microsandbox-rb 0.15.0 → 0.16.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 241dfe5d94b8c98d3c790994698b004a591d66229d9965799fc5886b01e5a19d
-  data.tar.gz: a134b4cbb4b58a60d72d6a7ace30ab6333da4057d0868c1a6e351396b7ff4d00
+  metadata.gz: 011c5bcfdd4eff6b2f86ec6ded70720520b5c77d93ceb575dc4ac9b0ce0a5078
+  data.tar.gz: 2e84a073bd4852e2cdbc124f4ce6b400beb5b20012c6b9ff81833169f13d58e1
 SHA512:
-  metadata.gz: c326c0481781ae1f3fc19994dfd8e4c004c4bdc8aa81b33e67386538f4fa9ff58cb84514955079c39daa09817c8eba65ac7d4ebe91ab34698ac5fce8cfa9c574
-  data.tar.gz: 1d93018f5982d2767cd66e29c50a195a3d138d7f60f93a2a3e6020384f41ce843e3a0b85d5152a2d17995a724ed9cc6169e72c0bcfc506017e7ae84b3acbe73f
+  metadata.gz: 6a12d8b308f479630dc8b266c3129bb7e337939da1963faf975fda7ebb890fe95d50ccbf77b37e9f33d3ccb0506dd94633e0374ac6c52cac599c6c80348ee931
+  data.tar.gz: 730a26aef15b87d348e95a23ede127520aee10d410856526f956d3366118959dc51f60d418e7c876781191be0c72009daafaa442a353afc6b6010643adf1a46f

data/CHANGELOG.md

@@ -6,6 +6,105 @@ All notable changes to this gem are documented here. The format is based on
 microsandbox runtime it embeds; each release notes the upstream runtime tag it
 wraps, and the README's Versioning section keeps the full gem→runtime map.
 
