[Enrique Saurez (esaurez)]

Part of #1076. Refs #1099.

Add vm::spawn(Prepared) and the caller-owned Launched result. Reuse the opened log, inherited resources, outputs, and capability; return a verified detached process. On a post-spawn verification failure, terminate only that child and confirm its exit. Preserve legacy spawn behavior, Linux child-local umask handling, and Windows trusted log-job and inheritance isolation.

This is SL2.9 directly on SL7.2 (#1339), replaying only original leaf d217471b; no private merge or additional ancestor is imported. The README context conflict preserves the parent's snapshot, configuration, and restore descriptions. Review follow-up 0f0de71c resolves caller-relative runtime and block-image paths before the final command-line check, and honors NVX_HYPERVISOR in the real-VM fixture.

The tests cover verified ownership, cleanup, caller survival, opened-resource identity, umask, Windows job claims, and relative inputs outside the VM directory. The existing cold_runtime helper now supplies explicit absolute placeholder paths. Windows platform helpers and their reexports support these cases, including the existing bounded job-claim release check; the unrelated child's survival assertion remains intact. No CI wiring changes.

Validation

• The original nine-file leaf was replayed unchanged at b9ed7d7e. The material review correction is 23 CORE / 1 counted path / 5 raw paths.
• Current whole-own measurement: 138 CORE / 3 counted paths / 9 raw paths, within the original 600 / 5 limits, with no manual discounts.
• Current inventory: 1 modified helper (cold_runtime), 0 relocated, 20 added test items. NVX and OpenVMM worktrees are clean; the native pin remains 14dc4116.
• All 24 applicable Windows check-nvx-rs gates pass on the exact pushed source, including feature-matrix tests and clippy, artifact bundling, warning-denied rustdoc, MSRV, and runtime-adapter checks. The relative-path regression fails before the fix and passes afterward; the focused VM suite reports 22 passed / 0 failed / 2 ignored. Linux-only and opt-in real-guest cases are not claimed as locally executed.
• Exact-head CI run 42543432981, attempt 1, completed successfully: 35 successful jobs / 8 conditional skips, with the required-job verifier executed and passed. Fresh Copilot review 5820671688 at 0f0de71c is COMMENTED / approval recommended / no open issues; both threads are resolved and every thread page was checked. This is not a formal maintainer approval. The first-run result and historical private qualification remain separate evidence, not promoted to new-head CI.

[Copilot]

🟡 Changes recommended

Unresolved relative executable and input paths can prevent VM startup or select the wrong files when spawning changes the child’s working directory.

2 open issues

• Resolve relative runtime and configuration paths before spawning · New
• Use the configured hypervisor in the real-VM test fixture · New

What changed in this PR

Adds caller-owned VM spawning to the library’s two-phase launch API, advancing the separation of VM mechanisms from durable state management.

Changes:

• Adds vm::spawn(Prepared) and Launched, retaining prepared resources, outputs, and capability.
• Adds confirmed child cleanup after verification failures and requires trusted Windows log jobs for library launches.
• Adds lifecycle tests, documentation, and public API snapshots.

File	Description
nvx-rs/​src/​host/​vm/​tests.rs	Adds ownership, cleanup, inheritance, caller-survival, and boot tests.
nvx-rs/​src/​host/​vm.rs	Adds prepared spawning and the caller-owned launch result.
nvx-rs/​src/​host/​spawn.rs	Shares spawn mechanics and adds confirmed child cleanup.
nvx-rs/​src/​host/​platform/​windows/​tests.rs	Adds Windows inheritance and job-test helpers.
nvx-rs/​src/​host/​platform/​windows/​spawn.rs	Adds termination with confirmed process exit.
nvx-rs/​src/​host/​platform/​tests.rs	Reexports Windows test helpers.
nvx-rs/​README.md	Documents launch ownership, platform behavior, and smoke testing.
nvx-rs/​public-api/​windows.txt	Records the new Windows public API.
nvx-rs/​public-api/​linux.txt	Records the new Linux public API.

_{Review effort: Balanced}

[github-actions]

This pull request changes existing tests

It modifies or removes 1 existing test asset(s), listed below. Review each with care: a change to a test can hide a regression that the test caught. See doc/contribute.md#changes-to-existing-tests.

Test code

Change	What	Before	After
modified helper	fn cold_runtime in host::vm::tests	nvx-rs/src/host/vm/tests.rs:428	nvx-rs/src/host/vm/tests.rs:434

Relocated unchanged: 0; added: 20. Compared the merge base 0f9a26b29999 with 0cf131612505.

[Copilot]

🟢 Approval recommended

No active review issues remain for the prepared-launch VM spawning changes.

No open issues 🎉

2 resolved since last review

• Resolve relative runtime and configuration paths before spawning
• Use the configured hypervisor in the real-VM test fixture

_{Review effort: Balanced}