release 3.0.0: iroh 1.0-rc.0, gossip 0.99, rendezvous 0.2

CHANGELOG.md

@@ -1,5 +1,47 @@
 # Changelog
 
+## [3.0.0] - 2026-05-11
+
+### Breaking
+
+- **`iroh` bumped 0.98 → `=1.0.0-rc.0`** and **`iroh-gossip` bumped
+  0.98 → 0.99**. The bridge is now built on iroh's first 1.0 release
+  candidate. iroh-gossip 0.99 hard-pins `iroh = "=1.0.0-rc.0"`, so the
+  bridge does too until iroh ships a final 1.0 — once it does, this
+  pin will relax to plain `"1"`. Any downstream consumer that pulls
+  iroh transitively must move in lockstep.
+- **`iroh-gossip-rendezvous` bumped 0.1 → 0.2** (now consumed from
+  crates.io; the local path-dep is gone). The 0.2 release of the
+  rendezvous crate carries the same iroh 1.0-rc.0 bump and pins
+  `ed25519-dalek = "=3.0.0-pre.7"` to match iroh-base's pre-release.
+
+### Changed
+
+- `donglora-client` resolves to 1.1.1 (was 1.0.x). Adds the
+  `connect()`-time auto-clamp of `tx_power_dbm` against
+  `GET_INFO.tx_power_min/max` and pre-flight rejection of
+  out-of-range `freq_hz` / `sf` / `bw` with
+  `ClientError::ConfigNotSupported` — both surface as ordinary
+  bridge connection errors today.
+- `Cargo.lock` refreshed end-to-end: `mainline` 6.0 → 6.1.2, plus
+  the usual tokio/rustls/hyper patch sweep.
+
+### Notes
+
+- **Pre-v2 config files were silently mis-loaded.** A stale
+  `~/.config/donglora-bridge/config.toml` from v0.x / v1.x — with
+  `sync_word = 13380` (`0x3444`, the old LoRaWAN-public default),
+  `tx_power = "22"` (old string field), or `cad = true` (removed in
+  v2) — would deserialize without error: serde silently ignored the
+  unknown `tx_power` / `cad` fields and the bridge fell back to its
+  per-field defaults, producing a "requested config" that didn't
+  match what the user had ever entered. On a shared mux the TUI
+  flagged this as a `!` against the active config. Re-run
+  `donglora-bridge config` (or update the file by hand) if your
+  config still has any of `tx_power`, `cad`, or
+  `sync_word = 13380`. A future minor will tighten the loader so
+  this fails loudly instead.
+
 ## [2.0.1] - 2026-04-25
 
 ### Fixed