[BUG] Native diagnostic page census omits terminal accounting backing #21

New issue

Closed

opened 2026-09-21 18:09:25 +02:00 by erikinkinen · 0 comments

erikinkinen commented

2026-09-21 18:09:25 +02:00

Owner

Summary

The maintained lifetime diagnostic reaches its terminal-accounting and child-cleanup checks, then panics because its final owned-page census still budgets five request pages after a sixth request page was added. This prevents the required native diagnostic from completing.

Reproduction

Select Kernel 5c89ff8f6e2a8ab0105f3fa42c3875a93f1a786a, lib-ipc 0b889095fd04f6f4b1da1d4c0064150551f52122 and lib-capabi 109c111a62e038f7b4c4eacf86be0c27cb32127e in the maintained isolated native catalog, then run bash scripts/run-native-kernel-vm.sh lifetime. The first original attempt reproduced the failure; no unchanged rerun was made.

Expected and actual behavior

Expected: every explicitly owned request, code and stack page matches the independent final census, followed by normal diagnostic completion.

Actual: after CHILD_EXECUTION_OK and TERMINAL_EVENT_RESERVATION_OK, Kernel panics at src/arch/x86_64/lifetime_vm.rs:395, the comparison of retained pages with the declared page count. Setup maps six request pages but still initializes the expected count with five. The maintained runner exits 1. The preceding user-mode observation, nonzero-accounting, repeat-query and acknowledgement checks reach that final inventory boundary; complete native acceptance has failed.

Environment and identity

Kernel revision: 5c89ff8f6e2a8ab0105f3fa42c3875a93f1a786a; Integration runner source: 648fbd5614d3d0b82223b1c3bb7f1b5a0c81ea7d, with the explicit original diagnostic catalog selection above.
Isolated x86_64 lifetime image, Rust 1.97.1, QEMU/OVMF, original 60-second scenario deadline and standard watchdogs.
Packaged boot image SHA256: 4c577468762e6616e13b87a7ac951bdc850a085973feae47f90559d22634a546.
The independent diagnostic observer holds its explicit Process endpoint; request pages are owned mappings in that observer's VSpace.
The preceding grant-rights diagnostic at Kernel 4a5333f760e258ebca23047a362d1cff4fded0c0 passed with its five-page request layout.

Evidence and prior checks

The complete original serial stream is 2,159 bytes, SHA256 7b6e1acdbd98a056d49567804d54cc2b6b6476b64ce5c3c0c30ef32cca6e5c77. The actual failed image, serial and QEMU streams are retained. There are no build-warning candidates. Four host configurations (736/760 unit tests and both standalone controls) and thirteen native build/Clippy profiles passed before this VM-only census failure.

Tracking

Centralize the declared request-page layout and derive allocation plus independent final census from that declaration. Preserve exact ownership checks, the failed attempt, original deadlines, and all terminal/CPU assertions. Validate the corrected source and rerun the maintained native diagnostic before closing this regression.

Verified native terminal accounting — 21 September 2026: Kernel a9bdf6163813d378e0b4a164bceb839e24fbb6b7 is signed/pushed. Terminal preflight reserves final scalar CPU evidence independently of TCB/CSpace/VSpace reclamation; exact queries preserve final results or explicit errors. Repeat observations belong to the actual original observer until exact acknowledgement, and observer death releases that claim. Independent authorized observers can progress. Selector 55 is retired; checked selectors 59/60 have no destructive fallback.

Four strict 736/760-unit configurations, both standalone controls and thirteen native build/Clippy profiles pass without warnings. Host controls include nonzero final counters after actual reclamation and ID reuse, original observer death, pending-final-charge destruction refusal, malformed requests, wrong callers, immutable errors and lost-acknowledgement reply retry. Original Kernel CI 624/625 and corrected 626/627 all pass from eight complete hashed logs (1,532,848 bytes), zero warnings.

