Add shared TCP and UDP virtual services

Provide named VIPs with independent protocol/port listeners and node/port
backends so applications can use one DNS endpoint without a separate load
balancer. Every authenticated member may create, edit or delete any service.
Client agents select the eligible backend with the lowest measured encrypted
data-plane RTT, including relayed paths, and pin existing flows. UDP recovers
on another backend after failure; established TCP is never replayed or moved.
An unanswered empty TCP SYN may retry another backend before establishment.

Keep signed multi-writer field registers in state/vip.rs. Independent backend
edits merge, same-field conflicts use Lamport/author/canonical ordering, and
listener generations prevent old backend entries returning on port recreation.
Permanent service tombstones protect replay while allowing obsolete fields to
be compacted. Active-service and deletion-history limits are separate. Commit
complete snapshots and the author's durable counter atomically before local
routing changes or publication. Restore counters from newer genuine author
updates learned from replicas after an old backup is restored.

Implement bounded client-side address/port NAT at overlay ingress and reverse
translation only after authenticated source/destination admission. Reserve OS
source ports to avoid direct-flow collisions and quarantine retired ports for
late replies. Handle a backend on the client itself, scoped fragment assembly,
checksums, re-fragmentation and quoted ICMP/PMTU headers. Plugins and encrypted
transit retain their existing contracts. Data-path probes measure RTT; bounded
fair TCP connect checks are enabled by default and configurable per listener.
Arbitrary UDP application readiness remains unknown; path checks and explicit
port errors drive eligibility without protocol-specific probe payloads.

Expose the shared draft API through local IPC, simple vip/listener/backend CLI
commands, JSON, editor-based atomic updates and watch output. Add a VIP button
on each network tile and a separate tray editor. Edits and removals stay local
until Save; stale revisions retain the draft, and closing a dirty window offers
explicit discard. Report local routing choices, health reasons, RTT age, active
and draining bindings, IP counters, rates, drops and UDP failovers. Extend DNS
with service names; keep numeric addresses secondary and preserve existing
bindings while VIP addresses or listeners change.

This changes control wire ALPN/version to tsunagi/ctrl/8 and local IPC to 22;
all members and local clients must upgrade together. Data ALPN remains 5.
SQLite schema 10 migrates existing mandatory state without changing identity,
secrets, network ids, derivation labels, handshake encoding or node records.
Crate versions and release tags are unchanged. No installed agent or tray was
replaced. Commands, limits and operational semantics are in docs/vip.md.

Checks on Linux in nix develop:
- cargo fmt --all -- --check
- cargo clippy --locked --workspace --all-targets -- -D warnings
- cargo test --locked --workspace --all-targets: 559 passed, 3 ignored
- git diff --cached --check

The full suite includes real encrypted TCP/UDP VIP traffic, backend-stop UDP
failover, real loopback TCP check recovery, source admission, signed merges,
stale/deleted state, SQLite migration and rollback, restart/author recovery,
network isolation, actual CLI/DNS processes, and headless text-entry/Save-button
interaction. Discovery and memory TUNs are the existing test substitutions;
authentication, transport, encryption and SQLite remain real.

Initial checks outside Nix failed for missing GTK pkg-config metadata, and an
initial CLI test inherited TSUNAGI_CONTROL_SOCKET. Final checks use the Nix
environment with that variable unset so tests address their temporary sockets.
Root/internet-dependent tests remain ignored. No live host TUN, native desktop
session, macOS or Windows validation was performed.

crates/tsunagi-core/src/overlay/interface.rs

@@ -145,18 +145,19 @@ impl Tally {
 }
 
 /// The overlay interface.
-#[derive(Debug)]
 pub struct Interface {
     device: Arc<dyn TunDevice>,
     factory: Arc<dyn TunFactory>,
     name: String,
     mtu: u32,
     routes: Arc<RoutingTable>,
+    carrier: Arc<dyn PacketCarrier>,
     tally: Arc<Tally>,
     /// What was last applied to the host, so an unchanged table is not
     /// re-applied on every pass.
     applied: std::sync::Mutex<Vec<Cidr>>,
     task: std::sync::Mutex<Option<JoinHandle<()>>>,
+    vip_task: std::sync::Mutex<Option<JoinHandle<()>>>,
     sync_lock: Arc<tokio::sync::Mutex<()>>,
     /// The host rules for this interface, when the factory manages the host.
     host_rules: Option<Arc<dyn BroadcastHostRules>>,
@@ -200,6 +201,14 @@ impl ExitState {
     }
 }
 
+impl std::fmt::Debug for Interface {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("Interface")
+            .field("name", &self.name)
+            .finish_non_exhaustive()
+    }
+}
+
 impl Interface {
     /// Creates the interface and starts moving packets.
     pub async fn start(
@@ -221,7 +230,29 @@ impl Interface {
         let name = device.name().to_string();
         let tally = Arc::new(Tally::default());
 
