[bahdotsh]

Step 7b of the shared network plan (ADR 0037). Stacked on #688.

One predicate: admitted

admitted(peer) is true when the peer is any one of:

• visible;
• in the named set;
• holding a 1:1 session with this node;
• on the roster of a group this node holds.

With no publisher key, every peer is admitted. app_sees_peer (the emission gate from #688) now asks this same predicate, as the ADR says.

The named set

• What it holds: addresses the app itself acted toward. That covers send_message, forward_message, send_media, connection requests and their answers, presence, typing and read receipts, establish_secure_session, manual_mls_create_session and invite_to_group.
• What writes it: only those calls. A frame never writes it.
• Storage: a new sealed protocol-state category, named_peers, because it is a contact list. The value is the Unix second the address was last named.
• Bound: 4096 addresses. The least recently named address without a session is evicted first.
• Backfill: on every launch, every peer that holds a session is added, so turning membership on cuts no one off.

The inbound gate

A frame addressed to this node from a sender that is not admitted goes down the blocked-sender path:

• it is not processed;
• it gets no answer of any kind;
• no event is emitted.

The sender sees what it would see for an address nobody holds. ACKs are also refused at both ACK send points (send_ack_with_status and send_undecryptable_ack).

These pass whatever the sender:

• __MEMBER__;
• relay server answers;
• custody receipts;
• the group data plane, which opens only under a group this node holds;
• discovery gossip, which gets its own rules in 7c.

Key packages, 1:1 Welcomes and group Welcomes pass if they carry a valid proof.

The end-to-end proof

• What carries it: every key package, 1:1 Welcome and group Welcome sent by a node that holds a certificate. It is attached in sign_control_message, so every send path gets it.
• Deviation from the ADR sketch: the proof travels in the frame metadata (__member_proof, defined once in offline-protocol-sealed), not in a payload field.
  • The bound body is then the content exactly as it travels, so nothing has to be re-serialised to hash it.
  • The payload structs have about 57 struct literals across the crates, including the leaf's; a payload field would have touched all of them.
  • Metadata is outside the control signature, but that costs nothing. The proof signs the recipient, kind and body itself, so stripping it fails closed and moving it onto another frame fails to verify.
• The spec section is updated to match.

Tests

• Seven new tests:
  • a stranger's key package gets no frame back of any kind;
  • the same stranger, once named, is answered;
  • an unconfigured node answers as before;
  • two members who never met converge on the proof alone;
  • a proof recorded on its way to alice and pasted onto bob's frame to dave is refused;
  • a node with the key but no certificate proves nothing;
  • the named set survives a restore, and an explicit call writes it.
• Mutation: with the inbound gate forced open, two of these tests fail.
• Suites: offline-protocol lib 2211 pass, offline-protocol-uniffi 318 pass, offline-protocol-sealed 102 pass.
• Clippy: clean over the workspace.

Deliberately not in this PR

• Service discovery under membership (sealed bodies, proofs on query and response, answering the originator) is 7c, the next PR.
• Subscription renewal and data sync on discovery stay ungated. Both act on relations the app made itself, and they did not go through the named-set hooks. The ADR lists them under the gate, so step 8's guard enumeration should decide whether they move behind admitted.