fix(rust-nat): defer TCP bridge startup until handshake completion and buffer partial NAT socket writes

changelog.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 2026-03-31 - 1.16.3 - fix(rust-nat)
+defer TCP bridge startup until handshake completion and buffer partial NAT socket writes
+
+- Start TCP bridge tasks only after the smoltcp socket becomes active to prevent server data from arriving before the client handshake completes.
+- Buffer pending TCP payloads and flush partial writes so bridge-to-socket data is not silently lost under backpressure.
+- Keep closing TCP sessions alive until FIN processing completes and add logging for dropped packets when bridge or route channels are full.
+
 ## 2026-03-31 - 1.16.2 - fix(wireguard)
 sync runtime peer management with client registration and derive the correct server public key from the WireGuard private key