release(v1.10.2): fix compat-mode dial to fresh peers

In v1.10.1, a compat-mode (WSS-only) daemon's first SYN to a fresh peer
went raw through the WSS pipe because routing.WriteFrame only wrapped
frames in BeaconMsgRelay after the blackhole heuristic flipped the peer
to relay (3 misses, ~8s silence). For brand-new peers the unwrapped
frame reached the beacon as an unknown protocol byte and was dropped
silently — every outbound-initiated dial from a managed claw timed out.

Add routing.Manager.forceRelay, set by TunnelManager.ConnectCompat, so
every outbound write in compat mode is BeaconMsgRelay-wrapped regardless
of blackhole state. Verified live against beacon.pilotprotocol.network:
a fresh compat daemon (UDP-free, only TCP/443 + TCP/9000) successfully
fetched the weather-agent list from list-agents.

Test surface added:
- pkg/daemon/routing/zz_routing_test.go::TestWriteFrame_ForceRelayWrapsFreshPeer
- tests/compat/zz_real_beacon_test.go: 4 integration tests against the
  real beacon binary's WSS bridge
- tests/zz_compat_dial_test.go: end-to-end DialConnection from a compat
  daemon to a UDP peer through an in-process beacon

Also moves the unworkable go-test and go-coverage pre-commit hooks to
the manual stage (still one command away, no longer 5-min gate on every
commit). Pre-push retains the full release gauntlet.

Scope (per CHANGELOG platform matrix): unblocks Render-class environments
(UDP-blocked, arbitrary TCP allowed). Railway/Fly/Lambda/Cloud Run/Modal/
E2B/Daytona were already fine in UDP mode. Replit Agent / Docker AI
Sandbox / locked-down Cursor sandboxes still need HTTPS_PROXY + a
registry-over-WSS bridge (tracked for v1.10.3).

Author: teovl

.pre-commit-config.yaml

@@ -32,17 +32,28 @@ repos:
         files: \.go$
         pass_filenames: false
 
+      # `go-test` and `go-coverage` are too slow for the pre-commit
+      # stage (the tests/ package's integration suite alone is ~2 min,
+      # `make coverage` is 5+ min). Pre-push already runs the full
+      # release gauntlet on v* tag pushes (.git/hooks/pre-push), and
+      # CI runs it on every PR. Leaving these here as `manual` stages
+      # so they're still one command away locally:
+      #
+      #   pre-commit run --hook-stage manual go-test
+      #   pre-commit run --hook-stage manual go-coverage
+
       - id: go-test
-        name: go test
-        entry: bash -c 'cd tests && go test -v -short -timeout 30s'
+        name: go test (manual)
+        entry: bash -c 'go test -parallel 4 -count=1 -timeout 300s ./tests/ ./pkg/beacon/'
         language: system
         files: \.go$
         pass_filenames: false
+        stages: [manual]
 
       - id: go-coverage
-        name: update coverage badge
+        name: update coverage badge (manual)
         entry: make coverage
         language: system
         files: \.go$
         pass_filenames: false
-        stages: [pre-commit]
+        stages: [manual]

CHANGELOG.md

@@ -7,6 +7,62 @@ project uses [Semantic Versioning](https://semver.org/).
 Detailed per-release notes are on the
 [GitHub Releases page](https://github.com/TeoSlayer/pilotprotocol/releases).
 
