[Pedro Henrique Penna (ppenna)]

Part of #1120 (SL6.11c, "The old capture steps are gone"). Parent #1087, umbrella #1076.

What and why

guest::snapshot::capture has replaced the activation's capture steps (SL7.4a and SL7.4b, #1394): one bounded call checks the mounts, prepares, requests the capture and repairs a restore. With the runtime adapter gone (#1499), nothing uses the steps any more, and the repair and the time ABI's capture and restore surface have no user outside guest::snapshot and nvx-time. So:

• The old capture steps are deleted from guest::activation (first commit): AdmissionFence; CapturePreparation, with new and prepare; CaptureBarrier, with capture and cancel; Restored, with restore and into_parts; and CaptureError, with stage, cause and into_cause. With them go the generic activation::Captured<F>, which only CaptureBarrier::capture returned, and activation::Devices, which only CapturePreparation::new took (see Judgment calls). What guest::snapshot uses stays where it is: CaptureStage, CaptureCause, and the capture's seam of the kernel and the time ABI (System, LiveSystem, capture_system, live_abi, at). The seam's pre_capture, which only the deleted preparation called, goes; TimeAbi::pre_capture stays for nvx-time pre-capture.
• The repair becomes private to guest::snapshot (first commit). guest::activation, and so its alias guest::clone, no longer re-exports Repair and repair, and Repair and Repair::run become pub(super). repair and Repair::new, which only the public API reached, go, since the dead-code check that CI denies finds them once they are private. The repair's implementation and its internal tests don't change. Repaired, RepairError, RepairCause, RepairStage, RangeFault and RepairProgress stay public, since snapshot::capture returns them.
• The time ABI's capture and restore surface becomes crate-private (second commit): TimeAbi::capture and TimeAbi::restore_finish, and CaptureRequest, CaptureOutcome, Restore (with network), RestoreNetwork, RestoreFinish, MemoryRange, CpuSet and ScratchPolicy, with all their methods, become pub(crate). guest::snapshot and nvx-time's capture and restore-finish commands use them as before. No TimeAbi method is deleted. CpuSet's contains, len, is_empty and iter, which nothing in the crate calls, go, for the same dead-code reason.
• Docs. The rustdoc of guest::activation, whose example now captures through snapshot::capture and then makes the Activation; of guest::time, whose example keeps the cold boot and the daemon; and of guest, the crate root, TimeAbi, snapshot::capture and the repair's types. The nvx-rs README's nvx::guest::time, nvx::guest::snapshot and nvx::guest::activation sections, the module-table rows of time and activation, whose purposes change, and the guest programs' paragraph. The guest-agent guidelines' note on the one call that starts processes. The case matrix's rows of the doc tests that this rewrites or moves (below).
• Public API. nvx-rs/public-api/linux.txt drops 95 lines: 56 in the first commit, the items above under guest::activation and its alias guest::clone, and 39 in the second, under guest::time. The Windows snapshot doesn't change.

No behavior changes: snapshot::capture, its failure dispositions and its repair, and nvx-time run the same code. BOOT_CONTRACT_VERSION and CONTROL_CONTRACT_REVISION don't change.

Judgment calls

These calls were approved for Pedro Henrique Penna (@ppenna):

