[bahdotsh]

The 0.32.0 readiness check left three blockers after #698. This PR clears all three. It changes docs and advisory config only.

1. Waive RUSTSEC-2026-0441 (pin-utils unmaintained)

cargo deny check advisories fails on main today. CI's Dependency Audit passed on 2026-11-04 only because the advisory reached the database afterwards, so the next CI run that touches dependencies would fail.

pin-utils compiles for wasm32 only. It sits directly under fluvio-wasm-timer, on the OpenMLS js path that the existing instant waiver (RUSTSEC-2024-0384) already covers:

pin-utils v0.1.1
└── fluvio-wasm-timer v0.2.5
    └── openmls v0.7.4

cargo tree -i pin-utils prints nothing for the host or aarch64-apple-ios. The waiver goes in both deny.toml and .cargo/audit.toml, because the audit list must stay a superset of the deny list.

2. Upgrade guide section 30

The new section follows the shape of section 29.

• Breaks Rust code that names every case or field. Event gains three subscription variants and is not #[non_exhaustive]. ProtocolConfig gains service_subscriptions and has no Default. A hand-written MeshServices conformer needs the twelve new methods.
• TypeScript. The ProtocolEvent union gains three event interfaces.
• Behaviour with no compile error. The section covers subscription requests under the default restricted policy, which are rejected after 60 seconds unanswered. It also covers the __MEMBER__ send refusal, frames for a live mesh neighbour staying on its link, the second Android app's LAN port, background and screen-off Bluetooth LE discovery, the four React Native calls that work again, and three smaller fixes.

Each claim was checked against main:

• Group and 1:1 sends both return InvalidArgument for a reserved prefix.
• __SVC_ was already reserved at v0.31.0, so __MEMBER__ is the only newly refused prefix.
• No binding passes service_subscriptions to the engine, so every binding runs the default.
• The approval timeout defaults to 60,000 ms.

The at-a-glance table and the "current line" reference are left for the version bump PR, as the recipe in CONTRIBUTING says.

3. README install table

• C#. A new row points to bindings/csharp, which builds over the C API and the native library in the release's desktop archives. Nothing publishes it to NuGet, so the row says so.
• Ruby. The row now points at the offline_protocol gem, which RubyGems has carried since 0.31.0. The Ruby README's "once a release publishes it" line is updated to match.

Verification

• cargo deny check: advisories, bans, licenses and sources all ok. cargo audit reports only the existing allowed warnings.
• scripts/check-license-consistency.sh passes.
• Every new relative link and anchor resolves.
• The diff has no em dashes.