v0.2.0 — protocol freeze candidate (families 3/4, private drops, drop2 tickets)

The one deliberate wire break before freezing the protocol. v0.2.0 peers and v0.1.x peers reject each other cleanly by version — upgrade together, and re-share tickets (old drop1… tickets fail with a clear version error).

Highlights

• Topic-bound signatures — frames verify under exactly one drop; cross-topic replay is impossible. Public = message family 3, sealed = family 4.
• Private drops — XChaCha20-Poly1305 sealed frames (--private on the CLI), key in the ticket, blind relays that carry what they can't read, rotate-to-exclude.
• drop2 tickets — explicit Public|Sealed mode, drop-owned address type (iroh's address evolution can't silently change ticket meaning).
• Namespaced extensions — kind numbers are core-owned; application protocols ride a 16-byte namespace envelope (kind 5). Presence beacons ship as the canonical example (iroh-drop-presence).
• Hardened sync — connection-bound, key-separated proofs for sealed drops; truncation signaling; per-attempt page/byte caps.
• Byte budgets everywhere — 32 MiB/topic retained history, 4 MiB extension budget, 64 sessions per instance, deterministic provider ordering, ambiguous-name lookups error instead of guessing.
• Web client — wasm, in-browser, relay-only, at iroh-drop.boxd.sh (redeployed for v0.2.0).

Spec: docs/protocol.md (rewritten: version terminology, acceptance order, full limits table). Extending: docs/extending.md.

Downloads

• macOS (Apple Silicon): iroh-drop-0.2.0-macos-arm64.zip — app bundle + CLI inside.
• Windows (x64): iroh-drop-0.2.0-windows-x64.zip — GUI, daemon, CLI; see README.txt inside for URL-scheme registration.

Built from tag v0.2.0. Workspace: 138/138 tests green, conformance fixtures in CI.