docs: say who the concordance is still for

§16 opened by saying "code comments, tests and older documents cite sections
of the documents this one replaces", and closed by saying "nothing needs
editing to follow a reference". Neither holds since 20a8241: the code carries
no reference to a removed document, and that commit is precisely the editing
the second sentence said was unnecessary. Left as it was, that sentence tells
the next reader a dead reference may stay dead.

The table itself is unchanged and stays whole — every row still resolves
something. What changed is who asks: 629 commits of history that cannot be
rewritten, the superseded documents kept under docs/ (cast-smart-tv.md and
WINDOWS-PORT.md both route readers here by name), and notes held outside this
repository. The intro now says that, and states the rule the code follows
instead — cite this document and a section.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 18 insertions, 6 deletions

diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md
index f1c0a67..33ab6fa 100644
--- a/docs/MESHBAY_DESIGN.md
+++ b/docs/MESHBAY_DESIGN.md
@@ -2363,6 +2363,14 @@ extension-gated: two container formats tag perfectly and decode in no mainstream
 engine, so for those the node performs a **one-shot whole-file conversion**, cached
 under its own content hash and served through the ordinary chunk path.
 
+**That conversion has a size ceiling, and it is the cache's rather than
+memory's.** The result is one row in a 512 MB least-recently-used store sized for
+thumbnails, posters and subtitle tracks; a source hours long would be a single row
+that evicts most of the cache to fit and is evicted again by the next few
+thumbnails. Whole-file is the right shape for the few-megabyte sources this
+exists for, and the wrong one past that — serving audio of that length means
+streaming the conversion, which is a different feature and not this one.
+
 **The player is persistent across tabs**, at shell level: closing the tab must not
 stop the music. The next queued track is prefetched while one plays — client-side
 only, a small in-memory cache evicted as the queue moves.
@@ -2890,7 +2898,7 @@ had already been asked.
 | **AV6** | **A relay proves possession of its approved key.** A public key is not a password, and the register call is unauthenticated by design — it is not a user — so the proof is the only thing standing between a stranger and where nodes send relayed traffic |
 | **AV7** | **A node bounds how many peers it holds and how long an unproven one lasts.** The hub's cap is per calling account, which is a limit on each member and not on the machine, so without this an operator's exposure grew with the size of their groups |
 | **AV8** | **One account cannot make the hub mail another at will.** The invitation email's subject comes from the group row, never from the request, and the endpoint is metered |
-| **AV9** | **No mail is sent from the event loop.** `smtplib` is synchronous and waits up to ten seconds; called from an async handler that wait is the whole instance's, not one request's. Every send goes through `mail.send_off_loop`. **Argon2 is held to the same rule**: every derivation runs on one dedicated worker thread (`auth.*_off_loop`), never on the loop and never two at a time, because two concurrent `lanes=4` derivations deadlock in OpenSSL. **So is the node's disk**: every filesystem call on a group's content — the stat as much as the read, since a stat is what wakes a sleeping disk — goes through `roots.off_disk`, onto one worker thread per root set. A spun-down or network-mounted root answers its first syscall in seconds, and on the loop that is every group, every stream and the hub socket waiting for a platter |
+| **AV9** | **No mail is sent from the event loop.** `smtplib` is synchronous and waits up to ten seconds; called from an async handler that wait is the whole instance's, not one request's. Every send goes through `mail.send_off_loop`. **Argon2 is held to the same rule**: every derivation runs on one dedicated worker thread (`auth.*_off_loop`), never on the loop and never two at a time, because two concurrent `lanes=4` derivations deadlock in OpenSSL. **So is the node's disk**: every filesystem call on a group's content — the stat as much as the read, since a stat is what wakes a sleeping disk — goes through `roots.off_disk`, onto one worker thread per root set. A spun-down or network-mounted root answers its first syscall in seconds, and on the loop that is every group, every stream and the hub socket waiting for a platter. **ffmpeg's own output too**, through `asyncio.to_thread` rather than that per-root thread: a temp file is not a group root and has no platter to serialise against, but a whole transcode read inline is still tens of megabytes of blocking read |
 | **AV10** | **Every path that makes the hub send mail is metered, per account.** A rate limit that counts by IP bounds a caller, not an inbox. Changing one's address mails an arbitrary stranger, so it carries a cooldown *and* a daily ceiling; a reset request and a registration resend carry cooldowns |
 | **AV13** | **The mail server is not a relay, and `mail.py` is where that is decided.** Every message passes one function; `purpose` is keyword-required and checked against a closed list, so a helper that names anything else does not send and one that names nothing is a TypeError. Under it sit a bound per **recipient** — the thing a person being mail-bombed actually experiences, unmoved by which account, address or endpoint asks — and an instance-wide hourly ceiling, because registration is open and "per account" is a bound an attacker buys more of |
 | **AV11** | **A namespace a client writes into is closed, and its rows are capped.** The preference key space is an allow-list plus `default_tab:<group_id>` checked as a group id, the value is length-bounded, and the row count per account is bounded |
@@ -3085,12 +3093,16 @@ process runs it — `systemctl --user` on Linux, Task Scheduler on Windows.
 
 ## 16. Concordance
 
-Code comments, tests and older documents cite sections of the documents this one
-replaces. **Those documents are no longer in the tree** — they were removed on
-2026-09-11, once their content was here and this table could resolve every
-reference they left behind. `git log -- docs/` recovers any of them.
+Older documents, notes outside this repository and every earlier revision in
+git cite sections of the documents this one replaces. **Those documents are no
+longer in the tree** — they were removed on 2026-09-11, once their content was here and
+this table could resolve every reference they left behind. `git log -- docs/`
+recovers any of them.
 
-Nothing needs editing to follow a reference: look the citation up here.
+The code does not need this table: since 2026-09-19 every comment and test cites
+`MESHBAY_DESIGN.md` and a section directly, and a new one must. What this
+resolves is what cannot be rewritten — a commit message, a `git blame`, a
+superseded document kept under `docs/`, a note somebody holds elsewhere.
 
 | Cited as | Read |
 |---|---|