Implement reactive MtuExceeded error signal (0x22)

Add a new session-layer error signal that transit routers send back to
the source when a forwarded packet exceeds the next-hop transport MTU.
This complements the existing proactive path MTU discovery (min'd at
each hop) by providing immediate feedback when oversized packets are
dropped, closing the transient window before the proactive mechanism
converges.

Wire format: 36-byte payload (msg_type + flags + dest_addr + reporter +
mtu) with FSP phase=0x0 and U flag set, matching the existing
CoordsRequired/PathBroken pattern.

Changes:
- Add SessionMessageType::MtuExceeded (0x22) and MtuExceeded struct with
  encode/decode methods to protocol/session.rs
- Add NodeError::MtuExceeded variant to propagate structured MTU info
  from TransportError through send_encrypted_link_message()
- Catch MtuExceeded in the forwarding path and send error signal back to
  the datagram source via send_mtu_exceeded_error(), rate-limited by the
  existing routing_error_rate_limiter
- Handle incoming MtuExceeded at the source by calling
  PathMtuState::apply_notification() for immediate MTU decrease
- Add unit tests for encode/decode roundtrip, boundary MTU values, and
  too-short payload rejection

src/node/handlers/forwarding.rs

@@ -5,13 +5,13 @@
 //! plaintext session-layer headers, routes to the next hop or delivers
 //! locally, and generates error signals on routing failure.
 
-use crate::node::Node;
+use crate::node::{Node, NodeError};
 use crate::node::session_wire::{
     parse_encrypted_coords, FspCommonPrefix, FSP_COMMON_PREFIX_SIZE, FSP_HEADER_SIZE,
     FSP_PHASE_ESTABLISHED, FSP_PHASE_MSG1, FSP_PHASE_MSG2,
 };
 use crate::protocol::{
-    CoordsRequired, PathBroken, SessionAck, SessionDatagram, SessionSetup,
+    CoordsRequired, MtuExceeded, PathBroken, SessionAck, SessionDatagram, SessionSetup,
 };
 use crate::NodeAddr;
 use tracing::debug;
@@ -77,12 +77,19 @@ impl Node {
             .send_encrypted_link_message(&next_hop_addr, &encoded)
             .await
         {
-            debug!(
-                next_hop = %next_hop_addr,
-                dest = %datagram.dest_addr,
-                error = %e,
-                "Failed to forward SessionDatagram"
-            );
+            match e {
+                NodeError::MtuExceeded { mtu, .. } => {
+                    self.send_mtu_exceeded_error(&datagram, mtu).await;
+                }
+                _ => {
+                    debug!(
+                        next_hop = %next_hop_addr,
+                        dest = %datagram.dest_addr,
+                        error = %e,
+                        "Failed to forward SessionDatagram"
+                    );
+                }
+            }
         }
     }
 
@@ -261,4 +268,62 @@ impl Node {
             );
         }
     }
+
+    /// Generate and send an MtuExceeded error signal back to the datagram's source.
+    ///
+    /// Called when `send_encrypted_link_message()` fails with
+    /// `NodeError::MtuExceeded` during forwarding. The signal tells the
+    /// source the bottleneck MTU so it can immediately reduce its path MTU.
+    async fn send_mtu_exceeded_error(
+        &mut self,
+        original: &SessionDatagram,
+        bottleneck_mtu: u16,
+    ) {
+        // Rate limit: reuse routing_error_rate_limiter keyed on dest_addr
+        if !self.routing_error_rate_limiter.should_send(&original.dest_addr) {
+            return;
+        }
+
+        let my_addr = *self.node_addr();
+
+        let error_payload = MtuExceeded::new(
+            original.dest_addr,
+            my_addr,
+            bottleneck_mtu,
+        ).encode();
+
+        let error_dg = SessionDatagram::new(my_addr, original.src_addr, error_payload)
+            .with_ttl(self.config.node.session.default_ttl);
+
+        let next_hop_addr = match self.find_next_hop(&original.src_addr) {
+            Some(peer) => *peer.node_addr(),
+            None => {
+                debug!(
+                    src = %original.src_addr,
+                    dest = %original.dest_addr,
+                    "Cannot route MtuExceeded signal back to source, dropping"
+                );
+                return;
+            }
+        };
+
+        let encoded = error_dg.encode();
+        if let Err(e) = self
+            .send_encrypted_link_message(&next_hop_addr, &encoded)
+            .await
+        {
+            debug!(
+                next_hop = %next_hop_addr,
+                error = %e,
+                "Failed to send MtuExceeded error signal"
+            );
+        } else {
+            debug!(
+                original_dest = %original.dest_addr,
+                error_dest = %original.src_addr,
+                bottleneck_mtu,
+                "Sent MtuExceeded error signal"
+            );
+        }
+    }
 }