• activation::Devices and activation::Captured<F> go with the steps. The Scope names neither, but each existed only for them. Devices, with guest::root::Device fields, was CapturePreparation::new's parameter: SL7.4a moved the capture's Devices to guest::snapshot, naming the devices by their MMIO bases, and kept this one for the old caller alone. Captured<F> was CaptureBarrier::capture's result, which holds a Restored<F>. Keeping them would leave public types that no call takes or returns. Deleting Devices forces one import edit: the doc link of the hidden RootTemplate::filesystem_tag now names guest::snapshot::Devices (apply.rs).
• CpuSet's contains, len, is_empty and iter go. The Scope makes CpuSet crate-private with all its methods, and nothing in the crate calls these four, so they are code that the change leaves unused, which CI's warning-denied dead-code check refuses. CpuSet::new and CpuSet::with, which the repair calls, stay.
• CaptureStage::Fence stays. No call produces it any more, but CaptureStage is guest::snapshot::CaptureFailure's, which "Not in this PR" protects. A later PR can drop the variant.
• The guest::clone alias stays. SL5.2 reports that nothing uses it any more, but this Scope doesn't name it. Its doc comment no longer says that it carries a legacy capture interface.
• scripts/nvx_tools/kernel_features.py keeps naming nvx::guest::clone::repair among the consumers of its processor and memory-hotplug features. The inventory is an input of the guest kernel's cache key (KERNEL_INPUT_HASH in build-guest-artifacts), so editing it rebuilds the kernels. The follow-up that SL5.2 started for this file updates its stale entries once, with a single rebuild, after SL6.11b, and now covers nvx::guest::clone::repair too: the repair that the entries mean runs inside nvx::guest::snapshot::capture.

Not in this PR

As the issue says: changing guest::snapshot::capture, its failure disposition, or its one-call capture and repair; redesigning repair or time synchronization; deleting the TimeAbi methods that nvx-time uses (capture, restore_finish, pre_capture and cancel_capture); and adding public capture-step types or compatibility aliases in their place.

Size

Measured against feature/nvx-refactor 5fb5e95c: 5 core lines in 2 counted files (estimate 30 and 4, stop 60).

File	Core lines	What
guest/activation.rs	3	The imports of root, snapshot and time that the deletion narrows; it deletes 227 lines of code
guest/activation/state/apply.rs	2	The doc-only import of Devices, from guest::snapshot, which rustfmt moves with its #[cfg(doc)]

These don't count, as the rules' exception for files whose items a PR only makes crate-private, with the edits that this forces, says. Counted too, they would make 45 core lines in 5 files, still under the stop:

• guest/time/api.rs: 34 lines that make the items pub(crate), 5 of them the signature of CaptureRequest::new, which rustfmt wraps once it is pub(crate). It deletes the four dead CpuSet methods.
• guest/time/mod.rs: 4 lines of re-exports, split between pub(crate) and pub.
• guest/snapshot/repair.rs: 2 lines that make Repair and Repair::run pub(super). It deletes the dead repair and Repair::new.

guest/mod.rs, guest/snapshot.rs and lib.rs change only docs. Tests, docs, the case matrix and the public-API snapshot don't count.