Both maintained lifetime and owned-invocation VMs pass under the unchanged 60-second scenario limits and standard watchdogs, with no build warnings and empty QEMU stderr. Actual guest instructions check repeat observations and CPU queries, exact acknowledgement and absent-acknowledgement retry; executing children require nonzero user and kernel counters after native reclamation. Lifetime retains 2,025 serial bytes (SHA256 921edf5eadfdff61f2d85a63158555666e77e57a1e8aa4254ac30dcd216f8cf9); owned invocation retains 1,587 (SHA256 404bc4ecad5074349d9ba45d1caf5439aebe849d344b726e5dec2ee2b9c4d907). Normal stripping exactly matches both packaged kernels to retained original artifacts; all fifteen selected original signatures and clean checkouts verify.

Kernel regression 21 retains the first VM's final page-census failure. The corrected layout declares and allocates all six request pages and derives the independent census from that declaration. No unchanged retry or deadline relaxation occurred.

Integration fcd7b4a9608f629a12de78c53da5c3615d906b46 is signed/pushed with the verified isolated catalog. Twenty dependency and 46 immutable-source tests, native policies, Markdown and source checks pass. The unchanged orchestration crate, embedded fixture and original dependency closure retain verified four 320/321-unit and native/Clippy/rustdoc configurations. The full service catalogs retain their separately coordinated revisions; original Integration CI remains under observation.

Procd and Rootd consumer adoption, ordinary and mediator metric retention/consumer loss, manual updates, full service/profiler scenarios, complete authority/source/frame audits and full regression acceptance remain open under Kernel design 20. Canonical acceptance remains 3.48% weighted; 15 of 460 items. Native upstream Rust/LLVM/runtime rebuilding and both full EriX guest build generations remain mandatory and unproven.