+## [0.16.0] - 2026-09-01
+
+Adopts upstream runtime **`v0.6.14` → `v0.6.16`**, stepping through the
+intermediate tag (`v0.6.15` verified and committed on its own).
+
+### Added
+
+- Per-mount fallback ownership: a bind or named mount in `volumes:` accepts
+  `uid:`/`gid:`, pinning the guest owner presented for host files that carry no
+  per-file stat override (upstream #1451, `v0.6.15`). They travel on the wire as
+  the core's `override_uid`/`override_gid` and mirror the Python SDK's public
+  `uid:`/`gid:` spelling. Validation matches the Python SDK: the pair must be
+  given together, each must be a plain `Integer` in `0..4294967295` (strings,
+  Floats and Booleans are rejected rather than coerced — a truncated or parsed
+  owner ID is never what the caller meant), and they conflict with both
+  `stat_virtualization: :off` (no overlay to rewrite the owner in) and
+  tmpfs/disk mounts. The one Python rule with no Ruby counterpart is
+  "unsupported for disk-backed named volumes": a Ruby `{ named: "vol" }` spec
+  only references an existing volume by name, so the volume's kind is known
+  only to the core, which rejects that combination at create time.
+- **Convergent lifecycle APIs** (upstream #1462, `v0.6.16`) — idempotent
+  operations that take a name to the state you want, whatever state it is in
+  now:
+  - `Sandbox.connect_or_create(name, **kwargs)` — connect to (and start) the
+    persisted sandbox with this name, or create it when none exists; concurrent
+    callers converge on the winning identity instead of one losing to a name
+    clash. Takes exactly `create`'s keyword options — the same normalization
+    path, not a second copy of it — and they apply only when a create actually
+    happens. The block form yields the sandbox and then stops it **only when the
+    call owns its lifecycle** — a deliberate divergence from `create`, whose
+    block form always stops: `connect_or_create` can hand back a sandbox this
+    process did not start, and tearing down someone else's long-lived service on
+    the way out of a block is never what the caller meant. So a sandbox created
+    here is stopped as usual; one merely *connected* to, or started with
+    `detached: true`, is left running. `replace:` / `replace_with_timeout:` are
+    accepted for kwargs parity but rejected by the core with
+    `InvalidConfigError`: replacing a sandbox is the opposite of converging
+    on it.
+  - `Sandbox#id` and `SandboxHandle#id` — the opaque, backend-assigned identity
+    of the *persisted* sandbox. Names are reusable labels; this changes when a
+    name is removed and recreated.
+  - `Sandbox#wait_for_status(status)` and `SandboxHandle#wait_for_status(status)`
+    — block until this exact sandbox reaches one of `:created`, `:starting`,
+    `:running`, `:draining`, `:paused`, `:stopped`, `:crashed`, returning a fresh
+    `SandboxHandle` (from both receivers, mirroring the official SDKs). There is
+    no built-in timeout and the wait is uninterruptible from Ruby (the native
+    call releases the GVL with no unblock function), so an unknown status name
+    raises `ArgumentError` up front rather than blocking forever — and only
+    states the active backend can reach are worth waiting for (`:created` and
+    `:paused` are cloud-side). Impose a deadline by running the call on its own
+    Thread.
+  - `Sandbox#restart(force:, timeout:, detached:)` and
+    `SandboxHandle#restart(...)` — stop and start this exact sandbox, returning a
+    new live `Sandbox`.
+  - `Sandbox#destroy(force:, timeout:)` and `SandboxHandle#destroy(...)` — stop
+    and remove this exact sandbox in one step.
+  - `SandboxHandle#connect_or_start(detached:)` — connect when the sandbox is
+    running, wait while it is starting, start it when it is created/stopped/
+    crashed.
+- `Microsandbox::SandboxReplacedError` (code `"sandbox-replaced"`) — raised by
+  every one of the identity-checked operations above when the name now refers to
+  a different persisted sandbox, instead of quietly acting on the replacement.
+  Mirrors the Python SDK's `SandboxReplacedError`; wired into the native
+  error-code mapping like the other `sandbox-*` codes.
+
+### Fixed
+
+- **The live `Sandbox#stop` no longer stops a same-name replacement.** The
+  binding re-fetched a `SandboxHandle` *by name* and stopped that — a pattern
+  left over from before the core's live `stop` was identity-scoped. As of
+  runtime v0.6.16 the core routes `stop` → `request_stop` →
+  `stop_identified(name, self.identity())`, so the fix is to route through the
+  live sandbox (`self.inner.stop()`) the way `kill`/`drain`/`wait`/
+  `stop_and_wait` already did, and the way both official bindings do. A sandbox
+  removed and recreated under the same name now raises `SandboxReplacedError`
+  (or `SandboxNotFoundError` when nothing holds the name) instead of terminating
+  whoever answers to it. This also hardens `Sandbox.connect_or_create`'s block
+  form, whose teardown calls `#stop`.
+- **Operations that can boot a microVM now provision the runtime first.**
+  `SandboxHandle#connect_or_start`, `SandboxHandle#restart` and
+  `Sandbox#restart` were missing the `ensure_runtime!` call `Sandbox.create` and
+  `Sandbox.start` make, so on a machine with no runtime installed they failed in
+  the native layer instead of fetching it. (`Sandbox.connect_or_create` was
+  already covered — it shares `create`'s option builder.)
+
+### Changed
+
+- Upstream runtime highlights carried without further Ruby surface:
+  - `v0.6.15` — read-only mounts no longer fail a write probe at mount time,
+    Windows DNS/NTFS handling, and the mount-ownership core work above.
+  - `v0.6.16` — log retrieval rerouted through the SDK backends (#1459; the
+    `logs`/`log_stream` bindings are unchanged and keep their behaviour — the
+    new `follow_logs`/`boot_error` core entry points are not bound, matching the
+    Python binding), sandbox config overlaid by field presence with
+    `LocalConfig` renamed to `GlobalConfig` (#1460; the gem touches neither —
+    the ext only calls `config::set_sdk_*_path` — and no Ruby config
+    round-trip or `modify` semantics changed), network-slot recycling and
+    migration, single-file mount isolation, empty `MSB_HOME` treated as unset.
+
 ## [0.15.0] - 2026-08-24
 
