WireMesh v0.10.6

v0.10.6 — a failed rotation unwinds itself (backlog item 9, route R1)

Patch release. Gateway-only; no proto or config change.

Fixed

• The rotation wedge (backlog item 9, route R1). A rotation that failed part-way left the gateway's rotation state machine parked off Idle, and Rotation::on_directive is honoured only from Idle — so the gateway silently ignored every later RotateDirective until the process restarted, and the minted private key for the failed epoch survived on disk. handle_rotate now unwinds its own failure synchronously: drops the in-flight role, tears the new epoch's tun down, evicts its enforcer, scrubs the orphan mint from epoch_keys.json, and returns the state machine to Idle last, so the next directive is honoured. EpochKeys::generate_next is replaced by generate_next_at(n) — the gateway mints at the epoch the controller directed rather than keeping a second local counter that diverged the moment a scrub removed an entry. (PR #90)
• Observability: wiremesh_gateway_rotation_phase{phase} gauge and rotation_aborts_total; a ROTATION STALLED warning after 90s in Overlapping (route R2 is not aborted gateway-side — that would be a hard blackhole — it is surfaced).
• Test-only fault hook (netns-tests feature; compiled out of release binaries, verified by strings).

Found on the way

This release's done-bar (crates/wiremesh-gateway/tests/rotation_wedge.rs) found two controller defects that had been latent because clean aborts were never routine: the broker directing the aborted epoch's orphan sentinel (v0.10.4) and the tracker seeding from it and dropping the real epoch's ack (v0.10.5). This release depends on both.

Still off by default

Automatic key rotation remains off (no WIREMESH_ROTATION_INTERVAL = no timer). Route R1 of item 9 is closed; the timer stays off pending R2/R15 and the orphan-row lifecycle at abort ((C-drop)/(E)), all Phase C. Backlog item 34 records the 5s lost-directive window after an unwind (nothing retries a directive — C1).

Full Changelog: v0.10.5...v0.10.6