[Pedro Henrique Penna (ppenna)]

Leaving code only. This PR changes only code that this effort removes from NVX: the template store (host::template: its store, leases, capture transactions and plans, with the aliases of the snapshot metadata that it kept for the store's users), with the crate-private code that only it used and the edits that remove references to it. Nothing that stays changes, and no later PR uses what it changes, so the size limits for kept code don't apply.

Outside the template store, and the sandbox store and supervisor that SL6.1 deletes, the modules that it edits, host::platform, host::sys, host::snapshot and host::sandbox, only lose the crate-private items that only the template store used, as the compiler's dead-code check finds them, and gate by cli the one item that only the CLI uses now, with the rustdoc and test assertions that named them.

Part of #1121 (SL6.2a, "The template store is gone"). Parent #1087, umbrella #1076.

Stacked on #1507 (SL6.2b), which deleted the old clone path, the template store's last user, and merged as c642f09e. This PR is rebased onto it, with feature/nvx-refactor as its base.

What and why

Since #1507 deleted the old clone path, nothing uses the template store, which captured templates and leased their generations to clones. This PR does SL6.2a's Scope and no more, in one commit, host: delete the template store:

• The template store goes: nvx-rs/src/host/template/store.rs and store/{capture,leases}.rs, with their tests.rs files: Store, Index, Generation, StorageGeneration, Capture, Created, Acquired, Retirement and the names of the store's files, with its leases, tombstones, retirement and capture transactions.
• TemplatePlan goes: template/plan.rs, with template/plan/tests.rs, and TemplateResources, MEMORY_BLOCK_SIZE and SCRATCH_NAME, which only it and the store used.
• The store's Generation::eligibility goes, which template/mod.rs implemented with TimeContract::eligibility; its tests were the store's. TimeContract::eligibility and its tests, in host/snapshot/eligibility/tests.rs, don't change.
• host::template goes whole, since nothing else is left in it: its module declaration in host, its re-exports of the store's items and of host::store::lease's (Lease, LeaseId, StoreId, GENERATIONS_NAME, STORE_FORMAT, STORE_RECORD_NAME), and the aliases of host::snapshot's metadata (TemplateKey, TemplateManifest, CaptureClass, TimeContract and the others) that SL2.12a kept "for old users until SL6.2a" (nvx-rs slimming 2.3.2: snapshots have one strict format, and a capture finishes into it #1102), with its crate-private re-export of host::snapshot's modules eligibility, key and manifest. Their last users take the snapshot names: the restore test live_init reads with SnapshotManifest, and two key tests drop their assertions on the TemplateKey alias. host::snapshot's internal TemplateKey and TemplateManifest aliases, which only the store's modules used, go too.
• The template-capture integration test goes: nvx-rs/tests/template_capture.rs, which captured templates in the store through the supervisor, with the fake OpenVMM.
• The public API snapshots lose its 222 items on each platform, all under nvx::host::template.
• The crate-private code that only the template store used goes with it, as the dead-code check of CI's warning-denied builds of each feature set finds it, on Linux and on Windows:
  • host::platform: create_owner_only_dir and foreign_writer_problem, on Linux, Windows and other hosts; Linux's foreign_writer; Windows' check_owner_only_dir, and Required::Unwritable and CHANGE_RIGHTS, which only foreign_writer_problem used, with their branch of privacy_problem; Linux's re-export of check_owner_only_dir, whose function stays for check_snapshot_dir, and Directory::store_dir_problem; and the tests' re-export of owner_only_problem, which only the store's tests used.
  • host::snapshot: the re-export of check_exit, whose function stays for finish_capture.
  • host::store, which SL6.1 deletes: LockedStore's reserve, reserved, open_dir and remove_clone_files, with the Reservation of a lease's launch, which only the template store's acquisition and release set and used; regular::identity_of; and in store/lease.rs, read_identity, read_binding_in, read_private, read_record, LeaseRecord::new, Lease::{new, sandbox, template} and {StoreId, LeaseId}::{from_bytes, as_bytes}. The lease module's remaining items become pub(crate): only host::template re-exported them, and unreachable_pub finds them now. Without a reservation, LockedStore::begin_launch refuses every launch of a sandbox whose clone binding records a lease, as it already refused all but the reserved one, with one message, which names the lease's launch.
• rename_no_replace is gated by cli: only the CLI's snapshot commands call it now, so the default build's dead-code check finds it. It is gated where it is on Linux, with host::sys's fs module, on Windows and on other hosts, with the two Windows tests that call it.
• The docs stop naming the template store, with no other change:
  • rustdoc: the crate's and host's module docs; host::supervisor's # Clones section, with its lock order and crashes, which described the template store's leases, and the mentions of a clone's lease in # Launches and in launch; the sandbox store's docs of its launches, recovery and removal, of the names of a clone's files, of begin_launch, of the lease and of LaunchId::generate, which linked to the template store's acquisition and release or compared with them; BlockGeometry's and contract's; SnapshotKey::VERSION's, which told to recreate a template store; Windows' check_snapshot_dir's; and tests/openvmm_vectors.rs's.
  • nvx-rs/README.md: the module table loses nvx::host::template's row; the layout and the Tests section stop naming the template store and the template-capture test; the supervisor section loses the clone's lock order and the lease's launch; the config section stops saying that host::template re-exports Invariants and BlockGeometry; and the nvx::host::template section goes, but for its paragraphs on the manifest reader, the capture class, the key and its encoding, and the eligibility, which describe host::snapshot's items: they move to nvx::host::snapshot's section under the snapshot names, SnapshotManifest::read and SnapshotKey::new, without their sentences on the template store, and without the sentence that a capture's time anchor and host stay out of the key, which the section's paragraph on the persisted key already supersedes.
  • nvx-rs/tests/vectors/README.md: host::config's tests, not the template module's, compile the excerpts of OpenVMM's allowlist, only the comparison with the submodule reads the port-forward excerpt now, and no key of an earlier build is supported, rather than "a template store that an earlier build created". doc/design/1.5-compatibility-and-versioning-model.md and 5.3-snapshot-protocol.md lose their template-store examples.
  • doc/acceptance-case-matrix.md: the doc tests of TemplatePlan and Store retire, the Docs row now counts 36 tests, 32 kept, 1 rewritten, 3 retired, and the doc tests of host::supervisor and host::store follow their code to lines 32, 72 and 104 (were 33, 75 and 107).
  • doc/modules, the module diagrams, still show host::template: CI's nightly module-diagrams workflow draws them again, as doc/ci.md asks.

