feat: SKEL skeleton instrumentation - designed-but-unimplemented paths panic

- hypercall.c: 5 Phase 1.3 stubs -> HCALL-E01..E05 panic (no NOSYS return)
- drr_stub.c: snapshot alloc fail -> DRR-E01; new skeletons DRR-E02 root key
  seal, DRR-E03 task kill crypto erase, DRR-E04/E05 segment/system rollback,
  DRR-E06/E07 driver recovery ops dispatch
- sched.c: enable fail -> SCH-E02 panic (no silent demo skip)
- dkm/kernel_api.c: D1 hot-unload DKM-E01, D2 bare code loader DKM-E02,
  SIPI AP wake DKM-E03 skeletons
- virtio_net tx/rx stubs -> VNET-E01/E02; ath9k tx stub -> ATH-E01;
  xhci port reset -> XHC-E01; nvme MSI/MSI-X fail -> NVME-E01..E03 (no
  silent polling downgrade); e1000 MAC fallback -> E1K-E01
- pe_shim unimpl API -> PE-E01; PE ordinal import -> PE-E02
- kernel/main.c: lib sync / vscode install fail -> LNX-E01/E02
- NEW brand/brand.c (E1 boot anim BRAND-E01, E2 time egg BRAND-E02) and
  pkg/pkg.c (pacman skeleton PKG-E01..03), wired into UTSM MAKEFILE
- Deliberate design-internal fallbacks kept and documented (VMX skip,
  bzImage skip, KDE fallback, boot-module fallback, apic->PIC route)

CODE/DKM/ath9k/ath9k.c

@@ -531,8 +531,11 @@ static void ath9k_rx_drain(void) {
  * 真实硬件验证后增量完善。
  */
 static void ath9k_set_channel(u8 channel) {
-    (void)channel;
-    /* TODO: 完整 ath9k 信道切换序列（参考 ar9002_hw_set_channel） */
+    /* TODO: 完整 ath9k 信道切换序列（参考 ar9002_hw_set_channel）。
+     * 严格错误策略插桩：本序列是占位最小实现，若上层依赖"信道已真正
+     * 切换"的语义（如定向扫描），调用方必须走 panic 版本接口——
+     * 当前扫描状态机明确容忍近似信道，此处保留最小序列并打点。 */
+    raw_hex("[ath9k] set_channel (minimal sequence), ch=", channel);
     /* 触发 RFBUS 请求，等待 grant */
     ath9k_reg_write(AR_PHY_RFBUS_REQ, 0x1);
     dkm_delay_us(5);
@@ -601,9 +604,11 @@ static int ath9k_is_wireless_impl(void *ctx) {
     return 1;
 }
 
-/* ath9k 当前不支持 TX（仅扫描） */
+/* ath9k 当前不支持 TX（仅扫描）——严格错误策略插桩：上层若真把帧交给
+ * 只会扫描的无线驱动，panic 而非静默丢包（ATH-E01）。 */
 static int ath9k_tx_stub(void *ctx, const void *packet, u32 length) {
     (void)ctx; (void)packet; (void)length;
+    g_log->panic("ATH-E01 TX NOT IMPLEMENTED (scan-only driver got a tx)");
     return -1;
 }
 

CODE/DKM/e1000/e1000.c

@@ -735,11 +735,12 @@ int driver_init(const struct dkm_kernel_api *api,
         raw_log("[e1000] MAC from RAL/RAH\n");
     }
 
-    /* 仍为全 0 或多播位错误时使用与虚拟机配置一致的回退 MAC */
+    /* 仍为全 0 或多播位错误时——严格错误策略插桩：MAC 读不到 = 网卡
+     * 身份不可知，零降级 panic（E1K-E01），不再用硬编码 MAC 冒充。 */
     if ((mac[0]==0&&mac[1]==0&&mac[2]==0&&mac[3]==0&&mac[4]==0&&mac[5]==0) ||
         (mac[0] & 1)) {
-        mac[0]=0x52; mac[1]=0x54; mac[2]=0x00; mac[3]=0x12; mac[4]=0x34; mac[5]=0x56;
-        raw_log("[e1000] using fallback MAC 52:54:00:12:34:56\n");
+        raw_log("[e1000] MAC read failed (zero/multicast)\n");
+        g_log->panic("E1K-E01 MAC READ FAILED");
     }
 
     raw_mac("[e1000] MAC=", mac);

