Multiplayer session share: human-friendly code + auto-copy + QR (drop the raw id:token string)

[kipavy]

Part of the team-ux initiative (brainstorm 2026-07-24).

Problem

The only artifact a host can share for a live session is a bare sessionId:token string built by buildInviteCode (src/services/inviteCode.ts) — labeled "invite link" in ShareMenu.tsx but it is neither a link nor scannable. The recipient has to know to open the Team Sessions rail → find a 10px "Join by code" text button (src/components/hosts/TeamSessions.tsx) → paste it. Copy is manual (no auto-copy on generate). There's no cross-device path (desktop→phone) short of retyping a long string.

Proposed reflow (host side, ShareMenu.tsx)

• Replace the raw id:token artifact with a human-friendly, high-entropy code. Passphrase-style words (e.g. brave-otter-marble-7) or a longer grouped alphanumeric (e.g. K7M2-P9QX-3B) — shorter than a URL, readable over the phone, but with enough entropy that TTL + rate-limiting makes brute force infeasible. The code is a convenience layer over the real token, resolved server-side; the token itself is never shortened.
• Security posture: code resolvable only by a signed-in user; short TTL (~10 min, regenerable); rate-limited resolution; one active code per session. (Decided against a 6-char code — too brute-forceable for a live terminal.)
• Auto-copy on generate + success toast (teamActionFeedback.ts), so the default path is generate → it's already on your clipboard.
• QR code rendered next to the code (encodes the join URL / deep link from Register a voltius:// URL scheme (deep-link infrastructure) #69) for desktop→phone.
• "Share via…" affordance where the OS supports it.

Join side

• Make "Join by code" a first-class, discoverable entry (not a 10px button): command-palette action + a clear affordance in the Team Sessions rail. Accept the human code, the QR, or a pasted link interchangeably.

Depends on / relates

• Deep-link / QR target URL comes from Register a voltius:// URL scheme (deep-link infrastructure) #69 (voltius:// scheme). Ships fine without it (code + auto-copy + QR-of-a-fallback-URL first); deep link upgrades the scan/click.
• The receive-side "X shared a session with you" notification is Unified team notification inbox — invites, shared sessions & control requests through the bell + toasts #67 (this issue is the artifact + host UI; Unified team notification inbox — invites, shared sessions & control requests through the bell + toasts #67 is the push).

Still open

• Code alphabet: passphrase words vs. grouped alphanumeric (entropy target ≥ ~40 bits).
• Server: code→session resolution table, TTL, rate-limit, single-active-code semantics.
• QR library choice (must be offline/bundled, no external calls).
• Exact TTL + regenerate UX.