addLink
Admit a Connection to a peer that dialed in after construction.
Exchanges the mesh preamble to learn the remote PeerId, applies the mesh's LinkAdmission policy, dedups against existing links using the same canonical rule as construction (see meshSeam), updates peers, and launches the link's read loop. Suspends until the preamble exchange completes.
The admission check runs between the handshake and link publication — the first moment the joiner's self-asserted PeerId is known, and the last moment before the link can contend in duplicate-link dedup or receive frames. A rejected connection is closed and never published — it never reaches the dedup tiebreak (so a forged link can never displace a live one), never joins peers, and never lands in attestedPrincipals.
Reject-and-continue: rejection affects only the one link. It is surfaced as a LinkRejectedException — the per-link signal a hub accept-pump (hostedOverlay) absorbs and debug-logs — and never tears down the seam or any other admitted link. Because the mesh admits many joiners one at a time, an unauthorized joiner cannot disturb the live session or concurrent legitimate ones.
Parameters
A fresh, unread Connection. The mesh wraps it with singleCollection before reading, so the preamble read and the read loop share ONE collection of Connection.incoming — a cold, single-collection conn (a stream fabric's framed()) works as well as a hot channel-backed one, exactly as construction does.
Throws
if the mesh's LinkAdmission policy rejects the link — a non-fatal per-link signal; the seam and all other links stay intact.