[hanthor]

The Windows preview launched an unmanaged QEMU process and could not safely stop, restart, or protect its Linux disk. This change prepares one persistent raw disk, records its identity, and supervises QEMU through private QMP pipes. Restart reuses that disk and firmware variables; only a guest shutdown event plus process exit permits normal reuse.

• A global image lock covers preparation, runtime, native installation/boot, and uninstall. QEMU starts suspended, joins a kill-on-close Windows job, then resumes. Interrupted state requires recovery.
• The full runtime closure must match the installer's signed manifest, including missing-file rejection. Protected paths and a sanitized environment prevent ambient DLL/plugin selection.
• A read-only boot sector must execute actual guest code and emit a fresh private serial marker before capability succeeds. The probe uses WHPX with kernel-irqchip=off, q35, and -cpu max; a bounded timeout is inconclusive, with no automatic TCG fallback.
• PrepareVM reuses the GUI's username/password fields. A protected transient fw_cfg file carries only the password hash; no credential enters arguments, logs, or durable state. The helper receipt must match the image, run, install, GPT identity, and created username.
• Explicit runtime setup checks the signed release entry, downloads a bounded archive and uses the verified atomic installer from feat: build and verify an x86 Windows VM runtime bundle #419. Missing release assets produce a clear error. Cancellation and crash cleanup preserve existing runtimes and disks.
• Visible shutdown/restart controls replace abrupt GTK close/quit actions. Process liveness never becomes desktop readiness. The JSON-RPC method table and generated DTOs include these operations.

Dependencies: #416 signed-artifact authentication is merged. #412 still needs its hosted GUI and OEM cycles. Keep this draft open until those runs pass. Signed bundle packaging/acquisition is coordinated with #419.

Validation: frontend build; the VM-first button keeps its action label while a screen-reader-live hint identifies the missing account field; all 53 Playwright tests, including account submission → stop → restart and branding; Go race suite; Windows cross-compilation; native Corral tests for QMP clean/host/crash/hung cases, mutex retention, preserved disk contents, suspended process/job ownership, receipt mismatch rejection, account cleanup, signed closure, and environment sanitization. The actual signed QEMU runtime executed the probe under Windows q35/TCG in 1.152 seconds; this is test-harness evidence, not WHPX or desktop proof. Logs and artifact hashes are committed. Removing guest-shutdown validation makes the host-exit test fail.

Outstanding: publishing the runtime asset, a complete personalized Windows-hosted Linux login/desktop run, and measured resource floors for older PCs. The current 6 GiB RAM/88 GiB free gate is a conservative trial boundary, not a product minimum; the helper now samples free space and cancels/reaps if the 8 GiB Windows reserve is breached. Measured physical peak and a lighter, smaller-capacity profile remain P0 work. Native promotion and desktopReady remain gated.

[hanthor]

Superseded: the managed VM lifecycle commits were restacked linearly on trial/vm-first-current-candidate, which is now carried to main by #495.