Every removed test, and its fate

python scripts/check_test_changes.py --base origin/feature/nvx-refactor reports 356 changes to existing tests: 106 removed tests, 9 modified tests, 2 modified helpers, the imports of 4 test modules, and the removed helpers, modules, imports and attributes of the deleted test files and of host::supervisor::tests. All 106 removed tests retire, since what they check leaves NVX, and none is named in the case matrix, as coverage or otherwise (git grep of each name):

• the 95 unit tests of the template store and of TemplatePlan (a few names appear twice, as Linux and Windows variants), with the store's tests of Generation::eligibility, through its selections and creations, and the 7 tests of tests/template_capture.rs, below by file;
• host::supervisor::tests::a_clone_whose_record_names_a_vmm_that_exited_may_release_its_lease and a_clone_whose_vmm_cannot_be_examined_keeps_its_lease, whose checks without the lease records_of_exited_vmms_are_cleared and a_vmm_that_cannot_be_examined_is_indeterminate_and_keeps_its_record already make;
• host::store::tests::the_files_that_a_clone_kept_of_its_launch_go_and_nothing_else and host::store::lifecycle::tests::windows::a_retried_removal_of_the_clone_files_takes_those_whose_deletion_is_pending_for_removed, the tests of remove_clone_files, which only a lease's release called; a removal's own removal of those files keeps its tests, such as a_removal_takes_the_clone_files_whose_deletion_is_pending_for_removed.

The doc tests nvx-rs/src/host/template/plan.rs - host::template::plan::TemplatePlan (line 137) and nvx-rs/src/host/template/store.rs - host::template::store::Store (line 473), which the report doesn't list, retire too, as the case matrix's Docs rows say.

nvx-rs/src/host/store/lifecycle/tests.rs (host::store::lifecycle::tests::windows): 1

a_retried_removal_of_the_clone_files_takes_those_whose_deletion_is_pending_for_removed

nvx-rs/src/host/store/tests.rs (host::store::tests): 1

the_files_that_a_clone_kept_of_its_launch_go_and_nothing_else

nvx-rs/src/host/supervisor/tests.rs (host::supervisor::tests): 2

a_clone_whose_record_names_a_vmm_that_exited_may_release_its_lease, a_clone_whose_vmm_cannot_be_examined_keeps_its_lease

nvx-rs/src/host/template/plan/tests.rs (host::template::plan::tests): 12

templates_render_their_devices_resources_and_capture_options, templates_keep_the_placeholder_and_the_files_of_their_capture_in_its_transaction, templates_limit_their_processors_online_at_boot_on_their_command_line, the_upper_of_an_adapters_plan_is_a_clones_and_no_part_of_its_template, transaction_directories_are_spelled_with_their_components, openvmms_platform_allowlist_admits_its_tokens_and_refuses_tenant_data, the_command_line_holds_only_tokens_of_openvmms_platform_allowlist, templates_hold_no_tenant_data, templates_refuse_what_no_capture_takes, transaction_directories_must_be_valid_unicode, transaction_directories_must_be_valid_unicode, templates_check_their_inputs_in_order

nvx-rs/src/host/template/store/capture/tests.rs (host::template::store::capture::tests): 23

