A network they can't read and can't join — but can see.

• Confidentiality — achievable. Modern crypto means nobody uninvited reads your traffic or joins your mesh. This is settled engineering.
• Invisibility — not achievable. Encryption hides content, never the fact of transmission. A radio is a beacon: an SDR sees packets, node IDs and timing, and can direction-find the transmitter. Real RF concealment needs secret-sequence spread-spectrum, burst and low power — Meshtastic and Starlink do none of it.
• Metadata is the leak. Who talks to whom, when, and how often — traffic analysis alone — is often more revealing than content. Design assumes you are watched.
• The real failure is human. Almost every historical break — Enigma included — came from operational process, not broken maths. The cipher rarely fails; the people around it do. So this is 20% radios and 80% discipline.

Four layers, each doing exactly one job. Content is encrypted above every radio, so no single node or link is ever trusted.

You asked whether to use Gematria Primus — read in English — as the language code. Yes, in a specific role. Here's the honest placement.

• It reads English. The 29 futhorc runes map to Latin letters, so a message written in Gematria Primus is simply English spelled in runes (Latin codewords optional for flavour). That's exactly how it's meant to be read.
• Great as identity + brevity + checksum. Use it as the unit motif, as a small codebook of short agreed words (fast, low-bandwidth brevity — ideal on the open HF layer where you can't encrypt), and as a tamper-check: every rune is a prime, so a phrase has a numeric sum — a correct decode hitting the agreed number authenticates it.
• Not the confidentiality layer. On its own it's a monoalphabetic substitution: the chart is one of the most-photographed on the internet (recognise → Google → decoded in a minute), and even unrecognised it falls to frequency analysis on a paragraph. This is obscurity, not security.
• If it must actually hold, run a Vigenère over it with a shared keyword — the same move Cicada used in the Liber Primus, unbroken after twelve years. Same aesthetic, vastly stronger. But real secrecy still comes from Layer 0, not the runes.

• Pads at muster. Two people who meet once can do unbreakable crypto forever after. Pre-load one-time pads into each kit in person; that solves the only genuinely hard problem.
• Keyless relays. Unattended nodes hold no private keys and relay only ciphertext they can't read — physical access to a relay must yield nothing. Meshtastic routers rebroadcast at the LoRa layer without the channel PSK, so this is native.
• Rotate, and assume record-now-decrypt-later. Anything sent can be recorded today and opened if a key leaks — rotate PSKs on a schedule and after any suspected loss.
• Device is the weak point. Full-disk encryption on every node, a kill/wipe path, tamper-evident enclosures. Destroy pads after use.

• Lowest power that closes the link, directional antennas, and burst/scheduled transmission with randomised timing. A node that lights up for twenty minutes every evening tells a story.
• Position & telemetry broadcasts OFF by default. GPS is receive-only and safe — the leak is downstream: never auto-broadcast position, never drop raw coordinates into messages. Design for graceful failure on a jammed or spoofed fix.
• Keep the net small and disciplined. Node-ID hygiene; assume traffic analysis; fewer emitters, fewer patterns.

Every box built from the runbook ships hardened. One script applies the defaults so security doesn't depend on the operator remembering — the Enigma failure mode. Review it, then run it against each node.

What it sets on every node:

• Rotates off the default key. The stock primary channel key (AQ==) is public — out of the box, DMs are effectively unencrypted. Replaced with a real 256-bit PSK.
• Position & telemetry broadcasts disabled. No auto-leaking where you are or how the box is doing.
• PKC direct messages. Per-node X25519 keypairs (firmware ≥ 2.5), DMs signed as well as encrypted.
• Relays carry no private keys. Unattended routers forward ciphertext they can't read.
• Pads + WireGuard keys generated with a CSPRNG, ready to distribute at muster.

You asked about an automated daily / hourly / single-transmission key for the mesh, and where else Gematria could be used. Both are good ideas — done the right way, which is: rotate a key nobody ever transmits, and let the runes be the human verification on top.

$ node keyschedule.mjs --period hour
PSK (base64)   z+OsjhUBHPbWBSP7h1g9GBICpCecqyirImDTzQ5+ifo=
KCV (hex)      cfe3ac8e        ← both ends must match
Day-sign       ᚉ ᚛   ᚇ ᚋ   (X·W·F·T·H)
prime-sum      150             ← the spoken checksum / countersign
# cron: 0 * * * *  node keyschedule.mjs --period hour --apply

Where else to use it:

• Sign / countersign. The day-sign word as challenge, the prime-sum as the answer — a rotating daily authenticator for voice and HF.
• Duress code. A pre-agreed rune-word or number that answers "correctly" but silently signals coercion.
• Key-check values. Prime-sum any key or config to confirm two nodes match, or to detect tampering, without sending the thing itself.
• Net identity. Rune callsigns and addressing — the unit's own script, doubling as a recognisable motif.
• Brevity + checksum on the open layer, where you can't encrypt but can compress and authenticate.