claude
1a704d704d
internal/netaddr parses a daemon seam address and dials or binds it. A scheme-less address is unix and behaves exactly as it does today: same 0700 parent dir, same 0600 socket, same bytes on the wire. tcp://host:port is the new option, and it is what lets a module live on another host. Over tcp the filesystem permission that authenticated the unix socket is gone, and what crosses this seam is audio of the owner speaking. So a tcp listener requires a shared token, checked in constant time before the first protocol frame is read, and a peer that fails is dropped without taking the listener down with it.