WireMesh v0.10.5

v0.10.5 — the rotation tracker seeds from the newest pending row

Patch release. Controller-only; no proto, config, or gateway change.

Fixed

• The controller's RotationTracker was seeded from the oldest pending key row. After a gateway-side rotation abort (v0.10.x Phase B, backlog item 9), the aborted rotation leaves an awaiting-submission sentinel row behind, and every later rotation's tracker was seeded from that orphan instead of the live rotation. The gateway's one-shot EpochAck for the real epoch then failed the tracker's epoch check and was dropped silently, so the real epoch was not promoted until the orphan aborted (~300s) and a zero-ack grace promote fired (~390s total) — reaching the right state by the hazard path, not the designed one. Seen as a deterministic red in rotation_wedge's 120s poll (3/3). All three seed sites (seed_and_record_epoch_acks, drive_rotation_for, sweep_rotations step 2) now share one private selector that picks the max-epoch pending row, threaded to both the lazy seed and the evict_decision staleness input at the two sweep-side sites. (PR #88)
• This is deliberately not the broker's newest-sentinel selector from v0.10.4: on {orphan sentinel below an active epoch} the tracker must still seed the sentinel, because that tracker is the orphan's only garbage collector (Abort at ABORT_AFTER → drop_pending_epoch); seeding nothing there strands the row and initiate_due_rotations skips the gateway permanently. A test pins the difference with the consequence in its failure message.

Observability

• The controller now logs an EpochAck whose epoch is not the rotation in flight (ignoring EpochAck(epoch=N) from gateway A for gateway B: the rotation in flight is epoch K). No state change on that path; a counter is a Phase-C item (the controller has no metrics surface yet).

Documented

• docs/research/orphan-sentinel-mis-seeds-tracker.md — the mechanism, the ~390s self-heal (why a larger test budget would have passed a broken controller), the one-shot ack, and the measured site-guarding asymmetry (sweep_rotations step 2 is guarded only by the identity-stamp churn test, because step 2b re-arbitrates every gateway after it).
• docs/BACKLOG.md item 35 (Phase C): make-before-break is enforced on the data plane, not on the roster — a rotating gateway destroys its retired key while the controller row still advertises it active; the window exists on the healthy path, this release only shortens it back.

Still off by default

Automatic key rotation remains off (no WIREMESH_ROTATION_INTERVAL = no timer). This release clears the second controller defect found by the Phase-B rotation-wedge done-bar; the timer stays off pending the Phase-C items (R2/R15, (C-drop)/(E)).

Full Changelog: v0.10.4...v0.10.5