fix: an MBK2 bundle is opened once and stored again as MBK3

Transitional. The Argon2 run that makes M makes A, the key MBK2 bundles were
sealed under; a session keeps it as a decrypt-only key (IndexedDB in a browser,
the key storage in the desktop app). A client meeting an MBK2 bundle opens it —
or its recovery copy — and stores the same identity as MBK3 once connected; the
desktop app reseals or withdraws it as browser access says. A session without
A asks for the passphrase once. Older formats stay refused by name. Replaces
the unpin-and-reinvite step the 0.17 flag day required on every node.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 3 insertions, 1 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport-rewrap.js b/packages/meshbay-hub/src/meshbay_hub/static/transport-rewrap.js
index 8bf884c..cdf86b0 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/transport-rewrap.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/transport-rewrap.js
@@ -117,7 +117,9 @@ async function rewrapAllNodes(o) {
           anyOk = true;
           continue;
         }
-        if (tp.newNodeBundle) {
+        // An identity read from an MBK2 bundle (TRANSITIONAL) is an existing
+        // one, and is re-sealed below like any other.
+        if (tp.newNodeBundle && !tp.upgradedLegacy) {
           // No identity existed on this node — connect just minted one under
           // the old key. Don't persist it: the next time this group is opened
           // the normal flow creates one under the current key, and storing it