[Enrique Saurez (esaurez)]

SL3.7a only

Add the private CLI named-snapshot store and an optional restored-sandbox source name. This is the first remaining slice of issue #1114, not capture or restore command implementation.

• Validate bounded portable names and map their original bytes to distinct hexadecimal directory names.
• Keep each published snapshot immutable, containing exactly key.bin, snapshot.json, and openvmm/. Validate staging with the strict reader and publish the whole directory with a non-replacing rename.
• Reuse existing private-directory and file-lock helpers. One exclusive lock per name stays outside its published directory; different names remain independent.
• Round-trip only the restored sandbox's own validated source_snapshot. Cold serialization omits the field.
• Relocate the existing temporary-name/random/hex helpers to their shared CLI parent and preserve existing callers.

There is no index, database, restore ledger, reconciliation protocol, list/remove/GC, shared-lock mode, capture/restore command, or blockless driver here.

Actual inputs and scope

The base is now feature/nvx-refactor. The current consumer is 6d20c37f61e3315388a57344ed88f7e6fe04c818, tree 9fc9f0ec37c70a38fa85f159a7ef5886af01a164, with sole parent db39a5d609eb6863f96a8c33f5e3fcaa71339e33. OpenVMM remains 14dc4116ec7e57567633c4b7b07892aca3a58522.

Only the original consumer commit a81a6c8d874b00e57046b8fcd8657e2a2cbdd2fe above historical input join 4662351ccc22198ffe16b6935d157bee14a163c0 was replayed. That join, PR #1444, was a conflict-free union with no independent logic. Its CLI-store and strict-reader producers, PR #1433 and PR #1440, are merged; their merge commits 0b1a990ea0088ffbc914c68fb4d9346def1a4d0e and cf5f91467c050f1e9508403964b1b4546e2724ab are ancestors of the new parent. The historical aggregate was not replayed.

The replay was conflict-free and git range-diff reports an unchanged own patch: seven paths, 473 insertions / 41 deletions, including two new test files and shared-helper relocation. There was no manual resolution or logical/API reconciliation. Original a81 source objects, refs, and qualification receipts remain preserved for consumers using that immutable source. The original two own donors were 5a5cebc4 and 593a17d0; raw production-file churn is not a measured core-logic LOC claim.

SL2.12c compatibility APIs are not required by this store. Later issue #1114 slices retain their actual-input dependency holds. This retarget changes no native stack metadata or other PR.

Current-head compile validation

The exact current head/tree was compiled before publication on both Linux and Windows, with real Git metadata and the exact OpenVMM source checkout. Each platform passed scripts/nvx.py verify and NVX_BUNDLE=skip cargo check --locked --manifest-path nvx-rs/Cargo.toml --all-targets --all-features using Rust 1.95.0 and MSRV 1.89.0. Windows initialized MSVC and ran Cargo in the same command process. Both platforms used private mutable Cargo homes and per-toolchain targets; source/native trees remained clean.

This unchanged rebase received compile-only validation: no new tests, native rebuild, VM/runtime execution, full matrix, or manual Copilot review was performed solely for rebasing.

Historical qualification: original a81 only

The following results belong to a81a6c8d874b00e57046b8fcd8657e2a2cbdd2fe, tree 15a0093e6680114c44277bfe327d6625e8bf999f, on the historical 4662351c input join. They are not new-head executions or a current-head full qualification claim.

That consumer's own Linux 44-command matrix passed at 2026-11-10 13:45:19 UTC; its own Windows 32-command matrix passed at 13:48:14 UTC. Both included applicable NVX/CLI/protocol/runtime-adapter, API/documentation/MSRV, layout, and platform checks. All six focused store/record cases passed on each OS, with zero failures or ignores, including real OS locking, Linux privacy, and Windows ACL/junction behavior.

An isolated Linux root ownership-negative case passed once with zero failures or ignores using the normally compiled original-head test binary, SHA-256 13d5c9e551c3c5e4ad14e56cf35db7372be1ef13419625d99b2db124cec32ca7, not root Cargo or a root full suite.

Native Opus 5.5 / max / long-context review 6f17d787-71d1-4e17-960a-7bc6de288abf cleared that original input composition, consumer head, and every new test/helper body. Its configured profile was independently verified from native events. This historical local review is not a formal GitHub approval or whole-chain merge-readiness claim.

Test changes

The added tests cover name bounds and case-fold-distinct/reserved-name mappings; strict whole publication and refusal to replace or move published entries; file identity/length/mtime/content preservation; malformed directories and links without mutating their targets; lock contention/release and independent names; Linux permission/linked-lock and Windows ACL refusal; and absent/valid/invalid source-name records.

There are seven test declarations, six applicable per OS, plus three snapshot-test helpers. Existing test bodies, assertions, ignores, deadlines, and runtime prerequisites are not weakened. The original test-change inventory reports two policy changes and 18 added items: one test-layout allowance each for the directly necessary private annotations in sandbox/state.rs and snapshots.rs. No tests move into production files; tests-modified records those two allowances.

This software-only store/record slice claims no new VM/runtime coverage. Full public CI is not admitted for this PR; it stays Draft, and Draft-skipped checks are not full proof.

Related issue: #1114. This slice does not complete or close the whole issue.

[github-actions]

This pull request changes existing tests

It modifies or removes 2 existing test asset(s), listed below. Review each with care: a change to a test can hide a regression that the test caught. See doc/contribute.md#changes-to-existing-tests.

Test policy

Change	What	Before	After
loosened allowlist entry	nvx-rs/src/host/cli/sandbox/state.rs (the seams allow 1 test hooks)		scripts/test-layout-allowlist.json
loosened allowlist entry	nvx-rs/src/host/cli/snapshots.rs (the seams allow 1 test hooks)		scripts/test-layout-allowlist.json

Relocated unchanged: 0; added: 18. Compared the merge base db39a5d609eb with 6d20c37f61e3.

[Copilot]

🟢 Approval recommended

No active review issues block the named-snapshot store changes.

No open issues 🎉

What changed in this PR

Adds the private CLI named-snapshot store for the first slice of #1114. It builds on the existing strict snapshot reader and CLI storage helpers; capture and restore commands remain out of scope.

Changes:

• Adds validated snapshot names, separate per-name exclusive locks, and whole-directory publication without replacement.
• Records an optional validated source snapshot name for restored sandboxes, omitting it for cold launches.
• Shares temporary-name helpers and adds focused store and record tests.

File	Description
scripts/​test-layout-allowlist.json	Registers two production-only annotation allowances.
nvx-rs/​src/​host/​cli/​store/​mod.rs	Exposes the existing lock wrapper for snapshot-store reuse.
nvx-rs/​src/​host/​cli/​snapshots/​tests.rs	Tests names, publication, immutability, locking, and platform privacy checks.
nvx-rs/​src/​host/​cli/​snapshots.rs	Implements the private named-snapshot store and exclusive locks.
nvx-rs/​src/​host/​cli/​sandbox/​state/​tests.rs	Tests source-name round-tripping, omission, and invalid-name rejection.
nvx-rs/​src/​host/​cli/​sandbox/​state.rs	Adds optional source snapshot metadata and reuses shared helpers.
nvx-rs/​src/​host/​cli/​mod.rs	Registers the snapshot module and hosts relocated utility helpers.

_{Review effort: Balanced}