feat: invitation links no longer bound to an e-mail addressHEADmain

A link is redeemable by whoever opens it first, so it can be sent by any
messaging app. The address is optional (mail + label only); a link lives
7 days, fixed. Adds a Share button; see MESHBAY_DESIGN.md §3.4.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 5 insertions, 4 deletions

diff --git a/docs/MESHBAY_NODE_PROTOCOL.md b/docs/MESHBAY_NODE_PROTOCOL.md
index 2206971..3351793 100644
--- a/docs/MESHBAY_NODE_PROTOCOL.md
+++ b/docs/MESHBAY_NODE_PROTOCOL.md
@@ -866,10 +866,11 @@ source of authority is a second thing to get wrong.
 ### 8.6 Invitation links (`kind = "link"`)
 
 A code for someone who may have no account yet, so it names none: it is bound to the
-first account that redeems it (`invite_link_create`, §10.4). What stops a stranger
-holding it is not the node but the hub, which lets only the account whose verified
-address the inviter named reach the node at all (`MESHBAY_DESIGN.md` §3.4). At the
-node it is therefore a **bearer code**, and everything else about it is fixed:
+first account that redeems it (`invite_link_create`, §10.4). Nothing stops a
+stranger holding the whole link — the hub's ticket is a bearer secret too
+(`MESHBAY_DESIGN.md` §3.4) — so what bounds it is that it works once, for seven
+days, and can be cancelled. At the node it is a **bearer code**, and everything else
+about it is fixed:
 
 * role `member`, never `operator`; a row that says otherwise is refused, not honoured;
 * one named group, never node-wide, and only redeemed on a connection authenticated to