 Adopts upstream runtime **`v0.6.9` → `v0.6.14`**, stepping through every

data/Cargo.lock

@@ -153,7 +153,7 @@ version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
 dependencies = [
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -164,7 +164,7 @@ checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
 dependencies = [
  "anstyle",
  "once_cell_polyfill",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -889,7 +889,7 @@ dependencies = [
  "maybe-owned",
  "rustix",
  "rustix-linux-procfs",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
  "winx",
 ]
 
@@ -1759,7 +1759,7 @@ dependencies = [
  "libc",
  "option-ext",
  "redox_users",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1938,7 +1938,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2067,7 +2067,7 @@ checksum = "94e7099f6313ecacbe1256e8ff9d617b75d1bcb16a6fddef94866d225a01a14a"
 dependencies = [
  "io-lifetimes 2.0.4",
  "rustix",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -2886,7 +2886,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "20fd6de4ccfcc187e38bc21cfa543cb5a302cb86a8b114eb7f0bf0dc9f8ac00f"
 dependencies = [
  "io-lifetimes 3.0.1",
- "windows-sys 0.52.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -3392,8 +3392,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox"
-version = "0.6.14"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.14#b30fd164ad8640cbc34f6aa9645f9c265c3490b8"
+version = "0.6.16"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.16#93c14431b387d4666c7c9ca6599bb2fafdc01782"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -3454,8 +3454,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-agent-client"
-version = "0.6.14"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.14#b30fd164ad8640cbc34f6aa9645f9c265c3490b8"
+version = "0.6.16"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.16#93c14431b387d4666c7c9ca6599bb2fafdc01782"
 dependencies = [
  "ciborium",
  "microsandbox-protocol",
@@ -3467,8 +3467,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-db"
-version = "0.6.14"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.14#b30fd164ad8640cbc34f6aa9645f9c265c3490b8"
+version = "0.6.16"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.16#93c14431b387d4666c7c9ca6599bb2fafdc01782"
 dependencies = [
  "async-trait",
  "sea-orm",
@@ -3479,8 +3479,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-filesystem"
-version = "0.6.14"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.14#b30fd164ad8640cbc34f6aa9645f9c265c3490b8"
+version = "0.6.16"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.16#93c14431b387d4666c7c9ca6599bb2fafdc01782"
 dependencies = [
  "libc",
  "microsandbox-utils",
@@ -3488,12 +3488,13 @@ dependencies = [
  "scopeguard",
  "tempfile",
  "tracing",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "microsandbox-image"
-version = "0.6.14"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.14#b30fd164ad8640cbc34f6aa9645f9c265c3490b8"
+version = "0.6.16"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.16#93c14431b387d4666c7c9ca6599bb2fafdc01782"
 dependencies = [
  "astral-tokio-tar",
  "async-compression",
@@ -3519,8 +3520,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-metrics"
-version = "0.6.14"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.14#b30fd164ad8640cbc34f6aa9645f9c265c3490b8"
+version = "0.6.16"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.16#93c14431b387d4666c7c9ca6599bb2fafdc01782"
 dependencies = [
  "chrono",
  "libc",
@@ -3531,8 +3532,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-migration"
-version = "0.6.14"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.14#b30fd164ad8640cbc34f6aa9645f9c265c3490b8"
+version = "0.6.16"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.16#93c14431b387d4666c7c9ca6599bb2fafdc01782"
 dependencies = [
  "sea-orm-migration",
  "serde_json",
@@ -3540,8 +3541,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-network"
-version = "0.6.14"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.14#b30fd164ad8640cbc34f6aa9645f9c265c3490b8"
+version = "0.6.16"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.16#93c14431b387d4666c7c9ca6599bb2fafdc01782"
 dependencies = [
  "base64 0.22.1",
  "bytes",
@@ -3584,8 +3585,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-protocol"
-version = "0.6.14"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.14#b30fd164ad8640cbc34f6aa9645f9c265c3490b8"
+version = "0.6.16"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.16#93c14431b387d4666c7c9ca6599bb2fafdc01782"
 dependencies = [
  "chrono",
  "ciborium",
@@ -3599,8 +3600,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-runtime"
-version = "0.6.14"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.14#b30fd164ad8640cbc34f6aa9645f9c265c3490b8"
+version = "0.6.16"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.16#93c14431b387d4666c7c9ca6599bb2fafdc01782"
 dependencies = [
  "bytes",
  "chrono",
@@ -3634,11 +3635,12 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-types"
-version = "0.6.14"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.14#b30fd164ad8640cbc34f6aa9645f9c265c3490b8"
+version = "0.6.16"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.16#93c14431b387d4666c7c9ca6599bb2fafdc01782"
 dependencies = [
  "chrono",
  "ipnetwork",
+ "microsandbox-types-macros",
  "serde",
  "serde_json",
  "sha2 0.11.0",
@@ -3647,10 +3649,20 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "microsandbox-types-macros"
+version = "0.6.16"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.16#93c14431b387d4666c7c9ca6599bb2fafdc01782"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.4",
+]
+
 [[package]]
 name = "microsandbox-utils"
-version = "0.6.14"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.14#b30fd164ad8640cbc34f6aa9645f9c265c3490b8"
+version = "0.6.16"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.16#93c14431b387d4666c7c9ca6599bb2fafdc01782"
 dependencies = [
  "dirs",
  "libc",
@@ -3662,8 +3674,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-vsock"
-version = "0.6.14"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.14#b30fd164ad8640cbc34f6aa9645f9c265c3490b8"
+version = "0.6.16"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.16#93c14431b387d4666c7c9ca6599bb2fafdc01782"
 dependencies = [
  "libc",
  "msb_krun",
@@ -3675,7 +3687,7 @@ dependencies = [
 
