feat: v0.8 Iteration C — narrow mesh, N1-N4 uniques index, anchor convection

Topology rework. The mesh's job is width; depth now comes from knowledge.

Slots:
- Local/Wide collapse into ONE mesh pool: 20 desktop / 15 mobile
- Temp referral slots +4..+10 ABOVE the cap (10 desktop / 4 mobile), carry no
  knowledge exchange, graduate into a freed mesh slot or expire (5 min TTL),
  never evict an established mesh peer
- Fixes the Wide-never-fills bug: outbound paths hardcoded Local while the
  growth gate counted Local only, so growth stopped at 71 and 20 slots were
  inbound-only. Also closes register_connection paths that enforced no cap.

Knowledge — two-pool uniques announce (replaces N1/N2/N3 share lists):
- Pool 1 (forwardable): our N0-N2 uniques, deduped. Receiver stores shifted one
  bounce deeper as N1-N3, reporter-tagged.
- Pool 2 (terminal): our N3, deduped against pool 1. Receiver stores as N4,
  USED for search/resolution but NEVER re-announced. No N5 anywhere.
- Uniques merge mesh peers + social directs + CDN file authors + holder peers,
  so receivers cannot tell how we know an ID
- Anchor entries carry addresses; every other entry is a bare ID. The pools
  double as the anchor directory.
- Dedup at both store and announce; per-bounce caps; 2 MB payload ceiling
- Device-tiered depth: mobile holds 3 bounces and drops the terminal pool

Anchor convection (register loop retired — 0xC0 AnchorRegister deleted):
- Rolling in-memory caller window (no registration DB): a caller gets the 2
  most recent viable prior callers, its address goes to the next 2, then
  rotates out; still-connected callers preferred; RelayIntroduce coordinated
  when both ends are live
- Request classes: entry (<2 connections) always served; top-up refused
  cheaply under load, and the refusal feeds the adaptive weights
- Stochastic per-disconnect action {nothing | anchor intro | mesh intro} with
  weights from local anchor density + refusal feedback. No thresholds, no
  jitter timer. Recovery (mesh < 2) stays immediate and non-stochastic.
- Anchors mined from the uniques pools incl. retained pools of disconnected
  peers; known_anchors demoted to a bootstrap cache

Security fixes from review: remote address poisoning (hearsay anchors could be
dialled — known_anchors/is_anchor now written only from completed handshakes),
N4 leaking back into announcements via the anchor mirror (infinite propagation),
missing payload size caps, unbounded candidate scoring, and a bulk SQLite write
held under the ConnectionManager mutex.

deploy.sh: version regex now captures pre-release suffixes (0.8.0-alpha would
have truncated to 0.8.0 and broken every artifact path), announce channel
derives from the suffix, and the anchor runs --publish-registry at genesis.

228 core tests; a3 integration 9/9; new c_topology_test.sh 33/33 (both
independently re-run). EDM corpse, session-relay gating, Iteration A/B intact.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LGiPD2cF75mnvneSCjdDC5

deploy.sh

@@ -18,8 +18,19 @@ SSH_OPTS="-o StrictHostKeyChecking=no"
 KEYSTORE="itsgoin.keystore"
 KS_ALIAS="itsgoin"
 
-VERSION=$(grep '"version"' crates/tauri-app/tauri.conf.json | head -1 | sed 's/.*"\([0-9.]*\)".*/\1/')
-echo "=== Deploying v${VERSION} ==="
+# Captures the FULL version string including any pre-release suffix
+# (e.g. 0.8.0-alpha). The old digits-and-dots-only pattern silently
+# truncated at the dash, so every ${VERSION} filename below missed the
+# artifacts Tauri had actually produced.
+VERSION=$(grep '"version"' crates/tauri-app/tauri.conf.json | head -1 | sed 's/.*"version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/')
+# Pre-release versions announce on their own channel so stable clients
+# are not told an alpha is "the" current release.
+case "$VERSION" in
+  *-*) ANN_CHANNEL="${VERSION#*-}" ;;
+  *)   ANN_CHANNEL="stable" ;;
+esac
+
+echo "=== Deploying v${VERSION} (announce channel: ${ANN_CHANNEL}) ==="
 
 # Builds run SERIALLY — parallel cargo invocations write to the same
 # target/ directory, which causes intermittent failures (linuxdeploy
@@ -76,10 +87,11 @@ sshpass -p "$SSH_PASS" ssh $SSH_OPTS "$SSH_HOST" "
   kill \$(cat ~/itsgoin-anchor.pid 2>/dev/null) 2>/dev/null
   sleep 1
   mv ~/bin/itsgoin.new ~/bin/itsgoin && chmod +x ~/bin/itsgoin
+  ~/bin/itsgoin ~/itsgoin-anchor-data --publish-registry 2>&1 | tail -3
   ~/bin/itsgoin ~/itsgoin-anchor-data \
     --announce \
     --ann-category release \
-    --ann-channel stable \
+    --ann-channel ${ANN_CHANNEL} \
     --ann-version ${VERSION} \
     --ann-url https://itsgoin.com/download.html \
     --ann-title 'ItsGoin v${VERSION} available' \