feat(node): accept a device link request before the proof (MNP 6.3)

A new device of a known account holds no identity the node pinned, so it
cannot complete a handshake until a pinned device approves it: it now files
device_add_request in the pre-proof window, as the desktop app's case
already required. The request stays inert until countersigned; at most 10
are pending per account, the oldest dropped. A 6.2 node answers it
"Handshake required", which a client reads as "cannot link here".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 6 insertions, 0 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc/dispatch.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc/dispatch.py
index 0ceefb5..7452f42 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/webrtc/dispatch.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc/dispatch.py
@@ -120,6 +120,12 @@ class DispatchMixin:
                     self._spawn(self._do_gek_bundle_fetch())
                 else:
                     self._spawn(self._do_keypair_bundle_fetch())
+            elif mtype == MNP.DEVICE_REQUEST and self._gek_challenge is not None:
+                # A machine with no key on this node cannot prove the group key —
+                # filing is how it gets one. Inert: nothing is admitted until a
+                # device already pinned countersigns, the code is bound to the
+                # keys, and the device budget bounds it (MNP 6.3).
+                self._spawn(self._do_device_request(msg))
             elif mtype == MNP.JOIN_REQUEST and self._nonce_node:
                 # Valid both before the GEK proof (a new member has no GEK to prove
                 # with) and after it (an operator pairing a browser is already