# mvirt 0.29.10

migrations: no
wire: unchanged
floor: undeclared
rev: 00f06b2735a80970f1e06442fc77a39913cf03af

mvirt 0.29.10

Image pulls stop depending on a leased prefix's third-party transit, a
registry's Retry-After is honoured, and every control-plane replica can say
how it is doing — with or without a leader.

- net, host: pod egress to platform-declared destinations
  (services.mvirt.ebpf.directEgress, e.g. the registry) leaves over the
  border's own uplink instead of the leased block's external transit; chosen
  by connection mark so destination-opened flows are untouched (#344,
  ADR-0026 amendment).
- net, cplane: while a v4 leased/carried block is Dark (15 min verdict), its
  pod egress falls back to the border's uplink for TCP/ICMP/DNS; 20 min exit
  dwell + 15 min drain; kill switch services.mvirt.ebpf.darkPrefixFallback
  (#320, ADR-0026 amendment b).
- one, cplane: the manifest fetch reads the real HTTP status and Retry-After;
  a rate-limited pull waits max(ladder, Retry-After ≤ 1 h) (refs #288).
- cplane, console: per-replica self-check (descriptors, disk, apply stall,
  follower lag, own error rate); unauthenticated /v1/healthz says a status
  word and failing-check names only; the admin "Control Plane" page asks every
  replica directly (#393 slice 1, ADR-0089).
- docs: a slice-shape fix switches on with the leader, not the node
  (release runbook).


## Upgrading

Point your flake's `mvirt` input at this release and redeploy the control-plane
host first, then each node in turn:

```
nix run .#colmena -- apply boot --reboot --on <control-plane host>
nix run .#colmena -- apply boot --reboot --on <node>   # one at a time
```

This release adds no migrations, so the control-plane host rolls back the same way
a node does: boot the previous NixOS generation.