captures_publish_generations_that_creations_then_serve, captures_limit_the_processors_that_their_class_keeps_offline_at_boot, refreshes_leave_older_generations_and_their_leases_untouched, creations_capture_unless_the_class_has_a_generation_that_restores_take, failures_before_the_check_retire_the_transaction, what_openvmm_leaves_beside_the_snapshot_is_removed, checked_transactions_outlive_failures_until_recovery_publishes_them, publications_interrupted_once_they_renamed_their_envelope_are_completed, recoveries_make_what_they_publish_durable_before_they_index_it, captures_make_the_store_durable_before_they_report_a_generation, creations_recover_the_index_before_they_look_for_a_generation, recoveries_drop_lost_generations_before_they_index_another, creations_make_the_store_durable_before_they_serve_a_generation, recovery_ends_the_captures_that_crashes_interrupt, generations_whose_payloads_are_lost_are_dropped_from_the_index, a_transaction_stays_while_it_records_a_launch, links_and_unsafe_ownership_are_refused_before_the_vm_starts, scratches_are_the_files_that_their_captures_created, no_handle_through_which_the_host_could_write_the_block_devices_is_open_as_the_vm_starts, captures_of_one_class_are_serialized, recoveries_refuse_entries_of_the_captures_that_are_not_slots, stores_too_deep_for_the_control_socket_of_a_capture_are_refused, working_directory_limits_are_checked_before_captures

nvx-rs/src/host/template/store/leases/tests.rs (host::template::store::leases::tests): 44

leases_bind_clones_to_the_generations_that_they_restore, acquisitions_refuse_what_they_cannot_lease_and_lease_nothing, releases_end_leases_once_their_clones_have_exited, a_lease_allows_one_launch_of_its_clone_under_the_lock_that_acquired_it, tombstones_quarantine_generations_and_keep_their_leases, selection_takes_the_latest_eligible_generation_of_a_key, retirement_deletes_a_generation_once_its_leases_drain, retirement_removes_the_leases_that_no_clone_binds, interrupted_retirements_finish, acquisitions_make_their_records_durable_before_their_bindings_and_both_before_they_return, an_acquisition_keeps_its_record_while_its_binding_may_outlast_a_crash, a_release_makes_the_removal_of_its_binding_durable_before_it_removes_its_record, a_retirement_makes_each_step_durable_before_the_next, a_retirement_makes_the_absence_of_a_binding_durable_before_it_removes_its_record, a_lease_names_its_sandbox_by_its_path_with_its_links_resolved, an_acquisition_binds_the_sandbox_that_it_resolved_whatever_its_path_names_meanwhile, a_release_takes_the_lock_of_its_sandbox_through_the_path_of_its_lease, a_release_ends_the_lease_of_the_sandbox_whose_lock_it_holds_whatever_its_path_names_meanwhile, the_payload_of_a_generation_opens_through_no_link, a_release_removes_the_socket_from_the_payload_that_it_opened_whatever_its_path_names_meanwhile, a_sandbox_s_store_removes_the_socket_of_its_clone_through_no_link, a_retirement_that_finds_its_generation_unindexed_makes_the_index_durable_first, a_retirement_keeps_a_tombstone_that_is_not_the_stores, directories_are_synced_where_the_platform_can, records_keep_their_json_form, malformed_records_and_foreign_entries_fail_clearly, the_directories_of_leases_and_tombstones_refuse_links, transaction_role, processes_that_race_to_lease_one_sandbox_lease_it_once, a_tombstone_that_races_acquisitions_in_other_processes_keeps_the_leases_before_it, a_retirement_that_races_acquisitions_and_releases_in_other_processes_waits_for_its_leases, clone_role, vmm_role, a_crash_during_an_acquisition_leaves_no_lease_or_one_that_launches_nothing, a_clone_that_crashes_before_its_spawn_keeps_its_lease_until_its_launch_ends, a_clone_that_crashes_after_its_spawn_keeps_its_lease_until_its_unrecorded_vmm_exits, a_clone_that_crashes_after_recording_its_vmm_keeps_its_lease_until_reattach_ends_it, a_committed_clone_keeps_its_lease_through_a_crash_until_its_vm_stops, a_crash_during_a_release_leaves_a_record_that_a_retirement_removes, only_a_file_that_is_gone_or_whose_deletion_is_pending_was_removed, records_that_refuse_access_are_not_taken_for_removed_ones, records_that_another_transaction_removes_are_gone_for_their_readers, a_release_whose_record_another_transaction_removes_ends_its_lease, a_release_takes_the_files_of_its_sandbox_whose_deletion_is_pending_for_removed

nvx-rs/src/host/template/store/tests.rs (host::template::store::tests): 16

stores_are_created_opened_and_reopened, a_creation_replaces_an_interrupted_one_and_refuses_foreign_entries, concurrent_creations_make_one_store, a_creation_that_another_overtakes_opens_its_store, records_keep_their_json_form, records_of_other_formats_fail_clearly, malformed_indexes_and_those_of_other_stores_are_refused, the_four_namespaces_stay_apart, payloads_are_checked_as_they_are_read, the_index_lock_excludes_other_holders, links_are_refused, records_that_are_not_regular_files_fail_at_once, the_store_is_private_to_the_current_user, private_directories_belong_to_the_current_user_and_grant_others_nothing, the_store_is_private_to_the_current_user, snapshots_that_openvmm_published_are_private_without_entries_for_their_files

nvx-rs/tests/template_capture.rs (template_capture): 7

captures_publish_generations_that_creations_then_serve, refreshes_publish_new_generations_and_leave_the_older_ones, vms_that_end_without_a_capture_publish_nothing, vms_that_never_end_are_torn_down_at_the_deadline, captures_of_one_class_are_serialized, adapter_role, a_vm_that_outlives_its_crashed_adapter_is_ended_by_recovery

