rosterUpdatesPrincipalOnReconnect

A peer that reconnects with a new principal supersedes its prior roster entry.

What this still mandates, after #2357: attested → attested supersession only. Both principals here are non-null, so this property obliges the seam to let a link the host verified as verified-alice-2 replace one it verified as verified-alice-1. Since the peer id is self-asserted, the harness cannot distinguish "alice reconnecting" from "someone else the host also verified, claiming alice's id", so that displacement stays reachable by an impostor holding some valid credential. Whether a seam should bind an id to an attestation is a behaviour decision with consumer impact and remains open — RoomAuthorizer cannot express it at all today, and LinkAdmission can express only a static binding (#2357).

What it never mandated: unattested displacement. It used to carry a note reading it as also obliging a seam to let a link the host verified as nothing erase an attestation, because a second link always won. That was over-read: both principals here are non-null, so this property has never exercised the unattested case in either direction. What happens there is now settled per seam rather than by this property — the mux hub refuses the claimant outright (RoomHubSeamUnattestedClaimTest), the mesh lets its nonce tiebreak decide and reports the survivor honestly (MeshAdmissionTest). See "What is deliberately NOT here" above for why that asymmetry is not smoothed over with an arm in this suite.