json()
     assert r.json()["pk_node_ed25519"] is not None
 
 
diff --git a/packages/meshbay-hub/tests/test_node_ws_auth.py b/packages/meshbay-hub/tests/test_node_ws_auth.py
new file mode 100644
index 0000000..1391722
--- /dev/null
+++ b/packages/meshbay-hub/tests/test_node_ws_auth.py
@@ -0,0 +1,346 @@
+"""
+Phase 11.5 security regression tests — node WebSocket registration (finding C2).
+
+The hub relays every WebRTC offer for a node to whoever holds that node's entry in
+`_connected_nodes`. That registration used to be established from a client-supplied
+`node_id` with no ownership check, so any registered user could take over a victim
+node's signaling and become the endpoint browsers connect to.
+
+These exercise `_authorize_node_ws` directly rather than through a socket: it is the
+function that makes the authorization decision, and the hub test harness uses
+ASGITransport, which has no WebSocket support.
+"""
+
+import base64
+
+import pytest
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey
+
+from meshbay_common.crypto import pk_to_b64
+
+
+async def _make_user(client, username: str) -> dict:
+    """Register + log in a user, returning ids, token and keys."""
+    sk_ed, sk_x = Ed25519PrivateKey.generate(), X25519PrivateKey.generate()
+    pk_ed, pk_x = pk_to_b64(sk_ed.public_key()), pk_to_b64(sk_x.public_key())
+
+    r = await client.post("/v1/users/register", json={
+        "username": username,
+        "email": f"{username}@example.test",
+        "auth_key": base64.b64encode(b"k" * 32).decode(),
+        "pk_user_ed25519": pk_ed,
+        "pk_user_x25519": pk_x,
+    })
+    assert r.status_code == 201, r.text
+    user_id = r.json()["user_id"]
+
+    r = await client.post("/v1/users/login", json={
+        "username": username,
+        "auth_key": base64.b64encode(b"k" * 32).decode(),
+    })
+    assert r.status_code == 200, r.text
+    return {"user_id": user_id, "token": r.json()["access_token"],
+            "pk_ed": pk_ed, "sk_ed": sk_ed}
+
+
+async def _announce_node(client, user: dict) -> str:
+    # Announce now requires proof of possession of the node key (M8).
+    import time as _t
+    ts = int(_t.time())
+    msg = f"meshbay:node_announce:{user['user_id']}:{user['pk_ed']}:{ts}".encode()
+    r = await client.post(
+        "/v1/nodes/announce",
+        json={
+            "pk_node": user["pk_ed"], "endpoint_hint": "test",
+            "timestamp": ts,
+            "signature": base64.b64encode(user["sk_ed"].sign(msg)).decode(),
+        },
+        headers={"Authorization": f"Bearer {user['token']}"},
+    )
+    assert r.status_code == 201, r.text
+    return r.json()["node_id"]
+
+
+def _node_token(user: dict) -> str:
+    from meshbay_hub.auth import issue_access_token
+    return issue_access_token(user["user_id"], scope="node")
+
+
+@pytest.mark.asyncio
+async def test_ws_rejects_user_scoped_token(client):
+    """C2: a browser token must never be able to register as a node."""
+    from meshbay_hub.api.revocation import _authorize_node_ws
+
+    victim = await _make_user(client, "victim1")
+    node_id = await _announce_node(client, victim)
+
+    resolved, detail = await _authorize_node_ws(victim["token"], node_id, None)
+    assert resolved is None
+    assert "node-scoped" in detail.lower()
+
+
+@pytest.mark.asyncio
+async def test_ws_rejects_foreign_node_id(client):
+    """
+    C2: the impersonation itself. An attacker with a perfectly valid node-scoped
+    token of their own must not be able to claim someone else's node_id.
+    """
+    from meshbay_hub.api.revocation import _authorize_node_ws
+
+    victim = await _make_user(client, "victim2")
+    attacker = await _make_user(client, "attacker2")
+    victim_node = await _announce_node(client, victim)
+    await _announce_node(client, attacker)
+
+    resolved, detail = await _authorize_node_ws(
+        _node_token(attacker), victim_node, None)
+    assert resolved is None, "attacker hijacked the victim's node registration (C2)"
+    assert "does not belong" in detail.lower()
+
+
+@pytest.mark.asyncio
+async def test_ws_rejects_unknown_node_id(client):
+    """C2: an invented node_id must not register either."""
+    from meshbay_hub.api.revocation import _authorize_node_ws
+
+    user = await _make_user(client, "user3")
+    resolved, _ = await _authorize_node_ws(_node_token(user), "no-such-node", None)
+    assert resolved is None
+
+
+@pytest.mark.asyncio
+async def test_ws_rejects_missing_node_id(client):
+    """C2: identity may not fall back to the token subject."""
+    from meshbay_hub.api.revocation import _authorize_node_ws
+
+    user = await _make_user(client, "user4")
+    resolved, _ = await _authorize_node_ws(_node_token(user), "", None)
+    assert resolved is None
+
+
+@pytest.mark.asyncio
+async def test_ws_accepts_own_node(client):
+    """The legitimate path still works."""
+    from meshbay_hub.api.revocation import _authorize_node_ws
+
+    user = await _make_user(client, "owner5")
+    node_id = await _announce_node(client, user)
+
+    resolved, groups = await _authorize_node_ws(_node_token(user), node_id, None)
+    assert resolved == node_id
+    assert groups == []
+
+
+@pytest.mark.asyncio
+async def test_ws_group_claims_cannot_widen_beyond_membership(client):
+    """
+    C2: `group_ids` used to be taken verbatim, letting a node advertise itself as
+    an online source for any group on the hub and attract clients to it.
+    """
+    from meshbay_hub.api.revocation import _authorize_node_ws
+
+    user = await _make_user(client, "owner6")
+    node_id = await _announce_node(client, user)
+
+    r = await client.post(
+        "/v1/groups",
+        json={"name": "mine", "visibility": "private", "join_policy": "invite"},
+        headers={"Authorization": f"Bearer {user['token']}"},
+    )
+    assert r.status_code == 201, r.text
+    own_group = r.json()["group_id"]
+
+    resolved, groups = await _authorize_node_ws(
+        _node_token(user), node_id, [own_group, "someone-elses-group"])
+
+    assert resolved == node_id
+    assert groups == [own_group], "node advertised a group it is not a member of"
+
+
+@pytest.mark.asyncio
+async def test_signaling_rejects_non_member(client):
+    """
+    H6/H4: POST /v1/nodes/{id}/webrtc/offer was reachable by any authenticated
+    user for any node, with no membership check and no rate limit. Each call makes
+    the target node allocate an aiortc PeerConnection and gather ICE, so it was a
+    remote resource-exhaustion primitive against a third party's machine.
+    """
+    from meshbay_hub.api import revocation as rev
+
+    owner = await _make_user(client, "owner8")
+    outsider = await _make_user(client, "outsider8")
+    node_id = await _announce_node(client, owner)
+
+    r = await client.post(
+        "/v1/groups",
+        json={"name": "private-g", "visibility": "private", "join_policy": "invite"},
+        headers={"Authorization": f"Bearer {owner['token']}"},
+    )
+    group_id = r.json()["group_id"]
+
+    # Pretend the node is connected and hosting that group.
+    class _FakeWS:
+        async def send_text(self, _):
+            raise AssertionError("offer relayed to node despite non-membership")
+
+    rev._connected_nodes[node_id] = _FakeWS()
+    rev._node_groups[node_id] = [group_id]
+    try:
+        resp = await client.post(
+            f"/v1/nodes/{node_id}/webrtc/offer",
+            json={"sdp": "v=0", "ice_candidates": []},
+            headers={"Authorization": f"Bearer {outsider['token']}"},
+        )
+        assert resp.status_code == 403, resp.text
+    finally:
+        rev._connected_nodes.pop(node_id, None)
+        rev._node_groups.pop(node_id, None)
+
+
+@pytest.mark.asyncio
+async def test_signaling_rejects_oversized_sdp(client):
+    """H6: an SDP offer is ~2 KB; unbounded input is a memory amplifier."""
+    user = await _make_user(client, "user9")
+    resp = await client.post(
+        "/v1/nodes/whatever/webrtc/offer",
+        json={"sdp": "v=0" + ("x" * 200_000), "ice_candidates": []},
+        headers={"Authorization": f"Bearer {user['token']}"},
+    )
+    assert resp.status_code == 413
+
+
+@pytest.mark.asyncio
+async def test_incoming_rejects_foreign_peer_ip(client):
+    """
+    H6: peer_ip was taken verbatim, letting any user make an arbitrary node emit
+    UDP packets to an address of their choosing — reflection via someone else's
+    machine. The probe target must be the caller's own address.
+    """
+    from meshbay_hub.api import revocation as rev
+
+    owner = await _make_user(client, "owner10")
+    node_id = await _announce_node(client, owner)
+
+    class _FakeWS:
+        async def send_text(self, _):
+            raise AssertionError("punch relayed with attacker-chosen peer_ip")
+
+    rev._connected_nodes[node_id] = _FakeWS()
+    try:
+        resp = await client.post(
+            f"/v1/nodes/{node_id}/incoming",
+            json={"peer_ip": "198.51.100.7", "peer_port": 9999},
+            headers={"Authorization": f"Bearer {owner['token']}"},
+        )
+        assert resp.status_code == 403, resp.text
+    finally:
+        rev._connected_nodes.pop(node_id, None)
+
+
+@pytest.mark.asyncio
+async def test_ws_node_may_narrow_its_group_set(client):
+    """A node hosting a subset of the operator's groups may say so."""
+    from meshbay_hub.api.revocation import _authorize_node_ws
+
+    user = await _make_user(client, "owner7")
+    node_id = await _announce_node(client, user)
+
+    created = []
+    for name in ("g-one", "g-two"):
+        r = await client.post(
+            "/v1/groups",
+            json={"name": name, "visibility": "private", "join_policy": "invite"},
+            headers={"Authorization": f"Bearer {user['token']}"},
+        )
+        created.append(r.json()["group_id"])
+
+    resolved, groups = await _authorize_node_ws(
+        _node_token(user), node_id, [created[0]])
+    assert resolved == node_id
+    assert groups == [created[0]]
+
+
+# ── M8: announce proof of possession ─────────────────────────────────────────
+
+def _announce_payload(user_id: str, sk, pk_b64: str, ts: int | None = None):
+    import time as _t
+    ts = ts if ts is not None else int(_t.time())
+    msg = f"meshbay:node_announce:{user_id}:{pk_b64}:{ts}".encode()
+    return {
+        "pk_node": pk_b64,
+        "endpoint_hint": "test",
+        "timestamp": ts,
+        "signature": base64.b64encode(sk.sign(msg)).decode(),
+    }
+
+
+@pytest.mark.asyncio
+async def test_announce_requires_proof_of_possession(client):
+    """
+    M8: /v1/nodes/announce accepted any pk_node with no proof the announcer held
+    the private key, so a user could announce a record carrying someone else's
+    node key.
+    """
+    user = await _make_user(client, "ann1")
+    r = await client.post(
+        "/v1/nodes/announce",
+        json={"pk_node": user["pk_ed"], "endpoint_hint": "test"},
+        headers={"Authorization": f"Bearer {user['token']}"},
+    )
+    assert r.status_code == 400, r.text
+
+
+@pytest.mark.asyncio
+async def test_announce_rejects_foreign_key(client):
+    """M8: announcing someone else's public key must fail — no matching private key."""
+    user = await _make_user(client, "ann2")
+    victim_sk = Ed25519PrivateKey.generate()
+    victim_pk = pk_to_b64(victim_sk.public_key())
+
+    attacker_sk = Ed25519PrivateKey.generate()
+    payload = _announce_payload(user["user_id"], attacker_sk, victim_pk)
+
+    r = await client.post(
+        "/v1/nodes/announce", json=payload,
+        headers={"Authorization": f"Bearer {user['token']}"},
+    )
+    assert r.status_code == 401, r.text
+
+
+@pytest.mark.asyncio
+async def test_announce_rejects_stale_timestamp(client):
+    """M8: a captured announce must not be replayable later."""
+    import time as _t
+    user = await _make_user(client, "ann3")
+    sk = Ed25519PrivateKey.generate()
+    payload = _announce_payload(
+        user["user_id"], sk, pk_to_b64(sk.public_key()), ts=int(_t.time()) - 3600)
+
+    r = await client.post(
+        "/v1/nodes/announce", json=payload,
+        headers={"Authorization": f"Bearer {user['token']}"},
+    )
+    assert r.status_code == 401, r.text
+
+
+@pytest.mark.asyncio
+async def test_announce_with_valid_proof_succeeds_and_is_idempotent(client):
+    """The legitimate path works, and re-announcing updates rather than piling up rows."""
+    user = await _make_user(client, "ann4")
+    sk = Ed25519PrivateKey.generate()
+    pk_b64 = pk_to_b64(sk.public_key())
+
+    first = await client.post(
+        "/v1/nodes/announce", json=_announce_payload(user["user_id"], sk, pk_b64),
+        headers={"Authorization": f"Bearer {user['token']}"},
+    )
+    assert first.status_code == 201, first.text
+
+    second = await client.post(
+        "/v1/nodes/announce", json=_announce_payload(user["user_id"], sk, pk_b64),
+        headers={"Authorization": f"Bearer {user['token']}"},
+    )
+    assert second.status_code == 201, second.text
+    assert second.json()["node_id"] == first.json()["node_id"], (
+        "re-announcing the same key must not create a second node record (M8)")
diff --git a/packages/meshbay-hub/tests/test_spa_ordering.py b/packages/meshbay-hub/tests/test_spa_ordering.py
new file mode 100644
index 0000000..0ef34fc
--- /dev/null
+++ b/packages/meshbay-hub/tests/test_spa_ordering.py
@@ -0,0 +1,103 @@
+"""
+Ordering guards for the SPA's connect() flow.
+
+These are source-level checks, which is not how one would normally test
+behaviour. They exist because a specific class of bug shipped to a live browser
+twice and no other test could see it: `connect()` is a long sequence in which
+later steps read values earlier steps set, and the Python end-to-end client in
+QE/deploy/ cannot catch a mistake there — it is a different implementation,
+written in the right order by construction, so it passes while the browser fails.
+
+Concretely: join_request signs a transcript over the node key and the node nonce,
+and runs *before* the GEK proof, because a first-time member has no GEK to prove.
+Both values were being read further down, next to the proof that also uses them,
+so every invited member hit "Handshake incomplete — reconnect and retry".
+
+If you restructure connect(), these will fail. Check the invariant still holds —
+that nothing reads a value assigned later — and then move the markers.
+"""
+
+from pathlib import Path
+
+import pytest
+
+STATIC = (Path(__file__).resolve().parents[1]
+          / "src" / "meshbay_hub" / "static")
+TRANSPORT = STATIC / "transport.js"
+
+pytestmark = pytest.mark.skipif(
+    not TRANSPORT.exists(), reason="SPA sources not present")
+
+
+def _positions(*needles: str) -> list[int]:
+    source = TRANSPORT.read_text()
+    out = []
+    for needle in needles:
+        idx = source.find(needle)
+        assert idx != -1, f"{needle!r} is gone from transport.js — update this test"
+        out.append(idx)
+    return out
+
+
+def test_challenge_values_are_captured_before_joining():
+    """
+    joinGroup() signs over node_pk and nonce_node, so both must be recorded when
+    the challenge arrives — not later, beside the proof.
+    """
+    # Deliberately loose markers: what matters is where the assignment happens,
+    # not how it is spelled, so a reordering fails on the ordering assertion
+    # below rather than on a missing string.
+    node_pk, nonce_node, join_call = _positions(
+        "this.nodePk = reply.node_pk",
+        "this._nonceNode = ",
+        "await this.joinGroup(",
+    )
+    assert node_pk < join_call, (
+        "node_pk is read from the challenge after joinGroup() runs — the join "
+        "would sign a transcript naming nothing")
+    assert nonce_node < join_call, (
+        "nonce_node is captured after joinGroup() runs — the join would not be "
+        "bound to this connection")
+
+
+def test_join_happens_before_the_gek_proof():
+    """
+    The whole point of joining in the pre-proof window: someone who has never
+    held the group key cannot produce a proof, so the key has to arrive first.
+    """
+    join_call, proof = _positions(
+        "await this.joinGroup(",
+        "await C.handshakeProof(",
+    )
+    assert join_call < proof, (
+        "the join must happen before the GEK proof — a first-time member has no "
+        "key to prove with")
+
+
+def test_keys_are_recovered_before_the_join_is_attempted():
+    """
+    A second browser holds nothing but a password. It recovers its identity keys
+    from the node's encrypted keypair bundle, and only then can it sign a join —
+    so the recovery has to come first. Getting this order wrong is invisible on
+    the browser that registered, and breaks every other one.
+    """
+    recover, join_call = _positions(
+        "type: 'keypair_bundle_fetch'",
+        "await this.joinGroup(",
+    )
+    assert recover < join_call, (
+        "the keypair bundle must be fetched before joinGroup() — otherwise a "
+        "browser that did not register has no key to sign the join with")
+
+
+def test_the_ack_still_verifies_the_announced_node_key():
+    """
+    Taking node_pk from the challenge is only safe because the ack proves it and
+    the client compares the two. Losing that check would leave the announcement
+    trusted on its own.
+    """
+    source = TRANSPORT.read_text()
+    assert "Node identity changed during the handshake" in source, (
+        "the challenge's node_pk must be checked against the ack's")
+    assert "verifyNodeSignature" in source, (
+        "the ack's signature over the handshake transcript must still be verified")
diff --git a/packages/meshbay-node/src/meshbay_node/bundle_store.py b/packages/meshbay-node/src/meshbay_node/bundle_store.py
index e7c6981..4cf3236 100644
--- a/packages/meshbay-node/src/meshbay_node/bundle_store.py
+++ b/packages/meshbay-node/src/meshbay_node/bundle_store.py
@@ -99,6 +99,21 @@ class BundleStore:
             row = await cursor.fetchone()
             return row[0] if row else None
 
+    async def delete_keypair(self, user_id: str) -> bool:
+        """
+        Drop someone's keypair bundle at their own request.
+
+        Backing keys up here is what lets a second browser recover them with the
+        password — and it is also what puts a PBKDF2-protected blob on every node
+        whose group they join (finding C4). Someone who does not need the first
+        should be able to withdraw the second, and not merely stop adding to it.
+        """
+        assert self._db
+        cur = await self._db.execute(
+            "DELETE FROM keypair_bundles WHERE user_id = ?", (user_id,))
+        await self._db.commit()
+        return cur.rowcount > 0
+
     async def close(self) -> None:
         if self._db:
             await self._db.close()
diff --git a/packages/meshbay-node/src/meshbay_node/config.py b/packages/meshbay-node/src/meshbay_node/config.py
index a7a0785..f3752ea 100644
--- a/packages/meshbay-node/src/meshbay_node/config.py
+++ b/packages/meshbay-node/src/meshbay_node/config.py
@@ -26,28 +26,33 @@ url      = "https://meshbay.org"
 username = "myusername"
 
 [node]
-port     = 19000   # TCP+TLS (MNP v1)
-quic_port = 19010  # QUIC (MNP v2)
-http_port = 19001  # HTTP file API (public content)
-ui_port  = 18000   # local web UI
+quic_port = 19010  # QUIC (MNP) — LAN, port-forwarded, hub-less direct access
+ui_port  = 18000   # local admin UI (127.0.0.1 only)
 
-# Multiple groups — each with its own directory and ports
+# One-time codes. An invitation waits for someone to read their messages; an
+# operator pairing code is typed during the SSH session that printed it.
+invite_ttl_hours = 168   # 7 days
+pair_ttl_hours   = 24
+
+# Browser and native clients reach this node over WebRTC DataChannel via hub
+# signaling — no inbound port to open. QUIC is the optional direct path.
+
+# Multiple groups — each with its own directory
 [[groups]]
 id          = ""    # set after joining
 name        = "My Media"
 shared_dir  = "/home/user/Media"
-port        = 19000
 quic_port   = 19010
-http_port   = 19001
 
 [[groups]]
 id          = ""
 name        = "Public Archive"
 shared_dir  = "/home/user/Archive"
-port        = 19002
 quic_port   = 19012
-http_port   = 19003
-visibility  = "public"
+visibility  = "public"       # discoverable on the hub
+# join_policy = "open"       # anyone the hub says is a member gets the group key,
+                             # with no pairing code. Only for groups where that is
+                             # genuinely intended: it means the hub can join too.
 
 [keystore]
 # unlock_file = "~/.config/meshbay/unlock.key"
@@ -68,10 +73,13 @@ class HubConfig:
 
 @dataclass
 class NodeConfig:
-    port:       int = 19000
     quic_port:  int = 19010
-    http_port:  int = 19001
     ui_port:    int = 18000
+    # How long a one-time code stays usable. Invitations travel through a human
+    # conversation and are answered days later; operator pairing happens during
+    # the SSH session that printed it.
+    invite_ttl_hours: int = 168   # 7 days
+    pair_ttl_hours:   int = 24
 
 
 @dataclass
@@ -79,10 +87,16 @@ class GroupConfig:
     id:         str = ""
     name:       str = ""
     shared_dir: str = ""
-    visibility: str = "private"   # public|private
-    port:       int = 19000       # TCP+TLS MNP port for this group
+    visibility: str = "private"   # public|private — discoverability, not admission
+    # Admission. "invite" (default) means a newcomer needs a one-time pairing code
+    # before the node wraps the group key for them; "open" means the node pins
+    # whoever turns up first (TOFU) and serves them.
+    #
+    # Deliberately read from THIS file and never from the hub: a hub that could
+    # declare a group open would walk into any group it liked. Being findable
+    # (`visibility`) and being open (`join_policy`) are different questions.
+    join_policy: str = "invite"   # invite|open
     quic_port:  int = 19010       # QUIC MNP port
-    http_port:  int = 19001       # HTTP file API port
 
 
 @dataclass
@@ -121,10 +135,14 @@ def load_config(path: Path = DEFAULT_CONFIG_PATH) -> Config:
         cfg.hub.username = hub.get("username", cfg.hub.username)
 
         nd = raw.get("node", {})
-        cfg.node.port      = nd.get("port",      cfg.node.port)
+        # `port` (TCP+TLS) and `http_port` no longer exist — both listeners were removed
+        # in Phase 11.5 (findings C1, C6). Regenerate node.toml with `meshbay-node init`.
         cfg.node.quic_port = nd.get("quic_port", cfg.node.quic_port)
-        cfg.node.http_port = nd.get("http_port", cfg.node.http_port)
         cfg.node.ui_port   = nd.get("ui_port",   cfg.node.ui_port)
+        cfg.node.invite_ttl_hours = int(
+            nd.get("invite_ttl_hours", cfg.node.invite_ttl_hours))
+        cfg.node.pair_ttl_hours = int(
+            nd.get("pair_ttl_hours", cfg.node.pair_ttl_hours))
 
         # Multi-group: [[groups]] array
         if "groups" in raw:
@@ -134,9 +152,8 @@ def load_config(path: Path = DEFAULT_CONFIG_PATH) -> Config:
                     name=g.get("name", ""),
                     shared_dir=g.get("shared_dir", ""),
                     visibility=g.get("visibility", "private"),
-                    port=g.get("port", cfg.node.port),
+                    join_policy=g.get("join_policy", "invite"),
                     quic_port=g.get("quic_port", cfg.node.quic_port),
-                    http_port=g.get("http_port", cfg.node.http_port),
                 ))
         # Back-compat: single [group] section
         elif "group" in raw:
@@ -163,8 +180,8 @@ def load_config(path: Path = DEFAULT_CONFIG_PATH) -> Config:
         cfg.hub.url = url
     if user := os.environ.get("MESHBAY_USERNAME"):
         cfg.hub.username = user
-    if port := os.environ.get("MESHBAY_PORT"):
-        cfg.node.port = int(port)
+    if port := os.environ.get("MESHBAY_QUIC_PORT"):
+        cfg.node.quic_port = int(port)
 
     return cfg
 
diff --git a/packages/meshbay-node/src/meshbay_node/daemon.py b/packages/meshbay-node/src/meshbay_node/daemon.py
index fe12909..58fa99a 100644
--- a/packages/meshbay-node/src/meshbay_node/daemon.py
+++ b/packages/meshbay-node/src/meshbay_node/daemon.py
@@ -8,9 +8,9 @@ Startup sequence:
   4. Fetch GEK bundle from hub (if group configured)
   5. Start directory indexer (watchdog)
   6. Create chat stores (one SQLite DB per group)
-  7. Create WebRTC transport (browser clients via DataChannel)
-  8. Start QUIC+TCP chunk servers (native clients)
-  9. Start HTTP file API (public content)
+  7. Create WebRTC transport (browser + native clients via DataChannel)
+  8. Start QUIC chunk server (LAN / port-forwarded / hub-less direct access)
+  9. (Phase 11.5: the unauthenticated HTTP file API and the TCP+TLS server were removed)
   10. Start hub WebSocket (signaling, revocations, WebRTC offers)
   11. Start local web UI on node.ui_port (localhost only)
   12. Run until SIGINT/SIGTERM
@@ -18,6 +18,9 @@ Startup sequence:
 Usage:
   meshbay-node                    # interactive password prompt
   meshbay-node --config /path     # custom config
+  meshbay-node status             # node state + public key (works while stopped)
+  meshbay-node ui                 # print the local admin UI URL
+  meshbay-node gek-init           # initialise the group key (no browser needed)
   meshbay-node init               # write example config + create keystore
   meshbay-node --calibrate-argon2 # benchmark Argon2id, suggest parameters
 """
@@ -26,6 +29,7 @@ import asyncio
 import base64
 import json
 import logging
+import os
 import signal
 import sys
 from pathlib import Path
@@ -41,13 +45,12 @@ from meshbay_node.chat.store import ChatStore
 from meshbay_node.config import Config, DEFAULT_CONFIG_PATH, load_config, write_example_config
 from meshbay_node.hub_client import HubClient, HubConfig
 from meshbay_node.indexer import DirectoryIndexer
-from meshbay_node.keystore import NodeKeys, load_or_create_keystore
+from meshbay_node.keystore import load_or_create_keystore
+from meshbay_node.roster import Roster
 from meshbay_node.transport import (
-    ChunkServer,
     Denylist,
     QUIC_AVAILABLE,
     WEBRTC_AVAILABLE,
-    create_http_app,
 )
 
 if QUIC_AVAILABLE:
@@ -103,22 +106,22 @@ class NodeDaemon:
             "hub_url":       config.hub.url,
             "username":      config.hub.username,
             "groups":        [g.name for g in config.groups],
-            "node_port":     config.node.port,
             "quic_port":     config.node.quic_port,
             "endpoint_hint": None,
             "indexes":       {},
         }
-        self._tcp_server:  ChunkServer | None = None
         self._quic_server = None
         self._webrtc = None
-        self._denylist = Denylist() if Denylist else None
+        # Persisted so a restart does not silently un-revoke everyone (H4)
+        self._denylist = (
+            Denylist(path=config.data_dir / "denylist.json") if Denylist else None)
         self._chat_stores: dict[str, ChatStore] = {}
         self._audit_store: AuditStore | None = None
         self._bundle_store: BundleStore | None = None
+        self._roster: Roster | None = None
         self._indexers: list[DirectoryIndexer] = []
         self._tasks: list[asyncio.Task] = []
         self._hub: HubClient | None = None
-        self._http_servers: list[uvicorn.Server] = []
 
     async def run(self) -> None:
         log.info("MeshBay Node starting up")
@@ -133,6 +136,17 @@ class NodeDaemon:
         # 2. Start admin UI early (so operator can copy node key before hub login)
         self._state["pk_node_ed25519"] = keys.pk_ed25519_b64
         self._state["config"] = self._config
+        # Per-run token for the local admin UI (11.5.3). Not a password: it keeps
+        # other local processes and rebound browser pages out of an API that can
+        # re-initialise group keys.
+        ui_token = base64.urlsafe_b64encode(os.urandom(18)).decode().rstrip("=")
+        self._state["ui_token"] = ui_token
+        # Persisted so `meshbay-node ui` can open the browser. Nobody should ever
+        # have to copy a token out of a log or a terminal — that is not a workflow.
+        self._config.data_dir.mkdir(parents=True, exist_ok=True)
+        self._ui_token_file = self._config.data_dir / "ui-token"
+        self._ui_token_file.write_text(ui_token)
+        self._ui_token_file.chmod(0o600)
         from meshbay_node.ui import create_ui_app
         ui_app = create_ui_app(self._state)
         ui_cfg = uvicorn.Config(
@@ -143,7 +157,7 @@ class NodeDaemon:
         )
         ui_server = uvicorn.Server(ui_cfg)
         self._tasks.append(asyncio.create_task(ui_server.serve()))
-        log.info("Admin UI at http://localhost:%d", self._config.node.ui_port)
+        log.info("Admin UI ready — open it with:  meshbay-node ui")
 
         # 3. Hub connection (Ed25519 auth — retries until node key is linked)
         hub_cfg = HubConfig(
@@ -162,6 +176,14 @@ class NodeDaemon:
             await self._bundle_store.open()
             log.info("Bundle store opened: %s", data_dir / "bundles.db")
 
+            # 4b. Roster — who this node recognises and which keys are theirs.
+            # Node authority is established here, locally, and never learned from
+            # the hub: a hub that could name the operator's key could install
+            # itself as node administrator.
+            self._roster = Roster(db_path=data_dir / "roster.db")
+            await self._roster.open()
+            await self._roster.purge_expired()
+
             # X25519 key material for GEK unwrapping
             from cryptography.hazmat.primitives import serialization
             sk_x_raw = keys.sk_x25519.private_bytes(
@@ -210,6 +232,10 @@ class NodeDaemon:
                     "gek": gek,
                     "shared_root": shared_root,
                     "index": indexer.index,
+                    "visibility": group_cfg.visibility,
+                    # Admission policy comes from node.toml, never from the hub:
+                    # a hub that could declare a group open would be handed its key.
+                    "join_policy": group_cfg.join_policy,
                 }
 
             if not groups_ctx:
@@ -246,7 +272,11 @@ class NodeDaemon:
                     groups=groups_ctx,
                     denylist=denylist,
                 )
-                self._webrtc._ctx["chat_store"] = first.get("chat_store")
+                # No global chat_store here: each group's store lives in
+                # groups_ctx[gid]["chat_store"] and is resolved per session via
+                # _group_ctx(). Assigning the first group's store transport-wide
+                # sent every group's chat to one database and served it back to
+                # members of every other group (finding H1).
                 self._webrtc._ctx["hub_ws"] = _WsSender(hub)
                 self._webrtc._ctx["node_user_id"] = session.user_id
                 self._webrtc._ctx["audit_store"] = self._audit_store
@@ -255,17 +285,27 @@ class NodeDaemon:
                 self._webrtc._ctx["pk_x25519_raw"] = pk_x_raw
                 self._webrtc._ctx["pk_x25519_b64"] = keys.pk_x25519_b64
 
-                admin_pk = self._resolve_admin_pk(keys)
+                self._webrtc._ctx["roster"] = self._roster
+                self._webrtc._ctx["invite_ttl"] = (
+                    self._config.node.invite_ttl_hours * 3600)
+                admin_pk = self._legacy_admin_pk()
+                paired = await self._roster.has_operator() if self._roster else False
                 if admin_pk:
                     self._webrtc._ctx["admin_pk_ed25519"] = admin_pk
-                    log.info("Admin Ed25519 key pinned for node sovereignty")
+                self._webrtc._ctx["has_admin_authority"] = paired
+                if paired or admin_pk:
+                    sources = ([] if not paired else ["paired operator"]) + \
+                              ([] if not admin_pk else ["node.toml admin_pk"])
+                    log.info("Node authority: %s", " + ".join(sources))
                 else:
-                    log.warning("No admin_pk_ed25519 — admin operations disabled")
+                    log.warning(
+                        "No operator paired — invites and file deletion are "
+                        "refused. Run: meshbay-node operator pair")
                 log.info("WebRTC transport ready")
             else:
                 log.warning("WebRTC not available (aiortc not installed)")
 
-            # 7. QUIC + TCP chunk servers
+            # 7. QUIC chunk server (LAN / port-forwarded / hub-less direct access)
             if QUIC_AVAILABLE:
                 self._quic_server = QuicChunkServer(
                     sk_node=keys.sk_ed25519,
@@ -282,19 +322,6 @@ class NodeDaemon:
                 log.info("QUIC server on port %d (%d groups)",
                          self._config.node.quic_port, len(groups_ctx))
 
-            self._tcp_server = ChunkServer(
-                sk_node=keys.sk_ed25519,
-                hub_pk_pem=session.hub_pk_pem,
-                gek=first["gek"],
-                shared_root=first["shared_root"],
-                index=first["index"],
-                host="0.0.0.0",
-                port=self._config.node.port,
-                groups=groups_ctx,
-            )
-            await self._tcp_server.start()
-            log.info("TCP+TLS server on port %d", self._config.node.port)
-
             # 8. Hub WebSocket (signaling + revocations + WebRTC offers)
             async def on_webrtc_offer(sdp, peer_id, ice_candidates):
                 if not self._webrtc:
@@ -324,8 +351,15 @@ class NodeDaemon:
                         tid = payload.get("target_id", "")
                         if target == "user":
                             denylist.deny_user(tid)
+                        elif target == "group":
+                            # H4: previously dropped on the floor, so "suspend a
+                            # group" was a hub-only gesture that no node enforced.
+                            denylist.deny_group(tid)
+                            self._drop_group_sessions(tid)
                         elif target == "jti":
                             denylist.deny_jti(tid)
+                        else:
+                            log.warning("Unknown revocation target: %r", target)
                     except Exception as e:
                         log.warning("Invalid revocation token: %s", e)
 
@@ -338,37 +372,17 @@ class NodeDaemon:
             self._tasks.append(ws_task)
             log.info("Hub WS task started")
 
-            # 9. HTTP file API (one per group)
-            for gid, gctx in groups_ctx.items():
-                group_cfg = next(
-                    (g for g in self._config.groups if g.id == gid), None)
-                if not group_cfg:
-                    continue
-                http_app = create_http_app(
-                    sk_node=keys.sk_ed25519,
-                    hub_pk_pem=session.hub_pk_pem,
-                    shared_root=gctx["shared_root"],
-                    index=gctx["index"],
-                    group_id=gid,
-                    group_name=group_cfg.name,
-                    gek=gctx.get("gek"),
-                )
-                http_cfg = uvicorn.Config(
-                    http_app,
-                    host="0.0.0.0",
-                    port=group_cfg.http_port,
-                    log_level="warning",
-                )
-                http_server = uvicorn.Server(http_cfg)
-                self._http_servers.append(http_server)
-                self._tasks.append(asyncio.create_task(http_server.serve()))
-                log.info("HTTP API on port %d for group %s",
-                         group_cfg.http_port, group_cfg.name)
+            # 9. (removed in Phase 11.5) The per-group HTTP file API used to start here.
+            # It served the Mesh Group Index and raw plaintext files on 0.0.0.0 with no
+            # authentication, for private groups too — finding C1. Every client path now
+            # goes through the MNP handshake (JWT + group claim + GEK proof).
 
             # 10. Update admin UI state (UI already running from step 2)
             self._state["groups_ctx"] = groups_ctx
             self._state["audit_store"] = self._audit_store
             self._state["bundle_store"] = self._bundle_store
+            self._state["roster"] = self._roster
+            self._state["node_user_id"] = session.user_id
             self._state["webrtc"] = self._webrtc
             self._state["hub"] = hub
             self._state["pk_x25519_raw"] = pk_x_raw
@@ -379,9 +393,15 @@ class NodeDaemon:
                      "yes" if self._webrtc else "no",
                      "yes" if self._quic_server else "no")
 
-            # 11. Initial swarm registration
+            # 11. Initial swarm registration — PUBLIC groups only.
+            # Finding H7: registering every group's hashes hands the hub a content
+            # fingerprint of every private file on the node, which is exactly the
+            # metadata the "hub stores no content metadata" claim rules out. It also
+            # lets anyone confirm whether a known file exists in the network.
             endpoint = f"webrtc:{self._config.node.quic_port}"
             for gctx in groups_ctx.values():
+                if gctx.get("visibility") != "public":
+                    continue
                 hashes = [e.id for e in gctx["index"].entries]
                 if hashes:
                     asyncio.ensure_future(self._register_swarm(hashes, endpoint))
@@ -403,14 +423,28 @@ class NodeDaemon:
                 return await hub.startup(endpoint_hint=None)
             except _httpx.HTTPStatusError as e:
                 body = e.response.text if hasattr(e.response, 'text') else ''
-                if e.response.status_code == 401 and "No node key" in body:
-                    self._state["status"] = "waiting_for_node_key"
-                    log.warning(
-                        "Node key not linked — open admin UI at "
-                        "http://localhost:%d, copy the key, and paste it in "
-                        "Settings > Link Node on the hub. Retrying in 30s...",
-                        self._config.node.ui_port,
-                    )
+                # Any 401 here needs a human at a browser, and the operator needs
+                # this daemon alive to read its public key out of the local admin
+                # UI. Exiting would take that UI down and strand them — which is
+                # exactly what happened when a node was started before its owner
+                # had registered.
+                if e.response.status_code == 401:
+                    if "No node key" in body:
+                        self._state["status"] = "waiting_for_node_key"
+                        log.warning(
+                            "Node key not linked. Open the admin UI, copy this "
+                            "node's key, and paste it in Settings > Link Node on "
+                            "%s. Retrying in 30s...",
+                            self._config.hub.url,
+                        )
+                    else:
+                        self._state["status"] = "waiting_for_account"
+                        log.warning(
+                            "Hub rejected the node credentials for user %r. "
+                            "Register that account on %s first, then link this "
+                            "node's key. Retrying in 30s...",
+                            self._config.hub.username, self._config.hub.url,
+                        )
                     await asyncio.sleep(30)
                 else:
                     raise
@@ -448,21 +482,25 @@ class NodeDaemon:
         log.warning("No unwrappable GEK bundle found for group %s", group_id[:8])
         return None
 
-    def _resolve_admin_pk(self, keys: NodeKeys) -> Ed25519PublicKey | None:
-        """Resolve the admin Ed25519 public key: config → auto-pin from node keystore."""
-        if self._config.admin_pk_ed25519:
-            try:
-                raw = base64.b64decode(self._config.admin_pk_ed25519)
-                return Ed25519PublicKey.from_public_bytes(raw)
-            except Exception as e:
-                log.error("Invalid admin_pk_ed25519 in config: %s", e)
-                return None
+    def _legacy_admin_pk(self) -> Ed25519PublicKey | None:
+        """
+        The pre-roster way of naming the operator: `admin_pk_ed25519` in node.toml.
 
