Add member tags, network scaling, and webhook reliability improvements

Registry: member tags per network, configurable webhook retry backoff,
improved replication protocol, directory sync enhancements, stale node
reap threshold increased to 5 minutes.

Daemon: webhook HTTP timeout and retry backoff configuration, member
tags IPC commands, policy runner improvements, tunnel peer management.

Driver: DialAddrTimeout for deadline-aware connections, MemberTagsSet
and MemberTagsGet IPC methods.

Author: teovl

docs/SPEC.md

@@ -35,7 +35,7 @@ Socket address includes a port: `1:0001.F291.0004:1000`
 | `0:0000.0000.0001` | Registry |
 | `0:0000.0000.0002` | Beacon |
 | `0:0000.0000.0003` | Nameserver |
-| `X:FFFF.FFFF.FFFF` | Broadcast on network X |
+| `X:XXXX.FFFF.FFFF` | Broadcast on network X (XXXX = X in hex, node = all-ones) |
 
 ---
 
@@ -66,6 +66,7 @@ Socket address includes a port: `1:0001.F291.0004:1000`
 | 1001 | Data exchange | Typed frames (text, binary, JSON, file) |
 | 1002 | Event stream | Pub/sub with topic filtering |
 | 1003 | Task submit | Task submission and lifecycle |
+| 1004 | Managed score | Polo score exchange for managed networks |
 
 ---
 
@@ -300,6 +301,8 @@ Maximum message size: 1 MB (1,048,576 bytes).
 | 0x20 | NetworkOK | Daemon -> Driver | `[NB JSON]` |
 | 0x21 | Health | Driver -> Daemon | (empty) |
 | 0x22 | HealthOK | Daemon -> Driver | `[NB JSON]` |
+| 0x23 | Managed | Driver -> Daemon | `[1B sub-cmd][NB payload]` |
+| 0x24 | ManagedOK | Daemon -> Driver | `[NB JSON]` |
 
 ### 6.2 Network Sub-Commands
 
@@ -315,6 +318,18 @@ The Network command (0x1F) uses a sub-command byte as the first byte of the payl
 | 0x06 | PollInvites | (empty) |
 | 0x07 | RespondInvite | `[2B network_id][1B accept]` |
 
+### 6.3 Managed Sub-Commands
+
+The Managed command (0x23) uses a sub-command byte as the first byte of the payload:
+
+| Sub-Cmd | Name | Payload |
+|---------|------|---------|
+| 0x01 | Score | `[2B network_id][4B node_id][4B delta][NB topic]` |
+| 0x02 | Status | `[2B network_id]` |
+| 0x03 | Rankings | `[2B network_id]` |
+| 0x04 | Cycle | `[2B network_id]` |
+| 0x05 | Policy | `[2B network_id][NB JSON]` |
+
 ---
 
 ## 7. Wire Examples

internal/fsutil/fsutil.go

@@ -1,6 +1,27 @@
 package fsutil
 
-import "os"
+import (
+	"fmt"
+	"os"
+)
+
+// AppendSync appends data to a file and fsyncs it. Used by the WAL for
+// durable, sequential writes. The file is opened in append mode.
+func AppendSync(path string, data []byte) error {
+	f, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0600)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	if _, err := f.Write(data); err != nil {
+		f.Close()
+		return fmt.Errorf("write: %w", err)
+	}
+	if err := f.Sync(); err != nil {
+		f.Close()
+		return fmt.Errorf("sync: %w", err)
+	}
+	return f.Close()
+}
 
 // AtomicWrite writes data to a file atomically using a temp file + rename.
 // This ensures the target file is never left in a truncated state.

pkg/beacon/server.go

@@ -43,7 +43,7 @@ type Server struct {
 	done chan struct{} // closed on shutdown
 }
 
-const relayQueueSize = 4096 // buffered relay jobs before backpressure
+const relayQueueSize = 32768 // buffered relay jobs before backpressure (increased for 1M-node scale)
 
 func New() *Server {
 	return NewWithPeers(0, nil)