Size

Measured against c642f09e (#1507 as merged):

• Core lines: 15 changed, 0 new, each a line that loses or narrows a deleted item: the re-export lists of platform's Linux and Windows modules and of snapshot (4); three imports of Windows' private.rs and privacy_problem's refusal (4); an import of store/lease.rs (1); and 6 lines of store/locked.rs: an import, and 5 of begin_launch, its check of the lease, its message and its choice of the endpoint. The 14 lines that gate rename_no_replace by cli, with the imports that this forces, and the 11 that make store/lease.rs's items crate-private don't count. The counted files lose 192 lines of code, net.
• Counted files: 23, where the estimate says 3, all of which only lose code, imports or doc references: lib.rs, contract.rs, host/mod.rs, host/platform/{linux/{identity,mod,private},other,windows/{mod,private}}.rs, host/sandbox/geometry.rs, host/snapshot.rs, host/snapshot/{key,manifest}.rs, host/store/{files,lease,lifecycle,locked,mod,names,record,regular}.rs and host/supervisor/{launch,mod}.rs. Nine of them change only rustdoc or comments: lib.rs, contract.rs, sandbox/geometry.rs, store/{files,lifecycle,names,record}.rs and supervisor/{launch,mod}.rs. host/sys/mod.rs, which only gates a module by cli, doesn't count, nor do the 10 files that it only deletes.

BOOT_CONTRACT_VERSION and CONTROL_CONTRACT_REVISION don't change.

Left as is

• The sandbox store's remaining handling of a clone binding: begin_launch refuses a launch of a sandbox that holds one, clear_runtime and recovery remove a clone's socket from a template store's payload, and a removal deletes the binding and a clone's files. Nothing writes a binding now, so these paths serve none. The tests of the refusal and of the socket's removal went through the template store's acquisitions and releases, and retire with it; the removal's own tests stay. This PR adds no tests for these paths: SL6.1 deletes them next, with the sandbox store, the last store types, TemplateReference, StoreGeneration and activation::Identity, and KeyIdentity's conversions to and from the last.
• The error codes template-ineligible and template-tombstoned, which nothing produces now, and the docs of sandbox-leased and foreign-files, which name the template store: nvx-rs slimming 4.3.3: the error codes are private #1126 deletes the codes that nothing produces once ErrorCode becomes crate-private.
• The fake OpenVMM's capture of a template, fake-openvmm-capture.json, which only the deleted tests drove, and the README's paragraph on it: the fake stays as it is in this group.
• port_forward_socket_creation.rs, the excerpt of OpenVMM's port-forward error that only the old clone path read, which tests/openvmm_vectors.rs still compares with the submodule.
• host::snapshot's pub(super) modules eligibility, key and manifest, which SL2.12a opened to host for host::template's re-export of them: nothing outside host::snapshot names them now, but no warning-denied build flags them, and narrowing them would change retained snapshot code, as would the rustdoc of host::snapshot that still calls a snapshot's capture a template's.

Not in this PR

Rewriting, refactoring or improving retained snapshot or time code; moving template-store leases, transactions or plans to another owner; a replacement template store or compatibility layer; changing TimeContract::eligibility; deleting the sandbox store or the supervisor (SL6.1); and the module diagrams, which CI draws.

Validation

The head, 2c003308, is 2a3dd31e rebased onto c642f09e, #1507 as merged, without conflicts: git range-diff shows the same patch, and the TemplatePlan and Store doc tests that its case-matrix rows retire are at the same lines, 137 and 473, at the tip. On it, locally on Windows, cargo fmt --check, the seven Clippy sets of the table below for Windows and for --target x86_64-unknown-linux-gnu, cargo doc, public_api.py, check_test_layout.py, SL5.2's case-matrix check against 99d2022085f, and the lib tests, 1278 with all features (13 ignored) and 1017 by default (7 ignored), passed; on nvx-mshv-test, cargo fmt --check, Clippy --all-targets --all-features and --lib, the lib tests, 2122 with all features (55 ignored) and 997 by default (7 ignored), and public_api.py passed. CI runs on it.