-        pk = keys.sk_ed25519.public_key()
-        from meshbay_common.crypto import pk_to_b64
-        pk_b64 = pk_to_b64(pk)
-        log.info("Auto-pinning admin key from node keystore: %s", pk_b64[:16])
-        return pk
+        Still honoured so a deployment configured that way keeps working, but no
+        longer the only path — and the auto-pin that used to stand in for it is
+        gone. It pinned the node's *keystore* key while the browser signed with the
+        user's *identity* key, so admin operations failed closed with a signature
+        error that looked like a bug elsewhere (finding M3). An operator now pairs
+        a browser with `meshbay-node operator pair`.
+        """
+        if not self._config.admin_pk_ed25519:
+            return None
+        try:
+            raw = base64.b64decode(self._config.admin_pk_ed25519)
+            return Ed25519PublicKey.from_public_bytes(raw)
+        except Exception as e:
+            log.error("Invalid admin_pk_ed25519 in config: %s", e)
+            return None
 
     async def _on_index_change(self, indexer: DirectoryIndexer) -> None:
         """Called when a DirectoryIndexer detects file changes."""
@@ -498,13 +536,25 @@ class NodeDaemon:
             if pushed:
                 log.info("Index pushed to %d WebRTC peers", pushed)
 
-        # 11.9 — Register file hashes with hub swarm table
-        if self._hub and self._state.get("endpoint_hint"):
+        # 11.9 — Register file hashes with hub swarm table (public groups only, H7)
+        group_cfg = next(
+            (g for g in self._config.groups if g.id == group_id), None)
+        if (self._hub and self._state.get("endpoint_hint")
+                and group_cfg and group_cfg.visibility == "public"):
             hashes = [e.id for e in idx.entries]
             if hashes:
                 endpoint = f"webrtc:{self._config.node.quic_port}"
                 asyncio.ensure_future(self._register_swarm(hashes, endpoint))
 
+    def _drop_group_sessions(self, group_id: str) -> None:
+        """Close live sessions for a revoked group (H4)."""
+        if not self._webrtc or not group_id:
+            return
+        for session in list(self._webrtc._sessions.values()):
+            if session._group_id == group_id:
+                asyncio.ensure_future(session.close())
+                log.info("Dropped session for revoked group %s", group_id[:8])
+
     async def _register_swarm(self, hashes: list[str], endpoint: str) -> None:
         try:
             n = await self._hub.register_swarm(hashes, endpoint)
@@ -533,6 +583,9 @@ class NodeDaemon:
         if self._bundle_store:
             await self._bundle_store.close()
 
+        if self._roster:
+            await self._roster.close()
+
         for store in self._chat_stores.values():
             await store.close()
 
@@ -541,15 +594,68 @@ class NodeDaemon:
 
         if self._quic_server:
             await self._quic_server.stop()
-        if self._tcp_server:
-            await self._tcp_server.stop()
 
-        for server in self._http_servers:
-            server.should_exit = True
+        token_file = getattr(self, "_ui_token_file", None)
+        if token_file is not None:
+            token_file.unlink(missing_ok=True)
 
         log.info("Node stopped")
 
 
+# ── CLI helpers ───────────────────────────────────────────────────────────────
+
+def _daemon_api(cfg: Config, path: str, method: str = "GET",
+                timeout: int = 30) -> dict:
+    """
+    Call the daemon's loopback API.
+
+    The daemon owns the roster, the hub session and the live group contexts, so
+    the CLI asks it to act rather than opening its databases behind its back. It
+    also means every operator action goes through the same authorization as the
+    admin UI (the per-run session token, 11.5.3).
+    """
+    import json as _json
+    import urllib.error
+    import urllib.parse
+    import urllib.request
+
+    token_file = cfg.data_dir / "ui-token"
+    if not token_file.exists():
+        print("Node is not running — start it with: meshbay-node")
+        sys.exit(1)
+
+    sep = "&" if "?" in path else "?"
+    url = (f"http://127.0.0.1:{cfg.node.ui_port}{path}"
+           f"{sep}t={token_file.read_text().strip()}")
+    try:
+        req = urllib.request.Request(url, method=method)
+        with urllib.request.urlopen(req, timeout=timeout) as r:
+            return _json.loads(r.read())
+    except urllib.error.HTTPError as e:
+        body = e.read().decode()[:300]
+        try:
+            detail = _json.loads(body).get("error", body)
+        except Exception:
+            detail = body
+        print(f"failed: {detail}")
+        sys.exit(1)
+    except Exception as e:
+        print(f"failed: {e}")
+        sys.exit(1)
+
+
+def _resolve_group(cfg: Config, group: str | None) -> str:
+    """The group argument, or the only configured one."""
+    if group:
+        return group
+    configured = [g.id for g in cfg.groups if g.id]
+    if len(configured) == 1:
+        return configured[0]
+    print("--group is required (several groups configured)"
+          if configured else "no group configured in node.toml")
+    sys.exit(1)
+
+
 # ── Entry point ───────────────────────────────────────────────────────────────
 
 def main() -> None:
@@ -557,16 +663,28 @@ def main() -> None:
 
     parser = argparse.ArgumentParser(description="MeshBay Node daemon")
     parser.add_argument("command", nargs="?",
-                        choices=["init", "calibrate-argon2"],
-                        help="init: write example config | calibrate-argon2: benchmark")
+                        choices=["init", "status", "ui", "gek-init", "operator",
+                                 "member", "calibrate-argon2"],
+                        help="init: write example config | status: node state and keys "
+                             "| ui: print the admin UI URL | operator pair: pair a "
+                             "browser with this node | member list|invite|revoke|unpin "
+                             "| calibrate-argon2: benchmark")
+    parser.add_argument("subcommand", nargs="?",
+                        help="'pair' for operator; list|invite|revoke|unpin for member")
+    parser.add_argument("target", nargs="?",
+                        help="username, for member invite|revoke|unpin")
     parser.add_argument("--config", type=Path, default=None,
                         help="Config file path")
+    parser.add_argument("--group", default=None,
+                        help="group id (optional if only one is configured)")
     parser.add_argument("--log-level", default="INFO",
                         choices=["DEBUG", "INFO", "WARNING", "ERROR"])
     args = parser.parse_args()
 
+    # Query commands print a report; library logging would interleave with it.
+    quiet = args.command in ("status", "ui", "gek-init", "operator", "member")
     logging.basicConfig(
-        level=getattr(logging, args.log_level),
+        level=logging.ERROR if quiet else getattr(logging, args.log_level),
         format="%(asctime)s %(levelname)-8s %(name)s: %(message)s",
     )
 
@@ -579,6 +697,216 @@ def main() -> None:
         calibrate_argon2()
         return
 
+    if args.command == "status":
+        import json as _json
+        import urllib.request
+
+        cfg = load_config(args.config or DEFAULT_CONFIG_PATH)
+        print(f"hub          {cfg.hub.url}  (user {cfg.hub.username or '—'})")
+
+        # Read straight from the keystore: the operator needs this key to link the
+        # node, and that happens before the daemon can ever stay running.
+        try:
+            keys = load_or_create_keystore(
+                path=cfg.keystore.path, unlock_file=cfg.keystore.unlock_file)
+            print(f"node key     {keys.pk_ed25519_b64}")
+        except Exception as e:
+            print(f"node key     <keystore locked: {e}>")
+
+        token_file = cfg.data_dir / "ui-token"
+        live = None
+        if token_file.exists():
+            try:
+                url = (f"http://127.0.0.1:{cfg.node.ui_port}"
+                       f"/api/status?t={token_file.read_text().strip()}")
+                with urllib.request.urlopen(url, timeout=3) as r:
+                    live = _json.loads(r.read())
+            except Exception:
+                live = None
+
+        if live:
+            print(f"daemon       running — {live.get('status')}")
+            print(f"node_id      {live.get('endpoint_hint') or '—'}")
+            print(f"groups       {live.get('group_count', 0)}"
+                  f"  files {live.get('total_files', 0)}"
+                  f"  peers {live.get('webrtc_peers', 0)}")
+            print(f"admin UI     meshbay-node ui")
+        else:
+            print("daemon       not running")
+
+        print(f"config       {DEFAULT_CONFIG_PATH}")
+        if not cfg.groups:
+            print("groups       none configured — create a group on the hub, then add")
+            print("             a [[groups]] entry with its id and shared_dir")
+        else:
+            for g in cfg.groups:
+                print(f"  group      {g.name} [{g.visibility}] {g.id or '<no id>'}")
+                print(f"             {g.shared_dir or '<no shared_dir>'}")
+        # Node authority: the roster is the source of truth, node.toml the legacy
+        # form. Read the DB directly so this reports correctly while the daemon is
+        # stopped — the state an operator is most often in when checking.
+        import asyncio as _asyncio
+
+        from meshbay_node.roster import Roster as _Roster
+
+        async def _read_roster() -> tuple[list, int]:
+            r = _Roster(db_path=cfg.data_dir / "roster.db")
+            await r.open()
+            try:
+                return (await r.list_members()), len(await r.list_invites())
+            finally:
+                await r.close()
+
+        try:
+            members, pending = _asyncio.run(_read_roster())
+        except Exception as e:
+            members, pending = [], 0
+            print(f"roster       <unreadable: {e}>")
+
+        operators = [m for m in members if m["role"] == "operator"
+                     and m["status"] == "active"]
+        if operators:
+            for op in operators:
+                print(f"operator     {op.get('username') or op['user_id'][:8]}"
+                      f"  key {(op.get('pk_ed25519') or '')[:16]}…"
+                      f"  paired {op.get('pinned_at', '?')}")
+        elif cfg.admin_pk_ed25519:
+            print("operator     node.toml admin_pk_ed25519 (legacy)")
+            print("             run `meshbay-node operator pair` to replace it")
+        else:
+            print("operator     NONE PAIRED — file deletion and member invites are")
+            print("             refused. Run: meshbay-node operator pair")
+        if pending:
+            print(f"invites      {pending} pending code(s)")
+        return
+
+    if args.command == "member":
+        cfg = load_config(args.config or DEFAULT_CONFIG_PATH)
+        sub = args.subcommand or "list"
+
+        if sub == "list":
+            group = args.group or ""
+            out = _daemon_api(
+                cfg, f"/api/roster?group_id={group}" if group else "/api/roster")
+            identities = {i["user_id"]: i for i in out.get("identities", [])}
+
+            members = out.get("members", [])
+            if not members:
+                print("no members admitted yet")
+                print("invite someone:  meshbay-node member invite <username>")
+            for m in members:
+                ident = identities.get(m["user_id"], {})
+                scope = m["group_id"][:8] if m["group_id"] else "node-wide"
+                print(f"{(ident.get('username') or m['user_id'])[:20]:20} "
+                      f"{m['role']:9} {m['status']:8} {scope:10} "
+                      f"pinned {ident.get('pinned_at', '?')} "
+                      f"({ident.get('pinned_via', '?')})")
+
+            invites = out.get("invites", [])
+            if invites:
+                print()
+                for i in invites:
+                    print(f"pending invite  user {i['user_id'][:12]}  "
+                          f"group {(i['group_id'] or 'node-wide')[:8]}  "
+                          f"expires {i['expires_at']}")
+            return
+
+        if not args.target:
+            print(f"usage: meshbay-node member {sub} <username>")
+            sys.exit(1)
+
+        if sub == "invite":
+            group_id = _resolve_group(cfg, args.group)
+            out = _daemon_api(
+                cfg, f"/api/groups/{group_id}/invites?username={args.target}",
+                method="POST")
+            from meshbay_node.roster import write_code_file
+            path = write_code_file(cfg.data_dir, out["code"],
+                                   out.get("expires_at", ""), name="invite-code")
+            print(f"INVITATION CODE  {out['code']}")
+            print(f"valid until      {out.get('expires_at', '?')}")
+            print()
+            print(f"Send it to {args.target} however you normally talk. It works")
+            print("once, for that account only, and never passes through the hub.")
+            print("They enter it the first time they open the group — you do not")
+            print("need to be online then.")
+            print()
+            print(f"also written to {path}")
+            return
+
+        # revoke and unpin both name a person; the daemon resolves the account.
+        # It tries its own roster first and falls back to the hub, so a node that
+        # pinned someone before invitations carried a name is still manageable.
+        match = _daemon_api(cfg, f"/api/resolve?username={args.target}")
+
+        if sub == "revoke":
+            group_id = _resolve_group(cfg, args.group)
+            out = _daemon_api(
+                cfg, f"/api/members/{match['user_id']}/revoke?group_id={group_id}",
+                method="POST")
+            print(f"{args.target} revoked from {group_id[:8]}")
+            print("They stop receiving the group key on their next connection.")
+            print("They still hold the current one — rotate it:")
+            print(f"  meshbay-node gek-init --group {group_id}")
+            return
+
+        if sub == "unpin":
+            _daemon_api(cfg, f"/api/members/{match['user_id']}/unpin", method="POST")
+            print(f"{args.target} unpinned — they can pair again with a new key")
+            print(f"issue a code:  meshbay-node member invite {args.target}")
+            return
+
+        print("usage: meshbay-node member list|invite|revoke|unpin")
+        sys.exit(1)
+
+    if args.command == "gek-init":
+        cfg = load_config(args.config or DEFAULT_CONFIG_PATH)
+        group_id = _resolve_group(cfg, args.group)
+        out = _daemon_api(cfg, f"/api/groups/{group_id}/gek",
+                          method="POST", timeout=60)
+
+        print(f"GEK ready for {group_id}")
+        print(f"  {out.get('authorized_members', 0)} authorized member(s) — each "
+              f"receives the key on connect")
+        for err in out.get("errors") or []:
+            print(f"  ! {err}")
+        return
+
+    if args.command == "operator":
+        if args.subcommand != "pair":
+            print("usage: meshbay-node operator pair")
+            sys.exit(1)
+
+        cfg = load_config(args.config or DEFAULT_CONFIG_PATH)
+        out = _daemon_api(cfg, "/api/operator/pair", method="POST")
+
+        from meshbay_node.roster import write_code_file
+        path = write_code_file(cfg.data_dir, out["code"], out.get("expires_at", ""))
+
+        print(f"PAIRING CODE   {out['code']}")
+        print(f"valid until    {out.get('expires_at', '?')}")
+        print()
+        print("Sign in to the web app as this node's operator, open one of your")
+        print("groups, go to the Members tab and enter the code there.")
+        print("It works once, for that account only, and authorizes invites and")
+        print("file deletion from that browser.")
+        print()
+        print(f"also written to {path}")
+        return
+
+    if args.command == "ui":
+        cfg = load_config(args.config or DEFAULT_CONFIG_PATH)
+        token_file = cfg.data_dir / "ui-token"
+        if not token_file.exists():
+            print("Node does not appear to be running — start it with: meshbay-node")
+            sys.exit(1)
+        print(f"http://127.0.0.1:{cfg.node.ui_port}"
+              f"/?t={token_file.read_text().strip()}")
+        print()
+        print("The UI listens on loopback only. From another machine:")
+        print(f"  ssh -L {cfg.node.ui_port}:127.0.0.1:{cfg.node.ui_port} <this-host>")
+        return
+
     cfg = load_config(args.config or DEFAULT_CONFIG_PATH)
     if not cfg.hub.username:
         print("Error: hub.username not set in config. Run: meshbay-node init")
diff --git a/packages/meshbay-node/src/meshbay_node/hub_client.py b/packages/meshbay-node/src/meshbay_node/hub_client.py
index 432af0a..d8417e3 100644
--- a/packages/meshbay-node/src/meshbay_node/hub_client.py
+++ b/packages/meshbay-node/src/meshbay_node/hub_client.py
@@ -13,6 +13,7 @@ No auth_key or password is ever stored on or transmitted from the node.
 The hub issues a node-scoped JWT that cannot manage group membership.
 """
 
+import asyncio
 import base64
 import json
 import logging
@@ -127,8 +128,8 @@ class HubClient:
         access_token = data["access_token"]
 
         decoded = jwt.decode(access_token, hub_pk_pem, algorithms=["EdDSA"])
-        assert decoded["pk_user"] == self._keys.pk_ed25519_b64, \
-            "Hub returned token for wrong public key"
+        # No pk_user claim to check any more: tokens carry no key. What binds this
+        # token to this node is the Ed25519 challenge it was issued against.
         assert "jti" in decoded, "Hub token missing jti — hub is outdated"
         assert decoded.get("scope") == "node", \
             "Expected node-scoped token"
@@ -163,9 +164,19 @@ class HubClient:
             raise RuntimeError("Not logged in")
         await self.ensure_fresh_token()
 
+        # Proof of possession of the node key (M8) — same domain-separated shape
+        # as node_auth, so a signature for one can never satisfy the other.
+        timestamp = int(time.time())
+        message = (f"meshbay:node_announce:{self._session.user_id}:"
+                   f"{self._keys.pk_ed25519_b64}:{timestamp}").encode()
+        signature = base64.b64encode(
+            self._keys.sk_ed25519.sign(message)).decode()
+
         r = await self._http.post("/v1/nodes/announce", json={
             "pk_node":       self._keys.pk_ed25519_b64,
             "endpoint_hint": endpoint_hint,
+            "timestamp":     timestamp,
+            "signature":     signature,
         }, headers=self._session.auth_headers)
         r.raise_for_status()
         node_id = r.json()["node_id"]
@@ -219,9 +230,19 @@ class HubClient:
         hub_url = self._session.hub_url.replace("https://", "wss://").replace("http://", "ws://")
         ws_url = f"{hub_url}/v1/nodes/ws"
 
+        # Offers are handled off the read loop (see below), so keep a handle on
+        # the tasks to avoid them being garbage-collected mid-negotiation.
+        pending: set[asyncio.Task] = set()
+
         while True:
             try:
-                async with websockets.connect(ws_url) as ws:
+                # Explicit keepalive: this connection is how a node stays visible
+                # to the hub, and a silently half-open socket looks exactly like a
+                # working one until someone notices the node has vanished.
+                async with websockets.connect(
+                    ws_url, ping_interval=20, ping_timeout=20, close_timeout=5,
+                    open_timeout=15,
+                ) as ws:
                     auth_msg = {
                         "type": "auth",
                         "token": self._session.access_token,
@@ -230,10 +251,20 @@ class HubClient:
                     if group_ids:
                         auth_msg["group_ids"] = group_ids
                     await ws.send(json.dumps(auth_msg))
-                    auth_resp = json.loads(await ws.recv())
+                    # Bounded: a hub that accepts the socket and then says nothing
+                    # — which is what it does for a few seconds while restarting —
+                    # would otherwise park this task here forever, with the node
+                    # running, silent, and invisible to everyone.
+                    auth_resp = json.loads(
+                        await asyncio.wait_for(ws.recv(), timeout=15))
                     if auth_resp.get("type") != "auth_ok":
-                        log.error("WS auth failed: %s", auth_resp)
-                        return
+                        # Not fatal: the token may simply have expired while we
+                        # were disconnected. Refresh on the next pass rather than
+                        # ending the task, which used to strand the node for good.
+                        log.warning("WS auth refused: %s — retrying in 5s", auth_resp)
+                        await asyncio.sleep(5)
+                        await self.ensure_fresh_token()
+                        continue
 
                     self._ws = ws
                     log.info("Hub WS connected")
@@ -250,28 +281,60 @@ class HubClient:
                             on_revocation(msg.get("token", ""))
 
                         elif mtype == "webrtc_offer" and on_webrtc_offer:
-                            answer = await on_webrtc_offer(
-                                msg["sdp"], msg["peer_id"],
-                                msg.get("ice_candidates", []))
-                            if answer:
-                                await ws.send(json.dumps({
-                                    "type": "webrtc_answer",
-                                    "peer_id": msg["peer_id"],
-                                    "sdp": answer[0],
-                                    "ice_candidates": answer[1],
-                                }))
+                            # Answered off the read loop on purpose. Awaiting the
+                            # handler here meant one slow negotiation stopped the
+                            # node reading this socket at all: no pings answered,
+                            # no close frame noticed, no further offers served. A
+                            # client that gave up mid-ICE left the node in
+                            # CLOSE-WAIT, still running but invisible to the hub
+                            # and unreachable by everyone, until it was restarted.
+                            task = asyncio.create_task(
+                                self._answer_offer(ws, on_webrtc_offer, msg))
+                            pending.add(task)
+                            task.add_done_callback(pending.discard)
 
                         elif mtype == "pong":
                             pass
 
             except asyncio.CancelledError:
+                for task in pending:
+                    task.cancel()
                 raise
             except Exception as e:
                 log.warning("Hub WS disconnected: %s — reconnecting in 5s", e)
                 await asyncio.sleep(5)
+            else:
+                # A clean close ends the `async for` without raising. Say so, so a
+                # node that quietly stopped being reachable leaves a trace.
+                log.warning("Hub WS closed by the hub — reconnecting in 5s")
+                await asyncio.sleep(5)
             finally:
                 self._ws = None
 
+    async def _answer_offer(self, ws, on_webrtc_offer, msg: dict) -> None:
+        """Negotiate one WebRTC offer and return the answer, off the read loop."""
+        try:
+            answer = await on_webrtc_offer(
+                msg["sdp"], msg["peer_id"], msg.get("ice_candidates", []))
+        except Exception as e:
+            log.warning("WebRTC offer from %s failed: %s",
+                        str(msg.get("peer_id"))[:8], e)
+            return
+        if not answer:
+            return
+        try:
+            await ws.send(json.dumps({
+                "type": "webrtc_answer",
+                "peer_id": msg["peer_id"],
+                "sdp": answer[0],
+                "ice_candidates": answer[1],
+            }))
+        except Exception as e:
+            # The socket may have gone while we were negotiating; the client will
+            # retry, and the read loop is reconnecting.
+            log.warning("Could not deliver WebRTC answer to %s: %s",
+                        str(msg.get("peer_id"))[:8], e)
+
     # ── Swarm registration ─────────────────────────────────────────────────
 
     async def register_swarm(self, content_hashes: list[str], endpoint: str) -> int:
diff --git a/packages/meshbay-node/src/meshbay_node/keystore.py b/packages/meshbay-node/src/meshbay_node/keystore.py
index 3777af0..59fc719 100644
--- a/packages/meshbay-node/src/meshbay_node/keystore.py
+++ b/packages/meshbay-node/src/meshbay_node/keystore.py
@@ -39,6 +39,12 @@ from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
 from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey
 
 from meshbay_common.crypto import (
+    ARGON2_ITERATIONS,
+    ARGON2_LANES,
+    ARGON2_MEMORY_COST,
+    LEGACY_ARGON2_ITERATIONS,
+    LEGACY_ARGON2_LANES,
+    LEGACY_ARGON2_MEMORY_COST,
     decrypt_keystore,
     derive_keystore_key,
     encrypt_keystore,
@@ -173,7 +179,18 @@ def load_keystore(
     tag  = base64.b64decode(envelope["tag_b64"])
     ct   = base64.b64decode(envelope["ciphertext_b64"])
 
-    aes_key = derive_keystore_key(pwd, salt)
+    # Envelopes written before M2 carry no parameters and used the 64 MB profile.
+    params = envelope.get("argon2", {
+        "iterations":  LEGACY_ARGON2_ITERATIONS,
+        "memory_cost": LEGACY_ARGON2_MEMORY_COST,
+        "lanes":       LEGACY_ARGON2_LANES,
+    })
+    aes_key = derive_keystore_key(
+        pwd, salt,
+        iterations=params.get("iterations"),
+        memory_cost=params.get("memory_cost"),
+        lanes=params.get("lanes"),
+    )
     try:
         plaintext = decrypt_keystore(iv, ct, tag, aes_key)
     except Exception:
@@ -205,6 +222,12 @@ def _write_keystore(path: Path, keys: NodeKeys, password: str) -> None:
     envelope = {
         "version":         KEYSTORE_VERSION,
         "argon2_salt_b64": base64.b64encode(salt).decode(),
+        # Recorded so parameters can be raised later without orphaning this file.
+        "argon2": {
+            "iterations":  ARGON2_ITERATIONS,
+            "memory_cost": ARGON2_MEMORY_COST,
+            "lanes":       ARGON2_LANES,
+        },
         "iv_b64":          base64.b64encode(iv).decode(),
         "tag_b64":         base64.b64encode(tag).decode(),
         "ciphertext_b64":  base64.b64encode(ct).decode(),
diff --git a/packages/meshbay-node/src/meshbay_node/roster.py b/packages/meshbay-node/src/meshbay_node/roster.py
new file mode 100644
index 0000000..6bda56b
--- /dev/null
+++ b/packages/meshbay-node/src/meshbay_node/roster.py
@@ -0,0 +1,400 @@
+"""
+Node roster — who this node recognises, and which keys are theirs.
+
+The node keeps its own answer to "may this person have the group key", derived from
+what the operator authorized locally. It is deliberately NOT derived from the hub:
+the hub decides group membership, and a hub that invents an account and mints a
+token for it would otherwise collect the GEK on connect. Hub membership is an input
+to the decision; it is not the decision.
+
+Three tables:
+
+  identities — one row per person, not per group. Someone paired for one group
+               needs no code for the next one on the same node.
+  members    — role and status per (group, user).
+  invites    — one-time pairing codes, stored as a hash. The code itself exists
+               only in the operator's hands and the invitee's.
+
+The code is what binds a public key to an account without asking the hub
+(finding H3). See `docs/invite-pairing-v1.md`.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import logging
+import os
+import secrets
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+
+import aiosqlite
+
+log = logging.getLogger(__name__)
+
+# Crockford base32 without I, L, O and U: no character pair a human can confuse
+# when reading a code aloud or typing it from a phone screen.
+_ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ"
+CODE_LEN = 8                      # 8 × 5 bits = 40 bits of entropy
+
+# Two different rhythms, so two different lifetimes.
+#
+# An invitation crosses a human conversation: it is sent by mail or message and
+# answered whenever the other person next looks. A day is not enough — the code
+# dies over a weekend and someone has to be at a browser, with the node online, to
+# issue another one.
+#
+# Operator pairing crosses an SSH session: the code is printed and typed minutes
+# later. There is no reason for it to outlive the sitting.
+#
+# The longer window costs little: a code is single use, bound to one account,
+# never seen by the hub, and 40 bits do not fall to guessing in a week against the
+# node-wide lockout.
+DEFAULT_INVITE_TTL = 7 * 24 * 3600   # seconds — member invitations
+DEFAULT_PAIR_TTL = 24 * 3600         # seconds — operator pairing
+
+_SCHEMA = """\
+CREATE TABLE IF NOT EXISTS identities (
+    user_id    TEXT PRIMARY KEY,
+    username   TEXT NOT NULL,
+    pk_ed25519 TEXT NOT NULL,
+    pk_x25519  TEXT NOT NULL,
+    pinned_at  TEXT NOT NULL,
+    pinned_via TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS members (
+    group_id    TEXT NOT NULL,
+    user_id     TEXT NOT NULL,
+    role        TEXT NOT NULL,
+    status      TEXT NOT NULL,
+    approved_by TEXT NOT NULL,
+    approved_at TEXT NOT NULL,
+    PRIMARY KEY (group_id, user_id)
+);
+
+CREATE TABLE IF NOT EXISTS invites (
+    code_hash  TEXT PRIMARY KEY,
+    group_id   TEXT NOT NULL,
+    user_id    TEXT NOT NULL,
+    username   TEXT NOT NULL DEFAULT '',
+    role       TEXT NOT NULL,
+    created_by TEXT NOT NULL,
+    created_at TEXT NOT NULL,
+    expires_at TEXT NOT NULL,
+    used_at    TEXT
+);
+"""
+
+
+def generate_code() -> str:
+    """A fresh pairing code, formatted for a human to read out: XXXX-XXXX."""
+    raw = "".join(secrets.choice(_ALPHABET) for _ in range(CODE_LEN))
+    return f"{raw[:4]}-{raw[4:]}"
+
+
+def normalize_code(code: str) -> str:
+    """
+    Fold what a human typed onto what was generated.
+
+    Crockford's rules: case-insensitive, dashes and spaces are decoration, and the
+    excluded letters map onto the digits they resemble. Someone reading a code over
+    the phone should not be able to get it wrong in a way we could have absorbed.
+    """
+    out = []
+    for ch in code.upper():
+        if ch in "- \t":
+            continue
+        if ch in "IL":
+            out.append("1")
+        elif ch == "O":
+            out.append("0")
+        elif ch == "U":
+            out.append("V")
+        else:
+            out.append(ch)
+    return "".join(out)
+
+
+def hash_code(code: str) -> str:
+    """
+    Store codes hashed: a stolen roster DB must not yield usable invitations.
+
+    SHA-256 rather than a password KDF on purpose — the input is 40 bits of
+    uniformly random secret, not a human-chosen string, so there is nothing for a
+    slow hash to defend.
+    """
+    return hashlib.sha256(normalize_code(code).encode()).hexdigest()
+
+
+def _now() -> str:
+    return datetime.now(timezone.utc).isoformat(timespec="seconds")
+
+
+class Roster:
+    def __init__(self, db_path: Path):
+        self._db_path = db_path
+        self._db: aiosqlite.Connection | None = None
+
+    async def open(self) -> None:
+        self._db_path.parent.mkdir(parents=True, exist_ok=True)
+        self._db = await aiosqlite.connect(str(self._db_path))
+        self._db.row_factory = aiosqlite.Row
+        # WAL: the CLI writes invites (`operator pair`) while the daemon reads them.
+        await self._db.execute("PRAGMA journal_mode=WAL")
+        await self._db.executescript(_SCHEMA)
+        # invites.username was added after the first deployments: the name is what
+        # the operator types, and it cannot be recovered from the JWT because the
+        # hub does not put one there. CREATE TABLE IF NOT EXISTS will not add a
+        # column to a table that already exists.
+        async with self._db.execute("PRAGMA table_info(invites)") as cur:
+            columns = {r[1] for r in await cur.fetchall()}
+        if "username" not in columns:
+            await self._db.execute(
+                "ALTER TABLE invites ADD COLUMN username TEXT NOT NULL DEFAULT ''")
+        await self._db.commit()
+
+    async def close(self) -> None:
+        if self._db:
+            await self._db.close()
+            self._db = None
+
+    # ── Identities ───────────────────────────────────────────────────────────
+
+    async def pin_identity(
+        self,
+        user_id: str,
+        username: str,
+        pk_ed25519: str,
+        pk_x25519: str,
+        via: str,
+    ) -> None:
+        assert self._db
+        await self._db.execute(
+            "INSERT OR REPLACE INTO identities "
+            "(user_id, username, pk_ed25519, pk_x25519, pinned_at, pinned_via) "
+            "VALUES (?, ?, ?, ?, ?, ?)",
+            (user_id, username, pk_ed25519, pk_x25519, _now(), via),
+        )
+        await self._db.commit()
+
+    async def get_identity(self, user_id: str) -> dict | None:
+        assert self._db
+        async with self._db.execute(
+            "SELECT * FROM identities WHERE user_id = ?", (user_id,)
+        ) as cur:
+            row = await cur.fetchone()
+        return dict(row) if row else None
+
+    async def unpin(self, user_id: str) -> bool:
+        assert self._db
+        cur = await self._db.execute(
+            "DELETE FROM identities WHERE user_id = ?", (user_id,))
+        await self._db.commit()
+        return cur.rowcount > 0
+
+    async def list_identities(self) -> list[dict]:
+        assert self._db
+        async with self._db.execute(
+            "SELECT * FROM identities ORDER BY pinned_at"
+        ) as cur:
+            return [dict(r) for r in await cur.fetchall()]
+
+    # ── Authority ────────────────────────────────────────────────────────────
+
+    async def operator_pks(self) -> list[str]:
+        """
+        Base64 Ed25519 keys allowed to authorize admin operations on this node.
+
+        Read fresh on every check rather than cached: an unpin must take effect at
+        once, and this runs only on admin operations, which are rare.
+        """
+        assert self._db
+        async with self._db.execute(
+            "SELECT i.pk_ed25519 FROM identities i "
+            "JOIN members m ON m.user_id = i.user_id "
+            "WHERE m.role = 'operator' AND m.status = 'active'"
+        ) as cur:
+            return [r["pk_ed25519"] for r in await cur.fetchall()]
+
+    async def has_operator(self) -> bool:
+        return bool(await self.operator_pks())
+
+    async def is_authorized(self, group_id: str, user_id: str) -> bool:
+        """
+        May this person be handed the group key?
+
+        The node's own answer, not the hub's. Hub membership is what lets someone
+        reach the node; this is what decides whether the key is wrapped for them —
+        otherwise a hub that invents an account and mints a token for it would be
+        served the GEK on connect.
+
+        An operator is authorized for every group this node hosts: their authority
+        is node-wide and is recorded with an empty group_id.
+        """
+        assert self._db
+        async with self._db.execute(
+            "SELECT 1 FROM members WHERE user_id = ? AND status = 'active' "
+            "AND (group_id = ? OR (group_id = '' AND role = 'operator')) LIMIT 1",
+            (user_id, group_id),
+        ) as cur:
+            return await cur.fetchone() is not None
+
+    # ── Members ──────────────────────────────────────────────────────────────
+
+    async def set_member(
+        self,
+        group_id: str,
+        user_id: str,
+        role: str,
+        status: str,
+        approved_by: str,
+    ) -> None:
+        assert self._db
+        await self._db.execute(
+            "INSERT OR REPLACE INTO members "
+            "(group_id, user_id, role, status, approved_by, approved_at) "
+            "VALUES (?, ?, ?, ?, ?, ?)",
+            (group_id, user_id, role, status, approved_by, _now()),
+        )
+        await self._db.commit()
+
+    async def get_member(self, group_id: str, user_id: str) -> dict | None:
+        assert self._db
+        async with self._db.execute(
+            "SELECT * FROM members WHERE group_id = ? AND user_id = ?",
+            (group_id, user_id),
+        ) as cur:
+            row = await cur.fetchone()
+        return dict(row) if row else None
+
+    async def list_members(self, group_id: str | None = None) -> list[dict]:
+        assert self._db
+        sql = (
+            "SELECT m.*, i.username, i.pk_ed25519, i.pinned_at, i.pinned_via "
+            "FROM members m LEFT JOIN identities i ON i.user_id = m.user_id"
+        )
+        args: tuple = ()
+        if group_id is not None:
+            sql += " WHERE m.group_id = ?"
+            args = (group_id,)
+        async with self._db.execute(sql + " ORDER BY m.approved_at", args) as cur:
+            return [dict(r) for r in await cur.fetchall()]
+
+    async def set_status(self, group_id: str, user_id: str, status: str) -> bool:
+        assert self._db
+        cur = await self._db.execute(
+            "UPDATE members SET status = ? WHERE group_id = ? AND user_id = ?",
+            (status, group_id, user_id),
+        )
+        await self._db.commit()
+        return cur.rowcount > 0
+
+    # ── Invites ──────────────────────────────────────────────────────────────
+
+    async def create_invite(
+        self,
+        group_id: str,
+        user_id: str,
+        role: str,
+        created_by: str,
+        ttl: int = DEFAULT_INVITE_TTL,
+        username: str = "",
+    ) -> str:
+        """
+        Issue a one-time code. Returns it in the clear — this is the only moment it
+        exists outside the operator's hands; only its hash is kept.
+
+        Any earlier unused invite for the same person and group is dropped, so
+        re-inviting supersedes rather than accumulating valid codes.
+        """
+        assert self._db
+        await self._db.execute(
+            "DELETE FROM invites WHERE group_id = ? AND user_id = ? AND used_at IS NULL",
+            (group_id, user_id),
+        )
+        code = generate_code()
+        expires = datetime.now(timezone.utc) + timedelta(seconds=ttl)
+        await self._db.execute(
+            "INSERT INTO invites (code_hash, group_id, user_id, username, role, "
+            "created_by, created_at, expires_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)",
+            (hash_code(code), group_id, user_id, username, role, created_by, _now(),
+             expires.isoformat(timespec="seconds")),
+        )
+        await self._db.commit()
+        return code
+
+    async def consume_invite(self, code: str, user_id: str) -> dict | None:
+        """
+        Redeem a code for `user_id`, or return None.
+
+        Single use is enforced by the UPDATE's WHERE clause: two connections racing
+        the same code cannot both see `used_at IS NULL`, so exactly one wins.
+        """
+        assert self._db
+        code_hash = hash_code(code)
+        async with self._db.execute(
+            "SELECT * FROM invites WHERE code_hash = ?", (code_hash,)
+        ) as cur:
+            row = await cur.fetchone()
+        if not row:
+            return None
+
+        invite = dict(row)
+        if invite["used_at"] is not None:
+            return None
+        # A code is valid for exactly one account, so a leaked code cannot be
+        # redeemed by whoever finds it first.
+        if invite["user_id"] != user_id:
+            return None
+        if datetime.fromisoformat(invite["expires_at"]) < datetime.now(timezone.utc):
+            return None
+
+        cur = await self._db.execute(
+            "UPDATE invites SET used_at = ? WHERE code_hash = ? AND used_at IS NULL",
+            (_now(), code_hash),
+        )
+        await self._db.commit()
+        if cur.rowcount == 0:
+            return None
+        return invite
+
+    async def list_invites(self, include_used: bool = False) -> list[dict]:
+        assert self._db
+        sql = "SELECT * FROM invites"
+        if not include_used:
+            sql += " WHERE used_at IS NULL"
+        async with self._db.execute(sql + " ORDER BY created_at") as cur:
+            return [dict(r) for r in await cur.fetchall()]
+
+    async def purge_expired(self) -> int:
+        assert self._db
+        cur = await self._db.execute(
+            "DELETE FROM invites WHERE used_at IS NULL AND expires_at < ?",
+            (_now(),),
+        )
+        await self._db.commit()
+        return cur.rowcount
+
+
+async def open_roster(data_dir: Path) -> Roster:
+    roster = Roster(data_dir / "roster.db")
+    await roster.open()
+    return roster
+
+
+def write_code_file(data_dir: Path, code: str, expires_at: str,
+                    name: str = "pair-code") -> Path:
+    """
+    Leave the code in a file as well as on stdout.
+
+    An operator working over SSH may not be able to copy out of their terminal,
+    and a code that can only be read off a scrolled-away screen is a dead end.
+    Pairing and invitation codes go to different files so one does not overwrite
+    the other.
+    """
+    path = data_dir / name
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(f"{code}\nexpires {expires_at}\n")
+    os.chmod(path, 0o600)
+    return path
diff --git a/packages/meshbay-node/src/meshbay_node/transport/__init__.py b/packages/meshbay-node/src/meshbay_node/transport/__init__.py
index df9c209..e423e35 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/__init__.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/__init__.py
@@ -1,7 +1,17 @@
-"""MeshBay Node transport layer — TCP+TLS (v1), QUIC (v2), WebRTC (browsers)."""
-from .server import ChunkServer
-from .client import ChunkClient
-from .http_server import create_http_app
+"""
+MeshBay Node transport layer — WebRTC DataChannel (primary), QUIC (direct/LAN).
+
+Transport decision (2026-08-13, second security review):
+  - WebRTC/ICE is the primary path for browser AND native clients. ICE/STUN is the
+    only NAT traversal validated on this project (2 ISPs, IPv4 STUN + IPv6, 4G CGNAT).
+  - QUIC is kept at parity for LAN, port-forwarded and hub-less `group://` access.
+    `punch_nat()` is a direct-connection helper, not a traversal stack.
+  - TCP+TLS (`server.py`/`client.py`) and the node HTTP file API (`http_server.py`)
+    were REMOVED in Phase 11.5. The HTTP API served private group indexes and
+    plaintext files with no authentication on 0.0.0.0 (finding C1); the TCP server
+    accepted a bare JWT with no GEK proof (finding C6). Neither is coming back —
+    every client path must go through the unified MNP handshake.
+"""
 
 # QUIC transport (MNP v2) — requires aioquic>=1.0
 try:
@@ -14,7 +24,7 @@ except ImportError:
     Denylist = None  # type: ignore[assignment,misc]
     QUIC_AVAILABLE = False
 
-# WebRTC transport (browsers) — requires aiortc>=1.9
+# WebRTC transport (browsers + native clients) — requires aiortc>=1.9
 try:
     from .webrtc_server import WebRTCTransport, WebRTCPeerSession
     WEBRTC_AVAILABLE = True
@@ -24,7 +34,6 @@ except ImportError:
     WEBRTC_AVAILABLE = False
 