+## [1.10.2] - 2026-05-19
+
+### Fixed
+- **Compat mode: outbound-initiated dials to fresh peers**. In v1.10.1, a
+  compat-mode (WSS-only) daemon's first SYN to a peer went raw through the WSS
+  pipe because `routing.WriteFrame` only wrapped frames in `BeaconMsgRelay`
+  after the blackhole heuristic flipped the peer to relay mode (3 misses, ~8s
+  silence). For brand-new peers, the unwrapped frame reached the beacon as an
+  unknown protocol byte and was dropped silently — every outbound-initiated
+  dial timed out. Managed claws (Docker on Render/Railway/Lambda, UDP-blocked
+  corp networks) could RECEIVE traffic via the bridge but couldn't INITIATE
+  connections to UDP-only peers. Fix: a `forceRelay` flag on `routing.Manager`
+  set by `TunnelManager.ConnectCompat`, so every outbound write in compat mode
+  is BeaconMsgRelay-wrapped regardless of blackhole state.
+
+### Added
+- `tests/zz_compat_dial_test.go` — end-to-end regression test: a compat daemon
+  dials a UDP peer's echo service through an in-process beacon and asserts the
+  three-way handshake completes and echo data flows both ways.
+- `tests/compat/zz_real_beacon_test.go` — 4 integration tests exercising the
+  production beacon binary's WSS↔UDP bridge with real `bwss.Server` +
+  `dwss.Transport` (not the synthetic in-memory bridge used by the existing
+  4-cell matrix).
+- `beacon.Server.WSSAddr()` and `WSSIsConnected(nodeID)` — exposed for tests
+  that bind to `:0` and need to wait for post-handshake WSS registration.
+
+### Platform compatibility
+
+Researched egress policies of common managed-claw / agent-sandbox platforms.
+Verified live: a fresh compat daemon (`node_id=205787`) fetched the
+weather-agent list from `list-agents` over **TCP/443 (beacon WSS) + TCP/9000
+(registry), zero UDP**. From that, the picture is:
+
+| Platform                | UDP egress         | TCP arbitrary port   | UDP mode works  | Compat mode works |
+|-------------------------|--------------------|----------------------|-----------------|-------------------|
+| Render                  | ❌ blocked         | ✅                   | No              | **✅ Yes**        |
+| Railway                 | ✅                 | ✅                   | ✅              | ✅                |
+| Fly.io                  | ✅                 | ✅                   | ✅              | ✅                |
+| AWS Lambda              | ✅ (port 25 blkd)  | ✅                   | ✅              | ✅                |
+| Google Cloud Run        | ✅ (via VPC)       | ✅                   | ✅              | ✅                |
+| Vercel Functions        | (ephemeral; wrong runtime for a persistent daemon)                | —               | —                 |
+| Modal Sandboxes         | ✅ default-allow   | ✅                   | ✅              | ✅                |
+| E2B Sandboxes           | ✅ (IP rules only) | ✅                   | ✅              | ✅                |
+| Daytona Sandboxes       | ✅ default-allow   | ✅                   | ✅              | ✅                |
+| Cursor Cloud Agents     | allowlist-driven   | allowlist-driven     | only if allowed | only if allowed   |
+| Replit Agent / Docker AI Sandbox | ❌ hard-blocked | ❌ hard-blocked  | No              | ❌ No (needs `HTTPS_PROXY`) |
+| Devin (Cognition)       | undocumented; likely Docker-AI-class | ❌  | No              | likely No         |
+
+**v1.10.2 fully unblocks**: Render (the original Garry Tan report case).
+**Already worked in v1.10.0 UDP mode**: Railway, Fly.io, Lambda, Cloud Run,
+Modal, E2B, Daytona.
+**Still blocked in v1.10.2**: platforms enforcing the Docker AI Sandbox
+HTTP-proxy-only egress model (Replit Agent, Devin, locked-down Cursor
+sandboxes). These need an `HTTP_PROXY`/`HTTPS_PROXY`-honoring transport and
+a registry-over-WSS bridge — tracked for v1.10.3.
+
 ## [1.10.1] - 2026-05-19
 
 ### Fixed

pkg/beacon/server.go

@@ -199,6 +199,27 @@ func (s *Server) WSSMetrics() bwss.Metrics {
 	return s.wssServer.Metrics()
 }
 
+// WSSAddr returns the actual listen address of the compat WSS
+// bridge. Empty string if EnableCompatWSS was never called. Used by
+// tests that bind to :0 and need to discover the real port.
+func (s *Server) WSSAddr() string {
+	if s.wssServer == nil {
+		return ""
+	}
+	return s.wssServer.Addr()
+}
+
+// WSSIsConnected reports whether a compat-mode daemon is currently
+// connected via the WSS bridge for the given nodeID. False if the
+// bridge isn't enabled. Used by tests that need to wait for the
+// post-handshake registration to land.
+func (s *Server) WSSIsConnected(nodeID uint32) bool {
+	if s.wssServer == nil {
+		return false
+	}
+	return s.wssServer.IsConnected(nodeID)
+}
+
 // CloseCompatWSS shuts down the WSS bridge. Idempotent. Used by
 // graceful shutdown paths and tests.
 func (s *Server) CloseCompatWSS() error {

pkg/daemon/routing/routing.go

@@ -132,6 +132,28 @@ type Manager struct {
 
 	// localNodeIDFn supplies our own node ID for relay-wrapping headers.
 	localNodeIDFn LocalNodeIDFn
+
+	// forceRelay, when true, makes WriteFrame always wrap outbound
+	// frames in BeaconMsgRelay regardless of blackhole heuristics or
+	// pinning. Set by TunnelManager.ConnectCompat for compat-mode
+	// daemons whose only path to peers is the beacon's WSS bridge.
+	// Without this, fresh peers receive raw L2 frames through the WSS
+	// pipe; the beacon's handlePacket sees no BeaconMsg prefix and
+	// drops them silently — outbound-initiated handshakes never
+	// complete and the daemon looks dead from the peer's side.
+	forceRelay atomic.Bool
+}
+
+// SetForceRelay toggles the every-send-must-be-relayed flag. Called
+// by TunnelManager.ConnectCompat. Idempotent.
+func (m *Manager) SetForceRelay(v bool) {
+	m.forceRelay.Store(v)
+}
+
+// ForceRelay reports the current forceRelay flag. Exposed for tests
+// and the dashboard.
+func (m *Manager) ForceRelay() bool {
+	return m.forceRelay.Load()
 }
 
