fix(client): the page names node operations, and the app confirms what widens the node

node:call is replaced by named operations with checked arguments; hosting a
group, sharing an unpicked folder, key rotation, denylist clearing and a change
of node account are confirmed by a native dialog. Every channel checks its
sender, secrets:get/set/clear are gone, node:start writes the app's own hub.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 7 insertions, 0 deletions

diff --git a/docs/USERGUIDE.md b/docs/USERGUIDE.md
index a802ae1..e190a92 100644
--- a/docs/USERGUIDE.md
+++ b/docs/USERGUIDE.md
@@ -203,6 +203,13 @@ any. So the application is the one to prefer for anything you care about. The
 browser stays, and is a perfectly reasonable way to use MeshBay — being able to
 open a group on someone else's laptop with nothing installed is worth having.
 
+The application asks in a small window of its own, not in the page, before it
+hosts a group on this computer, shares a folder you did not pick in its folder
+dialog, replaces a group's key, clears the denylist, or points the node at
+another account. A folder you pick in the folder dialog is not asked about
+twice. That window belongs to the application, so nothing displayed in the page
+— which shows content from other people's nodes — can answer it for you.
+
 ---
 
 ## 4. Joining a group