feat(windows): add native Windows WHPX hypervisor support

.cargo/config.toml

@@ -3,3 +3,10 @@ rustflags = ["-C", "target-feature=+crt-static", "-C", "link-arg=-Wl,-z,stack-si
 
 [target.x86_64-unknown-linux-musl]
 rustflags = ["-C", "target-feature=+crt-static", "-C", "link-arg=-Wl,-z,stack-size=2097152"]
+
+# Windows MSVC: allow duplicate symbols when linking libkrun staticlib into Rust binaries.
+# libkrun is built as a staticlib (bundles Rust stdlib) for C consumers, but when linked
+# into a Rust binary the stdlib symbols collide. /FORCE:MULTIPLE resolves this safely
+# since both copies are identical.
+[target.x86_64-pc-windows-msvc]
+rustflags = ["-C", "link-arg=/FORCE:MULTIPLE"]

.claude/commands/md-to-pdf.md

@@ -0,0 +1,64 @@
+Convert Markdown files in `./docs/` to PDF format using md-to-pdf.
+
+Arguments: $ARGUMENTS
+
+## Parameters
+
+- **File pattern** (required): A glob pattern to match files in `./docs/`, e.g. `in-depth-*`, `in-depth-cn-*`, `in-depth-01-*`. The `.md` extension is appended automatically if not included.
+
+Existing PDFs are always overwritten.
+
+## Prerequisites
+
+- **Node.js** must be installed
+- **md-to-pdf** npm package: install globally if not available
+
+```bash
+npm install -g md-to-pdf
+```
+
+## Output File Naming
+
+- **Input**: `{filename}.md`
+- **Output**: `{filename}.pdf`
+
+Example: `cn.d-big_data.s-literary.big_data-cn-v6.md.md` -> `cn.d-big_data.s-literary.big_data-cn-v6.md.pdf`
+
+## Conversion Requirements
+
+1. **Preserve Formatting**: The PDF must faithfully render all Markdown formatting including headings, bold, italic, bullet points, nested lists, blockquotes, and inline code.
+
+2. **HTML Support**: Must correctly render embedded HTML tags (`<small>`, `<br>`, `&nbsp;`, etc.) commonly used in the resume files.
+
+3. **Page Layout**:
+   - Paper size: A4
+   - Margins: 8.5mm all sides (matches MPE preview padding of 2em/32px)
+   - Font: system default sans-serif
+
+4. **Styling**: Use different stylesheets for Chinese and English files:
+   - **Chinese files** (filename contains `-cn-`): Use `./docs/github-light.css` (original MPE stylesheet)
+   - **English files** (filename does NOT contain `-cn-`): Use `./docs/en.github-light.css` (optimized with reduced h2 and h3 spacing)
+
+5. **No External Dependencies Beyond md-to-pdf**: Do not require LaTeX, wkhtmltopdf, or other heavy toolchains.
+
+## Process
+
+1. Check if `md-to-pdf` is installed; if not, install it via `npm install -g md-to-pdf`
+2. Parse arguments: extract the file pattern. If no file pattern is provided, report an error.
+3. Use `Glob` to find matching `.md` files in `./docs/` using the pattern. If the pattern does not end with `.md`, append `.md` (e.g. `in-depth-*` becomes `in-depth-*.md`).
+4. If no files match, report an error and list available `.md` files in `./docs/`.
+5. For each matching file, determine the stylesheet based on filename:
+   - If filename contains `-cn-`, use `./docs/github-light.css` (Chinese)
+   - Otherwise, use `./docs/en.github-light.css` (English)
+
+   Then run (use the stylesheet determined above):
+   ```bash
+   # Chinese files (containing "-cn-"):
+   md-to-pdf --stylesheet "./docs/github-light.css" --pdf-options '{"format":"A4","margin":{"top":"8.5mm","bottom":"8.5mm","left":"8.5mm","right":"8.5mm"}}' <input_file>
+
+   # English files (NOT containing "-cn-"):
+   md-to-pdf --stylesheet "./docs/en.github-light.css" --pdf-options '{"format":"A4","margin":{"top":"8.5mm","bottom":"8.5mm","left":"8.5mm","right":"8.5mm"}}' <input_file>
+   ```
+6. Report results:
+   - List converted files
+   - Confirm total counts

