# mvirt 0.24.19

migrations: no
wire: unchanged
rev: d1910ae3b7e812bb2ce412735e49e97d7b5a503f

mvirt 0.24.19

A read-only token can no longer be widened into a writable one: the
registry token endpoint grants it pull only, and the assistant refuses
it danger mode. Login redirects fail closed when no console URL is
configured. A project can be deleted right after its VMs are terminated.

- cplane: the ADR-0065 D4 read-only fence moves into one grant check
  (rest::Grants) that every authorizing handler goes through; the
  registry token realm grants a read-only caller pull only, and a
  read-only assistant message cannot arm danger mode (#202).
- cplane: an empty return_to allowlist refuses OIDC start, the CLI
  handoff and a password login with returnTo, instead of accepting any
  URL; MVIRT_DEV_RETURN_TO_ALL=1 restores the old behaviour for local
  development (#144). Deployments need MVIRT_CONSOLE_URLS or a console
  domain on every control-plane replica.
- cplane, mvdb: deleting a project purges its torn-down Terminated VM
  tombstones in the same transaction instead of returning 409 until the
  retention GC runs; a restrict FK now sees children deleted earlier in
  the same transaction (#179).
- cplane: a Never/OnFailure pod with one cleanly finished container and
  one still running reads Running, not Creating (#171).


## Upgrading

Point your flake's `mvirt` input at this release and redeploy the control-plane
host first, then each node in turn:

```
nix run .#colmena -- apply boot --reboot --on <control-plane host>
nix run .#colmena -- apply boot --reboot --on <node>   # one at a time
```

This release adds no migrations, so the control-plane host rolls back the same way
a node does: boot the previous NixOS generation.