 // New returns a fresh Manager with empty state. The Socket may be nil

pkg/daemon/routing/writeframe.go

@@ -31,6 +31,15 @@ func (m *Manager) WriteFrame(nodeID uint32, addr *net.UDPAddr, frame []byte, cou
 	_ = silentFor
 	_ = misses
 
+	// Compat-mode daemons have no usable direct UDP path — the only
+	// way for an outbound packet to reach a peer is wrapped in
+	// BeaconMsgRelay so the beacon's relayWorker can route it (over
+	// UDP if the peer is a regular UDP node, over WSS if the peer
+	// is itself in compat mode).
+	if m.forceRelay.Load() {
+		shouldRelay = true
+	}
+
 	m.mu.RLock()
 	bAddr := m.beaconAddr
 	sock := m.sock

pkg/daemon/routing/zz_routing_test.go

@@ -599,6 +599,68 @@ func TestWriteFrame_RelayWhenPinned(t *testing.T) {
 	}
 }
 
+// TestWriteFrame_ForceRelayWrapsFreshPeer pins compat-mode behavior:
+// when forceRelay is set, every outbound — even to a fresh peer with
+// no prior blackhole observations — must be wrapped in BeaconMsgRelay
+// and addressed to the beacon. Regression test for the v1.10.1 bug
+// where managed-claw daemons silently failed to talk to UDP-only
+// peers because the first send went raw through the WSS pipe and the
+// beacon dropped it as an unknown protocol packet.
+func TestWriteFrame_ForceRelayWrapsFreshPeer(t *testing.T) {
+	t.Parallel()
+	m := routing.New()
+	const ourID uint32 = 0xC0FFEE01
+	const peerID uint32 = 0xBADCAFE0
+	m.SetLocalNodeIDFn(func() uint32 { return ourID })
+	beacon := &net.UDPAddr{IP: net.ParseIP("198.51.100.20"), Port: 9001}
+	m.SetBeaconAddrUDP(beacon)
+	sock := &fakeSocket{}
+	m.SetSocket(sock)
+
+	// Critical: peer is FRESH — no SetRelayPeer / SetRelayPeerPinned /
+	// blackhole flips. Only forceRelay is on.
+	m.SetForceRelay(true)
+	if !m.ForceRelay() {
+		t.Fatal("ForceRelay() returned false after SetForceRelay(true)")
+	}
+
+	// addr is nil — caller doesn't even know the peer's direct UDP
+	// endpoint yet. This mirrors the real compat-mode caller, where
+	// peers maps only get populated after the first relay reply.
+	frame := []byte{0xDE, 0xAD, 0xBE, 0xEF, 0xCA, 0xFE}
+	out, err := m.WriteFrame(peerID, nil, frame, routing.CounterTarget{})
+	if err != nil {
+		t.Fatalf("WriteFrame with forceRelay should not error on fresh peer: %v", err)
+	}
+	if !out.WasRelay {
+		t.Fatal("expected relay-wrapped send under forceRelay, got direct")
+	}
+
+	got := sock.snapshot()
+	if len(got) != 1 {
+		t.Fatalf("expected 1 send, got %d", len(got))
+	}
+	if !addrsEqual(got[0].dst, beacon) {
+		t.Fatalf("dst: got %v want beacon %v", got[0].dst, beacon)
+	}
+	wire := got[0].frame
+	if len(wire) != 1+4+4+len(frame) {
+		t.Fatalf("wire len=%d want %d", len(wire), 1+4+4+len(frame))
+	}
+	if wire[0] != protocol.BeaconMsgRelay {
+		t.Fatalf("wire[0]=0x%02x want 0x%02x (BeaconMsgRelay)", wire[0], protocol.BeaconMsgRelay)
+	}
+	if got := binary.BigEndian.Uint32(wire[1:5]); got != ourID {
+		t.Fatalf("sender nodeID=0x%08x want 0x%08x", got, ourID)
+	}
+	if got := binary.BigEndian.Uint32(wire[5:9]); got != peerID {
+		t.Fatalf("dst nodeID=0x%08x want 0x%08x", got, peerID)
+	}
+	if !equalBytes(wire[9:], frame) {
+		t.Fatalf("payload mismatch: got %x want %x", wire[9:], frame)
+	}
+}
+
 func TestWriteFrame_NoAddressNoBeacon(t *testing.T) {
 	t.Parallel()
 	m := routing.New()

pkg/daemon/tunnel.go

@@ -719,6 +719,11 @@ func (tm *TunnelManager) ConnectCompat(ctx context.Context, cfg ConnectCompatCon
 	}
 	tm.sock = wssTr
 	tm.routing.SetSocket(wssTr)
+	// In compat mode every outbound L2 frame must travel beacon-wrapped:
+	// the WSS pipe terminates at the beacon, not at peers, so raw frames
+	// would be received as unknown beacon-protocol packets and dropped.
+	// Force the routing manager to wrap every send in BeaconMsgRelay.
+	tm.routing.SetForceRelay(true)
 
 	tm.readWg.Add(1)
 	go tm.readLoop()