 [[package]]
 name = "microsandbox_rb"
-version = "0.15.0"
+version = "0.16.0"
 dependencies = [
  "chrono",
  "futures",
@@ -4717,7 +4729,7 @@ dependencies = [
  "once_cell",
  "socket2",
  "tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -5255,7 +5267,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -5324,7 +5336,7 @@ dependencies = [
  "security-framework 3.7.0",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -5949,7 +5961,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "52d1cfed4120b4d927bf7c0f86d2087a4a7d6027c906d9f9d525a80573b9be51"
 dependencies = [
  "libc",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -6398,7 +6410,7 @@ dependencies = [
  "getrandom 0.4.2",
  "once_cell",
  "rustix",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -6758,7 +6770,7 @@ checksum = "f2f6fb2847f6742cd76af783a2a2c49e9375d0a111c7bef6f71cd9e738c72d6e"
 dependencies = [
  "memoffset",
  "tempfile",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -7163,7 +7175,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -7474,7 +7486,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3f3fd376f71958b862e7afb20cfe5a22830e1963462f3a17f49d82a6c1d1f42d"
 dependencies = [
  "bitflags 2.13.0",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]

data/DESIGN.md

@@ -184,7 +184,7 @@ extension.
 
 `ext/microsandbox/Cargo.toml` depends on the core crate via a **pinned git tag**
 (`microsandbox` / `microsandbox-network`, pinned to the same tag as
-`Microsandbox::RUNTIME_VERSION` — currently `v0.6.14`), so the gem builds anywhere
+`Microsandbox::RUNTIME_VERSION` — currently `v0.6.16`), so the gem builds anywhere
 — CI, `rake-compiler-dock` release containers, and end-user source installs —
 without an adjacent checkout. For fast local development against a sibling
 microsandbox checkout, copy `.cargo/config.toml.example` to `.cargo/config.toml`

