docs: mark Phase 5 complete — QUIC, federation, moderation, packaging

59/59 tests. Hub deployed on meshbay.org with all Phase 5 features.
Android/iOS deferred. MHP federation memory-only (DB persistence next).

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

1 files changed, 36 insertions, 11 deletions

diff --git a/devel-phases.md b/devel-phases.md
index ce584fc..517ca06 100644
--- a/devel-phases.md
+++ b/devel-phases.md
@@ -254,22 +254,47 @@ ffmpeg (system package) — HLS segmentation via subprocess
 
 ---
 
-## Phase 5 — QUIC, Federation, Mobile
+## Phase 5 — QUIC, Federation, Moderation ✅ DONE (Mobile deferred)
 
 **Goal:** full decentralization, mobile support, community infrastructure.
 
 | # | Component | Notes |
 |---|---|---|
-| 5.1 | QUIC transport (MNP v2) | Replace TCP+TLS with aioquic; same application protocol |
-| 5.2 | MHP federation | Hub-to-hub Mesh Directory exchange, explicit peer allowlist |
-| 5.3 | Mesh Relay | Community TURN relay registration protocol |
-| 5.4 | Android client | Kotlin/Flutter, hub account, group access, node pairing |
-| 5.5 | Content replication | Node-to-node, admin-authorized, no hub involvement |
-| 5.6 | iOS client | After Android stabilizes |
-| 5.7 | Revocation push | WebSocket hub→node signed token broadcast |
-| 5.8 | CSAM hash matching | NCMEC/IWF integration on public content registration |
-| 5.9 | Moderation flow | blake3 blocklist, DMCA takedown, escalation |
-| 5.10 | RPM/DEB packaging | meshbay-hub, meshbay-node, python3-meshbay-common |
+| # | Component | File(s) | Status |
+|---|---|---|---|
+| 5.1 | QUIC transport (MNP v2) | `transport/quic_server.py` + `quic_client.py` | ✅ 3/3 tests |
+| 5.2 | MHP federation | `meshbay_hub/api/federation.py` | ✅ GET/POST /mhp/* |
+| 5.3 | Mesh Relay | `meshbay_hub/api/relay.py` | ✅ register+list+approve |
+| 5.4 | Android client | — | ⏳ deferred (different tech) |
+| 5.5 | Content replication | — | ⏳ deferred |
+| 5.6 | iOS client | — | ⏳ after Android |
+| 5.7 | Revocation push | `api/revocation.py` + `node/revocation.py` | ✅ 3/3 tests |
+| 5.8 | CSAM hash matching | `meshbay_hub/csam.py` | ✅ CSAMChecker + admin API |
+| 5.9 | Moderation | `api/moderation.py` | ✅ 6/6 tests |
+| 5.10 | RPM/DEB packaging | `packaging/` | ✅ spec + control + systemd |
+
+**Total: 59/59 tests.**
+
+### Phase 5 bugs fixed
+
+- **QUIC**: `asyncio.Event` race condition in client recv loop (quic_event_received
+  overwrote `_stream_events[0]` created by `_recv`). Fixed with `asyncio.Queue`
+  (no shared mutable state between coroutines).
+- **QUIC**: `verify_peer` parameter renamed to `verify_mode` in aioquic 1.3.0.
+- **QUIC**: `connect()` returns protocol directly (not `(transport, proto)` tuple).
+
+### Phase 5 dependencies added
+
+```
+aioquic==1.3.0    # QUIC transport (Cloudflare-maintained)
+websockets        # hub→node revocation push
+```
+
+### Deferred to future
+
+- Android/iOS client (Kotlin/Flutter — different tech stack, dedicated effort)
+- Content replication (node-to-node, Phase 6)
+- MHP federation persistence (currently in-memory; needs DB table `federated_groups`)
 
 ---