feat(engine): pin Telemt 3.5.16 (84e5b82) and adopt short tag layout

- Upgrade Telemt engine to 3.5.16 (84e5b82) with retry jitter, RPC ping-pong latency validation, stalled ME relay fixes (#879), and dual-stack metrics allowlist (#849)
- Standardize version tag format to clean short layout <version>-<short-commit> (3.5.16-84e5b82) matching previous releases
- Support flexible commit checkout verification in Dockerfile (cut -c1-7)
- Update build workflow defaults and engine image test suite

Author: SamNet-dev

.github/workflows/build-engine.yml

@@ -4,13 +4,13 @@ on:
   workflow_dispatch:
     inputs:
       telemt_commit:
-        description: 'Full Telemt commit SHA to build from'
+        description: 'Telemt commit hash to build from (7-char or full SHA)'
         required: true
-        default: '9d5b896bb695c55e2905b82f276da84e45a0a2ec'
+        default: '84e5b82'
       version_tag:
-        description: 'Version tag (e.g. 3.4.8-10c9bcd)'
+        description: 'Version tag (e.g. 3.5.16-84e5b82)'
         required: true
-        default: '3.5.14-9d5b896bb695c55e2905b82f276da84e45a0a2ec'
+        default: '3.5.16-84e5b82'
 
 env:
   REGISTRY: ghcr.io
@@ -46,7 +46,7 @@ jobs:
           RUN apt-get update && apt-get install -y --no-install-recommends git && rm -rf /var/lib/apt/lists/*
           RUN git clone "https://github.com/${TELEMT_REPO}.git" /build
           WORKDIR /build
-          RUN git checkout --detach "${TELEMT_COMMIT}" && test "$(git rev-parse HEAD)" = "${TELEMT_COMMIT}"
+          RUN git checkout --detach "${TELEMT_COMMIT}" && test "$(git rev-parse HEAD | cut -c1-7)" = "${TELEMT_COMMIT:0:7}"
           ENV CARGO_PROFILE_RELEASE_LTO=true CARGO_PROFILE_RELEASE_CODEGEN_UNITS=1 CARGO_PROFILE_RELEASE_DEBUG=false
           RUN cargo build --release --locked && (strip target/release/telemt 2>/dev/null || true) && cp target/release/telemt /telemt
           FROM debian:bookworm-slim

README.md

@@ -1629,10 +1629,12 @@ mtproxymax update                       # Check for script + engine updates
 
 ## 📋 Changelog
 
-### v1.4.2-LTS — Telemt Engine 3.5.14, Self-Healing Resilience & Enterprise Hardening
+### v1.4.2-LTS — Telemt Engine 3.5.16, Self-Healing Resilience & Enterprise Hardening
 
 - **Traffic Reset & Daily Monitoring Aliases ([#159](https://github.com/SamNet-dev/MTProxyMax/issues/159)):** Added `mtproxymax traffic reset-all` and `mtproxymax traffic reset-users` (plus `mtproxymax traffic help`) to allow resetting both global and per-user traffic counters in one step for daily consumption monitoring.
 - **Persistent Middle-End NAT Overrides ([#158](https://github.com/SamNet-dev/MTProxyMax/pull/158)):** Added `middle_proxy_nat_ip` and `middle_proxy_nat_probe` to `mtproxymax tune` to persist public IPv4 egress address overrides for policy-routed networks (e.g. WireGuard/MikroTik) across config regenerations.
+- **Telemt Engine 3.5.16 Upgrade & Resilience:**
+  - Upgraded core Rust proxy engine to **3.5.16** (`84e5b82`), adding retry jitter (`X-Telemt-Retry-After-Ms`), RPC ping-pong latency validation, resolving stalled ME relays by observing child task completion (#879), dual-stack metrics allowlist matching (#849), and bounded opt-in wildcard host routing.
 - **Telemt Engine 3.5.14 & Build Hardening ([#157](https://github.com/SamNet-dev/MTProxyMax/pull/157)):**
   - Upgraded core Rust proxy engine to **3.5.14** (`9d5b896bb695c55e2905b82f276da84e45a0a2ec`), resolving Middle-End pool convergence failures and writer starvation under egress tunnels (#949), with autonomous conntrack recovery on absent iptables-nft chains (3.5.11) and replay-safe streaming downlink (3.5.13).
   - Eliminated unsafe `:latest` registry relabeling in `build_telemt_image()`, ensuring missing prebuilt tags compile from source instead of mislabeling old cached binaries.

mtproxymax.sh

@@ -41,8 +41,8 @@ RUNLEVELS_DIR="${RUNLEVELS_DIR:-/etc/runlevels}"
 SCANNER_SHIELD_SET="mtp_scanners"
 CONTAINER_NAME="mtproxymax"
 DOCKER_IMAGE_BASE="mtproxymax-telemt"
-TELEMT_MIN_VERSION="3.5.14"
-TELEMT_COMMIT="9d5b896bb695c55e2905b82f276da84e45a0a2ec"  # Pinned: v3.5.14 — autonomous, lifecycle-bounded ME pool convergence
+TELEMT_MIN_VERSION="3.5.16"
+TELEMT_COMMIT="84e5b82"  # Pinned: v3.5.16 (84e5b82) — Verfassungsgericht: retry jitter, RPC ping-pong latency validation, stalled ME relay fixes (#879), dual-stack metrics allowlist (#849)
 GITHUB_REPO="SamNet-dev/MTProxyMax"
 REGISTRY_IMAGE="ghcr.io/samnet-dev/mtproxymax-telemt"
 
@@ -1189,7 +1189,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends git && \
     rm -rf /var/lib/apt/lists/*
 RUN git clone "https://github.com/telemt/telemt.git" /build
 WORKDIR /build
-RUN git checkout --detach "${TELEMT_COMMIT}" && test "$(git rev-parse HEAD)" = "${TELEMT_COMMIT}"
+RUN git checkout --detach "${TELEMT_COMMIT}" && test "$(git rev-parse HEAD | cut -c1-7)" = "${TELEMT_COMMIT:0:7}"
 ENV CARGO_PROFILE_RELEASE_LTO=true CARGO_PROFILE_RELEASE_CODEGEN_UNITS=1 CARGO_PROFILE_RELEASE_DEBUG=false
 RUN cargo build --release --locked && \
     (strip target/release/telemt 2>/dev/null || true) && \

tests/test_engine_image.sh

@@ -53,7 +53,7 @@ build_telemt_image
 assert_no_latest_pull
 grep -q "^build --build-arg TELEMT_COMMIT=${TELEMT_COMMIT} " "$tmp/calls"
 assert_marker "$version"
-grep -Fq 'RUN git checkout --detach "${TELEMT_COMMIT}" && test "$(git rev-parse HEAD)" = "${TELEMT_COMMIT}"' "$tmp/Dockerfile"
+grep -Fq 'RUN git checkout --detach "${TELEMT_COMMIT}" && test "$(git rev-parse HEAD | cut -c1-7)" = "${TELEMT_COMMIT:0:7}"' "$tmp/Dockerfile"
 grep -Fq 'cargo build --release --locked' "$tmp/Dockerfile"
 
 reset_case