data/README.md

@@ -186,6 +186,39 @@ Microsandbox::Sandbox.start("box")    # restart a stopped sandbox
 Microsandbox::Sandbox.remove("box")   # remove a stopped sandbox
 ```
 
+**Convergent lifecycle** (runtime `v0.6.16`) — idempotent operations that take a
+name to the state you want, whatever state it is in now:
+
+```ruby
+# Create it, or connect to (and start) the one that is already there. The
+# keyword options are `create`'s and apply only when a create actually happens.
+sb = Microsandbox::Sandbox.connect_or_create("box", image: "public.ecr.aws/docker/library/alpine:latest")
+
+sb.id                     # opaque identity of the *persisted* sandbox — unlike
+                          # the reusable name, it changes on remove+recreate
+sb.wait_for_status(:running)  # => SandboxHandle (no built-in timeout)
+sb = sb.restart               # stop + start; => a new live Sandbox
+sb.destroy                    # stop + remove, in one step
+
+h = Microsandbox::Sandbox.get("box")
+h.connect_or_start        # connect if running, start if not => Sandbox
+h.restart(force: true, timeout: 5)
+h.destroy
+```
+
+Everything that acts on an *existing* receiver — `wait_for_status`, `restart`,
+`destroy`, `connect_or_start` — compares the identity it was bound to against
+the name's current owner first, raising `Microsandbox::SandboxReplacedError`
+rather than touching a sandbox someone else recreated under the same name.
+(`connect_or_create` is the entry point, so it has no prior identity to check:
+it simply converges on whichever sandbox now owns the name.)
+
+`connect_or_create`'s block form stops the sandbox only when the call owns its
+lifecycle — i.e. when it created it attached. A sandbox it merely connected to,
+or started with `detached: true`, is left running. And the stop it does issue is
+scoped to that sandbox's `id`, so a name removed and recreated while the block
+ran cannot be taken down by the teardown either.
+
 > **v0.5.8 lifecycle change.** Upstream split the lifecycle into the live
 > `Sandbox` and a controllable `SandboxHandle`, and the gem mirrors it. The live
 > `Sandbox#stop`/`#kill` no longer take a `timeout:`; `#request_stop`/
@@ -430,7 +463,9 @@ Microsandbox::Volume.remove("cache")
 ```
 
 `volumes:` accepts a host path String (bind mount) or `{ bind: "/host" }` /
-`{ named: "volume-name" }` per guest path. Boot from a snapshot with
+`{ named: "volume-name" }` per guest path. A bind or named mount may pin the
+fallback guest owner for host files with `uid:`/`gid:` (both required together,
+runtime `v0.6.15`). Boot from a snapshot with
 `Sandbox.create(name, from_snapshot: "snap-name-or-path")`.
 
 ### Error handling
@@ -524,8 +559,8 @@ change diverged the two numbers — the gem version is **not** a reliable indica
 of the embedded runtime version. To learn which runtime a build wraps, ask it:
 
 ```ruby
-Microsandbox::VERSION          # => "0.15.0"  (the gem's own version)
-Microsandbox.runtime_version   # => "v0.6.14" (the embedded upstream runtime tag)
+Microsandbox::VERSION          # => "0.16.0"  (the gem's own version)
+Microsandbox.runtime_version   # => "v0.6.16" (the embedded upstream runtime tag)
 ```
 
 The companion [`microsandbox-rb-binaries`](#the-runtime-binaries) gem is
@@ -558,6 +593,7 @@ stale.
 | `0.13.0` | `v0.6.9` | adopts upstream `v0.6.9` (**breaking**): a bare `MSB_API_KEY` no longer selects the cloud backend (explicit `MSB_BACKEND=cloud` or a cloud profile required; invalid cloud config fails closed with `InvalidConfigError`); snapshot payload integrity becomes opt-in (`record_integrity:`, `verify` can report `:not_recorded`). Parity: default-workload execution (`exec_default`/`exec_default_stream`/`attach_default`, `cmd:`), flat root disks (`RootDisk.flat`), `modify(root_disk_size:)`, `rate_limiter:`, `vsock:`, `default_backend_info`, `Volume.get_default` |
 | `0.14.0` | `v0.6.9` | two-gem split: SDK-only gem (no build-time runtime download) + companion `microsandbox-rb-binaries` platform gems |
 | `0.15.0` | `v0.6.14` | adopts upstream `v0.6.10`–`v0.6.14` step by step: bind-mount correctness, guest bootstrap off the kernel command line, DNS pins for deferred domain allows, Linux glibc 2.28 baseline for the prebuilt runtime, legacy ext4 upper-disk resize, `msb_krun` 0.1.32. Parity: `ssh.open_client`/`prepare_server` accept `inactivity_timeout:` (seconds; `0` disables, `nil` inherits the 600s global default) |
+| `0.16.0` | `v0.6.16` | adopts upstream `v0.6.15`+`v0.6.16` step by step: mount fallback ownership, readonly-mount write-probe fix, log retrieval rerouted through the SDK backends, config overlaid by field presence, network-slot recycling. Parity: per-mount `uid:`/`gid:`, and the convergent lifecycle — `Sandbox.connect_or_create`, `#id`, `#wait_for_status`, `#restart`, `#destroy`, `SandboxHandle#connect_or_start`, `SandboxReplacedError` |
 