Tests of the area

• guest::activation::tests, 19 tests before, 8 after:
  • retired with the fence, the barrier and a restored clone's parts, 10: the_fence_closes_before_the_checks_and_the_detectors_are_suppressed_before_the_capture, a_fence_that_fails_to_close_stops_the_preparation, a_preparation_behind_a_fence_that_another_holds_closed_fails_and_leaves_it_closed, a_held_suppression_that_a_failed_preparation_cannot_restore_is_a_release_error, a_port_permission_that_the_thread_may_hold_outranks_a_failed_restore, cancel_and_drop_open_the_fence_then_restore_the_detectors, a_failed_restoration_of_the_detectors_is_reported_after_the_fence_opens, a_restored_clone_gets_the_fence_closed_with_the_detectors_suppressed, a_failed_capture_restores_the_detectors_and_opens_the_fence_only_before_its_request and a_failed_capture_whose_detectors_cannot_be_restored_is_a_release_error. What they checked of the capture apart from the fence, the barrier and the restored clone's parts, the one call's tests check: its order (fresh_capture_orders_the_existing_steps_and_does_not_deadline_the_request), the rollback after a failure before the request and its failure (a_pre_request_failure_resumes_only_after_its_detector_restoration_succeeds, strict_time_status_is_retained_when_detector_rollback_also_fails), the precedence of a port permission that the thread may hold (port_release_is_fatal_and_keeps_its_cause_at_each_time_stage_despite_rollback_failure), the request's and the release's failures (request_and_release_failures_never_report_that_the_guest_resumed), and a restore's seed (a_pending_capture_is_not_released_and_an_unseeded_restore_must_end; the repair's capture_returns_the_repaired_generation_resources_and_acknowledgement_after_the_finish);
  • moved and rewritten, 1: a_failed_time_preparation_names_its_stage_and_opens_the_fence becomes guest::snapshot::tests::a_failed_time_preparation_names_its_stage_and_restores_the_detectors_that_it_holds, on the one call;
  • rewritten, 6: the five tests of the mount checks, each_mount_from_the_template_s_devices_blocks_a_capture, the_first_blocking_mount_of_the_table_is_reported, mounts_from_other_devices_and_tags_block_no_capture, a_device_without_a_window_has_nothing_mounted_from_it and a_mount_table_that_cannot_be_checked_blocks_a_capture, and errors_name_their_stage_and_their_cause;
  • kept unchanged, 2: the_live_system_finds_windows_and_block_devices_in_procfs_and_sysfs and the_capture_and_the_repair_take_the_time_abi_in_strict_mode.
• guest::snapshot::tests: every test kept; the fixture loses its pre_capture, and the test above is added.
• guest::snapshot::repair::tests: kept unchanged. They build the Repair with with_system, and capture through the one call.
• guest::time::api::tests: cpu_sets_hold_the_cpus_that_the_abi_covers rewritten; every other test kept unchanged. guest::time::commands::tests, guest::init's and guest::managed_agent's tests: kept unchanged.
• Doc tests: guest::activation's and guest::time's rewritten, guest's moved a line up (below).

The case matrix

doc/acceptance-case-matrix.md names doc tests by file and line. Three of its rows change, and its counts don't:

• nvx-rs/src/guest/activation.rs - guest::activation, now at line 158: this PR rewrites it on guest::snapshot::capture, as its row said the PR that removes the fence would. It stays kept.
• nvx-rs/src/guest/time/mod.rs - guest::time, now at line 9: it loses its capture and restore finish, which became crate-private. It stays kept.
• nvx-rs/src/guest/mod.rs - guest, now at line 39: unchanged, one line up, since the paragraph above it is one line shorter.

The matrix names none of the unit tests that this PR retires, moves or rewrites (git grep of each name). SL5.2's check of the matrix, check_matrix.py against 99d20220, passes.

Validation

feature/nvx-refactor has no scripts/local_gates.py. dev's copy, given this change's files, selects test-changes, markdown-links, test-layout, the nvx-rs gates and nvx-cli; they ran from this branch's own action definitions, with the pinned Rust 1.95.0 (MSRV 1.89) and NVX_BUNDLE=skip.

Rebase for the merge. This head, 2233d210, is 4efedab6 rebased onto feature/nvx-refactor 5fb5e95c, with rerere off. Since 5b3fab2c, the base gained #1511, #1497, #1501, #1503, #1523, #1507, #1513, #1518, #1519, #1520, #1527, #1525, #1502 and #1506. Two conflicts, both in docs and both from #1506, which deleted the exec engine and its guest binding: in the crate root's paragraph on the guest library (lib.rs), #1506 dropped the exec engine's mention right above the two lines that this change rewrites, and in the README's module table, it deleted the nvx::guest::exec::binding row right above the nvx::guest::time row that this change rewrites. Each resolution keeps both sides. #1506 also shortened the paragraph of guest/mod.rs above the guest doc test, which this change shortens once more, so the matrix's row of that test now names line 39, not 40; that fixup is folded into the first commit. Beyond that row, the lines that this change adds and removes are those of 4efedab6, the public-API snapshot's 95 among them. None of the base's new commits touches guest::activation, guest::snapshot, guest::time or examples/guest-workflows.rs: #1525 made NVXC and host::session private and changed only the host's examples, and #1502 gave named snapshots a NIC through the CLI. check_test_changes.py reports the same 46 changes, and Copilot's review of this head finds no open issues.

