feat: Phase 9 — Web client SPA with WebRTC P2P transport

Complete browser-based client: Preact SPA with login, group file browser,
encrypted download, video playback, group chat, i18n, and dark/light theme.
Browser connects P2P to nodes behind residential NAT via WebRTC DataChannel
(aiortc). Hub handles signaling only — all data flows E2E.

Performance: pipelined downloads (8-chunk sliding window), binary msgpack
wire format (no base64), redundant I/O elimination. Large file downloads
stream to disk via File System Access API (showSaveFilePicker).

Validated on SFR + Orange residential NATs, Chrome + Firefox, IPv4/IPv6.
132 tests passing. Deployed to meshbay.org + Orange node.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 70 insertions, 0 deletions

diff --git a/devel-phases.md b/devel-phases.md
index f1735e4..b5bef49 100644
--- a/devel-phases.md
+++ b/devel-phases.md
@@ -325,6 +325,76 @@ persistent MHP federation, content replication, and browser private group decryp
 
 ---
 
+## Phase 7 — Node v2: production, streaming, chat ✅ DONE
+
+**Goal:** multi-group node, Sender Keys chat, QUIC 0-RTT, jti denylist push, HLS streaming.
+
+Commit: fc56585 — 26 files, +2155/−159 lines, 109 tests.
+
+See `devel-phases-next.md` for details.
+
+---
+
+## Phase 8 — Hub v2: admin, federation, security ✅ DONE
+
+**Goal:** admin roles, email encryption, refresh token rotation, rate limiting, healthcheck.
+
+Commit: 46918ec — 20 files, +508/−90 lines, 117 tests.
+Deployed to meshbay.org. All security review items S1/S2/S5 resolved.
+
+See `devel-phases-next.md` for details.
+
+---
+
+## Phase 9 — Web client: WebRTC transport + core SPA ✅ DONE
+
+**Goal:** browser connects P2P to a node behind residential NAT via WebRTC DataChannel.
+Full SPA: login, groups, file browser, download, video playback, chat, i18n, dark/light.
+
+### Milestones
+
+| # | Component | Status |
+|---|---|---|
+| 9.1–9.5 | WebRTC DataChannel spike + E2E NAT validation | ✅ |
+| 9.6–9.12 | Preact SPA (login, groups, files, video, chat, i18n, settings) | ✅ |
+| 9.13 | Tests: 132 passing | ✅ |
+| 9.14–9.16 | Performance: pipelining, binary wire format, I/O reduction | ✅ |
+| 9.17 | Large file download: File System Access API (stream to disk) | ✅ |
+
+**Total: 132/132 tests. Deployed to meshbay.org + Orange node (2026-08-11).**
+
+### Key technical decisions
+
+- **Transport:** WebRTC DataChannel (aiortc on node) — browsers can't use QUIC for NAT traversal
+- **Wire format:** length-prefixed msgpack, binary chunk fields (no base64)
+- **UI:** Preact + htm ESM (vendored, no build step, no CDN, no npm)
+- **Crypto:** WebCrypto SubtleCrypto AES-256-GCM for E2E chunk decryption in browser
+- **Large files:** File System Access API (`showSaveFilePicker`) — stream to disk, ~8 MB RAM
+- **Indexer:** 2s debounce + path-based dedup for file copy events
+
+### NAT traversal validated
+
+Two ISPs (SFR + Orange residential NAT), Chrome + Firefox, IPv4 STUN + IPv6 direct.
+No TURN relay needed. See `devel-phases-next.md` for detailed test matrix.
+
+### QE deployment state (2026-08-11)
+
+- **Hub (meshbay.org):** running as `meshbay-hub.service`, DB has 3 users
+  (admin, cbesson, grenet), 1 group (`d3bbd90b`), `admin_usernames = ["admin"]`
+- **Node (Orange host via `ssh cbesson@localhost -p 2222`):** running as
+  `nohup .venv/bin/python3 QE/demo-v3/run_node_simple.py`, user grenet,
+  connected via WS to hub, WebRTC + QUIC dual transport
+- **Credentials:** `QE/demo-v3/creds.json` (not versioned)
+- **Shared dir on node:** `~/meshbay/QE/demo-v3/shared/`
+- All 3 users password: see creds.json
+
+### Dependencies added
+
+- `aiortc>=1.9` in meshbay-node (WebRTC DataChannel)
+- `preact` + `htm` vendored as `static/vendor/htm-preact.js` (ESM, ~3 KB gzipped)
+
+---
+
 ## Conventions
 
 - Commits: `feat(node):`, `fix(hub):`, `chore(common):`, `docs:`, `test(node):`