fix: removing someone who never redeemed their invitation

A member row appears only when a code is consumed, so revoking someone
invited to the wrong group was refused for having no row — and the node's
refusal aborted the browser's removal before its hub half, leaving them a
member everywhere with a live code. Revoking now cancels unredeemed codes
for that group, and a node refusal no longer cancels the hub removal.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 11 insertions, 3 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/daemon.py b/packages/meshbay-node/src/meshbay_node/daemon.py
index bb50bcf..c16e49f 100644
--- a/packages/meshbay-node/src/meshbay_node/daemon.py
+++ b/packages/meshbay-node/src/meshbay_node/daemon.py
@@ -2409,9 +2409,17 @@ def main() -> None:
                 cfg, f"/api/members/{match['user_id']}/revoke?group_id={group_id}",
                 method="POST")
             print(f"{args.target} revoked from {group_id[:8]}")
-            print("They stop receiving the group key on their next connection.")
-            print("They still hold the current one — rotate it:")
-            print(f"  meshbay-node gek-init --group {group_id}")
+            if out.get("invites_dropped"):
+                print("Their unredeemed invitation was cancelled.")
+            # The node decides whether a rotation is warranted and says so in
+            # the reminder — somebody who never redeemed a code never held the
+            # key, and advising a rotation there is advice to ignore the next
+            # time it is real. Deciding it again here is the second
+            # implementation this file exists not to have.
+            if out.get("reminder"):
+                print("They stop receiving the group key on their next connection.")
+                print("They still hold the current one — rotate it:")
+                print(f"  meshbay-node gek-init --group {group_id}")
             return
 
         if sub == "unpin":