fix: list as members only the accounts the node has admitted

The Members list showed the hub's membership, which an account gains when it
accepts the invitation or redeems a link, before it has presented its code to
the node. The node's roster is the authority (MESHBAY_DESIGN.md §3.4), so
the list now crosses the hub's members with the sealed group roster the node
already sends every connected member. An account the node has not admitted
yet is shown to the owner alone, as waiting for its code, with the Remove
button; other members do not see it. When the roster cannot be read, the
hub's list is shown as before.

groupRoster() takes { fresh: true } so the page sees who joined since the
connection opened.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 4 insertions, 1 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport-devices.js b/packages/meshbay-hub/src/meshbay_hub/static/transport-devices.js
index 8dbb6c0..f079f80 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/transport-devices.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/transport-devices.js
@@ -23,7 +23,10 @@ extendTransport(class {
    * at first sight, where there is nothing to compare against — that boundary
    * is `docs/MESHBAY_DESIGN.md` §3.2's and does not move.
    */
-  async groupRoster() {
+  async groupRoster({ fresh = false } = {}) {
+    // `fresh`: read it again rather than keep this connection's copy, for a
+    // page that lists the members and must show who joined since.
+    if (fresh && !this._rosterInFlight) this._roster = null;
     if (this._roster) return this._roster;
     if (this._rosterInFlight) return this._rosterInFlight;