iroh 0.35 -> 1.0 migration (unblocks browser receiver; mandatory before 2026-12-31 relay sunset)

[Kerim-Sabic]

Why (two reasons, both hard)

1. Relay sunset. n0 sunsets public-relay support for iroh 0.35-era clients on 2026-12-31. After that the app loses WAN relay connectivity. This migration is not optional.
2. Browser receiver. The v0.9.0 headline "receive in any browser" only exists on the iroh 1.0 / iroh-blobs 0.103 line, and a 1.0 browser peer can't talk to a 0.35 app (iroh 0.91 broke the relay wire protocol). The app must be 1.0 for the browser feature to work.

Already de-risked

The feasibility spike is GO — see docs/browser-receiver-spike.md. The whole browser data path compiles to wasm32-unknown-unknown, and the web-receiver/ crate is built and unit-tested. That doc contains the fully verified 0.35 -> 1.0 API map — use it as the migration checklist.

Scope (files, in order)

• src-tauri/Cargo.toml: iroh 1.0, iroh-blobs 0.103 (fs-store), drop the iroh-quinn-proto = 0.13 pin, bump n0-future.
• node/endpoint.rs (epicenter): Endpoint::builder(presets::N0) + address_lookup/MemoryLookup; BlobsProtocol::new(&store, events) + api::Store + Downloader; endpoint.online()/addr(); watcher renames.
• transfer/sender.rs: add_from_path/scan_path/WrapOption -> store.blobs().add_path(_with_opts); collection creation.
• transfer/receiver.rs + transfer/swarm.rs: download_with_opts/DownloadProgress enum -> Downloader.download(HashAndFormat, providers) (DownloadProgress: IntoFuture); preserve retry/cancel/swarm semantics.
• transfer/export.rs: new export API.
• transfer/ticket.rs: 1.0 BlobTicket (EndpointAddr); bump fd2 feature flags; unparseable-old-ticket -> friendly "sender needs to update" error.
• node/nearby_protocol.rs: re-verify the 1.0 ProtocolHandler signature.
• re-verify congestion-control (BBR/CUBIC) exposure in 1.0's transport config; re-validate Warp/BBR claims against benchmark-local and update the honesty notes honestly.
• benches + bin/benchmark_local.rs: recompile + re-baseline.

Compatibility callout

v0.9.0 cannot transfer with <=v0.8.x peers (relay + protocol break). Release notes + in-app updater nudge required.

Then: ship the browser receiver

• wasm-bindgen the existing web-receiver/ crate into public/webrx (build in GitHub Actions, not Netlify — CI has clang for ring); netlify-cli deploy.
• src/components/ReceiveHandoffPage.tsx: "Receive in this browser (beta)" below the native CTA; lazy-import wasm on click; size gate (warn >500 MB, refuse >~1-2 GB); File System Access API save + Blob fallback; "BLAKE3 verified" state.
• netlify.toml: script-src 'wasm-unsafe-eval', connect-src wss:// relay hosts.
• CLAUDE.md: amend the "Tauri IPC is the only bridge" invariant to note the WASM receiver runs the same engine in-page (never a server); document relay-only + memory-bound.

Verify

Full pnpm check + cargo clippy --all-targets -- -D warnings post-migration; benchmark-local re-baseline; cross-device matrix (Win/mac/Linux/Android v0.9 sender -> Chrome/Firefox/Safari receiver, LAN + forced relay); cancel mid-fetch; oversize refusal; zero CSP console errors on a Netlify preview.