06 · Admission closure, source descriptors and readiness

Starting state

At least two approved members; organizer chooses to seal; local audio has not started.

Ordered events

1. Organizer → Relay

   Signed roster with open=false precedes source keys

2. Relay → Rider

   Apply sealed roster and close unapproved links

3. Rider → Relay

   Publish signed stream descriptor

4. Relay → Organizer

   Propagate admitted source descriptors; sync missing state

Fields and messages

stream ssrc/key/clock=48000/frameMs=20/nextIndex; SSRC top byte index+1.

Authorization and invariants

Only admitted sealed sources distribute keys. Same SSRC cannot change key; older stream control seq cannot replace newer descriptor. Fixed membership has no eviction/rekey command.

Timers

State sync on admitted link activation/reconnect; no deadline pretends missing streams are ready.

Resource lifetime

Per-source SRTP contexts survive transport changes; key material lives only in native ride state.

What the rider sees

Ready UI waits for source completeness and headset readiness; remote closure cannot start recording.

Failure branches

Seal with fewer than two fails; unapproved joiner receives NOT_ADMITTED; missing descriptor keeps start unavailable until sync.

Resulting state

Fixed roster is sealed; approved peers exchange source descriptors; each becomes ready when all descriptors are present.

Evidence boundary

Host engine, audio, shared-binding and handoff state-sync tests.