On this head:

Check	Result
Windows: cargo fmt --all --check, check-nvx-rs's six Clippy runs, Clippy for x86_64-unknown-linux-gnu (--all-targets --all-features) and for the musl guest build (--no-default-features --features guest --all-targets), and rustdoc for Windows and Linux, each with warnings denied	Passed
Windows: public_api.py (both snapshots), check_test_layout.py, check_markdown_links.py, and error::tests, which reads the README	Passed; 5 tests
Windows: SL5.2's check_matrix.py <worktree> 99d2022085f	Passed
nvx-mshv-test: cargo fmt --all --check, check-nvx-rs's six Clippy runs, and rustdoc with -D warnings	Passed
nvx-mshv-test: cargo test --locked --all-features	Passed: the library's 1946 tests (55 ignored), and 25 doc tests, among them guest::activation (line 158), guest (line 39), guest::snapshot (line 25), guest::time (line 9) and lib.rs (line 57)
nvx-mshv-test: cargo test --locked, cargo build --locked --lib --no-default-features, cargo test --locked --lib --no-default-features	Passed: 790 library tests (5 ignored) and 6 doc tests; 190 library tests
nvx-mshv-test: MSRV, cargo +1.89 check --locked --all-targets --all-features, and macOS, cargo check --locked --all-targets --all-features --target aarch64-apple-darwin	Passed
nvx-mshv-test: python3 scripts/public_api.py	Passed
nvx-mshv-test: python3 scripts/nvx.py check-guest-binaries --toolchain 1.95.0 (musl Clippy and tests)	1115 passed, 37 ignored
nvx-mshv-test, MSHV: test-microvm --backend mshv --scenario snapshot-core --scenario untiered-network-policy, both on named snapshots, the second's with a NIC (#1502)	Both passed, in 43 s

The microVMs ran with OpenVMM at this branch's pin (14dc4116, which the base didn't move), nvx-rs, the kernel and the Alpine initramfs built from this head, the last with nvx.py build-guest --native, so that its nvx-init captures through guest::snapshot::capture and its nvx-time is this head's, and the Ubuntu layer and scratch template of feature/nvx-refactor's CI run 43146257261 (99d20220), which the host can't build and whose formats the base didn't change. A first attempt ran a stale nvx-rs, built at 4efedab6, whose snapshot capture lacks #1502's --net; rebuilt, both passed.

After the restack, on 4efedab6, on feature/nvx-refactor 5b3fab2c (no conflicts, both commits unchanged): the same checks passed on Windows and nvx-mshv-test, with the library's 2393 tests (60 ignored) and 34 doc tests, and SL5.1c's snapshot-core and snapshot-tiers on MSHV.

Before the restack, on 8f088d80, on SL5.2's branch a2fadde7:

Windows (local):

Check	Result
cargo fmt --all --check	Passed
check-nvx-rs's six Clippy runs, with -D warnings	Passed
RUSTDOCFLAGS="-D warnings" cargo doc --locked --no-deps --all-features	Passed
cargo test --locked --all-features --lib error::tests, which reads the README	5 passed
Clippy for x86_64-unknown-linux-gnu (--all-targets --all-features) and for x86_64-unknown-linux-musl (--no-default-features --features guest --all-targets), and rustdoc for Linux, each with warnings denied	Passed
python scripts/public_api.py --update	The 96 removed lines above, and nothing else
check_markdown_links.py, check_test_layout.py	Passed

Linux, on nvx-mshv-test (linux-mshv, virtual machine, Azure Linux 3, kernel 6.18), in a temporary worktree of this branch:

