Land v0.4.0 pre-release source content: docs, changelog, packaging

Bring the source tree to its finished v0.4.0 content state ahead of the
release candidate. Documentation, changelog, release notes, and
packaging metadata only; no code or version-string changes.

CHANGELOG.md: backfill the operator-visible changes that landed since
v0.3.0 (the show_metrics scraper query and fipsctl stats metrics, the
discovery dedup-cache-full counter, the off-rx_loop control read
surface and its new daemon-resolved fields, the fipstop TUI overhaul,
the TCP inbound cap now honoring max_connections, host-map hot-reload,
log-noise demotions, and the net bug fixes), topic-grouped rather than
replayed per commit; intra-cycle fixes folded into their feature
entries; the duplicate Unreleased Fixed section merged into one.

Release notes: author docs/releases/release-notes-v0.4.0.md to the
operator-upgrade bar and mirror it byte-for-byte into the root
RELEASE-NOTES.md. Attribute each feature to its author in Contributors
(Nym transport and the mixnet demo to @oleksky, opt-in mDNS LAN
discovery to @mmalmi).

README.md: add the Nym transport to the support matrix (Linux, macOS,
Windows; OpenWrt pending verification), the multi-transport bullet, and
the "What works today" list; fold mDNS LAN discovery into the existing
Nostr-discovery bullets; refresh the status narrative to v0.4.0 over a
global, public test mesh.

packaging/common/fips.yaml: add commented Nym transport and mDNS LAN
discovery example stanzas with verified field names and defaults.

Cargo.toml: add homepage, keywords, and categories crate metadata.

docs/reference: update the cli-fips version example to the released
form; document the new control-socket output fields and the typed
RejectReason families in control-socket.md; sync cli-fipstop.md with the
overhauled TUI keybindings.

docs/reference/cli-fips.md

@@ -28,7 +28,7 @@ controlled through the standard service control manager.
 | Flag | Argument | Description |
 | ---- | -------- | ----------- |
 | `-c`, `--config` | `FILE` | Use `FILE` as the configuration. Skips the default search paths. |
-| `-V` | — | Print the short version (e.g. `0.3.0-dev (rev abcdef1)`). |
+| `-V` | — | Print the short version (e.g. `0.4.0 (rev abcdef1)`). |
 | `--version` | — | Print the long version: short version plus build target triple. |
 | `-h`, `--help` | — | Print usage and exit. |
 | `--install-service` | — | (Windows only) Install `fips` as a Windows service. Requires Administrator. |

docs/reference/cli-fipstop.md

@@ -15,8 +15,11 @@ socket, polls a small set of `show_*` queries on a timer, and renders
 the state in a tabbed full-screen UI. A separate poll runs against the
 gateway control socket when the Gateway tab is active.
 
-`fipstop` is read-only — it cannot mutate daemon state. Use
-[`fipsctl`](cli-fipsctl.md) for `connect` / `disconnect` and friends.
+`fipstop` is almost entirely read-only: the only state-mutating action
+it offers is disconnecting a peer (`Del` on a selected Peers row, with
+a confirmation prompt — see [Keybindings](#keybindings)). For
+`connect` and other mutating commands, use
+[`fipsctl`](cli-fipsctl.md).
 
 ## Options
 
@@ -86,6 +89,11 @@ empty list and the panel hides.
 
 ## Keybindings
 
+Press `?` at any time for an in-app help overlay. The overlay and the
+status-bar hint footer both read from a single keybinding registry
+keyed by `(tab, mode)`, so the always-visible hints describe exactly
+the keys the current context accepts.
+
 ### Global
 
 | Key | Action |
@@ -94,7 +102,8 @@ empty list and the panel hides.
 | `Tab` | Next tab. |
 | `Shift-Tab` | Previous tab. |
 | `g` | Jump to the Graphs tab. |
-| `Esc` | Close detail view (if open). |
+| `?` | Toggle the help overlay. |
+| `Esc` | Close an open detail view; otherwise deselect the active table row. |
 
