RC6 development candidate: owner-scoped Tier-1 delivery

Piglet 1.0.0-rc.6 was a local development candidate that validated the Quick and four-node full profiles on both Tier-1 native hypervisor platforms (macOS arm64 / HVF and Linux amd64 / KVM) and introduced journaled host-network transactions for crash recovery.

Frozen build identity

Four native product scenarios

All eight full-profile guests booted Ubuntu 24.04.4, passed contract assertions, and were cleanly destroyed afterward while retaining shared image caches, project markers, and keys.

Journaled host-network transactions

Network install and uninstall use a root-owned, strict-prefix transaction:

• Root planning produces a token bound to the invoking owner, host identity, and observed prestate.
• Apply re-evaluates the plan under the host-global lock and accepts only that token.
• A typed, fsync-committed journal is written before any host mutation begins.
• Each step records a checkpoint only after verifying its postcondition.
• If a transaction is interrupted, ordinary network changes are blocked until an explicit forward or rollback recovery plan is approved.

macOS completed an interrupted forward-recovery test and converged to a healthy default host network. Linux completed install, rollback/retry, four-node operation, uninstall, and host restoration prior to a final patch that tightened socket-state canonicalization, systemd unit enablement scope, NetworkManager ordering, and recovery field scoping (verified via source checks and -race tests).

macOS shared mode and subnet conflicts

The default macOS mode is socket_vmnet host mode; shared mode also passed a two-node test on an alternate free subnet as an explicit opt-in fallback.

During testing, the default subnet encountered VMNET_SHARING_SERVICE_BUSY (1009) when an older Piglet-created bridge100 interface was still present. Preflight checks interface ownership markers rather than adopting an existing interface just because its .1/24 address matches. When a subnet conflict occurs, operators can either remove the conflicting interface or move the entire lab to a clean RFC 1918 /24 subnet—the runtime never renumbers individual guests or picks a random subnet on its own.

Reproducible local archives

Two independent local RC6 build trees produced byte-identical archives, checksums, release metadata, and Homebrew formula files:

Remaining work before public release

At the close of RC6, the remaining items before public release were:

• Physical host-reboot persistence checks on both Tier-1 platforms
• Native smoke tests on macOS amd64 and Linux arm64
• Re-running the Linux network install/uninstall/reinstall cycle with the final post-audit patch
• Guest image normalization, hosting, and active/standby manifest signing keys
• Public release tags, Homebrew tap and DEB/RPM package publication, and clean-host installer verification

See the tutorial, architecture guide, and status page for how these items were completed in subsequent Barn releases.