Check	Result
cargo fmt --all --check, check-nvx-rs's six Clippy runs, and rustdoc with -D warnings	Passed
cargo test --locked --all-features --lib -- guest::activation guest::snapshot guest::time guest::init guest::managed_agent	377 passed, 22 ignored
cargo test --locked --all-features --doc	32 passed, among them guest::activation (line 158), guest::time (line 9), guest (line 40), guest::snapshot (line 25) and lib.rs (line 58)
cargo test --locked --all-features, cargo test --locked, cargo build --locked --lib --no-default-features, cargo test --locked --lib --no-default-features	Passed, none failed
python3 scripts/public_api.py (both snapshots), check_test_layout.py	Passed
MSRV: cargo +1.89 check --locked --all-targets --all-features	Passed
macOS: cargo check --locked --all-targets --all-features --target aarch64-apple-darwin	Passed
python3 scripts/nvx.py check-guest-binaries --toolchain 1.95.0 (musl Clippy and tests)	Passed: 1132 unit tests and the guest tools' integration tests
The first commit alone, as cc65ae8c, which differs from 6148ad32 only in the guest::activation example that Copilot's review fixed, and whose doc test compiles at this head: fmt, Clippy (all targets and features, --lib, --lib --no-default-features, cli), rustdoc, the guest unit tests and doc tests above, public_api.py, check-guest-binaries	Passed

MicroVMs, on nvx-mshv-test. OpenVMM, built with nvx.py build-openvmm at this branch's pin (14dc4116), and the kernel and the Alpine initramfs, built with nvx.py build-guest --native from 8f088d80, whose guest binaries nvx-time and nvx-init it compiles. python3 scripts/nvx.py test-microvm --backend mshv --scenario snapshot-core --scenario platform-restore-processors --scenario restore-memory --scenario time-abi-conformance --scenario untiered-network-policy --processors 1 2 passed all five: snapshot-core (12.5 s), platform-restore-processors (3.9 s), restore-memory (3.2 s), untiered-network-policy (12.7 s), whose guest's nvx-time capture consumes each restore packet and prints its network settings, and time-abi-conformance (0.4 s; capture, restore and boot markers within budget). Their guests capture and restore through nvx-snapshot, which runs nvx-time capture and nvx-time restore-finish, the commands of TimeAbi::capture and TimeAbi::restore_finish, which this change makes crate-private.

Left to CI: the bundled-artifacts test, which nothing here reaches; the guest binaries' release build and static-ELF check; and the KVM, MSHV and WHP microVM suites, SL5.1c's smoke tests among them.

Changes to existing tests

python3 scripts/check_test_changes.py --base origin/feature/nvx-refactor, dev's script, lists 46 changes to existing tests, hence the tests-modified label; it also finds 2 added and none relocated unchanged. All are in guest::activation::tests, but for the two noted.

Modified, 16:

1. enum Call drops the calls of the fence and of the time ABI (Close, Open, PreCapture, CancelCapture, GenerationId, Capture): the mount checks look up only the mount table, the windows and the block devices.
2. struct FakeSystem and its new drop the fake time ABI's fields (preparation, restoration_fails, generation_fails, outcome) and their defaults.
3. FakeSystem's pre_capture_until, cancel_capture, generation_id and capture (4) are now unreachable!, since the mount checks ask nothing of the time ABI; the trait still requires them.
4. fn devices returns guest::snapshot::Devices, the MMIO bases, in place of the deleted activation::Devices.
5. The module's imports drop the fence's atomics, Seed and PortError, and import guest::snapshot (as mounts), CaptureFailure, Devices and Disposition directly, since guest::activation no longer imports snapshot under that name.
6. The five tests of the mount checks (5) call snapshot::check_mounts through the new helper check, in place of a preparation. They assert the same mounts, origins, mount points, error kinds and texts, and lookups. They no longer assert the fence's and the time ABI's calls around the checks, nor the stage's prefix, failed to check the mount table: , which CaptureFailure adds; the one call's a_mount_refusal_never_prepares_or_requests_capture checks both the stage and that a refusal prepares nothing.
7. errors_name_their_stage_and_their_cause checks the Display form and the source of CaptureFailure, which are those of the deleted CaptureError, in its place, and drops into_cause. Its stage and origin names don't change.
8. cpu_sets_hold_the_cpus_that_the_abi_covers (guest::time::api::tests) checks the set's CPUs, count, membership and emptiness through its mask, set.0, since CpuSet's own iter, len, contains and is_empty go.

