Two opt-in features and a forward-only schema bump. The binary arrives behaviour-neutral: both features are default-off, so an upgrade changes nothing until the flags are set fleet-wide.
Schema
v50 → v51, forward-only. Upgrade every host in one lv host upgrade invocation — it pre-stages the schema cluster-wide before rolling any node. A binary downgrade onto a migrated database will refuse to start, by design.
NetBox as external IPAM (opt-in: netbox.enabled)
A litevirt network can be bound to a NetBox prefix (lv network create --netbox-prefix-id). VM NIC addresses are then claimed from and released to NetBox under a per-incarnation identity, instead of from the builtin allocator. An orphan sweep reclaims addresses nothing references, gated on whole-cluster proof that no host still claims them.
An inventory mirror is a second, narrower opt-in (netbox.mirror_inventory): with it off, NetBox holds addresses carrying this cluster's identity and nothing else.
Both are gated on capability latches (netbox_ipam_v1, netbox_mirror_v1) advertised only while the corresponding flag is on, so a latch requires config uniformity rather than merely a uniform build.
lv cutover as one guarded transition (opt-in: enforcement.vm_replace)
Giving a replacement VM the name a replaced VM still holds used to fail — destructively — whenever the replaced VM actually existed: its tombstone still occupies the primary key, and the rename ran after the original's disks and firmware were already gone.
It is now a single guarded transition that a receiver applies whole or not at all, carrying the replacement's incarnation and authority above both inputs. The destruction that has to follow it is driven from a journaled, immutable manifest whose authorizing step is committed in the same batch as the transition, so a crash anywhere leaves the operation resumable rather than half-applied. Addresses move with the transition and the replaced VM's own are released afterwards, ownership-checked on both the local row and the external object.
A running replacement is briefly interrupted — libvirt cannot rename a live domain — and the CLI says so before it starts.
Requires enforcement.operation_protocol alongside enforcement.vm_replace; lv cutover refuses until both have latched, before stopping a domain or writing to either VM.
Upgrading
lv host upgrade --binary <path to v1.7.0> -y
Run it with every host. Features stay off until you set the flags on every node and the latches form; see docs/configuration.md and docs/diagnostics.md.