WireMesh v0.10.3

WireMesh v0.10.3

Patch release: relay ALPN pinned to one constant set with negotiated readback and distinguishable connect failures, plus a per-(peer, relay) connect back-off on the gateway (Phase B / D2, PR #82). Closes BACKLOG item 19.

Changed

• relay: ALPN_V0 / ALPN_SUPPORTED are the single source of truth consumed by both server builders, the client endpoint, and the tests. The v1.0 client offers wiremesh-relay/0 only (owner ruling 2026-08-25); a future /1 is a one-line addition, and a test client offering [/1, /0] proves it negotiates /0.
• relay: Client::negotiated_alpn() reads the handshake result back; the registration log line carries alpn="…" and a per-ALPN session counter (the deprecation anchor for /0).
• relay: connect failures are classified at every finish_connect step on the raw error — AlpnMismatch, PeerRejectedCredentials(alert), Unreachable, Other — attached as the anyhow chain root; a credentials rejection surfaces at the ack read, not the connect.
• gateway: a per-(peer, relay) connect back-off replaces the silent per-tick retry: 3 transient failures or 1 permanent (ALPN mismatch / rejected credentials) open a jittered window (30s base, 300s hard cap); an expired window always allows again, so a relay-only pair is never starved. An unparseable advertised endpoint is recorded like any other failure (found in review).

Evidence

• relay/tests/alpn.rs 8/8; relay lib + 14 integration targets green; gateway lib 114 + punch_backoff 9 + relay_connect_backoff 14 green.
• relay_matrix netns done-bar full marks (3 passed, case5 ignored by design): the symmetric-NAT pair stays path_state=relayed; relay eviction re-paths; relay-leg death recovers a real direct path.
• Clippy identity diffs vs main: no new diagnostics in either crate.

Unchanged

Automatic key rotation stays off; unaffected by this release.

Full diff: v0.10.2...v0.10.3