feat: enhance guest network configuration and recovery process for UVM

README.md

@@ -423,6 +423,19 @@ template retains apt's package metadata and enables `main` and `universe`,
 including updates/security repositories. Guest DNS defaults to `1.1.1.1` and
 `8.8.8.8` in `/etc/resolv.conf`.
 
+UVM specializes the Ubuntu guest's `/etc/systemd/network/10-uvm.network` with
+its assigned `Address=` and `Gateway=` before boot. `KeepConfiguration=yes`
+also retains the kernel-created default route while systemd-networkd starts.
+Older templates used `KeepConfiguration=static`, which could retain the guest
+IP but remove the default route, producing `ping: connect: Network is unreachable`.
+
+The updated CLI repairs an older VM's original, unedited UVM profile on its
+next stopped-disk boot, including `restart`. The repair is prepared and checked
+on a sparse copy before publication; guest-edited profiles and custom images
+are preserved. New VMs also receive the fix when using a cached older Ubuntu
+template. See [guest route recovery](USAGE.md#guest-reports-network-is-unreachable)
+for immediate recovery inside a running guest.
+
 Existing accounts retain their UID, groups, home directory, and shell. A new
 user reuses a same-named group if present; otherwise UVM creates one with an
 unused GID. `/etc/gshadow` is updated when present. The default `root` account
@@ -469,6 +482,8 @@ sudo ./uvm.py start web
 
 On a running VM, `start` refreshes its private policy and shared host networking
 without rebooting it. New VM boots set up the same networking automatically.
+For an older guest missing its default route, use `restart` once to apply the
+offline guest-profile repair, or follow the guest route recovery steps above.
 
 Private VM creation and start require an RFC 1918 subnet (`10.0.0.0/8`,
 `172.16.0.0/12`, or `192.168.0.0/16`). Retained VMs prevent incompatible
@@ -516,7 +531,7 @@ is mode `0600`. Treat it as a secret, do not include it in bug reports, and
 replace the default `root` password immediately.
 
 Credential provisioning applies only to VMs created by this version. Existing
-VM disks are not modified automatically.
+guest accounts, passwords, and SSH host keys are retained on subsequent boots.
 
 Older registries are read and migrated on the next write. A missing/null
 `ports` policy remains `None`/`unmanaged`, not an empty allowlist or an