fix(contacts): backfill peer_fingerprint for pre-existing rows in _post_init

.gitignore

@@ -131,6 +131,7 @@ data/pending-restart.json
 # Stray dev screenshot artifacts
 desktop-initial.png
 venv/
+data/hub/
 
 # Credential material must never be committable. An agent stored a registry
 # token at /opt/taos/secrets/ on 2026-07-27 - correct permissions, but inside the

changelog.d/2561-contacts-fingerprint-keying.md

@@ -0,0 +1,10 @@
+### Fixed
+- Cross-user contacts are now keyed on the peer's ed25519 signing-key
+  fingerprint rather than on their username, so a peer who changes or reuses a
+  username can no longer be confused with an existing pinned contact. Stores
+  created before this change are upgraded in place on first open: existing rows
+  have their `peer_fingerprint` backfilled from the stored public key, and rows
+  whose key is missing or malformed are left unkeyed instead of aborting the
+  upgrade. Revocation now reports how many contacts matched and cascades to
+  every contact sharing the revoked fingerprint, and blocking a peer cascades
+  consistently through both block paths (#2561).

docs/design/cross-user-collaboration.md

@@ -427,6 +427,9 @@ lane (real build/test CI, fork-approval rules apply), FLEET = free-model builder
 - A1 LEAD: `contacts_store` plus `peer_links` plus envelope sign/verify plus peer
   route family plus rate limits.
 - A2 LEAD: friend-accept to contact-row plus handshake wiring (hub subscription).
+  **Deviation:** the peer-link token is minted locally without hub delivery —
+  the token exchange requires both instances to be online simultaneously, which
+  is acceptable for a pilot and avoids hub-trust assumptions for bearer tokens.
 - A3 HOGNEK: hub sealed-envelope relay endpoints on taos.my (T1, not pilot-blocking,
   can trail).
 - A4 FLEET (cards): ContactsApp taOS section UI; presence dots; request