Function wan_carry_gate 

pub(crate) fn wan_carry_gate(
    req: &InjectionRequest,
    wan: Option<&WanIdentityStore>,
    directory: Option<&str>,
    local_channel: &str,
) -> Result<WanCarried, &'static str>

The relay carry gate (§2.1): the tuple rides the relay only if every condition holds; otherwise the message is relayed exactly as before, with nothing carried, so every gap degrades to “unsigned”, never to a false forgery alarm at the receiver. Err names the first condition that failed, for debug logging only.

1. The sender proved itself on this host (sig_verified == Some(true)): a local process holding the auth key can’t launder a captured wan_sig through the relay. Do not drop this gate.
2. The signed instance and channel are this install’s own.
3. The signature verifies locally under the agent’s key in wan.db (a key purged by an agent delete fails here).
4. The directory this relay sends into — this relay plus the signed-in account (wan_publish::directory_id) — is confirmed to hold that key, so a receiver can find it. A key published under another account or relay doesn’t count: after a sign-in there, the signature would name a key the receiver can’t fetch.
5. Both ids are well-formed and every field is within the cloud’s caps.