## Summary The maintained lifetime diagnostic reaches its terminal-accounting and child-cleanup checks, then panics because its final owned-page census still budgets five request pages after a sixth request page was added. This prevents the required native diagnostic from completing. ## Reproduction Select Kernel `5c89ff8f6e2a8ab0105f3fa42c3875a93f1a786a`, lib-ipc `0b889095fd04f6f4b1da1d4c0064150551f52122` and lib-capabi `109c111a62e038f7b4c4eacf86be0c27cb32127e` in the maintained isolated native catalog, then run `bash scripts/run-native-kernel-vm.sh lifetime`. The first original attempt reproduced the failure; no unchanged rerun was made. ## Expected and actual behavior Expected: every explicitly owned request, code and stack page matches the independent final census, followed by normal diagnostic completion. Actual: after `CHILD_EXECUTION_OK` and `TERMINAL_EVENT_RESERVATION_OK`, Kernel panics at `src/arch/x86_64/lifetime_vm.rs:395`, the comparison of retained pages with the declared page count. Setup maps six request pages but still initializes the expected count with five. The maintained runner exits 1. The preceding user-mode observation, nonzero-accounting, repeat-query and acknowledgement checks reach that final inventory boundary; complete native acceptance has failed. ## Environment and identity - Kernel revision: `5c89ff8f6e2a8ab0105f3fa42c3875a93f1a786a`; Integration runner source: `648fbd5614d3d0b82223b1c3bb7f1b5a0c81ea7d`, with the explicit original diagnostic catalog selection above. - Isolated x86_64 lifetime image, Rust 1.97.1, QEMU/OVMF, original 60-second scenario deadline and standard watchdogs. - Packaged boot image SHA256: `4c577468762e6616e13b87a7ac951bdc850a085973feae47f90559d22634a546`. - The independent diagnostic observer holds its explicit Process endpoint; request pages are owned mappings in that observer's VSpace. - The preceding grant-rights diagnostic at Kernel `4a5333f760e258ebca23047a362d1cff4fded0c0` passed with its five-page request layout. ## Evidence and prior checks The complete original serial stream is 2,159 bytes, SHA256 `7b6e1acdbd98a056d49567804d54cc2b6b6476b64ce5c3c0c30ef32cca6e5c77`. The actual failed image, serial and QEMU streams are retained. There are no build-warning candidates. Four host configurations (736/760 unit tests and both standalone controls) and thirteen native build/Clippy profiles passed before this VM-only census failure. ## Tracking Related: [acknowledged terminal accounting](https://git.erikinkinen.fi/erix/kernel/issues/20), [Kernel implementation PR](https://git.erikinkinen.fi/erix/kernel/pulls/3), [Integration PR](https://git.erikinkinen.fi/erix/integration/pulls/12), and [Phase 6 completion](https://git.erikinkinen.fi/erix/integration/issues/65). Centralize the declared request-page layout and derive allocation plus independent final census from that declaration. Preserve exact ownership checks, the failed attempt, original deadlines, and all terminal/CPU assertions. Validate the corrected source and rerun the maintained native diagnostic before closing this regression. Verified native terminal accounting — 21 September 2026: Kernel [a9bdf6163813d378e0b4a164bceb839e24fbb6b7](https://git.erikinkinen.fi/erix/kernel/commit/a9bdf6163813d378e0b4a164bceb839e24fbb6b7) is signed/pushed. Terminal preflight reserves final scalar CPU evidence independently of TCB/CSpace/VSpace reclamation; exact queries preserve final results or explicit errors. Repeat observations belong to the actual original observer until exact acknowledgement, and observer death releases that claim. Independent authorized observers can progress. Selector 55 is retired; checked selectors 59/60 have no destructive fallback. Four strict 736/760-unit configurations, both standalone controls and thirteen native build/Clippy profiles pass without warnings. Host controls include nonzero final counters after actual reclamation and ID reuse, original observer death, pending-final-charge destruction refusal, malformed requests, wrong callers, immutable errors and lost-acknowledgement reply retry. Original Kernel CI 624/625 and corrected 626/627 all pass from eight complete hashed logs (1,532,848 bytes), zero warnings. Both maintained lifetime and owned-invocation VMs pass under the unchanged 60-second scenario limits and standard watchdogs, with no build warnings and empty QEMU stderr. Actual guest instructions check repeat observations and CPU queries, exact acknowledgement and absent-acknowledgement retry; executing children require nonzero user and kernel counters after native reclamation. Lifetime retains 2,025 serial bytes (SHA256 `921edf5eadfdff61f2d85a63158555666e77e57a1e8aa4254ac30dcd216f8cf9`); owned invocation retains 1,587 (SHA256 `404bc4ecad5074349d9ba45d1caf5439aebe849d344b726e5dec2ee2b9c4d907`). Normal stripping exactly matches both packaged kernels to retained original artifacts; all fifteen selected original signatures and clean checkouts verify. [Kernel regression 21](https://git.erikinkinen.fi/erix/kernel/issues/21) retains the first VM's final page-census failure. The corrected layout declares and allocates all six request pages and derives the independent census from that declaration. No unchanged retry or deadline relaxation occurred. Integration [fcd7b4a9608f629a12de78c53da5c3615d906b46](https://git.erikinkinen.fi/erix/integration/commit/fcd7b4a9608f629a12de78c53da5c3615d906b46) is signed/pushed with the verified isolated catalog. Twenty dependency and 46 immutable-source tests, native policies, Markdown and source checks pass. The unchanged orchestration crate, embedded fixture and original dependency closure retain verified four 320/321-unit and native/Clippy/rustdoc configurations. The full service catalogs retain their separately coordinated revisions; original Integration CI remains under observation. Procd and Rootd consumer adoption, ordinary and mediator metric retention/consumer loss, manual updates, full service/profiler scenarios, complete authority/source/frame audits and full regression acceptance remain open under [Kernel design 20](https://git.erikinkinen.fi/erix/kernel/issues/20). Canonical acceptance remains **3.48% weighted; 15 of 460 items**. Native upstream Rust/LLVM/runtime rebuilding and both full EriX guest build generations remain mandatory and unproven.

erikinkinen added the

bug

phase-6

labels

2026-09-21 18:09:25 +02:00

erikinkinen referenced this issue from a commit

2026-09-21 18:12:36 +02:00

fix: Derive native request mappings from the declared layout

erikinkinen closed this issue

2026-09-21 18:20:49 +02:00

erikinkinen referenced this issue

2026-09-21 18:20:50 +02:00