src/node/handlers/session.rs

@@ -18,8 +18,8 @@ use crate::noise::{HandshakeState, HANDSHAKE_MSG1_SIZE, HANDSHAKE_MSG2_SIZE};
 use crate::mmp::report::ReceiverReport;
 use crate::mmp::{MAX_SESSION_REPORT_INTERVAL_MS, MIN_SESSION_REPORT_INTERVAL_MS};
 use crate::protocol::{
-    CoordsRequired, FspInnerFlags, PathBroken, PathMtuNotification, SessionAck, SessionDatagram,
-    SessionMessageType, SessionReceiverReport, SessionSenderReport, SessionSetup,
+    CoordsRequired, FspInnerFlags, MtuExceeded, PathBroken, PathMtuNotification, SessionAck,
+    SessionDatagram, SessionMessageType, SessionReceiverReport, SessionSenderReport, SessionSetup,
 };
 use crate::NodeAddr;
 use secp256k1::PublicKey;
@@ -73,6 +73,9 @@ impl Node {
                     Some(SessionMessageType::PathBroken) => {
                         self.handle_path_broken(error_body).await;
                     }
+                    Some(SessionMessageType::MtuExceeded) => {
+                        self.handle_mtu_exceeded(error_body).await;
+                    }
                     _ => {
                         debug!(error_type, "Unknown plaintext error signal type");
                     }
@@ -703,6 +706,47 @@ impl Node {
         }
     }
 
+    /// Handle an MtuExceeded error signal from a transit router.
+    ///
+    /// A transit router couldn't forward our packet because it exceeded the
+    /// next-hop transport MTU. Apply the reported bottleneck MTU to our
+    /// PathMtuState for the affected session, causing an immediate decrease.
+    async fn handle_mtu_exceeded(&mut self, inner: &[u8]) {
+        let msg = match MtuExceeded::decode(inner) {
+            Ok(m) => m,
+            Err(e) => {
+                debug!(error = %e, "Malformed MtuExceeded");
+                return;
+            }
+        };
+
+        let peer_name = self.peer_display_name(&msg.dest_addr);
+        debug!(
+            dest = %peer_name,
+            reporter = %msg.reporter,
+            bottleneck_mtu = msg.mtu,
+            "MtuExceeded: transit router reports oversized packet"
+        );
+
+        // Apply to PathMtuState: immediate decrease via apply_notification()
+        if let Some(entry) = self.sessions.get_mut(&msg.dest_addr)
+            && let Some(mmp) = entry.mmp_mut()
+        {
+            let old_mtu = mmp.path_mtu.current_mtu();
+            let now = std::time::Instant::now();
+            if mmp.path_mtu.apply_notification(msg.mtu, now) {
+                let new_mtu = mmp.path_mtu.current_mtu();
+                info!(
+                    dest = %peer_name,
+                    old_mtu,
+                    new_mtu,
+                    reporter = %msg.reporter,
+                    "Path MTU decreased via reactive MtuExceeded signal"
+                );
+            }
+        }
+    }
+
     // === Session Initiation (Send Path) ===
 
     /// Initiate an end-to-end session with a remote node.

src/node/mod.rs

@@ -25,7 +25,7 @@ use crate::peer::{ActivePeer, PeerConnection};
 use self::rate_limit::HandshakeRateLimiter;
 use self::routing_error_rate_limit::RoutingErrorRateLimiter;
 use crate::transport::{
-    Link, LinkId, PacketRx, PacketTx, TransportAddr, TransportHandle, TransportId,
+    Link, LinkId, PacketRx, PacketTx, TransportAddr, TransportError, TransportHandle, TransportId,
 };
 use crate::transport::udp::UdpTransport;
 use crate::tree::TreeState;
@@ -96,6 +96,9 @@ pub enum NodeError {
     #[error("send failed to {node_addr}: {reason}")]
     SendFailed { node_addr: NodeAddr, reason: String },
 
+    #[error("mtu exceeded forwarding to {node_addr}: packet {packet_size} > mtu {mtu}")]
+    MtuExceeded { node_addr: NodeAddr, packet_size: usize, mtu: u16 },
+
     #[error("config error: {0}")]
     Config(#[from] ConfigError),
 
@@ -1156,9 +1159,16 @@ impl Node {
             .ok_or(NodeError::TransportNotFound(transport_id))?;
 
         let bytes_sent = transport.send(&remote_addr, &wire_packet).await
-            .map_err(|e| NodeError::SendFailed {
-                node_addr: *node_addr,
-                reason: format!("transport send: {}", e),
+            .map_err(|e| match e {
+                TransportError::MtuExceeded { packet_size, mtu } => NodeError::MtuExceeded {
+                    node_addr: *node_addr,
+                    packet_size,
+                    mtu,
+                },
+                other => NodeError::SendFailed {
+                    node_addr: *node_addr,
+                    reason: format!("transport send: {}", other),
+                },
             })?;
 
         // Update send statistics