Function control_pseudonym 

pub fn control_pseudonym(
    server_root: &ServerRootKey,
    community_id: &CommunityId,
    epoch: Epoch,
) -> String

The relay-filterable pseudonym members use to fetch the control plane for (community, epoch). Derived from the server-root key + community id, so members compute it but outsiders (no server-root) can’t — the control plane has no stable on-wire identifier. This reuses the channel-pseudonym derivation; what keeps a control pseudonym from ever aliasing a channel’s is the invariant that the server-root key is always distinct from every channel key (the HKDF label is shared, so domain separation rests on the distinct IKM + id32).