+        let vip_task = {
+            let routes = Arc::clone(&routes);
+            let carrier = Arc::clone(&carrier);
+            tokio::spawn(async move {
+                let mut interval = tokio::time::interval(std::time::Duration::from_millis(250));
+                interval.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Skip);
+                let mut checks = tokio::task::JoinSet::new();
+                loop {
+                    tokio::select! {
+                        _=interval.tick()=>{
+                            let (probes,jobs)=routes.vips.tick(routes.vips.check_capacity().saturating_sub(checks.len()));
+                            for (route,packet) in probes {carrier.carry(route,packet);}
+                            for job in jobs {checks.spawn(job.run());}
+                        },
+                        Some(result)=checks.join_next(),if !checks.is_empty()=>{
+                            if let Ok((job,ok))=result {routes.vips.checked(job,ok);}
+                        }
+                    }
+                }
+            })
+        };
         let task = {
+            let carrier = Arc::clone(&carrier);
             let device = Arc::clone(&device);
             let routes = Arc::clone(&routes);
             let tally = Arc::clone(&tally);
@@ -231,6 +262,26 @@ impl Interface {
                         tally.malformed.fetch_add(1, Ordering::Relaxed);
                         continue;
                     };
+                    match routes.vips.outgoing(packet.clone()) {
+                        crate::vip::router::Decision::Send(route, packet) => {
+                            for part in crate::vip::packet::fragments(packet, mtu) {
+                                if carrier.carry(route, part) {
+                                    tally.sent.fetch_add(1, Ordering::Relaxed);
+                                } else {
+                                    tally.undeliverable.fetch_add(1, Ordering::Relaxed);
+                                }
+                            }
+                            continue;
+                        }
+                        crate::vip::router::Decision::Local(packet) => {
+                            for part in crate::vip::packet::fragments(packet, mtu) {
+                                let _ = device.send(part).await;
+                            }
+                            continue;
+                        }
+                        crate::vip::router::Decision::Drop => continue,
+                        crate::vip::router::Decision::Pass => {}
+                    }
                     let destination = header.destination();
                     if let (IpAddr::V4(source), IpAddr::V4(destination)) =
                         (header.source(), destination)
@@ -279,9 +330,11 @@ impl Interface {
             name,
             mtu,
             routes,
+            carrier,
             tally,
             applied: std::sync::Mutex::new(Vec::new()),
             task: std::sync::Mutex::new(Some(task)),
+            vip_task: std::sync::Mutex::new(Some(vip_task)),
             sync_lock: Arc::new(tokio::sync::Mutex::new(())),
             host_rules,
             rules_report: std::sync::Mutex::new(None),
@@ -716,6 +769,15 @@ impl Interface {
             task.abort();
             let _ = task.await;
         }
+        let vip_task = self
+            .vip_task
+            .lock()
+            .unwrap_or_else(|e| e.into_inner())
+            .take();
+        if let Some(task) = vip_task {
+            task.abort();
+            let _ = task.await;
+        }
         self.factory.destroy(self.device.name()).await;
     }
 
@@ -770,6 +832,24 @@ impl Interface {
                 return Err(Rejected::WrongDestination);
             }
         };
+        // Source ownership was checked before any VIP reverse translation.
+        let packet = match self.routes.vips.incoming(network, peer, packet.clone()) {
+            crate::vip::router::Decision::Send(route, packet) => {
+                // Probe replies use the ordinary peer carrier, never the TUN.
+                self.carrier.carry(route, packet);
+                return Ok(());
+            }
+            crate::vip::router::Decision::Local(packet) => {
+                for part in crate::vip::packet::fragments(packet, self.mtu) {
+                    if self.device.send(part).await.is_ok() {
+                        self.tally.received.fetch_add(1, Ordering::Relaxed);
+                    }
+                }
+                return Ok(());
+            }
+            crate::vip::router::Decision::Drop => return Ok(()),
+            crate::vip::router::Decision::Pass => packet,
+        };
         // Remote broadcasts terminate here. Only local TUN ingress can fan out.
         if self.device.send(packet).await.is_ok() {
             if broadcast {
@@ -794,6 +874,14 @@ impl Interface {
 
 impl Drop for Interface {
     fn drop(&mut self) {
+        if let Some(task) = self
+            .vip_task
+            .lock()
+            .unwrap_or_else(|e| e.into_inner())
+            .take()
+        {
+            task.abort();
+        }
         if let Ok(mut guard) = self.task.lock()
             && let Some(task) = guard.take()
         {

crates/tsunagi-core/src/overlay/router.rs

@@ -89,6 +89,7 @@ pub enum RouteError {
 /// Address ownership across every network this agent is in.
 #[derive(Debug, Default)]
 pub struct RoutingTable {
+    pub(crate) vips: Arc<crate::vip::VipRouter>,
     broadcast: ArcSwap<BroadcastTable>,
     networks: RwLock<HashMap<NetworkId, NetworkRoutes>>,
 }
@@ -146,6 +147,7 @@ impl RoutingTable {
 
     /// Forgets a network.
     pub fn remove_network(&self, network: NetworkId) {
+        self.vips.remove_network(network);
         let mut networks = self.write();
         networks.remove(&network);
         self.broadcast