## What changed
- Fix scheduled WARP rotation by verifying the real SOCKS egress IPv4, retrying unchanged or unverifiable identities, and restoring the last working WireGuard configuration on failure.
- Add `0.1.3-rotator` and `0.1.3-rotator-http` packages pinned to the current `ghcr.io/ccbkkb/microwarp:0.1.3` multi-arch image. The legacy `rotator-latest` variants remain available and are kept compatible for existing installs.
- Make 1Panel lifecycle scripts resolve quoted `APP_DATA_DIR_1` values relative to the installed app root without sourcing `.env`.
- During upgrades, atomically replace the root `rotate.sh` that 1Panel leaves untouched; preserve `.env`, `wg0.conf`, and WARP registration data, and fail safely when the target payload is unavailable.
The numeric version variants are intentional: 1Panel rejects an upgrade when the source and target version strings are both `rotator-latest`, so updating that moving label alone does not expose an old-user upgrade path.
## Verification
- `validate-v2.sh --strict-store --i18n-mode strict --i18n-scope all`: all six packaged versions pass (only the expected missing `source-evidence.json` warning).
- Script regression suite: missing/empty/custom `.env`, quoted paths, `APP_ROOT`, idempotence, atomic replacement, missing-payload failure, data preservation, and dotenv non-sourcing all pass.
- Fresh `moelin/1panel:v2` upgrade smoke using the final six-version tree:
- `rotator-latest -> 0.1.3-rotator`: install, upgrade, running, restart, uninstall, and cleanup passed.
- `rotator-http-latest -> 0.1.3-rotator-http`: install, upgrade, both containers running, restart, uninstall, and cleanup passed.
- Image pull verification passed for `ghcr.io/ccbkkb/microwarp:0.1.3` and `gogost/gost:latest`; repository integrity audit passed.
- Existing `microwarp-rotator` and `microwarp-rotator-http` containers were not modified.
Evidence reports are retained in the maintainer workspace under `.tmp/microwarp-repair-20260725/evidence/`.