fix(relay): make verified relay publication identity-scoped

[mickvandijke]

Linear issue

https://linear.app/autonominetwork/issue/V2-812/gate-proactive-relay-publication-with-independent-canary-verification Tracking issue: WithAutonomi/saorsa-core#138. Dependent PR: WithAutonomi/saorsa-core#136.

Risk tier

• T0 — docs / tooling / CI / pure UX-output. Repo CI only.
• T1 — client-only, no network-facing behavior change. CI + prod compat smoke.
• T2 — node/client logic with behavioral surface, no protocol/format/economics change. Dev testnet + ADR.
• T3 — protocol / storage format / payments / routing. T2 evidence + adversarial testing.

Compatibility

• Wire: the unreleased relay-allocation receipt extension has been removed; CONNECT-UDP responses again carry only the existing address/reason fields.
• Storage: none.
• API: breaking; proactive relay prepare/publish/abort use an opaque PreparedRelay allocation identity instead of a SocketAddr, and the unreleased receipt APIs/types are removed.

Semver impact

• breaking
• feature
• fix

Summary

• Model proactive relay state as one identity-scoped lifecycle: none, provisional, or published.
• Publish or abort only the exact prepared allocation, so a stale same-address handle cannot affect its replacement.
• Keep provisional tunnels out of public relay state until saorsa-core's canary quorum accepts them.
• Tear down rejected, lost, or replaced relay sessions deterministically and release relay capacity.
• Carry the authoritative accepted QUIC handle directly into LinkTransport, removing the address-map lookup race that emitted Connection not found for short-lived peers.
• Remove relay-allocation receipts and their MASQUE wire/API plumbing; witness abuse is now bounded in saorsa-core instead of relying on requester-mintable proof.
• Remove packet-by-packet relay trace logging while retaining cumulative traffic and error diagnostics.

Test evidence

• Current head: 4b1ed67973763e4636694a9d9c0601ff41b9e933.
• cargo test --lib --quiet: 1,494 passed, 3 ignored, 0 failed.
• cargo fmt --all -- --check: clean.
• cargo clippy --all-targets --all-features -- -D warnings: clean.
• cargo test --all-features --quiet passed the 1,580-test primary suite and all receipt-removal-related coverage. Two unrelated NAT coordination race tests failed; both reproduce unchanged on an untouched e24989f2 worktree (6 passed, the same 2 failed).
• Downstream saorsa-core at ab9da8f: 560 tests passed, 12 ignored, 0 failed; strict clippy clean.
• Downstream ant-node: cargo check --workspace --quiet clean with the exact current transport lock.
• Prior matched 90-minute testnet evidence is recorded on saorsa-core chore(deps): bump the minor-and-patch group across 1 directory with 73 updates #136; it predates receipt removal and is not presented as an exact-head run.

New dependency

none

ADR

https://github.com/WithAutonomi/saorsa-core/blob/feat/relay-canary-gate-rc-2026.6.2/docs/adr/ADR-016-canary-gated-proactive-relays.md

Mitigation / rollback

Revert PR #131 together with dependent saorsa-core PR #136.

[github-actions]

Benchmark Results

Performance Comparison

Benchmark	Baseline	Current	Change	Status

Summary

Configuration

• Regression threshold: >10% slower
• Improvement threshold: >10% faster
• Measurements: Mean execution time

[dirvine]

Reviewed exact head d960473f165107f15e9a7c53dca015bf2033ce17.

The terminal relay-lifecycle fix resolves the remaining blocker: shutdown drains installed relay ownership once, invalidates in-flight generations, and rejects later prepare/publish commands. The earlier cancellation-safe ownership, exact-session cleanup, and receipt-verification budget fixes were also revalidated as part of the paired review.

Verification:

• Six-seat review consensus: approve; no remaining release blocker in saorsa-transport #131.
• Local cargo test --lib: 1,498 passed, 3 ignored.
• Exact-head GitHub CI: complete and green; merge state clean.

Non-blocking follow-ups remain around broader endpoint-wide shutdown semantics for the older public relay-session API and cancellation hardening before shutdown-command linearisation. These are pre-existing/outside the proactive lifecycle blocker and do not hold this PR.