Implement durable shared Space membership directory

[mkdir700]

Background

Current space_member state is device-local and is not replicated. That prevents a Space member from learning about devices invited by another member, and prevents offline devices from converging on later joins or exits. Device OS and hardware metadata must be built on a shared membership foundation rather than individual pairing records.

Scope

Implement a durable, cryptographically verifiable shared membership directory for a Space. Any active member may invite a new device. Other devices must converge on membership changes when they next reconnect.

• Model signed membership events: MemberAdded, MemberLeft, MemberRevoked, and ProfileUpdated.
• Give each admission a distinct member_instance_id so a later rejoin of the same device_id is not invalidated by an older leave or revoke event.
• Persist encrypted event history and snapshots using MasterKey AEAD. Do not persist member names, future device metadata, or other business payloads in plaintext.
• Verify event signatures, causal ordering, active-member authorization, and revocation state before applying events.
• Keep local per-peer sync_preferences out of the replicated directory.
• On successful join, deliver a verified directory snapshot and subsequent events to the new device.
• Implement anti-entropy synchronization after peer connections are established: compare directory summaries, fetch missing events, and fall back to a snapshot for stale or incomplete histories.
• Define completion semantics for self-leave: do not report completion until a second peer or a durable encrypted relay mailbox acknowledges the leave event.
• Define the authorization model for forced removal and the recovery path for a lost or permanently offline device.

Constraints

• P2P remains the default transport.
• An offline device can only learn changes after reconnecting to a peer or durable relay that retains the encrypted directory state.
• A device that is wiped or permanently offline cannot reliably announce its own departure; another authorized member must be able to revoke it.
• The existing local member repository is a derived view, not the distributed source of truth.

Acceptance Criteria

• A member invited by any active device appears in every existing device roster after synchronization, including devices that were offline during the join.
• A newly joined device receives the existing verified roster after its pairing completes.
• A self-leave and an authorized revocation are eventually reflected on every device after synchronization.
• Rejoining with the same device_id creates a new membership instance and is not suppressed by stale leave or revoke events.
• Invalid signatures, unauthorized events, stale events, and malformed or undecryptable payloads are rejected without altering the local roster.
• Local sync_preferences never leave the device that owns them.
• All newly introduced persisted membership payloads are MasterKey-AEAD encrypted.

Follow-up

After this directory is available, add shared device profiles for OS family, form factor, and optional model metadata through ProfileUpdated events.