Validate certificate-derived linked-device DIDs and carry them in AccessBasis without Copy semantics. Terminate direct device-door mTLS connections, derive each connection's DID from its accepted peer certificate across session resumption, and route it through the link HTTP surface with one access identity.