Removed, 30:

9. The 10 retired tests and the moved test, listed in Tests of the area.
10. Their helpers (18): GENERATION, RESTORED, FakeFence with its impl, handle, is_closed, and its AdmissionFence implementation's close and open, Preparation, Outcome, FakeSystem's pre_capture, fence, prepare, prepared, preparation_calls, platform_request and seed.
11. CaptureSystem's pre_capture (guest::snapshot::tests), which asserted that the one call never used the enforcing preparation: the trait method is gone.

Added, 2: the helper check, and guest::snapshot::tests::a_failed_time_preparation_names_its_stage_and_restores_the_detectors_that_it_holds, the moved test. It checks the same stages, causes and error numbers for each failure of the time ABI's preparation, through the one call, which also reports them as Resumed and restores the stall detectors only when the failure holds their suppression.

The openvmm gitlink doesn't move.

[github-actions]

This pull request changes existing tests

It modifies or removes 46 existing test asset(s), listed below. Review each with care: a change to a test can hide a regression that the test caught. See doc/contribute.md#changes-to-existing-tests.

Test code

Change	What	Before	After
modified helper	enum Call in guest::activation::tests	nvx-rs/src/guest/activation/tests.rs:46	nvx-rs/src/guest/activation/tests.rs:40
modified helper	struct FakeSystem in guest::activation::tests	nvx-rs/src/guest/activation/tests.rs:172	nvx-rs/src/guest/activation/tests.rs:72
modified helper	fn new in guest::activation::tests, impl FakeSystem``	nvx-rs/src/guest/activation/tests.rs:193	nvx-rs/src/guest/activation/tests.rs:85
modified helper	fn cancel_capture in guest::activation::tests, impl System for FakeSystem``	nvx-rs/src/guest/activation/tests.rs:281	nvx-rs/src/guest/activation/tests.rs:153
modified helper	fn pre_capture_until in guest::activation::tests, impl System for FakeSystem``	nvx-rs/src/guest/activation/tests.rs:290	nvx-rs/src/guest/activation/tests.rs:149
modified helper	fn generation_id in guest::activation::tests, impl System for FakeSystem``	nvx-rs/src/guest/activation/tests.rs:298	nvx-rs/src/guest/activation/tests.rs:157
modified helper	fn capture in guest::activation::tests, impl System for FakeSystem``	nvx-rs/src/guest/activation/tests.rs:307	nvx-rs/src/guest/activation/tests.rs:161
modified helper	fn devices in guest::activation::tests	nvx-rs/src/guest/activation/tests.rs:327	nvx-rs/src/guest/activation/tests.rs:173
modified imports	the imports of guest::activation::tests	nvx-rs/src/guest/activation/tests.rs:5	nvx-rs/src/guest/activation/tests.rs:5
modified test	fn each_mount_from_the_template_s_devices_blocks_a_capture in guest::activation::tests	nvx-rs/src/guest/activation/tests.rs:410	nvx-rs/src/guest/activation/tests.rs:188
modified test	fn the_first_blocking_mount_of_the_table_is_reported in guest::activation::tests	nvx-rs/src/guest/activation/tests.rs:482	nvx-rs/src/guest/activation/tests.rs:253
modified test	fn mounts_from_other_devices_and_tags_block_no_capture in guest::activation::tests	nvx-rs/src/guest/activation/tests.rs:506	nvx-rs/src/guest/activation/tests.rs:275
modified test	fn a_device_without_a_window_has_nothing_mounted_from_it in guest::activation::tests	nvx-rs/src/guest/activation/tests.rs:536	nvx-rs/src/guest/activation/tests.rs:301
modified test	fn a_mount_table_that_cannot_be_checked_blocks_a_capture in guest::activation::tests	nvx-rs/src/guest/activation/tests.rs:550	nvx-rs/src/guest/activation/tests.rs:312
modified test	fn errors_name_their_stage_and_their_cause in guest::activation::tests	nvx-rs/src/guest/activation/tests.rs:933	nvx-rs/src/guest/activation/tests.rs:356
modified test	fn cpu_sets_hold_the_cpus_that_the_abi_covers in guest::time::api::tests	nvx-rs/src/guest/time/api/tests.rs:626	nvx-rs/src/guest/time/api/tests.rs:626