 __all__ = [
-    "ChunkServer", "ChunkClient", "create_http_app",
     "QuicChunkServer", "QuicChunkClient", "Denylist", "QUIC_AVAILABLE",
     "WebRTCTransport", "WebRTCPeerSession", "WEBRTC_AVAILABLE",
 ]
diff --git a/packages/meshbay-node/src/meshbay_node/transport/client.py b/packages/meshbay-node/src/meshbay_node/transport/client.py
deleted file mode 100644
index 63d50af..0000000
--- a/packages/meshbay-node/src/meshbay_node/transport/client.py
+++ /dev/null
@@ -1,148 +0,0 @@
-"""
-MeshBay — TCP+TLS chunk client (MNP v1).
-
-Used by the web client (or other nodes) to fetch files from a Mesh Node.
-Verifies Ed25519 chunk signatures using the node's public key from the hub.
-"""
-
-import asyncio
-import base64
-import logging
-import struct
-from pathlib import Path
-
-import blake3
-import msgpack
-from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
-
-from meshbay_common import MNP_VERSION
-from meshbay_common.crypto import (
-    chunk_key as derive_chunk_key,
-    decrypt_chunk,
-    verify_chunk_signature,
-)
-from meshbay_common.protocol import MNP
-from meshbay_node.transport.tls_cert import client_ssl_context
-
-log = logging.getLogger(__name__)
-
-MAX_MSG = 64 * 1024 * 1024
-
-
-async def _send(writer, obj):
-    data = msgpack.packb(obj, use_bin_type=True)
-    writer.write(struct.pack(">I", len(data)) + data)
-    await writer.drain()
-
-async def _recv(reader):
-    header = await reader.readexactly(4)
-    length = struct.unpack(">I", header)[0]
-    if length > MAX_MSG:
-        raise ValueError(f"Message too large: {length}")
-    return msgpack.unpackb(await reader.readexactly(length), raw=False)
-
-
-class ChunkClient:
-    """
-    Async client for fetching encrypted chunks from a ChunkServer.
-
-    Usage:
-        async with ChunkClient(host, port, jwt_token, gek, pk_node_b64) as client:
-            data = await client.fetch_chunk(file_id, chunk_index=0)
-    """
-
-    def __init__(
-        self,
-        host: str,
-        port: int,
-        jwt_token: str,
-        gek: bytes,
-        pk_node_b64: str,     # node's Ed25519 PK from hub — used for sig verification
-        group_id: str = "",
-    ):
-        self._host       = host
-        self._port       = port
-        self._jwt_token  = jwt_token
-        self._gek        = gek
-        self._group_id   = group_id
-        self._pk_node    = Ed25519PublicKey.from_public_bytes(
-            base64.b64decode(pk_node_b64))
-        self._reader: asyncio.StreamReader | None = None
-        self._writer: asyncio.StreamWriter | None = None
-
-    async def __aenter__(self):
-        await self.connect()
-        return self
-
-    async def __aexit__(self, *_):
-        await self.close()
-
-    async def connect(self) -> None:
-        ssl_ctx = client_ssl_context()
-        self._reader, self._writer = await asyncio.open_connection(
-            self._host, self._port, ssl=ssl_ctx)
-
-        handshake_msg = {
-            "type":  MNP.HANDSHAKE,
-            "v":     MNP_VERSION,
-            "token": self._jwt_token,
-        }
-        if self._group_id:
-            handshake_msg["group_id"] = self._group_id
-        await _send(self._writer, handshake_msg)
-        ack = await _recv(self._reader)
-        if ack.get("type") != MNP.HANDSHAKE_ACK:
-            raise ConnectionError(f"Handshake rejected: {ack}")
-        log.debug("Connected to node %s:%d", self._host, self._port)
-
-    async def close(self) -> None:
-        if self._writer:
-            self._writer.close()
-            await self._writer.wait_closed()
-
-    async def fetch_index(self) -> bytes:
-        """Request the Mesh Group Index. Returns raw wire bytes (encrypted)."""
-        await _send(self._writer, {"type": MNP.INDEX_SYNC, "v": MNP_VERSION})
-        msg = await _recv(self._reader)
-        return base64.b64decode(msg["index_b64"])
-
-    async def fetch_chunk(self, file_id: str, chunk_index: int) -> bytes:
-        """
-        Fetch, verify, and decrypt one chunk.
-        Returns plaintext bytes.
-        """
-        await _send(self._writer, {
-            "type":        MNP.FILE_REQUEST,
-            "v":           MNP_VERSION,
-            "file_id":     file_id,
-            "chunk_index": chunk_index,
-        })
-        msg = await _recv(self._reader)
-
-        if msg.get("type") == "error":
-            raise LookupError(msg.get("detail", "Unknown error"))
-
-        ct        = base64.b64decode(msg["ct_b64"])
-        nonce     = base64.b64decode(msg["nonce_b64"])
-        ct_hash   = base64.b64decode(msg["ct_hash_b64"])
-        pt_hash   = base64.b64decode(msg["pt_hash_b64"])
-        sig       = base64.b64decode(msg["sig_b64"])
-        file_hash = base64.b64decode(msg["file_hash_b64"])
-        ci        = msg["chunk_index"]
-
-        # 1. Verify Ed25519 signature
-        verify_chunk_signature(self._pk_node, ci, nonce, ct_hash, sig)
-
-        # 2. Verify ciphertext hash
-        if blake3.blake3(ct).digest() != ct_hash:
-            raise ValueError("Ciphertext hash mismatch")
-
-        # 3. Decrypt
-        ckey = derive_chunk_key(self._gek, file_hash, ci)
-        plaintext = decrypt_chunk(ckey, nonce, ct)
-
-        # 4. Verify plaintext hash
-        if blake3.blake3(plaintext).digest() != pt_hash:
-            raise ValueError("Plaintext hash mismatch after decryption")
-
-        return plaintext
diff --git a/packages/meshbay-node/src/meshbay_node/transport/http_server.py b/packages/meshbay-node/src/meshbay_node/transport/http_server.py
deleted file mode 100644
index 151c2e8..0000000
--- a/packages/meshbay-node/src/meshbay_node/transport/http_server.py
+++ /dev/null
@@ -1,336 +0,0 @@
-"""
-MeshBay Node — HTTP file API (port 19001, public content).
-
-Serves public group content over standard HTTP so browsers can
-access files without any special protocol.
-
-Endpoints:
-  GET  /                          node info (JSON)
-  GET  /index                     public Mesh Group Index (JSON)
-  GET  /file/{file_id}            full file download (streaming)
-  GET  /file/{file_id}/{chunk}    single encrypted chunk (JSON)
-  GET  /hls/{file_id}/playlist.m3u8  HLS playlist
-  GET  /hls/{file_id}/{segment}.ts   HLS segment (binary TS)
-
-Auth: Bearer JWT in Authorization header (or ?token= query param).
-For public groups: auth optional (anonymous browse allowed).
-For chunk download: auth required (JWT verified offline with hub PK).
-
-Note: this server handles PUBLIC content only (no GEK decryption).
-Private group content requires a client that can do ChaCha20 (Phase 5).
-"""
-
-import asyncio
-import base64
-import json
-import logging
-import os
-import struct
-import subprocess
-import tempfile
-from pathlib import Path
-
-import blake3
-import jwt
-from fastapi import FastAPI, Header, HTTPException, Query, Request
-from fastapi.responses import FileResponse, JSONResponse, StreamingResponse
-from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
-
-from meshbay_common import MNP_VERSION
-from meshbay_common.crypto import sign_chunk, pk_to_b64
-from meshbay_common.webcrypto import chunk_key_aes as derive_chunk_key, encrypt_chunk_aes as encrypt_chunk
-from meshbay_node import __version__
-from meshbay_node.indexer import GroupIndex
-from meshbay_node.indexer.group_index import GroupIndex
-
-log = logging.getLogger(__name__)
-
-CHUNK_SIZE = 1024 * 1024   # 1 MB
-HLS_SEGMENT_DURATION = 4   # seconds per HLS segment
-
-
-def create_http_app(
-    sk_node: Ed25519PrivateKey,
-    hub_pk_pem: bytes,
-    shared_root: Path,
-    index: GroupIndex,
-    group_id: str,
-    group_name: str,
-    gek: bytes | None = None,   # None for public groups
-) -> FastAPI:
-    """
-    Create the node's public HTTP API FastAPI app.
-    Bind to 0.0.0.0:19001 (or configured port) for external access.
-    """
-    app = FastAPI(
-        title="MeshBay Node HTTP API",
-        version=__version__,
-        docs_url=None,
-        redoc_url=None,
-    )
-
-    # ── Auth helper ───────────────────────────────────────────────────────────
-
-    def _verify_token_optional(
-        authorization: str | None,
-        token_param: str | None,
-    ) -> dict | None:
-        """Verify JWT if provided. Returns decoded payload or None."""
-        raw = None
-        if authorization and authorization.lower().startswith("bearer "):
-            raw = authorization[7:]
-        elif token_param:
-            raw = token_param
-        if not raw:
-            return None
-        try:
-            return jwt.decode(raw, hub_pk_pem, algorithms=["EdDSA"])
-        except Exception:
-            return None
-
-    def _require_token(
-        authorization: str | None,
-        token_param: str | None,
-    ) -> dict:
-        decoded = _verify_token_optional(authorization, token_param)
-        if decoded is None:
-            raise HTTPException(status_code=401, detail="Authentication required")
-        return decoded
-
-    # ── Node info ─────────────────────────────────────────────────────────────
-
-    @app.get("/")
-    async def node_info():
-        return {
-            "node_version": __version__,
-            "mnp_version":  MNP_VERSION,
-            "group_id":     group_id,
-            "group_name":   group_name,
-            "file_count":   index.count,
-            "pk_node":      pk_to_b64(sk_node.public_key()),
-        }
-
-    # ── Public index ──────────────────────────────────────────────────────────
-
-    @app.get("/index")
-    async def get_index(
-        authorization: str | None = Header(default=None),
-        token: str | None = Query(default=None),
-    ):
-        """Public Mesh Group Index as JSON. No auth required for public groups."""
-        entries = [
-            {
-                "id":       e.id,
-                "name":     e.name,
-                "path":     e.path,
-                "size":     e.size,
-                "type":     e.type,
-                "duration": e.duration,
-            }
-            for e in index.entries
-        ]
-        return {
-            "group_id":   group_id,
-            "group_name": group_name,
-            "version":    index.version,
-            "entries":    entries,
-        }
-
-    # ── Full file download (streaming) ────────────────────────────────────────
-
-    @app.get("/file/{file_id}")
-    async def download_file(
-        file_id: str,
-        authorization: str | None = Header(default=None),
-        token: str | None = Query(default=None),
-    ):
-        """Stream an entire file. Public groups: no auth needed."""
-        entry = index.get_entry(file_id)
-        if not entry:
-            raise HTTPException(status_code=404, detail="File not found in index")
-
-        file_path = shared_root / entry.path / entry.name
-        if not file_path.exists():
-            raise HTTPException(status_code=404, detail="File not on disk")
-
-        return FileResponse(
-            path=str(file_path),
-            filename=entry.name,
-            media_type=_media_type(entry.name),
-        )
-
-    # ── Chunk endpoint (encrypted, for MNP-aware clients) ────────────────────
-
-    @app.get("/file/{file_id}/{chunk_index}")
-    async def get_chunk(
-        file_id: str,
-        chunk_index: int,
-        authorization: str | None = Header(default=None),
-        token: str | None = Query(default=None),
-    ):
-        """
-        Serve one encrypted chunk (JSON). Auth required.
-        Clients that understand MNP can decrypt with the GEK they got from the hub.
-        """
-        _require_token(authorization, token)
-
-        entry = index.get_entry(file_id)
-        if not entry:
-            raise HTTPException(status_code=404, detail="File not found")
-
-        file_path = shared_root / entry.path / entry.name
-        if not file_path.exists():
-            raise HTTPException(status_code=404, detail="File not on disk")
-
-        # Read chunk
-        with open(file_path, "rb") as f:
-            f.seek(chunk_index * CHUNK_SIZE)
-            plaintext = f.read(CHUNK_SIZE)
-
-        if not plaintext:
-            raise HTTPException(status_code=416, detail="Chunk out of range")
-
-        file_hash = bytes.fromhex(entry.id)
-        pt_hash   = blake3.blake3(plaintext).digest()
-
-        if gek:
-            # Private group: encrypt chunk
-            ckey = derive_chunk_key(gek, file_hash, chunk_index)
-            nonce, ct = encrypt_chunk(ckey, plaintext)
-            ct_hash = blake3.blake3(ct).digest()
-            sig = sign_chunk(sk_node, chunk_index, nonce, ct_hash)
-            return {
-                "chunk_index":    chunk_index,
-                "plaintext_size": len(plaintext),
-                "encrypted":      True,
-                "nonce_b64":      base64.b64encode(nonce).decode(),
-                "ct_b64":         base64.b64encode(ct).decode(),
-                "ct_hash_b64":    base64.b64encode(ct_hash).decode(),
-                "pt_hash_b64":    base64.b64encode(pt_hash).decode(),
-                "sig_b64":        base64.b64encode(sig).decode(),
-                "pk_node_b64":    pk_to_b64(sk_node.public_key()),
-                "file_hash_b64":  base64.b64encode(file_hash).decode(),
-            }
-        else:
-            # Public group: serve plaintext chunk (TLS provides transport encryption)
-            pt_hash_b = blake3.blake3(plaintext).digest()
-            sig_payload = chunk_index.to_bytes(4, "big") + bytes(12) + pt_hash_b
-            sig = sk_node.sign(sig_payload)
-            return {
-                "chunk_index":    chunk_index,
-                "plaintext_size": len(plaintext),
-                "encrypted":      False,
-                "data_b64":       base64.b64encode(plaintext).decode(),
-                "pt_hash_b64":    base64.b64encode(pt_hash).decode(),
-                "sig_b64":        base64.b64encode(sig).decode(),
-                "pk_node_b64":    pk_to_b64(sk_node.public_key()),
-            }
-
-    # ── HLS streaming ─────────────────────────────────────────────────────────
-
-    @app.get("/hls/{file_id}/playlist.m3u8")
-    async def hls_playlist(
-        file_id: str,
-        authorization: str | None = Header(default=None),
-        token: str | None = Query(default=None),
-    ):
-        """Generate HLS playlist for a video file."""
-        entry = index.get_entry(file_id)
-        if not entry or entry.type != "video":
-            raise HTTPException(status_code=404, detail="Video file not found")
-
-        file_path = shared_root / entry.path / entry.name
-        if not file_path.exists():
-            raise HTTPException(status_code=404, detail="File not on disk")
-
-        duration = entry.duration or _probe_duration(file_path)
-        if not duration:
-            raise HTTPException(status_code=422, detail="Cannot determine video duration")
-
-        n_segments = max(1, int(duration / HLS_SEGMENT_DURATION) + 1)
-        token_param = f"?token={token}" if token else ""
-
-        lines = [
-            "#EXTM3U",
-            "#EXT-X-VERSION:3",
-            f"#EXT-X-TARGETDURATION:{HLS_SEGMENT_DURATION}",
-            "#EXT-X-MEDIA-SEQUENCE:0",
-        ]
-        for i in range(n_segments):
-            seg_dur = min(HLS_SEGMENT_DURATION, duration - i * HLS_SEGMENT_DURATION)
-            if seg_dur <= 0:
-                break
-            lines.append(f"#EXTINF:{seg_dur:.3f},")
-            lines.append(f"/hls/{file_id}/{i}.ts{token_param}")
-        lines.append("#EXT-X-ENDLIST")
-
-        return StreamingResponse(
-            iter(["\n".join(lines)]),
-            media_type="application/vnd.apple.mpegurl",
-        )
-
-    @app.get("/hls/{file_id}/{segment_index}.ts")
-    async def hls_segment(
-        file_id: str,
-        segment_index: int,
-        authorization: str | None = Header(default=None),
-        token: str | None = Query(default=None),
-    ):
-        """Serve one HLS segment as MPEG-TS via ffmpeg transcoding."""
-        entry = index.get_entry(file_id)
-        if not entry or entry.type != "video":
-            raise HTTPException(status_code=404, detail="Video not found")
-
-        file_path = shared_root / entry.path / entry.name
-        if not file_path.exists():
-            raise HTTPException(status_code=404, detail="File not on disk")
-
-        start_time = segment_index * HLS_SEGMENT_DURATION
-
-        async def generate():
-            proc = await asyncio.create_subprocess_exec(
-                "ffmpeg", "-hide_banner", "-loglevel", "error",
-                "-ss", str(start_time),
-                "-i", str(file_path),
-                "-t", str(HLS_SEGMENT_DURATION),
-                "-c:v", "copy", "-c:a", "copy",
-                "-f", "mpegts", "pipe:1",
-                stdout=asyncio.subprocess.PIPE,
-                stderr=asyncio.subprocess.DEVNULL,
-            )
-            assert proc.stdout
-            while chunk := await proc.stdout.read(65536):
-                yield chunk
-            await proc.wait()
-
-        return StreamingResponse(generate(), media_type="video/mp2t")
-
-    return app
-
-
-# ── Helpers ───────────────────────────────────────────────────────────────────
-
-def _media_type(filename: str) -> str:
-    ext = Path(filename).suffix.lower()
-    return {
-        ".mp4": "video/mp4", ".mkv": "video/x-matroska",
-        ".webm": "video/webm", ".avi": "video/x-msvideo",
-        ".mp3": "audio/mpeg", ".flac": "audio/flac",
-        ".ogg": "audio/ogg",  ".opus": "audio/opus",
-        ".jpg": "image/jpeg", ".png": "image/png",
-        ".pdf": "application/pdf",
-    }.get(ext, "application/octet-stream")
-
-
-def _probe_duration(path: Path) -> float | None:
-    """Use ffprobe to get video duration in seconds."""
-    try:
-        result = subprocess.run(
-            ["ffprobe", "-v", "quiet", "-print_format", "json",
-             "-show_format", str(path)],
-            capture_output=True, text=True, timeout=10,
-        )
-        data = json.loads(result.stdout)
-        return float(data["format"]["duration"])
-    except Exception:
-        return None
diff --git a/packages/meshbay-node/src/meshbay_node/transport/quic_client.py b/packages/meshbay-node/src/meshbay_node/transport/quic_client.py
index 288465f..9102085 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/quic_client.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/quic_client.py
@@ -11,6 +11,7 @@ TLS cert is self-signed; we use CERT_NONE equivalent in QUIC config.
 import asyncio
 import base64
 import logging
+import os
 import struct
 from pathlib import Path
 
@@ -26,6 +27,32 @@ from meshbay_common import MNP_VERSION
 from meshbay_common.crypto import verify_chunk_signature
 from meshbay_common.webcrypto import chunk_key_aes as derive_chunk_key, decrypt_chunk_aes as decrypt_chunk
 from meshbay_common.protocol import MNP
+from meshbay_common.handshake import (
+    NONCE_LEN,
+    ROLE_CLIENT,
+    ROLE_NODE,
+    handshake_transcript,
+    make_proof,
+    quic_binding,
+    verify_proof,
+)
+
+
+def _peer_cert_der(proto) -> bytes | None:
+    """
+    The server certificate as seen by the client — the channel-binding anchor.
+
+    Spike 11.5.6: aioquic 1.3.0 exposes no RFC 5705 exporter, and the peer
+    certificate only through a private attribute. Returns None when it is absent;
+    callers decide, because absence is not always an error — see below.
+    """
+    from cryptography.hazmat.primitives import serialization
+
+    tls = getattr(getattr(proto, "_quic", None), "tls", None)
+    cert = getattr(tls, "_peer_certificate", None) if tls is not None else None
+    if cert is None:
+        return None
+    return cert.public_bytes(serialization.Encoding.DER)
 
 log = logging.getLogger(__name__)
 
@@ -99,6 +126,7 @@ class QuicChunkClient:
         pk_node_b64: str,
         local_port: int = 0,   # 0 = OS picks; set for hole punching (Port-Restricted)
         group_id: str = "",
+        peer_cert_der: bytes | None = None,
         session_ticket: object | None = None,
     ):
         self._host       = host
@@ -112,6 +140,9 @@ class QuicChunkClient:
         self._proto: _MNPClientProtocol | None = None
         self._cm         = None
         self._ctrl_stream = 0
+        # 11.5.6 binding anchor. Travels with the session ticket: on a resumed
+        # TLS session the server does not re-send its certificate.
+        self._peer_cert_der: bytes | None = peer_cert_der
         self._session_ticket = session_ticket
 
     async def __aenter__(self):
@@ -146,19 +177,70 @@ class QuicChunkClient:
         )
         self._proto = await self._cm.__aenter__()
 
-        handshake_msg = {
-            "type":  MNP.HANDSHAKE,
+        nonce_c = os.urandom(NONCE_LEN)
+        self._proto._send(self._ctrl_stream, {
+            "type":     MNP.HANDSHAKE,
+            "v":        MNP_VERSION,
+            "token":    self._jwt_token,
+            "group_id": self._group_id,
+            "nonce":    base64.b64encode(nonce_c).decode(),
+        })
+
+        reply = await self._proto._recv(self._ctrl_stream)
+        if reply.get("type") != MNP.HANDSHAKE_CHALLENGE:
+            raise ConnectionError(f"QUIC handshake rejected: {reply}")
+
+        nonce_s = base64.b64decode(reply["nonce"])
+
+        # On a RESUMED TLS session the server does not re-send its certificate, so
+        # there is nothing live to bind to. The session ticket is cryptographically
+        # derived from the original handshake, so binding to the certificate seen
+        # then is sound — but only if we actually saw one. We never fall back to an
+        # unbound proof: that would silently drop MitM detection (L4).
+        cert_der = _peer_cert_der(self._proto)
+        if cert_der is not None:
+            self._peer_cert_der = cert_der
+        elif getattr(self, "_peer_cert_der", None) is None:
+            raise ConnectionError(
+                "QUIC peer certificate unavailable and none cached from a prior "
+                "session — refusing to handshake without channel binding")
+        binding = quic_binding(self._peer_cert_der)
+
+        self._proto._send(self._ctrl_stream, {
+            "type":  MNP.HANDSHAKE_RESPONSE,
             "v":     MNP_VERSION,
-            "token": self._jwt_token,
-        }
-        if self._group_id:
-            handshake_msg["group_id"] = self._group_id
-        self._proto._send(self._ctrl_stream, handshake_msg)
+            "proof": base64.b64encode(make_proof(
+                self._gek, ROLE_CLIENT, self._group_id,
+                nonce_c, nonce_s, binding)).decode(),
+        })
+
         ack = await self._proto._recv(self._ctrl_stream)
         if ack.get("type") != MNP.HANDSHAKE_ACK:
             raise ConnectionError(f"QUIC handshake rejected: {ack}")
+
+        # Authenticate the node before trusting anything it serves (C3).
+        if not verify_proof(
+            self._gek, base64.b64decode(ack.get("proof", "")), ROLE_NODE,
+            self._group_id, nonce_c, nonce_s, binding,
+        ):
+            raise ConnectionError("Node failed to prove GEK possession")
+
+        transcript = handshake_transcript(
+            ROLE_NODE, self._group_id, nonce_c, nonce_s, binding)
+        try:
+            Ed25519PublicKey.from_public_bytes(
+                base64.b64decode(ack["node_pk"])
+            ).verify(base64.b64decode(ack["sig"]), transcript)
+        except Exception as exc:
+            raise ConnectionError(f"Node signature invalid: {exc}") from exc
+
         log.debug("QUIC connected to %s:%d", self._host, self._port)
 
+    @property
+    def peer_cert_der(self) -> bytes | None:
+        """Binding anchor to carry alongside a saved session ticket (11.5.6)."""
+        return self._peer_cert_der
+
     async def close(self) -> None:
         if self._cm:
             await self._cm.__aexit__(None, None, None)
diff --git a/packages/meshbay-node/src/meshbay_node/transport/quic_server.py b/packages/meshbay-node/src/meshbay_node/transport/quic_server.py
index f439e62..ed3925d 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/quic_server.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/quic_server.py
@@ -20,6 +20,7 @@ The transport is the only change — all crypto, auth, and message types stay th
 import asyncio
 import base64
 import logging
+import os
 import struct
 import subprocess
 from pathlib import Path
@@ -34,6 +35,17 @@ from aioquic.quic.events import QuicEvent, StreamDataReceived, StreamReset
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
 
 from meshbay_common import MNP_VERSION
+from meshbay_common.handshake import (
+    NONCE_LEN,
+    ROLE_CLIENT,
+    ROLE_NODE,
+    HandshakeError,
+    authorize_token,
+    handshake_transcript,
+    make_proof,
+    quic_binding,
+    verify_proof,
+)
 from meshbay_common.crypto import (
     sign_chunk,
     pk_to_b64,
@@ -41,7 +53,6 @@ from meshbay_common.crypto import (
 from meshbay_common.webcrypto import chunk_key_aes as derive_chunk_key, encrypt_chunk_aes as encrypt_chunk
 from meshbay_common.protocol import MNP
 from meshbay_node.indexer import GroupIndex
-from meshbay_node.transport.tls_cert import server_ssl_context
 
 log = logging.getLogger(__name__)
 
@@ -51,22 +62,69 @@ ALPN       = ["meshbay-mnp"]
 
 
 class Denylist:
-    """Shared denylist for revoked users and invalidated JWTs."""
+    """
+    Denylist for revoked users, groups and invalidated JWTs.
 
-    def __init__(self):
+    Finding H4: revocations used to live only in memory, so a node restart silently
+    un-revoked everyone, and group revocations were dropped entirely — the hub
+    signed and broadcast them but the node's handler only understood "user" and
+    "jti". Now persisted to disk and group targets are honoured.
+    """
+
+    def __init__(self, path: Path | None = None):
         self.user_ids: set[str] = set()
+        self.group_ids: set[str] = set()
         self.jtis: set[str] = set()
+        self._path = path
+        self._load()
 
-    def is_denied(self, user_id: str, jti: str) -> bool:
-        return user_id in self.user_ids or jti in self.jtis
+    def is_denied(self, user_id: str, jti: str, group_id: str = "") -> bool:
+        return (user_id in self.user_ids
+                or jti in self.jtis
+                or (bool(group_id) and group_id in self.group_ids))
 
     def deny_user(self, user_id: str) -> None:
         self.user_ids.add(user_id)
         log.info("Denied user: %s", user_id[:8])
+        self._save()
+
+    def deny_group(self, group_id: str) -> None:
+        self.group_ids.add(group_id)
+        log.info("Denied group: %s", group_id[:8])
+        self._save()
 
     def deny_jti(self, jti: str) -> None:
         self.jtis.add(jti)
         log.info("Denied jti: %s", jti[:8])
+        self._save()
+
+    def _load(self) -> None:
+        if not self._path or not self._path.exists():
+            return
+        try:
+            import json
+            data = json.loads(self._path.read_text())
+            self.user_ids = set(data.get("users", []))
+            self.group_ids = set(data.get("groups", []))
+            self.jtis = set(data.get("jtis", []))
+            log.info("Denylist loaded: %d users, %d groups, %d jtis",
+                     len(self.user_ids), len(self.group_ids), len(self.jtis))
+        except Exception as e:
+            log.warning("Could not load denylist from %s: %s", self._path, e)
+
+    def _save(self) -> None:
+        if not self._path:
+            return
+        try:
+            import json
+            self._path.parent.mkdir(parents=True, exist_ok=True)
+            self._path.write_text(json.dumps({
+                "users": sorted(self.user_ids),
+                "groups": sorted(self.group_ids),
+                "jtis": sorted(self.jtis),
+            }))
+        except Exception as e:
+            log.warning("Could not persist denylist to %s: %s", self._path, e)
 
 
 # ── Wire helpers ──────────────────────────────────────────────────────────────
@@ -111,6 +169,9 @@ class _MNPServerProtocol(QuicConnectionProtocol):
         self._user_id: str | None = None
         self._group_id: str | None = None
         self._buffers: dict[int, _StreamBuffer] = {}
+        self._nonce_client: bytes = b""
+        self._gek_challenge: bytes | None = None
+        self._pending = None
 
     def quic_event_received(self, event: QuicEvent) -> None:
         if isinstance(event, StreamDataReceived):
@@ -130,6 +191,8 @@ class _MNPServerProtocol(QuicConnectionProtocol):
         try:
             if mtype == MNP.HANDSHAKE:
                 self._do_handshake_sync(stream_id, msg)
+            elif mtype == MNP.HANDSHAKE_RESPONSE:
+                self._do_handshake_response_sync(stream_id, msg)
             elif self._user_id is None:
                 self._send(stream_id, {"type": "error", "detail": "Handshake required"})
             elif mtype == MNP.INDEX_SYNC:
@@ -147,44 +210,117 @@ class _MNPServerProtocol(QuicConnectionProtocol):
             self._send(stream_id, {"type": "error", "detail": str(e)})
 
     def _do_handshake_sync(self, stream_id: int, msg: dict) -> None:
-        token = msg.get("token", "")
-        group_id = msg.get("group_id", "")
+        """
+        Authorization half of the unified handshake (11.5.4).
+
+        This used to be a second, weaker copy of the WebRTC logic: group_id was
+        optional (so omitting it skipped the membership check entirely — M1),
+        node-scoped daemon tokens were accepted as client tokens (M9), and the
+        checks could drift from the WebRTC path independently. All of that now
+        comes from meshbay_common.handshake, shared with WebRTC.
+
+        NOT YET DONE — finding C6 remains open on this transport: there is still no
+        GEK proof here, so a forged or stolen token reaches the node and can inject
+        chat without holding the group key. The challenge/response and mutual node
+        proof (quic_binding() is written and unit-tested for exactly this) are the
+        remaining work in 11.5.4/5/6.
+        """
         try:
-            decoded = jwt.decode(token, self._ctx["hub_pk_pem"], algorithms=["EdDSA"])
-        except Exception as e:
-            self._send(stream_id, {"type": "error", "detail": f"Invalid JWT: {e}"})
+            peer = authorize_token(
+                msg.get("token", ""),
+                self._ctx["hub_pk_pem"],
+                group_id=msg.get("group_id", ""),
+                hosted_groups=self._ctx.get("groups"),
+                denylist=self._ctx.get("denylist"),
+            )
+        except HandshakeError as refusal:
+            self._send(stream_id, {"type": "error", "detail": str(refusal)})
+            self._quic.close()
+            return
+
+        try:
+            self._nonce_client = base64.b64decode(msg.get("nonce", ""))
+        except Exception:
+            self._nonce_client = b""
+        if len(self._nonce_client) < NONCE_LEN:
+            self._send(stream_id, {"type": "error", "detail": "Client nonce required"})
             self._quic.close()
             return
 
-        denylist = self._ctx.get("denylist")
-        if denylist and denylist.is_denied(decoded.get("sub", ""), decoded.get("jti", "")):
-            self._send(stream_id, {"type": "error", "detail": "Token revoked"})
+        gctx = self._ctx["groups"][peer.group_id] if "groups" in self._ctx else self._ctx
+        if not gctx.get("gek"):
+            self._send(stream_id, {
+                "type": "error",
+                "detail": "Group encryption not initialized — contact node operator",
+            })
+            self._quic.close()
+            return
+
+        # Decoded but NOT authenticated: authentication is the GEK proof below.
+        self._pending = peer
+        self._gek_challenge = os.urandom(NONCE_LEN)
+        self._send(stream_id, {
+            "type":  MNP.HANDSHAKE_CHALLENGE,
+            "v":     MNP_VERSION,
+            "nonce": base64.b64encode(self._gek_challenge).decode(),
+        })
+
+    def _do_handshake_response_sync(self, stream_id: int, msg: dict) -> None:
+        """Verify the client's GEK proof, then prove the node in return (C6, C3)."""
+        if not self._gek_challenge or self._pending is None:
+            self._send(stream_id, {"type": "error", "detail": "No pending handshake challenge"})
+            return
+
+        peer = self._pending
+        gctx = self._ctx["groups"][peer.group_id] if "groups" in self._ctx else self._ctx
+        gek = gctx.get("gek")
+        if not gek:
+            self._send(stream_id, {"type": "error", "detail": "Group encryption not initialized"})
             self._quic.close()
             return
 
-        if group_id and group_id not in decoded.get("groups", []):
-            self._send(stream_id, {"type": "error", "detail": "Not a member of this group"})
+        binding = self._ctx.get("server_cert_der")
+        if not binding:
+            # Refuse rather than fall back to an unbound proof (L4).
+            self._send(stream_id, {"type": "error", "detail": "Channel binding unavailable"})
             self._quic.close()
             return
+        binding = quic_binding(binding)
 
-        if group_id and "groups" in self._ctx and group_id not in self._ctx["groups"]:
-            self._send(stream_id, {"type": "error", "detail": "Group not hosted on this node"})
+        try:
+            proof = base64.b64decode(msg.get("proof", ""))
+        except Exception:
+            self._send(stream_id, {"type": "error", "detail": "Invalid proof encoding"})
+            return
+
+        if not verify_proof(gek, proof, ROLE_CLIENT, peer.group_id,
+                            self._nonce_client, self._gek_challenge, binding):
+            self._send(stream_id, {"type": "error", "detail": "GEK proof failed"})
             self._quic.close()
             return
 
-        self._user_id = decoded["sub"]
-        self._group_id = group_id
+        self._user_id = peer.user_id
+        self._group_id = peer.group_id
 
         peers = self._ctx.get("_peers")
         if peers is not None:
             peers[self._user_id] = self
 
-        log.info("QUIC handshake OK — user=%s group=%s", self._user_id[:8], group_id[:8] if group_id else "none")
+        transcript = handshake_transcript(
+            ROLE_NODE, peer.group_id, self._nonce_client, self._gek_challenge, binding)
+        node_proof = make_proof(
+            gek, ROLE_NODE, peer.group_id, self._nonce_client, self._gek_challenge, binding)
+
+        log.info("QUIC handshake OK — user=%s group=%s",
+                 self._user_id[:8], self._group_id[:8])
         self._send(stream_id, {
             "type":    MNP.HANDSHAKE_ACK,
             "v":       MNP_VERSION,
             "node_pk": pk_to_b64(self._ctx["sk_node"].public_key()),
+            "proof":   base64.b64encode(node_proof).decode(),
+            "sig":     base64.b64encode(self._ctx["sk_node"].sign(transcript)).decode(),
         })
+        self._gek_challenge = None
 
     def _group_ctx(self) -> dict:
         """Resolve the active group context (multi-group or legacy single-group)."""
@@ -408,6 +544,13 @@ class QuicChunkServer:
             generate_self_signed_cert(self._cert_path, self._key_path)
         config = QuicConfiguration(is_client=False, alpn_protocols=ALPN)
         config.load_cert_chain(str(self._cert_path), str(self._key_path))
+
+        # Channel-binding anchor for the handshake proof (11.5.6). Read from our own
+        # cert file — no aioquic internals needed on this side.
+        from cryptography import x509
+        from cryptography.hazmat.primitives import serialization as _ser
+        self._ctx["server_cert_der"] = x509.load_pem_x509_certificate(
+            self._cert_path.read_bytes()).public_bytes(_ser.Encoding.DER)
         return config
 
     def _store_ticket(self, ticket: Any) -> None:
diff --git a/packages/meshbay-node/src/meshbay_node/transport/server.py b/packages/meshbay-node/src/meshbay_node/transport/server.py
deleted file mode 100644
index b77f1f2..0000000
--- a/packages/meshbay-node/src/meshbay_node/transport/server.py
+++ /dev/null
@@ -1,286 +0,0 @@
-"""
-MeshBay Node — TCP+TLS chunk server (MNP v1).
-
-Serves encrypted file chunks to authenticated clients over TLS.
-Each connection:
-  1. Client sends MNP handshake with JWT bearer token
-  2. Server verifies JWT offline (hub PK cached)
-  3. Client sends chunk requests
-  4. Server reads from disk, encrypts on-the-fly, signs, sends
-
-Wire protocol: length-prefixed msgpack (4-byte big-endian length header).
-All messages carry {"type": ..., "v": MNP_VERSION}.
-"""
-
-import asyncio
-import base64
-import logging
-import struct
-import time
-from pathlib import Path
-
-import blake3
-import jwt
-import msgpack
-from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
-
-from meshbay_common import MNP_VERSION
-from meshbay_common.crypto import (
-    chunk_key as derive_chunk_key,
-    encrypt_chunk,
-    sign_chunk,
-    pk_to_b64,
-)
-from meshbay_common.protocol import MNP
-from meshbay_node.indexer import GroupIndex
-from meshbay_node.transport.tls_cert import server_ssl_context
-
-log = logging.getLogger(__name__)
-
-CHUNK_SIZE = 1024 * 1024   # 1 MB
-MAX_MSG    = 64 * 1024 * 1024   # 64 MB max message size (safety)
-
-
-# ── Wire helpers ──────────────────────────────────────────────────────────────
-
-async def _send(writer: asyncio.StreamWriter, obj: dict) -> None:
-    data = msgpack.packb(obj, use_bin_type=True)
-    writer.write(struct.pack(">I", len(data)) + data)
-    await writer.drain()
-
-async def _recv(reader: asyncio.StreamReader) -> dict:
-    header = await reader.readexactly(4)
-    length = struct.unpack(">I", header)[0]
-    if length > MAX_MSG:
-        raise ValueError(f"Message too large: {length}")
-    data = await reader.readexactly(length)
-    return msgpack.unpackb(data, raw=False)
-
-
-# ── Chunk serving ─────────────────────────────────────────────────────────────
-
-def _serve_chunk(
-    sk_node: Ed25519PrivateKey,
-    gek: bytes,
-    file_path: Path,
-    file_hash: bytes,
-    chunk_index: int,
-) -> dict:
-    """Read, encrypt, sign one chunk. Blocking — run in executor."""
-    with open(file_path, "rb") as f:
-        f.seek(chunk_index * CHUNK_SIZE)
-        plaintext = f.read(CHUNK_SIZE)
-
-    pt_hash = blake3.blake3(plaintext).digest()
-    ckey    = derive_chunk_key(gek, file_hash, chunk_index)
-    nonce, ct = encrypt_chunk(ckey, plaintext)
-    ct_hash = blake3.blake3(ct).digest()
-    sig     = sign_chunk(sk_node, chunk_index, nonce, ct_hash)
-
-    return {
-        "type":           MNP.FILE_CHUNK,
-        "v":              MNP_VERSION,
-        "chunk_index":    chunk_index,
-        "plaintext_size": len(plaintext),
-        "nonce_b64":      base64.b64encode(nonce).decode(),
-        "ct_b64":         base64.b64encode(ct).decode(),
-        "ct_hash_b64":    base64.b64encode(ct_hash).decode(),
-        "pt_hash_b64":    base64.b64encode(pt_hash).decode(),
-        "sig_b64":        base64.b64encode(sig).decode(),
-        "pk_node_b64":    pk_to_b64(sk_node.public_key()),
-        "file_hash_b64":  base64.b64encode(file_hash).decode(),
-    }
-
-
-# ── Connection handler ────────────────────────────────────────────────────────
-
-class _ConnectionHandler:
-    def __init__(
-        self,
-        reader: asyncio.StreamReader,
-        writer: asyncio.StreamWriter,
-        sk_node: Ed25519PrivateKey,
-        hub_pk_pem: bytes,
-        gek: bytes,
-        shared_root: Path,
-        index: GroupIndex,
-        groups: dict[str, dict] | None = None,
-    ):
-        self._reader      = reader
-        self._writer      = writer
-        self._sk_node     = sk_node
-        self._hub_pk_pem  = hub_pk_pem
-        self._gek         = gek
-        self._shared_root = shared_root
-        self._index       = index
-        self._groups      = groups
-        self._peer        = writer.get_extra_info("peername")
-        self._user_id: str | None = None
-        self._group_id: str | None = None
-
-    async def handle(self) -> None:
-        try:
-            await self._handshake()
-            await self._serve_loop()
-        except asyncio.IncompleteReadError:
-            log.debug("[%s] Client disconnected", self._peer)
-        except Exception as e:
-            log.warning("[%s] Error: %s", self._peer, e)
-            await _send(self._writer, {"type": "error", "detail": str(e)})
-        finally:
-            self._writer.close()
-
-    async def _handshake(self) -> None:
-        msg = await _recv(self._reader)
-        if msg.get("type") != MNP.HANDSHAKE:
-            raise ValueError(f"Expected handshake, got {msg.get('type')!r}")
-
-        token = msg.get("token", "")
-        group_id = msg.get("group_id", "")
-        try:
-            decoded = jwt.decode(token, self._hub_pk_pem, algorithms=["EdDSA"])
-        except Exception as e:
-            raise PermissionError(f"Invalid JWT: {e}") from e
-
-        if group_id and group_id not in decoded.get("groups", []):
-            raise PermissionError("Not a member of this group")
-
-        if group_id and self._groups and group_id not in self._groups:
-            raise PermissionError("Group not hosted on this node")
-
-        self._user_id = decoded["sub"]
-        self._group_id = group_id
-
-        if group_id and self._groups and group_id in self._groups:
-            ctx = self._groups[group_id]
-            self._gek = ctx["gek"]
-            self._shared_root = ctx["shared_root"]
-            self._index = ctx["index"]
-
-        log.info("[%s] Handshake OK — user=%s group=%s", self._peer, self._user_id[:8], group_id[:8] if group_id else "none")
-
-        await _send(self._writer, {
-            "type":    MNP.HANDSHAKE_ACK,
-            "v":       MNP_VERSION,
-            "node_pk": pk_to_b64(self._sk_node.public_key()),
-        })
-
-    async def _serve_loop(self) -> None:
-        loop = asyncio.get_event_loop()
-        while True:
-            msg = await _recv(self._reader)
-            mtype = msg.get("type")
-
-            if mtype == MNP.INDEX_SYNC:
-                wire = self._index.serialize()
-                await _send(self._writer, {
-                    "type":      MNP.INDEX_SYNC,
-                    "v":         MNP_VERSION,
-                    "index_b64": base64.b64encode(wire).decode(),
-                })
-
-            elif mtype == MNP.FILE_REQUEST:
-                file_id     = msg["file_id"]
-                chunk_index = msg["chunk_index"]
-
-                entry = self._index.get_entry(file_id)
-                if entry is None:
-                    await _send(self._writer, {
-                        "type":   "error",
-                        "detail": f"File not found: {file_id[:8]}",
-                    })
-                    continue
-
-                file_path = self._shared_root / entry.path / entry.name
-                if not file_path.exists():
-                    await _send(self._writer, {
-                        "type": "error", "detail": "File not on disk"})
-                    continue
-
-                file_hash = bytes.fromhex(entry.id)
-                chunk = await loop.run_in_executor(
-                    None, _serve_chunk,
-                    self._sk_node, self._gek, file_path, file_hash, chunk_index)
-                await _send(self._writer, chunk)
-
-            else:
-                log.warning("[%s] Unknown message type: %s", self._peer, mtype)
-
-
-# ── Server ────────────────────────────────────────────────────────────────────
-
-class ChunkServer:
-    """
-    Async TCP+TLS server that serves encrypted file chunks.
-
-    Usage:
-        server = ChunkServer(
-            host="0.0.0.0", port=19000,
-            sk_node=sk, hub_pk_pem=pk_pem,
-            gek=gek, shared_root=Path("/data"),
-            index=group_index,
-        )
-        await server.start()
-        # ... when shutting down:
-        await server.stop()
-    """
-
-    def __init__(
-        self,
-        sk_node: Ed25519PrivateKey,
-        hub_pk_pem: bytes,
-        gek: bytes,
-        shared_root: Path,
-        index: GroupIndex,
-        host: str = "0.0.0.0",
-        port: int = 19000,
-        cert_path: Path | None = None,
-        key_path: Path | None = None,
-        groups: dict[str, dict] | None = None,
-    ):
-        self._sk_node     = sk_node
-        self._hub_pk_pem  = hub_pk_pem
-        self._gek         = gek
-        self._shared_root = shared_root
-        self._index       = index
-        self._host        = host
-        self._port        = port
-        self._cert_path   = cert_path
-        self._key_path    = key_path
-        self._groups      = groups
-        self._server: asyncio.Server | None = None
-
-    @property
-    def port(self) -> int:
-        return self._port
-
-    async def start(self) -> None:
-        ssl_ctx = server_ssl_context(
-            cert_path=self._cert_path or Path.home() / ".config/meshbay/node_tls.crt",
-            key_path=self._key_path  or Path.home() / ".config/meshbay/node_tls.key",
-        )
-        self._server = await asyncio.start_server(
-            self._handle_connection,
-            host=self._host,
-            port=self._port,
-            ssl=ssl_ctx,
-        )
-        log.info("ChunkServer listening on %s:%d (TLS)", self._host, self._port)
-
-    async def stop(self) -> None:
-        if self._server:
-            self._server.close()
-            await self._server.wait_closed()
-            self._server = None
-            log.info("ChunkServer stopped")
-
-    async def _handle_connection(
-        self, reader: asyncio.StreamReader, writer: asyncio.StreamWriter
-    ) -> None:
-        handler = _ConnectionHandler(
-            reader, writer,
-            self._sk_node, self._hub_pk_pem,
-            self._gek, self._shared_root, self._index,
-            groups=self._groups,
-        )
-        await handler.handle()
diff --git a/packages/meshbay-node/src/meshbay_node/transport/tls_cert.py b/packages/meshbay-node/src/meshbay_node/transport/tls_cert.py
index 1354ac9..374fd08 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/tls_cert.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/tls_cert.py
@@ -1,17 +1,18 @@
 """
-Self-signed TLS certificate generation for the node.
+Self-signed TLS certificate generation for the node's QUIC listener.
 
