Merge remote-tracking branch 'origin/main'

1 files changed, 30 insertions, 0 deletions

diff --git a/docs/meshbay-draft-v6.md b/docs/meshbay-draft-v6.md
index a5fb8d3..c1ce3fc 100644
--- a/docs/meshbay-draft-v6.md
+++ b/docs/meshbay-draft-v6.md
@@ -53,6 +53,7 @@
 | 11 | Hub role | The hub gains a **runtime instance-policy store** (`hub_settings`). First policy: an admin switches **public groups off** hub-wide, enforced server-side on every hub-mediated path. `suspend` vs `revoke` on a group are now written down as the distinct things they are | §2.8 |
 | 12 | Group registry | A group name is **unique per owner account**, not globally; the group's identity is still its UUID. Listed everywhere as `name@owner` | §2.9 |
 | 13 | Enrichment | **Chat link previews** — the node unfurls a pasted URL into an OpenGraph card. A new instance of the §2.7 "node on demand, asking device caches, nothing durable" rule; new SSRF surface, gated. MNP 0.12 | §2.10 |
+| 14 | Node page | The Node page (D5) **exposes five `[node]` settings** — TTLs for invitations, pairing and device requests, the concurrent stream cap, and the transcode toggle. Editable from the panel, persisted in both `roster.db` and `node.toml` | §2.11 |
 
 ---
 
@@ -362,6 +363,35 @@ pinning the checked IP — deferred.
 **MNP 0.12** — `link_preview_req` / `link_preview_resp`, additive: an older node logs
 "unknown type" and the client shows the bare link.
 
+### 2.11 Node page — `[node]` settings exposed to the operator
+
+New. The Node page (D5) connects over MNP and shows groups, roots and the roster;
+it does not show the daemon's own tuning. Five `[node]` settings from `node.toml`
+are worth surfacing there — they affect what the node does, not only how it starts,
+and their current value is invisible until something goes wrong (an invitation that
+expired silently, a viewer told "server busy" with no knob to turn).
+
+| Setting | Type | Default | What it controls |
+|---|---|---|---|
+| `invite_ttl_hours` | positive int | 168 (7 days) | How long a member invitation code remains valid. An invitation travels through a human conversation and may be read days later; too short and the recipient finds a dead code with no message telling them what happened |
+| `pair_ttl_hours` | positive int | 24 | How long an operator pairing code remains valid. Shorter than an invitation because the code is typed during the SSH session that printed it |
+| `device_request_ttl_minutes` | positive int | 60 | How long a device-add request may wait for approval from an existing device. Comfort rather than security: the code is bound to the requesting keys by its hash, so a longer window widens nothing an attacker can use |
+| `max_concurrent_streams` | positive int | 8 | Maximum simultaneous video streams. One ffmpeg process runs per viewer; it remuxes rather than re-encodes so CPU cost is low, but each uses about 50 MB of memory. When reached, new viewers are told the server is busy. Override: `MESHBAY_MAX_CONCURRENT_STREAMS`. Zero or negative values are ignored with a warning |
+| `transcode_incompatible_video` | bool | true | When true, HEVC and other browser-incompatible video codecs are transcoded to H.264 during streaming so browsers can play them. Unlike remuxing, this costs real CPU per concurrent viewer. Set to false only when all viewers are known to decode the source codec natively |
+
+**Editable from the panel, persisted in both `roster.db` and `node.toml`.** The panel
+writes to both stores simultaneously: `roster.db` for immediate effect (no restart needed),
+`node.toml` so the value survives a DB wipe or a fresh install. On startup, `node.toml` is
+read as today; if `roster.db` holds an override for a key, it takes precedence. A manual
+`node.toml` edit plus a reload overwrites the roster value. The TOML write is a targeted
+line replacement (the same technique `ops.py` uses for roots), not a round-trip through a
+writer — comments and formatting survive.
+
+**Wire shape.** `node_status_ack` gains a `settings` object carrying the five values above
+(effective, i.e. roster override if present, config default otherwise). `node_settings_set`
+writes changes and returns `node_settings_set_ack` with the updated keys. Both are
+operator-only.
+
 ---
 
 ## 3. Filesystem portability as a security property