refactor(node): section headers follow the code they introduce

Three headers stayed in webrtc_server when their sections moved; they now
sit above the same methods in blobs.py and admission.py. Two that were only
a title over what is now a whole module are dropped.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2 files changed, 16 insertions, 0 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc/admission.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc/admission.py
index 6a714cb..b02e59a 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/webrtc/admission.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc/admission.py
@@ -115,6 +115,8 @@ class AdmissionMixin:
         self._issue_admin_challenge(
             OP_INVITE_CANCEL, invite_id, {"group_id": group_id, "invite_id": invite_id})
 
+    # ── Pairing and join (H3, M3) ────────────────────────────────────────────
+
     def _join_refuse(self, reason: str, audit_detail: str = "") -> None:
         self._join_attempts += 1
         # Node-wide window, shared across connections: reconnecting must not reset
@@ -348,6 +350,13 @@ class AdmissionMixin:
         await self._join_ok(user_id, pk_x_raw, session_group or invite["group_id"],
                             role=invite["role"], recognised=False)
 
+    # ── Device linking ───────────────────────────────────────────────────────
+    #
+    # A person may hold several devices on one node. The authority admitting a
+    # new one is a key the node already pinned — never the hub, which has stored
+    # no user keys since 2026-08-14 and therefore cannot countersign anything.
+    # See docs/MESHBAY_DESIGN.md §3.3.
+
     async def _do_device_request(self, msg: dict) -> None:
         """
         A new device files itself as pending, bound to a code it displays.
diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc/blobs.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc/blobs.py
index 5e67a42..e624fb9 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/webrtc/blobs.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc/blobs.py
@@ -120,6 +120,13 @@ class BlobsMixin:
             "detail": "keypair_bundle_stored",
         })
 
+    # ── Per-account blobs (playlists, docs/playlists.md §8.2) ────────────────
+    #
+    # The node stores bytes it cannot read and hands them back. `self._user_id`
+    # comes from the authenticated session and never from the message: a
+    # `user_id` in the body would let any member of this group read or
+    # overwrite any other member's blob, which is finding C5 one size down.
+
     def _user_blob_refuse(self, detail: str, kind: str = "") -> None:
         """
         Refuse, and say so in the audit log.