v0.3.0

Behaviour and interoperability release. Nothing was removed and no exported signature changed.

Added: seven blob chunk-range APIs, docs.InsertOutcome.Err, blobs.Downloader.Wait, and blobs.ErrDownloaderClosed. Adding Err and Wait can make selectors ambiguous on types embedding another provider of the same method.

Four behaviour changes worth reading before upgrading.

• Incoming docs sync requires authorization. A nil docs.Handler.Allow used to permit every peer and namespace; it now rejects every request with AbortNotFound, including legacy handshakes. Supply an explicit namespace and peer policy. Handler.Validate adds policy after mandatory signature and empty-record checks; it cannot bypass them.
• Closing a downloader ends its work. Close rejects new downloads, cancels active ones, and closes cached connections. Wait(ctx) joins downloads and their callbacks. An OnEvent callback may call Close, but must not call Wait. New downloads after closure return ErrDownloaderClosed.
• Save failures reach callers. Check InsertOutcome.Err(). Failed saves leave entries readable in memory, but sync reports failure until persistence succeeds. Duplicate inserts retry a failed save. Mutations, saves, and subscriber events are ordered.
• Live sync closure waits for workers and callbacks. An OnSync callback must arrange Close asynchronously rather than call it itself.

Blob providers now serve arbitrary chunk selections, hash-sequence children, and bao-tree-compatible partial-block proofs. Use the new chunk APIs for iroh-blobs wire responses; the byte-offset EncodeBlobRange retains whole-group encoding.

Docs sync opens with Init, matching iroh-docs, while accepting older report-first clients under the explicit policy. Live sync downloads reconciled content, retains queued work during bursts, and recovers subscriber lag. Cancellation interrupts blocked sync I/O; canceling a blob download preserves connections shared by other transfers.

mDNS puts addresses in the additional section, omits empty TXT records, and resolves every SRV record for an instance. NAT traversal rounds start only on client connections.

The Rust parity matrix records 34 passes and one expected postcard-varint incompatibility per pinned release, iroh 1.2.0 and 1.3.0. Docs interop uses a separate iroh 1.1.0 peer. See COMPATIBILITY.md for scope, provenance, and the full detail.