v0.7.3-beta1: wg_substituted_total diagnostic counter Instruments boringtun's encapsulate-substitution path (per-link and daemon-wide lifetime counters): when a link has no current valid WireGuard session, boringtun silently substitutes a handshake datagram for real data with no visible error. Built after wg_rejected_total (0.7.2) ruled out receive-side rejection as the cause of a real ~15% TCP retransmission finding under load.