.claude/commands/win10-e2e.md

@@ -0,0 +1,63 @@
+# Win10 Full E2E Workflow
+
+Complete Win10 E2E testing workflow. Execute these commands in order.
+
+## Workflow
+
+### 1. Local Validation (before deploying)
+
+```bash
+cargo test -p boxlite --no-default-features --lib
+cargo clippy -p boxlite --no-default-features --lib -- -D warnings
+```
+
+Fix any failures before proceeding.
+
+### 2. `/win10-sync` — Pack + Deploy + Generate .bat
+
+Creates tarball of modified `src/` files, generates a rebuild+test .bat script, and SCPs both to Win10.
+
+### 3. Execute .bat on Win10
+
+Two options:
+
+**Option A: Run the .bat (rebuild + test in one shot)**
+```bash
+ssh -o IdentitiesOnly=yes -i ~/.ssh/id_rsa lilongen@192.168.3.143 "cd C:\\ws-boxlite && win10-e2eN.bat > e2e-testN.txt 2>&1 && echo DONE"
+```
+Timeout: 300s (covers build + test).
+
+**Option B: Step by step (more control)**
+- `/win10-rebuild` — Rebuild shim and/or SDK
+- `/win10-test` — Run test + retrieve + analyze
+
+### 4. `/win10-test` — Retrieve + Analyze Results
+
+Fetches `e2e-testN.txt` from Win10, reads it, and checks for success.
+
+## Common Pitfalls
+
+| Pitfall | Symptom | Fix |
+|---------|---------|-----|
+| `set VAR=val &&` (space!) | pip "Failed to parse" proxy URL | `set VAR=val&&` — NO space before `&&` |
+| Missing file in tarball | Same error as before fix | Verify with `findstr` in .bat |
+| Didn't rebuild SDK | SDK uses old crate code | Rebuild BOTH shim + SDK |
+| Disk cache stale | Permission/format bugs persist | Clear `disk-images/` (see `/win10-sync`) |
+| SCP backslash paths | "No such file" on retrieve | Use `C:/path/` not `C:\\path\\` |
+| Locked .exe | Build silently produces old binary | `taskkill` before build |
+| Stale shim | "transport error" / broken pipe | `taskkill /F /IM boxlite-shim.exe` |
+| Flaky ContainerInit | Passes on retry | Re-run once; if consistent, it's a real bug |
+
+## Success Criteria
+
+All 8 phases of vm-bench.py show ms times:
+```
+1. import boxlite           ~80 ms
+2. runtime_init             ~100 ms
+3. box_create                ~6 ms  (cached) / ~250 ms (first)
+4. first_exec (cold)      ~1700 ms
+5. second_exec (warm)       ~55 ms
+6. third_exec (warm)        ~36 ms
+7. stop                    ~155 ms
+8. remove                   ~55 ms
+```

.claude/commands/win10-rebuild.md

@@ -0,0 +1,59 @@
+# Win10 Rebuild (shim + SDK)
+
+Rebuild boxlite-shim and/or Python SDK on Win10 after code has been deployed.
+
+**CRITICAL Windows `set` rule**: `set VAR=value&&` — NO space before `&&`. A trailing space becomes part of the value and breaks URL parsing in pip/cargo.
+
+## Quick Rebuild (Both)
+
+**Shim:**
+```bash
+ssh -o IdentitiesOnly=yes -i ~/.ssh/id_rsa lilongen@192.168.3.143 "cmd /c \"cd C:\\ws-boxlite\\boxlite&&set HTTP_PROXY=http://127.0.0.1:7897&&set HTTPS_PROXY=http://127.0.0.1:7897&&set PATH=C:\\ws-boxlite\\tools\\protoc\\bin;%PATH%&&taskkill /F /IM boxlite-shim.exe 2>nul&cargo build -p boxlite --bin boxlite-shim --no-default-features --features krun&&copy /Y target\\debug\\boxlite-shim.exe C:\\ws-boxlite\\runtime\\boxlite-shim.exe&&echo SHIM OK\"" 2>&1
+```
+
+**SDK** (separate command, different working dir):
+```bash
+ssh -o IdentitiesOnly=yes -i ~/.ssh/id_rsa lilongen@192.168.3.143 "cmd /c \"cd C:\\ws-boxlite\\boxlite\\sdks\\python&&set HTTP_PROXY=http://127.0.0.1:7897&&set HTTPS_PROXY=http://127.0.0.1:7897&&set BOXLITE_DEPS_STUB=1&&pip install -e .&&echo SDK OK\"" 2>&1
+```
+
+## Preferred: Use .bat Script
+
+For reliability, write a `.bat` file instead of SSH one-liners (avoids quoting/set issues):
+
+```bat
+@echo off
+cd C:\ws-boxlite\boxlite
+set HTTP_PROXY=http://127.0.0.1:7897
+set HTTPS_PROXY=http://127.0.0.1:7897
+set PATH=C:\ws-boxlite\tools\protoc\bin;%PATH%
+taskkill /F /IM boxlite-shim.exe 2>nul
+cargo build -p boxlite --bin boxlite-shim --no-default-features --features krun
+if %ERRORLEVEL% NEQ 0 (echo SHIM FAILED & exit /b 1)
+copy /Y target\debug\boxlite-shim.exe C:\ws-boxlite\runtime\boxlite-shim.exe
+echo === Shim OK ===
+set BOXLITE_DEPS_STUB=1
+cd C:\ws-boxlite\boxlite\sdks\python
+pip install -e .
+if %ERRORLEVEL% NEQ 0 (echo SDK FAILED & exit /b 1)
+echo === SDK OK ===
+```
+
+## When to Rebuild What
+
+| Component | When to rebuild |
+|-----------|----------------|
+| **Shim only** | Changes in `src/boxlite/src/bin/shim/` only |
+| **SDK only** | Changes in `src/boxlite/src/images/`, `src/boxlite/src/litebox/`, `src/boxlite/src/disk/` |
+| **Both** | Changes in `src/boxlite/src/vmm/`, `src/boxlite/src/portal/`, `Cargo.toml`, or unsure |
+
+## Build Times (incremental)
+
+- Shim: ~10-50s (depends on what changed)
+- SDK: ~20-80s (first build ~83s, incremental ~10-20s)
+
+## Prerequisite
+
+Always kill old shim before rebuild:
+```bash
+ssh -o IdentitiesOnly=yes -i ~/.ssh/id_rsa lilongen@192.168.3.143 "taskkill /F /IM boxlite-shim.exe 2>nul"
+```