On 2a3dd31e, which is a6fcf24d rebased onto 993f80a7, #1507's head once #1499 (SL5.2) merged, with Rust 1.95.0 and NVX_BUNDLE=skip, locally on Windows and on nvx-mshv-test (Azure Linux 3, kernel 6.18, linux-mshv, virtual machine), in a temporary worktree:

Check	Windows	Linux
cargo fmt --all --check	passed	passed
Clippy -D warnings: --all-targets --all-features, --lib, --lib --no-default-features, --lib --no-default-features --features serde, --lib --bins --features cli, --lib --bins --no-default-features --features testing, and --all-targets	passed, and for --target x86_64-unknown-linux-gnu	passed
RUSTDOCFLAGS=-D warnings cargo doc --locked --no-deps --all-features	passed	passed
python scripts/public_api.py (both snapshots)	passed: each snapshot lacks the base's 222 items of nvx::host::template, and differs in nothing else	passed
python scripts/check_test_layout.py	passed	passed
python scripts/check_markdown_links.py	passed
cargo +1.89 check --locked --all-targets --all-features (MSRV)		passed
cargo check --locked --all-targets --all-features --target aarch64-apple-darwin	passed	passed
cargo test --locked --all-features	passed: lib 1278 (13 ignored), cli 110, every other target, doc tests 11	with --no-fail-fast, three runs: lib 2121 (55 ignored) of 2176 tests, where the base's lib lists 2265 (58 ignored), every other target and doc tests 31 passed in each; cli passed 118 of 119 in the first, the other a timing failure (below), and 119 in the next two
cargo test --locked	passed: lib 1017 (7 ignored), every other target, doc tests 11	passed: lib 997 (7 ignored), every other target, doc tests 11
cargo build --locked --lib --no-default-features, cargo test --locked --lib --no-default-features	passed: 283	passed: 283
cargo test --doc --all-features -- --list	11 doc tests, each at the line that its case-matrix row names	31 doc tests, each at the line that its case-matrix row names
cargo test --locked --no-default-features --test openvmm_vectors -- --ignored, with the OpenVMM submodule at its pin	passed: 3
python3 scripts/nvx.py check-guest-binaries --toolchain 1.95.0 (Clippy and tests of the guest feature for the guests' target)		passed

The rebase had three conflicts, all with #1489 (SL3.8b), which deleted the crate-private read_attachments: host/template/mod.rs, whose re-export of it #1489 dropped, stays deleted; host/cli/run.rs keeps the base's imports, so this PR no longer edits it; and nvx-rs/README.md's nvx::host::template section stays deleted, while its paragraph on the manifest reader, which moves to nvx::host::snapshot's section, loses the sentence on the attachments that run's restores read, as #1489 dropped it from the section. The other files, the case matrix among them, merged without conflicts. What this PR deletes is still unused at the base, and cli/run.rs, cli/snapshots.rs and the restore code compile without host::template.

On nvx-mshv-test, tests/cli.rs's one_shot::forwarding_failure_stops_the_verified_vm_during_connect_and_handshake failed once, in the first full run: its connect phase passed, but in its handshake phase the CLI took longer than the test's 3-second bound to exit once the test had closed its output, and the test reported "foreground cancellation waited for an attachment timeout". This PR changes neither host::cli nor tests/cli. The test then passed 20 times alone and in 5 runs of the whole cli target, both at this head and at the base, and in the two later full runs. tests/supervisor.rs's vmms_inherit_only_their_streams_and_allowed_descriptors_while_others_spawn, which failed once for #1507 on a loaded host, passed in every run.

Before the rebase, 7c4e7773 passed the same checks on #1507's previous head, 6065e736; a6fcf24d, which changed only docs, comments and begin_launch's refusal message for the review below, passed Clippy, cargo doc, the doc-test list and the tests of host::{store, supervisor} again, and Copilot reviewed it without comments.

A code-review agent reviewed the whole diff. Its findings that this head folds in: the store's and the README's docs, and begin_launch's message, still described the reserved launch of a lease, and the crate's docs, SnapshotKey::VERSION's, design doc 1.5 and the vectors README still named the template store, or said that no test reads the port-forward excerpt, which the comparison with the submodule reads. Its finding that the sandbox store's remaining lease paths lose their tests is answered under "Left as is".

No microVM scenario ran: no runtime path changes. What nvx-rs run, sandbox and snapshot run doesn't use the template store, and the edits to code that they use only remove what nothing calls, or gate by cli what only the CLI calls. Left to CI: the bundled-artifact check and the build of the guest binaries, which this change doesn't reach, and the hypervisor jobs.

Changes to existing tests (tests-modified)

Besides the removals above, each change only drops or replaces what used a deleted item:

