[Enrique Saurez (esaurez)]

Scope

Adds nvx-rs snapshot capture NAME --store-dir PATH for the SL3.7b BLOCKLESS
capture consumer. This is a partial contribution to
#1114; the whole issue is NOT_COMPLETE.

The command emits exactly one nvx_sandbox=1 selector and composes existing
boot.capture, the ordinary durable launch journal, authenticated NVXC capture,
the same held process's actual exit proof, finish_capture, and immutable named
publication of exactly key.bin, snapshot.json, and openvmm/.
Timeouts and non-interrupted control/record failures stop the verified VM without
finalizing. Interrupted attempts are ended, never resumed or published, by the
next capture on that store. Unknown/unjournaled data and indeterminate evidence
are retained. Exact host/native atomic staging names are accepted only in a
journaled slot, and deletion still requires successful verified recovery.

Rebase onto feature/nvx-refactor

#1455, #1453 and #1441 merged, so every input that #1459 joined is in feature/nvx-refactor, and this pull request now targets that branch instead of #1459's. Its nine own commits are rebased onto 394c89025ecd384f814165bfa848407dcd10010c as d83488a45e..9761cdf4fcc24386d361d0c2f7966ca424a2104e (tree 7daf190aa98aace2d7838c25b5d1b4c58d56ebf0). The merge commit 8d288a9c, which adopted #1459's checkpoint d814df2e, is dropped: git show --remerge-diff 8d288a9c shows no change of its own, and the checkpoint's inputs are in the base. git range-diff d814df2e03..3e791f4bd4 394c89025e..9761cdf4fc reports eight of the nine patches identical. The first, Add journaled named snapshot capture command, also sets memory_capacity_mib: None in the capture VM's Boot in nvx-rs/src/host/cli/snapshots/capture.rs: #1441 added that field, and the capture keeps booting with its boot memory alone. check_test_changes.py --base origin/feature/nvx-refactor reports the same 3 changed existing items and 41 added items as below.

Rechecked on Windows at this tree, with the commands of check-nvx-rs where they apply: rustfmt; Clippy with -D warnings for --all-targets --all-features, --lib, --lib --no-default-features, --lib --bins --features cli and --lib --bins --no-default-features --features testing, and for --all-targets --all-features and --lib --bins --features cli on x86_64-unknown-linux-musl; cargo +1.89 check --all-targets --all-features; rustdoc with -D warnings; cargo test --locked --all-features, also in a process that ignores Ctrl-C, as the CI runner's Windows step does; scripts/public_api.py; the test layout; and Markdown links. CI runs the full matrix on this head, including the real-VM jobs that the limits below leave out.

Inputs and size

Before the rebase above, a dependent Draft above #1459:
d814df2e0358ce17f86c45f71a8b1b7f8048eff2
(tree 0562032829106a4ac9c0bb8a11de0a9ab3156bb9).
That published input joins the original b70d7e98 with public full-TimeContractB
source d4d89270; it was adopted once by ordinary merge. Native source remains
14dc4116ec7e57567633c4b7b07892aca3a58522. No producer/public-API/native changes.
The ultimate target remains feature/nvx-refactor, not dev.

Actual production is 463 nonblank added/changed lines in five files.
The conservative count is 465, excluding only the two pure test-module
declarations at capture.rs:486-487; deletions do not offset additions.
The original 440-line stop was explicitly extended to at most 470 only for the
bounded atomic-staging recovery fix (26 gross new production lines, same files).

Checks and review

At head 3e791f4bd44cefcc359213c7145271d90ee11df0
(tree 389661f7134e9695c7ec694f94794d8fdec63b13), scoped checks passed on approved
Linux and Windows SSH hosts with initialized exact native Git/source metadata and
scripts/nvx.py verify before Cargo: formatting; CLI build/help; warning-denied
host/default/no-default/CLI Clippy; runtime-adapter build/Clippy; Rust 1.89 checks;
test layout/accounting; Markdown links.

