Reach a peer through one that can reach both

Two members of a mesh could both reach a third and not each other, and
that pair was simply lost to one another: a packet for a peer with no data
link was counted undeliverable and dropped. Now it goes through a member
that has both.

What travels is not routes. Each agent says only which peers *it* has a
live link with — first-hand, over the control plane, one hop, never a
claim about somebody else's reachability — and everybody computes their
own way through from that. The choice is local and deterministic (the
lowest endpoint id among the peers that have a link to the destination),
so there is nothing to agree, nothing to elect, and two agents may well
route each direction differently. It is soft state: repeated while it
holds, expired when it stops, so a relay that disappears stops being
chosen without anybody revoking anything.

The one in the middle carries bytes it cannot read. A datagram is wrapped
with the peer it is for, and unwrapped on the other side into the link for
the peer it came *from* — which matters, because a packet attributed to
the carrier would be dropped as coming from an address the carrier does
not hold. The tunnel stays end to end, and the relayed datagram goes link
in, link out: it never reaches the middle's interface, so no routing,
forwarding or firewall setting of that host is involved. One hop, so a
loop cannot form without counting anything.

A protocol is handed one link per peer that now outlives the paths under
it. A direct link that dies, a hop that changes, a direct link that comes
back: none of it tears down a tunnel any more, and the size a protocol may
use does not change with the path. Where there was never a direct link at
all, the link exists anyway as long as a hop does, so a peer reachable
only through somebody still gets a tunnel.

The data ALPN is `tsunagi/data/2`: every datagram now carries a tag saying
whether it is direct, for somebody else, or from somebody else. The local
control protocol is 13, for the relay counters — what this device carried
for others is their traffic on its uplink, and that should not be
invisible. `status` says `via <peer>` on a path through somebody.

Fairness between the peers a relay carries for is deliberately not here
yet: the queues are bounded and the counters are what a limit would be
built on.

Tested with fake links for the mechanics, and end to end with three real
agents — two that cannot reach each other directly, a real WireGuard
packet crossing through the middle. The one arrangement a single host
cannot produce by itself is a pair that cannot see each other, so that is
a `testing`-only switch on the agent config and exists in no release
build.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

README.md

@@ -536,6 +536,27 @@ async fn main() -> Result<()> {
 reaches the internet by accident. Opt into `DirectOnly` or `N0Defaults`
 explicitly.
 
+### Through somebody in the middle
+
+Two members can both reach a third and not each other: a blocked path, a
+relay that is unavailable, a network only reachable from inside somebody
+else's building. When that happens the pair is routed through a member that
+has both.
+
+Nothing is agreed and nothing is elected. Each member says only which peers
+*it* has a live link with, first-hand, over the control plane and one hop
+only; everyone picks their own way through from that, deterministically, and
+drops it the moment a direct link exists. There is no routing protocol, no
+second-hand claim to weigh, and a relayed datagram is never relayed again —
+so a loop cannot form.
+
+The one in the middle carries **bytes it cannot read**: the tunnel stays end
+to end between the two ends, and a relayed datagram never touches the middle
+host's interface, so no forwarding, routing or firewall setting of that host
+is involved. `status` says `via <peer>` on a path that goes through
+somebody, and counts what this device has carried for others — it is their
+traffic on your uplink, and that should not be invisible.
+
 ## How peers find each other
 
 Two different lookups are involved, and only one of them is this project's: