v1.9.1-rc3

Tag bump to republish rc2's content with a fresh codesigned + checksummed
artifact set from the release workflow. No new behavior vs rc2.

Documents the residual long-running-tunnel desync against older-version
peer daemons as a known limitation (out-of-scope structural protocol
work; CLI workaround: 'pilotctl daemon stop && pilotctl daemon start').

Adds peerCrypto.createdAt — placeholder for a future "stale-state"
heuristic that needs more design before it can be safely turned on.

Author: teovl

CHANGELOG.md

@@ -9,6 +9,30 @@ Detailed per-release notes for tagged versions are published on the
 
 ## [Unreleased]
 
+## [1.9.1-rc3] - 2026-05-03
+
+Same content as rc2; tag bump to publish a fresh signed/notarized
+artifact set. The release workflow's macOS ad-hoc codesign step
+(`.github/workflows/release.yml:81-91`) re-signs each darwin binary on
+every tag — rc3 picks up that signature and the corresponding
+`checksums.txt`.
+
+### Tracked, not blocking rc3
+
+- Long-running tunnels against older-version peer daemons can desync
+  after ~minutes-to-hours of idle: the peer's daemon resets its send
+  counter (or rotates AEAD state without rotating X25519 keys), our
+  preserved peerCrypto holds a high maxRecvNonce, and the peer's
+  resumed-from-1 packets get rejected as replays. User symptom: a
+  burst of pings works on a fresh daemon, then `dial timeout after
+  7.5 s` until daemon restart. Workaround: `pilotctl daemon stop &&
+  pilotctl daemon start`. Fix candidates explored in rc2-dev (reset
+  recv replay state on duplicate key exchange, reset crypto on stale
+  contexts, prewarm trusted-peer tunnels) all introduced regressions
+  of their own and were reverted. The structural fix is a protocol-
+  level "session epoch" handshake — out of scope for the rc series.
+  Adds `peerCrypto.createdAt` for a future heuristic.
+
 ## [1.9.1-rc2] - 2026-05-03
 
 Release candidate 2. Builds on rc1 with three classes of fixes:

pkg/daemon/tunnel.go

@@ -57,6 +57,14 @@ type peerCrypto struct {
 	ready         bool                          // true once key exchange is complete
 	authenticated bool                          // true if peer proved Ed25519 identity
 	peerX25519Key [32]byte                      // peer's X25519 public key (for detecting rekeying)
+	// createdAt is when this peerCrypto was installed in tm.crypto. Used
+	// by handleAuthKeyExchange to decide between preserving existing state
+	// (fresh handshake retransmit/reply within seconds) and resetting it
+	// (long-lived peer's own state desynced — e.g. older-version daemon
+	// rotated its send counter without rotating X25519 keys, which
+	// otherwise leaves us with a high maxRecvNonce that rejects the
+	// peer's resumed packets as replays).
+	createdAt time.Time
 
 	// P1-010 desync salvage: ring buffer of recent plaintext sent with this
 	// key. On a peer-initiated rekey (keyChanged in handleAuthKeyExchange),
@@ -1394,7 +1402,7 @@ func (tm *TunnelManager) deriveSecret(peerPubKeyBytes []byte) (*peerCrypto, erro
 	}
 
 	// Generate random nonce prefix for domain separation
-	pc := &peerCrypto{aead: aead, ready: true}
+	pc := &peerCrypto{aead: aead, ready: true, createdAt: time.Now()}
 	copy(pc.peerX25519Key[:], peerPubKeyBytes)
 	if _, err := rand.Read(pc.noncePrefix[:]); err != nil {
 		return nil, fmt.Errorf("nonce prefix: %w", err)