• host::supervisor::tests: the helpers committed_clone and refuses_release, and the constant CONFIG, go: they leased a generation from a template store. a_reattach_whose_caller_cannot_record_an_exit_keeps_the_record_until_one_can, only_a_stop_unless_exited_keeps_the_record_of_a_vmm_that_had_exited and a_stop_unless_exited_stops_a_running_vmm_as_a_stop_does now record their VM in a sandbox store of their own, as the module's other tests do, and drop their checks of the lease: each check that the store refused to release the lease becomes a check that the runtime record stays, which the refusal implied, the final release goes, and the first test checks the recorded launch by its identity. a_clone_whose_forced_teardown_fails_keeps_its_lease_until_one_ends_its_vmm does the same, renamed a_forced_teardown_that_fails_keeps_the_record_until_one_ends_the_vmm, since no clone or lease is left in it. The module's imports lose the template store's.
• host::snapshot::key::tests::the_guest_build_is_not_part_of_a_snapshot_key and keys_with_the_removed_guest_build_field_are_refused: drop their assertions on the TemplateKey alias, which leaves; the same assertions on SnapshotKey stay.
• host::restore::tests::live_init's helper run and imports: read the snapshot's manifest with SnapshotManifest::read, the type that the TemplateManifest alias named.
• host::snapshot::tests::SnapshotFixture::new: creates the snapshot's directories with platform::create_store_dir, which create_owner_only_dir called on Windows, and which on Linux creates them with the same mode, 0700, and checks them at least as strictly.
• host::vm_directory::tests::an_existing_directory_that_is_not_private_is_refused_and_left_unchanged (Linux): drops its assertion that platform::check_owner_only_dir, the template store's owner-only policy, accepts the mode 0500 that a VM directory refuses, which the change that added it made to show that the store's policy stayed as it was. The function stays for check_snapshot_dir, but nothing outside platform names it now.
• host::platform::windows::private::tests::renames_support_long_paths_without_replacing_existing_files and invalid_paths_do_not_create_or_rename_their_prefix: compile only with cli, as rename_no_replace now does. CI's --all-features runs still run them.
• host::platform::tests and host::platform::linux::tests: their imports lose owner_only_problem, which only the template store's tests used.

[github-actions]

This pull request changes existing tests

It modifies or removes 356 existing test asset(s), listed below. Review each with care: a change to a test can hide a regression that the test caught. See doc/contribute.md#changes-to-existing-tests.

