feat(node): invitation links — a code bound to no account until redeemed

New invite kind "link": member of one group, once, never operator, not
spendable by an active member, capped at 20 per group, cancellable by
handle. Signed ops invite_link_create / invite_cancel, loopback routes,
and the known-device join path now accepts a link code. Adds the plan,
docs/invite-links.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 11 insertions, 0 deletions

diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md
index 4b99fb4..371163e 100644
--- a/docs/MESHBAY_DESIGN.md
+++ b/docs/MESHBAY_DESIGN.md
@@ -420,6 +420,15 @@ being bob on his first connection:
 | Safety-number comparison | Nothing — but it needs two humans reading digits at the worst moment | correct, unusable as a default |
 | **One-time pairing code** | **Nothing: the code never reaches the hub** | **adopted** |
 
+**An invitation link is the one code that names no account**, because it goes to
+someone who may not have one yet. At the node it is a bearer code — a member of one
+group, once, never an operator, never for someone already in the group, at most
+twenty outstanding per group, cancellable (`MESHBAY_NODE_PROTOCOL.md` §8.6). Who may
+bring it is decided before the node is reached: the hub admits only the account whose
+verified address the inviter named, and the client sends the code only to the node
+the link names, once that node has signed its challenge (§5.2). The node half is
+built; the hub ticket and the client are not yet (§15.2, `docs/invite-links.md`).
+
 **Mailing the code is the inviter's choice, and it gives up the row above.**
 The Members tab can ask the hub to mail the code to the invitee's address on file
 (`invite-notify`); that request carries the code, so an active hub holds it and
@@ -973,6 +982,7 @@ from anything in the response.
 | `file_delete` | the operator, or **any non-revoked device of the uploading account** |
 | `dir_delete` | the operator alone, and only on an empty directory |
 | `invite_create` | the operator (or a delegate, when delegation ships) |
+| `invite_link_create`, `invite_cancel` | the operator |
 | `gek_rotate` | operator-signed; the node generates the key itself |
 | initial `gek-init` | **local admin API or CLI only** |
 | root add/remove/update/eject/plug, `apps_enabled`, app directories, transfer limits | operator-signed |
@@ -3190,6 +3200,7 @@ process runs it — `systemctl --user` on Linux, Task Scheduler on Windows.
 | — | DLNA/UPnP casting (§11.4) |
 | — | **Bitmap subtitles** (PGS, VOBSUB — about a fifth of the embedded streams). No WebVTT without OCR; they are not listed rather than listed and blank. Burn-in covers them and costs `-c:v copy`, which is what the eight-slot sizing assumes never happens |
 | — | Delegation (§3.4) |
+| — | **Invitation links** (§3.4). The node half is built — the unbound code, its signed ops and the join path; the hub ticket bound to an address and the client that reads the link are not (`docs/invite-links.md`) |
 | — | Tier 3 roster attestation (§3.3) |
 | — | Android client |
 | — | **Federation between two hubs.** The protocol is written and switched off in the code (§7.6); what is not built is one run between two machines |