HIGH, the last of the 4 concurrency-audit findings.

Race

boot_from_record creates a real VM outside the state lock (the flock only spans the post-boot record write). A dead box is simultaneously the monitor's auto-restart target and a valid user restart/start target, so both can boot it concurrently:

1. each clones the record, boots a VM unlocked,
2. then races to persist — apply_boot_result has no already-running guard, so the second write overwrites the first's pid.

The first VM (shim + overlay mount + network endpoint) becomes untracked and is never reaped. ensure_network_connected is idempotent for the duplicate and the overlay stacks without EBUSY, so the second boot doesn't fail on its own.

Fix

A per-box advisory BootLock (flock on locks/<box_id>.boot.lock) held across the boot and the record write, via a new boot::boot_and_record helper used by both the monitor and restart. A loser that acquires the lock and finds the box already running with a live, identity-matched shim returns AlreadyRunning and does not boot a duplicate — so there is no orphan to tear down (the winner records its pid before releasing the lock, so the loser observes it). The removed-during-boot orphan teardown is centralized into the same helper (restart previously lacked it).

Validation

Full a3s-box-cli lib suite (597) green, fmt + clippy clean. A cross-process boot serialization fix; the interleaving needs a multi-process/real-VM harness to exercise (like the other concurrency fixes), but the flock + re-check-under-lock is self-evidently correct.

Completes the concurrency audit (4/4)

After #144 (HIGH monitor-resurrect + MED kill-identity) and #145 (MED warm-pool leak). Note: touches monitor.rs poll_once near #144's region — rebase if #144 merges first (adjacent, non-overlapping edits).