Test code

Change	What	Before	After
modified helper	fn run in host::restore::tests::live_init (only the paths that it names changed)	nvx-rs/src/host/restore/tests/live_init.rs:161	nvx-rs/src/host/restore/tests/live_init.rs:161
modified helper	fn new in host::snapshot::tests, impl SnapshotFixture``	nvx-rs/src/host/snapshot/tests.rs:1012	nvx-rs/src/host/snapshot/tests.rs:1012
modified imports	the imports of host::platform::linux::tests	nvx-rs/src/host/platform/linux/tests.rs:1	nvx-rs/src/host/platform/linux/tests.rs:1
modified imports	the imports of host::platform::tests	nvx-rs/src/host/platform/tests.rs:2	nvx-rs/src/host/platform/tests.rs:2
modified imports	the imports of host::restore::tests::live_init	nvx-rs/src/host/restore/tests/live_init.rs:1	nvx-rs/src/host/restore/tests/live_init.rs:1
modified imports	the imports of host::supervisor::tests	nvx-rs/src/host/supervisor/tests.rs:4	nvx-rs/src/host/supervisor/tests.rs:4
modified test	fn renames_support_long_paths_without_replacing_existing_files in host::platform::windows::private::tests (moved, and it now compiles where feature = "cli" and feature = "host" and test and windows hold, not where feature = "host" and test and windows did)	nvx-rs/src/host/platform/windows/private/tests.rs:45	nvx-rs/src/host/platform/windows/private/tests.rs:46
modified test	fn invalid_paths_do_not_create_or_rename_their_prefix in host::platform::windows::private::tests (moved, and it now compiles where feature = "cli" and feature = "host" and test and windows hold, not where feature = "host" and test and windows did)	nvx-rs/src/host/platform/windows/private/tests.rs:64	nvx-rs/src/host/platform/windows/private/tests.rs:66
modified test	fn the_guest_build_is_not_part_of_a_snapshot_key in host::snapshot::key::tests	nvx-rs/src/host/snapshot/key/tests.rs:348	nvx-rs/src/host/snapshot/key/tests.rs:348
modified test	fn keys_with_the_removed_guest_build_field_are_refused in host::snapshot::key::tests	nvx-rs/src/host/snapshot/key/tests.rs:728	nvx-rs/src/host/snapshot/key/tests.rs:724
modified test	fn a_reattach_whose_caller_cannot_record_an_exit_keeps_the_record_until_one_can in host::supervisor::tests	nvx-rs/src/host/supervisor/tests.rs:620	nvx-rs/src/host/supervisor/tests.rs:571
modified test	fn a_clone_whose_forced_teardown_fails_keeps_its_lease_until_one_ends_its_vmm in host::supervisor::tests (renamed to a_forced_teardown_that_fails_keeps_the_record_until_one_ends_the_vmm)	nvx-rs/src/host/supervisor/tests.rs:722	nvx-rs/src/host/supervisor/tests.rs:625
modified test	fn only_a_stop_unless_exited_keeps_the_record_of_a_vmm_that_had_exited in host::supervisor::tests	nvx-rs/src/host/supervisor/tests.rs:763	nvx-rs/src/host/supervisor/tests.rs:667
modified test	fn a_stop_unless_exited_stops_a_running_vmm_as_a_stop_does in host::supervisor::tests	nvx-rs/src/host/supervisor/tests.rs:799	nvx-rs/src/host/supervisor/tests.rs:702
modified test	fn an_existing_directory_that_is_not_private_is_refused_and_left_unchanged in host::vm_directory::tests	nvx-rs/src/host/vm_directory/tests.rs:60	nvx-rs/src/host/vm_directory/tests.rs:60
removed attributes	the inner attributes of host::template::plan::tests	nvx-rs/src/host/template/plan/tests.rs:1
removed attributes	the inner attributes of host::template::plan::tests::openvmm	nvx-rs/src/host/template/plan/tests.rs:25
removed attributes	the inner attributes of host::template::plan::tests::openvmm::openvmm_defs	nvx-rs/src/host/template/plan/tests.rs:27
removed attributes	the inner attributes of host::template::plan::tests::openvmm::openvmm_defs::microvm	nvx-rs/src/host/template/plan/tests.rs:29
removed attributes	the inner attributes of host::template::store::capture::tests	nvx-rs/src/host/template/store/capture/tests.rs:1
removed attributes	the inner attributes of host::template::store::leases::tests	nvx-rs/src/host/template/store/leases/tests.rs:1
removed attributes	the inner attributes of host::template::store::leases::tests::windows	nvx-rs/src/host/template/store/leases/tests.rs:2735
removed attributes	the inner attributes of host::template::store::tests	nvx-rs/src/host/template/store/tests.rs:1
removed attributes	the inner attributes of template_capture (tests)	nvx-rs/tests/template_capture.rs:1
removed attributes	the inner attributes of template_capture/windows (tests)	nvx-rs/tests/template_capture.rs:629
removed helper	const CONFIG in host::supervisor::tests	nvx-rs/src/host/supervisor/tests.rs:32
removed helper	fn committed_clone in host::supervisor::tests	nvx-rs/src/host/supervisor/tests.rs:94
removed helper	fn refuses_release in host::supervisor::tests	nvx-rs/src/host/supervisor/tests.rs:130
removed helper	macro include in host::template::plan::tests::openvmm::openvmm_defs::microvm	nvx-rs/src/host/template/plan/tests.rs:30
removed helper	macro include in host::template::plan::tests::openvmm	nvx-rs/src/host/template/plan/tests.rs:34
removed helper	fn admits in host::template::plan::tests::openvmm	nvx-rs/src/host/template/plan/tests.rs:37
removed helper	const GIB in host::template::plan::tests	nvx-rs/src/host/template/plan/tests.rs:43
removed helper	const IDENTITY in host::template::plan::tests	nvx-rs/src/host/template/plan/tests.rs:46
removed helper	const PLACEHOLDER in host::template::plan::tests	nvx-rs/src/host/template/plan/tests.rs:49
removed helper	const CLONE_SCRATCH in host::template::plan::tests	nvx-rs/src/host/template/plan/tests.rs:56
removed helper	const TRANSACTION in host::template::plan::tests	nvx-rs/src/host/template/plan/tests.rs:63
removed helper	const SCRATCH in host::template::plan::tests	nvx-rs/src/host/template/plan/tests.rs:70
removed helper	const DESTINATION in host::template::plan::tests	nvx-rs/src/host/template/plan/tests.rs:77
removed helper	const GENERATION in host::template::plan::tests	nvx-rs/src/host/template/plan/tests.rs:84
removed helper	const OPTIONS in host::template::plan::tests	nvx-rs/src/host/template/plan/tests.rs:87
removed helper	fn erofs in host::template::plan::tests	nvx-rs/src/host/template/plan/tests.rs:105
removed helper	fn gpt in host::template::plan::tests	nvx-rs/src/host/template/plan/tests.rs:110
removed helper	fn binding_of in host::template::plan::tests	nvx-rs/src/host/template/plan/tests.rs:115
removed helper	fn binding in host::template::plan::tests	nvx-rs/src/host/template/plan/tests.rs:137
removed helper	fn adapter_with in host::template::plan::tests	nvx-rs/src/host/template/plan/tests.rs:142
removed helper	fn adapter_at in host::template::plan::tests	nvx-rs/src/host/template/plan/tests.rs:152
removed helper	fn adapter in host::template::plan::tests	nvx-rs/src/host/template/plan/tests.rs:162
removed helper	fn network in host::template::plan::tests	nvx-rs/src/host/template/plan/tests.rs:167
removed helper	fn outbound in host::template::plan::tests	nvx-rs/src/host/template/plan/tests.rs:172
removed helper	fn listening in host::template::plan::tests	nvx-rs/src/host/template/plan/tests.rs:179

... and 306 more, which the job's summary lists.

Relocated unchanged: 0; added: 0. Compared the merge base c642f09e5ed6 with 2c0033083c35.

[Copilot]

🟢 Approval recommended

There are no active review issues for the legacy template-store removal.

No open issues 🎉

What changed in this PR

This PR implements SL6.2a of #1121, removing the legacy template store after the old clone path’s deletion in #1507. It advances NVX’s move toward caller-owned state while preserving snapshot metadata and TimeContract::eligibility.

