fix(hub): a node that hosts nothing is not a free target, and a private group's hosts are its members'

Two checks that were not performed, in the same shape: something true of the
public case, written so it did not apply to the rest.

**Signaling.** The membership check read `if node_group_ids:`, so an empty set
skipped it — membership, group status and the public-group gate together — and
the offer was relayed. Since AV1 made an empty claim mean "no groups" rather
than "all of my owner's", that is the *normal* registration of a node hosting
nothing: the unconfigured node left running, the machine in this register's
founding incident, and the one least able to absorb the work. Each offer makes
it allocate an RTCPeerConnection and gather ICE, 30 a minute, which is H6
restored in exactly the case AV1 made common. It is refused now. Nothing
legitimate is lost: such a node refuses the handshake anyway — `group_id` is
mandatory (M1) and a node with no group key refuses (NS8) — so this declines
work the node would decline one step later at its own expense.

**The node list.** `GET /v1/groups/{id}/nodes` checked membership only for a
public group with public groups switched off. A private one answered any
authenticated account that knew the id — which an ex-member knows for ever —
with the ids and public keys of the machines hosting it. §7.4 already stated the
property for the public case. Membership is required now unless the group is
public and public groups are on. Nothing needs the list before joining: an open
join writes the membership row first, and an invitation registers the invitee's
when the code is created, both checked before making the change.

`test_webrtc_signaling_roundtrip` had to be repaired, and is the finding
restated: it registered a node in `_connected_nodes` and never in
`_node_groups`, so it drove the relay through the hole rather than through the
door — the check it routed around was the defect. It now registers the group a
real node registers.

§7.2 and §7.3 gain the rules, the register AV24 and AV25, and
test_availability_between_members.py two cases that fail on the property
against the previous source.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UMxEQadpzPkYLFf5CYKhpW

1 files changed, 19 insertions, 0 deletions

diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md
index 4147fe7..68b9fa9 100644
--- a/docs/MESHBAY_DESIGN.md
+++ b/docs/MESHBAY_DESIGN.md
@@ -1601,6 +1601,15 @@ share an active group with the target node**. Otherwise any authenticated user
 could make a third party's machine allocate peer connections on demand (**H6**).
 The address in a NAT-punch request must match the caller's source address.
 
+**A node registered for no group shares one with nobody**, and is refused rather
+than exempted. Written as "check membership if the node claims any group", the
+rule skipped itself — membership, group status and the public-group gate
+together — for precisely the node that AV1 made commonplace: the unconfigured
+one, hosting nothing, which is also the one least able to absorb the work. No
+legitimate connection is lost, because such a node refuses the handshake anyway
+(`group_id` is mandatory, **M1**, and a node holding no group key refuses,
+**NS8**); the refusal simply stops happening at the operator's expense.
+
 `X-Forwarded-For` is honoured **only from a trusted proxy, rightmost hop** (**M7**),
 through one helper so the behaviour is defined in one place — including for the
 rate limiter, whose keying otherwise collapses to a single global bucket behind a
@@ -1624,6 +1633,14 @@ staff exempt. Public groups are the ones that cost other people something: they
 appear in the directory and are brokered to strangers. The check is at creation
 only, which is correct because the update endpoint refuses to change visibility.
 
+**Which nodes host a group is answered to its members.** For a public group that
+is everyone, which is what public means; for a private one it is the membership
+row and nothing else. Answering any authenticated account — as it did while only
+the public case was checked — hands whoever knows the group id the identities of
+the machines hosting it, and an ex-member knows that id for ever. Nothing needs
+it before joining: an open join writes the membership row first, and an
+invitation registers the invitee's when the code is created.
+
 ### 7.4 Instance policy
 
 `hub_settings` is a key/value table an admin edits at runtime. It is **instance
@@ -2600,6 +2617,8 @@ had already been asked.
 | **AV21** | **A lease is what the node granted, not what the client called it** (§5.5). `tr` was read as a boolean, so any non-empty string skipped the leaseless ceiling and every cap behind it, and a queued transfer was held back only by the honesty of the client waiting in the queue |
 | **AV22** | **The node's own controls take no authority from a hub token** (§6.7). `node_status`, `node_settings_set`, `roster_read`, `denylist_read`, `denylist_clear` and `node_reload` were gated on the account id in the JWT, which is the hub's to choose — NS4 and M3 with the check written the other way round. The gate is a proved operator device, which a hub holding no user keys cannot produce |
 | **AV23** | **An upload's owner is recorded when the upload ends and applied when the entry is created**, which are different moments (§5.4). Written against the index at the end of the upload it matched nothing, every time, and left every uploaded file owned by nobody — so no member could delete what they had sent |
+| **AV24** | **A node registered for no group is refused signaling, not exempted from it** (§7.2). The membership check was written as "if the node claims any group", so it skipped itself — membership, group status and the public-group gate together — for the node AV1 made commonplace: the unconfigured one, which is also the one least able to absorb the work |
+| **AV25** | **Which nodes host a group is answered to its members** (§7.3). Only the public case checked, so a private group told any authenticated account that knew its id which machines hosted it — and an ex-member knows that id for ever |
 
 ### 13.6 Chat design findings