05 · Multiple direct and relayed admissions

Starting state

Open admission with an organizer, one relay and several candidate riders; shared responder and sufficient reported NDP capacity.

Ordered events

1. Children → Relay

   Independent TLS/hello and signed joins

2. Relay → Organizer

   Forward each join over the active/admission path

3. Organizer → Relay

   Approve distinct identities and publish each roster revision

4. Relay → Children

   Distribute roster while retaining per-peer ownership

Fields and messages

Distinct peer IDs/indexes versus shared Network/endpoint; at most 24 pending joins and 12 roster members.

Authorization and invariants

Each child proves its own key/token. One child is never accepted solely because another child owns the same local interface.

Timers

One-second join retry handles relay-upstream ordering; direct health deadlines apply per peer.

Resource lifetime

Shared endpoint references survive sibling retirement; request and peer lifetimes remain independent.

What the rider sees

Organizer lists distinct pending/approved riders; capacity reporting does not fabricate measured radio support.

Failure branches

First join before relay upstream activation retries; full capacity stops new offers; one failed child does not reset all children.

Resulting state

Direct and downstream approved members share one organizer-authorized roster without requiring one NDI per child.

Evidence boundary

Real shared-endpoint socket regression plus twelve-node topology and admission tests. Physical shared-NDI routing remains unqualified.