# mvirt 0.25.0

migrations: yes
wire: unchanged
rev: bb7907ffb2efa9181f5d9a15e90f3b833dfb87de

mvirt 0.25.0

A password reset now revokes every session and CLI refresh token of the
account. The session signing key is region state, so a control-plane
failover no longer logs every console user out. GET /v1/nodes shows each
replica's schema level. PaaS app hostnames redirect :80 to HTTPS once
their certificate is issued.

- cplane: Account and CliSession carry a token_epoch; session JWTs carry
  it as `ep` and are refused once the account's epoch moves. A password
  reset bumps it; DELETE /v1/accounts/{id}/sessions signs out
  everywhere. Pre-existing tokens count as epoch 0, so the upgrade signs
  nobody out (#149). Migration 0140_account_token_epoch.
- cplane: the session signing key is sealed in the store (pki row
  session_signing_key), seeded once by the first leader on this version
  from the key it signs with, and re-read by every member every 10 s.
  Expect one more console re-login on this roll: sessions survive only
  if they were signed by the first leader running 0.25.0 (#170).
- cplane, node: ControlPlaneFacet gains schema_level (8),
  pending_migrations (9) and schema_held (10); /v1/nodes shows them per
  replica, and an older node reads as "unknown". Additive proto change in
  node.proto — the wire line below only tracks the storage wire (#328).
- cplane: the object gateway's resolve lookups require
  objectstore.resolve (platform editor/admin already hold it; new
  built-in role object-gateway). The REST role cache resyncs from the
  store every 10 s (#148).
- cplane: app hostnames on the PaaS ingress get httpsRedirect once
  issued; the ACME challenge path stays on :80 (#286).

Rolling: this release migrates. With the #334 rail an upgraded leader
holds the migration until every Online voter reports 0.25.0; roll
leader-last (runbook C1a).


## Upgrading

Point your flake's `mvirt` input at this release and redeploy the control-plane
host first, then each node in turn:

```
nix run .#colmena -- apply boot --reboot --on <control-plane host>
nix run .#colmena -- apply boot --reboot --on <node>   # one at a time
```

**This release migrates the store.** Once the control plane has started, the
previous version will refuse to run against it — migrations are forward-only, so
rolling the control-plane host back means restoring a backup, with data loss back
to the backup point. The control plane writes a backup immediately before it
applies migrations; nodes roll back freely by booting the previous generation.