 The cert is used for transport confidentiality only.
 Node identity is verified via Ed25519 PK (from hub), not TLS cert chain.
-Clients connect with ssl.CERT_NONE + verify Ed25519 at the MNP handshake layer.
 
-Certificate is generated once and cached at ~/.config/meshbay/node_tls.pem/.key.
+Phase 11.5 note: the certificate hash is also the intended channel-binding anchor for
+the QUIC handshake proof (11.5.6), since QUIC has no DTLS fingerprint to bind to.
+
+Certificate is generated once and cached at ~/.config/meshbay/node_tls.crt/.key.
 """
 
 import logging
 import os
 from pathlib import Path
-import ssl
 import datetime
 import ipaddress
 
@@ -69,27 +70,6 @@ def generate_self_signed_cert(
     return cert_path, key_path
 
 
-def server_ssl_context(
-    cert_path: Path = DEFAULT_CERT,
-    key_path: Path = DEFAULT_KEY,
-) -> ssl.SSLContext:
-    """SSL context for the node's TCP server."""
-    if not cert_path.exists() or not key_path.exists():
-        generate_self_signed_cert(cert_path, key_path)
-
-    ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
-    ctx.load_cert_chain(certfile=cert_path, keyfile=key_path)
-    ctx.minimum_version = ssl.TLSVersion.TLSv1_3
-    return ctx
-
-
-def client_ssl_context() -> ssl.SSLContext:
-    """
-    SSL context for clients connecting to a node.
-    CERT_NONE because we verify node identity via Ed25519 PK at the MNP layer.
-    """
-    ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
-    ctx.check_hostname = False
-    ctx.verify_mode    = ssl.CERT_NONE
-    ctx.minimum_version = ssl.TLSVersion.TLSv1_3
-    return ctx
+# `server_ssl_context()` / `client_ssl_context()` were removed in Phase 11.5 along with
+# the TCP+TLS transport they served. QUIC builds its own QuicConfiguration and calls
+# generate_self_signed_cert() directly.
diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
index 13e90c8..fe4e3c2 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
@@ -28,7 +28,9 @@ import hashlib
 import hmac
 import logging
 import os
+import re
 import struct
+import time
 from pathlib import Path
 from typing import Any
 
@@ -41,16 +43,68 @@ from cryptography.hazmat.primitives.asymmetric.ed25519 import (
 )
 
 from meshbay_common import MNP_VERSION
-from meshbay_common.crypto import pk_to_b64
+from meshbay_common.handshake import (
+    NONCE_LEN,
+    ROLE_CLIENT,
+    ROLE_NODE,
+    HandshakeError,
+    authorize_token,
+    handshake_transcript,
+    make_proof,
+    verify_proof,
+    webrtc_binding,
+)
+from meshbay_common.adminop import (
+    ADMIN_CHALLENGE_TTL,
+    OP_FILE_DELETE,
+    OP_INVITE_CREATE,
+    admin_transcript,
+)
+from meshbay_common.crypto import pk_to_b64, wrap_gek_aes
+from meshbay_common.join import (
+    JOIN_TTL,
+    ROLE_MEMBER,
+    ROLE_OPERATOR,
+    join_transcript,
+)
 from meshbay_common.webcrypto import chunk_key_aes, encrypt_chunk_aes
 from meshbay_common.protocol import MNP
 from meshbay_node.indexer import GroupIndex
+from meshbay_node.roster import DEFAULT_INVITE_TTL
 
 log = logging.getLogger(__name__)
 
 CHUNK_SIZE = 1024 * 1024
 MAX_MSG = 64 * 1024 * 1024
 
+# Upload limits (finding C5a). Uploads used to land directly in the shared root under
+# a name the client chose, overwriting whatever was already there — which both violated
+# node sovereignty and defeated the delete authorization (overwrite a file, become its
+# recorded uploader, then delete it legitimately).
+MAX_UPLOAD_BYTES = 4 * 1024 * 1024 * 1024   # 4 GB per file
+
+# Budget for an unauthenticated peer: enough for a handshake and a bundle fetch,
+# nowhere near enough to be a memory-exhaustion primitive (H6).
+PRE_HANDSHAKE_MAX_MSG = 64 * 1024
+# ffmpeg is spawned per stream request; without a cap any member can fork-bomb
+# the node by requesting many streams at once (H6).
+MAX_CONCURRENT_TRANSCODES = 2
+# Bundle fetches are served in the pre-proof window (C4). Bounded and audited
+# until the native client removes remote keypair bundles entirely.
+MAX_PRE_PROOF_FETCHES = 4
+# Pairing codes carry 40 bits and are single-use, but a connection must not be
+# allowed to sit there guessing. Failures are audited, so a grind is visible.
+MAX_JOIN_ATTEMPTS = 5
+# Per-connection limits alone would not bind an attacker who can open connections
+# at will — and the adversary who can mint tokens for any account is the hub. So
+# failed pairings are also counted node-wide over a window.
+MAX_JOIN_FAILURES_WINDOW = 20
+JOIN_FAILURE_WINDOW = 600  # seconds
+UPLOAD_DIR_NAME = ".uploads"
+# Conservative allowlist: also what keeps markup out of filenames, which the node admin
+# UI used to render unescaped (finding H2).
+SAFE_UPLOAD_NAME = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._ -]{0,127}$")
+
 
 def _extract_dtls_fingerprint(sdp: str) -> bytes:
     """Extract the DTLS SHA-256 fingerprint from SDP as raw 32 bytes."""
@@ -119,10 +173,18 @@ def _pack(obj: dict) -> bytes:
 
 
 class _DataChannelBuffer:
-    """Accumulate DataChannel messages and extract length-prefixed msgpack."""
+    """
+    Accumulate DataChannel messages and extract length-prefixed msgpack.
+
+    Finding H6: the limit was a flat 64 MB applied even before the handshake, so an
+    unauthenticated peer could announce a 64 MB frame and dribble bytes into it,
+    holding that much memory per connection. Until a peer has proved GEK
+    possession it gets a small budget; the large one is for file uploads.
+    """
 
-    def __init__(self):
+    def __init__(self, max_message: int = MAX_MSG):
         self._buf = bytearray()
+        self.max_message = max_message
 
     def feed(self, data: bytes):
         self._buf.extend(data)
@@ -130,7 +192,7 @@ class _DataChannelBuffer:
     def messages(self):
         while len(self._buf) >= 4:
             length = struct.unpack(">I", self._buf[:4])[0]
-            if length > MAX_MSG:
+            if length > self.max_message:
                 raise ValueError(f"Message too large: {length}")
             if len(self._buf) < 4 + length:
                 break
@@ -162,15 +224,25 @@ class WebRTCPeerSession:
         self._pc = pc
         self._ctx = node_ctx
         self._channel: RTCDataChannel | None = None
-        self._buffer = _DataChannelBuffer()
+        self._buffer = _DataChannelBuffer(max_message=PRE_HANDSHAKE_MAX_MSG)
+        self._pre_proof_fetches = 0
         self._user_id: str | None = None
         self._group_id: str | None = None
         self._peer_id: str = peer_id
         self._remote_ip: str = ""
         self._username: str = ""
-        self._pk_user: str = ""
+        # Set from the roster: the key this node pinned for this account. Never
+        # from the JWT — the hub picks what goes in there.
+        self._pinned_pk: str = ""
         self._gek_challenge: bytes | None = None
-        self._admin_challenges: dict[str, bytes] = {}
+        # Same value as the GEK challenge, but kept for the life of the connection:
+        # a join_request is signed over it, and it must stay verifiable after the
+        # handshake clears the challenge (an operator pairs while already connected).
+        self._nonce_node: bytes = b""
+        self._join_attempts = 0
+        self._nonce_client: bytes = b""
+        self._admin_ops: dict[str, dict] = {}   # op_id → pending admin operation
+        self._uploads: dict[str, dict] = {}   # filename → {next_index, bytes}
 
     def _setup_channel(self, channel: RTCDataChannel) -> None:
         self._channel = channel
@@ -191,10 +263,30 @@ class WebRTCPeerSession:
                 self._do_handshake(msg)
             elif mtype == MNP.HANDSHAKE_RESPONSE:
                 self._do_handshake_response(msg)
-            elif mtype == MNP.GEK_BUNDLE_FETCH and self._gek_challenge is not None:
-                asyncio.ensure_future(self._do_gek_bundle_fetch())
-            elif mtype == MNP.KEYPAIR_BUNDLE_FETCH and self._gek_challenge is not None:
-                asyncio.ensure_future(self._do_keypair_bundle_fetch())
+            elif mtype in (MNP.GEK_BUNDLE_FETCH, MNP.KEYPAIR_BUNDLE_FETCH) \
+                    and self._gek_challenge is not None:
+                # Served before the GEK proof by necessity: the client needs its
+                # wrapped bundle in order to compute the proof. That window is a
+                # disclosure surface (C4) — a hub that forges a JWT reaches it — so
+                # it is bounded and audited here, and closed properly when clients
+                # stop storing keypair bundles on other people's nodes.
+                self._pre_proof_fetches += 1
+                if self._pre_proof_fetches > MAX_PRE_PROOF_FETCHES:
+                    self._audit_auth_failed(
+                        getattr(self, "_pending_group", ""), "pre-proof fetch flood")
+                    self._send({"type": "error", "detail": "Too many requests"})
+                    return
+                self._audit_pre_proof_fetch(mtype)
+                if mtype == MNP.GEK_BUNDLE_FETCH:
+                    asyncio.ensure_future(self._do_gek_bundle_fetch())
+                else:
+                    asyncio.ensure_future(self._do_keypair_bundle_fetch())
+            elif mtype == MNP.JOIN_REQUEST and self._nonce_node:
+                # Valid both before the GEK proof (a new member has no GEK to prove
+                # with) and after it (an operator pairing a browser is already
+                # connected). Authority comes from the pairing code and the
+                # signature, never from the session state.
+                asyncio.ensure_future(self._do_join_request(msg))
             elif self._user_id is None:
                 self._send({"type": "error", "detail": "Handshake required"})
             elif mtype == MNP.INDEX_SYNC:
@@ -213,17 +305,21 @@ class WebRTCPeerSession:
                 self._do_file_delete(msg)
             elif mtype == MNP.ADMIN_RESPONSE:
                 self._do_admin_response(msg)
-            elif mtype == MNP.GEK_BUNDLE_STORE:
-                asyncio.ensure_future(self._do_gek_bundle_store(msg))
+            elif mtype == MNP.INVITE_CREATE:
+                self._do_invite_create(msg)
             elif mtype == MNP.KEYPAIR_BUNDLE_STORE:
                 asyncio.ensure_future(self._do_keypair_bundle_store(msg))
+            elif mtype == MNP.KEYPAIR_BUNDLE_DELETE:
+                asyncio.ensure_future(self._do_keypair_bundle_delete())
             elif mtype == MNP.STREAM_REQUEST:
                 asyncio.ensure_future(self._stream_video(msg))
             else:
                 log.warning("Unknown MNP message type on DataChannel: %s", mtype)
         except Exception as e:
-            log.error("Error handling %s on DataChannel: %s", mtype, e)
-            self._send({"type": "error", "detail": str(e)})
+            # Log the detail locally; send the peer a generic message. Exception
+            # text here carries filesystem paths and internal state (finding L3).
+            log.error("Error handling %s on DataChannel: %s", mtype, e, exc_info=True)
+            self._send({"type": "error", "detail": "Request failed"})
 
     def _audit(self, event: str, detail: str = "") -> None:
         audit = self._ctx.get("audit_store")
@@ -239,57 +335,73 @@ class WebRTCPeerSession:
                 detail=detail,
             ))
 
+    def _channel_binding(self) -> bytes:
+        """Both DTLS fingerprints, so a proof is valid on this connection only."""
+        offer_fp = b""
+        answer_fp = b""
+        if self._pc.remoteDescription:
+            offer_fp = _extract_dtls_fingerprint(self._pc.remoteDescription.sdp)
+        if self._pc.localDescription:
+            answer_fp = _extract_dtls_fingerprint(self._pc.localDescription.sdp)
+        if not offer_fp or not answer_fp:
+            return b""
+        return webrtc_binding(offer_fp, answer_fp)
+
     def _do_handshake(self, msg: dict) -> None:
-        token = msg.get("token", "")
         group_id = msg.get("group_id", "")
         try:
-            decoded = jwt.decode(token, self._ctx["hub_pk_pem"], algorithms=["EdDSA"])
-        except Exception as e:
-            self._send({"type": "error", "detail": f"Invalid JWT: {e}"})
-            self._audit_auth_failed(group_id, str(e))
-            return
-
-        denylist = self._ctx.get("denylist")
-        if denylist and denylist.is_denied(decoded.get("sub", ""), decoded.get("jti", "")):
-            self._send({"type": "error", "detail": "Token revoked"})
-            return
-
-        if group_id and group_id not in decoded.get("groups", []):
-            self._send({"type": "error", "detail": "Not a member of this group"})
+            peer = authorize_token(
+                msg.get("token", ""),
+                self._ctx["hub_pk_pem"],
+                group_id=group_id,
+                hosted_groups=self._ctx.get("groups"),
+                denylist=self._ctx.get("denylist"),
+            )
+        except HandshakeError as refusal:
+            # HandshakeError messages are authored to be peer-safe, unlike arbitrary
+            # exception text (L3) — the client needs to know *why* it was refused.
+            self._send({"type": "error", "detail": str(refusal),
+                        "code": getattr(refusal, "code", "")})
+            self._audit_auth_failed(group_id, str(refusal))
             return
 
-        if group_id and "groups" in self._ctx and group_id not in self._ctx["groups"]:
-            self._send({"type": "error", "detail": "Group not hosted on this node"})
+        try:
+            self._nonce_client = base64.b64decode(msg.get("nonce", ""))
+        except Exception:
+            self._nonce_client = b""
+        if len(self._nonce_client) < NONCE_LEN:
+            # The client nonce is what makes the NODE's proof fresh (C3). Without
+            # it a recorded ack could be replayed by an impersonating peer.
+            self._send({"type": "error", "detail": "Client nonce required"})
             return
 
-        # Store decoded JWT data but DO NOT set self._user_id yet —
-        # the user is not authenticated until they prove GEK possession.
-        self._pending_sub = decoded["sub"]
-        self._pending_group = group_id
-        self._pending_username = decoded.get("username", "")
-        self._pending_pk_user = decoded.get("pk_user", "")
+        # Decoded, but NOT authenticated: that happens on the GEK proof.
+        self._pending_sub = peer.user_id
+        self._pending_group = peer.group_id
+        self._pending_username = peer.username
 
-        ctx = self._ctx
-        if "groups" in ctx and group_id:
-            gctx = ctx["groups"].get(group_id, ctx)
-        else:
-            gctx = ctx
-        gek = gctx.get("gek")
-
-        nonce = os.urandom(32)
-        self._gek_challenge = nonce
-        challenge = {
-            "type": MNP.HANDSHAKE_CHALLENGE,
-            "v": MNP_VERSION,
-            "nonce": base64.b64encode(nonce).decode(),
-        }
-        if not gek:
+        gctx = self._ctx["groups"][peer.group_id] if "groups" in self._ctx else self._ctx
+        if not gctx.get("gek"):
             self._send({
                 "type": "error",
                 "detail": "Group encryption not initialized — contact node operator",
             })
             return
-        self._send(challenge)
+
+        self._gek_challenge = os.urandom(NONCE_LEN)
+        self._nonce_node = self._gek_challenge
+        self._send({
+            "type": MNP.HANDSHAKE_CHALLENGE,
+            "v": MNP_VERSION,
+            "nonce": base64.b64encode(self._gek_challenge).decode(),
+            # Announced here because a first-time joiner needs it *before* the
+            # ack: join_request signs a transcript naming this node, and someone
+            # who has never held the GEK cannot complete the handshake to learn
+            # it. Unverified at this point — the ack proves it, the client checks
+            # the two match, and a wrong value only makes our own verification
+            # fail. It is never a substitute for the ack's proof and signature.
+            "node_pk": self._node_pk_b64(),
+        })
 
     def _do_handshake_response(self, msg: dict) -> None:
         if not self._gek_challenge or not hasattr(self, "_pending_sub"):
@@ -297,61 +409,71 @@ class WebRTCPeerSession:
             return
 
         group_id = self._pending_group
-        ctx = self._ctx
-        if "groups" in ctx and group_id:
-            gctx = ctx["groups"].get(group_id, ctx)
-        else:
-            gctx = ctx
+        gctx = self._ctx["groups"][group_id] if "groups" in self._ctx else self._ctx
         gek = gctx.get("gek")
-
         if not gek:
             self._send({"type": "error", "detail": "Group encryption not initialized"})
             self._gek_challenge = None
             return
 
-        proof = msg.get("proof", "")
         try:
-            proof_bytes = base64.b64decode(proof)
+            proof_bytes = base64.b64decode(msg.get("proof", ""))
         except Exception:
             self._send({"type": "error", "detail": "Invalid proof encoding"})
             return
 
-        offer_fp = b""
-        answer_fp = b""
-        if self._pc.remoteDescription:
-            offer_fp = _extract_dtls_fingerprint(self._pc.remoteDescription.sdp)
-        if self._pc.localDescription:
-            answer_fp = _extract_dtls_fingerprint(self._pc.localDescription.sdp)
+        binding = self._channel_binding()
+        if not binding:
+            # Refuse rather than fall back to an unbound proof (L4).
+            self._send({"type": "error", "detail": "Channel binding unavailable"})
+            self._gek_challenge = None
+            self._audit_auth_failed(group_id, "no channel binding")
+            return
 
-        data = self._gek_challenge + offer_fp + answer_fp
-        expected = hmac.new(gek, data, hashlib.sha256).digest()
-        if not hmac.compare_digest(proof_bytes, expected):
+        if not verify_proof(gek, proof_bytes, ROLE_CLIENT, group_id,
+                            self._nonce_client, self._gek_challenge, binding):
             self._send({"type": "error", "detail": "GEK proof failed"})
             self._gek_challenge = None
             self._audit_auth_failed(group_id, "GEK HMAC mismatch")
             return
 
+        self._complete_handshake(gek, binding)
         self._gek_challenge = None
-        self._complete_handshake()
 
-    def _complete_handshake(self) -> None:
+    def _complete_handshake(self, gek: bytes, binding: bytes) -> None:
+        # Authenticated peers may send large frames (file uploads); unauthenticated
+        # ones may not (H6).
+        self._buffer.max_message = MAX_MSG
         self._user_id = self._pending_sub
         self._group_id = self._pending_group
         self._username = self._pending_username
-        self._pk_user = self._pending_pk_user
+        asyncio.ensure_future(self._load_pinned_pk())
 
-        peers = self._ctx.get("_peers")
-        if peers is not None:
-            peers[self._user_id] = self
+        self._peer_registry()[self._user_id] = self
 
         node_user_id = self._ctx.get("node_user_id")
         log.info("WebRTC handshake OK — user=%s group=%s",
                  self._user_id[:8],
                  self._group_id[:8] if self._group_id else "none")
+        # The node proves itself too (C3): possession of the GEK over the client's
+        # nonce, plus a signature over the same transcript with its long-term key.
+        # Previously the client received an unverifiable node_pk and trusted
+        # is_node_admin from whoever answered — so a peer that had hijacked
+        # signaling could serve a forged index, chat history and permissions.
+        node_transcript = handshake_transcript(
+            ROLE_NODE, self._group_id or "", self._nonce_client,
+            self._gek_challenge or b"", binding)
+        node_proof = make_proof(
+            gek, ROLE_NODE, self._group_id or "", self._nonce_client,
+            self._gek_challenge or b"", binding)
+
         ack = {
             "type": MNP.HANDSHAKE_ACK,
             "v": MNP_VERSION,
             "node_pk": pk_to_b64(self._ctx["sk_node"].public_key()),
+            "proof": base64.b64encode(node_proof).decode(),
+            "sig": base64.b64encode(
+                self._ctx["sk_node"].sign(node_transcript)).decode(),
             "is_node_admin": bool(node_user_id and self._user_id == node_user_id),
         }
         if node_user_id:
@@ -388,65 +510,41 @@ class WebRTCPeerSession:
         else:
             self._send({"type": MNP.GEK_BUNDLE_RESP, "v": MNP_VERSION, "found": False})
 
-    async def _do_gek_bundle_store(self, msg: dict) -> None:
-        """Store a wrapped GEK bundle for a target user (admin operation)."""
-        bundle_store = self._ctx.get("bundle_store")
-        if not bundle_store:
-            self._send({"type": "error", "detail": "Bundle store not available"})
-            return
-
-        target_user_id = msg.get("user_id", "")
-        group_id = msg.get("group_id") or self._group_id
-        pk_eph = msg.get("pk_eph_b64", "")
-        nonce = msg.get("nonce_b64", "")
-        wrapped = msg.get("wrapped_b64", "")
+    def _do_invite_create(self, msg: dict) -> None:
+        """
+        Issue a one-time pairing code for someone the operator wants to admit.
 
-        if not target_user_id or not pk_eph or not nonce or not wrapped or not group_id:
-            self._send({"type": "error", "detail": "Missing bundle fields"})
+        Replaces the old invite path, where the inviter fetched the invitee's
+        public key from the hub and wrapped the group key for whatever came back
+        (H3). The node now needs nothing but a name: it will wrap the key itself,
+        later, for a key the invitee proves they hold.
+        """
+        roster = self._ctx.get("roster")
+        if roster is None:
+            self._send({"type": "error", "detail": "Roster not available"})
             return
 
-        await bundle_store.store(group_id, target_user_id, pk_eph, nonce, wrapped)
-        log.info("GEK bundle stored: group=%s user=%s", group_id[:8], target_user_id[:8])
-        self._audit("gek_bundle_store", f"target={target_user_id[:8]}")
-
-        self._send({
-            "type": "ack", "v": MNP_VERSION,
-            "detail": "gek_bundle_stored",
-            "user_id": target_user_id,
-        })
-
-        # Auto-activate GEK if the bundle is for the node operator
-        node_user_id = self._ctx.get("node_user_id")
-        if node_user_id and target_user_id == node_user_id and group_id:
-            await self._try_activate_gek(group_id, target_user_id)
-
-    async def _try_activate_gek(self, group_id: str, user_id: str) -> None:
-        """Unwrap and activate GEK for the node when the operator's bundle arrives."""
-        from meshbay_common.crypto import unwrap_gek_aes
-
-        bundle_store = self._ctx.get("bundle_store")
-        sk_x_raw = self._ctx.get("sk_x25519_raw")
-        pk_x_raw = self._ctx.get("pk_x25519_raw")
-        if not bundle_store or not sk_x_raw or not pk_x_raw:
+        invitee_id = msg.get("user_id", "")
+        group_id = msg.get("group_id") or self._group_id
+        if not invitee_id or not group_id:
+            self._send({"type": "error", "detail": "Missing user_id or group_id"})
             return
-
-        bundle = await bundle_store.fetch(group_id, user_id)
-        if not bundle:
+        if group_id != self._group_id:
+            self._send({"type": "error", "detail": "Wrong group for this session"})
             return
 
-        try:
-            gek = unwrap_gek_aes(bundle, sk_x_raw, pk_x_raw)
-        except Exception as e:
-            log.warning("Failed to unwrap GEK for auto-activation: %s", e)
+        if not self._has_admin_authority():
+            self._send({
+                "type": "error",
+                "detail": "No operator paired — run `meshbay-node operator pair`",
+            })
             return
 
-        groups = self._ctx.get("groups")
-        if groups and group_id in groups:
-            groups[group_id]["gek"] = gek
-            log.info("GEK auto-activated for group %s", group_id[:8])
-        elif "gek" in self._ctx:
-            self._ctx["gek"] = gek
-            log.info("GEK auto-activated (single-group mode)")
+        self._issue_admin_challenge(OP_INVITE_CREATE, invitee_id, {
+            "group_id": group_id,
+            "user_id": invitee_id,
+            "username": str(msg.get("username", ""))[:64],
+        })
 
     async def _do_keypair_bundle_fetch(self) -> None:
         """Serve the caller's encrypted keypair bundle during the handshake window."""
@@ -491,6 +589,287 @@ class WebRTCPeerSession:
             "detail": "keypair_bundle_stored",
         })
 
+    # ── Pairing and join (H3, M3) ────────────────────────────────────────────
+
+    def _join_refuse(self, reason: str, audit_detail: str = "") -> None:
+        self._join_attempts += 1
+        # Node-wide window, shared across connections: reconnecting must not reset
+        # the budget.
+        now = time.time()
+        failures = [t for t in self._ctx.get("join_failures", [])
+                    if now - t < JOIN_FAILURE_WINDOW]
+        failures.append(now)
+        self._ctx["join_failures"] = failures
+        self._audit_join("join_refused", audit_detail or reason)
+        self._send({
+            "type": MNP.JOIN_RESULT,
+            "v": MNP_VERSION,
+            "ok": False,
+            "reason": reason,
+        })
+
+    def _audit_join(self, event: str, detail: str) -> None:
+        audit = self._ctx.get("audit_store")
+        if not audit:
+            return
+        self._remote_ip = self._remote_ip or _get_remote_ip(self._pc)
+        asyncio.ensure_future(audit.log_event(
+            user_id=self._user_id or getattr(self, "_pending_sub", "unknown"),
+            event=event,
+            ip=self._remote_ip,
+            username=self._username or getattr(self, "_pending_username", ""),
+            group_id=self._group_id or getattr(self, "_pending_group", "") or "",
+            detail=detail,
+        ))
+
+    async def _do_join_request(self, msg: dict) -> None:
+        """
+        Pin an identity, or recognise one already pinned.
+
+        The client signs its own Ed25519 and X25519 keys together with the node's
+        nonce, so the identity key vouches for the encryption key — that is what
+        will make it safe for the node to wrap the GEK for a key that arrived over
+        the wire instead of one fetched from the hub's directory (H3).
+
+        A first pairing needs a one-time code, which the hub never sees. Afterwards
+        the pin is the credential and a changed key is refused outright, the same
+        rule the client applies to `pk_node` (11.5.8).
+        """
+        roster = self._ctx.get("roster")
+        if roster is None:
+            self._send({"type": "error", "detail": "Roster not available"})
+            return
+
+        if self._join_attempts >= MAX_JOIN_ATTEMPTS:
+            self._send({"type": "error", "detail": "Too many attempts"})
+            return
+
+        now = time.time()
+        recent = [t for t in self._ctx.get("join_failures", [])
+                  if now - t < JOIN_FAILURE_WINDOW]
+        if len(recent) >= MAX_JOIN_FAILURES_WINDOW:
+            self._audit_join("join_throttled", f"{len(recent)} failures in window")
+            self._send({"type": "error", "detail": "Pairing temporarily locked"})
+            return
+
+        user_id = self._user_id or getattr(self, "_pending_sub", "")
+        username = self._username or getattr(self, "_pending_username", "")
+        if not user_id:
+            self._send({"type": "error", "detail": "Handshake required"})
+            return
+
+        pk_ed_b64 = msg.get("pk_ed25519", "")
+        pk_x_b64 = msg.get("pk_x25519", "")
+        code = msg.get("code", "")
+        ts = msg.get("ts", 0)
+
+        try:
+            pk_ed_raw = base64.b64decode(pk_ed_b64)
+            pk_x_raw = base64.b64decode(pk_x_b64)
+            if len(pk_ed_raw) != 32 or len(pk_x_raw) != 32:
+                raise ValueError
+            pk_ed = Ed25519PublicKey.from_public_bytes(pk_ed_raw)
+        except Exception:
+            self._join_refuse("invalid_keys")
+            return
+
+        if not isinstance(ts, int) or abs(time.time() - ts) > JOIN_TTL:
+            self._join_refuse("stale_request")
+            return
+
+        # An empty group_id means operator pairing, which is node-wide. Anything
+        # else must be the group this connection authenticated to — a signature
+        # obtained for one group must not name another.
+        group_id = msg.get("group_id", "") or ""
+        session_group = self._group_id or getattr(self, "_pending_group", "") or ""
+        if group_id and group_id != session_group:
+            self._join_refuse("group_mismatch")
+            return
+
+        transcript = join_transcript(
+            node_pk_b64=self._node_pk_b64(),
+            group_id=group_id,
+            user_id=user_id,
+            pk_ed25519_b64=pk_ed_b64,
+            pk_x25519_b64=pk_x_b64,
+            nonce_node=self._nonce_node,
+            ts=ts,
+        )
+        try:
+            sig = base64.b64decode(msg.get("sig", ""))
+        except Exception:
+            self._join_refuse("invalid_signature_encoding")
+            return
+        if not self._verify_sig(pk_ed, transcript, sig):
+            self._join_refuse("signature_invalid")
+            return
+
+        known = await roster.get_identity(user_id)
+        if known:
+            if known["pk_ed25519"] != pk_ed_b64 or known["pk_x25519"] != pk_x_b64:
+                # The blocking warning, raised where it matters: whoever this is
+                # holds a different key than the person the operator paired.
+                self._join_refuse(
+                    "key_changed",
+                    f"pinned={known['pk_ed25519'][:16]} presented={pk_ed_b64[:16]}")
+                return
+            # An operator's row is node-wide (empty group), so a lookup for the
+            # group they happen to be opening finds nothing. Fall back to it, or
+            # the client is told it has no role on a node it administers.
+            member = (await roster.get_member(group_id, user_id)
+                      or await roster.get_member("", user_id))
+            await self._join_ok(
+                user_id, pk_x_raw, session_group,
+                role=member["role"] if member else "",
+                recognised=True,
+            )
+            return
+
+        if not code:
+            if self._group_join_policy(session_group) == "open":
+                # An open-join group admits anyone the hub calls a member, so a
+                # code would protect nothing — the hub can walk in through the
+                # front door. Pin what turns up and say so in the audit log.
+                await self._pin_and_admit(
+                    roster, user_id, username, pk_ed_b64, pk_x_b64,
+                    group_id=session_group, role=ROLE_MEMBER,
+                    approved_by="open-join", via="tofu")
+                await self._join_ok(user_id, pk_x_raw, session_group,
+                                    role=ROLE_MEMBER, recognised=False)
+                return
+            self._join_refuse("code_required")
+            return
+
+        invite = await roster.consume_invite(code, user_id)
+        if not invite:
+            self._join_refuse("code_invalid")
+            return
+
+        await self._pin_and_admit(
+            # The name comes from the invitation, not from the token: the hub does
+            # not put a username claim in a JWT, so pinning from the session alone
+            # left the roster nameless and `member revoke <name>` unable to match.
+            roster, user_id, invite["username"] or username, pk_ed_b64, pk_x_b64,
+            group_id=invite["group_id"], role=invite["role"],
+            approved_by=invite["created_by"], via="code")
+        # The roster row comes from the invitation; the key comes from the
+        # connection. An operator pairing is node-wide (empty group), but they
+        # redeemed the code while opening a group and expect to read it — and
+        # is_authorized() already grants an operator every group on this node.
+        await self._join_ok(user_id, pk_x_raw, session_group or invite["group_id"],
+                            role=invite["role"], recognised=False)
+
+    def _group_join_policy(self, group_id: str) -> str:
+        """
+        Admission policy for a group, read from the node's own configuration.
+
+        Never from the hub: a hub that could declare a group open would be handed
+        the key to it (§3.4 of docs/invite-pairing-v1.md).
+        """
+        gctx = (self._ctx.get("groups") or {}).get(group_id) or {}
+        return gctx.get("join_policy", "invite")
+
+    async def _pin_and_admit(
+        self, roster, user_id: str, username: str, pk_ed_b64: str, pk_x_b64: str,
+        *, group_id: str, role: str, approved_by: str, via: str,
+    ) -> None:
+        await roster.pin_identity(
+            user_id=user_id, username=username,
+            pk_ed25519=pk_ed_b64, pk_x25519=pk_x_b64, via=via,
+        )
+        await roster.set_member(
+            group_id=group_id, user_id=user_id, role=role,
+            status="active", approved_by=approved_by,
+        )
+        if role == ROLE_OPERATOR:
+            self._ctx["has_admin_authority"] = True
+
+        log.info("Identity pinned (%s): user=%s role=%s", via, user_id[:8], role)
+        self._audit_join("join_pinned", f"role={role} via={via}")
+
+    async def _join_ok(
+        self, user_id: str, pk_x_raw: bytes, group_id: str,
+        *, role: str, recognised: bool,
+    ) -> None:
+        """
+        Answer a join, wrapping the group key for the key the caller just proved.
+
+        This is the H3 fix. The inviter used to fetch the invitee's public key from
+        the hub and wrap the GEK for whatever came back, so a hub that answered
+        with its own key was handed the group key by an honest member following the
+        protocol exactly. The node now wraps for a key that arrived from its owner
+        over an authenticated channel, bound to a pinned identity.
+        """
+        reply = {
+            "type": MNP.JOIN_RESULT,
+            "v": MNP_VERSION,
+            "ok": True,
+            "recognised": recognised,
+            "role": role,
+        }
+
+        roster = self._ctx["roster"]
+        if group_id and not await roster.is_authorized(group_id, user_id):
+            # Pinned on this node, but not admitted to this group. Hub membership
+            # alone must not produce a key.
+            reply["gek"] = False
+            reply["reason"] = "not_authorized_for_group"
+            self._send(reply)
+            self._audit_join("join_no_gek", f"group={group_id[:8]} not authorized")
+            return
+
+        gctx = (self._ctx.get("groups") or {}).get(group_id) or {}
+        gek = gctx.get("gek")
+        if not gek:
+            reply["gek"] = False
+            reply["reason"] = "no_gek"
+            self._send(reply)
+            return
+
+        bundle = wrap_gek_aes(gek, pk_x_raw)
+        reply["gek"] = True
+        reply["pk_eph_b64"] = bundle["pk_eph_b64"]
+        reply["nonce_b64"] = bundle["nonce_b64"]
+        reply["wrapped_b64"] = bundle["wrapped_b64"]
+        self._send(reply)
+        self._audit_join("gek_wrapped", f"group={group_id[:8]}")
+
+    async def _do_keypair_bundle_delete(self) -> None:
+        """
+        Withdraw our own key backup from this node.
+
+        Only ever our own: the user_id comes from the authenticated session, never
+        from the message. Someone who does not want a second browser should not be
+        leaving a PBKDF2-protected blob on every node they have ever joined (C4),
+        and turning the setting off has to remove what is already there — not just
+        stop adding to it.
+        """
+        bundle_store = self._ctx.get("bundle_store")
+        if not bundle_store:
+            self._send({"type": "error", "detail": "Bundle store not available"})
+            return
+
+        removed = await bundle_store.delete_keypair(self._user_id)
+        if removed:
+            log.info("Keypair bundle withdrawn by user=%s", self._user_id[:8])
+            self._audit("keypair_bundle_delete")
+        self._send({"type": "ack", "v": MNP_VERSION,
+                    "detail": "keypair_bundle_deleted", "removed": removed})
+
+    def _audit_pre_proof_fetch(self, mtype: str) -> None:
+        """Record bundle access made before the GEK proof (C4)."""
+        audit = self._ctx.get("audit_store")
+        if not audit:
+            return
+        self._remote_ip = self._remote_ip or _get_remote_ip(self._pc)
+        asyncio.ensure_future(audit.log_event(
+            user_id=getattr(self, "_pending_sub", "unknown"),
+            event="pre_proof_fetch",
+            ip=self._remote_ip,
+            group_id=getattr(self, "_pending_group", "") or "",
+            detail=mtype,
+        ))
+
     def _audit_auth_failed(self, group_id: str, reason: str) -> None:
         audit = self._ctx.get("audit_store")
         if audit:
@@ -508,6 +887,20 @@ class WebRTCPeerSession:
             return self._ctx["groups"][self._group_id]
         return self._ctx
 
+    def _peer_registry(self) -> dict:
+        """
+        Connected peers for THIS group only.
+
+        Finding H1: this used to live on the shared transport context, so a chat
+        message was broadcast to every peer on the node regardless of which group
+        they had authenticated to.
+        """
+        return self._group_ctx().setdefault("_peers", {})
+
+    def _user_names(self) -> dict:
+        """Display-name cache, per group — same leak as _peer_registry (H1)."""
+        return self._group_ctx().setdefault("_user_names", {})
+
     def _do_index_sync(self) -> None:
         ctx = self._group_ctx()
         idx = ctx["index"]
@@ -555,6 +948,17 @@ class WebRTCPeerSession:
             self._audit("file_download", entry.name)
 
     def _do_stream_segment(self, msg: dict) -> None:
+        asyncio.ensure_future(self._do_stream_segment_async(msg))
+
+    async def _do_stream_segment_async(self, msg: dict) -> None:
+        """
+        Legacy HLS segment extraction (superseded by stream_req/MSE).
+
+        Finding H6: this ran subprocess.run(..., timeout=30) directly inside the
+        event loop, so a single request stalled the whole daemon — every peer,
+        every group — for up to thirty seconds. Now async and under the same
+        transcode semaphore as _stream_video.
+        """
         ctx = self._group_ctx()
         file_id = msg["file_id"]
         segment_index = msg["segment_index"]
@@ -570,21 +974,34 @@ class WebRTCPeerSession:
             self._send({"type": "error", "detail": "File not on disk"})
             return
 
-        import subprocess
+        sem = self._ctx.get("_transcode_sem")
+        if sem is None:
+            sem = asyncio.Semaphore(MAX_CONCURRENT_TRANSCODES)
+            self._ctx["_transcode_sem"] = sem
+
         try:
-            result = subprocess.run(
-                ["ffmpeg", "-hide_banner", "-loglevel", "error",
-                 "-ss", str(segment_index * segment_duration),
-                 "-i", str(file_path),
-                 "-t", str(segment_duration),
-                 "-c:v", "copy", "-c:a", "copy",
-                 "-f", "mpegts", "pipe:1"],
-                capture_output=True, timeout=30,
-            )
-            if result.returncode != 0 or not result.stdout:
+            async with sem:
+                proc = await asyncio.create_subprocess_exec(
+                    "ffmpeg", "-hide_banner", "-loglevel", "error",
+                    "-ss", str(segment_index * segment_duration),
+                    "-i", str(file_path),
+                    "-t", str(segment_duration),
+                    "-c:v", "copy", "-c:a", "copy",
+                    "-f", "mpegts", "pipe:1",
+                    stdout=asyncio.subprocess.PIPE,
+                    stderr=asyncio.subprocess.DEVNULL,
+                )
+                try:
+                    stdout, _ = await asyncio.wait_for(proc.communicate(), timeout=30)
+                except asyncio.TimeoutError:
+                    proc.kill()
+                    await proc.wait()
+                    self._send({"type": "error", "detail": "Segment extraction timed out"})
+                    return
+            if proc.returncode != 0 or not stdout:
                 self._send({"type": "error", "detail": "Segment extraction failed"})
                 return
-            segment_data = result.stdout
+            segment_data = stdout
         except Exception:
             self._send({"type": "error", "detail": "Segment extraction failed"})
             return
@@ -599,11 +1016,14 @@ class WebRTCPeerSession:
         })
 
     def _do_chat_message(self, msg: dict) -> None:
-        chat_store = self._ctx.get("chat_store")
+        # Per-group store — see _peer_registry() and finding H1. Reading chat_store
+        # off the shared transport context sent every group's messages to the first
+        # group's database, and served them back to anyone on the node.
+        chat_store = self._group_ctx().get("chat_store")
         payload = msg.get("payload", "")
         sender_name = msg.get("sender_name", "")
         if sender_name:
-            self._ctx.setdefault("_user_names", {})[self._user_id] = sender_name
+            self._user_names()[self._user_id] = sender_name
         if chat_store:
             raw = payload.encode() if isinstance(payload, str) else payload
             asyncio.ensure_future(chat_store.save_message(
@@ -614,7 +1034,7 @@ class WebRTCPeerSession:
                 sender_name=sender_name,
             ))
 
-        peers = self._ctx.get("_peers", {})
+        peers = self._peer_registry()
         broadcast = {
             "type": MNP.CHAT_MESSAGE,
             "v": MNP_VERSION,
@@ -647,7 +1067,7 @@ class WebRTCPeerSession:
         self._audit("chat_message")
 
     def _do_chat_history(self, msg: dict) -> None:
-        chat_store = self._ctx.get("chat_store")
+        chat_store = self._group_ctx().get("chat_store")
         if not chat_store:
             self._send({
                 "type": MNP.CHAT_HISTORY_RESPONSE,
@@ -662,7 +1082,7 @@ class WebRTCPeerSession:
 
     async def _send_chat_history(self, chat_store, since: float, limit: int) -> None:
         msgs = await chat_store.get_messages(since=since, limit=limit)
-        names = self._ctx.get("_user_names", {})
+        names = self._user_names()
         self._send({
             "type": MNP.CHAT_HISTORY_RESPONSE,
             "v": MNP_VERSION,
@@ -691,24 +1111,55 @@ class WebRTCPeerSession:
             self._send({"type": "error", "detail": "Missing filename or data"})
             return
 
+        if not SAFE_UPLOAD_NAME.match(filename):
+            self._send({"type": "error", "detail": "Invalid filename"})
+            return
+
         shared_root = ctx.get("shared_root")
         if not shared_root:
             self._send({"type": "error", "detail": "No shared directory"})
             return
 
-        upload_dir = shared_root / ".uploads"
-        upload_dir.mkdir(exist_ok=True)
-        safe_name = filename.replace("/", "_").replace("\\", "_").replace("..", "_")
-        tmp_path = upload_dir / f"{safe_name}.part"
+        # Per-user quarantine: a member can only ever write inside their own directory,
+        # so they cannot overwrite the operator's files or another member's (C5a).
+        rel_dir = f"{UPLOAD_DIR_NAME}/{self._user_id}"
+        user_dir = shared_root / UPLOAD_DIR_NAME / self._user_id
+        user_dir.mkdir(parents=True, exist_ok=True)
+        tmp_path = user_dir / f"{filename}.part"
+        final_path = user_dir / filename
+
+        state = self._uploads.get(filename)
+        if chunk_index == 0:
+            if final_path.exists():
+                self._send({"type": "error", "detail": "File already exists"})
+                return
+            state = {"next_index": 0, "bytes": 0}
+            self._uploads[filename] = state
+        elif state is None:
+            self._send({"type": "error", "detail": "Upload not started"})
+            return
+
+        # Reject out-of-order or replayed chunks — otherwise chunk_index>0 appends
+        # blindly to whatever .part file is already on disk.
+        if chunk_index != state["next_index"]:
+            self._send({"type": "error", "detail": "Unexpected chunk index"})
+            return
 
         if isinstance(data, str):
             chunk_bytes = base64.b64decode(data)
         else:
             chunk_bytes = bytes(data)
 
-        mode = "ab" if chunk_index > 0 else "wb"
-        with open(tmp_path, mode) as f:
+        if state["bytes"] + len(chunk_bytes) > MAX_UPLOAD_BYTES:
+            self._uploads.pop(filename, None)
+            tmp_path.unlink(missing_ok=True)
+            self._send({"type": "error", "detail": "Upload exceeds size limit"})
+            return
+
+        with open(tmp_path, "wb" if chunk_index == 0 else "ab") as f:
             f.write(chunk_bytes)
+        state["next_index"] = chunk_index + 1
+        state["bytes"] += len(chunk_bytes)
 
         self._send({
             "type": MNP.FILE_UPLOAD_ACK,
@@ -718,21 +1169,30 @@ class WebRTCPeerSession:
         })
 
         if chunk_index + 1 >= total_chunks:
-            final_path = shared_root / safe_name
+            self._uploads.pop(filename, None)
             tmp_path.rename(final_path)
-            log.info("Upload complete: %s (%d chunks)", safe_name, total_chunks)
-            self._audit("file_upload", safe_name)
-            self._register_uploader(ctx, safe_name)
+            log.info("Upload complete: %s (%d chunks, %d bytes)",
+                     filename, total_chunks, state["bytes"])
+            self._audit("file_upload", f"{rel_dir}/{filename}")
+            self._register_uploader(ctx, rel_dir, filename)
+
+    def _register_uploader(self, ctx: dict, rel_dir: str, filename: str) -> None:
+        """
+        Tag the index entry with the uploader's identity after upload completes.
 