Changes:

• Deletes the template module, store-only planning surface, aliases, and obsolete tests.
• Removes unused private helpers, updates remaining imports, and gates rename helpers behind cli.
• Updates API snapshots, documentation, and test-retirement records.

File	Description
nvx-rs/​tests/​vectors/​README.md	Updates vector ownership and compatibility documentation.
nvx-rs/​tests/​template_capture.rs	Deletes template-store capture integration tests.
nvx-rs/​tests/​openvmm_vectors.rs	Corrects documentation of excerpt consumers.
nvx-rs/​src/​lib.rs	Removes template-store references from crate documentation.
nvx-rs/​src/​host/​vm_directory/​tests.rs	Drops an assertion on the removed platform re-export.
nvx-rs/​src/​host/​template/​plan.rs	Deletes template capture planning and resource types.
nvx-rs/​src/​host/​template/​mod.rs	Deletes template exports, aliases, and eligibility adapter.
nvx-rs/​src/​host/​sys/​mod.rs	Gates Linux rename support behind cli.
nvx-rs/​src/​host/​supervisor/​tests.rs	Removes lease-only tests and preserves runtime-record checks.
nvx-rs/​src/​host/​supervisor/​mod.rs	Removes template-store lifecycle documentation.
nvx-rs/​src/​host/​supervisor/​launch.rs	Updates launch documentation for lease refusal.
nvx-rs/​src/​host/​store/​tests.rs	Removes the deleted clone-file helper’s test.
nvx-rs/​src/​host/​store/​regular.rs	Deletes the unused file-identity helper.
nvx-rs/​src/​host/​store/​record.rs	Removes lease-acquisition references from launch-ID documentation.
nvx-rs/​src/​host/​store/​names.rs	Removes deleted lease-release references from file documentation.
nvx-rs/​src/​host/​store/​mod.rs	Removes the reservation export and obsolete documentation.
nvx-rs/​src/​host/​store/​locked.rs	Deletes reservation helpers and rejects all leased launches.
nvx-rs/​src/​host/​store/​lifecycle/​tests.rs	Removes a test of the deleted clone-file removal helper.
nvx-rs/​src/​host/​store/​lifecycle.rs	Removes lease-release comparisons from removal documentation.
nvx-rs/​src/​host/​store/​lease.rs	Deletes unused lease APIs and narrows remaining visibility.
nvx-rs/​src/​host/​store/​files.rs	Removes template-store documentation references.
nvx-rs/​src/​host/​snapshot/​tests.rs	Uses the retained private-directory creation helper.
nvx-rs/​src/​host/​snapshot/​manifest.rs	Removes the internal TemplateManifest alias.
nvx-rs/​src/​host/​snapshot/​key/​tests.rs	Drops assertions on the deleted TemplateKey alias.
nvx-rs/​src/​host/​snapshot/​key.rs	Removes the alias and updates compatibility documentation.
nvx-rs/​src/​host/​snapshot.rs	Removes the unused check_exit re-export.
nvx-rs/​src/​host/​sandbox/​geometry.rs	Removes documentation of the template re-export.
nvx-rs/​src/​host/​restore/​tests/​live_init.rs	Uses SnapshotManifest directly.
nvx-rs/​src/​host/​platform/​windows/​private/​tests.rs	Gates rename tests behind cli.
nvx-rs/​src/​host/​platform/​windows/​private.rs	Deletes store-only privacy helpers and gates renaming.
nvx-rs/​src/​host/​platform/​windows/​mod.rs	Updates private exports and rename gating.
nvx-rs/​src/​host/​platform/​tests.rs	Removes the unused owner-only test re-export.
nvx-rs/​src/​host/​platform/​other.rs	Deletes unused stubs and gates renaming.
nvx-rs/​src/​host/​platform/​linux/​tests.rs	Removes the unused owner-only helper re-export.
nvx-rs/​src/​host/​platform/​linux/​private.rs	Deletes store-only helpers and gates renaming.
nvx-rs/​src/​host/​platform/​linux/​mod.rs	Removes unused exports and gates the rename export.
nvx-rs/​src/​host/​platform/​linux/​identity.rs	Deletes the unused directory-policy helper.
nvx-rs/​src/​host/​mod.rs	Removes the template module declaration and documentation.
nvx-rs/​src/​host/​cli/​run.rs	Imports attachment reading directly from snapshot metadata.
nvx-rs/​src/​contract.rs	Updates documentation to name SnapshotKey.
nvx-rs/​README.md	Removes store documentation and relocates retained snapshot details.
nvx-rs/​public-api/​windows.txt	Removes the template public API entries.
nvx-rs/​public-api/​linux.txt	Removes the template public API entries.
doc/​design/​5.3-snapshot-protocol.md	Removes the template-store deadline example.
doc/​design/​1.5-compatibility-and-versioning-model.md	Describes unsupported keys without referencing a template store.
doc/​acceptance-case-matrix.md	Records retired doctests and updates retained test locations.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues remain for the legacy template-store removal.

No open issues 🎉

_{Review effort: Balanced}