fix(vm): binder:vm / TCG compatibility & boot-cache reliability sweep

[Xiddoc]

Summary

First batch of an automated codebase sweep, focused on binder: vm (QEMU micro-VM / TCG) compatibility — the one device backend reachable on binderless / no-KVM hosts (incl. the Claude Code web sandbox). These fixes make a cold software-emulated (TCG) boot actually succeed, repeat cleanly via the savevm boot-cache, and not corrupt or orphan state, plus a few process-safety and cache-correctness bugs.

Each issue was verified against the real code by a triage pass, implemented with tests, and gate-checked before integration.

Fixes (12 issues)

Compatibility / TCG boot

• Default vm_adb_connect_timeout (60s) is below cold TCG boot (~222s), so plain up and the cold boot_cache path fail before the guest's ADB relay is reachable #160 — accelerator-aware ADB-connect wait: TCG uses a boot-completed-scale deadline instead of the flat 60s, so a ~222s cold TCG boot no longer fails up before the guest exposes ADB (KVM keeps the short default).
• boot_cache staleness fingerprint omits resolved -smp and -m, so a savevm checkpoint resumes under incompatible vCPU/RAM geometry and QEMU loadvm hard-fails #161 — boot_cache folds resolved -smp/-m geometry into the staleness fingerprint, so a geometry edit cold-boots instead of -loadvm-resuming into a mismatch QEMU rejects.
• boot_cache: an aborted first cold boot leaves a snapshot-less dirty overlay that is reused, so later cold boots run over a soured COW layer instead of a pristine one #175 — recreate a snapshot-less overlay before a cold boot so an aborted first boot's dirty COW layer is never reused; cache-key sidecar now written atomically.
• Warm boot_cache resume has no cold-boot fallback and never polls is_running() during the adb wait, so an unrestorable snapshot burns the full timeout then misreports TCG slowness #176 — re-check QEMU liveness during the ADB wait and fall back to one cold boot when a warm -loadvm resume dies, instead of burning the full timeout with a misleading TCG-slowness error.
• compute_cache_key / boot_cache.base_identity violate documented order-independence when two inputs share a basename (stable sort on basename only) #235 — compute_cache_key/base_identity break basename ties on content hash (and hash each input exactly once).
• CI: cache a booted VM via QEMU savevm/snapshot to skip the ~100s TCG boot in e2e/perf jobs #49 — e2e tier-vm-qemu caches the savevm overlay (keyed by kernel+rootfs hash) to skip the ~100s cold TCG boot on repeat runs.

Process safety / correctness

• VmDeviceBackend down/restart/destroy can SIGTERM/SIGKILL an unrelated process: terminate() signals the qemu.pid PID without verifying it still names QEMU #162 — verify the recorded PID still names this instance's QEMU (/proc/<pid>/cmdline) before SIGTERM/SIGKILL on down/restart/destroy; is_running() and kill-escalation both route through the identity check.
• VM up()/_up_cached() leak the running QEMU process when the adb-connect wait times out, orphaning the emulator and trapping the next up #174 — a timed-out up terminates the QEMU it just launched instead of orphaning it.
• binder: vm doctor leaves magisk.zygisk + magisk.denylist rows that always fail on the Magisk-less VM guest, reporting a healthy VM as broken (exit non-zero) #163 — doctor drops the always-failing Magisk zygisk/denylist rows on the Magisk-less upstream-redroid VM guest, so a healthy VM stops reporting as broken.

Relay / guest

• guest-init.sh ADB_TCP_PORT is an overridable env knob but the QEMU hostfwd guest target is hardcoded to 5555, so overriding it silently breaks the relay #237 — fix the in-guest ADB port to a single 5555 contract so the relay can't diverge from the QEMU hostfwd target.
• VM adb relay dual-stack/eth0/sysctl/diagnostic hardening gaps (TCP4 vs v6-only adbd, swallowed bring-up errors, short-read probe) #238 — harden the adb relay: IPv6 loopback (drops bindv6only dependency), verify eth0 got 10.0.2.15, distinct warnings on bring-up failure, short-read-safe adbprobe.
• vm.py comments contradict each other (and guest-init.sh) on whether adb connect succeeds at hostfwd-bind vs only after the post-boot relay #241 — align self-contradicting vm.py comments/docstrings with guest-init.sh (relay attaches only post-boot).

Testing

Full local gate green: ruff check (src+tests), ruff format --check, mypy --strict (src+tests), pytest -p no:randomly with 100% line+branch coverage (1744 passed, 6 docker-daemon skips), shellcheck -S style -s sh + shfmt -i 4, yamllint, actionlint 1.7.12, zizmor 1.25.2, codespell 2.4.2, deptry 0.25.1, uv lock --check, changelog lint.

🤖 Generated with Claude Code

https://claude.ai/code/session_01P1YsNMpGizhSDDPCBu5cut

---

Generated by Claude Code