Two different mechanisms
Mesh transit: Node B receives an encrypted overlay packet from A, checks it and the ACL, then forwards it over a separate authenticated peer session toward C using a learned next hop.
Encrypted relay: a relay service forwards DVeProto ciphertext between endpoints when a direct path is unavailable. It is not a Control server and does not intentionally decrypt overlay payloads.
Implementation status
DVeMesh includes relay allocation and a UDP ciphertext forwarding implementation with authenticated allocation registration. The operator CLI documents a relay command such as sudo dvemesh relay --port 52821. Availability of a public relay service is not confirmed; the documented production peer config currently ships without relay endpoints.
Authorization and topology
Topology policy constrains whether a peer session or relay path is allowed. An ACL ALLOW for packet traffic cannot grant A and C a direct or relayed peer session when Control's SELECTIVE policy does not authorize that relationship.
Metadata and availability
A relay can observe network metadata and affect availability even when payloads remain encrypted. Relay operators still need authentication, allocation expiry, resource limits, and monitoring.
Validation status
Relay mechanics have automated test coverage; a live externally hosted relay and a complete independent-host fallback test are not verified.