v3.2.6

What's Changed

• fix(windows): WHPX fail-closed negatives, wait exit honesty, quieter happy-path WARNs by @ZhiXiao-Lin in #258
• fix(windows): WHPX bridge/pool/update fail-closed (#259-#263) by @ZhiXiao-Lin in #264
• feat(oci): add Linux KVM MicroVM qualification opt-in by @ZhiXiao-Lin in #269
• fix(oci): publish portable MicroVM bundles as mode 0700 by @ZhiXiao-Lin in #270
• fix(oci): tighten portable handoff ancestor modes to 0700 by @ZhiXiao-Lin in #271
• fix(oci): skip portable rootfs metadata on same-uid virtiofs by @ZhiXiao-Lin in #272
• chore(oci): pin OCI Runtime to 01786ab by @ZhiXiao-Lin in #273
• test(oci): lock portable rootfs metadata annotation gate by @ZhiXiao-Lin in #274
• feat(oci): add Linux KVM MicroVM vertical-slice qualification by @ZhiXiao-Lin in #275
• fix(oci): treat undrained log projection death as owner loss by @ZhiXiao-Lin in #276
• feat(oci): Linux KVM vertical slice Host Service restart (v2) by @ZhiXiao-Lin in #277
• Migrate Sandbox OCI owners into delegated cgroup children by @ZhiXiao-Lin in #268
• chore(oci): pin 3cea73d and re-qualify Linux KVM MicroVM slice by @ZhiXiao-Lin in #278
• chore(oci): pin OCI Runtime 95d624f and re-qualify KVM MicroVM slice by @ZhiXiao-Lin in #279
• chore(oci): bump pin to 60b1888 and requalify Linux KVM MicroVM by @ZhiXiao-Lin in #280
• chore(oci): bump pin to f14c940 and requalify Linux KVM MicroVM by @ZhiXiao-Lin in #281
• chore(oci): bump pin to 49d409 and requalify Linux KVM MicroVM by @ZhiXiao-Lin in #282
• chore(oci): bump pin to 7d27d1 and requalify Linux KVM MicroVM by @ZhiXiao-Lin in #283
• chore(oci): bump pin to 26ab488 and requalify Linux KVM MicroVM by @ZhiXiao-Lin in #284
• chore(oci): bump pin to f5118ff and requalify Linux KVM MicroVM by @ZhiXiao-Lin in #285
• chore(oci): bump pin to f9d6eeb and requalify Linux KVM MicroVM by @ZhiXiao-Lin in #286
• Align CI/release OCI pins with Cargo f9d6eeb by @ZhiXiao-Lin in #287
• chore(oci): bump pin to fdaf2e7 and requalify Linux KVM MicroVM by @ZhiXiao-Lin in #288
• chore(oci): bump pin to 019b2d2 and requalify Linux KVM MicroVM by @ZhiXiao-Lin in #289
• chore(oci): bump pin to 35c3370 and requalify Linux KVM MicroVM by @ZhiXiao-Lin in #290
• fix(ci): align OCI workflow pins with Cargo 35c3370 by @ZhiXiao-Lin in #291
• fix(oci): accept native-linux-recovery.v6 for pin 35c3370 by @ZhiXiao-Lin in #292
• fix(oci): restore pin 402949c2 after hosted rootless smoke timeout by @ZhiXiao-Lin in #293
• fix(runtime): lifecycle evidence honesty + native live-session v2 (anti-overfit) by @ZhiXiao-Lin in #294
• chore: pin OCI Runtime to 07e653f with live-session v2 evidence by @ZhiXiao-Lin in #296
• feat: Native Linux live-session v3 retained-stream + OCI 7001ce5 pin by @ZhiXiao-Lin in #295
• feat(box): KVM MicroVM live-session retained stream (v1) by @ZhiXiao-Lin in #298
• feat(box): Native Live filesystem continuity (v4) by @emigmo in #299
• feat(box): prove KVM MicroVM Live filesystem continuity (v2) by @ZhiXiao-Lin in #301
• docs(box): close B2 process-session recovery parent by @ZhiXiao-Lin in #302
• chore(box): bump OCI Runtime pin to 05a3b2b by @ZhiXiao-Lin in #303
• fix(ci): live-session cleanup + keyed-exec retries on v4 by @ZhiXiao-Lin in #300
• docs(box): record #300 both-arch Native Live v4 greening digests by @ZhiXiao-Lin in #304
• fix(live-session): same-request_id keyed-exec retry on KVM by @ZhiXiao-Lin in #305
• feat(sdk): optional stable command request_id for keyed-exec retries by @ZhiXiao-Lin in #306
• feat(sdk): surface command request_id on success and Unavailable by @ZhiXiao-Lin in #307
• fix(runtime): durable op identity for mutating file/FS ops by @ZhiXiao-Lin in #308
• fix(runtime): inner Unavailable retry for one-shot OCI exec by @ZhiXiao-Lin in #309
• test(sdk): Unavailable request_id round-trips in Go/Python/TS by @ZhiXiao-Lin in #310
• fix(runtime): inner Unavailable retry for OCI process stdin by @ZhiXiao-Lin in #311
• fix(runtime): inner Unavailable retry for OCI resource update by @ZhiXiao-Lin in #312
• feat(cli): optional --request-id for one-shot exec retries by @ZhiXiao-Lin in #313
• fix(runtime): inner Unavailable retry for OCI close_stdin and signal by @ZhiXiao-Lin in #314
• fix(runtime): inner Unavailable retry for OCI kill and delete by @ZhiXiao-Lin in #315
• feat(cli): mint cli-cp-* request_id for mutating cp exec paths by @ZhiXiao-Lin in #316
• feat(cli): mint cli-update-* request_id for container-update retries by @ZhiXiao-Lin in #317
• feat(pool): mint cli-pool-* request_id for lease exec retries by @ZhiXiao-Lin in #318
• feat(cri): mint cri-exec-* request_id for ExecSync guest replay by @ZhiXiao-Lin in #319
• fix(runtime): keyed MicroVM exec in-call replay on lost responses by @ZhiXiao-Lin in #320
• fix(runtime): MicroVM session execute keyed replay after stream loss by @ZhiXiao-Lin in #321
• fix(runtime): ExecClient keyed one-shot replay on ambiguous transport by @ZhiXiao-Lin in #322
• fix(runtime): retry signal_main once on ambiguous ACK loss by @ZhiXiao-Lin in #323
• fix(runtime): retry maintenance shutdown on ambiguous ACK loss by @ZhiXiao-Lin in #324
• fix(runtime): spawn_main ambiguous ACK retry with guest idempotency by @ZhiXiao-Lin in #325
• fix(runtime): retry read-only filesystem ops on ambiguous transport by @ZhiXiao-Lin in #326
• feat: default Linux Sandbox to SandboxViaOci by @ZhiXiao-Lin in #328
• docs+scripts: productize Sandbox host prep and freeze GA matrix by @ZhiXiao-Lin in #330
• docs: remove stale Sandbox opt-in wording after GA default by @ZhiXiao-Lin in #331
• release: prepare a3s-box 3.2.6 Sandbox GA by @ZhiXiao-Lin in #332

Full Changelog: v3.2.5...v3.2.6