[Pedro Henrique Penna (ppenna)]

What and why

On Windows, Sandbox::new, which creates the directory of each VM test of the
runtime adapter, can panic with Access is denied. (os error 5) before its
test launches anything. It names each sandbox runtime-adapter-NAME-PID-N
after the first N that no directory takes, so tests that share a scenario
name reuse the names that the others free: vm_clone shares 15 names among
its 37 tests, such as cl-r, which 6 of them use. Windows keeps the name of a
directory that remove_dir_all is deleting until the deletion completes, and
until then refuses to create a directory under it with ERROR_ACCESS_DENIED,
not ERROR_ALREADY_EXISTS, which Sandbox::new takes for a failure.

On feature/nvx-refactor, whose sandbox names leave out the scenario's name
since 07d16d0 (#1432), every test of a binary shares them, and the race
failed the Windows/WHP runtime adapter job of run 42896649941. CI
hasn't hit it on dev: of the 9 Windows/WHP runtime adapter jobs that failed
in the last 14 days, only that one failed this way.
#1463 fixes feature/nvx-refactor the same way.

Each sandbox of a test process now takes N from a process-wide counter, so a
process never takes the name of a sandbox that it created, while a name that
another process left still counts as taken. The directory's format stays as
it is.

• tests/runtime-adapter/tests/common/mod.rs: Sandbox::new takes N from
  NEXT_SANDBOX.
• tests/runtime-adapter/tests/sandbox_names.rs: a new host-only test, which
  boots nothing, drops a sandbox and checks that the next one of the same name
  takes another name. Before the fix, both took
  runtime-adapter-names-16820-0.
• tests/runtime-adapter/README.md: describes the new test.

On Linux, the absolute path of a template store must stay within 55 bytes for
its clones' sockets, generations/1/LAUNCH.sock, and within 56 for a
capture's. A test binary creates a few hundred sandboxes at most, so the
counter adds at most two digits: with a seven-digit PID below /tmp, the
longest template store grows from 48 to 49 bytes.

Validation

On Windows 11 (NTFS), without a hypervisor:

• Reproduction, with a temporary test that this pull request doesn't add: 8
  threads that create and drop sandboxes named cl-r through common::Sandbox
  for 20 s. Before the fix, 55 of 12,470 creations failed with cannot create ...\runtime-adapter-cl-r-9668-1: Access is denied. (os error 5); after it,
  0 of 13,068.
• cargo test --locked --features host --test sandbox_names, in
  tests/runtime-adapter: failed before the fix, passed after it.
• python scripts/local_gates.py --base origin/dev --run --keep-going --only test-changes markdown-links test-layout nvx-rs-adapter-protocol nvx-rs-adapter-host: all 5 passed.
• In tests/runtime-adapter, with Rust 1.95.0: cargo fmt --all --check;
  cargo clippy --locked --all-targets -- -D warnings, cargo build --locked, cargo test --locked, and RUSTDOCFLAGS="-D warnings" cargo doc --locked --no-deps, each also with --features host; and cargo clippy
  and cargo doc with --features guest --target x86_64-unknown-linux-musl.
  With Rust 1.89, cargo check --locked --all-targets, also with --features host. All passed.
• python -m unittest scripts.test_nvx_tools.RuntimeAdapterSuiteTests -v: 13
  passed.

Left to CI: the runtime adapter's VM scenarios on Windows/WHP, Linux/KVM, and
Linux/MSHV, which create their sandboxes through Sandbox::new; the
guest-only build, tests, and MSRV check on Linux; and the rest of the
nvx-rs and NVX CLI gates that local_gates.py selects, though this changes
neither nvx-rs/ nor scripts/.

python scripts/check_test_changes.py --base origin/dev lists one change to
an existing test: the Sandbox::new helper in
tests/runtime-adapter/tests/common/mod.rs. It still creates a directory of
its own for each sandbox, skips a name that exists, and panics on any other
error; only its choice of N changed, from the first number that no
directory takes to the next of the process's counter. No assertion, timeout,
or ignored test changed.

[github-actions]

This pull request changes existing tests

It modifies or removes 1 existing test asset(s), listed below. Review each with care: a change to a test can hide a regression that the test caught. See doc/contribute.md#changes-to-existing-tests.

Test code

Change	What	Before	After
modified helper	fn new in common/mod (tests), impl Sandbox``	tests/runtime-adapter/tests/common/mod.rs:152	tests/runtime-adapter/tests/common/mod.rs:157

Relocated unchanged: 0; added: 5. Compared the merge base 1c25bb4837d2 with d5abc5f9d3c2.

[Copilot]

🟢 Approval recommended

No active review issues are recorded for the change to prevent sandbox-name reuse within a test process.

No open issues 🎉

What changed in this PR

This PR prevents runtime-adapter tests from reusing sandbox directory names within a test process, avoiding Windows access-denied failures while a previously used directory is still being deleted.

Changes:

• Allocate sandbox names using a process-wide atomic counter while preserving the name format and handling of existing directories.
• Add a host-only regression test that verifies a dropped sandbox’s name is not reused.
• Document the new regression test.

File	Description
tests/​runtime-adapter/​tests/​sandbox_names.rs	Adds a name-reuse regression test that requires no hypervisor.
tests/​runtime-adapter/​tests/​common/​mod.rs	Uses an atomic counter to assign distinct sandbox names within each process.
tests/​runtime-adapter/​README.md	Describes the new test and the Windows deletion race it guards against.

_{Review effort: Balanced}