[Enrique Saurez (esaurez)]

Part of #1103

SL2.18b completes the failure facts returned by host::restore::RestoreMachine.
It builds on #1347 and adds phase, policy-free attribution, evidence, whether
guest code may have run, a diagnostic message, and the original error source
to RestoreError.

Attribution follows the existing clone failure rules, without adopting their
records, quarantine, teardown or retry policy. Only an outcome report already
supplied by the caller is classified; the machine performs no I/O.

guest_may_have_run conservatively becomes true after the existing Spawned
input and remains true through reconnects and failure. It does not prove
execution, imply that the VM remains alive, or claim that a workload started.
Display retains the phase/evidence-only projection; the complete diagnostic
message and original boxed cause remain separately available.

RestoreAction::Fail leaves the process, session and storage with the caller.
Success still ends at Ready without sending mappings or Start. The existing
listener, legacy clone implementation and runtime adapter are unchanged.

Tests

Three existing tests are extended, with their incoming checks preserved:

• restore_machine_checks_the_transaction_and_refuses_a_cold_record retains
  transaction refusal and now distinguishes an invalid initial activation
  request from an unknown protocol failure, including attribution and the
  pre-spawn guest-execution fact.
• restore_machine_keeps_operation_phase_evidence_and_original_source retains
  the caller's exact phase, evidence and source identity, including the
  no-cause-duplication Display check, and adds the remaining failure facts.
• restore_machine_expiry_cancellation_and_exit_fail_every_pending_phase
  retains every pending-phase and terminal-absorption assertion and adds
  attribution, guest-execution possibility, message and source checks.

Five new tests cover all attribution classes, guest report categories and
status bounds, sticky pre/post-spawn facts, full cause-chain messages with
original source identity, and real running/exited child-process ownership.
The cause-chain test's Display expectation follows the existing separation
between concise Display text and the detailed message.

No tests are retired. Existing activation-write, combined Ready, queued
session-loss, transaction and peer-verified listener coverage is preserved.

API and size

Adds Attribution and the remaining RestoreError fields, plus policy-free
evidence classes. The generated Linux and Windows public API snapshots each
record 31 added items.

The entire four-commit owned range above
a876ab5826488cc8e9fb7506979233bf130f45db measures 140 core lines in
1 counted file, 4 raw paths, with no ownership or visibility discounts.
The public-parent alignment preserves all four patches and the entire
previously qualified source tree.

Validation

Applicable check	Windows	Linux
Complete restore module, including real process ownership	17 passed	19 passed
Formatting and all five warning-denied Clippy feature configurations	Passed	Passed
Warning-denied documentation and Rust 1.89 all-target/all-feature check	Passed	Passed
Generated Linux and Windows public API comparison	Passed	Passed
Test layout and exact-parent test-change inventory	Passed	Passed

The macOS all-target/all-feature cross-check passed with existing warnings in
unchanged legacy test files. An earlier run exposed a conflicting Display
assertion; the corrected complete restore selection passed without weakening
message, original-source or incoming assertions.

Independent read-only review found no remaining actionable issue. Its exact
reviewed source tree and all four patches are unchanged by the mechanical
public-parent alignment.

This pure sans-I/O failure-facts change needs no native or guest rebuild or
VM matrix. Broader inherited suites, ignored runtime tests and CI are not
claimed as executed or passed here.

[github-actions]

This pull request changes existing tests

It modifies or removes 3 existing test asset(s), listed below. Review each with care: a change to a test can hide a regression that the test caught. See doc/contribute.md#changes-to-existing-tests.

Test code

Change	What	Before	After
modified test	fn restore_machine_checks_the_transaction_and_refuses_a_cold_record in host::restore::tests	nvx-rs/src/host/restore/tests.rs:673	nvx-rs/src/host/restore/tests.rs:673
modified test	fn restore_machine_keeps_operation_phase_evidence_and_original_source in host::restore::tests	nvx-rs/src/host/restore/tests.rs:724	nvx-rs/src/host/restore/tests.rs:733
modified test	fn restore_machine_expiry_cancellation_and_exit_fail_every_pending_phase in host::restore::tests	nvx-rs/src/host/restore/tests.rs:766	nvx-rs/src/host/restore/tests.rs:783

Relocated unchanged: 0; added: 5. Compared the merge base 4e0ffabf1d7b with 62b01974f607.

[Copilot]

🟢 Approval recommended

No active review issues remain for the restore failure-reporting changes.

No open issues 🎉

What changed in this PR

Completes RestoreMachine failure reporting for #1103, building on #1347’s restore state machine without adding I/O or lifecycle policy. Process, session, and storage ownership remain with the caller.

Changes:

• Adds failure attribution, guest-execution possibility, and detailed diagnostic messages while preserving the original error source and concise Display.
• Classifies caller-supplied outcome reports using existing guest status rules.
• Extends restore tests and updates both platform API snapshots.

File	Description
nvx-rs/​src/​host/​restore/​tests.rs	Tests attribution, report classification, sticky execution facts, cause preservation, and caller ownership.
nvx-rs/​src/​host/​restore.rs	Adds policy-free failure facts and outcome classification.
nvx-rs/​public-api/​windows.txt	Records the expanded restore API on Windows.
nvx-rs/​public-api/​linux.txt	Records the expanded restore API on Linux.

_{Review effort: Balanced}