A fresh replica learns whose public repo to read from the DIDs a dialer claims on its first frame, and `PrivateEndpoint` closed that connection on the accept — both iroh bindings call `onLink` the moment they accept one — so the frame carrying the claim was destroyed along with the round trip it travelled in, and the discovery deadlock held in exactly the state this was built to end. An inbound connection no attached space names is now kept for a bounded grace (8 at a time, 30 s) instead of closed. Nothing is served over it: the bus refuses every frame against the same directory, as before. It is adopted if the directory catches up in the meantime, and only into a space with no live link to that endpoint — a held connection is older than anything adopted since, and promoting it over a live one would hand a peer a socket it may already have hung up on. Beside it, the verification the claim buys is tightened: a DID is kept only when its own repo binds the claimed endpoint (asked through `connectablePeers`, since `authorizeEndpoint` answers with the first device it finds for an endpoint and a daemon running two identities publishes two addresses for one), the bounds are named constants, and the per-endpoint cooldown table is bounded because a stranger chooses its keys. The bug survived review because both loopback doubles were one-directional: an accepter could hang up while the dialer went on being served. Both now share one open flag across a connection's two ends, and the regressions start from the honest state — a replica that has never heard of the peer about to dial it: a fresh daemon replica bootstrapped end to end, a fresh tab filled from a daemon nothing it polls names, the endpoint lifecycle in core, and the ingestor's verify-then-keep bounds. Co-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) <claudebot.disnetdev.com@noreply.radial>