# mvirt 0.26.0

migrations: no
wire: unchanged
rev: 15d0ec7ae1082b95c5af8885f00cda5806a26435

mvirt 0.26.0

A route-mesh subscription is no longer latched open for the life of a
session: a node that loses its last presence in a network stops being
fanned that network's routes, and only on a confirmed Deny. The replica
status file no longer claims leadership it does not hold, a voter is
never parked or stripped of its log because its view lagged its raft
log, and the last unaudited tenant/operator mutations are audited.

- cplane, route: held subscriptions are re-judged every 10 s and on each
  re-assert with a tri-state verdict (Allow/Deny/Unreadable); a revoke
  needs a successfully-read positive Deny confirmed after a read barrier
  and withdraws exactly the routes the grant replayed; Unsubscribe
  un-replays too (#312).
- mvdb: new raft RPC ReadIndex backs Node::read_barrier (leader: quorum
  confirm; follower: leader's commit index + apply catch-up). An older
  replica answers "unimplemented", which fails the barrier, so nothing
  is revoked until the leader runs 0.26 — wire addition between
  control-plane replicas.
- mvdb: probe_membership, like recover::local_role (0.25.2), reads both
  the view's and the log's membership, so a voter whose adoption or
  promotion was never applied rejoins instead of being parked as
  Removed (refs #379).
- cplane: replica-status.json reports isLeader only for quorum-confirmed
  leadership and is moved to replica-status.last.json on shutdown/boot,
  so a rebooted former leader no longer shows a stale isLeader:true
  (#382).
- cplane: org-scoped ip-prefix carve/DELETE/assignment are audited
  (refs #229).
- ebpf, protos: the retired NetService SetForwarding RPC and its
  messages are deleted (node-local proto, no cross-host caller) (#317).
- lab (ADR-0087, from another session): mvirt-ebpf reads MVIRT_DATA_DIR
  and MVIRT_EBPF_LISTEN (the module now passes ebpf.port); mvirt-node,
  mvirt-vmm gain path/size flags; defaults unchanged (#370).


## Upgrading

Point your flake's `mvirt` input at this release and redeploy the control-plane
host first, then each node in turn:

```
nix run .#colmena -- apply boot --reboot --on <control-plane host>
nix run .#colmena -- apply boot --reboot --on <node>   # one at a time
```

This release adds no migrations, so the control-plane host rolls back the same way
a node does: boot the previous NixOS generation.