v1.13.3-beta.1 — pre-launch daemon hardening + reliability (beta)

WS6 reliability (fleet self-heal): registry-pool half-open detection (active idle-ping +
pong-deadline -> auto-reconnect), per-request resolve deadline, rx-watchdog restart-loop breaker.
WS1 data-plane trust gate — default OFF (flag: --strict-dataplane-trust / PILOT_STRICT_DATAPLANE_TRUST).
WS4 partial PII redaction. CLI help + beacon-default fixes (#418/#419).
Bumps trustedagents v0.2.5 (removes malformed duplicate node_id 243113).

All enforcement flags default-off; wire-compatible with old agents. Canary-verified locally.

v1.13.2 — transport reliability: T2 session-desync recovery

- daemon: event-driven path reset on rekey give-up (#416) — a peer whose
  session key desyncs is no longer Ready, so the inbound-silence path
  watchdog can't see it; the rekey give-up now fires a hook that triggers
  a full path reset (fresh resolve + hole-punch + PILA). Live-verified:
  reset fires ~1s after give-up and re-establishes the tunnel. Supersedes
  the ineffective poll approach in #415.
- daemon: fix silent_for=2562047h overflow log on relay flip (T7) (#414).

v1.13.1

- #405 pilotctl pidfile lifecycle: --foreground records the real PID
  (exec keeps it); a crash no longer bricks restart with 'PID file
  locked'; PID-reuse guard stops start/status false-positives and stops
  'daemon stop' signaling innocent processes. Makes the rx-watchdog
  exit-86 recovery actually work under pilotctl-managed systemd/launchd
  units.

v1.13.0

Per-peer path self-healing:
- #401 per-peer path watchdog — detects a single dead peer NAT/relay
  session (probe + in-place prefer-direct reset, ~85s worst case) with
  zero wire changes; verified compatible with the v1.10.0-era fleet
- #388 WSS half-open ping detection, rx-watchdog restart-loop breaker,
  network port policy fails closed on registry errors

v1.12.8

Reliable P2P data transfer across NAT + cold-start onboarding fixes.
See CHANGELOG.md [1.12.8].

v1.12.7 — dynamic context for app-store calls

- pilotctl renders a next-steps graph after every `appstore call` (success and
  failure): the recommended next commands for where the agent stands, cached at
  install from the sha-verified catalogue metadata, printed to stderr. Off via
  PILOT_NEXT_STEPS=off. (#396)
- appstore install renders an app's product demo at the last step. (#395)

Both are additive and backward-compatible: older clients ignore the new
metadata fields.

v1.12.6

Reliability + security fixes shipped since v1.12.5:
- #387 rx-watchdog now also detects the partial (outbound-dial) wedge
- #381 fix WSS compat-auth wire skew (6-week prod break vs current beacons)
- #374 authenticate before committing envelope replay state (remote-DoS)
- catalogue app updates (#376-380)

daemon: inbound-path watchdog — auto-recover the long-uptime NAT wedge (

#369)

* daemon: add inbound-path watchdog — auto-recover the long-uptime NAT wedge

A daemon could run for days transmitting into a stale NAT/relay mapping
while receiving nothing (2026-07-13 incident: 43.5 MB sent vs 102 KB
received over 2d19h, every send-message failing with "cannot connect
(data exchange port 1001)"). The registry heartbeat is TCP and kept
succeeding, so trustRepublishLoop never noticed and only a manual
restart cleared it.

The new watchdog (pkg/daemon/rxwatchdog.go) samples PktsRecv/PktsSent
every 30s. On 3 min of delivered-packet silence with active transmit it
soft-recovers: RegisterWithBeacon (the discover reply doubles as an
active inbound probe) plus registry reRegister. If the wedge survives
3 soft attempts it exits with code 86 so launchd (KeepAlive
SuccessfulExit=false) / systemd (Restart=always) respawn the daemon
with a fresh transport — the remedy that demonstrably clears the wedge.

Flap guards on the hard exit: never fires when the registry is also
unreachable (machine offline — restart fixes nothing), when inbound
never progressed this process (would boot-loop), or within 30 min of
start. Emits tunnel.rx_silence / tunnel.rx_recovered /
tunnel.rx_wedged_exit. Disable with -no-rx-watchdog.

Supporting changes:
- tunnel.go: LastRecvNano stamped on every raw datagram + LastRecvTime()
  accessor, so logs separate dead-socket from dead-session-layer wedges.
- daemon.go: lastRegistryOKNano stamped on registration/heartbeat/
  re-registration successes; startTime now set at the top of Start()
  so watchdog goroutine reads never race the historical late assignment.
- pilotctl daemon start: launchd readiness wait 10s -> 30s — app-store
  apps spawn before IPC comes up, and the old timeout reported a false
  failure for boots that succeed moments later.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* go.mod: bump go directive 1.25.11 -> 1.25.12 (GO-2026-5856)

govulncheck flags GO-2026-5856 (crypto/tls Encrypted Client Hello privacy
leak), fixed in the standard library at go1.25.12. CI installs the toolchain
via go-version-file: go.mod, so bumping the go directive pulls in the fixed
stdlib and clears the vuln repo-wide. Build verified under go1.25.12.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* rxwatchdog: suppress gosec G404 on startup jitter (scheduling, not crypto)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Teodor Calin <teodor@vulturelabs.io>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

pilotprotocol v1.12.4

- pilotctl appstore outdated + upgrade (client-side app updates, #339)

v1.12.3 — catalogue-anchored app trust (app-store v1.0.2 #25 + daemon…

… companion #324)