-    def _register_uploader(self, ctx: dict, filename: str) -> None:
-        """Tag the index entry with the uploader's user_id after upload completes."""
+        The key recorded here is the one this node pinned, not the one the token
+        carried. `pk_user` was a hub-chosen claim, and it decided who could later
+        delete the file: a hub issuing a token naming its own key could delete
+        anyone's uploads on any node. Deletion is supposed to be authorized by the
+        node, and this closes the last place where it was not.
+        """
         idx = ctx.get("index")
         if not idx:
             return
         for entry in idx.entries:
-            if entry.name == filename and entry.path == "":
+            if entry.name == filename and entry.path == rel_dir:
                 entry.uploader_id = self._user_id
-                entry.uploader_pk = self._pk_user
+                entry.uploader_pk = self._pinned_pk
                 return
 
     def _do_file_delete(self, msg: dict) -> None:
@@ -747,28 +1207,115 @@ class WebRTCPeerSession:
             self._send({"type": "error", "detail": "File not found"})
             return
 
-        admin_pk = self._ctx.get("admin_pk_ed25519")
         has_uploader_pk = bool(entry.uploader_pk)
-        if not admin_pk and not has_uploader_pk:
+        if not self._has_admin_authority() and not has_uploader_pk:
             self._send({"type": "error", "detail": "No authorized key for deletion"})
             return
 
-        challenge = os.urandom(32)
-        self._admin_challenges[file_id] = challenge
+        self._issue_admin_challenge(OP_FILE_DELETE, file_id)
+
+    # ── Admin operation challenge/response (finding H5) ──────────────────────
+
+    def _node_pk_b64(self) -> str:
+        return pk_to_b64(self._ctx["sk_node"].public_key())
+
+    def _issue_admin_challenge(
+        self, op: str, subject: str, payload: dict | None = None,
+    ) -> None:
+        """
+        Ask the client to authorize `op` on `subject` with its Ed25519 identity key.
+
+        The client is sent the transcript *fields*, not opaque bytes, so it can
+        rebuild and inspect what it signs. The node keeps the authoritative copy and
+        rebuilds the transcript itself at verification time — nothing signed is ever
+        taken from the response message.
+        """
+        nonce = os.urandom(32)
+        ts = int(time.time())
+        op_id = base64.b64encode(os.urandom(16)).decode()
+        self._admin_ops[op_id] = {
+            "op": op, "subject": subject, "nonce": nonce, "ts": ts,
+            "payload": payload or {},
+        }
         self._send({
             "type": MNP.ADMIN_CHALLENGE,
             "v": MNP_VERSION,
-            "challenge": base64.b64encode(challenge).decode(),
-            "file_id": file_id,
+            "op_id": op_id,
+            "op": op,
+            "subject": subject,
+            "nonce": base64.b64encode(nonce).decode(),
+            "ts": ts,
+            "node_pk": self._node_pk_b64(),
+            "group_id": self._group_id or "",
         })
 
+    @staticmethod
+    def _verify_sig(pk: Ed25519PublicKey | None, transcript: bytes, sig: bytes) -> bool:
+        if pk is None:
+            return False
+        try:
+            pk.verify(sig, transcript)
+            return True
+        except Exception:
+            return False
+
+    async def _load_pinned_pk(self) -> None:
+        """Remember which key this node pinned for the peer we just authenticated."""
+        roster = self._ctx.get("roster")
+        if roster is None or not self._user_id:
+            return
+        ident = await roster.get_identity(self._user_id)
+        if ident:
+            self._pinned_pk = ident["pk_ed25519"]
+
+    def _has_admin_authority(self) -> bool:
+        """
+        Cheap synchronous pre-check: is there anyone who could authorize this?
+
+        Only decides whether to issue a challenge at all — the gate is
+        `_verify_admin_sig`. The flag is set at startup and refreshed in-process
+        when an operator pairs.
+        """
+        return bool(self._ctx.get("admin_pk_ed25519")
+                    or self._ctx.get("has_admin_authority"))
+
+    async def _verify_admin_sig(self, transcript: bytes, sig: bytes) -> bool:
+        """
+        Check a signature against every key holding node-operator authority.
+
+        Read from the roster on each call rather than cached: revoking a paired
+        browser must take effect immediately, and admin operations are rare enough
+        that a SQLite read costs nothing. `admin_pk_ed25519` in node.toml is still
+        honoured so an existing deployment keeps working until its operator pairs
+        (M3) — it is the legacy form of the same statement.
+        """
+        legacy = self._ctx.get("admin_pk_ed25519")
+        if self._verify_sig(legacy, transcript, sig):
+            return True
+
+        roster = self._ctx.get("roster")
+        if roster is None:
+            return False
+        for pk_b64 in await roster.operator_pks():
+            try:
+                pk = Ed25519PublicKey.from_public_bytes(base64.b64decode(pk_b64))
+            except Exception:
+                continue
+            if self._verify_sig(pk, transcript, sig):
+                return True
+        return False
+
     def _do_admin_response(self, msg: dict) -> None:
-        file_id = msg.get("file_id", "")
+        op_id = msg.get("op_id", "")
         sig_b64 = msg.get("signature", "")
 
-        challenge = self._admin_challenges.pop(file_id, None)
-        if not challenge:
-            self._send({"type": "error", "detail": "No pending admin challenge"})
+        pending = self._admin_ops.pop(op_id, None)
+        if not pending:
+            self._send({"type": "error", "detail": "No pending admin operation"})
+            return
+
+        if time.time() - pending["ts"] > ADMIN_CHALLENGE_TTL:
+            self._send({"type": "error", "detail": "Admin challenge expired"})
             return
 
         try:
@@ -777,40 +1324,96 @@ class WebRTCPeerSession:
             self._send({"type": "error", "detail": "Invalid signature encoding"})
             return
 
+        transcript = admin_transcript(
+            op=pending["op"],
+            node_pk_b64=self._node_pk_b64(),
+            group_id=self._group_id or "",
+            subject=pending["subject"],
+            nonce=pending["nonce"],
+            ts=pending["ts"],
+        )
+
+        if pending["op"] == OP_FILE_DELETE:
+            asyncio.ensure_future(
+                self._admin_exec_file_delete(pending, transcript, sig_bytes))
+        elif pending["op"] == OP_INVITE_CREATE:
+            asyncio.ensure_future(
+                self._admin_exec_invite_create(pending, transcript, sig_bytes))
+        else:
+            self._send({"type": "error", "detail": "Unknown admin operation"})
+
+    async def _admin_exec_file_delete(
+        self, pending: dict, transcript: bytes, sig: bytes,
+    ) -> None:
+        file_id = pending["subject"]
         ctx = self._group_ctx()
         entry = ctx["index"].get_entry(file_id)
         if not entry:
             self._send({"type": "error", "detail": "File not found"})
             return
 
-        verified = False
-
-        # Try admin key (locally pinned)
-        admin_pk = self._ctx.get("admin_pk_ed25519")
-        if admin_pk:
-            try:
-                admin_pk.verify(sig_bytes, challenge)
-                verified = True
-            except Exception:
-                pass
-
-        # Try uploader key (stored at upload time)
-        if not verified and entry.uploader_pk:
+        uploader_pk = None
+        if entry.uploader_pk:
             try:
-                uploader_key = Ed25519PublicKey.from_public_bytes(
+                uploader_pk = Ed25519PublicKey.from_public_bytes(
                     base64.b64decode(entry.uploader_pk))
-                uploader_key.verify(sig_bytes, challenge)
-                verified = True
             except Exception:
-                pass
+                uploader_pk = None
 
-        if not verified:
+        # Node operator, or the user who uploaded this file — verified by the key
+        # recorded at upload time, never by a JWT claim (the hub controls those).
+        if not (await self._verify_admin_sig(transcript, sig)
+                or self._verify_sig(uploader_pk, transcript, sig)):
             self._send({"type": "error", "detail": "Signature verification failed"})
             self._audit("admin_auth_failed", f"file_delete:{file_id[:16]}")
             return
 
         self._exec_file_delete(ctx, file_id, entry)
 
+    async def _admin_exec_invite_create(
+        self, pending: dict, transcript: bytes, sig: bytes,
+    ) -> None:
+        # Node operator only. A group admin who does not run the node has no
+        # authority over who this node admits (deny by default). Delegation is
+        # designed but deferred — see §6.2 of docs/invite-pairing-v1.md.
+        if not await self._verify_admin_sig(transcript, sig):
+            self._send({"type": "error", "detail": "Signature verification failed"})
+            self._audit("admin_auth_failed", f"invite_create:{pending['subject'][:16]}")
+            return
+
+        roster = self._ctx.get("roster")
+        if roster is None:
+            self._send({"type": "error", "detail": "Roster not available"})
+            return
+
+        payload = pending["payload"]
+        code = await roster.create_invite(
+            group_id=payload["group_id"],
+            user_id=payload["user_id"],
+            role=ROLE_MEMBER,
+            created_by=self._user_id or "",
+            ttl=self._ctx.get("invite_ttl", DEFAULT_INVITE_TTL),
+            username=payload.get("username", ""),
+        )
+        invites = await roster.list_invites()
+        expires = next(
+            (i["expires_at"] for i in invites
+             if i["user_id"] == payload["user_id"]
+             and i["group_id"] == payload["group_id"]), "")
+
+        log.info("Invite created: group=%s user=%s",
+                 payload["group_id"][:8], payload["user_id"][:8])
+        self._audit("invite_create", f"target={payload['user_id'][:8]}")
+        # The code exists in the clear exactly here and in the operator's hands.
+        self._send({
+            "type": MNP.INVITE_RESULT,
+            "v": MNP_VERSION,
+            "code": code,
+            "expires_at": expires,
+            "user_id": payload["user_id"],
+            "username": payload.get("username", ""),
+        })
+
     def _exec_file_delete(self, ctx: dict, file_id: str, entry) -> None:
         file_path = ctx["shared_root"] / entry.path / entry.name
         if file_path.exists():
@@ -827,6 +1430,20 @@ class WebRTCPeerSession:
 
     async def _stream_video(self, msg: dict) -> None:
         """Stream a video file as fMP4 segments via MSE-compatible output."""
+        # One ffmpeg per request with no cap lets any member exhaust the node's
+        # CPU and process table (H6). The semaphore lives on the transport context
+        # so it is shared across all peers, not per-session.
+        sem = self._ctx.get("_transcode_sem")
+        if sem is None:
+            sem = asyncio.Semaphore(MAX_CONCURRENT_TRANSCODES)
+            self._ctx["_transcode_sem"] = sem
+        if sem.locked() and sem._value <= 0:
+            self._send({"type": "error", "detail": "Server busy, retry shortly"})
+            return
+        async with sem:
+            await self._stream_video_inner(msg)
+
+    async def _stream_video_inner(self, msg: dict) -> None:
         ctx = self._group_ctx()
         file_id = msg.get("file_id", "")
         entry = ctx["index"].get_entry(file_id)
@@ -914,9 +1531,8 @@ class WebRTCPeerSession:
 
     async def close(self) -> None:
         self._audit("disconnect")
-        peers = self._ctx.get("_peers")
-        if peers and self._user_id:
-            peers.pop(self._user_id, None)
+        if self._user_id:
+            self._peer_registry().pop(self._user_id, None)
         await self._pc.close()
 
 
diff --git a/packages/meshbay-node/src/meshbay_node/ui/app.py b/packages/meshbay-node/src/meshbay_node/ui/app.py
index b4885af..28654df 100644
--- a/packages/meshbay-node/src/meshbay_node/ui/app.py
+++ b/packages/meshbay-node/src/meshbay_node/ui/app.py
@@ -9,13 +9,14 @@ FastAPI app providing:
   - API endpoints for all data (JSON)
 
 Served only on 127.0.0.1 — not exposed to the network.
-No authentication required (localhost only).
+Gated by a per-run session token (11.5.3) — printed at daemon startup.
 """
 
 import base64
 import json
 import logging
 import time
+from html import escape
 from pathlib import Path
 
 from fastapi import FastAPI, WebSocket, WebSocketDisconnect, Query
@@ -23,6 +24,7 @@ from fastapi.responses import HTMLResponse, JSONResponse
 
 from meshbay_node import __version__
 from meshbay_common.crypto import generate_gek, wrap_gek_aes
+from meshbay_common.join import ROLE_MEMBER, ROLE_OPERATOR
 
 log = logging.getLogger(__name__)
 
@@ -35,6 +37,55 @@ def create_ui_app(state: dict) -> FastAPI:
         redoc_url=None,
     )
 
+    @app.middleware("http")
+    async def _require_session_token(request, call_next):
+        """
+        Gate the admin UI behind a per-run token (11.5.3).
+
+        "localhost only" is weaker than it sounds: any process on the machine can
+        reach it, and a page in the operator's browser can reach it too via DNS
+        rebinding. Since this API can re-initialise a group's GEK and read the
+        audit log, an unauthenticated loopback service is a privilege boundary
+        waiting to be crossed. The token is printed at startup and accepted as
+        ?t= or the X-MeshBay-Token header.
+        """
+        from fastapi.responses import PlainTextResponse
+
+        token = state.get("ui_token")
+        if token:
+            supplied = (request.query_params.get("t")
+                        or request.headers.get("X-MeshBay-Token"))
+            if supplied != token:
+                return PlainTextResponse("Forbidden", status_code=403)
+        return await call_next(request)
+
+    @app.middleware("http")
+    async def _security_headers(request, call_next):
+        """
+        Defence in depth behind the escaping fixes for H2. This UI is unauthenticated
+        on loopback, so script execution here equals full control of the node admin API.
+
+        Note what this does and does not do: the page relies on inline <script>, so
+        script-src must allow 'unsafe-inline' and CSP therefore does NOT prevent an
+        injected script from running. Escaping is the actual fix. What CSP buys is
+        containment — connect-src/img-src/form-action 'self'|'none' stop an injected
+        script from exfiltrating the audit log or config to an external host.
+        """
+        response = await call_next(request)
+        response.headers["Content-Security-Policy"] = (
+            "default-src 'none'; "
+            "style-src 'unsafe-inline'; "
+            "script-src 'unsafe-inline'; "
+            "connect-src 'self'; "
+            "img-src 'self' data:; "
+            "form-action 'none'; "
+            "frame-ancestors 'none'; "
+            "base-uri 'none'"
+        )
+        response.headers["X-Content-Type-Options"] = "nosniff"
+        response.headers["Referrer-Policy"] = "no-referrer"
+        return response
+
     # ── JSON API ─────────────────────────────────────────────────────────────
 
     @app.get("/api/status")
@@ -48,7 +99,6 @@ def create_ui_app(state: dict) -> FastAPI:
             "status": state.get("status", "starting"),
             "hub_url": state.get("hub_url", ""),
             "username": state.get("username", ""),
-            "node_port": state.get("node_port", 0),
             "quic_port": state.get("quic_port", 0),
             "endpoint_hint": state.get("endpoint_hint"),
             "group_count": len(groups_ctx),
@@ -154,9 +204,7 @@ def create_ui_app(state: dict) -> FastAPI:
         return {
             "hub_url": config.hub.url,
             "username": config.hub.username,
-            "node_port": config.node.port,
             "quic_port": config.node.quic_port,
-            "http_port": config.node.http_port,
             "ui_port": config.node.ui_port,
             "data_dir": str(config.data_dir),
             "groups": [
@@ -170,11 +218,159 @@ def create_ui_app(state: dict) -> FastAPI:
             ],
         }
 
+    # ── Operator pairing (localhost only) ──────────────────────────────────
+
+    @app.post("/api/operator/pair")
+    async def operator_pair():
+        """
+        Issue a one-time code that pairs a browser as this node's operator.
+
+        The code is the whole point: it binds the operator's browser identity key
+        to their account without asking the hub, which is what stops a hub from
+        naming itself node administrator (M3, and the same substitution as H3).
+        It is returned once and stored only as a hash.
+        """
+        roster = state.get("roster")
+        user_id = state.get("node_user_id")
+        if not roster or not user_id:
+            return JSONResponse({"error": "Node not connected to hub yet"}, 503)
+
+        config = state.get("config")
+        ttl = (config.node.pair_ttl_hours if config else 24) * 3600
+        code = await roster.create_invite(
+            group_id="",                 # operator authority is node-wide
+            user_id=user_id,
+            role=ROLE_OPERATOR,
+            created_by="local-cli",
+            ttl=ttl,
+            username=(config.hub.username if config else ""),
+        )
+        invites = await roster.list_invites()
+        expires = next((i["expires_at"] for i in invites
+                        if i["user_id"] == user_id and i["role"] == ROLE_OPERATOR), "")
+        return {"code": code, "expires_at": expires, "user_id": user_id}
+
+    @app.get("/api/roster")
+    async def api_roster(group_id: str = ""):
+        roster = state.get("roster")
+        if not roster:
+            return {"identities": [], "members": [], "invites": []}
+        return {
+            "identities": await roster.list_identities(),
+            "members": await roster.list_members(group_id or None),
+            "invites": await roster.list_invites(),
+        }
+
+    @app.post("/api/groups/{group_id}/invites")
+    async def create_invite(group_id: str, username: str):
+        """
+        Issue an invitation code from the CLI, without a browser.
+
+        The hub is asked for the account id and nothing else — never for a key.
+        A hub that answered with the wrong account would produce an invite whose
+        code it never learns, since the code goes to a human out of band.
+        """
+        roster = state.get("roster")
+        groups_ctx = state.get("groups_ctx", {})
+        if not roster:
+            return JSONResponse({"error": "Roster not available"}, 503)
+        if group_id not in groups_ctx:
+            return JSONResponse({"error": "Group not hosted on this node"}, 404)
+
+        hub = state.get("hub")
+        if not hub or not hub._session:
+            return JSONResponse({"error": "Hub not connected"}, 503)
+        try:
+            account = await hub.get_user_pubkeys(username)
+        except Exception as e:
+            return JSONResponse({"error": f"Unknown user {username!r}: {e}"}, 404)
+
+        config = state.get("config")
+        ttl = (config.node.invite_ttl_hours if config else 168) * 3600
+        code = await roster.create_invite(
+            group_id=group_id,
+            user_id=account["user_id"],
+            role=ROLE_MEMBER,
+            created_by="local-cli",
+            ttl=ttl,
+            username=username,
+        )
+        invites = await roster.list_invites()
+        expires = next((i["expires_at"] for i in invites
+                        if i["user_id"] == account["user_id"]
+                        and i["group_id"] == group_id), "")
+        return {"code": code, "expires_at": expires,
+                "username": username, "user_id": account["user_id"]}
+
+    @app.get("/api/resolve")
+    async def resolve_user(username: str):
+        """
+        Map a username to an account id for the CLI.
+
+        The roster answers first — it is the node's own record. The hub is the
+        fallback for identities pinned before invitations carried a name, and for
+        people admitted through an open-join group. Only an account id comes back;
+        no key is ever taken from here.
+        """
+        roster = state.get("roster")
+        if roster:
+            for ident in await roster.list_identities():
+                if ident["username"] == username:
+                    return {"user_id": ident["user_id"], "source": "roster"}
+        hub = state.get("hub")
+        if hub and hub._session:
+            try:
+                account = await hub.get_user_pubkeys(username)
+                return {"user_id": account["user_id"], "source": "hub"}
+            except Exception:
+                pass
+        return JSONResponse({"error": f"Unknown user {username!r}"}, 404)
+
+    @app.post("/api/members/{user_id}/revoke")
+    async def revoke_member(user_id: str, group_id: str):
+        """
+        Stop serving the group key to someone.
+
+        Takes effect on their next connection: the key is wrapped on demand, so
+        there is no stored bundle left behind that would outlive this. Rotating
+        the group key is still required — they hold the current one.
+        """
+        roster = state.get("roster")
+        if not roster:
+            return JSONResponse({"error": "Roster not available"}, 503)
+        if not await roster.set_status(group_id, user_id, "revoked"):
+            return JSONResponse({"error": "No such member in that group"}, 404)
+        log.info("Member revoked: user=%s group=%s", user_id[:8], group_id[:8])
+        return {"status": "revoked", "user_id": user_id, "group_id": group_id,
+                "reminder": "rotate the group key: meshbay-node gek-init"}
+
+    @app.post("/api/members/{user_id}/unpin")
+    async def unpin_member(user_id: str):
+        """Forget a pinned identity, so the person can pair again with a new key."""
+        roster = state.get("roster")
+        if not roster:
+            return JSONResponse({"error": "Roster not available"}, 503)
+        if not await roster.unpin(user_id):
+            return JSONResponse({"error": "No such pinned identity"}, 404)
+        log.info("Identity unpinned: user=%s", user_id[:8])
+        return {"status": "unpinned", "user_id": user_id}
+
     # ── GEK initialization (operator only, localhost) ──────────────────────
 
     @app.post("/api/groups/{group_id}/gek")
     async def init_gek(group_id: str):
-        """Generate GEK, wrap for all group members, store, and activate."""
+        """
+        Generate the group key and activate it.
+
+        It used to be wrapped here for every member, using public keys fetched from
+        the hub — which is H3 with the node as the victim instead of the inviter: a
+        hub answering with its own key was handed the group key by the node itself.
+
+        Nothing is pre-wrapped for members now. Each member's copy is produced when
+        they connect, for a key they proved they hold (`join_request`). Only the
+        node's own copy is stored, so the daemon can reload the key across restarts
+        without the operator's browser.
+        """
         groups_ctx = state.get("groups_ctx", {})
         if group_id not in groups_ctx:
             return JSONResponse({"error": "Group not hosted on this node"}, 404)
@@ -187,48 +383,15 @@ def create_ui_app(state: dict) -> FastAPI:
         if not bundle_store:
             return JSONResponse({"error": "Bundle store not available"}, 503)
 
-        await hub.ensure_fresh_token()
-        session = hub._session
-        members_resp = await hub._http.get(
-            f"/v1/groups/{group_id}/members",
-            headers=session.auth_headers,
-        )
-        if not members_resp.is_success:
-            return JSONResponse(
-                {"error": f"Failed to fetch members: {members_resp.status_code}"}, 502)
-        members = members_resp.json().get("members", [])
-        if not members:
-            return JSONResponse({"error": "No members in group"}, 400)
-
         existing_gek = groups_ctx[group_id].get("gek")
         gek = existing_gek or generate_gek()
+        errors: list[str] = []
 
-        wrapped_count = 0
-        errors = []
-        for member in members:
-            username = member["username"]
-            user_id = member["user_id"]
-            try:
-                pk_data = await hub.get_user_pubkeys(username)
-                pk_x_raw = base64.b64decode(pk_data["pk_x25519"])
-                bundle = wrap_gek_aes(gek, pk_x_raw)
-                await bundle_store.store(
-                    group_id, user_id,
-                    bundle["pk_eph_b64"], bundle["nonce_b64"], bundle["wrapped_b64"],
-                )
-                wrapped_count += 1
-                log.info("GEK wrapped for %s (%s)", username, user_id[:8])
-            except Exception as e:
-                errors.append(f"{username}: {e}")
-                log.warning("Failed to wrap GEK for %s: %s", username, e)
+        roster = state.get("roster")
+        authorized = len(await roster.list_members(group_id)) if roster else 0
 
-        if wrapped_count == 0:
-            return JSONResponse(
-                {"error": "Failed to wrap GEK for any member", "details": errors}, 500)
-
-        # Also store a copy wrapped for the node keystore X25519 key
-        # so the daemon can reload GEK on restart without the operator's browser keys
-        config = state.get("config")
+        # Store a copy wrapped for the node keystore X25519 key so the daemon can
+        # reload the GEK on restart without the operator's browser keys.
         node_user_id = hub._session.user_id if hub._session else None
         pk_x_node_raw = state.get("pk_x25519_raw")
         if pk_x_node_raw and node_user_id:
@@ -239,13 +402,14 @@ def create_ui_app(state: dict) -> FastAPI:
                     node_bundle["pk_eph_b64"], node_bundle["nonce_b64"],
                     node_bundle["wrapped_b64"],
                 )
-                log.info("GEK also wrapped for node keystore (daemon reload)")
+                log.info("GEK wrapped for node keystore (daemon reload)")
             except Exception as e:
+                errors.append(f"node keystore: {e}")
                 log.warning("Failed to wrap GEK for node keystore: %s", e)
 
         groups_ctx[group_id]["gek"] = gek
-        log.info("GEK initialized for group %s — wrapped for %d/%d members",
-                 group_id[:8], wrapped_count, len(members))
+        log.info("GEK initialized for group %s — %d authorized member(s) will "
+                 "receive it on connect", group_id[:8], authorized)
 
         webrtc = state.get("webrtc")
         if webrtc and "groups" in webrtc._ctx and group_id in webrtc._ctx["groups"]:
@@ -254,8 +418,7 @@ def create_ui_app(state: dict) -> FastAPI:
         return {
             "status": "ok",
             "group_id": group_id,
-            "wrapped_count": wrapped_count,
-            "total_members": len(members),
+            "authorized_members": authorized,
             "errors": errors,
         }
 
@@ -311,11 +474,21 @@ def create_ui_app(state: dict) -> FastAPI:
 
     @app.get("/", response_class=HTMLResponse)
     async def root():
-        return _render_page(state)
+        # Roster reads are async and the page renderer is not, so gather here.
+        roster = state.get("roster")
+        roster_view = None
+        if roster:
+            identities = {i["user_id"]: i for i in await roster.list_identities()}
+            roster_view = {
+                "identities": identities,
+                "members": await roster.list_members(),
+                "invites": await roster.list_invites(),
+            }
+        return _render_page(state, roster_view)
 
     @app.get("/audit", response_class=HTMLResponse)
     async def audit_page():
-        return _render_audit_page()
+        return _render_audit_page(state.get("ui_token", ""))
 
     return app
 
@@ -330,7 +503,71 @@ def _fmt_size(n: int) -> str:
     return f"{n / (1024 * 1024 * 1024):.2f} GB"
 
 
-def _render_page(state: dict) -> str:
+def _render_roster(roster_view: dict | None) -> str:
+    """
+    Who this node recognises, and which keys are theirs.
+
+    Every value here is escaped: usernames come from the hub and pass through the
+    roster, so they are attacker-influenced text on the operator's own admin page
+    (the H2 rule applies to them exactly as it does to filenames).
+    """
+    if roster_view is None:
+        return '<p class="muted">Roster unavailable</p>'
+
+    identities = roster_view["identities"]
+    rows = ""
+    for m in roster_view["members"]:
+        ident = identities.get(m["user_id"], {})
+        scope = escape(m["group_id"][:8]) if m["group_id"] else "node-wide"
+        status_color = "#22c55e" if m["status"] == "active" else "#ef4444"
+        rows += (
+            f"<tr><td>{escape(str(ident.get('username') or m['user_id']))}</td>"
+            f"<td>{escape(str(m['role']))}</td>"
+            f"<td><span class='badge' style='background:{status_color}'>"
+            f"{escape(str(m['status']))}</span></td>"
+            f"<td>{scope}</td>"
+            f"<td><code>{escape(str(ident.get('pk_ed25519', ''))[:16])}…</code></td>"
+            f"<td>{escape(str(ident.get('pinned_at', '?')))} "
+            f"({escape(str(ident.get('pinned_via', '?')))})</td></tr>"
+        )
+    if not rows:
+        rows = ('<tr><td colspan="6" class="muted">Nobody admitted yet — '
+                'run <code>meshbay-node member invite &lt;username&gt;</code></td></tr>')
+
+    invite_rows = ""
+    for i in roster_view["invites"]:
+        invite_rows += (
+            f"<tr><td><code>{escape(str(i['user_id'])[:16])}</code></td>"
+            f"<td>{escape(str(i['group_id'][:8] or 'node-wide'))}</td>"
+            f"<td>{escape(str(i['role']))}</td>"
+            f"<td>{escape(str(i['expires_at']))}</td></tr>"
+        )
+    invites_html = ""
+    if invite_rows:
+        invites_html = f"""
+        <details style="margin-top:10px"><summary>Pending invitations</summary>
+        <table>
+          <thead><tr><th>Account</th><th>Group</th><th>Role</th><th>Expires</th></tr></thead>
+          <tbody>{invite_rows}</tbody>
+        </table>
+        </details>"""
+
+    return f"""
+    <table>
+      <thead><tr><th>User</th><th>Role</th><th>Status</th><th>Scope</th>
+                 <th>Identity key</th><th>Pinned</th></tr></thead>
+      <tbody>{rows}</tbody>
+    </table>
+    {invites_html}
+    <p class="muted" style="margin-top:8px">
+      Codes are issued from the CLI: <code>meshbay-node operator pair</code>,
+      <code>meshbay-node member invite &lt;username&gt;</code>. They never pass
+      through the hub.
+    </p>"""
+
+
+def _render_page(state: dict, roster_view: dict | None = None) -> str:
+    token_js = json.dumps(state.get("ui_token", ""))
     status = state.get("status", "starting")
     indexes = state.get("indexes", {})
     groups_ctx = state.get("groups_ctx", {})
@@ -356,12 +593,16 @@ def _render_page(state: dict) -> str:
         fcount = idx.count if idx else 0
         total_size = sum(e.size for e in idx.entries) if idx else 0
 
+        # Everything interpolated below is attacker-controlled: filenames come from
+        # uploads by any group member. Rendering them raw was a stored XSS into the
+        # unauthenticated localhost admin UI, i.e. full control of the node admin API
+        # from the operator's browser (finding H2).
         file_rows = ""
         if idx:
             for e in sorted(idx.entries, key=lambda x: x.name):
                 file_rows += (
-                    f"<tr><td>{e.name}</td><td>{e.type}</td>"
-                    f"<td>{_fmt_size(e.size)}</td><td>{e.path or '/'}</td></tr>"
+                    f"<tr><td>{escape(e.name)}</td><td>{escape(e.type)}</td>"
+                    f"<td>{_fmt_size(e.size)}</td><td>{escape(e.path or '/')}</td></tr>"
                 )
 
         has_gek = bool(ctx.get("gek"))
@@ -385,14 +626,14 @@ def _render_page(state: dict) -> str:
 
         groups_html += f"""
         <div class="card">
-          <h3>{name}
-            <span class="badge" style="background:#6366f1">{vis}</span>
+          <h3>{escape(str(name))}
+            <span class="badge" style="background:#6366f1">{escape(str(vis))}</span>
             {gek_badge}
           </h3>
-          <p><b>Directory:</b> <code>{shared}</code></p>
+          <p><b>Directory:</b> <code>{escape(str(shared))}</code></p>
           <p><b>Files:</b> {fcount} &mdash; <b>Total:</b> {_fmt_size(total_size)}</p>
           {gek_action}
-          <p class="muted">ID: {gid}</p>
+          <p class="muted">ID: {escape(gid)}</p>
           <details><summary>File list</summary>
           <table>
             <thead><tr><th>Name</th><th>Type</th><th>Size</th><th>Path</th></tr></thead>
@@ -408,10 +649,10 @@ def _render_page(state: dict) -> str:
             from meshbay_node.transport.webrtc_server import _get_remote_ip
             ip = session._remote_ip or _get_remote_ip(session._pc)
             peers_html += (
-                f"<tr><td>{session._username or session._user_id or '—'}</td>"
-                f"<td>{ip or '—'}</td>"
-                f"<td>{session._group_id[:8] if session._group_id else '—'}</td>"
-                f"<td>{session._pc.connectionState}</td></tr>"
+                f"<tr><td>{escape(session._username or session._user_id or '—')}</td>"
+                f"<td>{escape(ip or '—')}</td>"
+                f"<td>{escape(session._group_id[:8] if session._group_id else '—')}</td>"
+                f"<td>{escape(session._pc.connectionState)}</td></tr>"
             )
     if not peers_html:
         peers_html = '<tr><td colspan="4" class="muted">No connected peers</td></tr>'
@@ -487,14 +728,16 @@ def _render_page(state: dict) -> str:
     <tbody>{peers_html}</tbody>
   </table>
 
+  <h2>Roster</h2>
+  {_render_roster(roster_view)}
+
   <h2>Groups</h2>
   {groups_html or '<p class="muted">No groups configured</p>'}
 
   <h2>Node Configuration</h2>
   <div class="card">
     <p><b>Hub:</b> {state.get("hub_url", "—")}</p>
-    <p><b>QUIC port:</b> {state.get("quic_port", "—")} &mdash;
-       <b>TCP port:</b> {state.get("node_port", "—")}</p>
+    <p><b>QUIC port:</b> {state.get("quic_port", "—")}</p>
     <p><b>Node ID:</b> <code>{state.get("endpoint_hint") or "—"}</code></p>
   </div>
 
@@ -524,17 +767,18 @@ def _render_page(state: dict) -> str:
   </div>
 </div>
 <script>
+const TOKEN = {token_js};
 async function initGEK(groupId) {{
   const btn = document.getElementById('gek-btn-' + groupId.slice(0,8));
   const status = document.getElementById('gek-status-' + groupId.slice(0,8));
   if (btn) btn.disabled = true;
   if (status) status.textContent = 'Initializing...';
   try {{
-    const resp = await fetch('/api/groups/' + groupId + '/gek', {{ method: 'POST' }});
+    const resp = await fetch('/api/groups/' + groupId + '/gek?t=' + TOKEN, {{ method: 'POST' }});
     const data = await resp.json();
     if (resp.ok) {{
-      if (status) status.textContent = 'GEK initialized — wrapped for '
-        + data.wrapped_count + '/' + data.total_members + ' members';
+      if (status) status.textContent = 'GEK initialized — '
+        + data.authorized_members + ' authorized member(s) get it on connect';
       if (status) status.style.color = '#22c55e';
       setTimeout(() => location.reload(), 2000);
     }} else {{
@@ -554,8 +798,11 @@ setTimeout(()=>location.reload(), 10000);
 </html>"""
 
 
-def _render_audit_page() -> str:
-    return """<!DOCTYPE html>
+def _render_audit_page(token: str = "") -> str:
+    return _AUDIT_HTML.replace("__TOKEN__", json.dumps(token))
+
+
+_AUDIT_HTML = """<!DOCTYPE html>
 <html lang="en">
 <head>
 <meta charset="utf-8">
@@ -591,7 +838,7 @@ def _render_audit_page() -> str:
 <body>
 <div class="container">
   <h1>Audit Log</h1>
-  <nav><a href="/">Dashboard</a><a href="/audit">Audit Log</a></nav>
+  <nav><a id="navHome" href="/">Dashboard</a><a id="navAudit" href="/audit">Audit Log</a></nav>
 
   <div class="filters">
     <select id="eventFilter">
@@ -620,23 +867,39 @@ def _render_audit_page() -> str:
   </table>
 </div>
 <script>
+const TOKEN = __TOKEN__;
 async function load() {
   const ev = document.getElementById('eventFilter').value;
   const limit = document.getElementById('limitSelect').value;
-  let url = '/api/audit?limit=' + limit;
+  let url = '/api/audit?limit=' + limit + (TOKEN ? '&t=' + TOKEN : '');
   if (ev) url += '&event=' + ev;
   const r = await fetch(url);
   const data = await r.json();
   const tbody = document.getElementById('tbody');
   document.getElementById('count').textContent = data.entries.length + ' entries';
-  tbody.innerHTML = data.entries.map(e => {
-    const t = new Date(e.timestamp * 1000).toLocaleString();
-    return '<tr><td>' + t + '</td><td>' + e.event + '</td><td>'
-      + (e.username || e.user_id.slice(0,8)) + '</td><td>'
-      + (e.ip || '—') + '</td><td>'
-      + (e.group_id ? e.group_id.slice(0,8) : '—') + '</td><td>'
-      + (e.detail || '') + '</td></tr>';
-  }).join('');
+  // textContent, not innerHTML: e.detail carries filenames chosen by group members
+  // (finding H2). Building this row with string concatenation was a stored XSS.
+  tbody.replaceChildren(...data.entries.map(e => {
+    const tr = document.createElement('tr');
+    const cells = [
+      new Date(e.timestamp * 1000).toLocaleString(),
+      e.event,
+      e.username || (e.user_id || '').slice(0, 8),
+      e.ip || '—',
+      e.group_id ? e.group_id.slice(0, 8) : '—',
+      e.detail || '',
+    ];
+    for (const value of cells) {
+      const td = document.createElement('td');
+      td.textContent = value;
+      tr.appendChild(td);
+    }
+    return tr;
+  }));
+}
+for (const [id, href] of [['navHome','/'],['navAudit','/audit']]) {
+  const el = document.getElementById(id);
+  if (el && TOKEN) el.href = href + '?t=' + TOKEN;
 }
 document.getElementById('eventFilter').onchange = load;
 document.getElementById('limitSelect').onchange = load;
diff --git a/packages/meshbay-node/tests/test_daemon.py b/packages/meshbay-node/tests/test_daemon.py
index 1c5a07e..60ef11f 100644
--- a/packages/meshbay-node/tests/test_daemon.py
+++ b/packages/meshbay-node/tests/test_daemon.py
@@ -21,7 +21,6 @@ from meshbay_node.config import Config, HubConfig, NodeConfig, GroupConfig, Keys
 from meshbay_node.daemon import NodeDaemon
 from meshbay_node.indexer import DirectoryIndexer
 
-
 def _mock_keystore_keys(sk_ed):
     """Create a mock keystore with real Ed25519 + X25519 key material."""
     sk_x = X25519PrivateKey.generate()
@@ -35,23 +34,33 @@ def _mock_keystore_keys(sk_ed):
     mock_keys.pk_x25519_b64 = base64.b64encode(pk_x_raw).decode()
     return mock_keys
 
