# mvirt 0.30.0

migrations: yes
wire: unchanged
floor: 0.29.0
rev: 9583dc894fcb14d51700a7ba5272f470613db79d

mvirt 0.30.0

Nodes declare the control plane they need, the platform checks every
external-route credential it is given, and the release carries its first
declared node floor.

- node, cplane: the node's control-plane floor is persisted on HostNode
  (m0148) so an offline host's floor survives; activation refuses a staged
  node generation whose floor exceeds the serving control plane; the first
  declared floor is 0.29.0 (#250, ADR-0084 D8).
- cplane: an external-route provider credential is exercised when it is
  configured (read-only Robot call for hetzner-failover; the carried /27's
  dormant webhook is not probed) and its result shown on the prefix (m0147,
  #321).
- everything in 0.29.12.

Migrating release: roll leader-last (runbook §C1a); ip_prefix writes are
refused while the fleet is mixed and an upgraded host leads.


## Upgrading

Point your flake's `mvirt` input at this release and redeploy the control-plane
host first, then each node in turn:

```
nix run .#colmena -- apply boot --reboot --on <control-plane host>
nix run .#colmena -- apply boot --reboot --on <node>   # one at a time
```

**This release migrates the store.** Once the control plane has started, the
previous version will refuse to run against it — migrations are forward-only, so
rolling the control-plane host back means restoring a backup, with data loss back
to the backup point. The control plane writes a backup immediately before it
applies migrations; nodes roll back freely by booting the previous generation.

**Nodes on this release require a control plane >= 0.29.0** (ADR-0084 D8). Upgrade
the control plane first: activating a node into this release is refused while the
control plane serving it is older.