1 files changed, 17 insertions, 4 deletions
diff --git a/packages/meshbay-common/src/meshbay_common/chatbox.py b/packages/meshbay-common/src/meshbay_common/chatbox.py
index e04bd9b..f3cfc76 100644
--- a/packages/meshbay-common/src/meshbay_common/chatbox.py
+++ b/packages/meshbay-common/src/meshbay_common/chatbox.py
@@ -16,10 +16,23 @@ The property is given up on the record rather than inherited by accident.
 delivers it to members wrapped under the current group key. Each device derives
 its *own* subkey from it, by name, so:
 
-* two devices never share an AES key, and nonce reuse across devices is
-  impossible without any coordination — the property per-device ratchet chains
-  were wanted for, obtained by derivation instead of by mutable state (which is
-  C1 one level down, and is exactly what `GroupSenderKeyStore` got wrong);
+* two *keys* never share a subkey, and — the part that actually matters —
+  **there is no mutable sending state at all**, so nothing can be advanced
+  twice. §15.0b wanted per-device chains because two devices advancing one
+  chain produce key and nonce reuse (C1, one level down, and exactly what
+  `GroupSenderKeyStore` got wrong). Derivation plus a *random* nonce removes
+  the hazard rather than partitioning it;
+
+  Be precise about what that does **not** say, because the obvious stronger
+  claim is false in the deployment that exists: two clients of one account on
+  one node normally hold the **same** identity key — a second browser recovers
+  it from the keypair bundle rather than minting a new one — so they share a
+  device key and therefore this subkey. That is safe here only because the
+  nonce is 96 random bits and not a counter: two independent senders under one
+  key collide with probability governed by the birthday bound, which at chat
+  volume is unreachable, whereas two independent senders advancing one counter
+  collide immediately. The design degrades correctly into that reality; a
+  chain-based one would not have;
 * a receiver derives any sender's subkey from the epoch key it already has, so
   nothing is distributed per device and there is no per-device state to
   persist, migrate or lose;