+def _free_port() -> int:
+    """
+    A port nobody else in the session is on.
+
+    These tests start the real admin UI server. Hardcoding 28000 made them fail
+    with EADDRINUSE whenever another test file had a node running — which is why
+    the full suite failed while each file passed on its own.
+    """
+    import socket
+    with socket.socket() as s:
+        s.bind(("127.0.0.1", 0))
+        return s.getsockname()[1]
+
 
 @pytest.fixture
 def sk_hub():
     return Ed25519PrivateKey.generate()
 
-
 @pytest.fixture
 def hub_pk_pem(sk_hub):
     return sk_hub.public_key().public_bytes(
         serialization.Encoding.PEM, serialization.PublicFormat.SubjectPublicKeyInfo)
 
-
 @pytest.fixture
 def gek():
     return generate_gek()
 
-
 @pytest.fixture
 def shared_dir(tmp_path):
     d = tmp_path / "shared"
@@ -60,26 +69,22 @@ def shared_dir(tmp_path):
     (d / "hello.txt").write_bytes(b"hello daemon test " * 50)
     return d
 
-
 @pytest.fixture
 def node_config(tmp_path, shared_dir):
     return Config(
         hub=HubConfig(url="http://localhost:9999", username="testuser"),
-        node=NodeConfig(port=29000, quic_port=29010, http_port=29001, ui_port=28000),
+        node=NodeConfig(quic_port=_free_port(), ui_port=_free_port()),
         groups=[GroupConfig(
             id="g" * 32,
             name="test-group",
             shared_dir=str(shared_dir),
             visibility="private",
-            port=29000,
             quic_port=29010,
-            http_port=29001,
         )],
         keystore=KeystoreConfig(path=tmp_path / "keystore.enc"),
         data_dir=tmp_path / "data",
     )
 
-
 @pytest.mark.asyncio
 async def test_daemon_creates_chat_store(tmp_path, node_config, gek, hub_pk_pem):
     """Daemon creates ChatStore for each group and shuts down cleanly."""
@@ -130,7 +135,14 @@ async def test_daemon_creates_chat_store(tmp_path, node_config, gek, hub_pk_pem)
         assert daemon._chat_stores[group_id]._db is not None
 
         if daemon._webrtc:
-            assert "chat_store" in daemon._webrtc._ctx
+            # Finding H1: chat_store must live in the per-group context, never on
+            # the shared transport context. Hoisting the first group's store
+            # transport-wide sent every group's chat to one database and served it
+            # back to members of every other group.
+            assert "chat_store" not in daemon._webrtc._ctx
+            groups_ctx = daemon._webrtc._ctx["groups"]
+            assert groups_ctx[group_id]["chat_store"] is daemon._chat_stores[group_id]
+
             assert "hub_ws" in daemon._webrtc._ctx
             assert "node_user_id" in daemon._webrtc._ctx
             assert daemon._webrtc._ctx["node_user_id"] == "user123"
@@ -146,7 +158,6 @@ async def test_daemon_creates_chat_store(tmp_path, node_config, gek, hub_pk_pem)
         for store in daemon._chat_stores.values():
             assert store._db is None
 
-
 @pytest.mark.asyncio
 async def test_daemon_no_groups_exits(tmp_path):
     """Daemon with no valid groups exits cleanly."""
@@ -188,19 +199,18 @@ async def test_daemon_no_groups_exits(tmp_path):
 
     assert len(daemon._chat_stores) == 0
 
-
 @pytest.mark.asyncio
 async def test_daemon_index_change_pushes_to_peers(tmp_path, shared_dir, gek, hub_pk_pem):
     """Index change callback pushes updated index to WebRTC peers."""
     config = Config(
         hub=HubConfig(url="http://localhost:9999", username="testuser"),
-        node=NodeConfig(port=29000, quic_port=29010, http_port=29001, ui_port=28000),
+        node=NodeConfig(quic_port=_free_port(), ui_port=_free_port()),
         groups=[GroupConfig(
             id="a" * 32,
             name="test-group",
             shared_dir=str(shared_dir),
             visibility="private",
-            port=29000, quic_port=29010, http_port=29001,
+            quic_port=29010,
         )],
         keystore=KeystoreConfig(path=tmp_path / "keystore.enc"),
         data_dir=tmp_path / "data",
@@ -232,10 +242,45 @@ async def test_daemon_index_change_pushes_to_peers(tmp_path, shared_dir, gek, hu
     assert msg["group_id"] == "a" * 32
     assert len(msg["entries"]) == indexer.index.count
 
+    # Finding H7: this group is private, so its content hashes must NOT be
+    # registered with the hub. The test previously asserted the opposite —
+    # publishing a fingerprint of every private file was treated as expected
+    # behaviour. Index push to members is unaffected (asserted above).
+    await asyncio.sleep(0.1)
+    daemon._hub.register_swarm.assert_not_called()
+
+@pytest.mark.asyncio
+async def test_daemon_index_change_registers_swarm_for_public_group(
+        tmp_path, shared_dir, gek, hub_pk_pem):
+    """Public groups still register content hashes with the hub swarm (H7)."""
+    config = Config(
+        hub=HubConfig(url="http://localhost:9999", username="testuser"),
+        node=NodeConfig(quic_port=_free_port(), ui_port=_free_port()),
+        groups=[GroupConfig(
+            id="a" * 32,
+            name="public-group",
+            shared_dir=str(shared_dir),
+            visibility="public",
+            quic_port=29010,
+        )],
+        keystore=KeystoreConfig(path=tmp_path / "keystore.enc"),
+        data_dir=tmp_path / "data",
+    )
+    daemon = NodeDaemon(config)
+    daemon._hub = AsyncMock()
+    daemon._hub.register_swarm = AsyncMock(return_value=2)
+    daemon._state["endpoint_hint"] = "node123"
+
+    indexer = DirectoryIndexer(
+        root=shared_dir, group_id="a" * 32,
+        sk_node=Ed25519PrivateKey.generate(), gek=gek)
+    await indexer.initial_scan()
+
+    await daemon._on_index_change(indexer)
+
     await asyncio.sleep(0.1)
     daemon._hub.register_swarm.assert_called_once()
-    call_args = daemon._hub.register_swarm.call_args
-    assert len(call_args[0][0]) == indexer.index.count
+    assert len(daemon._hub.register_swarm.call_args[0][0]) == indexer.index.count
 
 
 @pytest.mark.asyncio
diff --git a/packages/meshbay-node/tests/test_http_server.py b/packages/meshbay-node/tests/test_http_server.py
deleted file mode 100644
index d4ccc32..0000000
--- a/packages/meshbay-node/tests/test_http_server.py
+++ /dev/null
@@ -1,227 +0,0 @@
-"""Tests for the node HTTP file API."""
-
-import asyncio
-import base64
-import json
-import os
-import time
-import pytest
-import jwt
-import httpx
-from pathlib import Path
-from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
-from cryptography.hazmat.primitives import serialization
-
-from meshbay_common.crypto import generate_gek, pk_to_b64
-from meshbay_node.indexer import DirectoryIndexer
-from meshbay_node.transport.http_server import create_http_app
-
-
-@pytest.fixture
-def sk_node():
-    return Ed25519PrivateKey.generate()
-
-@pytest.fixture
-def sk_hub():
-    return Ed25519PrivateKey.generate()
-
-@pytest.fixture
-def hub_pk_pem(sk_hub):
-    return sk_hub.public_key().public_bytes(
-        serialization.Encoding.PEM, serialization.PublicFormat.SubjectPublicKeyInfo)
-
-@pytest.fixture
-def gek():
-    return generate_gek()
-
-@pytest.fixture
-def shared_dir(tmp_path):
-    d = tmp_path / "shared"
-    d.mkdir()
-    (d / "video.mp4").write_bytes(os.urandom(3 * 1024 * 1024))  # 3MB
-    (d / "doc.pdf").write_bytes(os.urandom(512 * 1024))
-    (d / "song.mp3").write_bytes(os.urandom(256 * 1024))
-    return d
-
-def make_token(sk_hub, pk_node_b64, ttl=3600):
-    sk_pem = sk_hub.private_bytes(
-        serialization.Encoding.PEM, serialization.PrivateFormat.PKCS8,
-        serialization.NoEncryption())
-    now = int(time.time())
-    return jwt.encode({
-        "iss": "test-hub", "sub": "user-001",
-        "pk_user": pk_node_b64, "hub_id": "test-hub",
-        "jti": "test-jti", "iat": now, "exp": now + ttl,
-    }, sk_pem, algorithm="EdDSA")
-
-
-@pytest.mark.asyncio
-async def test_node_info(sk_node, sk_hub, hub_pk_pem, gek, shared_dir):
-    indexer = DirectoryIndexer(root=shared_dir, group_id="g", sk_node=sk_node, gek=gek)
-    await indexer.initial_scan()
-
-    app = create_http_app(
-        sk_node=sk_node, hub_pk_pem=hub_pk_pem,
-        shared_root=shared_dir, index=indexer.index,
-        group_id="test-group", group_name="Test Group",
-    )
-    async with httpx.AsyncClient(
-        transport=httpx.ASGITransport(app=app), base_url="http://test"
-    ) as c:
-        r = await c.get("/")
-        assert r.status_code == 200
-        data = r.json()
-        assert data["group_id"] == "test-group"
-        assert data["file_count"] == 3
-        assert "pk_node" in data
-
-
-@pytest.mark.asyncio
-async def test_public_index(sk_node, sk_hub, hub_pk_pem, shared_dir):
-    """Public group: index accessible without auth."""
-    indexer = DirectoryIndexer(root=shared_dir, group_id="g", sk_node=sk_node, gek=None)
-    await indexer.initial_scan()
-
-    app = create_http_app(
-        sk_node=sk_node, hub_pk_pem=hub_pk_pem,
-        shared_root=shared_dir, index=indexer.index,
-        group_id="pub-group", group_name="Public Group",
-        gek=None,
-    )
-    async with httpx.AsyncClient(
-        transport=httpx.ASGITransport(app=app), base_url="http://test"
-    ) as c:
-        r = await c.get("/index")
-        assert r.status_code == 200
-        data = r.json()
-        assert len(data["entries"]) == 3
-        names = {e["name"] for e in data["entries"]}
-        assert "video.mp4" in names
-        assert "doc.pdf" in names
-
-
-@pytest.mark.asyncio
-async def test_file_download(sk_node, sk_hub, hub_pk_pem, shared_dir):
-    """Full file download via HTTP."""
-    indexer = DirectoryIndexer(root=shared_dir, group_id="g", sk_node=sk_node, gek=None)
-    await indexer.initial_scan()
-
-    app = create_http_app(
-        sk_node=sk_node, hub_pk_pem=hub_pk_pem,
-        shared_root=shared_dir, index=indexer.index,
-        group_id="g", group_name="G",
-    )
-    entry = next(e for e in indexer.index.entries if e.name == "doc.pdf")
-    original = (shared_dir / "doc.pdf").read_bytes()
-
-    async with httpx.AsyncClient(
-        transport=httpx.ASGITransport(app=app), base_url="http://test"
-    ) as c:
-        r = await c.get(f"/file/{entry.id}")
-        assert r.status_code == 200
-        assert r.content == original
-
-
-@pytest.mark.asyncio
-async def test_chunk_public_group(sk_node, sk_hub, hub_pk_pem, shared_dir):
-    """Public group chunk: plaintext, signed, auth required."""
-    indexer = DirectoryIndexer(root=shared_dir, group_id="g", sk_node=sk_node, gek=None)
-    await indexer.initial_scan()
-
-    app = create_http_app(
-        sk_node=sk_node, hub_pk_pem=hub_pk_pem,
-        shared_root=shared_dir, index=indexer.index,
-        group_id="g", group_name="G", gek=None,
-    )
-    entry = next(e for e in indexer.index.entries if e.name == "video.mp4")
-    token = make_token(sk_hub, pk_to_b64(sk_node.public_key()))
-
-    async with httpx.AsyncClient(
-        transport=httpx.ASGITransport(app=app), base_url="http://test"
-    ) as c:
-        r = await c.get(f"/file/{entry.id}/0",
-                        headers={"Authorization": f"Bearer {token}"})
-        assert r.status_code == 200
-        chunk = r.json()
-        assert chunk["encrypted"] is False
-        assert chunk["chunk_index"] == 0
-        assert "data_b64" in chunk
-
-        # Verify the chunk data matches original
-        original = (shared_dir / "video.mp4").read_bytes()
-        data = base64.b64decode(chunk["data_b64"])
-        assert data == original[:len(data)]
-
-
-@pytest.mark.asyncio
-async def test_chunk_private_group(sk_node, sk_hub, hub_pk_pem, gek, shared_dir):
-    """Private group chunk: encrypted with GEK."""
-    from meshbay_common.webcrypto import chunk_key_aes as derive_chunk_key, decrypt_chunk_aes as decrypt_chunk
-    import blake3
-
-    indexer = DirectoryIndexer(root=shared_dir, group_id="g", sk_node=sk_node, gek=gek)
-    await indexer.initial_scan()
-
-    app = create_http_app(
-        sk_node=sk_node, hub_pk_pem=hub_pk_pem,
-        shared_root=shared_dir, index=indexer.index,
-        group_id="g", group_name="G", gek=gek,
-    )
-    entry = next(e for e in indexer.index.entries if e.name == "doc.pdf")
-    token = make_token(sk_hub, pk_to_b64(sk_node.public_key()))
-
-    async with httpx.AsyncClient(
-        transport=httpx.ASGITransport(app=app), base_url="http://test"
-    ) as c:
-        r = await c.get(f"/file/{entry.id}/0",
-                        headers={"Authorization": f"Bearer {token}"})
-        assert r.status_code == 200
-        chunk = r.json()
-        assert chunk["encrypted"] is True
-
-        # Decrypt and verify
-        file_hash = base64.b64decode(chunk["file_hash_b64"])
-        nonce     = base64.b64decode(chunk["nonce_b64"])
-        ct        = base64.b64decode(chunk["ct_b64"])
-        ckey      = derive_chunk_key(gek, file_hash, 0)
-        plaintext = decrypt_chunk(ckey, nonce, ct)
-        original  = (shared_dir / "doc.pdf").read_bytes()
-        assert plaintext == original[:len(plaintext)]
-
-
-@pytest.mark.asyncio
-async def test_chunk_requires_auth(sk_node, hub_pk_pem, shared_dir):
-    """Chunk endpoint rejects unauthenticated requests."""
-    indexer = DirectoryIndexer(root=shared_dir, group_id="g", sk_node=sk_node, gek=None)
-    await indexer.initial_scan()
-    app = create_http_app(
-        sk_node=sk_node, hub_pk_pem=hub_pk_pem,
-        shared_root=shared_dir, index=indexer.index,
-        group_id="g", group_name="G",
-    )
-    entry = indexer.index.entries[0]
-
-    async with httpx.AsyncClient(
-        transport=httpx.ASGITransport(app=app), base_url="http://test"
-    ) as c:
-        r = await c.get(f"/file/{entry.id}/0")   # no token
-        assert r.status_code == 401
-
-
-@pytest.mark.asyncio
-async def test_unknown_file_404(sk_node, hub_pk_pem, sk_hub, shared_dir):
-    indexer = DirectoryIndexer(root=shared_dir, group_id="g", sk_node=sk_node, gek=None)
-    await indexer.initial_scan()
-    app = create_http_app(
-        sk_node=sk_node, hub_pk_pem=hub_pk_pem,
-        shared_root=shared_dir, index=indexer.index,
-        group_id="g", group_name="G",
-    )
-    token = make_token(sk_hub, pk_to_b64(sk_node.public_key()))
-
-    async with httpx.AsyncClient(
-        transport=httpx.ASGITransport(app=app), base_url="http://test"
-    ) as c:
-        r = await c.get("/file/nonexistent-hash/0",
-                        headers={"Authorization": f"Bearer {token}"})
-        assert r.status_code == 404
diff --git a/packages/meshbay-node/tests/test_quic_transport.py b/packages/meshbay-node/tests/test_quic_transport.py
index 0c1a1cd..93ab1b0 100644
--- a/packages/meshbay-node/tests/test_quic_transport.py
+++ b/packages/meshbay-node/tests/test_quic_transport.py
@@ -49,7 +49,8 @@ def make_jwt(sk_hub, pk_node_b64, ttl=3600, groups=None):
         "iss": "test-hub", "sub": "user-001",
         "pk_user": pk_node_b64, "hub_id": "test-hub",
         "jti": "test-jti", "iat": now, "exp": now + ttl,
-        "groups": groups or [],
+        # group_id is mandatory (M1), so default tokens are members of "g".
+        "groups": groups if groups is not None else ["g"],
     }, sk_pem, algorithm="EdDSA")
 
 
@@ -80,6 +81,7 @@ async def test_quic_chunk_roundtrip(sk_node, sk_hub, gek, shared_dir, tmp_path):
         host="127.0.0.1", port=19100,
         jwt_token=token, gek=gek,
         pk_node_b64=pk_to_b64(sk_node.public_key()),
+        group_id="g",
     ) as client:
         chunk0 = await client.fetch_chunk(entry.id, chunk_index=0)
         chunk1 = await client.fetch_chunk(entry.id, chunk_index=1)
@@ -116,6 +118,7 @@ async def test_quic_fetch_index(sk_node, sk_hub, gek, shared_dir, tmp_path):
         host="127.0.0.1", port=19101,
         jwt_token=token, gek=gek,
         pk_node_b64=pk_to_b64(sk_node.public_key()),
+        group_id="g",
     ) as client:
         wire = await client.fetch_index()
         recovered = GroupIndex.deserialize(wire, sk_node=sk_node, gek=gek)
@@ -220,10 +223,12 @@ async def test_quic_session_resumption(sk_node, sk_hub, gek, shared_dir, tmp_pat
     async with QuicChunkClient(
         host="127.0.0.1", port=19104,
         jwt_token=token, gek=gek, pk_node_b64=pk_b64,
+            group_id="g",
     ) as client:
         wire = await client.fetch_index()
         assert GroupIndex.deserialize(wire, sk_node=sk_node, gek=gek).count == 2
         saved_ticket = client.session_ticket
+        saved_cert = client.peer_cert_der
 
     # Allow server to process the close
     await asyncio.sleep(0.1)
@@ -233,6 +238,10 @@ async def test_quic_session_resumption(sk_node, sk_hub, gek, shared_dir, tmp_pat
         host="127.0.0.1", port=19104,
         jwt_token=token, gek=gek, pk_node_b64=pk_b64,
         session_ticket=saved_ticket,
+        # A resumed session carries no certificate, so the binding anchor from the
+        # original handshake travels with the ticket (11.5.6).
+        peer_cert_der=saved_cert,
+            group_id="g",
     ) as client:
         wire = await client.fetch_index()
         assert GroupIndex.deserialize(wire, sk_node=sk_node, gek=gek).count == 2
@@ -269,6 +278,7 @@ async def test_quic_denylist_blocks_user(sk_node, sk_hub, gek, shared_dir, tmp_p
     async with QuicChunkClient(
         host="127.0.0.1", port=19105,
         jwt_token=token, gek=gek, pk_node_b64=pk_b64,
+            group_id="g",
     ) as client:
         wire = await client.fetch_index()
         assert GroupIndex.deserialize(wire, sk_node=sk_node, gek=gek).count == 2
@@ -281,6 +291,7 @@ async def test_quic_denylist_blocks_user(sk_node, sk_hub, gek, shared_dir, tmp_p
         async with QuicChunkClient(
             host="127.0.0.1", port=19105,
             jwt_token=token, gek=gek, pk_node_b64=pk_b64,
+            group_id="g",
         ) as client:
             await client.fetch_index()
 
