Covers that the relay allowlist is exactly the session-scoped read/steer/handoff surface (starting, deleting, and previews stay off it), that unknown names are refused, and that an allowed call runs against the device's own home project rather than the caller's project id.

## Before writing SPEC.md files

Read https://raw.githubusercontent.com/brillout/sdd/refs/heads/main/sdd.md
