The shared symmetric keys held by GROUP destinations (RNS 1.4.2 Destination type 0x01): one Token.generate_key() secret, encrypting and decrypting with it directly.
The core link primitives: the LinkId both ends derive, the negotiated LinkMode, and the AES-256 session LinkKey, HKDF of the ECDH shared secret salted by the link_id. Establishment frames live in handshake; per-link state in table.
RNS 1.4.2 Destination.register_request_handler: rows keyed by (destination, truncated_hash(path)), each carrying its allow policy and, for RequestPolicy::AllowList, the permitted identity hashes. A request with no handler, or one its policy refuses, dies silently: the reference’s exact posture.
RNS 1.4.2 Destination.accept_link_requests: AcceptNone announces but answers no link request — reachable for singles and announces, silent to LINKREQUEST.