diff --git a/packages/meshbay-node/tests/test_roster_pairing.py b/packages/meshbay-node/tests/test_roster_pairing.py
new file mode 100644
index 0000000..665c060
--- /dev/null
+++ b/packages/meshbay-node/tests/test_roster_pairing.py
@@ -0,0 +1,744 @@
+"""
+Roster and operator pairing (M3, and the mechanism that will close H3).
+
+Negative assertions, per the posture set in Phase 11.5: each test states an attack
+or a mistake that must not work. The one to keep an eye on is
+`test_daemon_does_not_auto_pin_keystore_key` — the auto-pin is what made node
+sovereignty inert as shipped, and it fails closed, so nothing else in the suite
+notices if it comes back.
+
+See `docs/invite-pairing-v1.md`.
+"""
+
+import base64
+import time
+from pathlib import Path
+
+import pytest
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey
+
+from meshbay_common.crypto import generate_gek, pk_to_b64, unwrap_gek_aes
+from meshbay_common.join import ROLE_MEMBER, ROLE_OPERATOR, join_transcript
+from meshbay_node.indexer.group_index import GroupIndex
+from meshbay_node.roster import Roster, hash_code, normalize_code
+from meshbay_node.transport.webrtc_server import WebRTCPeerSession
+
+
+# ── Fixtures ──────────────────────────────────────────────────────────────────
+
+@pytest.fixture
+async def roster(tmp_path):
+    r = Roster(db_path=tmp_path / "roster.db")
+    await r.open()
+    yield r
+    await r.close()
+
+
+def _keypair_full():
+    """(sk_ed, pk_ed_b64, pk_x_b64, sk_x) — the X25519 secret is needed to unwrap."""
+    sk_ed = Ed25519PrivateKey.generate()
+    sk_x = X25519PrivateKey.generate()
+    pk_ed_b64 = pk_to_b64(sk_ed.public_key())
+    pk_x_b64 = base64.b64encode(
+        sk_x.public_key().public_bytes(
+            encoding=serialization.Encoding.Raw,
+            format=serialization.PublicFormat.Raw,
+        )
+    ).decode()
+    return sk_ed, pk_ed_b64, pk_x_b64, sk_x
+
+
+def _keypair():
+    sk_ed, pk_ed_b64, pk_x_b64, _ = _keypair_full()
+    return sk_ed, pk_ed_b64, pk_x_b64
+
+
+def _session(tmp_path: Path, roster, user_id: str = "grenet",
+             group_id: str | None = None, gek: bytes | None = None,
+             join_policy: str = "invite") -> WebRTCPeerSession:
+    """A peer session with the join path wired and sending stubbed out."""
+    shared_root = tmp_path / "shared"
+    shared_root.mkdir(exist_ok=True)
+    index = GroupIndex(group_id="g" * 32, sk_node=Ed25519PrivateKey.generate())
+
+    session = WebRTCPeerSession.__new__(WebRTCPeerSession)
+    session._ctx = {
+        "shared_root": shared_root,
+        "index": index,
+        "sk_node": index.sk_node,
+        "roster": roster,
+    }
+    if group_id:
+        session._ctx["groups"] = {
+            group_id: {
+                "gek": gek,
+                "shared_root": shared_root,
+                "index": index,
+                "join_policy": join_policy,
+            },
+        }
+    session._group_id = group_id
+    session._user_id = user_id
+    session._username = user_id
+    session._pk_user = ""
+    session._uploads = {}
+    session._join_attempts = 0
+    session._nonce_node = b"\x11" * 32
+    session._remote_ip = ""
+    session.sent = []
+    session._send = session.sent.append
+    session._audit = lambda *a, **k: None
+    return session
+
+
+def _join_msg(session, sk_ed, pk_ed_b64, pk_x_b64, code="", user_id="grenet",
+              group_id="", nonce=None, ts=None):
+    ts = int(time.time()) if ts is None else ts
+    transcript = join_transcript(
+        node_pk_b64=session._node_pk_b64(),
+        group_id=group_id,
+        user_id=user_id,
+        pk_ed25519_b64=pk_ed_b64,
+        pk_x25519_b64=pk_x_b64,
+        nonce_node=nonce if nonce is not None else session._nonce_node,
+        ts=ts,
+    )
+    return {
+        "type": "join_request",
+        "group_id": group_id,
+        "pk_ed25519": pk_ed_b64,
+        "pk_x25519": pk_x_b64,
+        "code": code,
+        "ts": ts,
+        "sig": base64.b64encode(sk_ed.sign(transcript)).decode(),
+    }
+
+
+def _last(session):
+    return session.sent[-1] if session.sent else {}
+
+
+# ── Roster ────────────────────────────────────────────────────────────────────
+
+async def test_invite_is_single_use(roster):
+    code = await roster.create_invite("", "grenet", ROLE_OPERATOR, "local-cli")
+    assert await roster.consume_invite(code, "grenet") is not None
+    assert await roster.consume_invite(code, "grenet") is None, (
+        "a pairing code must not be redeemable twice")
+
+
+async def test_invite_is_bound_to_one_account(roster):
+    """A leaked code must be useless to whoever finds it."""
+    code = await roster.create_invite("", "grenet", ROLE_OPERATOR, "local-cli")
+    assert await roster.consume_invite(code, "eve") is None
+    assert await roster.consume_invite(code, "grenet") is not None
+
+
+async def test_expired_invite_is_refused(roster):
+    code = await roster.create_invite("", "grenet", ROLE_OPERATOR, "local-cli", ttl=-1)
+    assert await roster.consume_invite(code, "grenet") is None
+
+
+async def test_reinvite_supersedes_the_previous_code(roster):
+    first = await roster.create_invite("", "grenet", ROLE_OPERATOR, "local-cli")
+    second = await roster.create_invite("", "grenet", ROLE_OPERATOR, "local-cli")
+    assert await roster.consume_invite(first, "grenet") is None
+    assert await roster.consume_invite(second, "grenet") is not None
+
+
+async def test_codes_are_not_stored_in_the_clear(roster, tmp_path):
+    code = await roster.create_invite("", "grenet", ROLE_OPERATOR, "local-cli")
+    rows = await roster.list_invites()
+    assert rows and rows[0]["code_hash"] != normalize_code(code)
+    assert rows[0]["code_hash"] == hash_code(code)
+
+
+def test_code_normalization_absorbs_human_error():
+    """Someone reading a code aloud must not be able to get it wrong."""
+    assert normalize_code("k7m2-qx4p") == normalize_code("K7M2QX4P")
+    assert normalize_code("O1IL") == "0111"
+    assert normalize_code(" k7m2 qx4p ") == "K7M2QX4P"
+
+
+async def test_operator_pks_reflect_unpinning(roster):
+    _, pk_ed_b64, pk_x_b64 = _keypair()
+    await roster.pin_identity("grenet", "grenet", pk_ed_b64, pk_x_b64, "code")
+    await roster.set_member("", "grenet", ROLE_OPERATOR, "active", "local-cli")
+    assert await roster.operator_pks() == [pk_ed_b64]
+
+    await roster.unpin("grenet")
+    assert await roster.operator_pks() == [], (
+        "authority must disappear with the pin, without a daemon restart")
+
+
+# ── Join / pairing over MNP ───────────────────────────────────────────────────
+
+async def test_pairing_with_a_valid_code_pins_the_identity(tmp_path, roster):
+    session = _session(tmp_path, roster)
+    sk_ed, pk_ed_b64, pk_x_b64 = _keypair()
+    code = await roster.create_invite("", "grenet", ROLE_OPERATOR, "local-cli")
+
+    await session._do_join_request(
+        _join_msg(session, sk_ed, pk_ed_b64, pk_x_b64, code=code))
+
+    assert _last(session).get("ok") is True
+    pinned = await roster.get_identity("grenet")
+    assert pinned["pk_ed25519"] == pk_ed_b64
+    assert await roster.operator_pks() == [pk_ed_b64]
+
+
+async def test_pairing_without_a_code_is_refused(tmp_path, roster):
+    """Fails closed: an unknown identity gets nothing until someone authorizes it."""
+    session = _session(tmp_path, roster)
+    sk_ed, pk_ed_b64, pk_x_b64 = _keypair()
+
+    await session._do_join_request(_join_msg(session, sk_ed, pk_ed_b64, pk_x_b64))
+
+    assert _last(session).get("ok") is False
+    assert _last(session).get("reason") == "code_required"
+    assert await roster.get_identity("grenet") is None
+
+
+async def test_wrong_code_pins_nothing(tmp_path, roster):
+    session = _session(tmp_path, roster)
+    sk_ed, pk_ed_b64, pk_x_b64 = _keypair()
+    await roster.create_invite("", "grenet", ROLE_OPERATOR, "local-cli")
+
+    await session._do_join_request(
+        _join_msg(session, sk_ed, pk_ed_b64, pk_x_b64, code="ZZZZ-ZZZZ"))
+
+    assert _last(session).get("reason") == "code_invalid"
+    assert await roster.get_identity("grenet") is None
+
+
+async def test_signature_must_cover_the_presented_keys(tmp_path, roster):
+    """
+    The heart of it: the X25519 key is only trustworthy because the Ed25519
+    identity signed it. Swapping in another encryption key after signing must fail.
+    """
+    session = _session(tmp_path, roster)
+    sk_ed, pk_ed_b64, pk_x_b64 = _keypair()
+    code = await roster.create_invite("", "grenet", ROLE_OPERATOR, "local-cli")
+
+    msg = _join_msg(session, sk_ed, pk_ed_b64, pk_x_b64, code=code)
+    _, _, attacker_pk_x = _keypair()
+    msg["pk_x25519"] = attacker_pk_x
+
+    await session._do_join_request(msg)
+
+    assert _last(session).get("reason") == "signature_invalid"
+    assert await roster.get_identity("grenet") is None
+
+
+async def test_join_cannot_be_replayed_onto_another_connection(tmp_path, roster):
+    session = _session(tmp_path, roster)
+    sk_ed, pk_ed_b64, pk_x_b64 = _keypair()
+    code = await roster.create_invite("", "grenet", ROLE_OPERATOR, "local-cli")
+
+    # Signed against a nonce this connection never issued.
+    msg = _join_msg(session, sk_ed, pk_ed_b64, pk_x_b64, code=code,
+                    nonce=b"\x99" * 32)
+    await session._do_join_request(msg)
+
+    assert _last(session).get("reason") == "signature_invalid"
+    assert await roster.get_identity("grenet") is None
+
+
+async def test_pinned_identity_presenting_a_new_key_is_refused(tmp_path, roster):
+    """
+    11.5.8's rule, applied to people: a changed key is refused outright rather
+    than warned about, and clearing it is a deliberate operator action.
+    """
+    session = _session(tmp_path, roster)
+    _, old_pk_ed, old_pk_x = _keypair()
+    await roster.pin_identity("grenet", "grenet", old_pk_ed, old_pk_x, "code")
+
+    sk_ed2, new_pk_ed, new_pk_x = _keypair()
+    await session._do_join_request(
+        _join_msg(session, sk_ed2, new_pk_ed, new_pk_x, code="ANY-CODE"))
+
+    assert _last(session).get("reason") == "key_changed"
+    assert (await roster.get_identity("grenet"))["pk_ed25519"] == old_pk_ed
+
+
+async def test_attempts_are_bounded(tmp_path, roster):
+    session = _session(tmp_path, roster)
+    sk_ed, pk_ed_b64, pk_x_b64 = _keypair()
+    await roster.create_invite("", "grenet", ROLE_OPERATOR, "local-cli")
+
+    for _ in range(6):
+        await session._do_join_request(
+            _join_msg(session, sk_ed, pk_ed_b64, pk_x_b64, code="AAAA-AAAA"))
+
+    assert any(m.get("detail") == "Too many attempts" for m in session.sent), (
+        "a connection must not be able to sit there guessing codes")
+
+
+async def test_failures_are_counted_across_connections(tmp_path, roster):
+    """
+    The adversary who can mint a token for any account is the hub, and it can
+    reconnect at will — so a per-connection budget alone would bound nothing.
+    """
+    shared_ctx = None
+    for _ in range(6):
+        session = _session(tmp_path, roster)
+        if shared_ctx is None:
+            shared_ctx = session._ctx
+        else:
+            session._ctx = shared_ctx          # same node, new connection
+        sk_ed, pk_ed_b64, pk_x_b64 = _keypair()
+        for _ in range(4):
+            await session._do_join_request(
+                _join_msg(session, sk_ed, pk_ed_b64, pk_x_b64, code="AAAA-AAAA"))
+
+    assert any(m.get("detail") == "Pairing temporarily locked"
+               for m in session.sent), (
+        "reconnecting must not reset the pairing budget")
+
+
+async def test_group_id_cannot_name_another_group(tmp_path, roster):
+    session = _session(tmp_path, roster)
+    session._group_id = "a" * 32
+    sk_ed, pk_ed_b64, pk_x_b64 = _keypair()
+
+    await session._do_join_request(
+        _join_msg(session, sk_ed, pk_ed_b64, pk_x_b64, group_id="b" * 32))
+
+    assert _last(session).get("reason") == "group_mismatch"
+
+
+# ── H3: the node wraps the group key, and only for people it admitted ─────────
+
+GROUP = "g" * 32
+
+
+async def test_node_wraps_the_gek_for_the_key_the_member_proved(tmp_path, roster):
+    """
+    The H3 fix. Nobody fetches a public key from the hub: the node encrypts the
+    group key for the X25519 key the joiner signed with their pinned identity, so
+    a hub substituting a key of its own has nothing to substitute into.
+    """
+    gek = generate_gek()
+    session = _session(tmp_path, roster, user_id="bob", group_id=GROUP, gek=gek)
+    sk_ed, pk_ed_b64, pk_x_b64, sk_x = _keypair_full()
+
+    code = await roster.create_invite(GROUP, "bob", ROLE_MEMBER, "grenet")
+    await session._do_join_request(
+        _join_msg(session, sk_ed, pk_ed_b64, pk_x_b64, code=code,
+                  user_id="bob", group_id=GROUP))
+
+    reply = _last(session)
+    assert reply["ok"] is True and reply["gek"] is True
+
+    pk_x_raw = base64.b64decode(pk_x_b64)
+    sk_x_raw = sk_x.private_bytes(
+        encoding=serialization.Encoding.Raw,
+        format=serialization.PrivateFormat.Raw,
+        encryption_algorithm=serialization.NoEncryption(),
+    )
+    assert unwrap_gek_aes(reply, sk_x_raw, pk_x_raw) == gek
+
+
+async def test_hub_membership_alone_yields_no_key(tmp_path, roster):
+    """
+    A hub can invent an account, add it to a group and mint it a token. What it
+    cannot do is put it on the node's roster — so the key never leaves.
+    """
+    gek = generate_gek()
+    session = _session(tmp_path, roster, user_id="eve", group_id=GROUP, gek=gek)
+    sk_ed, pk_ed_b64, pk_x_b64 = _keypair()
+
+    # Pinned on this node (say, for another group) but never admitted to this one.
+    await roster.pin_identity("eve", "eve", pk_ed_b64, pk_x_b64, "code")
+
+    await session._do_join_request(
+        _join_msg(session, sk_ed, pk_ed_b64, pk_x_b64,
+                  user_id="eve", group_id=GROUP))
+
+    reply = _last(session)
+    assert reply.get("gek") is False
+    assert reply.get("reason") == "not_authorized_for_group"
+    assert "wrapped_b64" not in reply
+
+
+async def test_open_join_group_admits_without_a_code(tmp_path, roster):
+    """§3.4: where anyone may join, a code protects nothing and is not required."""
+    gek = generate_gek()
+    session = _session(tmp_path, roster, user_id="newcomer", group_id=GROUP,
+                       gek=gek, join_policy="open")
+    sk_ed, pk_ed_b64, pk_x_b64 = _keypair()
+
+    await session._do_join_request(
+        _join_msg(session, sk_ed, pk_ed_b64, pk_x_b64,
+                  user_id="newcomer", group_id=GROUP))
+
+    reply = _last(session)
+    assert reply["ok"] is True and reply["gek"] is True
+    pinned = await roster.get_identity("newcomer")
+    assert pinned["pinned_via"] == "tofu"
+
+
+async def test_invite_only_group_still_demands_a_code(tmp_path, roster):
+    """Being public (discoverable) is not being open (admitting anyone)."""
+    gek = generate_gek()
+    session = _session(tmp_path, roster, user_id="newcomer", group_id=GROUP,
+                       gek=gek, join_policy="invite")
+    sk_ed, pk_ed_b64, pk_x_b64 = _keypair()
+
+    await session._do_join_request(
+        _join_msg(session, sk_ed, pk_ed_b64, pk_x_b64,
+                  user_id="newcomer", group_id=GROUP))
+
+    assert _last(session).get("reason") == "code_required"
+    assert await roster.get_identity("newcomer") is None
+
+
+async def test_unknown_group_is_invite_only(tmp_path, roster):
+    """
+    Fail closed: a group whose policy the node cannot read is treated as
+    invite-only, never as open.
+    """
+    session = _session(tmp_path, roster, user_id="newcomer")
+    session._group_id = "unconfigured-group"
+    assert session._group_join_policy("unconfigured-group") == "invite"
+    assert session._group_join_policy("") == "invite"
+
+
+def test_join_policy_is_carried_from_node_config():
+    """
+    The policy reaches the transport from node.toml. If it ever came from the hub
+    instead, a hub could declare any group open and be handed its key.
+    """
+    daemon_src = (Path(__file__).parent.parent
+                  / "src" / "meshbay_node" / "daemon.py").read_text()
+    assert '"join_policy": group_cfg.join_policy' in daemon_src
+
+    config_src = (Path(__file__).parent.parent
+                  / "src" / "meshbay_node" / "config.py").read_text()
+    assert "join_policy" in config_src, "GroupConfig must carry the admission policy"
+
+
+async def test_revoked_member_stops_receiving_the_key(tmp_path, roster):
+    """
+    Wrapping on demand is what makes revocation work. A stored bundle survived
+    revocation; this does not. (Rotating the GEK is still required — the
+    ex-member has the old one.)
+    """
+    gek = generate_gek()
+    session = _session(tmp_path, roster, user_id="bob", group_id=GROUP, gek=gek)
+    sk_ed, pk_ed_b64, pk_x_b64 = _keypair()
+    await roster.pin_identity("bob", "bob", pk_ed_b64, pk_x_b64, "code")
+    await roster.set_member(GROUP, "bob", ROLE_MEMBER, "active", "grenet")
+
+    await session._do_join_request(
+        _join_msg(session, sk_ed, pk_ed_b64, pk_x_b64,
+                  user_id="bob", group_id=GROUP))
+    assert _last(session)["gek"] is True
+
+    await roster.set_status(GROUP, "bob", "revoked")
+    session.sent.clear()
+    await session._do_join_request(
+        _join_msg(session, sk_ed, pk_ed_b64, pk_x_b64,
+                  user_id="bob", group_id=GROUP))
+    assert _last(session).get("gek") is False
+
+
+# ── What a first-time joiner can know ─────────────────────────────────────────
+
+def test_challenge_carries_node_pk_in_source():
+    """
+    Belt and braces for the above: the field must be in the message the node
+    builds, whatever the surrounding handshake does.
+    """
+    source = (Path(__file__).parent.parent
+              / "src" / "meshbay_node" / "transport" / "webrtc_server.py").read_text()
+    challenge = source[source.find("MNP.HANDSHAKE_CHALLENGE,"):]
+    challenge = challenge[:challenge.find("})")]
+    assert "node_pk" in challenge, (
+        "the challenge must announce the node key — a first-time joiner cannot "
+        "learn it any other way, and join_request signs it")
+
+
+async def test_a_key_pinned_by_one_node_is_worthless_at_another(tmp_path, roster):
+    """
+    The whole point of per-node identity: node A's operator who cracks the bundle
+    on their own disk holds a key node B has never seen. Presenting it there is a
+    first contact like any other — it needs a code from B's operator.
+    """
+    gek = generate_gek()
+    node_b = _session(tmp_path, roster, user_id="bob", group_id=GROUP, gek=gek)
+
+    # The key bob uses at node A. Node B's roster knows nothing about it.
+    sk_ed_a, pk_ed_a, pk_x_a = _keypair()
+
+    await node_b._do_join_request(
+        _join_msg(node_b, sk_ed_a, pk_ed_a, pk_x_a,
+                  user_id="bob", group_id=GROUP))
+
+    assert _last(node_b).get("reason") == "code_required"
+    assert await roster.get_identity("bob") is None
+
+
+async def test_the_stolen_key_cannot_be_forced_in_with_someone_elses_code(
+        tmp_path, roster):
+    """And a code issued for another account does not help either."""
+    gek = generate_gek()
+    session = _session(tmp_path, roster, user_id="eve", group_id=GROUP, gek=gek)
+    sk_ed, pk_ed, pk_x = _keypair()
+    code = await roster.create_invite(GROUP, "bob", ROLE_MEMBER, "grenet")
+
+    await session._do_join_request(
+        _join_msg(session, sk_ed, pk_ed, pk_x, code=code,
+                  user_id="eve", group_id=GROUP))
+
+    assert _last(session).get("reason") == "code_invalid"
+    assert await roster.get_identity("eve") is None
+
+
+# ── Code lifetimes ────────────────────────────────────────────────────────────
+
+async def test_invitations_outlive_pairing_codes(roster):
+    """
+    An invitation crosses a human conversation; a pairing code crosses an SSH
+    session. A day was long enough for the second and not for the first — a code
+    that dies over a weekend means someone has to be at a browser to reissue it.
+    """
+    from meshbay_node.roster import DEFAULT_INVITE_TTL, DEFAULT_PAIR_TTL
+
+    assert DEFAULT_INVITE_TTL == 7 * 24 * 3600
+    assert DEFAULT_PAIR_TTL == 24 * 3600
+    assert DEFAULT_INVITE_TTL > DEFAULT_PAIR_TTL
+
+
+def test_code_lifetimes_are_configurable(tmp_path):
+    """The operator decides, not the default."""
+    from meshbay_node.config import load_config
+
+    path = tmp_path / "node.toml"
+    path.write_text(
+        '[hub]\nurl = "https://example.org"\nusername = "grenet"\n'
+        "[node]\ninvite_ttl_hours = 72\npair_ttl_hours = 2\n"
+    )
+    cfg = load_config(path)
+    assert cfg.node.invite_ttl_hours == 72
+    assert cfg.node.pair_ttl_hours == 2
+
+    default = load_config(tmp_path / "missing.toml")
+    assert default.node.invite_ttl_hours == 168
+    assert default.node.pair_ttl_hours == 24
+
+
+async def test_expiry_is_enforced_at_redemption(tmp_path, roster):
+    """Purging is housekeeping; the check that matters happens on use."""
+    session = _session(tmp_path, roster)
+    sk_ed, pk_ed_b64, pk_x_b64 = _keypair()
+    code = await roster.create_invite("", "grenet", ROLE_OPERATOR, "local-cli", ttl=-1)
+
+    await session._do_join_request(
+        _join_msg(session, sk_ed, pk_ed_b64, pk_x_b64, code=code))
+
+    assert _last(session).get("reason") == "code_invalid"
+    assert await roster.get_identity("grenet") is None
+
+
+# ── M3: where node authority comes from ───────────────────────────────────────
+
+async def test_admin_signature_verified_against_the_paired_key(tmp_path, roster):
+    session = _session(tmp_path, roster)
+    sk_ed, pk_ed_b64, pk_x_b64 = _keypair()
+    await roster.pin_identity("grenet", "grenet", pk_ed_b64, pk_x_b64, "code")
+    await roster.set_member("", "grenet", ROLE_OPERATOR, "active", "local-cli")
+
+    transcript = b"meshbay:admin:v1 whatever"
+    assert await session._verify_admin_sig(transcript, sk_ed.sign(transcript))
+
+    stranger = Ed25519PrivateKey.generate()
+    assert not await session._verify_admin_sig(
+        transcript, stranger.sign(transcript))
+
+
+async def test_unpinned_operator_loses_authority_immediately(tmp_path, roster):
+    """No caching: revoking a paired browser must not need a daemon restart."""
+    session = _session(tmp_path, roster)
+    sk_ed, pk_ed_b64, pk_x_b64 = _keypair()
+    await roster.pin_identity("grenet", "grenet", pk_ed_b64, pk_x_b64, "code")
+    await roster.set_member("", "grenet", ROLE_OPERATOR, "active", "local-cli")
+
+    transcript = b"meshbay:admin:v1 whatever"
+    assert await session._verify_admin_sig(transcript, sk_ed.sign(transcript))
+
+    await roster.unpin("grenet")
+    assert not await session._verify_admin_sig(transcript, sk_ed.sign(transcript))
+
+
+# ── Operator surface (slice 3) ────────────────────────────────────────────────
+
+def _ui_client(tmp_path, roster, **extra):
+    from fastapi.testclient import TestClient
+
+    from meshbay_node.config import Config
+    from meshbay_node.ui.app import create_ui_app
+
+    state = {
+        "status": "running", "groups_ctx": {GROUP: {"gek": b"k" * 32}},
+        "indexes": {}, "ui_token": "tok", "roster": roster,
+        "node_user_id": "grenet", "config": Config(),
+    }
+    state.update(extra)
+    return TestClient(create_ui_app(state)), state
+
+
+async def test_revoke_endpoint_stops_authorization(tmp_path, roster):
+    client, _ = _ui_client(tmp_path, roster)
+    _, pk_ed_b64, pk_x_b64 = _keypair()
+    await roster.pin_identity("bob", "bob", pk_ed_b64, pk_x_b64, "code")
+    await roster.set_member(GROUP, "bob", ROLE_MEMBER, "active", "grenet")
+    assert await roster.is_authorized(GROUP, "bob")
+
+    resp = client.post(f"/api/members/bob/revoke?group_id={GROUP}&t=tok")
+    assert resp.status_code == 200
+    assert "gek-init" in resp.json()["reminder"], (
+        "revocation must remind the operator to rotate the key they still hold")
+    assert not await roster.is_authorized(GROUP, "bob")
+
+
+async def test_unpin_endpoint_allows_repairing(tmp_path, roster):
+    client, _ = _ui_client(tmp_path, roster)
+    _, pk_ed_b64, pk_x_b64 = _keypair()
+    await roster.pin_identity("bob", "bob", pk_ed_b64, pk_x_b64, "code")
+
+    assert client.post("/api/members/bob/unpin?t=tok").status_code == 200
+    assert await roster.get_identity("bob") is None
+    assert client.post("/api/members/bob/unpin?t=tok").status_code == 404
+
+
+async def test_operator_surface_needs_the_session_token(tmp_path, roster):
+    """11.5.3 applies to every one of these: they change who may hold the key."""
+    client, _ = _ui_client(tmp_path, roster)
+    for path in ("/api/roster",
+                 "/api/operator/pair",
+                 f"/api/members/bob/revoke?group_id={GROUP}",
+                 "/api/members/bob/unpin",
+                 f"/api/groups/{GROUP}/invites?username=bob"):
+        method = client.get if path == "/api/roster" else client.post
+        assert method(path).status_code == 403, f"{path} reachable without a token"
+
+
+async def test_cli_invite_asks_the_hub_for_an_account_never_a_key(tmp_path, roster):
+    """
+    The CLI resolves a username to an account id through the hub, and stops there.
+    A key fetched from the hub is what H3 was; an account id is not a secret and
+    a wrong one produces an invite whose code the hub never learns.
+    """
+    class _Hub:
+        _session = object()
+
+        async def get_user_pubkeys(self, username):
+            return {"user_id": f"id-of-{username}",
+                    "pk_x25519": "SHOULD-NOT-BE-USED",
+                    "pk_ed25519": "SHOULD-NOT-BE-USED"}
+
+    client, _ = _ui_client(tmp_path, roster, hub=_Hub())
+    resp = client.post(f"/api/groups/{GROUP}/invites?username=bob&t=tok")
+    assert resp.status_code == 200
+    body = resp.json()
+    assert body["user_id"] == "id-of-bob"
+
+    invites = await roster.list_invites()
+    assert [i["user_id"] for i in invites] == ["id-of-bob"]
+    # Whatever the hub said about keys was never stored anywhere.
+    assert "SHOULD-NOT-BE-USED" not in str(invites)
+    assert await roster.get_identity("id-of-bob") is None
+
+
+def _run_cli(monkeypatch, tmp_path, argv, responses):
+    """Drive the real CLI with the daemon API stubbed, capturing the calls."""
+    import sys as _sys
+
+    from meshbay_node import daemon as _daemon
+
+    calls = []
+
+    def fake_api(cfg, path, method="GET", timeout=30):
+        calls.append((method, path))
+        for key, value in responses.items():
+            if key in path:
+                return value
+        return {}
+
+    monkeypatch.setattr(_daemon, "_daemon_api", fake_api)
+
+    conf = tmp_path / "node.toml"
+    conf.write_text(
+        f'data_dir = "{tmp_path}"\n'
+        '[hub]\nurl = "https://example.org"\nusername = "grenet"\n'
+        f'[[groups]]\nid = "{GROUP}"\nname = "demo"\n'
+        f'shared_dir = "{tmp_path}"\n'
+    )
+    monkeypatch.setattr(_sys, "argv",
+                        ["meshbay-node", *argv, "--config", str(conf)])
+    try:
+        _daemon.main()
+    except SystemExit as e:
+        calls.append(("exit", e.code))
+    return calls
+
+
+def test_cli_member_commands_reach_the_right_endpoints(monkeypatch, tmp_path, capsys):
+    resolved = {"user_id": "u-bob", "source": "roster"}
+
+    calls = _run_cli(monkeypatch, tmp_path, ["member", "revoke", "bob"],
+                     {"/api/resolve": resolved,
+                      "revoke": {"status": "revoked", "reminder": "gek-init"}})
+    assert ("POST", f"/api/members/u-bob/revoke?group_id={GROUP}") in calls
+    # The operator is told the revocation does not take back the key they hold.
+    assert "rotate" in capsys.readouterr().out.lower()
+
+    calls = _run_cli(monkeypatch, tmp_path, ["member", "unpin", "bob"],
+                     {"/api/resolve": resolved, "unpin": {"status": "unpinned"}})
+    assert ("POST", "/api/members/u-bob/unpin") in calls
+
+
+def test_cli_resolves_a_name_before_acting(monkeypatch, tmp_path):
+    """
+    The name has to be turned into an account first, and the node's own roster is
+    asked before the hub. A JWT carries no username, so an identity pinned without
+    an invitation has none — the hub fallback is what keeps it manageable.
+    """
+    calls = _run_cli(monkeypatch, tmp_path, ["member", "revoke", "bob"],
+                     {"/api/resolve": {"user_id": "u-bob", "source": "hub"},
+                      "revoke": {"status": "revoked", "reminder": "gek-init"}})
+
+    assert ("GET", "/api/resolve?username=bob") == calls[0], (
+        "the CLI must resolve the name before acting on anyone")
+    assert ("POST", f"/api/members/u-bob/revoke?group_id={GROUP}") in calls
+
+def test_daemon_does_not_auto_pin_keystore_key():
+    """
+    M3: the daemon used to auto-pin its own keystore key as the admin key, while
+    the browser signs with the user's identity key. Different keys, so every
+    privileged operation failed closed with a signature error that looked like a
+    bug elsewhere — and the demo only worked because a deploy script overwrote it.
+
+    Authority now comes from the roster, or from an explicit node.toml value.
+    """
+    source = (Path(__file__).parent.parent
+              / "src" / "meshbay_node" / "daemon.py").read_text()
+    assert "Auto-pinning admin key" not in source
+    assert "_resolve_admin_pk" not in source, (
+        "the auto-pin resolver is back — node authority must be established "
+        "locally by pairing, never inferred from the node's own keystore (M3)")
+
+
+def test_admin_authority_is_never_fetched_from_the_hub():
+    """
+    The fix M3 invites: ask the hub which key belongs to the operator. That would
+    hand a malicious hub the node — the same substitution as H3, one level deeper.
+    """
+    source = (Path(__file__).parent.parent
+              / "src" / "meshbay_node" / "daemon.py").read_text()
+    admin_region = source[source.find("_legacy_admin_pk"):]
+    assert "pubkeys" not in admin_region.split("def ")[1], (
+        "node authority must never be resolved through a hub lookup")
diff --git a/packages/meshbay-node/tests/test_security_regressions.py b/packages/meshbay-node/tests/test_security_regressions.py
new file mode 100644
index 0000000..dcd9cf6
--- /dev/null
+++ b/packages/meshbay-node/tests/test_security_regressions.py
@@ -0,0 +1,604 @@
+"""
+Phase 11.5 security regression tests.
+
+Each test here encodes a finding from `second-review.md`. They are negative tests:
+they assert that an attack does NOT work. The pre-11.5 code passed 209 feature
+tests while every one of these attacks succeeded — the suite only ever exercised
+happy paths, never an authorization boundary.
+
+If one of these starts failing, a fix has been reverted. Do not "fix" the test.
+"""
+
+import base64
+import struct
+from pathlib import Path
+
+import pytest
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+from meshbay_common.protocol import IndexEntry
+from meshbay_node.indexer.group_index import GroupIndex
+from meshbay_node.transport.webrtc_server import WebRTCPeerSession
+
+
+def _safe_name_re():
+    """
+    Imported lazily so that a missing allowlist fails the two tests that need it,
+    rather than aborting collection of the whole module and hiding every other
+    finding's result.
+    """
+    from meshbay_node.transport.webrtc_server import SAFE_UPLOAD_NAME
+    return SAFE_UPLOAD_NAME
+
+
+# ── C1: the unauthenticated HTTP file API must stay deleted ───────────────────
+
+def test_http_file_api_is_gone():
+    """
+    C1: transport/http_server.py served GET /index and GET /file/{id} on 0.0.0.0
+    with no authentication, for private groups too. It was deleted rather than
+    patched. Re-adding any module that serves file bytes outside the MNP handshake
+    reintroduces a full confidentiality bypass.
+    """
+    with pytest.raises(ImportError):
+        import meshbay_node.transport.http_server  # noqa: F401
+
+    import meshbay_node.transport as transport
+    assert not hasattr(transport, "create_http_app")
+
+
+def test_tcp_transport_is_gone():
+    """C6: the TCP+TLS server accepted a bare JWT with no GEK proof."""
+    with pytest.raises(ImportError):
+        import meshbay_node.transport.server  # noqa: F401
+
+    import meshbay_node.transport as transport
+    assert not hasattr(transport, "ChunkServer")
+
+
+def test_daemon_exposes_no_plaintext_listener():
+    """
+    C1: the daemon must not bind anything that serves content without a handshake.
+    NodeConfig no longer carries an HTTP port at all.
+    """
+    from meshbay_node.config import NodeConfig, GroupConfig
+
+    assert "http_port" not in NodeConfig.__dataclass_fields__
+    assert "http_port" not in GroupConfig.__dataclass_fields__
+    assert "port" not in NodeConfig.__dataclass_fields__
+
+
+# ── C5a: upload filename allowlist ───────────────────────────────────────────
+
+@pytest.mark.parametrize("name", [
+    "../../etc/passwd",
+    "..\\windows\\system32",
+    "/absolute/path",
+    "<img src=x onerror=alert(1)>",          # the H2 stored-XSS vector
+    'name";DROP TABLE x;--',
+    ".hidden",
+    "",
+    "a" * 200,
+    "file\x00.mp4",
+    "sub/dir/file.mp4",
+])
+def test_upload_rejects_unsafe_filenames(name):
+    """C5a/H2: only a conservative allowlist may reach the filesystem."""
+    assert not _safe_name_re().match(name), f"should be rejected: {name!r}"
+
+
+@pytest.mark.parametrize("name", [
+    "movie.mp4",
+    "My Holiday Video.mkv",
+    "report-2026.pdf",
+    "track_01.flac",
+])
+def test_upload_accepts_ordinary_filenames(name):
+    """The allowlist must not break normal use."""
+    assert _safe_name_re().match(name), f"should be accepted: {name!r}"
+
+
+def _session(tmp_path: Path, user_id: str) -> WebRTCPeerSession:
+    """A peer session wired to a real shared root, with sending stubbed out."""
+    shared_root = tmp_path / "shared"
+    shared_root.mkdir(exist_ok=True)
+    index = GroupIndex(group_id="g" * 32, sk_node=Ed25519PrivateKey.generate())
+    ctx = {"shared_root": shared_root, "index": index, "sk_node": index.sk_node}
+
+    session = WebRTCPeerSession.__new__(WebRTCPeerSession)
+    session._ctx = ctx
+    session._group_id = None
+    session._user_id = user_id
+    session._pk_user = ""
+    session._uploads = {}
+    session.sent = []
+    session._send = session.sent.append
+    session._audit = lambda *a, **k: None
+    return session
+
+
+def test_upload_cannot_overwrite_another_members_file(tmp_path):
+    """
+    C5a: uploads used to land in the shared root under a client-chosen name and
+    overwrite whatever was there. That let any member destroy the operator's files,
+    and — by becoming the recorded uploader of the replaced file — delete them
+    through the uploader path, bypassing the Ed25519 admin challenge entirely.
+    """
+    victim = _session(tmp_path, "victim-user")
+    shared_root = victim._ctx["shared_root"]
+
+    original = shared_root / "important.mp4"
+    original.write_bytes(b"operator's original content")
+
+    attacker = _session(tmp_path, "attacker-user")
+    attacker._do_file_upload({
+        "filename": "important.mp4",
+        "chunk_index": 0,
+        "total_chunks": 1,
+        "data": base64.b64encode(b"attacker content").decode(),
+    })
+
+    assert original.read_bytes() == b"operator's original content"
+    uploaded = shared_root / ".uploads" / "attacker-user" / "important.mp4"
+    assert uploaded.exists(), "upload should be quarantined, not dropped"
+    assert uploaded.read_bytes() == b"attacker content"
+
+
+def test_upload_rejects_out_of_order_chunks(tmp_path):
+    """C5a: chunk_index > 0 used to append blindly to any .part file on disk."""
+    session = _session(tmp_path, "user-1")
+    session._do_file_upload({
+        "filename": "movie.mp4", "chunk_index": 3, "total_chunks": 5,
+        "data": base64.b64encode(b"spliced").decode(),
+    })
+    assert any(m.get("type") == "error" for m in session.sent)
+
+
+def test_upload_second_attempt_cannot_replace_own_completed_file(tmp_path):
+    """C5a: even the original uploader goes through a fresh name, not an overwrite."""
+    session = _session(tmp_path, "user-1")
+    payload = {"filename": "movie.mp4", "chunk_index": 0, "total_chunks": 1,
+               "data": base64.b64encode(b"first").decode()}
+    session._do_file_upload(dict(payload))
+    session.sent.clear()
+
+    session._do_file_upload(dict(payload))
+    assert any(m.get("type") == "error" for m in session.sent)
+    stored = session._ctx["shared_root"] / ".uploads" / "user-1" / "movie.mp4"
+    assert stored.read_bytes() == b"first"
+
+
+# ── H1: group isolation ──────────────────────────────────────────────────────
+
+def test_chat_store_and_peers_are_per_group(tmp_path):
+    """
+    H1: chat_store and the peer registry were read from the shared transport
+    context, so on a multi-group node every group's messages went to the first
+    group's database and were served back to members of every other group.
+    """
+    index_a = GroupIndex(group_id="a" * 32, sk_node=Ed25519PrivateKey.generate())
+    index_b = GroupIndex(group_id="b" * 32, sk_node=Ed25519PrivateKey.generate())
+    groups = {
+        "a" * 32: {"chat_store": "STORE_A", "index": index_a, "shared_root": tmp_path},
+        "b" * 32: {"chat_store": "STORE_B", "index": index_b, "shared_root": tmp_path},
+    }
+    ctx = {"groups": groups}
+
+    sess_a = WebRTCPeerSession.__new__(WebRTCPeerSession)
+    sess_a._ctx, sess_a._group_id, sess_a._user_id = ctx, "a" * 32, "alice"
+
+    sess_b = WebRTCPeerSession.__new__(WebRTCPeerSession)
+    sess_b._ctx, sess_b._group_id, sess_b._user_id = ctx, "b" * 32, "bob"
+
+    assert sess_a._group_ctx()["chat_store"] == "STORE_A"
+    assert sess_b._group_ctx()["chat_store"] == "STORE_B"
+
+    sess_a._peer_registry()["alice"] = sess_a
+    sess_b._peer_registry()["bob"] = sess_b
+
+    # Alice's broadcast target set must not contain Bob, who is in another group.
+    assert "bob" not in sess_a._peer_registry()
+    assert "alice" not in sess_b._peer_registry()
+
+    sess_a._user_names()["alice"] = "Alice"
+    assert "alice" not in sess_b._user_names()
+
+
+def test_daemon_sets_no_global_chat_store(tmp_path):
+    """H1: the daemon must not hoist one group's chat store onto the transport."""
+    source = (Path(__file__).parent.parent
+              / "src" / "meshbay_node" / "daemon.py").read_text()
+    assert '_ctx["chat_store"]' not in source, (
+        "daemon must not assign a transport-wide chat_store — it leaks chat "
+        "across groups (H1)"
+    )
+
+
+# ── H2: node admin UI escaping ───────────────────────────────────────────────
+
+def test_no_member_can_hand_the_node_key_material(tmp_path):
+    """
+    C5b, strengthened by the invite redesign (docs/invite-pairing-v1.md).
+
+    This test used to assert that `gek_bundle_store` answered with an admin
+    challenge and stored nothing without an operator signature. The message is now
+    gone entirely: the node holds the GEK and wraps it itself, so no member ever
+    submits key material, authorized or not. Deleting the path is a stronger
+    guarantee than gating it, which is why the assertion changed rather than the
+    behaviour regressing.
+    """
+    from meshbay_common.protocol import MNP as _MNP
+
+    assert not hasattr(_MNP, "GEK_BUNDLE_STORE"), (
+        "the member-supplied bundle message is back — the node must never accept "
+        "key material over MNP (C5b)"
+    )
+
+    source = (Path(__file__).parent.parent
+              / "src" / "meshbay_node" / "transport" / "webrtc_server.py").read_text()
+    assert "_do_gek_bundle_store" not in source
+    assert "_admin_exec_bundle_store" not in source
+
+
+def test_unknown_message_stores_nothing(tmp_path):
+    """A peer sending the retired message must not reach any storage path."""
+    session = _session(tmp_path, "ordinary-member")
+    session._group_id = None
+    session._admin_ops = {}
+
+    stored = []
+
+    class _Store:
+        async def store(self, *args):
+            stored.append(args)
+
+    session._ctx["bundle_store"] = _Store()
+    session._handle_message({
+        "type": "gek_bundle_store",
+        "user_id": "victim", "group_id": "g" * 32,
+        "pk_eph_b64": "AA==", "nonce_b64": "AA==", "wrapped_b64": "AA==",
+    })
+
+    assert stored == [], "a retired message type still reached the bundle store"
+
+
+def test_gek_auto_activation_is_gone():
+    """
+    C5b: the node used to unwrap and adopt any bundle addressed to the operator.
+    Since the operator's X25519 public key is public, any member could hand the
+    node a GEK of their choosing. Nothing arriving over MNP may set a live GEK.
+    """
+    source = (Path(__file__).parent.parent / "src" / "meshbay_node"
+              / "transport" / "webrtc_server.py").read_text()
+    assert "_try_activate_gek" not in source
+    assert 'unwrap_gek_aes' not in source, (
+        "the MNP path must not unwrap a GEK — activation is local-admin only"
+    )
+
+
+# ── H5: admin challenge is bound, not a blind signing oracle ─────────────────
+
+def _transcript(**kw):
+    from meshbay_common.adminop import admin_transcript
+    base = dict(op="file_delete", node_pk_b64="NODEPK", group_id="g" * 32,
+                subject="file-1", nonce=b"\x01" * 32, ts=1_700_000_000)
+    base.update(kw)
+    return admin_transcript(**base)
+
+
+def test_admin_transcript_is_domain_separated():
+    """H5: signatures here can never be valid in another MeshBay protocol."""
+    assert _transcript().startswith(b"meshbay:admin:v1")
+
+
+@pytest.mark.parametrize("field,value", [
+    ("op", "invite_create"),
+    ("subject", "file-2"),
+    ("node_pk_b64", "OTHERNODE"),
+    ("group_id", "h" * 32),
+    ("nonce", b"\x02" * 32),
+    ("ts", 1_700_000_001),
+])
+def test_admin_transcript_binds_every_field(field, value):
+    """
+    H5: a signature must not carry over to another operation, subject, node,
+    group, challenge or moment in time.
+    """
+    assert _transcript() != _transcript(**{field: value}), (
+        f"transcript ignores {field} — signature would be reusable"
+    )
+
+
+def test_admin_transcript_is_unambiguous():
+    """
+    H5/L4: fields are length-prefixed. With plain concatenation a crafted subject
+    could impersonate the following field and two different operations would
+    produce identical signed bytes.
+    """
+    a = _transcript(subject="file-1", group_id="g")
+    b = _transcript(subject="1", group_id="gfile-")
+    assert a != b, "concatenation is ambiguous — length prefixes missing"
+
+
+def test_admin_signature_does_not_transfer_between_operations(tmp_path):
+    """
+    H5: the concrete attack. A signature collected to delete a file must not
+    authorize storing a GEK bundle.
+    """
+    from meshbay_common.adminop import OP_FILE_DELETE, OP_INVITE_CREATE
+
+    sk_admin = Ed25519PrivateKey.generate()
+    delete_transcript = _transcript(op=OP_FILE_DELETE)
+    signature = sk_admin.sign(delete_transcript)
+
+    invite_transcript = _transcript(op=OP_INVITE_CREATE)
+    with pytest.raises(Exception):
+        sk_admin.public_key().verify(signature, invite_transcript)
+
+
+def test_admin_challenge_expires(tmp_path):
+    """H5: a stale challenge must not be usable."""
+    import time as _time
+    from meshbay_common.adminop import ADMIN_CHALLENGE_TTL, OP_FILE_DELETE
+
+    session = _session(tmp_path, "operator")
+    session._group_id = None
+    session._admin_ops = {
+        "op-1": {
+            "op": OP_FILE_DELETE, "subject": "file-1", "nonce": b"\x00" * 32,
+            "ts": int(_time.time()) - ADMIN_CHALLENGE_TTL - 5, "payload": {},
+        }
+    }
+    session._do_admin_response({"op_id": "op-1", "signature": ""})
+    assert any(m.get("type") == "error" and "expired" in m.get("detail", "").lower()
+               for m in session.sent)
+
+
+def test_denylist_persists_and_honours_groups(tmp_path):
+    """
+    H4: revocations lived only in memory, so a node restart silently un-revoked
+    everyone, and 'group' targets were dropped entirely — the hub signed and
+    broadcast them, the node's handler understood only 'user' and 'jti'.
+    """
+    from meshbay_node.transport import Denylist
+
+    path = tmp_path / "denylist.json"
+    first = Denylist(path=path)
+    first.deny_group("g-revoked")
+    first.deny_user("u-revoked")
+    first.deny_jti("j-revoked")
+
+    # A fresh instance stands in for a daemon restart.
+    reloaded = Denylist(path=path)
+    assert reloaded.is_denied("", "", "g-revoked"), "group revocation not honoured"
+    assert reloaded.is_denied("u-revoked", "")
+    assert reloaded.is_denied("", "j-revoked")
+    assert not reloaded.is_denied("someone", "other", "g-allowed")
+
+
+def test_swarm_registration_skips_private_groups():
+    """
+    H7: the daemon registered content hashes for every group, private included,
+    handing the hub a fingerprint of every private file. The bug was masked by a
+    mis-mounted route, so fixing the route without this filter would have turned a
+    dormant leak into a live one.
+    """
+    source = (Path(__file__).parent.parent / "src" / "meshbay_node"
+              / "daemon.py").read_text()
+    assert 'visibility' in source and '_register_swarm' in source
+    # Both registration sites must gate on public visibility.
+    for marker in ['gctx.get("visibility") != "public"',
+                   'group_cfg.visibility == "public"']:
+        assert marker in source, f"swarm registration not gated: {marker}"
+
+
+def test_keystore_argon2_is_production_strength():
+    """M2: the keystore protects the node's private keys and sat at 64 MB."""
+    from meshbay_common.crypto import ARGON2_MEMORY_COST
+    assert ARGON2_MEMORY_COST >= 262144
+
+
+def test_keystore_records_argon2_params_for_migration(tmp_path):
+    """
+    M2: raising the parameters must not orphan existing keystores, so each
+    envelope records the parameters it was written with.
+    """
+    import json
+    from meshbay_node.keystore import create_keystore, load_keystore
+
+    path = tmp_path / "keystore.enc"
+    created = create_keystore(path=path, password="correct horse battery")
+    envelope = json.loads(path.read_text())
+    assert envelope["argon2"]["memory_cost"] >= 262144
+
+    reopened = load_keystore(path=path, password="correct horse battery")
+    assert reopened.pk_ed25519_b64 == created.pk_ed25519_b64
+
+
+def test_legacy_keystore_still_opens(tmp_path):
+    """M2: a keystore written under the 64 MB profile must still unlock."""
+    import base64 as _b64
+    import json
+    import msgpack
+    from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey
+    from meshbay_common.crypto import (
+        LEGACY_ARGON2_ITERATIONS, LEGACY_ARGON2_LANES, LEGACY_ARGON2_MEMORY_COST,
+        derive_keystore_key, encrypt_keystore, pk_to_b64, sk_to_b64,
+    )
+    from meshbay_node.keystore import load_keystore
+
+    sk_ed, sk_x = Ed25519PrivateKey.generate(), X25519PrivateKey.generate()
+    payload = msgpack.packb({
+        "sk_ed25519_b64": sk_to_b64(sk_ed),
+        "sk_x25519_b64": sk_to_b64(sk_x),
+    }, use_bin_type=True)
+
+    salt = b"\x01" * 16
+    key = derive_keystore_key(
+        "legacy-pass", salt,
+        iterations=LEGACY_ARGON2_ITERATIONS,
+        memory_cost=LEGACY_ARGON2_MEMORY_COST,
+        lanes=LEGACY_ARGON2_LANES,
+    )
+    iv, ct, tag = encrypt_keystore(payload, key)
+
+    path = tmp_path / "legacy.enc"
+    # No "argon2" key — exactly how pre-M2 envelopes look.
+    path.write_text(json.dumps({
+        "version": 1,
+        "argon2_salt_b64": _b64.b64encode(salt).decode(),
+        "iv_b64": _b64.b64encode(iv).decode(),
+        "tag_b64": _b64.b64encode(tag).decode(),
+        "ciphertext_b64": _b64.b64encode(ct).decode(),
+    }))
+
+    keys = load_keystore(path=path, password="legacy-pass")
+    assert keys.pk_ed25519_b64 == pk_to_b64(sk_ed.public_key())
+    assert keys.pk_x25519_b64 == pk_to_b64(sk_x.public_key())
+
+
+def test_dead_gek_protocol_constants_removed():
+    """L1: the node never serves a GEK; the message types should not suggest it."""
+    from meshbay_common.protocol import MNP
+    assert not hasattr(MNP, "GEK_REQUEST")
+    assert not hasattr(MNP, "GEK_RESPONSE")
+
+
+def test_peer_errors_do_not_leak_internals():
+    """
+    L3: arbitrary exception text carries filesystem paths and internal state, so
+    the catch-all handler must not relay it.
+
+    Deliberately narrow: HandshakeError messages ARE sent to the peer, because a
+    client needs to know why it was refused, and those strings are authored for
+    that purpose. The check targets the generic `except Exception as e` path.
+    """
+    source = (Path(__file__).parent.parent / "src" / "meshbay_node"
+              / "transport" / "webrtc_server.py").read_text()
+    assert '"detail": str(e)' not in source, (
+        "generic exception text relayed to peer — use a fixed message"
+    )
+    # And the catch-all must still exist, sending something opaque.
+    assert '"detail": "Request failed"' in source
+
+
+def test_pre_handshake_message_budget_is_small():
+    """
+    H6: the frame limit was a flat 64 MB applied before authentication, so an
+    unauthenticated peer could announce a huge frame and dribble bytes into it.
+    """
+    from meshbay_node.transport.webrtc_server import (
+        MAX_MSG, PRE_HANDSHAKE_MAX_MSG, _DataChannelBuffer,
+    )
+    assert PRE_HANDSHAKE_MAX_MSG <= 1024 * 1024
+    assert PRE_HANDSHAKE_MAX_MSG < MAX_MSG
+
+    buf = _DataChannelBuffer(max_message=PRE_HANDSHAKE_MAX_MSG)
+    buf.feed(struct.pack(">I", PRE_HANDSHAKE_MAX_MSG + 1) + b"x")
+    with pytest.raises(ValueError):
+        list(buf.messages())
+
+
+def test_stream_segment_is_not_synchronous():
+    """
+    H6: _do_stream_segment ran subprocess.run(timeout=30) inside the event loop,
+    stalling every peer on the node for up to thirty seconds per request.
+
+    Asserts the property (the worker is a coroutine, ffmpeg is spawned through
+    asyncio) rather than grepping for "subprocess.run" — which also matches the
+    comment that documents the old behaviour.
+    """
+    import ast
+    import inspect
+    from meshbay_node.transport.webrtc_server import WebRTCPeerSession
+
+    assert inspect.iscoroutinefunction(WebRTCPeerSession._do_stream_segment_async)
+
+    source = (Path(__file__).parent.parent / "src" / "meshbay_node"
+              / "transport" / "webrtc_server.py").read_text()
+    tree = ast.parse(source)
+    blocking = [
+        node for node in ast.walk(tree)
+        if isinstance(node, ast.Call)
+        and isinstance(node.func, ast.Attribute)
+        and node.func.attr == "run"
+        and isinstance(node.func.value, ast.Name)
+        and node.func.value.id == "subprocess"
+    ]
+    assert not blocking, "blocking subprocess.run() in the event loop"
+    assert "_transcode_sem" in source, "ffmpeg spawns must be capped"
+
+
+def test_pre_proof_fetches_are_bounded():
+    """C4: the pre-proof bundle window is a disclosure surface; bound it."""
+    from meshbay_node.transport.webrtc_server import MAX_PRE_PROOF_FETCHES
+    assert 0 < MAX_PRE_PROOF_FETCHES <= 10
+
+
+def test_node_admin_ui_requires_token():
+    """
+    11.5.3: "localhost only" is not authentication. Any local process — or a
+    rebound browser page — could re-initialise a group's GEK and read the audit log.
+    """
+    from fastapi.testclient import TestClient
+    from meshbay_node.ui.app import create_ui_app
+
+    app = create_ui_app({"status": "running", "groups_ctx": {},
+                         "indexes": {}, "ui_token": "secret-token"})
+    client = TestClient(app)
+
+    assert client.get("/api/status").status_code == 403
+    assert client.get("/api/status?t=wrong").status_code == 403
+    assert client.get("/api/config?t=wrong").status_code == 403
+    assert client.get("/api/status?t=secret-token").status_code == 200
+    assert client.get(
+        "/api/status", headers={"X-MeshBay-Token": "secret-token"}
+    ).status_code == 200
+
+
+def test_admin_ui_escapes_filenames(tmp_path):
+    """
+    H2: filenames are chosen by any group member and were rendered into the
+    localhost admin UI unescaped, giving script execution against an
+    unauthenticated admin API.
+    """
+    from meshbay_node.ui.app import _render_page
+
+    payload = '<img src=x onerror="fetch(1)">'
+    index = GroupIndex(group_id="g" * 32, sk_node=Ed25519PrivateKey.generate())
+    index.add_entry(IndexEntry(
+        id="0" * 64, name=payload, path="", size=1, type="video", added_at=0,
+    ))
+
+    html = _render_page({
+        "status": "running",
+        "groups_ctx": {"g" * 32: {"index": index, "shared_root": tmp_path}},
+        "indexes": {"g" * 32: index},
+    })
+
+    assert payload not in html, "filename rendered unescaped — stored XSS (H2)"
+    assert "&lt;img" in html, "filename should appear escaped"
+
+
+def test_admin_ui_escapes_roster_usernames(tmp_path):
+    """
+    H2 again, for the roster: usernames originate at the hub and land on the
+    operator's own admin page, which can re-key groups and read the audit log.
+    """
+    from meshbay_node.ui.app import _render_page
+
+    payload = '<img src=x onerror="fetch(1)">'
+    html = _render_page(
+        {"status": "running", "groups_ctx": {}, "indexes": {}},
+        {
+            "identities": {"u1": {"user_id": "u1", "username": payload,
+                                  "pk_ed25519": "AAA", "pinned_at": "now",
+                                  "pinned_via": "code"}},
+            "members": [{"group_id": "", "user_id": "u1", "role": "operator",
+                         "status": "active"}],
+            "invites": [],
+        },
+    )
+
+    assert payload not in html, "username rendered unescaped — stored XSS (H2)"
+    assert "&lt;img" in html
diff --git a/packages/meshbay-node/tests/test_transport.py b/packages/meshbay-node/tests/test_transport.py
deleted file mode 100644
index 0e70d72..0000000
--- a/packages/meshbay-node/tests/test_transport.py
+++ /dev/null
@@ -1,222 +0,0 @@
-"""
-Integration test: ChunkServer ↔ ChunkClient over TLS.
-
-Starts a real TLS server on localhost, connects a client,
-fetches index and a chunk, verifies signature+hash+decryption.
-"""
-
-import asyncio
-import base64
-import os
-import time
-import jwt
-import pytest
-from pathlib import Path
-from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
-from cryptography.hazmat.primitives import serialization
-
-from meshbay_common.crypto import generate_gek, pk_to_b64
-from meshbay_node.indexer import DirectoryIndexer, GroupIndex
-from meshbay_node.transport.server import ChunkServer
-from meshbay_node.transport.client import ChunkClient
-
-
-@pytest.fixture
-def sk_node():
-    return Ed25519PrivateKey.generate()
-
-@pytest.fixture
-def sk_hub():
-    return Ed25519PrivateKey.generate()
-
-@pytest.fixture
-def gek():
-    return generate_gek()
-
-@pytest.fixture
-def shared_dir(tmp_path):
-    d = tmp_path / "shared"
-    d.mkdir()
-    (d / "test.mp4").write_bytes(os.urandom(2 * 1024 * 1024))   # 2 MB
-    (d / "small.txt").write_bytes(b"hello meshbay " * 100)
-    return d
-
-def make_jwt(sk_hub, pk_node_b64, user_id="user-001", ttl=3600, groups=None):
-    sk_pem = sk_hub.private_bytes(
-        serialization.Encoding.PEM,
-        serialization.PrivateFormat.PKCS8,
-        serialization.NoEncryption(),
-    )
-    now = int(time.time())
-    return jwt.encode({
-        "iss": "test-hub", "sub": user_id,
-        "pk_user": pk_node_b64, "hub_id": "test-hub",
-        "jti": "test-jti",
-        "iat": now, "exp": now + ttl,
-        "groups": groups or [],
-    }, sk_pem, algorithm="EdDSA")
-
-
-@pytest.mark.asyncio
-async def test_chunk_server_client_roundtrip(
-        sk_node, sk_hub, gek, shared_dir, tmp_path):
-    """Full integration: server serves a chunk, client verifies and decrypts."""
-
-    # Build index
-    indexer = DirectoryIndexer(
-        root=shared_dir, group_id="g", sk_node=sk_node, gek=gek)
-    await indexer.initial_scan()
-    assert indexer.index.count == 2
-
-    # Hub PK for JWT verification
-    hub_pk_pem = sk_hub.public_key().public_bytes(
-        serialization.Encoding.PEM,
-        serialization.PublicFormat.SubjectPublicKeyInfo)
-
-    # TLS cert in tmp dir
-    cert_path = tmp_path / "node.crt"
-    key_path  = tmp_path / "node.key"
-
-    server = ChunkServer(
-        sk_node=sk_node,
-        hub_pk_pem=hub_pk_pem,
-        gek=gek,
-        shared_root=shared_dir,
-        index=indexer.index,
-        host="127.0.0.1",
-        port=0,   # OS picks a free port
-        cert_path=cert_path,
-        key_path=key_path,
-    )
-    await server.start()
-    port = server._server.sockets[0].getsockname()[1]
-
-    token = make_jwt(sk_hub, pk_to_b64(sk_node.public_key()))
-
-    # Find the large test file in the index
-    entry = next(e for e in indexer.index.entries if e.name == "test.mp4")
-
-    async with ChunkClient(
-        host="127.0.0.1",
-        port=port,
-        jwt_token=token,
-        gek=gek,
-        pk_node_b64=pk_to_b64(sk_node.public_key()),
-    ) as client:
-        # Fetch first chunk
-        chunk0 = await client.fetch_chunk(entry.id, chunk_index=0)
-        assert len(chunk0) == 1024 * 1024   # first 1MB of 2MB file
-
-        # Fetch second chunk
-        chunk1 = await client.fetch_chunk(entry.id, chunk_index=1)
-        assert len(chunk1) == 1024 * 1024   # second 1MB
-
-        # Reassembled file matches original
-        original = (shared_dir / "test.mp4").read_bytes()
-        assert chunk0 + chunk1 == original
-
-    await server.stop()
-
-
-@pytest.mark.asyncio
-async def test_invalid_jwt_rejected(sk_node, sk_hub, gek, shared_dir, tmp_path):
-    hub_pk_pem = sk_hub.public_key().public_bytes(
-        serialization.Encoding.PEM, serialization.PublicFormat.SubjectPublicKeyInfo)
-
-    indexer = DirectoryIndexer(root=shared_dir, group_id="g",
-                               sk_node=sk_node, gek=gek)
-    await indexer.initial_scan()
-
-    cert_path = tmp_path / "node.crt"
-    key_path  = tmp_path / "node.key"
-
-    server = ChunkServer(
-        sk_node=sk_node, hub_pk_pem=hub_pk_pem, gek=gek,
-        shared_root=shared_dir, index=indexer.index,
-        host="127.0.0.1", port=0,
-        cert_path=cert_path, key_path=key_path,
-    )
-    await server.start()
-    port = server._server.sockets[0].getsockname()[1]
-
-    # Use a different hub key to sign the token
-    sk_other_hub = Ed25519PrivateKey.generate()
-    bad_token = make_jwt(sk_other_hub, pk_to_b64(sk_node.public_key()))
-
-    with pytest.raises(Exception):
-        async with ChunkClient(
-            host="127.0.0.1", port=port,
-            jwt_token=bad_token, gek=gek,
-            pk_node_b64=pk_to_b64(sk_node.public_key()),
-        ) as client:
-            pass
-
-    await server.stop()
-
-
-@pytest.mark.asyncio
-async def test_wrong_group_rejected(sk_node, sk_hub, gek, shared_dir, tmp_path):
-    """TCP+TLS server rejects a client whose JWT groups don't include the requested group_id."""
-    hub_pk_pem = sk_hub.public_key().public_bytes(
-        serialization.Encoding.PEM, serialization.PublicFormat.SubjectPublicKeyInfo)
-
-    indexer = DirectoryIndexer(root=shared_dir, group_id="g",
-                               sk_node=sk_node, gek=gek)
-    await indexer.initial_scan()
-
-    cert_path = tmp_path / "node.crt"
-    key_path  = tmp_path / "node.key"
-
-    server = ChunkServer(
-        sk_node=sk_node, hub_pk_pem=hub_pk_pem, gek=gek,
-        shared_root=shared_dir, index=indexer.index,
-        host="127.0.0.1", port=0,
-        cert_path=cert_path, key_path=key_path,
-    )
-    await server.start()
-    port = server._server.sockets[0].getsockname()[1]
-
-    token = make_jwt(sk_hub, pk_to_b64(sk_node.public_key()), groups=["group-a"])
-
-    with pytest.raises(ConnectionError, match="rejected"):
-        async with ChunkClient(
-            host="127.0.0.1", port=port,
-            jwt_token=token, gek=gek,
-            pk_node_b64=pk_to_b64(sk_node.public_key()),
-            group_id="group-b",
-        ) as client:
-            pass
-
-    await server.stop()
-
-
-@pytest.mark.asyncio
-async def test_fetch_index(sk_node, sk_hub, gek, shared_dir, tmp_path):
-    hub_pk_pem = sk_hub.public_key().public_bytes(
-        serialization.Encoding.PEM, serialization.PublicFormat.SubjectPublicKeyInfo)
-    indexer = DirectoryIndexer(root=shared_dir, group_id="g",
-                               sk_node=sk_node, gek=gek)
-    await indexer.initial_scan()
-
-    cert_path = tmp_path / "node.crt"
-    key_path  = tmp_path / "node.key"
-
-    server = ChunkServer(
-        sk_node=sk_node, hub_pk_pem=hub_pk_pem, gek=gek,
-        shared_root=shared_dir, index=indexer.index,
-        host="127.0.0.1", port=0,
-        cert_path=cert_path, key_path=key_path,
-    )
-    await server.start()
-    port = server._server.sockets[0].getsockname()[1]
-    token = make_jwt(sk_hub, pk_to_b64(sk_node.public_key()))
-
-    async with ChunkClient(
-        host="127.0.0.1", port=port, jwt_token=token,
-        gek=gek, pk_node_b64=pk_to_b64(sk_node.public_key()),
-    ) as client:
-        wire = await client.fetch_index()
-        recovered = GroupIndex.deserialize(wire, sk_node=sk_node, gek=gek)
-        assert recovered.count == 2
-
-    await server.stop()
diff --git a/packages/meshbay-node/tests/test_webrtc_transport.py b/packages/meshbay-node/tests/test_webrtc_transport.py
index 693a68b..93cd3fd 100644
--- a/packages/meshbay-node/tests/test_webrtc_transport.py
+++ b/packages/meshbay-node/tests/test_webrtc_transport.py
@@ -19,7 +19,9 @@ import jwt
 import msgpack
 import pytest
 from cryptography.hazmat.primitives import serialization
-from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+from cryptography.hazmat.primitives.asymmetric.ed25519 import (
+    Ed25519PrivateKey, Ed25519PublicKey,
+)
 from aiortc import RTCPeerConnection, RTCSessionDescription
 
 from meshbay_common import MNP_VERSION
@@ -29,10 +31,24 @@ from meshbay_common.crypto import (
     wrap_gek,
     wrap_gek_aes,
     unwrap_gek,
+    unwrap_gek_aes,
 )
 from meshbay_common.webcrypto import chunk_key_aes, decrypt_chunk_aes
 from meshbay_common.protocol import MNP
+TEST_GROUP = "g"
+
+from meshbay_common.handshake import (
+    NONCE_LEN, ROLE_CLIENT, ROLE_NODE, handshake_transcript,
+    make_proof, verify_proof, webrtc_binding,
+)
+from meshbay_common.adminop import (
+    OP_FILE_DELETE,
+    OP_INVITE_CREATE,
+    admin_transcript,
+)
+from meshbay_common.join import ROLE_MEMBER, ROLE_OPERATOR, join_transcript
 from meshbay_node.bundle_store import BundleStore
+from meshbay_node.roster import Roster
 from meshbay_node.indexer import DirectoryIndexer
 from meshbay_node.transport.webrtc_server import WebRTCTransport
 
