[Enrique Saurez (esaurez)]

Part of #1076. Implements SL2.4a2 from #1098, retaining merged #1278, #1270 and #1310 and the snapshot metadata from merged #1345.

Stack and scope

This Draft targets feature/nvx-refactor directly, on pinned landed baseline 489ce50efc93fe253d145557482c6c93e384391b (tree fe2bfe7da5fe24007c4e6333fb47ae98b961c66c), which includes merged #1345 and the earlier activation, capture configuration and caller-driven restore context. Only the original two renderer/documentation logical commits are replayed. No input-union history or already-merged producer changes are included in the owned range. The original source and input ref remain preserved.

Own head: 43716c030c4f4084e9cc06950442a6563eef0f7f, tree 6ca0229e3f009b342529f632e59ad497e8400bb2. Its two linear commits are 23472f0273f65cdb088495cf45d55b052cdc8c07 and 43716c030c4f4084e9cc06950442a6563eef0f7f. Entire own delta: 141 CORE lines, three counted production files, eight total paths, no special budget exclusions or lint-hook changes.

• Strict paired hostname/machine-ID view codec. Hostname bytes use canonical lowercase hexadecimal; malformed and duplicate inputs are rejected.
• Pure checked cold-boot VmConfig::kernel_command_line rendering for root/settings, view and export mappings, preserving the caller suffix and existing crate Error/Result/ErrorKind contract.
• Focused malformed-input, round-trip and rendering coverage, generated API/documentation updates.

No activation/restore wiring, new caller collision/quoting policy, OpenVMM argv rewrite, root assembly, or SL7.5b runtime implementation.

Validation of the current landed input

The four renderer/view production and test files are byte-identical to the preserved 7d4b7e86 and 4148aa06 sources. All other owned code/test hunks and assertions remain unchanged. The renderer range-diff equals the previous logical commit; the documentation entry differs only in context, preserving the merged snapshot row and all snapshot, capture and restore sections. The complete effective tree is different, so earlier whole-tree qualification is not relabeled as current execution.

• Fresh complete affected commands: 14 on Windows and 16 on Linux, covering all-features/host/CLI Clippy, complete all-features and default Rust tests, bundling, rustdoc, MSRV and runtime-adapter host checks; Linux also checked both API snapshots and the macOS build.
• Audited current all-features totals: Windows 1409 passed/19 ignored; Linux 2212 passed/48 ignored. Whole canonical Python units ran 1818 tests on each OS, with 70 Windows and 39 Linux source-guarded platform skips. Nested Rust child summaries are not counted twice.
• Current crate/adapter formatting, full test layout, own-base test-change inventory and Markdown links passed on both OSes. The inventory reports zero changes to existing tests and 13 added entries; every original helper, fixture and assertion is retained.
• Exact unchanged-input evidence is reused with its original 4148aa06 execution identity, not claimed as rerun: protocol-only/testing-only checks, runtime-adapter protocol/guest configurations, native vector/profile comparisons, and unchanged Python, shell, typing, kernel and PowerShell checks. The repository's complete 149-file guest input digest remains 3ee18662bef8702bdbcf7ef1e527a4305e5e461089a86f347e7583af99aa87c3; all ten retained guest executables were rehashed against their build manifest. No guest rebuild or runtime pass is inferred from that reuse.
• The first current Linux all-features attempt failed when an unchanged CLI fixture executed a newly copied executable (ETXTBSY). The complete command subsequently passed with normal parallelism and without a source, assertion, timeout or thread-count change. The failure and focused diagnosis remain preserved alongside the complete recovery.
• Current native source is 14dc4116ec7e57567633c4b7b07892aca3a58522. Independent exact-head read-only Opus 5.5/max/long review is clear. It is static review, not runtime or CI evidence.
• No new VMM, kernel, guest-image producer or VM/distro matrix was run: this pure renderer remains unwired. Historical native results below retain their original source/runtime labels. No CI result is claimed.

Preserved earlier input and qualification

The following section records the earlier source 7d4b7e86 on input base 58deb193; it is preserved history, not new execution at 43716c03 on 489ce50e.

The original two logical commits are replayed on the fixed landed inputs. Both range-diff entries truthfully show context differences, not equality: all landed tests/helpers/assertions and capture/restore documentation are preserved; three existing test Boot literals explicitly use capture: None to retain their no-capture behavior. The owned production semantics are unchanged. Current owned patch SHA256: b80370d0e5b5e6d7b3261f52bc2ecc4de6c8aef4d096000b0946e41aa39d0152.

• Fresh exact-head Windows and Linux software checks passed: all 24/34 required Rust/API/adapter/guest-tool commands, plus one canonical CLI build and one complete canonical Python unit action on each OS. The all-features/default Rust harnesses ran in normal parallel mode; no inherited thread-count exception was used.
• Audited all-features Rust totals: Windows 1394 passed/19 ignored; Linux 2197 passed/48 ignored. Protocol-only library: 278 passed/0 ignored on each OS. Nested child summaries are not counted twice.
• Whole canonical Python units: 1818 tests per OS, with 70 Windows and 39 Linux source-guarded skips. Full adversarial: 84 per OS, with 11 Windows skips and no Linux skips. The entire eight-test shell-root class passed with zero skips on each OS.
• Current format/layout/own-base test-change/link/host/bytecode/help checks passed. Full pinned ShellCheck/shfmt inventory, Ruff lint/format, both Pyright platforms, kernel inventory, 25 Specula tests, and native PowerShell syntax with normal ICU passed. The API snapshots and MSRV checks are current-source results.
• Fresh canonical CLI provenance binds both executables to source digest 9663a1bc8394ed8451d0bc20966fee652952e8b44467ac1cd7e54cc76a9ade0c: Windows static-CRT SHA256 ff4e048d13e911ad37fc9a5807fd026fc56407bfd1754ff364496778f309c9bd; Linux static-musl SHA256 a49e068ecf4beff06e46de8cb213d71bbb6e7d35888ee43925cd0dd0ef4327d1. Real executable help and target/provenance checks passed.
• Current initialized native source is 14dc4116ec7e57567633c4b7b07892aca3a58522. Independent exact-head read-only Opus 5.5/max/long review is clear. It is static review, not runtime or CI evidence.
• The actual offline dependency-cache failure and native PowerShell/ICU restoration failures are preserved alongside their successful, scoped recoveries. Earlier source/qualification/publication/native/skip/failure histories retain their original execution identities, not new-head labels.
• The current owned input base merges to this exact source tree. No new VMM/kernel/guest-image producer or full VM/distro matrix was run: the pure renderer remains unwired, and earlier native results below are historical only, not current landed-input runtime or integration qualification.