 **Going forward** — the gem version moves on its own semver track and no longer
 mirrors the upstream tag:

data/ext/microsandbox/Cargo.toml

@@ -6,8 +6,8 @@ name = "microsandbox_rb"
 description = "Ruby SDK native extension for microsandbox — secure, fast microVM-based sandboxing."
 # Must equal Microsandbox::VERSION (lib/microsandbox/version.rb) — Native.version
 # returns this via env!("CARGO_PKG_VERSION") and version_spec.rb asserts equality.
-# The core-crate dependency below stays pinned at its own tag (v0.6.14).
-version = "0.15.0"
+# The core-crate dependency below stays pinned at its own tag (v0.6.16).
+version = "0.16.0"
 authors = ["Super Rad Company <development@superrad.company>"]
 repository = "https://github.com/superradcompany/microsandbox"
 license = "Apache-2.0"
@@ -42,8 +42,8 @@ rb-sys = "0.9"
 # first-use download into ~/.microsandbox (`setup::install`, which is not
 # gated on "prebuilt"). "net"/"ssh"/"keyring" are the features the official
 # SDKs ship with.
-microsandbox = { git = "https://github.com/superradcompany/microsandbox", tag = "v0.6.14", default-features = false, features = ["keyring", "net", "ssh"] }
-microsandbox-network = { git = "https://github.com/superradcompany/microsandbox", tag = "v0.6.14" }
+microsandbox = { git = "https://github.com/superradcompany/microsandbox", tag = "v0.6.16", default-features = false, features = ["keyring", "net", "ssh"] }
+microsandbox-network = { git = "https://github.com/superradcompany/microsandbox", tag = "v0.6.16" }
 # The *guest* agent (`agentd`, PID 1 inside every microVM) is embedded into the
 # extension by microsandbox-filesystem's build.rs, which without its "prebuilt"
 # feature demands a locally built `build/agentd` (workspace-only, `just
@@ -52,7 +52,7 @@ microsandbox-network = { git = "https://github.com/superradcompany/microsandbox"
 # prebuilt agentd for the target arch is fetched (same behaviour as before)
 # while the SDK-level msb download above stays off. Feature unification means
 # this adds no new crates; keep it on the same tag as the deps above.
-microsandbox-runtime = { git = "https://github.com/superradcompany/microsandbox", tag = "v0.6.14", default-features = false, features = ["prebuilt"] }
+microsandbox-runtime = { git = "https://github.com/superradcompany/microsandbox", tag = "v0.6.16", default-features = false, features = ["prebuilt"] }
 
 # Async core bridged to Ruby's synchronous API via a blocking tokio runtime.
 tokio = { version = "1", features = ["rt-multi-thread", "sync", "time"] }

data/ext/microsandbox/src/error.rs

@@ -17,6 +17,11 @@ fn class_name(err: &MicrosandboxError) -> &'static str {
         SandboxNotFound(_) => "SandboxNotFoundError",
         SandboxAlreadyExists(_) => "SandboxAlreadyExistsError",
         SandboxStillRunning(_) => "SandboxStillRunningError",
+        // v0.6.16 (#1462): the receiver's captured identity no longer owns the
+        // name — it was removed and recreated. Raised by the identity-checked
+        // convergent lifecycle APIs instead of acting on the replacement.
+        // Mirrors the Python `SandboxReplacedError`.
+        SandboxReplaced { .. } => "SandboxReplacedError",
         // v0.6.6 (#1099): the sandbox exists but isn't running. Raised by the
         // handle's exec/attach/ping/touch not-running guards and the fs
         // agent-endpoint lookup. The `SandboxNotRunningError` class already