[Enrique Saurez (esaurez)]

Part of #1105.

Summary

Based on #1414 at 8b2a392a. This layer makes restored capture return only after
the existing repair completes.

• Return Captured::Restored(Repaired) after inline repair, retaining operation
  order, retries, CPU/memory handling, reseed and acknowledgement.
• Move the repair implementation, data and errors into guest::snapshot; legacy
  activation/clone exports use the same implementation. Repair failures retain
  their detail/status and map to MustEnd.
• After a restored capture, take RESET and call
  GuestConnection::acknowledge(window) on the existing session before receiving
  activation. Fresh capture deadlines, port release and rollback are unchanged.

The complete delta is 52 core lines in 3 counted files, 7 logical/9 raw paths,
plus 78 documentation and 103 test lines. All five original commits are replayed
once, in order, without patch, message or trailer changes; the already-empty
fixture commit is retained. The original and rewritten commits are unsigned.
No correction delta was needed. The OpenVMM pin remains 14dc4116; no kernel,
VMM, dependency, protocol or repair-state-machine change is included.

Validation

Current candidate: 0dd708cfa28ede292101feba561b1e3a3de9dcf7, based on
8b2a392ae6fd5f73f1b27fb2a0e109ce36d068e3.

• Structural checks passed: exactly five owned commits, first parent equal to the
  current base, zero merges, identical ordered patches/messages/trailers, clean
  source/native checkout, whitespace, test layout and complete size measurement.
• Full CI 42626861483,
  attempt 1, concluded successfully for this exact head. Nine conditional jobs
  were skipped; those skips are not test passes.
• Independent read-only code review found no blocking defects, with unchanged
  source/native hashes and four nonblocking observations retained. Current-head
  Copilot review reports no open issues. Its earlier caution about missing real
  inline capture/RESET/ACK evidence is addressed by the later, separate local
  witness below, not by relabeling the legacy adapter.
• Fresh Windows checks recorded 48 successful commands, including Rust/MSRV,
  adapter, CLI and quality checks. CLI: 1,823 tests/67 skips; adversarial:
  84 tests/11 skips; host-profile tests: 4 passed. The remaining Specula test
  command fails on Windows because fcntl is unavailable; the identical command
  also fails on the exact parent with byte-identical Specula code. It is not
  relabeled a pass or fixed outside this layer.
• Fresh Linux software/API/MSRV/quality/CLI checks: all 65 commands passed.
  CLI: 1,823 tests/30 skips; adversarial: 84 tests/no skips; Specula: 25 passed.
  This does not relabel the unsupported Windows Specula command.
• Current WHP and MSHV runtime each passed the complete
  156-scenario/11-target adapter command, the complete default Alpine command,
  and the required Ubuntu six-scenario and Azure Linux seven-scenario commands.
  These are successful whole commands, not combined prefixes or selector subsets.
  Outer Rust test concurrency was bounded to one; scenario assertions, internal
  clone concurrency, deadlines and timeouts are unchanged.
• Real inline-capture witnesses passed on both WHP and MSHV, using an isolated
  copy of the current adapter linked to this exact NVX source. Its actual compiled
  guest calls snapshot::capture(Fresh, deadline), returns Restored(Repaired),
  consumes RESET and calls the existing acknowledgement before activation.
  The two original CPU/memory resource scenarios and their assertions are
  unchanged. Each backend passed both cases with five actual existing guest
  activation-probe responses showing acknowledged repair, then ordered RESET,
  first message, Ready and start. All 66 fixture sources, genuine compiled
  binaries, guest call edges, source/native indices and before/after hashes are
  retained. This fixture is not a production producer or protocol change.
• Initial MSHV attempts retain their actual failures: excessive private temporary
  path length, then an interrupted whole command after the resource sampler raced
  normal removal of a temporary file. The corrected sampler credits no volatile
  allocation and retains the complete growth budget and safety floors. An exact
  restrictive-umask negative control failed; the unchanged case passed with the
  ordinary child umask. Only private execution layout/wrappers changed.
  The first WHP witness's console-marker audit also remains failed: that adapter
  deliberately disables the console. The separate successful proof captures
  actual existing probe replies, not fabricated console markers.
• Current kernel/guest/native components have exact effective-input provenance;
  no native or kernel rebuild or pin change was needed. Runtime commands use
  frozen genuine prebuilt runners, without a compiler during an owned VM phase.
  Unavailable, failed or skipped checks are not passes.
• Historical results below do not qualify this rebased candidate. An ancestor
  currently has an unrelated KVM test failure; the ancestor chain is not claimed
  qualified.

Historical evidence, not current-head passes

• At ddd62a60, documentation checks and warning-denied documentation builds
  passed on both platforms, with independent review of the RESET/ACK wording.
• At 974f2d6b, complete CLI checks ran 1,822 tests on each platform, with
  67 Windows skips and 32 Linux skips, plus adversarial/host/help checks.
  Rust/API/MSRV/guest/runtime evidence used explicitly bound earlier component
  inputs, not artifacts relabeled as the later documentation-only head.
• Earlier WHP/MSHV acceptance covered Alpine, Ubuntu and Azure Linux, plus the
  complete 156-test/11-target adapter suites. WHP default coverage combined a
  same-input passing prefix and remaining selectors (51 selectors/57 processor
  spans), not one successful whole command. Failed/interrupted commands remain
  failures. A Linux all-features correction used a complete serial run; a Linux
  adapter path-depth correction used a private mount-only temporary directory and
  unprivileged VMM driver. No expectations, skips or timeouts were weakened.
• Earlier independent review found no high-confidence defects, with four
  nonblocking observations retained in the historical evidence. None is a fresh
  review or CI pass for this candidate.

