nx_lan_signup.nx

nx_lan_signup.nx -- the SIGNUP-ALLOWED decision, BY CONSTRUCTION. The operator's law: "signup exposed only on LAN, for the family to sign up." Two independent gates must BOTH hold before any registration is permitted: (a) the PEER SOURCE IP is LAN -- RFC1918 private (10/8, 172.16/12, 192.168/16) or loopback (127/8). A WAN client can NEVER register, regardless of any flag, because the daemon reads the real connecting address from accept() (sys_accept_with_addr) -- not a spoofable header. This is the "only on LAN" guarantee. (b) the HANDLE is INVITED in this realm's HR store (the operator provisioned it via nx_hr_admin.hra_invite). A LAN stranger with an un-provisioned handle is denied; a handle already CLAIMED (active) is denied (re-registration blocked) because a claimed record is no longer "invited". This is the "only the family". So the registration surface is closed to the world AND closed to anyone the operator did not invite -- replacing the old single global open/closed flag with an invite-governed, LAN-scoped gate. Pure decision (no I/O beyond the HR read inside hra_is_invited); the daemon supplies the 4 peer-IP octets + handle + the HR store/realm.