1.0.1 — IPv6 lease file per-user (mirror of 0.9.27 v4 fix)

[click0]

Summary

• lib/network_lease6.cpp — mirror the 0.9.27 IPv4 effectivePath() lazy-resolve pattern; when crated's privops socket is detected at first call, the v6 lease file resolves to /var/run/crate/<uid>/network-leases6.txt instead of the legacy shared /var/run/crate/network-leases6.txt
• lib/network_lease6.h — header comment documents per-user storage
• cli/args.cpp — version crate 1.0.1
• CHANGELOG.md — entry covering the asymmetry that masked the bug

Why this matters

Without this fix, rootless multi-tenant deployments raced on v6 lease allocations even though IPv4 was already isolated since 0.9.27. Single-stack v4 setups never saw the bug; dual-stack setups hit it whenever two operators ran crate run concurrently with overlapping v6 names.

Behaviour

Mode	v4 path	v6 path (before)	v6 path (1.0.1)
Legacy (no crated)	/var/run/crate/network-leases.txt	/var/run/crate/network-leases6.txt	/var/run/crate/network-leases6.txt
Rootless (crated + privops)	/var/run/crate/<uid>/...	/var/run/crate/network-leases6.txt ⚠️	/var/run/crate/<uid>/network-leases6.txt ✓

Wire / API compatibility

None of the lease format, allocation algorithm, or public function signatures changed. NetworkLease6::leasePath() now returns the resolved per-user path (matching what NetworkLease::leasePath() has done since 0.9.27).

Test plan

• FreeBSD CI lite green
• Linux CI green
• Manual: with crated running + rootless_per_user: true, crate run an IPv6 jail and verify ls /var/run/crate/$(id -u)/network-leases6.txt exists
• Manual: with crated stopped, crate --help works (no daemon dependency for v6 path resolution at process start)
• Manual: legacy path /var/run/crate/network-leases6.txt unchanged when privops socket not detected

---

Generated by Claude Code