Expand CHANGELOG Unreleased for master-only changes

Adds entries for master-only work since 0.2.0 that wasn't captured
yet: Windows and macOS platform support, the outbound LAN gateway
and its packaging, the macOS WireGuard sidecar example, multi-backend
.fips DNS configuration, the node.log_level config, the Nostr UDP
hole punch protocol proposal doc, the MMP report interval retune,
the info-to-debug log demotion, the rekey msg1 gate fix, and the
fipstop ratatui try_init change.

Fixed entries only cover bugs present in 0.2.0. Fixes against
master-only code (BLE reliability work, new sidecar port mapping)
are rolled into their respective Added entries rather than listed
as Fixed, per Keep a Changelog conventions.

CHANGELOG.md

@@ -9,6 +9,46 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+#### Platform Support
+
+- Windows platform support: wintun TUN device, TCP control socket on
+  `localhost:21210` (in place of the Unix domain socket), Windows
+  Service lifecycle (`--install-service`, `--uninstall-service`,
+  `--service`), ZIP packaging with PowerShell install/uninstall scripts,
+  and CI build/test matrix entry
+  ([#45](https://github.com/jmcorgan/fips/pull/45))
+- macOS platform support: native `utun` TUN interface management, raw
+  Ethernet transport via BPF, `.pkg` packaging with launchd plist and
+  uninstall script, x86_64 cross-compile from arm64, and CI build/unit
+  test jobs
+- `gateway` Cargo feature flag gates the optional Linux-only
+  `rustables` dependency so macOS and Windows builds never pull in
+  nftables bindings
+
+#### Outbound LAN Gateway
+
+- New `fips-gateway` binary that lets unmodified LAN hosts reach FIPS
+  mesh destinations via DNS-allocated virtual IPs and kernel nftables
+  NAT. Virtual-IP pool (`fd01::/112` by default) with state-machine
+  lifecycle and TTL-based reclamation; conntrack-backed session
+  tracking; proxy NDP on the LAN interface; control socket at
+  `/run/fips/gateway.sock` with `show_gateway` and `show_mappings`;
+  fipstop Gateway tab with pool gauge and mappings table; design doc
+  at `docs/design/fips-gateway.md`; integration test harness
+- Gateway packaging: systemd service unit with `After=fips.service`,
+  Debian and AUR package entries, OpenWrt procd init with dnsmasq
+  forwarding, proxy NDP, RA route advertisements, and IPv6 forwarding
+  sysctls. Gateway enabled by default on OpenWrt
+
+#### Examples
+
+- macOS WireGuard sidecar: run FIPS in a local Docker container and
+  route `.fips` traffic from the macOS host through a WireGuard tunnel
+  to the container's `fips0` interface. Only traffic destined for
+  `fd00::/8` transits the sidecar; regular internet traffic continues
+  to use the host network
+  ([#51](https://github.com/jmcorgan/fips/pull/51))
+
 #### Bluetooth Transport
 
 - Bluetooth Low Energy (BLE) L2CAP Connection-Oriented Channel transport
@@ -20,6 +60,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Cross-probe tie-breaker using deterministic NodeAddr comparison
 - Connection pool with configurable capacity and eviction
 
+#### DNS
+
+- Multi-backend `.fips` DNS configuration: a detection script
+  configures whichever resolver is available, in priority order:
+  systemd dns-delegate (systemd >= 258), systemd-resolved via
+  `resolvectl`, standalone dnsmasq, NetworkManager with the dnsmasq
+  plugin. Teardown reads the recorded backend from
+  `/run/fips/dns-backend` and reverses only what was applied
+  ([#58](https://github.com/jmcorgan/fips/pull/58),
+  fixes [#52](https://github.com/jmcorgan/fips/issues/52))
+
+#### Operator Configuration
+
+- `node.log_level` config field (case-insensitive, default `info`)
+  replaces the hardcoded `RUST_LOG=info` previously baked into
+  systemd units and the OpenWrt procd init script. The daemon now
+  loads config before initializing tracing so the configured level
+  takes effect; `RUST_LOG` still overrides when set
+
+#### Documentation
+
+- Pre-implementation proposal for NAT traversal using Nostr relays
+  as the signaling channel and STUN for reflexive address discovery
+  (`docs/proposals/`)
+
 #### Packaging and Deployment
 
 - Linux release artifact workflow: builds x86_64 and aarch64 tarballs
@@ -30,6 +95,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   ([#21](https://github.com/jmcorgan/fips/pull/21),
   [@dskvr](https://github.com/dskvr))
 
+### Changed
+
+- MMP link-layer report intervals retuned for constrained transports:
+  steady-state floor raised from 100ms to 1000ms, ceiling from 2000ms
+  to 5000ms. Cold-start uses a 200ms floor for the first 5 SRTT samples
+  before switching to steady-state. Reduces BLE overhead ~10× while
+  keeping reports well above the EWMA convergence threshold.
+  Session-layer intervals unchanged
+- 35 info-level log messages demoted to debug (handshake
+  cross-connection mechanics, periodic MMP telemetry, TUN/transport
+  shutdown, retry scheduling). Info output now focuses on
+  operator-relevant state changes: lifecycle events, peer promotions,
+  session establishment, parent switches, transport start/stop
+
 ### Fixed
 
 - Control socket path detection in fipsctl and fipstop now checks for
@@ -61,6 +140,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   bind with `EAFNOSUPPORT`
   ([#61](https://github.com/jmcorgan/fips/issues/61),
   reported by [@SwapMarket](https://github.com/SwapMarket))
+- Rekey msg1 on non-accepting transports (e.g. UDP holepunch) was
+  rejected at the top of `handle_msg1()`, which broke rekey handshakes
+  on established links and produced repeated "dual rekey initiation"
+  log floods. The gate now only blocks truly new inbound handshakes
+  from unknown addresses; rekey and restart msg1s for established
+  peers are processed normally
+  ([#47](https://github.com/jmcorgan/fips/issues/47),
+  [#49](https://github.com/jmcorgan/fips/pull/49))
+- `fipstop` now uses `ratatui::try_init()` instead of `ratatui::init()`,
+  so terminal initialization failures (e.g. Docker on macOS Sequoia,
+  or environments without a usable tty) produce a clean error message
+  instead of a hard crash
 
 ## [0.2.0] - 2026-03-22