CODE/DKM/nvme/nvme.c

@@ -920,13 +920,17 @@ static int nvme_msix_program(const struct dkm_kernel_api *api,
      * 页属性 PCD|PWT (UC), MSI-X 表访问不要求 cache 一致性操作。 */
     volatile u32 *tbl = (volatile u32 *)api->mm_map_mmio(tbl_phys, 4096);
     if (!tbl) {
-        g_log->warn("[nvme] MSI-X: table MMIO map failed; polling");
+        /* 严格错误策略插桩：MSI-X 表映射失败不允许静默转轮询（NVME-E01） */
+        g_log->error("[nvme] MSI-X: table MMIO map failed");
+        g_log->panic("NVME-E01 MSIX TABLE MAP FAILED");
         return 0;
     }
 
     int vector = api->irq_vector_alloc();
     if (vector < 0 || vector > 255) {
-        g_log->warn("[nvme] MSI-X: vector alloc failed; polling");
+        /* 严格错误策略插桩：向量分配失败不允许静默转轮询（NVME-E02） */
+        g_log->error("[nvme] MSI-X: vector alloc failed");
+        g_log->panic("NVME-E02 VECTOR ALLOC FAILED");
         return 0;
     }
     log_dec("[nvme] MSI-X vector=", (u64)vector);
@@ -958,7 +962,10 @@ static int nvme_msix_program(const struct dkm_kernel_api *api,
     log_hex("[nvme] MSI-X readback entry vctl=", rb_vc);
     if (!(rb_ctl & 0x8000u) || rb_a0 != addr || rb_a1 != 0 ||
         (rb_d & 0xffu) != ((u32)vector & 0xffu) || (rb_vc & 1u)) {
-        g_log->warn("[nvme] MSI-X: readback mismatch; rolling back");
+        /* 严格错误策略插桩：MSI-X 编程回读不符 = 硬件/虚拟机拒绝消息中断，
+         * 不允许静默回滚转轮询（NVME-E03）。 */
+        g_log->error("[nvme] MSI-X: readback mismatch");
+        g_log->panic("NVME-E03 MSIX READBACK MISMATCH");
         u32 rb = dkm_pci_read(bus, dev, func, (u8)cap);
         rb = (rb & 0x0000ffffu) | (msg_ctl << 16);      /* 恢复原 msg_ctl */
         dkm_pci_write(bus, dev, func, (u8)cap, rb);

CODE/DKM/virtio_net/virtio_net.c

@@ -775,19 +775,21 @@ static void virtio_net_selftest(void) {
     log_hex("[virtio_net] selftest rx frames seen=", frames);
 }
 
-/* ================= stub（初始化失败时的安全占位，与历史行为一致） ================= */
+/* ================= stub（初始化失败时的安全占位） =================
+ * 严格错误策略插桩：占位不再静默丢包/静默无数据——一旦被上层调用
+ * （即有人真的把流量交给未协商 virtqueue 的设备），立即莲花 panic。
+ * 正常路径 netman 因 flags 缺 LINK_UP 不会选中本驱动，stub 不触发。 */
 
 static int virtio_net_tx_stub(void *ctx, const void *packet, u32 length) {
-    (void)ctx;
-    (void)packet;
-    log_hex("[virtio_net] tx stub: packet dropped, len=", length);
+    (void)ctx; (void)packet;
+    log_hex("[virtio_net] tx stub hit, len=", length);
+    g_log->panic("VNET-E01 TX VIRTQUEUE NOT IMPLEMENTED (stub tx called)");
     return 0;
 }
 
 static int virtio_net_rx_poll_stub(void *ctx, void *buffer, u32 capacity, u32 *out_length) {
-    (void)ctx;
-    (void)buffer;
-    (void)capacity;
+    (void)ctx; (void)buffer; (void)capacity;
+    g_log->panic("VNET-E02 RX VIRTQUEUE NOT IMPLEMENTED (stub rx called)");
     if (out_length) *out_length = 0;
     return 0;
 }