removed helper	const GENERATION in guest::activation::tests	nvx-rs/src/guest/activation/tests.rs:29
removed helper	const RESTORED in guest::activation::tests	nvx-rs/src/guest/activation/tests.rs:31
removed helper	struct FakeFence in guest::activation::tests	nvx-rs/src/guest/activation/tests.rs:88
removed helper	impl FakeFence in guest::activation::tests	nvx-rs/src/guest/activation/tests.rs:97
removed helper	fn handle in guest::activation::tests, impl FakeFence``	nvx-rs/src/guest/activation/tests.rs:99
removed helper	fn is_closed in guest::activation::tests, impl FakeFence``	nvx-rs/src/guest/activation/tests.rs:108
removed helper	impl AdmissionFence for FakeFence in guest::activation::tests	nvx-rs/src/guest/activation/tests.rs:113
removed helper	fn close in guest::activation::tests, impl AdmissionFence for FakeFence``	nvx-rs/src/guest/activation/tests.rs:114
removed helper	fn open in guest::activation::tests, impl AdmissionFence for FakeFence``	nvx-rs/src/guest/activation/tests.rs:125
removed helper	enum Preparation in guest::activation::tests	nvx-rs/src/guest/activation/tests.rs:136
removed helper	enum Outcome in guest::activation::tests	nvx-rs/src/guest/activation/tests.rs:157
removed helper	fn pre_capture in guest::activation::tests, impl System for FakeSystem``	nvx-rs/src/guest/activation/tests.rs:261
removed helper	fn fence in guest::activation::tests	nvx-rs/src/guest/activation/tests.rs:342
removed helper	fn prepare in guest::activation::tests	nvx-rs/src/guest/activation/tests.rs:351
removed helper	fn prepared in guest::activation::tests	nvx-rs/src/guest/activation/tests.rs:360
removed helper	fn preparation_calls in guest::activation::tests	nvx-rs/src/guest/activation/tests.rs:367
removed helper	fn platform_request in guest::activation::tests	nvx-rs/src/guest/activation/tests.rs:378
removed helper	fn seed in guest::activation::tests	nvx-rs/src/guest/activation/tests.rs:383
removed helper	fn pre_capture in guest::snapshot::tests, impl System for CaptureSystem``	nvx-rs/src/guest/snapshot/tests.rs:71
removed test	fn the_fence_closes_before_the_checks_and_the_detectors_are_suppressed_before_the_capture in guest::activation::tests	nvx-rs/src/guest/activation/tests.rs:390
removed test	fn a_fence_that_fails_to_close_stops_the_preparation in guest::activation::tests	nvx-rs/src/guest/activation/tests.rs:601
removed test	fn a_preparation_behind_a_fence_that_another_holds_closed_fails_and_leaves_it_closed in guest::activation::tests	nvx-rs/src/guest/activation/tests.rs:622
removed test	fn a_failed_time_preparation_names_its_stage_and_opens_the_fence in guest::activation::tests	nvx-rs/src/guest/activation/tests.rs:653
removed test	fn a_held_suppression_that_a_failed_preparation_cannot_restore_is_a_release_error in guest::activation::tests	nvx-rs/src/guest/activation/tests.rs:720
removed test	fn a_port_permission_that_the_thread_may_hold_outranks_a_failed_restore in guest::activation::tests	nvx-rs/src/guest/activation/tests.rs:738
removed test	fn cancel_and_drop_open_the_fence_then_restore_the_detectors in guest::activation::tests	nvx-rs/src/guest/activation/tests.rs:756
removed test	fn a_failed_restoration_of_the_detectors_is_reported_after_the_fence_opens in guest::activation::tests	nvx-rs/src/guest/activation/tests.rs:766
removed test	fn a_restored_clone_gets_the_fence_closed_with_the_detectors_suppressed in guest::activation::tests	nvx-rs/src/guest/activation/tests.rs:799
removed test	fn a_failed_capture_restores_the_detectors_and_opens_the_fence_only_before_its_request in guest::activation::tests	nvx-rs/src/guest/activation/tests.rs:845
removed test	fn a_failed_capture_whose_detectors_cannot_be_restored_is_a_release_error in guest::activation::tests	nvx-rs/src/guest/activation/tests.rs:889