 ### Table tabs (Peers, Sessions, Transports, Gateway)
 
@@ -102,6 +111,13 @@ empty list and the panel hides.
 | --- | ------ |
 | `Up`, `Down` | Move row selection. |
 | `Enter` | Open detail view for the selected row. |
+| `Esc` | Deselect the row (return to the tab's overview state). |
+
+### Peers tab (extra)
+
+| Key | Action |
+| --- | ------ |
+| `Del` | Disconnect the selected peer. Opens a `Y`/`N` confirmation modal first; this is the only state-mutating action in `fipstop`. |
 
 ### Transports tab (extra)
 
@@ -112,16 +128,43 @@ empty list and the panel hides.
 | `e` | Expand all transports. |
 | `c` | Collapse all transports. |
 
+### Multi-pane scrolling tabs (Tree, Filters, Routing)
+
+Each lays out stacked panes that scroll independently.
+
+| Key | Action |
+| --- | ------ |
+| `f` | Move focus to the next pane. |
+| `Up`, `Down` | Scroll the focused pane by one row. |
+| `PageUp`, `PageDown` | Scroll the focused pane by ten rows. |
+| `Home`, `End` | Jump to the top / bottom of the focused pane. |
+
+### Performance tab (extra)
+
+The Performance tab lays out two panes (Link MMP, Session MMP).
+
+| Key | Action |
+| --- | ------ |
+| `f` | Move focus between the Link and Session MMP panes. |
+| `Up`, `Down` | Scroll the focused pane. |
+| `PageUp`, `PageDown` | Scroll the focused pane by ten rows. |
+| `Home`, `End` | Jump to the top / bottom of the focused pane. |
+| `s` | Cycle the sort column of the focused pane. |
+| `Shift-S` | Toggle the sort direction of the focused pane. |
+
 ### Graphs tab (extra)
 
 | Key | Action |
 | --- | ------ |
-| `Up`, `Down` | Scroll within the stacked plots. |
+| `Up`, `Down` | Scroll the stacked plots; in `MetricByPeer` mode, move the by-peer selection (and follow it when the by-peer detail is open). |
 | `Right`, `Space` | Next time window. Cycles `1m / 1s` → `10m / 1s` → `1h / 1s` → `24h / 1m`. |
 | `Left` | Previous time window. |
+| `Enter` | In `MetricByPeer` mode, expand the selected peer summary into a full-pane plot. |
 | `m` | Cycle view mode: `Node` (stacked node metrics) → `MetricByPeer` (one per-peer metric across all peers) → `PeerByMetric` (all per-peer metrics for one peer). |
 | `n` | Next selector (next per-peer metric in MetricByPeer; next peer in PeerByMetric). |
 | `Shift-N` | Previous selector. |
+| `s` | Cycle the sort column of the by-peer summary list. |
+| `Shift-S` | Toggle the sort direction of the by-peer summary list. |
 
 ## Exit Codes
 

docs/reference/control-socket.md

@@ -100,22 +100,22 @@ table below lists every command currently registered.
 
