feat: v0.8 Iteration A — ID-class fixes, manifest privacy, registry + greetings

A1 — ID-class bug family (v0.6.1 persona split left network-NodeId comparisons
where posting IDs live). ~14 sites fixed with multi-persona semantics ("author is
one of MY posting identities", not == default):
- revoke_post_access / revoke_circle_access (revocation was broken for every post)
- group key create/add-member/rotate (add-member distribution now works)
- circle profile set/delete/get, encrypted-attachment CEK unwrap
- receipt/comment slot authorship, replication cycle, blob eviction own-tier
- orphaned GroupKeyRequest/Response (0xA1/0xA2) deleted (no send side existed)

A2 — Manifest privacy: AuthorManifest.author_addresses removed from struct AND
signature digest; CdnManifest tree-era fields dropped. Startup migrations re-sign
own manifests, purge unverifiable foreign copies, strip persona fields from legacy
network-id profile rows. Posting identities are now location-anonymous.

A3 — Discovery & first contact:
- Open-slot comments: derivable slot V_x (blake3 from author + slot_binder_nonce)
  so strangers pass the CDN comment-verification gate; OpenSlotDecl in FoF gating
- Greetings: HPKE-style sealed GreetingBody (return_path + fresh reply_pubkey),
  throwaway outer ID, size-bucketed; messaging-first (Reply/Dismiss, no vouch)
- Registry: frozen canonical registry post + REGISTRY_POST_ID, signed registration
  comments (self-certifying deletes), newest-wins per persona, --publish-registry
- Comment TTL: expires_at_ms inside signed digest v2 (context bump), rand 30-365d
  ordinary / fixed 30d registrations, expiry sweep on the eviction cycle
- Single accept_incoming_comment() gate wired into all three ingest sites, closing
  a pre-existing hole where both pull paths stored comments with no verification
- UI: consent panel (visible/listed/greetings, active choice at first publish),
  registry search in Discover, sealed "Say hi" compose, greetings inbox

Security fixes from review: forged-tombstone injection, delete-by-sender-trust,
remote SetPolicy poisoning, stored XSS (escapeHtml quotes, 7 pre-existing sites),
greeting off-switch now revokes prior bios' slots.

No PoW (rejected: inverted cost). Session-relay gating untouched.
201 core tests pass; CLI + desktop build; 3-node integration green.

DEPLOY GATE: wire-incompatible with v0.7.3 — ALPN bump to itsgoin/4 lands in
Iteration B. Do not build/deploy/anchor-swap before that.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LGiPD2cF75mnvneSCjdDC5

frontend/index.html

@@ -13,6 +13,12 @@
       <h2>Welcome to ItsGoin</h2>
       <p>Pick a display name if you want one &mdash; or leave blank to stay anonymous.</p>
       <input id="setup-name" type="text" placeholder="Display name (optional)" maxlength="50" autofocus />
+      <!-- v0.8 (A3): active choice at first profile publish — pre-checked,
+           visible, opt-out BEFORE anything ships (never silently defaulted). -->
+      <label class="checkbox-label" style="display:block;text-align:left;font-size:0.8rem;margin:0.5rem 0 0.75rem;cursor:pointer">
+        <input type="checkbox" id="setup-greetings-check" checked />
+        Accept greetings &mdash; people who find you can send a sealed hello. Only you can read them. Turn off any time in Profiles.
+      </label>
       <button id="setup-btn" class="btn btn-primary">Continue</button>
     </div>
   </div>
@@ -139,8 +145,14 @@
       </div>
 
       <div class="section-card">
-        <button id="discover-toggle" class="btn btn-ghost btn-sm section-toggle">Discover People</button>
-        <div id="discover-body" class="hidden">
+        <button id="discover-toggle" class="btn btn-ghost btn-sm section-toggle">Hide Discover</button>
+        <div id="discover-body">
+          <!-- v0.8 (A3): registry search — on-demand chain pull, local query -->
+          <div class="input-row" style="margin-bottom:0.5rem">
+            <input id="registry-search-input" placeholder="Search the registry: name or keywords" />
+            <button id="registry-search-btn" class="btn btn-primary">Search</button>
+          </div>
+          <div id="registry-results"></div>
           <p class="empty-hint" style="margin-bottom:0.5rem">Named profiles on the network you haven't followed or ignored.</p>
           <div id="discover-list"></div>
         </div>
@@ -181,6 +193,15 @@
         <h3>Message Requests</h3>
         <div id="message-requests-list"></div>
       </div>
+
+      <!-- v0.8 (A3): greetings inbox — [Reply] and [Dismiss] ONLY.
+           Vouching is People-tab relationship management, never a
+           Messages action (round 9). -->
+      <div class="section-card" id="greetings-section">
+        <h3>Greetings</h3>
+        <p class="empty-hint" style="margin-bottom:0.5rem;font-size:0.75rem">Sealed hellos from people outside your circles. Replies go back sealed &mdash; only the sender can read them.</p>
+        <div id="greetings-list"></div>
+      </div>
     </section>
 
     <!-- Settings tab -->