Indeterminate Role (Phase 13b)

[maxholman]

Indeterminate Role (Phase 13b)

Scope

Wire protocol foundation: add Indeterminate as a fourth NodeRole variant,
wire it through the proto conversions and management API, enforce that transport
connections survive role events, and pause the data plane while indeterminate.

Touches: crates/core/src/types.rs,
crates/wire/proto/management.proto,
crates/core/src/node_api.rs,
crates/core/src/control/handler.rs,
crates/core/src/control/peers.rs,
crates/daemon/src/daemon_config.rs,
crates/daemon/src/mode/mod.rs,
crates/cli/src/daemon_cli.rs

Out of scope

• Auto-negotiation / role derivation from handshake (Phase 13c)
• Hints (--prefer, --exclude-role, --fixed-role) (Phase 13d)
• Subcommand deprecation — entry, exit, relay subcommands continue
  to work unchanged. Deprecation deferred to Phase 13d when --fixed-role
  is available.
• Mode transitions / RoleTransition messages (Phase 13g)

Why

NodeRole has three variants. ROLE_INDETERMINATE already exists in the
data proto (added in 13a) but maps to Err(NodeRoleError::Unset) in the
domain type — the codebase has no concept of a node waiting for its role to
be resolved. Every subsequent phase (13c onward) depends on indeterminate
being a first-class runtime state.

Notes

• ROLE_INDETERMINATE already in proto — data.proto has it from 13a.
  control.proto uses wallhack.data.NodeRole, so no proto change needed
  there. Only management.proto needs updating: add NODE_ROLE_RELAY (was
  missing — relay collapsed to exit) and NODE_ROLE_INDETERMINATE.
• NodeRole::Indeterminate in types.rs — add the variant. Change
  TryFrom<ProtoNodeRole> to From<ProtoNodeRole> (no longer fallible —
  ROLE_INDETERMINATE → Indeterminate instead of error). Remove
  NodeRoleError. Update Display to print "indeterminate".
• Management proto — ipc.rs currently collapses relay → exit in
  From<NodeRole> for management::NodeRole. Fix to report all four roles
  accurately. CLI output and REPL info should show indeterminate when
  applicable.
• Transport survives role events — audit all paths where a role conflict
  or unexpected handshake result causes disconnection. Each must transition to
  indeterminate instead. Known candidates:
  • server/quic/ and server/ws/ accept paths that reject unexpected roles
  • Any ControlLoopExit::Disconnect path triggered by role mismatch
  • daemon_config.rs / mode/mod.rs — startup role resolution
• Data plane paused in indeterminate — a node in indeterminate must not
  forward tunnel traffic. Control plane (ping/pong, handshake) continues
  normally. Log at INFO when entering indeterminate, including the reason.

Tests

• NodeRole::Indeterminate round-trips correctly through data.proto and
  management.proto wire formats.
• Transport connection survives a role becoming invalid — node transitions to
  indeterminate, connection stays open.
• Data plane is paused in indeterminate — packets are not forwarded.
• Control plane continues in indeterminate — ping/pong still works.
• info output shows indeterminate correctly.
• just check must pass.