Skip to content

Release 2.1.61 (2026-06-23)

Bug fixes

  • update a running box in place over IAP instead of rebuilding (#1815) Corrects the stateless premise #1803 baked in: vrg-vm update of a running off-platform box rebuilt it (an ~8-min recreate that destroys the live session), and update --all skipped off-platform boxes and only reported them.

The tooling update is already transport-generic, so a running box updates in place over its IAP transport exactly as Lima does over limactl — seconds, non-disruptive, no capacity/quota risk. Rebuild stays reserved for what genuinely needs a fresh image.

  • update_plugins is now transport-generic (moved lima.py -> vm_guest.py, taking a Transport) so the plugin refresh runs over IAP.
  • update <off-platform> updates in place via the box's IAP transport; a non-running box is refused with an identity-qualified start hint, no longer redirected to rebuild.
  • update --all updates running off-platform boxes in place and skips/reports non-running ones, folded into the unified updated/skipped/failed accounting (fail-deferred).
  • Off-platform labels, the update ref, and the list rows now carry identity, so two boxes that share an org/repo (one per identity) stay distinct instead of collapsing into identical, identity-less lines.

Documentation

  • park shared-workspace NFS design (#1796) (#1814)
  • docs(off-platform): add shared-workspace-over-NFS design for vergil-user/vergil-audit

Design for the two identities sharing one writable tree and shared project memory off-platform via a fleet-wide self-managed NFS server (small GCE VM + zonal pd-balanced SSD + snapshots), replacing the per-identity persistent volume. Records the cost analysis that rejected managed Filestore (~2-5x cheaper at the ~1 TiB scale the working trees need) and the behavioral trust boundary the dual-agent IPC channel requires.

Features

  • auto-fall back across a region's zones on a capacity stockout (#1816) On a fresh off-platform create, sweep the region's zones until the instance lands instead of failing on the first stocked zone. Hit live: n2-standard-8/16 unavailable across us-central1-a/b/c on the same night.

  • region_zones(): enumerate a region's UP zones via gcloud.

  • is_zone_capacity_error(): match the GCP stockout signature (ZONE_RESOURCE_POOL_ EXHAUSTED / 'does not have enough resources') so a capacity failure is retried while a real error still aborts.
  • apply_vm_with_zone_fallback(): try the VM in the chosen zone; on a capacity stockout, destroy the empty volume and recreate volume+VM in each fallback zone until one succeeds, else raise a clear 'no zone in has capacity'.
  • _candidate_zones(): an explicit profile 'zone' is tried first; otherwise the region's zones are shuffled to spread load.

Fresh-volume only: a reattach (existing volume) is pinned to its zone — a zonal disk can't move without losing data — so it passes no fallback zones and a stockout there fails clearly. The per-attempt rollback also keeps a failed create cleanly retryable (no orphan firewall, cf #1804).

Region-wide crunches (every zone stocked) still surface honestly; the message points at a different instance family / region / waiting.