[kvinwang]

Problem

Some apps need every boot to start from a clean data disk, so that no state from an earlier boot (or a copy the host rolled back) is visible to app code. Right now the guest always reuses whatever filesystem it finds on the data disk.

Fix

Add an opt-in requirements.ephemeral_data_disk field (default false) to app-compose.json.

• guest: when this is set, mount_data_disk skips detection and always initializes the disk: it runs a fresh luksFormat (new random volume key, which makes the old ciphertext unreadable), clears stale ZFS labels, and creates the filesystem. This all happens before any app code runs.
• sdk: Go, JS and Python add the typed field. As with health_check, false is omitted from the output, so compose hashes for existing apps do not change.

The field sits under requirements, so it needs manifest_version: "3". Older guests reject it, so they fail closed instead of ignoring it.

The VMM is deliberately left out. Replacing hda.img on the host would rule out a later option that keeps named volumes across boots.