I am evaluating a bounded workload host using Virtualization.framework on Apple silicon. This is a question about supported architecture and API contracts, not a report of a reproduced bug. No particular macOS release has yet been qualified for this design; please identify the releases and prerequisites to which an answer applies.
I have read the discussions about cleanup after the VM-owning application terminates:
https://developer.apple.com/forums/thread/848542
https://developer.apple.com/forums/thread/850709
I understand that this cleanup is different from an externally observable, time-bounded teardown guarantee. I am not asking again for a replacement application's handle to a VM whose owner has already died.
The unresolved case is different:
- A host application owns a VM, but its serial VM-control queue is no longer progressing.
- A separate supervisor is intended to initiate the fallback stop action against that application.
- An external stop trigger occurs. The supervisor is then lost or stops progressing before it enters the signal operation; the VM-owning application remains alive.
- Loss of the supervisor role does not necessarily mean that its process has exited, so a process-exit notification cannot be assumed.
- Complete host or kernel failure is not part of this scenario.
Is there a supported public mechanism that can be established before workload preparation and retain authority to act on the same target application after this loss, without requiring another action by the supervisor or progress on the VM-control queue?
For any such mechanism, I would particularly appreciate clarification of:
- How its authority is bound to the intended target during incomplete setup, including process creation that has begun but has not returned a usable target identity. Assuming an already-running watchdog leaves this setup boundary unanswered.
- Which actor performs the remaining action when the supervisor cannot, and what lifecycle, privilege and progress assumptions that actor requires.
- Whether any documented progress bound applies when a required operation does not return. The design requirement is completion of the whole prescribed stop/escalation attempt, including required failure-handling steps, within 10 seconds of the same first external trigger. Starting a timer or entering a signal call is not equivalent to completing that attempt. This is not a request for unconditional successful process or VM termination.
A supported narrower mechanism, or an explicit statement that macOS provides no such contract for this case, would also be useful. I am looking for public interfaces and their documented limits, not private helper-process identities or kernel implementation details.
Thank you.