A silent relay wire is detected: quiet wires are pinged, unanswered pings retire the connection

[lannbot]

A relay that completed the handshake and then went silent-but-open was undetectable (#96): the pump retires and redials only on a websocket error, and a stalled wire errors nothing. The client answered server pings (core/src/relay.rs) but never initiated one and tracked no deadline. Consequences: silent home-death for the home relay (no redial ever arms; new dials black-hole; connections die at the QUIC idle timeout), and stale foreign pool entries whose transmits black-hole. A middlebox that holds TCP open while dropping payload produces exactly this shape.

This is the post-handshake sibling of #93 (fixed by #95, which bounded the dial itself).

The fix — upstream's mechanism

Upstream iroh runs a client-initiated ping loop in its relay actor: PING_INTERVAL = 15s, reset on any inbound relay message (so pings fire only on a quiet wire; the constant's own doc picks 15s as half QUIC's default 30s max-idle-timeout), with the pong bounded by ping_tracker's PING_TIMEOUT = 5s; a ping timeout is a connection error feeding the reconnect path. Same shape here:

• Mechanism in core, policy in the pump. RelayConn stamps last_inbound on every inbound frame and offers probe_step (one policy step: clear an answered probe / request a ping on a quiet wire / declare death past the deadline) and send_ping. The pump's tick arm sweeps the pool: Dead on the home relay takes exactly the receive-error arm's path (retire + redial, immediate here since the connection lived ≥ 10s); Dead on a foreign relay retires it and its URL mapping, so a later dial reconnects.
• Divergences, recorded at the definition sites: any inbound frame counts as the probe's answer (upstream correlates pong payloads — for detecting a silent wire, any-frame has equal power, so the ping payload is an uncorrelated counter); the pong bound is the fixed 5s cap (upstream shrinks it by measured RTT; this client tracks none).
• The probe can never become the pin it hunts: ping sends are detached (spawn_local), so a backpressured wire cannot stall the pump — a ping that never leaves still reaches the pong deadline, which is the right verdict for that wire either way.

The regression guard

Exam scenario 9, owned-relay-gated like the outage row: a mute relay stub — accepts the websocket upgrade, selects the offered subprotocol, sends the one-byte immediate confirms-auth, then never replies while staying OPEN. No socket error is ever available; the probe alone must drive recovery:

• the stub observes ≥ 1 client PING frame (measured: first at 15200 ms);
• the endpoint retires the dead wire and redials — a second accept on the still-open stub (measured: 4867 ms after the ping);
• once the real relay returns, a fresh dial + echo completes; no guest trap throughout.

Falsified against the unfixed endpoint (guest changes stashed, component rebuilt): scenario 9 fails with the client's liveness probe reached the mute wire: 0 PING(s) and the exam reports FAIL.

Not in this PR

The send side: the pump awaits datagram sends inline, and whether a host's websocket send can pend indefinitely against a backpressured wire (pinning the pump) is unmeasured on the wasmtime host — #96's open item 2, now tracked separately in #98.

Gates

• just check (fmt, clippy, validate-wit, test): pass
• just build: pass
• just exam-polyengine: 10/10 with an owned relay — scenario 9: ping at 15200 ms, redial at 4867 ms after it, recovery echo OK
• just matrix: all 13 pairings pass

Fixes #96