# mvirt 0.24.9

migrations: no
wire: unchanged
rev: cd0a7df038aa420538acf36016a20febf4c15bcb

mvirt 0.24.9

A patch release: a new control-plane leader hands every node its slice
within seconds of an election.

What changed

- #341: two things held a fresh leader's first slice push behind the
  outside world. ACME issuance/renewal ran inside the converger's ladder
  (an 8 s public fetch per certificate held at the self-check, every pass);
  it now runs as its own leader-scoped task every 15 s. And the throttled
  external sweeps (repository/backup GC, DNS sync, registry sync, object
  records) were all due on the first pass; they now wait until the first
  compile + push has completed and run right after it. On the 0.24.7 roll a
  fresh leader delivered no slice to any node for 8.5 minutes.
- The certificate SAN change is now one transaction, so the concurrent ACME
  task's order state is never overwritten.
- #360: the ACME log line after a blind-self-check validation says so.

Upgrade: ordinary host-by-host roll (release.md §C1 + §C3). No store migration.


## Upgrading

Point your flake's `mvirt` input at this release and redeploy the control-plane
host first, then each node in turn:

```
nix run .#colmena -- apply boot --reboot --on <control-plane host>
nix run .#colmena -- apply boot --reboot --on <node>   # one at a time
```

This release adds no migrations, so the control-plane host rolls back the same way
a node does: boot the previous NixOS generation.