1 files changed, 3 insertions, 2 deletions
diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md
index e7d7f0c..a9653b6 100644
--- a/docs/MESHBAY_DESIGN.md
+++ b/docs/MESHBAY_DESIGN.md
@@ -163,7 +163,7 @@ document uses:
 | Content cannot be modified | ✅ | ✅ | ❌ by design | ✅ | ✅ |
 | The node cannot be impersonated | ✅ | ✅ | — | ✅ | ✅ |
 | Client code integrity | ❌ **T3, accepted** (browser) · ✅ ships in the package (native) | ❌ T3 · ⚠️ native: **detectable, not prevented** | ✅ | ✅ | ✅ |
-| The hub cannot obtain the group key | ✅ | ✅ **except** in an open-join group, where it can join legitimately (§7.3) | — | — | ✅ |
+| The hub cannot obtain the group key | ✅ | ✅ **except** in an open-join group, where it can join legitimately (§7.3), and for an invitation the inviter asked the hub to mail, whose code it then holds (§3.4) | — | — | ✅ |
 | Node content authority | ✅ | ✅ | ✅ sovereign | ✅ | ✅ |
 | Devices cannot be added by the hub | ✅ | ✅ — the hub holds no user key and cannot countersign | ⚠️ a node adds a device only to itself, where it already reads everything | ✅ | ✅ |
 | Chat senders are authenticated to each other | ✅ | ✅ | ⚠️ only for accounts the reader has already seen (§3.3) | ✅ | ✅ |
@@ -374,7 +374,8 @@ Four properties, each load-bearing:
 2. **The code binds a key to an account**, and the hub never sees it — unless
    the inviter ticks *Send the invitation by e-mail* (below). 40 bits,
    Crockford base32 rendered `XXXX-XXXX`, single use, valid for exactly one
-   account in one group, stored only as `sha256(code)`. A password KDF over 40
+   account in one group — except an invitation link's, which names its account
+   when it is redeemed (below) — stored only as `sha256(code)`. A password KDF over 40
    uniformly random bits would buy nothing. Guessing is bounded by 5 attempts per
    connection and a node-wide lockout, and every attempt is an audit event.
 3. **The node's roster is the authority**, not hub membership. A hub that invents