microvm: add bind-once read-only image slots

.cargo/config.toml

@@ -90,8 +90,9 @@ rustc-link-search = []
 
 [target.'cfg(all(windows, target_env = "msvc"))']
 rustflags = [
-  # Set up delayloads.
-  "-C", "link-args=dloadhelper.lib /delayload:ws2_32.dll /delayload:virtdisk.dll /delayload:user32.dll /delayload:winhvplatform.dll /delayload:bcrypt.dll /delayload:crypt32.dll",
+  # Keep Winsock eager: mixed raw-dylib and native import libraries can produce
+  # invalid delay-import thunks. Optional platform libraries remain delay-loaded.
+  "-C", "link-args=dloadhelper.lib /delayload:virtdisk.dll /delayload:user32.dll /delayload:winhvplatform.dll /delayload:bcrypt.dll /delayload:crypt32.dll",
   # Set up the CRT: use ucrtbase.dll but statically link the VC runtime.
   "-C", "link-args=/nodefaultlib onecore_apiset.lib ucrt.lib libvcruntime.lib libcmt.lib",
   # Enable CFG

.config/nextest.toml

@@ -57,11 +57,26 @@ threads-required = 2
 # Use the same slow timeout as ci, but never terminate
 slow-timeout = { period = "10m" }
 
+[[profile.ci.overrides]]
+# This test exhaustively models two writers racing a reader across wraparound
+# and takes over a minute on Windows. Keep the larger budget scoped to it.
+filter = 'package(atomic_ringbuf) and test(/^loom_tests::loom_multi_writer_wraparound$/)'
+slow-timeout = { period = "60s", terminate-after = 2 }
+
+[[profile.agent.overrides]]
+filter = 'package(atomic_ringbuf) and test(/^loom_tests::loom_multi_writer_wraparound$/)'
+slow-timeout = { period = "60s", terminate-after = 2 }
+
 [[profile.ci.overrides]]
 # allow loom based tests more time, as they take a while
 filter = 'test(loom)'
 slow-timeout = { period = "30s", terminate-after = 2 }
 
+[[profile.agent.overrides]]
+# Keep the same exhaustive loom test budget as CI.
+filter = 'test(loom)'
+slow-timeout = { period = "30s", terminate-after = 2 }
+
 # Profile for AI agent runs. Minimizes output noise: only prints slow, failing,
 # and flaky tests. Agents should use: cargo nextest run -p <pkg> --profile agent
 [profile.agent]
@@ -88,4 +103,4 @@ fail-fast = false
 
 [profile.ci.junit]
 path = "junit.xml"
-store-success-output = "true"
+store-success-output = "true"

.github/instructions/doc-code-sync.instructions.md

@@ -13,6 +13,14 @@ does, the PR should update the Guide or flag a follow-up.
 
 - CLI args changed in `openvmm_entry` → `Guide/src/reference/openvmm/management/cli.md`
 - Device crate under `vm/devices/` changed → look for a matching page under `Guide/src/reference/`
+- virtio-fs backends, queue/cache policy, save/restore, or microVM attachment
+  semantics changed (`vm/devices/virtio/virtiofs/`,
+  `vm/devices/virtio/virtio_resources/`, `vm/devices/support/fs/fuse/`) →
+  `Guide/src/reference/devices/virtio/virtio-fs.md`
+- Control-session framing, record types, payload rules, receive credits,
+  authentication, or reconnect behavior changed
+  (`vm/devices/virtio/virtio_console/`) →
+  `Guide/src/reference/openvmm/management/control_session_protocol.md`
 - OpenHCL internals changed (`openhcl/`) → `Guide/src/reference/architecture/openhcl/`
 - Crate renamed or moved → grep `Guide/src/` for the old name
 - New crate under `vm/devices/` → consider whether it needs a reference page

.github/workflows/dep-review.yml

@@ -29,6 +29,7 @@ permissions:
 
 jobs:
   dep-review:
+    if: github.repository == 'microsoft/openvmm'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout base branch (safe — our own code)