cli: start restored sandboxes from their named snapshots (SL3.8a1)

doc/run.md

@@ -1185,7 +1185,9 @@ otherwise read or change: `provision` refuses a share whose resolved host path
 equals, contains, or lies inside the sandbox's state directory, its image, its
 scratch image, or the OpenVMM, kernel, or initramfs of the artifact root, or
 the OpenVMM that `NVX_OPENVMM` names, before it records the sandbox, and
-`start` refuses one again before it launches the VM.
+`start` refuses one again before it launches the VM. The `start` of a restored
+sandbox also refuses a share that reaches its snapshot store, whose files the
+view of each restore links, before it takes the snapshot's lock.
 `start` resolves the recorded host paths again, so a share that came to reach
 one of these files through a link since `provision` is refused too. A
 `provision` that finds no artifact root leaves the artifacts to `start`. A

nvx-rs/src/host/cli/sandbox/lifecycle/mod.rs

@@ -5,9 +5,14 @@
 //! matching saved VM only after authenticated readiness and mappings. Every lifecycle command
 //! takes the CLI store's recoverable lock; indeterminate launches retain their evidence.
 //!
+//! A restored sandbox, whose configuration names a named snapshot, restores it at each start in
+//! place of a cold boot, under the snapshot's lock, through the blocking restore driver, which
+//! readies the guest, maps the shares and runs the recorded workload.
+//!
 //! Exec and stop reattach with runtime and process verification. Stop requests NVXC shutdown,
 //! waits for exit, then forces only the verified process. Deprovision removes only this stopped
-//! sandbox's owned files. No running sandbox from the old runtime store is migrated.
+//! sandbox's owned files, and a restored sandbox's view of its snapshot under the snapshot's
+//! lock. No running sandbox from the old runtime store is migrated.
 //!
 //! A run launches the VM that a provision and a start would launch, in a temporary VM directory,
 //! without a state directory, executes one workload over NVXC, and stops it the way stop does.
@@ -93,7 +98,7 @@ pub(crate) fn provision(
     let scratch = RecordedScratch::new(launch)?;
     write_json(
         &config_path,
-        &serialize_launch(launch, distro, scratch.as_ref(), config)?,
+        &serialize_launch(launch, distro, scratch.as_ref(), config, None)?,
     )
 }
 

nvx-rs/src/host/cli/sandbox/lifecycle/start/tests.rs

@@ -9,6 +9,11 @@ use crate::host::sandbox::mount::{plan_mounts, validate_mounts};
 use crate::host::sandbox::options::{sandbox_mounts, validate_sandbox_systemd_policy};
 use crate::host::sandbox::{SandboxSettings, SandboxUpper};
 
+/// The starts of restored sandboxes, with a fake OpenVMM and guest in place of OpenVMM's restore,
+/// which the tests fake on Linux and Windows.
+#[cfg(any(target_os = "linux", windows))]
+mod restore;
+
 #[test]
 fn run_checks_again_that_its_shares_do_not_overlap() {
     let directory = tempfile::tempdir().unwrap();