 | Command | Params | `data` shape (top-level keys) |
 | ------- | ------ | ----------------------------- |
-| `show_status` | — | `version`, `npub`, `node_addr`, `ipv6_addr`, `state`, `is_leaf_only`, `peer_count`, `session_count`, `link_count`, `transport_count`, `connection_count`, `tun_state`, `tun_name`, `effective_ipv6_mtu`, `control_socket`, `pid`, `exe_path`, `uptime_secs`, `estimated_mesh_size`, `forwarding`, `sparklines`. |
+| `show_status` | — | `version`, `npub`, `node_addr`, `ipv6_addr`, `state`, `is_leaf_only`, `is_root` (bool — this node is the spanning-tree root), `root` (hex node-addr of the current tree root), `persistent` (bool — identity is persisted, i.e. `persistent` set or an `nsec` configured), `peer_count`, `session_count`, `link_count`, `transport_count`, `connection_count`, `transport_peer_counts` (object mapping transport-type name to its connected-peer count; configured transports appear with `0`), `tun_state`, `tun_name`, `effective_ipv6_mtu`, `control_socket`, `pid`, `exe_path`, `uptime_secs`, `estimated_mesh_size`, `forwarding`, `sparklines`. |
 | `show_acl` | — | `allow_file`, `deny_file`, `enforcement_active`, `effective_mode`, `default_decision`, `allow_all`, `deny_all`, `allow_file_entries`, `deny_file_entries`, `allow_entries`, `deny_entries`. |
-| `show_peers` | — | `peers[]` — per-peer object: `node_addr`, `npub`, `display_name`, `ipv6_addr`, `connectivity`, `link_id`, `direction`, `transport_addr`, `transport_type`, `is_parent`, `is_child`, `tree_depth`, `stats`, `noise`, `current_k_bit`, `mmp`, plus optional `nostr_traversal`, `rekey_in_progress`, `rekey_draining`. |
+| `show_peers` | — | `peers[]` — per-peer object: `node_addr`, `npub`, `display_name`, `ipv6_addr`, `connectivity`, `link_id`, `direction`, `transport_addr`, `transport_type`, `is_parent`, `is_child`, `tree_depth`, `effective_depth` (`tree_depth + link_cost` — the metric `evaluate_parent` ranks on; `null` when the peer has no coords, or is unmeasured while another peer has an SRTT sample, per the cold-start gate), `stats`, `noise`, `current_k_bit`, `mmp`, plus optional `nostr_traversal`, `rekey_in_progress`, `rekey_draining`. |
 | `show_links` | — | `links[]` — `link_id`, `transport_id`, `remote_addr`, `direction`, `state`, `created_at_ms`, `stats`. |
-| `show_tree` | — | `my_node_addr`, `root`, `is_root`, `depth`, `my_coords[]`, `parent`, `parent_display_name`, `declaration_sequence`, `declaration_signed`, `peer_tree_count`, `peers[]`, `stats`. |
+| `show_tree` | — | `my_node_addr`, `root`, `root_npub` (bech32 npub of the current tree root), `is_root`, `depth`, `my_coords[]`, `parent`, `parent_display_name`, `declaration_sequence`, `declaration_signed`, `peer_tree_count`, `peers[]`, `stats`. |
 | `show_sessions` | — | `sessions[]` — `remote_addr`, `npub`, `display_name`, `state` (`established`, `initiating`, `awaiting_msg3`, `unknown`), `is_initiator`, `last_activity_ms`, `stats`, optional `mmp`, `current_k_bit`, `is_draining`. |
-| `show_bloom` | — | `own_node_addr`, `is_leaf_only`, `sequence`, `leaf_dependent_count`, `leaf_dependents[]`, `peer_filters[]`, `stats`. |
+| `show_bloom` | — | `own_node_addr`, `is_leaf_only`, `sequence`, `leaf_dependent_count`, `leaf_dependents[]`, `peer_filters[]`, `uptree_fill_ratio` (fill ratio of the last filter actually sent to the tree parent), `uptree_estimated_count` (cardinality estimate of that uptree filter — this node's whole subtree under split-horizon, not the mesh; both are `null` for a root node or before the first announce), `stats`. |
 | `show_mmp` | — | `peers[]` (link-layer per peer), `sessions[]` (session-layer per session). Each entry includes loss/RTT/ETX/goodput, smoothed values, trends. |
 | `show_cache` | — | `count`, `max_entries`, `fill_ratio`, `default_ttl_ms`, `expired`, `avg_age_ms`, `entries[]` — per-destination coords, depth, age, last-used, optional `path_mtu`. |
 | `show_connections` | — | `connections[]` — pending handshakes: `link_id`, `direction`, `handshake_state`, `started_at_ms`, `idle_ms`, `resend_count`, optional `expected_peer`. |
 | `show_transports` | — | `transports[]` — `transport_id`, `type`, `state`, `mtu`, `name`, `local_addr`, optional `tor_mode`, `onion_address`, `tor_monitoring`, `stats`. |
