An envelope's outside is cleartext that nodes verify: previous ids, author and time, key id, signature. The inside is sealed with the read key. So every query runs on a device.

It is the exact privacy claim: what an operator with the disks can and cannot learn.

Look at one envelope again. The outside is readable. The inside is not.

Outside: which envelopes came before. Who wrote it, and when. Which key encrypts it. And the signature.

Inside: the edits themselves. Sealed with the space's read key. Only members hold that key.

A sync node is a post office. A strict one: a real post office does not check signatures. It checks the signature, checks the author is on the list, checks the pointers resolve. It never holds the key. The inside is opaque to it.

So a node knows that a space exists. Which keys are members. The shape and size of the chains. It never knows a name, a field, or a message.

One consequence. A node cannot run a query. Every query runs on a device. The network is a relay for sealed mail.

Check yourself. Name two things a sync node can see and two it cannot.