@@ -72,6 +88,9 @@ def _hub_pk_pem(sk_hub):
 
 
 def _make_jwt(sk_hub, groups=None, pk_user="test"):
+    # group_id is mandatory now (M1), so the default token must be a member
+    # of the group the tests connect to. Tests that exercise refusal pass
+    # groups=[...] explicitly.
     sk_pem = sk_hub.private_bytes(
         serialization.Encoding.PEM,
         serialization.PrivateFormat.PKCS8,
@@ -82,10 +101,25 @@ def _make_jwt(sk_hub, groups=None, pk_user="test"):
         "iss": "test-hub", "sub": "user-001",
         "pk_user": pk_user, "hub_id": "test-hub",
         "jti": "test-jti-webrtc", "iat": now, "exp": now + 3600,
-        "groups": groups or [],
+        "groups": groups if groups is not None else [TEST_GROUP],
     }, sk_pem, algorithm="EdDSA")
 
 
+def _transcript_from(challenge_msg: dict) -> bytes:
+    """
+    Rebuild the signed transcript from an admin_challenge, the way a real client
+    does — from the announced fields, never from opaque bytes on the wire (H5).
+    """
+    return admin_transcript(
+        op=challenge_msg["op"],
+        node_pk_b64=challenge_msg["node_pk"],
+        group_id=challenge_msg["group_id"],
+        subject=challenge_msg["subject"],
+        nonce=base64.b64decode(challenge_msg["nonce"]),
+        ts=challenge_msg["ts"],
+    )
+
+
 def _pack(obj: dict) -> bytes:
     data = msgpack.packb(obj, use_bin_type=True)
     return struct.pack(">I", len(data)) + data
@@ -103,36 +137,80 @@ def _extract_dtls_fp(sdp: str) -> bytes:
     return b""
 
 
-async def _handshake_with_gek_proof(channel, received, sk_hub, gek, groups=None,
-                                    browser_pc=None):
-    """Send handshake, handle GEK challenge, return handshake_ack."""
-    token = _make_jwt(sk_hub, groups=groups)
+async def _do_mnp_handshake(channel, received, token, gek, pc, group_id):
+    """
+    Client half of the unified handshake (11.5.4): client nonce, length-prefixed
+    role-bound transcript, and verification of the node's own proof + signature.
+    """
+    nonce_c = os.urandom(NONCE_LEN)
     channel.send(_pack({
-        "type": MNP.HANDSHAKE,
-        "v": MNP_VERSION,
-        "token": token,
+        "type": MNP.HANDSHAKE, "v": MNP_VERSION,
+        "token": token, "group_id": group_id,
+        "nonce": base64.b64encode(nonce_c).decode(),
     }))
     msg = await asyncio.wait_for(received.get(), timeout=5.0)
-    if msg["type"] == MNP.HANDSHAKE_CHALLENGE:
-        nonce = base64.b64decode(msg["nonce"])
-        offer_fp = b""
-        answer_fp = b""
-        if browser_pc:
-            offer_fp = _extract_dtls_fp(browser_pc.localDescription.sdp)
-            answer_fp = _extract_dtls_fp(browser_pc.remoteDescription.sdp)
-        proof = hmac.new(gek, nonce + offer_fp + answer_fp, hashlib.sha256).digest()
-        channel.send(_pack({
-            "type": MNP.HANDSHAKE_RESPONSE,
-            "v": MNP_VERSION,
-            "proof": base64.b64encode(proof).decode(),
-        }))
-        msg = await asyncio.wait_for(received.get(), timeout=5.0)
+    if msg["type"] != MNP.HANDSHAKE_CHALLENGE:
+        return msg
+
+    nonce_s = base64.b64decode(msg["nonce"])
+    binding = webrtc_binding(
+        _extract_dtls_fp(pc.localDescription.sdp),
+        _extract_dtls_fp(pc.remoteDescription.sdp),
+    )
+    proof = make_proof(gek, ROLE_CLIENT, group_id, nonce_c, nonce_s, binding)
+    channel.send(_pack({
+        "type": MNP.HANDSHAKE_RESPONSE, "v": MNP_VERSION,
+        "proof": base64.b64encode(proof).decode(),
+    }))
+    ack = await asyncio.wait_for(received.get(), timeout=5.0)
+
+    if ack.get("type") == MNP.HANDSHAKE_ACK:
+        # The client must authenticate the node too (C3).
+        assert verify_proof(
+            gek, base64.b64decode(ack["proof"]), ROLE_NODE,
+            group_id, nonce_c, nonce_s, binding), "node proof invalid"
+        transcript = handshake_transcript(
+            ROLE_NODE, group_id, nonce_c, nonce_s, binding)
+        Ed25519PublicKey.from_public_bytes(
+            base64.b64decode(ack["node_pk"])
+        ).verify(base64.b64decode(ack["sig"]), transcript)
+    return ack
+
+
+async def _handshake_with_gek_proof(channel, received, sk_hub, gek, groups=None,
+                                    browser_pc=None, group_id=TEST_GROUP):
+    """Send handshake, handle GEK challenge, return handshake_ack."""
+    token = _make_jwt(sk_hub, groups=groups or [group_id])
+    msg = await _do_mnp_handshake(
+        channel, received, token, gek, browser_pc, group_id)
     assert msg["type"] == MNP.HANDSHAKE_ACK
     return msg
 
 
-async def _setup_peer(transport, sk_hub, gek, peer_id, jwt_sub="user-001", sk_user=None):
-    """Create a peer connection, perform handshake with GEK proof, return (pc, channel, queue)."""
+def _token(sk_hub, jwt_sub, peer_id, group_id, pk_user="test"):
+    """A hub-issued user token, as the browser would present it."""
+    sk_h_pem = sk_hub.private_bytes(
+        serialization.Encoding.PEM,
+        serialization.PrivateFormat.PKCS8,
+        serialization.NoEncryption(),
+    )
+    now = int(time.time())
+    return jwt.encode({
+        "iss": "test-hub", "sub": jwt_sub,
+        "pk_user": pk_user, "hub_id": "test-hub",
+        "jti": f"jti-{peer_id}", "iat": now, "exp": now + 3600,
+        "groups": [group_id], "scope": "user",
+    }, sk_h_pem, algorithm="EdDSA")
+
+
+async def _open_channel(transport, peer_id):
+    """
+    Signaling only: a live DataChannel with no MNP handshake performed.
+
+    Separate from `_setup_peer` because someone joining a group for the first time
+    cannot complete the handshake — they have no GEK to prove — and the join has to
+    happen in that window.
+    """
     pc = RTCPeerConnection()
     q = asyncio.Queue()
     buf = bytearray()
@@ -161,6 +239,13 @@ async def _setup_peer(transport, sk_hub, gek, peer_id, jwt_sub="user-001", sk_us
     answer_sdp, _ = await transport.handle_offer(pc.localDescription.sdp, peer_id)
     await pc.setRemoteDescription(RTCSessionDescription(sdp=answer_sdp, type="answer"))
     await asyncio.wait_for(ready.wait(), timeout=5.0)
+    return pc, ch, q
+
+
+async def _setup_peer(transport, sk_hub, gek, peer_id, jwt_sub="user-001", sk_user=None,
+                      group_id=TEST_GROUP):
+    """Create a peer connection, perform handshake with GEK proof, return (pc, channel, queue)."""
+    pc, ch, q = await _open_channel(transport, peer_id)
 
     pk_user = "test"
     if sk_user:
@@ -169,31 +254,9 @@ async def _setup_peer(transport, sk_hub, gek, peer_id, jwt_sub="user-001", sk_us
                 serialization.Encoding.Raw, serialization.PublicFormat.Raw)
         ).decode()
 
-    sk_h_pem = sk_hub.private_bytes(
-        serialization.Encoding.PEM,
-        serialization.PrivateFormat.PKCS8,
-        serialization.NoEncryption(),
-    )
-    now = int(time.time())
-    token = jwt.encode({
-        "iss": "test-hub", "sub": jwt_sub,
-        "pk_user": pk_user, "hub_id": "test-hub",
-        "jti": f"jti-{peer_id}", "iat": now, "exp": now + 3600,
-        "groups": [],
-    }, sk_h_pem, algorithm="EdDSA")
+    token = _token(sk_hub, jwt_sub, peer_id, group_id, pk_user)
 
-    ch.send(_pack({"type": MNP.HANDSHAKE, "v": MNP_VERSION, "token": token}))
-    msg = await asyncio.wait_for(q.get(), timeout=5.0)
-    if msg["type"] == MNP.HANDSHAKE_CHALLENGE:
-        nonce = base64.b64decode(msg["nonce"])
-        offer_fp = _extract_dtls_fp(pc.localDescription.sdp)
-        answer_fp = _extract_dtls_fp(pc.remoteDescription.sdp)
-        proof = hmac.new(gek, nonce + offer_fp + answer_fp, hashlib.sha256).digest()
-        ch.send(_pack({
-            "type": MNP.HANDSHAKE_RESPONSE, "v": MNP_VERSION,
-            "proof": base64.b64encode(proof).decode(),
-        }))
-        msg = await asyncio.wait_for(q.get(), timeout=5.0)
+    msg = await _do_mnp_handshake(ch, q, token, gek, pc, group_id)
     assert msg["type"] == MNP.HANDSHAKE_ACK
     return pc, ch, q
 
@@ -676,6 +739,8 @@ async def test_webrtc_wrong_gek_proof_rejected(sk_node, sk_hub, gek, shared_dir)
     token = _make_jwt(sk_hub)
     channel.send(_pack({
         "type": MNP.HANDSHAKE, "v": MNP_VERSION, "token": token,
+        "group_id": TEST_GROUP,
+        "nonce": base64.b64encode(os.urandom(NONCE_LEN)).decode(),
     }))
 
     challenge = await asyncio.wait_for(received.get(), timeout=5.0)
@@ -734,6 +799,8 @@ async def test_webrtc_dtls_channel_binding_detects_mitm(sk_node, sk_hub, gek, sh
     token = _make_jwt(sk_hub)
     channel.send(_pack({
         "type": MNP.HANDSHAKE, "v": MNP_VERSION, "token": token,
+        "group_id": TEST_GROUP,
+        "nonce": base64.b64encode(os.urandom(NONCE_LEN)).decode(),
     }))
 
     challenge = await asyncio.wait_for(received.get(), timeout=5.0)
@@ -783,13 +850,13 @@ async def test_webrtc_admin_challenge_response(sk_node, sk_hub, gek, shared_dir)
 
     challenge_msg = await asyncio.wait_for(received.get(), timeout=5.0)
     assert challenge_msg["type"] == MNP.ADMIN_CHALLENGE
-    assert challenge_msg["file_id"] == entry.id
+    assert challenge_msg["op"] == OP_FILE_DELETE
+    assert challenge_msg["subject"] == entry.id
 
-    challenge = base64.b64decode(challenge_msg["challenge"])
-    signature = sk_admin.sign(challenge)
+    signature = sk_admin.sign(_transcript_from(challenge_msg))
     channel.send(_pack({
         "type": MNP.ADMIN_RESPONSE, "v": MNP_VERSION,
-        "file_id": entry.id,
+        "op_id": challenge_msg["op_id"],
         "signature": base64.b64encode(signature).decode(),
     }))
 
@@ -832,11 +899,10 @@ async def test_webrtc_admin_bad_signature_rejected(sk_node, sk_hub, gek, shared_
     challenge_msg = await asyncio.wait_for(received.get(), timeout=5.0)
     assert challenge_msg["type"] == MNP.ADMIN_CHALLENGE
 
-    challenge = base64.b64decode(challenge_msg["challenge"])
-    bad_sig = sk_attacker.sign(challenge)
+    bad_sig = sk_attacker.sign(_transcript_from(challenge_msg))
     channel.send(_pack({
         "type": MNP.ADMIN_RESPONSE, "v": MNP_VERSION,
-        "file_id": entry.id,
+        "op_id": challenge_msg["op_id"],
         "signature": base64.b64encode(bad_sig).decode(),
     }))
 
@@ -914,14 +980,14 @@ async def test_webrtc_uploader_delete_requires_challenge(sk_node, sk_hub, gek, s
 
     challenge_msg = await asyncio.wait_for(received.get(), timeout=5.0)
     assert challenge_msg["type"] == MNP.ADMIN_CHALLENGE
-    assert challenge_msg["file_id"] == entry.id
+    assert challenge_msg["op"] == OP_FILE_DELETE
+    assert challenge_msg["subject"] == entry.id
 
     # Sign with uploader's Ed25519 key
-    challenge = base64.b64decode(challenge_msg["challenge"])
-    signature = sk_uploader.sign(challenge)
+    signature = sk_uploader.sign(_transcript_from(challenge_msg))
     channel.send(_pack({
         "type": MNP.ADMIN_RESPONSE, "v": MNP_VERSION,
-        "file_id": entry.id,
+        "op_id": challenge_msg["op_id"],
         "signature": base64.b64encode(signature).decode(),
     }))
 
@@ -979,11 +1045,10 @@ async def test_webrtc_uploader_impersonation_blocked(sk_node, sk_hub, gek, share
     assert challenge_msg["type"] == MNP.ADMIN_CHALLENGE
 
     # Sign with user B's key (wrong key)
-    challenge = base64.b64decode(challenge_msg["challenge"])
-    bad_sig = sk_user_b.sign(challenge)
+    bad_sig = sk_user_b.sign(_transcript_from(challenge_msg))
     channel.send(_pack({
         "type": MNP.ADMIN_RESPONSE, "v": MNP_VERSION,
-        "file_id": entry.id,
+        "op_id": challenge_msg["op_id"],
         "signature": base64.b64encode(bad_sig).decode(),
     }))
 
@@ -1014,54 +1079,122 @@ def x25519_keypair():
 
 
 @pytest.mark.asyncio
-async def test_gek_bundle_store_and_fetch(sk_node, sk_hub, gek, shared_dir,
-                                          tmp_path, x25519_keypair):
-    """GEK bundle stored on node via DataChannel, then fetched during handshake."""
+async def test_invite_then_join_delivers_the_gek(sk_node, sk_hub, gek, shared_dir,
+                                                 tmp_path, x25519_keypair):
+    """
+    The whole invite flow over a real DataChannel, end to end.
+
+    The operator asks for a code; the invitee — who has never held the group key
+    and therefore cannot complete the GEK proof — redeems it in the pre-proof
+    window and the node wraps the key for the X25519 key they just proved they
+    hold. At no point is a public key fetched from the hub, which is the point:
+    that lookup was H3.
+    """
     hub_pk_pem = _hub_pk_pem(sk_hub)
     indexer = DirectoryIndexer(root=shared_dir, group_id="g", sk_node=sk_node, gek=gek)
     await indexer.initial_scan()
 
-    bundle_store = BundleStore(db_path=tmp_path / "bundles.db")
-    await bundle_store.open()
+    roster = Roster(db_path=tmp_path / "roster.db")
+    await roster.open()
 
     transport = WebRTCTransport(
         sk_node=sk_node, hub_pk_pem=hub_pk_pem, gek=gek,
         shared_root=shared_dir, index=indexer.index,
         stun_servers=[],
     )
-    transport._ctx["bundle_store"] = bundle_store
+    transport._ctx["roster"] = roster
+    transport._ctx["has_admin_authority"] = True
+    transport._ctx["groups"] = {
+        TEST_GROUP: {"gek": gek, "shared_root": shared_dir, "index": indexer.index},
+    }
+
+    # A paired operator, as `meshbay-node operator pair` would have left it.
+    sk_admin = Ed25519PrivateKey.generate()
+    admin_pk_b64 = pk_to_b64(sk_admin.public_key())
+    await roster.pin_identity("user-001", "grenet", admin_pk_b64, "AA==", "code")
+    await roster.set_member("", "user-001", ROLE_OPERATOR, "active", "local-cli")
 
-    # Connect as admin and store a GEK bundle for user-002
     pc_admin, ch_admin, q_admin = await _setup_peer(
         transport, sk_hub, gek, "peer-admin")
 
-    sk_x_raw, pk_x_raw = x25519_keypair
-    bundle = wrap_gek(gek, pk_x_raw)
+    # 1. The operator asks the node for an invitation code.
+    ch_admin.send(_pack({
+        "type": MNP.INVITE_CREATE, "v": MNP_VERSION,
+        "user_id": "user-002", "group_id": TEST_GROUP, "username": "bob",
+    }))
+    challenge_msg = await asyncio.wait_for(q_admin.get(), timeout=5.0)
+    assert challenge_msg["type"] == MNP.ADMIN_CHALLENGE
+    assert challenge_msg["op"] == OP_INVITE_CREATE
+    assert challenge_msg["subject"] == "user-002"
 
     ch_admin.send(_pack({
-        "type": MNP.GEK_BUNDLE_STORE,
-        "v": MNP_VERSION,
-        "user_id": "user-002",
-        "group_id": "g",
-        "pk_eph_b64": bundle["pk_eph_b64"],
-        "nonce_b64": bundle["nonce_b64"],
-        "wrapped_b64": bundle["wrapped_b64"],
+        "type": MNP.ADMIN_RESPONSE, "v": MNP_VERSION,
+        "op_id": challenge_msg["op_id"],
+        "signature": base64.b64encode(
+            sk_admin.sign(_transcript_from(challenge_msg))).decode(),
     }))
-    ack = await asyncio.wait_for(q_admin.get(), timeout=5.0)
-    assert ack["type"] == "ack"
-    assert ack["detail"] == "gek_bundle_stored"
+    invite = await asyncio.wait_for(q_admin.get(), timeout=5.0)
+    assert invite["type"] == MNP.INVITE_RESULT
+    code = invite["code"]
+    assert code and len(code) == 9        # XXXX-XXXX
 
-    # Verify bundle was persisted
-    stored = await bundle_store.fetch("g", "user-002")
-    assert stored is not None
-    assert stored["pk_eph_b64"] == bundle["pk_eph_b64"]
+    # 2. Bob connects. He cannot prove GEK possession — he has never had it — so
+    #    he redeems the code in the pre-proof window instead.
+    sk_x_raw, pk_x_raw = x25519_keypair
+    sk_bob_ed = Ed25519PrivateKey.generate()
+    pc_bob, ch_bob, q_bob = await _open_channel(transport, "peer-bob")
 
-    # Unwrap to verify it's correct
-    recovered = unwrap_gek(stored, sk_x_raw, pk_x_raw)
-    assert recovered == gek
+    nonce_c = os.urandom(NONCE_LEN)
+    ch_bob.send(_pack({
+        "type": MNP.HANDSHAKE, "v": MNP_VERSION,
+        "token": _token(sk_hub, "user-002", "peer-bob", TEST_GROUP),
+        "group_id": TEST_GROUP,
+        "nonce": base64.b64encode(nonce_c).decode(),
+    }))
+    challenge = await asyncio.wait_for(q_bob.get(), timeout=5.0)
+    assert challenge["type"] == MNP.HANDSHAKE_CHALLENGE
+    nonce_s = base64.b64decode(challenge["nonce"])
 
-    await bundle_store.close()
+    # Bob signs a transcript naming the node, and he cannot complete the handshake
+    # that would prove its key — he has no GEK yet. So he has to be able to learn
+    # it from the challenge; taking it from the test's own knowledge of sk_node
+    # would hide the fact that a real client cannot.
+    assert challenge["node_pk"] == pk_to_b64(sk_node.public_key()), (
+        "the challenge must announce the node key to a first-time joiner")
+    node_pk_b64 = challenge["node_pk"]
+
+    pk_ed_b64 = pk_to_b64(sk_bob_ed.public_key())
+    pk_x_b64 = base64.b64encode(pk_x_raw).decode()
+    ts = int(time.time())
+    transcript = join_transcript(
+        node_pk_b64=node_pk_b64,
+        group_id=TEST_GROUP, user_id="user-002",
+        pk_ed25519_b64=pk_ed_b64, pk_x25519_b64=pk_x_b64,
+        nonce_node=nonce_s, ts=ts,
+    )
+    ch_bob.send(_pack({
+        "type": MNP.JOIN_REQUEST, "v": MNP_VERSION,
+        "group_id": TEST_GROUP,
+        "pk_ed25519": pk_ed_b64, "pk_x25519": pk_x_b64,
+        "code": code, "ts": ts,
+        "sig": base64.b64encode(sk_bob_ed.sign(transcript)).decode(),
+    }))
+
+    result = await asyncio.wait_for(q_bob.get(), timeout=5.0)
+    assert result["type"] == MNP.JOIN_RESULT
+    assert result["ok"] is True
+    assert result["gek"] is True
+    assert result["role"] == ROLE_MEMBER
+
+    # 3. The key really is the group key, and only Bob's secret opens it.
+    assert unwrap_gek_aes(result, sk_x_raw, pk_x_raw) == gek
+
+    # 4. The code is spent.
+    assert await roster.consume_invite(code, "user-002") is None
+
+    await roster.close()
     await pc_admin.close()
+    await pc_bob.close()
     await transport.close_all()
 
 
@@ -1124,8 +1257,10 @@ async def test_gek_bundle_fetch_during_handshake(sk_node, sk_hub, gek, shared_di
 
     # Step 1: Send handshake with group_id so _pending_group is set
     token = _make_jwt(sk_hub, groups=["g"])
+    nonce_c = os.urandom(NONCE_LEN)
     channel.send(_pack({
         "type": MNP.HANDSHAKE, "v": MNP_VERSION, "token": token, "group_id": "g",
+        "nonce": base64.b64encode(nonce_c).decode(),
     }))
     msg = await asyncio.wait_for(received.get(), timeout=5.0)
     assert msg["type"] == MNP.HANDSHAKE_CHALLENGE
@@ -1140,11 +1275,12 @@ async def test_gek_bundle_fetch_during_handshake(sk_node, sk_hub, gek, shared_di
     recovered_gek = unwrap_gek(bundle_resp, sk_x_raw, pk_x_raw)
     assert recovered_gek == gek
 
-    nonce = base64.b64decode(msg["nonce"])
-    offer_fp = _extract_dtls_fp(browser_pc.localDescription.sdp)
-    answer_fp = _extract_dtls_fp(browser_pc.remoteDescription.sdp)
-    proof = hmac.new(recovered_gek, nonce + offer_fp + answer_fp,
-                     hashlib.sha256).digest()
+    nonce_s = base64.b64decode(msg["nonce"])
+    binding = webrtc_binding(
+        _extract_dtls_fp(browser_pc.localDescription.sdp),
+        _extract_dtls_fp(browser_pc.remoteDescription.sdp),
+    )
+    proof = make_proof(recovered_gek, ROLE_CLIENT, "g", nonce_c, nonce_s, binding)
 
     # Step 4: Complete handshake
     channel.send(_pack({
@@ -1229,8 +1365,10 @@ async def test_keypair_bundle_store_and_fetch(sk_node, sk_hub, gek, shared_dir,
     await asyncio.wait_for(ready.wait(), timeout=5.0)
 
     token = _make_jwt(sk_hub, groups=["g"])
+    nonce_c = os.urandom(NONCE_LEN)
     channel.send(_pack({
         "type": MNP.HANDSHAKE, "v": MNP_VERSION, "token": token, "group_id": "g",
+        "nonce": base64.b64encode(nonce_c).decode(),
     }))
     msg = await asyncio.wait_for(received.get(), timeout=5.0)
     assert msg["type"] == MNP.HANDSHAKE_CHALLENGE
@@ -1296,8 +1434,10 @@ async def test_keypair_bundle_fetch_not_found(sk_node, sk_hub, gek, shared_dir,
     await asyncio.wait_for(ready.wait(), timeout=5.0)
 
     token = _make_jwt(sk_hub, groups=["g"])
+    nonce_c = os.urandom(NONCE_LEN)
     channel.send(_pack({
         "type": MNP.HANDSHAKE, "v": MNP_VERSION, "token": token, "group_id": "g",
+        "nonce": base64.b64encode(nonce_c).decode(),
     }))
     msg = await asyncio.wait_for(received.get(), timeout=5.0)
     assert msg["type"] == MNP.HANDSHAKE_CHALLENGE
@@ -1313,9 +1453,18 @@ async def test_keypair_bundle_fetch_not_found(sk_node, sk_hub, gek, shared_dir,
 
 
 @pytest.mark.asyncio
-async def test_gek_auto_activate_on_node_bundle_store(sk_node, sk_hub, gek, shared_dir,
+async def test_gek_not_auto_activated_on_bundle_store(sk_node, sk_hub, gek, shared_dir,
                                                        tmp_path, x25519_keypair):
-    """Storing the node operator's GEK bundle auto-activates GEK (AES variant)."""
+    """
+    A GEK bundle arriving over MNP must NOT become the node's live key (C5b).
+
+    This test previously asserted the opposite: storing a bundle addressed to the
+    node operator auto-activated it, with no signature required. Because the
+    operator's X25519 public key is public — the node publishes it in handshake_ack
+    — any group member could wrap a key of their own choosing for it and take over
+    the group, locking every legitimate member out. GEK activation now happens only
+    through the node's local admin UI or CLI.
+    """
     hub_pk_pem = _hub_pk_pem(sk_hub)
     indexer = DirectoryIndexer(root=shared_dir, group_id="g", sk_node=sk_node, gek=gek)
     await indexer.initial_scan()
@@ -1324,7 +1473,8 @@ async def test_gek_auto_activate_on_node_bundle_store(sk_node, sk_hub, gek, shar
     bundle_store = BundleStore(db_path=tmp_path / "bundles.db")
     await bundle_store.open()
 
-    new_gek = generate_gek()
+    attacker_gek = generate_gek()
+    assert attacker_gek != gek
 
     transport = WebRTCTransport(
         sk_node=sk_node, hub_pk_pem=hub_pk_pem, gek=gek,
@@ -1336,14 +1486,18 @@ async def test_gek_auto_activate_on_node_bundle_store(sk_node, sk_hub, gek, shar
     transport._ctx["sk_x25519_raw"] = sk_x_raw
     transport._ctx["pk_x25519_raw"] = pk_x_raw
     transport._ctx["pk_x25519_b64"] = base64.b64encode(pk_x_raw).decode()
+    transport._ctx["admin_pk_ed25519"] = Ed25519PrivateKey.generate().public_key()
 
     pc_admin, ch_admin, q_admin = await _setup_peer(
         transport, sk_hub, gek, "peer-setup-admin")
 
-    # Store GEK bundle wrapped with AES-GCM (browser-compatible)
-    node_bundle = wrap_gek_aes(new_gek, pk_x_raw)
+    # An ordinary member wraps a key of their choosing for the operator's public
+    # key and offers it to the node. The message that used to carry this no longer
+    # exists (the node wraps the GEK itself now), so it reaches no handler at all —
+    # a stronger outcome than the admin challenge this test used to assert.
+    node_bundle = wrap_gek_aes(attacker_gek, pk_x_raw)
     ch_admin.send(_pack({
-        "type": MNP.GEK_BUNDLE_STORE,
+        "type": "gek_bundle_store",
         "v": MNP_VERSION,
         "user_id": "node-operator",
         "group_id": "g",
@@ -1351,12 +1505,12 @@ async def test_gek_auto_activate_on_node_bundle_store(sk_node, sk_hub, gek, shar
         "nonce_b64": node_bundle["nonce_b64"],
         "wrapped_b64": node_bundle["wrapped_b64"],
     }))
-    ack = await asyncio.wait_for(q_admin.get(), timeout=5.0)
-    assert ack["type"] == "ack"
 
-    await asyncio.sleep(0.2)
+    await asyncio.sleep(0.5)
+    assert q_admin.empty(), "the retired bundle message still gets a response"
 
-    assert transport._ctx.get("gek") == new_gek
+    assert transport._ctx.get("gek") == gek, "group key was seized over MNP (C5b)"
+    assert await bundle_store.fetch("g", "node-operator") is None
 
     await bundle_store.close()
     await pc_admin.close()
@@ -1398,6 +1552,8 @@ async def test_webrtc_no_gek_connection_refused(sk_node, sk_hub, shared_dir):
     token = _make_jwt(sk_hub)
     channel.send(_pack({
         "type": MNP.HANDSHAKE, "v": MNP_VERSION, "token": token,
+        "group_id": TEST_GROUP,
+        "nonce": base64.b64encode(os.urandom(NONCE_LEN)).decode(),
     }))
 
     msg = await asyncio.wait_for(received.get(), timeout=5.0)
@@ -1457,8 +1613,10 @@ async def test_gek_bundle_fetch_not_found(sk_node, sk_hub, gek, shared_dir, tmp_
     await asyncio.wait_for(ready.wait(), timeout=5.0)
 
     token = _make_jwt(sk_hub, groups=["g"])
+    nonce_c = os.urandom(NONCE_LEN)
     channel.send(_pack({
         "type": MNP.HANDSHAKE, "v": MNP_VERSION, "token": token, "group_id": "g",
+        "nonce": base64.b64encode(nonce_c).decode(),
     }))
     msg = await asyncio.wait_for(received.get(), timeout=5.0)
     assert msg["type"] == MNP.HANDSHAKE_CHALLENGE
diff --git a/second-review.md b/second-review.md
index a2218ad..01ee2af 100644
--- a/second-review.md
+++ b/second-review.md
@@ -394,6 +394,16 @@ Consider a localhost token in the URL to blunt DNS-rebinding against the unauthe
 
 ### H3 — An active hub breaks confidentiality through key substitution (T2 is not a residual risk)
 
+> **CLOSED 2026-08-14.** Not by the fix proposed below. The invite path no longer reads
+> the directory at all: the node holds the GEK and wraps it for a key the recipient
+> proves possession of over the authenticated channel, and identities are bound to
+> accounts by one-time codes the hub never sees. Safety numbers would have made the
+> substitution *detectable by a human who checks*; removing the lookup makes it
+> impossible. See `docs/invite-pairing-v1.md` and draft-v5 §5.5.
+>
+> `gek-init` had the same flaw with the node as the victim — it fetched every member's
+> public key from the hub and wrapped for the answer. That is gone too.
+
 **Location:** `app.js:1389-1415`, `users.py:340-358`, `users.py:310-337`
 
 The invite flow is: fetch `pk_x25519` for the invitee **from the hub**, wrap the GEK for it,
@@ -535,7 +545,11 @@ minimum password, and the calibration command prints instructions to hand-edit a
 `meshbay_common` rather than writing a per-node parameter — so the keystore parameters cannot
 actually be tuned per hardware as §4.2.1 promises.
 
-**M3 — Node operator cannot delete files in the default configuration.** `_resolve_admin_pk`
+**M3 — Node operator cannot delete files in the default configuration.** *(CLOSED
+2026-08-14 — the auto-pin is deleted; authority comes from the node's roster, established
+locally by `meshbay-node operator pair`. Asking the hub for the operator's key, the
+obvious-looking fix, would have let the hub install itself as node administrator.)*
+`_resolve_admin_pk`
 (`daemon.py:451-465`) auto-pins the **node keystore's** Ed25519 key, while the browser signs
 challenges with the **user identity** key from the keypair bundle (`app.js:983`). These are
 different keys, so verification fails unless the operator manually sets `admin_pk_ed25519` to
@@ -543,6 +557,13 @@ their browser key. Fails closed, so it is a correctness problem rather than a ho
 sovereignty feature is effectively inert as shipped, and the mismatch will invite the wrong
 fix (relaxing the check) unless it is documented.
 
+> **C4 — REDUCED 2026-08-14, not closed.** The bundle's KDF moved from PBKDF2-SHA512
+> 600k to Argon2id 128 MB/t=3 in the browser (vendored WebAssembly), so an operator
+> attacking one offline no longer enjoys the GPU economics of a compute-only KDF. The
+> pre-proof window is unchanged and still bounded. What remains: bundles are still stored
+> on every node their owner joins, and a weak passphrase still loses — draft-v5 §7.1 gives
+> the measured numbers. It closes at 13.3.
+
 **M4 — Response-to-request matching by arrival order.** `transport.js:390-422` resolves the
 **oldest** pending promise with whatever message arrives, ignoring type. With the 8-deep
 pipelined download window, a node that reorders responses (or an `error` message arriving
@@ -619,6 +640,11 @@ client path.
 
 ## 7. Does the system do what it claims?
 
+> This table is the verdict **on the code as it stood on 2026-08-13**, and is left as the
+> record of what the review found. It is not the current state: Phase 11.5 closed C1–C6
+> and H1–H7 except H3, and the invite redesign closed H3 and M3 on 2026-08-14. For what
+> holds today, and against which adversary, read draft-v5 §2 — never this table.
+
 | Claim (draft-v4) | Verdict | Why |
 |---|---|---|
 | Data never transits a central server | **Yes** | WebRTC DataChannel is genuinely P2P; hub relays SDP only. Well executed. |
diff --git a/tmp-decisions.md b/tmp-decisions.md
index 97a27ea..347d771 100644
--- a/tmp-decisions.md
+++ b/tmp-decisions.md
@@ -1,7 +1,8 @@
-# Open decisions — client architecture
+# Client architecture — decisions
 
-> Working note, not a spec. Created 2026-08-13 after the second security review.
-> Delete or fold into `docs/meshbay-draft-v5.md` once decided.
+> Created 2026-08-13 after the second security review. D1/D2/D3 decided the same day;
+> D4 (hub minimization) deferred. Fold into `docs/meshbay-draft-v5.md`.
+> The analysis below is kept as the rationale behind the decisions, not as open questions.
 
 ---
 
@@ -9,18 +10,35 @@
 
 | # | Decision | State |
 |---|---|---|
-| D1 | Does the hub keep serving the web UI? | **Open** — leaning yes |
-| D2 | Browser extension, native desktop client, or both? | **Open** — needs time |
+| D1 | Does the hub keep serving the web UI? | ✅ **DECIDED 2026-08-13 — yes** |
+| D2 | Browser extension, native desktop client, or both? | ✅ **DECIDED 2026-08-13 — native client, offered alongside the hub-served SPA** |
 | D3 | Transport: aiortc primary, QUIC at parity, TCP+HTTP removed | ✅ Decided 2026-08-13 |
+| D4 | Hub minimization (old Phase 12) | ⏸️ **Deferred, may be dropped** |
 
-**Neither D1 nor D2 blocks anything right now.** Phase 11.5 (security remediation),
-Phase 12 (hub minimization), Phase 14 (node CLI) and Phase 15 (Sender Keys) are entirely
-client-agnostic — every finding they close is node-side or hub-side. Phase 11.5 is in
-progress on that basis.
+**What was decided.** The hub keeps serving the web UI — that is the zero-install path
+and it stays. A native desktop client is offered *in addition*, not as a replacement.
+Hub minimization is off the critical path and may be dropped entirely.
 
----
+**What that means, stated once and then respected.** Keeping the hub in the trusted path
+is a legitimate product call, and this project is not obliged to defend against its own
+operator. But two consequences should be carried deliberately rather than by accident:
+
+1. **T3 is accepted permanently for browser users.** A hub that serves the code can
+   exfiltrate keys from the page regardless of what the protocol does. The native client
+   gives users who care an alternative; browser users are trusting meshbay.org, and the
+   docs should say so plainly rather than claiming end-to-end integrity.
+2. **H3 was the last open High finding and its only fix lived in the dropped phase.**
+   The hub is the public key directory: substituting a key during an invite hands it the
+   group key, silently, with no forgery and no code injection. So key transparency and
+   safety numbers were kept and are now Phase 12.1 — everything else from hub
+   minimization is dropped. If Phase 12 is later dropped too, H3 stays open by choice,
+   and "unreadable by other parties, even the hub" stops being a claim the project can
+   make about an adversarial hub.
+
+The honest framing that survives all of this: **the hub cannot read your content unless
+it actively attacks you.** That is still a strong property, and it is defensible.
 
-## Why these are open
+## Rationale — why the native client is not a T3 fix
 
 The second review recommended a native client and claimed *"T3 disappears — code integrity
 stops depending on the hub."* **That claim was wrong and has been corrected** in
@@ -52,12 +70,12 @@ It should not be justified as the fix for T3 unless 18.7 ships with it.
 
 ---
 
-## D1 — Should the hub keep serving the UI?
+## D1 rationale — hub keeps serving the UI ✅
 
 Keeping it is defensible. It is how anyone tries the platform without installing anything,
 and it stays the fallback when a device has no client installed.
 
-What must be true if it stays (all already scheduled in Phase 12.6):
+What must be true now that it stays (Phase 12.2/12.3):
 
 - strict CSP and Subresource Integrity on the bundle
 - the hub publishes a **signed digest** of the served bundle, so any third party — an
@@ -69,7 +87,7 @@ The honest framing: hub-served SPA is a **convenience tier**, not the secure tie
 
 ---
 
-## D2 — Extension vs native: what each actually covers
+## D2 rationale — native chosen; extension not taken up
 
 Three shapes, cheapest first:
 
@@ -85,7 +103,7 @@ hub operator does not control**. Manifest V3 forbids remote code, which works in
 the structure enforces exactly what we want. Keys live in extension storage, isolated from
 page JS. Moderate effort.
 
-**Option C — Native desktop client (pywebview + aiortc)**
+**Option C — Native desktop client (pywebview + aiortc)** ← **CHOSEN**
 Phase 13. Full control, durable keys in an OS keystore, QUIC, hub-less access, best UX.
 Highest effort, and the security argument depends on 18.7.