-| `show_routing` | — | `coord_cache_entries`, `identity_cache_entries`, `pending_lookups[]`, `pending_tun_destinations`, `pending_tun_packets`, `recent_requests`, `retries[]`, `forwarding`, `discovery`, `error_signals`, `congestion`. |
+| `show_routing` | — | `coord_cache_entries`, `identity_cache_entries`, `pending_lookups[]`, `pending_tun_destinations`, `pending_tun_packets`, `recent_requests`, `retries[]`, `forwarding`, `discovery` (request/response sub-counters; includes `req_deduplicated` — requests suppressed as recent duplicates — and `req_dedup_cache_full` — requests admitted because the dedup cache was full), `error_signals`, `congestion`. |
 | `show_identity_cache` | — | `entries[]`, `count`, `max_entries`. Each entry: `node_addr`, `npub`, `display_name`, `ipv6_addr`, `last_seen_ms`, `age_ms`. |
 | `show_listening_sockets` | — | `fips0_addr`, `firewall_active` (bool — `inet fips` table loaded), `sockets[]`. Each entry: `proto` (`tcp` / `udp`), `local_addr` (`::` or the node's fd00::/8 address), `port`, `pid` (nullable), `process` (nullable), `wildcard_bind` (bool — `local_addr == ::`), `filter` (`accept` / `drop` / `unknown` / `no_firewall`). Linux-only; returns an empty `sockets[]` on other platforms. |
 | `show_stats_list` | — | `metrics[]` (each with `name`, `unit`, `scope`), `fast_ring_seconds`, `slow_ring_minutes`, `peer_retention_seconds`. |
-| `show_metrics` | — | Flat snapshot of every counter family in the metrics registry: `forwarding`, `discovery`, `tree`, `bloom`, `congestion`, `errors`. Each value is that family's counter snapshot object. Counter-only — gauges/histograms that need the live node are excluded. Served off the main loop. |
+| `show_metrics` | — | Flat snapshot of every counter family in the metrics registry: `forwarding`, `discovery`, `tree`, `bloom`, `congestion`, `errors`. Each value is that family's counter snapshot object. Counter-only — gauges/histograms that need the live node are excluded. Served off the main loop. Silent-rejection sites classify their reason as a typed `RejectReason` and increment the matching per-family counter exposed here — see [Rejection reasons](#rejection-reasons). |
 | `show_stats_history` | `metric` (req), `peer` (req for per-peer metrics), `window` (`<N>s` / `<N>m` / `<N>h`, default `10m`), `granularity` (`1s` / `1m`, default `1s`) | A single `Series`: `metric`, `unit`, `granularity_seconds`, `values[]`. |
 | `show_stats_all_history` | `peer` (optional npub), `window`, `granularity` | `granularity_seconds`, `window_seconds`, `peer`, `series[]` (one per metric). |
 | `show_stats_peers` | — | `peers[]`, `count`. Each entry: `npub`, `node_addr`, `display_name`, `is_active`, `first_seen_secs_ago`, `last_contact_secs_ago`. |
@@ -125,6 +125,30 @@ The schema of each query response is pinned by snapshot tests in
 `src/control/snapshots/`; intentional schema changes regenerate those
 fixtures.
 
+### Rejection reasons
+
+Silent-rejection paths across the node classify why a message was
+dropped via a typed `RejectReason` rather than only logging it, so the
+*what* of a rejection is visible in the counter snapshots above. The
+top-level reason set has eight families, mirroring the protocol-layer /
+subsystem split of the metrics:
+
+- **Tree** — spanning-tree `TreeAnnounce` processing rejections.
+- **Bloom** — bloom-filter `FilterAnnounce` processing rejections.
+- **Discovery** — discovery request / response processing rejections.
+- **Handshake** — Noise handshake state-machine rejections.
+- **Session** — FSP session state-machine rejections.
+- **Mmp** — MMP link-layer rejections.
+- **Forwarding** — forwarding-path rejections (no-route, TTL, MTU).
+- **Transport** — transport-layer rejections (admission caps, framing).
+
+Each rejection increments the corresponding counter in its family's
+stats, surfaced through `show_metrics` (the `tree`, `bloom`,
+`discovery`, and `forwarding` families carry their own counters; the
+`errors` family and the remaining subsystem counters carry the rest).
+The full per-family variant list lives in `src/node/reject.rs`; it is
+not reproduced here to avoid duplicating the source.
+
 ### Mutating commands
 
 | Command | Required params | Behaviour |