System crash during VM shutdown can leave VM unable to start due to "-private" being renamed to "-private-tmp"

[qubesuser]

Qubes OS version:

R4.0-rc2

Steps to reproduce the behavior:

1. Shutdown a VM
2. Press the hardware reset button while lvm clone of VM-private-snap to VM-private is running

Expected behavior:

The system should continue to work normally after the reboot.

Actual behavior:

The VM can no longer be started, because there is no "-private" volume, since it was renamed to "-private-tmp".

General notes:

Two possible solutions:

1. Detect the situation and rename "-private-tmp" back to "-private" (maybe use a better suffix than "-tmp")
2. Add a version number to volumes, so that instead of "-private", we have e.g. "-private-33". Then, on commit, just clone/rename "-private-snap" to "-private-34", and delete any older versions as needed, and no longer use the "-tmp" mechanism. Rewrite "_revisions_to_keep" to simply mean how many old numbered volumes to keep.

I think the second solution is the best design.