Focused results: 10 fake-backed capture cases, 5 CLI unit cases, the exact
top-level usage case, 15 Linux/14 Windows existing store/recovery cases, and
4 adapter cases. Two ignored helper entries are explicitly self-invoked owned
subprocesses, not hardware-VM proof. The planted atomic-output regression was
actually RED at test-first ea6b1b0e (unowned temporary, VM still running), then
GREEN here. The earlier Windows 8d288a9c failure is retained, not relabeled.
Final read-only Opus 5.5/max/long-context logical review found no new issues and
confirmed all three findings resolved.

Existing test changes

tests-modified applies to three existing items: top-level CLI usage/choice
expectations append snapshot while retaining all previous error/status
assertions; ControlSession::capture's dead-code guard now includes its real CLI
caller; the obsolete snapshots-module dead-code hook and its allowance are
removed. Accounting reports 3 existing changes, 41 added items, no test
retirements or relocations. New cases retain the interruption barrier and actual
Exited assertions and add deterministic staging/near-miss/ownership checks.

Limits

No real VM/backend capture, guest/native build, restore matrix, or full CI was
executed. Earlier local Windows observations were unapproved/incidental and are
not qualification evidence. Software/fake-backed checks are not VM proof.
The inherited lower-layer selector-validation gaps and other producer findings
remain their owners' work; this caller supplies a valid selector. Public
TimeContractB source is consumed, not reimplemented or fully hardware-qualified.
Restore 3.8, persistent lifecycle, GPT/provision migration, and remaining issue
1114 supporting contracts are outside this consumer. No native stack mutation or issue
closure is part of this pull request, which is now ready for review.

[github-actions]

This pull request changes existing tests

It modifies or removes 3 existing test asset(s), listed below. Review each with care: a change to a test can hide a regression that the test caught. See doc/contribute.md#changes-to-existing-tests.

Test code

Change	What	Before	After
modified hook	the test hooks of fn capture in host::session (impl ControlSession)	nvx-rs/src/host/session.rs:177	nvx-rs/src/host/session.rs:174
modified test	fn top_level_usage_errors_exit_with_status_2 in cli (tests)	nvx-rs/tests/cli.rs:2384	nvx-rs/tests/cli.rs:2384
removed hook	the test hooks of host::cli::snapshots	nvx-rs/src/host/cli/snapshots.rs:1

Relocated unchanged: 0; added: 41. Compared the merge base 394c89025ecd with 9761cdf4fcc2.

[Copilot]

🔵 Needs a closer look

Fake-backed tests leave real-VM capture and destructive launch recovery unqualified, requiring maintainer judgment on whether end-to-end capture and interruption/recovery validation is needed before landing.

No open issues 🎉

What changed in this PR

Adds nvx-rs snapshot capture NAME --store-dir PATH as the SL3.7b capture portion of #1114, using existing VM, launch-journal, and named-snapshot APIs. Restore remains out of scope.

Changes:

• Adds blockless capture through authenticated NVXC, requiring the producing VM’s timely exit before finalization and immutable publication.
• Handles timeout cleanup and interrupted-capture recovery while preserving unknown content and indeterminate evidence.
• Adds fake-backed capture tests, updates CLI expectations, and documents usage and recovery behavior.

File	Description
scripts/​test-layout-allowlist.json	Removes the obsolete snapshot-module allowance.
nvx-rs/​tests/​cli.rs	Adds snapshot to existing CLI usage expectations.
nvx-rs/​src/​host/​session.rs	Updates the capture dead-code guard for its CLI caller.
nvx-rs/​src/​host/​cli/​snapshots/​capture/​tests.rs	Adds fake-backed publication, timeout, interruption, and recovery tests.
nvx-rs/​src/​host/​cli/​snapshots/​capture.rs	Implements capture parsing, orchestration, publication, and cleanup.
nvx-rs/​src/​host/​cli/​snapshots.rs	Exposes the capture module and removes its obsolete dead-code guard.
nvx-rs/​src/​host/​cli/​sandbox/​mod.rs	Allows capture to reuse artifact-root handling.
nvx-rs/​src/​host/​cli/​mod.rs	Registers and dispatches the snapshot command.
nvx-rs/​README.md	Summarizes the capture command and links to usage details.
doc/​usage.md	Documents capture options, publication guarantees, and recovery behavior.

_{Review effort: Balanced}