fix(node): a pinned device can be invited to a further invite-only group

Regression from device linking (Stage C, 2026-08-18). Once a device is
pinned on a node — as a member of one group, or an operator pairing — the
`known` fast-path in `_do_join_request` dropped straight into `_join_ok`.
For any *other* invite-only group it had no roster row for, that answered
`not_authorized_for_group` and stopped there: the client never got
`code_required`, so the pairing-code form never appeared and a legitimately
invited member could not join.

The `known` branch now, when there is no membership for the group being
opened:
  - with a valid code → consumes the invite and admits (as the unknown-
    device path already does);
  - with no code but an invite waiting for this user here → `code_required`,
    so the client prompts;
  - with no code and nothing inviting them → `not_authorized_for_group`,
    unchanged, so the H3 guarantee (a hub-invented pin gets no key) holds.

Also fixed: the group's own roster row is now consulted first, so an
existing member opening their group is never mistaken for a stranger.

Tests in test_roster_pairing.py cover all three branches plus the H3 guard.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018gKJ85aZyvEwarXMFzFEwi

1 files changed, 37 insertions, 4 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
index 4958b92..dfa775e 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
@@ -1039,10 +1039,11 @@ class WebRTCPeerSession:
                 f"paired with this node")
             return
         if known:
-            # An operator's row is node-wide (empty group), so a lookup for the
-            # group they happen to be opening finds nothing. Fall back to it, or
-            # the client is told it has no role on a node it administers.
-            member = (await roster.get_member(group_id, user_id)
+            # This group's own row first; then the join message's group_id (empty
+            # on the node-wide first connect); then the operator's node-wide row,
+            # which is where an operator opening any group finds their authority.
+            member = (await roster.get_member(session_group, user_id)
+                      or await roster.get_member(group_id, user_id)
                       or await roster.get_member("", user_id))
             if not member and self._group_join_policy(session_group) == "open":
                 await roster.set_member(
@@ -1050,6 +1051,38 @@ class WebRTCPeerSession:
                     status="active", approved_by="open-join",
                 )
                 member = await roster.get_member(session_group, user_id)
+            if not member:
+                # A device this node already pinned — for another group, or an
+                # operator pairing — opening an invite-only group it has no row
+                # for. The device-linking `known` fast-path used to drop straight
+                # into `_join_ok`, which answered `not_authorized_for_group` and
+                # left a real invitee with no way to redeem the code they were
+                # sent. Tell them to enter it *only* when one is actually
+                # waiting for them here; a bare hub-invented pin, with nothing
+                # inviting it, still gets the flat refusal H3 relies on.
+                if not code:
+                    invited = any(
+                        i["user_id"] == user_id
+                        and i["group_id"] in (session_group, "")
+                        for i in await roster.list_invites())
+                    self._join_refuse(
+                        "code_required" if invited else "not_authorized_for_group")
+                    return
+                invite = await roster.consume_invite(code, user_id)
+                if not invite:
+                    self._join_refuse("code_invalid")
+                    return
+                await roster.set_member(
+                    group_id=invite["group_id"], user_id=user_id,
+                    role=invite["role"], status="active",
+                    approved_by=invite["created_by"],
+                )
+                self._audit_join(
+                    "join_pinned",
+                    f"group={invite['group_id'][:8]} role={invite['role']} "
+                    "via=code (device already known)")
+                member = (await roster.get_member(session_group, user_id)
+                          or await roster.get_member(invite["group_id"], user_id))
             await self._join_ok(
                 user_id, pk_x_raw, session_group,
                 role=member["role"] if member else "",