Historical original-head local evidence

The following evidence belongs to original head 83e60bc5, not to fresh execution at 7d4b7e86.

• Windows: 25 applicable Rust commands; Linux: 35, with per-target runner audits.
• Whole canonical Python units: 1811 tests on each host, 67 Windows and 30 Linux source-guarded platform skips. Actual applicable CLI/capture/portable PowerShell cases ran. Both compiler-capable whole commands used the normal compiler admission wrapper.
• Historical canonical CLI provenance: Windows static CRT 4f40ff13b51dd9b042cf8d07cc13fbd625efa39525e922c2efe16b5f62498980; Linux static musl 65eaec8ebae1fb9a1768f25d2f9a105f591773315696338ca1ae15affc68ed03. Both bind source digest 6f2478160f698802e09abc23fa4ec4dfb9b252a7cd1a9cf7eece804ce974d679.
• Applicable full adversarial/host/help/layout/API/quality checks, including native Linux PowerShell with normal ICU, Pyright, shellcheck, shfmt and 25 Specula tests.
• WHP and MSHV each: three actual commands, eight scenarios, public-four checks 27+41+12+14=94 plus Alpine/Ubuntu cold-boot and identity cases; complete JSONL outcomes/teardown, no remaining owned VMM.
• Historical own ten guest ELFs and images, guest source 4fd32623be669477621348fa03e96a7fffddf7d1b89921211fd30399108d35a1, manifest b1e928483232ef243154d8290f308a0a33765387188c30d55396e6d9f1600090. Frozen qualification baseline 256ebe3dd9c23f20da94503b55d678d1193e392d, OpenVMM 9cec2b89245f41f2126f9a787c5e43a0d84b7154 and kernel 692ac2a9f351aa5a31dcf1810782d82c1a83a0f1fd0b3edcf4fad9c0d94cfe81; no new kernel or VMM producer.
• Historical independent exact-head read-only Opus 5.5/max/long review: no remaining scoped findings. This is static review, not runtime evidence.

Historical evidence packet SHA256: 7095ac0b607094465278e57e5432f7b822997bf57ee71885250866580a8ff544; its 19 indexed artifacts are hash-bound. Earlier interrupted, unadmitted, noncanonical-CLI and failed attempts remain historical failures, not current passes.

Boundaries

Local qualification binds the stated source and pinned feature baseline, not CI or a future merge. This update changes only the existing PR1312 head, its necessary feature base and this provenance disclosure, preserving Draft, title, labels, original refs and all earlier evidence. No parent PR source, integration branch, Ready state or merge is changed.

The historical native results cover the stated existing public/cold-boot paths. They are not a 156/11 full-group matrix or a claim that the new pure renderer is already wired into every legacy caller. Fresh exact-head repository feedback is still required before any later Ready decision.

[Copilot]

🟢 Approval recommended

No active review issues are reported for the view codec and cold-boot command-line renderer.

No open issues 🎉

What changed in this PR

Adds the view codec and cold-boot kernel-command-line renderer for the #1076 library refactor, combining the parent changes for root settings and boot configuration. Runtime and restore wiring remain out of scope.

Changes:

• Adds a strict paired hostname/machine-ID codec using canonical lowercase hexadecimal for hostname bytes.
• Adds checked VmConfig::kernel_command_line rendering for root settings, view and export mappings, preserving caller text unchanged.
• Adds focused codec and rendering tests, documentation, and public-API snapshot updates.

File	Description
nvx-rs/​src/​protocol/​view/​tests.rs	Tests round trips and rejection of malformed, partial and duplicate tokens.
nvx-rs/​src/​protocol/​view.rs	Implements strict view-token rendering and parsing.
nvx-rs/​src/​protocol/​mod.rs	Exposes and documents the view module.
nvx-rs/​src/​host/​config/​tests.rs	Tests rendering, caller-text preservation and configuration errors.
nvx-rs/​src/​host/​config/​mod.rs	Adds the checked cold-boot command-line renderer.
nvx-rs/​README.md	Documents the codec, renderer and validation boundaries.
nvx-rs/​public-api/​windows.txt	Records the new public APIs for Windows.
nvx-rs/​public-api/​linux.txt	Records the new public APIs for Linux.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues were identified for the VM-view codec and cold-boot command-line rendering changes.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

There are no active review issues for the VM view codec and cold-boot command-line rendering changes.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues are recorded for the VM-view codec and cold-boot command-line renderer.

No open issues 🎉

_{Review effort: Balanced}

[github-actions]

This pull request changes no existing test

Relocated unchanged: 0; added: 13. Compared the merge base 489ce50efc93 with 43716c030c4f.

[Copilot]

🟢 Approval recommended

No active review issues are reported for the cold-boot command-line renderer and paired view codec.

No open issues 🎉

_{Review effort: Balanced}