Existing test changes (tests-modified)

• expands and failure now drive repair through capture; resource assertions
  remain, and failures also check the repair stage, retained detail and fatal
  disposition/status.
• an_ungated_restore_is_finished_without_an_acknowledgement and
  the_instant_of_the_acknowledgement_precedes_the_deferred_work_of_the_finish
  use that seam without weakening acknowledgement/order assertions.
• each_failure_class_ends_the_clone_with_a_status_of_its_own also checks
  capture's fatal mapping for every existing repair status.
• a_repair_draws_no_randomness_before_its_reseed changes only its relocated
  subprocess selector.
• The pending/unseeded case is renamed to match the repaired API and retains
  NoSeed detail with REPAIR_RESTORE fatal status.
• Repair-test imports move with the module. The classifier reports 70 unchanged
  relocations, 8 existing-item changes and 5 added test items.

[github-actions]

This pull request changes existing tests

It modifies or removes 8 existing test asset(s), listed below. Review each with care: a change to a test can hide a regression that the test caught. See doc/contribute.md#changes-to-existing-tests.

Test code

Change	What	Before	After
modified helper	fn expands in guest::activation::repair::tests (moved)	nvx-rs/src/guest/activation/repair/tests.rs:429	nvx-rs/src/guest/snapshot/repair/tests.rs:465
modified helper	fn failure in guest::activation::repair::tests (moved)	nvx-rs/src/guest/activation/repair/tests.rs:707	nvx-rs/src/guest/snapshot/repair/tests.rs:741
modified test	fn an_ungated_restore_is_finished_without_an_acknowledgement in guest::activation::repair::tests (moved)	nvx-rs/src/guest/activation/repair/tests.rs:317	nvx-rs/src/guest/snapshot/repair/tests.rs:357
modified test	fn the_instant_of_the_acknowledgement_precedes_the_deferred_work_of_the_finish in guest::activation::repair::tests (moved)	nvx-rs/src/guest/activation/repair/tests.rs:390	nvx-rs/src/guest/snapshot/repair/tests.rs:430
modified test	fn each_failure_class_ends_the_clone_with_a_status_of_its_own in guest::activation::repair::tests (moved)	nvx-rs/src/guest/activation/repair/tests.rs:712	nvx-rs/src/guest/snapshot/repair/tests.rs:758
modified test	fn a_repair_draws_no_randomness_before_its_reseed in guest::activation::repair::tests (moved)	nvx-rs/src/guest/activation/repair/tests.rs:1214	nvx-rs/src/guest/snapshot/repair/tests.rs:1267
modified test	fn a_pending_capture_is_not_released_and_a_restore_without_network_is_not_repaired in guest::snapshot::tests (renamed to a_pending_capture_is_not_released_and_an_unseeded_restore_must_end)	nvx-rs/src/guest/snapshot/tests.rs:350	nvx-rs/src/guest/snapshot/tests.rs:383
removed imports	the imports of guest::activation::repair::tests	nvx-rs/src/guest/activation/repair/tests.rs:5

Relocated unchanged: 70; added: 5. Compared the merge base 8b2a392ae6fd with 0dd708cfa28e.

[Copilot]

🟡 Changes recommended

The snapshot documentation and README recommend attach() after RESET, which returns InvalidState; they should instead document acknowledge(window) before receiving the activation record.

1 open issue

• Correct RESET recovery instructions to acknowledge before activation · New

What changed in this PR

Extends the fresh-capture API from #1394 so restored guests complete the existing repair before capture returns.

Changes:

• Returns Captured::Restored(Repaired) after repair and preserves repair errors as fatal dispositions.
• Moves repair into guest::snapshot while retaining legacy activation exports.
• Updates capture-path tests, public API records, and transport documentation.

File	Description
nvx-rs/​src/​guest/​snapshot/​tests.rs	Adds a restored-capture fixture and checks fatal unseeded restores.
nvx-rs/​src/​guest/​snapshot/​repair/​tests.rs	Exercises repair ordering, results, and errors through capture.
nvx-rs/​src/​guest/​snapshot/​repair.rs	Relocates repair and shares its system interface with capture.
nvx-rs/​src/​guest/​snapshot.rs	Runs restore repair inline and returns repaired data or fatal errors.
nvx-rs/​src/​guest/​activation.rs	Preserves legacy exports and adds repair failure variants.
nvx-rs/​README.md	Documents inline repair and post-restore transport handling.
nvx-rs/​public-api/​linux.txt	Records the new snapshot results and repair exports.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The live restored-capture path coordinates resource activation, reseeding, and host acknowledgement, but fake-based tests and the adapter’s legacy capture path leave hardware-backed integration evidence needing maintainer review.

No open issues 🎉

1 resolved since last review

• Correct RESET recovery instructions to acknowledge before activation

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Exact-head guest/runtime validation remains pending, and seam tests do not establish the real restore and RESET/ACK lifecycle while the runtime adapter still uses legacy capture and repair.

No open issues 🎉

_{Review effort: Balanced}