[cdalar]

Step 2 of boxctl-vms's docs/plans/run-status.md: a vsock device on every Firecracker microVM, so a box can report to its host without a token, a network path, or ssh.

• Deploy: PUT /vsock {"guest_cid": 3, "uds_path": "<vmdir>/v.sock"} before boot (FCVMConfig.VsockPath, recorded as vsockPath in metadata.json). A guest connection to CID 2, port N arrives at <vmdir>/v.sock_N. Every VM can use CID 3 because each device belongs to its own VM only.
• Pause/Resume: the device is part of the snapshot, on the VM's own vmDir path, which moves with it on export/import, so no vsock_override is needed (that override is Firecracker ≥1.16 anyway). Resume removes the socket left by the previous process, which Firecracker would otherwise refuse to bind.
• Restart: a cold boot configures it too, so a VM created before this gets one there.
• Path limit: a vmDir too deep for <path>_<port> to fit a Unix socket path (107 bytes) gets no device, not a failed create. On hosts (/opt/fc/vms/<owner>-<name>/) that's ~82 bytes at most.
• cloud-hypervisor: not in this PR. ch boxes are mostly Windows and have no Pause/Resume; a follow-up if a Linux ch box needs the channel.

Tested: go vet, golangci-lint, go test ./..., with new tests for the /vsock call, Deploy recording the path, Resume removing a stale socket, Restart adding a device to an old VM, and the length guard.
Tested live on fc-host (Firecracker v1.16.0, guest kernel 6.1.188) with a throwaway VM on its own state dir and bridge, removed afterwards. A guest sent to CID 2, port 1024, and a socat listener on <vmdir>/v.sock_1024 received it:

• after create ✔
• after a cold pause -f + resume ✔ (the old v.sock was still there after pausing, and Resume replaced it)
• after a pause --hot + resume ✔
• after restart of a VM whose metadata had no vsockPath (faked pre-vsock VM) ✔: it came back with the device recorded

Finding for the host side (boxctl-vms step 3): a guest's half-close (shutdown(SHUT_WR)) didn't reach the host reader, which waited for EOF and hung. A newline-ended message, read as one line and answered with ok\n, works both ways, so the status protocol should end each message with a newline and not wait for EOF.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XF91y27tgx4Ycv1WRSHk8D

[codecov]

Codecov Report

❌ Patch coverage is 86.95652% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 39.94%. Comparing base (9ac9b4f) to head (ba44e2e).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/cloud/fc.go	88.23%	2 Missing ⚠️
internal/providerfc/common.go	83.33%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1202      +/-   ##
==========================================
+ Coverage   39.79%   39.94%   +0.14%     
==========================================
  Files          67       67              
  Lines        7310     7333      +23     
==========================================
+ Hits         2909     2929      +20     
- Misses       4401     4404       +3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.