# mvirt 0.29.0

migrations: yes
wire: unchanged
rev: 1214c99707f4781308af62c51e313cff3484764d

mvirt 0.29.0

Guest MTU follows the underlay, DNS-01 records are tracked and cleaned up,
pods get a visible ephemeral-storage limit, and a silent pod-VM guest no
longer stalls or strands anything.

- cplane: ACME DNS-01 challenge records are kept in a ledger and removed
  by what was actually written (migration 0144, #63).
- cplane, node, ebpf: guest MTU derives from the host's underlay MTU and
  region instead of a fixed value (migration 0145, #57).
- cplane, node, vmm: pods carry spec.ephemeralStorageMib (default 8192 =
  today's fixed scratch size, 1-256 GiB, immutable); the scratch disk is
  sized from it and the scheduler reserves it against the node's data disk
  (InsufficientEphemeralStorage); GET /v1/nodes shows status.ephemeralStorage
  (migration 0146, refs #201).
- node: a pod-VM whose guest stays unresponsive (3 failed checks over
  >=120 s, never during boot) is reported failed and restarted per
  restartPolicy; log shipping gives each pod a 5 s budget and the vmm
  bounds guest log reads (closes #388).
- cplane: OnFailure retries a container that failed to start, at most 6
  restarts, then Failed with "restart limit reached" (closes #330).
- node: a pre-stop log drain with no Report stream spools to disk and
  replays on reconnect (closes #275).
- cplane: creates apply or refuse every field their PATCH accepts (buckets,
  orgs, projects, reserved IPs); those four creates reject unknown fields
  (closes #386).
- cplane, ebpf, console: LB pool members and internal front-ends must be
  in the LB's own network (400 on the API; ebpf skips others with a WARN)
  (closes #318). A member whose vNIC row cannot be read (a slice racing
  the vNIC create, a store error) keeps its membership with its own
  warning instead of being refused as foreign.
- meta: an OIDC sign-in whose email already has an account re-links it
  only on a verified claim from the same issuer to a verified,
  password-less, non-admin account; everything else is an explicit
  account_exists refusal instead of a bare 409 page (closes #289).
- ebpf: the MTU probe builds on musl (retag: the first v0.29.0 run failed
  to compile before publishing anything).
- cplane: per-replica /v1/healthz and the leader's platform conditions
  (refs #393).
- ci: nix-checks trust a checkout owned by another user.

Roll order: cplane before the new VK image. Node and vmm ship together.


## Upgrading

Point your flake's `mvirt` input at this release and redeploy the control-plane
host first, then each node in turn:

```
nix run .#colmena -- apply boot --reboot --on <control-plane host>
nix run .#colmena -- apply boot --reboot --on <node>   # one at a time
```

**This release migrates the store.** Once the control plane has started, the
previous version will refuse to run against it — migrations are forward-only, so
rolling the control-plane host back means restoring a backup, with data loss back
to the backup point. The control plane writes a backup immediately before it
applies migrations; nodes roll back freely by booting the previous generation.