Relocated unchanged: 0; added: 2. Compared the merge base 5fb5e95c4b68 with 2233d210992b.

[Copilot]

🟡 Changes recommended

The activation example swallows capture failures that require VM shutdown, losing the required fatal status instead of passing it to the caller’s shutdown path.

1 open issue

• Propagate MustEnd disposition to the VM shutdown path · New

What changed in this PR

This PR removes the obsolete guest capture API after the runtime adapter’s deletion, leaving guest::snapshot::capture as the public capture-and-repair entry point in the library-slimming workstream.

Changes:

• Deletes activation’s legacy capture steps and makes restore repair private to snapshot.
• Makes the time ABI’s capture and restore interfaces crate-private while retaining their internal consumers.
• Updates tests, documentation, and the Linux public-API snapshot to reflect the reduced surface.

File	Description
nvx-rs/​src/​lib.rs	Documents snapshot capture and activation separately.
nvx-rs/​src/​guest/​time/​mod.rs	Narrows re-exports and simplifies the public example.
nvx-rs/​src/​guest/​time/​api/​tests.rs	Adapts CPU-set assertions to removed accessors.
nvx-rs/​src/​guest/​time/​api.rs	Restricts capture and restore visibility; removes unused accessors.
nvx-rs/​src/​guest/​snapshot/​tests.rs	Adds migrated preparation-failure coverage.
nvx-rs/​src/​guest/​snapshot/​repair.rs	Makes repair internal and removes public wrappers.
nvx-rs/​src/​guest/​snapshot.rs	Clarifies capture’s process effects and mount-check documentation.
nvx-rs/​src/​guest/​mod.rs	Updates guest API and compatibility-alias documentation.
nvx-rs/​src/​guest/​activation/​tests.rs	Retires legacy-step tests and retains mount-check coverage.
nvx-rs/​src/​guest/​activation/​state/​apply.rs	Redirects a documentation import to snapshot devices.
nvx-rs/​src/​guest/​activation.rs	Deletes legacy capture types and rewrites the example.
nvx-rs/​README.md	Describes the reduced public capture and time interfaces.
nvx-rs/​public-api/​linux.txt	Records the removed public API entries.
doc/​guest-agent-guidelines.md	Updates guidance on capture’s process-starting behavior.
doc/​acceptance-case-matrix.md	Updates doctest locations and migration notes.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues remain for the legacy guest capture API removal.

No open issues 🎉

1 resolved since last review

• Propagate MustEnd disposition to the VM shutdown path

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues remain for the legacy capture API removal and related visibility reductions.

No open issues 🎉

_{Review effort: Balanced}