CODE/DKM/xhci/xhci.c

@@ -2073,7 +2073,8 @@ int driver_init(const struct dkm_kernel_api *api,
 
         /* Port Reset */
         if (xhci_reset_port(port) != 0) {
-            g_log->warn("[xhci] port reset failed; skipping");
+            /* 严格错误策略插桩：端口复位失败 = 设备不可用，零降级 panic */
+            g_log->panic("XHC-E01 PORT RESET FAILED");
             continue;
         }
         g_log->info("[xhci] port reset OK");

CODE/UTSM/MAKEFILE

@@ -9,7 +9,7 @@ CFLAGS := -target x86_64-unknown-none -std=c11 -ffreestanding -fno-builtin -fno-
 ASFLAGS := -target x86_64-unknown-none -ffreestanding -fno-pic -fno-pie -mcmodel=kernel -mno-red-zone -mno-sse -mno-sse2 -mno-mmx -msoft-float -m64 -Iinclude -I../utsm-ipc
 LDFLAGS := -nostdlib -static -z max-page-size=0x1000 -T linker.ld
 
-C_SOURCES := $(wildcard arch/x86_64/*.c kernel/*.c runtime/*.c mm/*.c core/*.c crypto/*.c pckc/*.c utrw/*.c drr/*.c sched/*.c dkm/*.c test/*.c vmm/*.c pe/*.c)
+C_SOURCES := $(wildcard arch/x86_64/*.c kernel/*.c runtime/*.c mm/*.c core/*.c crypto/*.c pckc/*.c utrw/*.c drr/*.c sched/*.c dkm/*.c test/*.c vmm/*.c pe/*.c brand/*.c pkg/*.c)
 S_SOURCES := $(wildcard arch/x86_64/*.S vmm/*.S sched/*.S)
 OBJECTS := $(C_SOURCES:.c=.o) $(S_SOURCES:.S=.o)
 DEPS := $(C_SOURCES:.c=.d)

CODE/UTSM/brand/brand.c

@@ -0,0 +1,30 @@
+/* ===================================================================
+ *  brand.c — 五期 E 系列：品牌体验骨架
+ *
+ *  设计已定、实现未做的品牌项，全部立骨架 + 调用即莲花 panic。
+ *  骨架不接线：当前启动走静态 Logo（DSK），接线上屏是后续任务。
+ *
+ *  E1 启动莲花动画：静态 Logo → 分瓣绽放动画（时间轴设计见
+ *     docs/ROADMAP_INSANE.md E1）。实现前调用即 panic。
+ *  E2 假想时光键彩蛋：特定按键序列触发"时光倒流"演出（回放最近
+ *     一段帧缓冲历史，DRR checkpoint 帧源）。实现前调用即 panic。
+ * =================================================================== */
+
+#include <utsm/types.h>
+#include <utsm/panic.h>
+#include <utsm/log.h>
+
+/* E1: 启动莲花动画（brand-E 系列） */
+void brand_lotus_boot_anim(u32 hold_ms) {
+    (void)hold_ms;
+    log_error("[BRAND] lotus boot animation requested");
+    panic_full("BRAND-E01 LOTUS BOOT ANIM NOT IMPLEMENTED",
+               "E1 petal-bloom boot animation: designed, not implemented", 0);
+}
+
+/* E2: 假想时光键彩蛋（Ctrl+Alt+Shift+T 时光倒流演出） */
+void brand_time_egg_trigger(void) {
+    log_error("[BRAND] time egg triggered");
+    panic_full("BRAND-E02 TIME EGG NOT IMPLEMENTED",
+               "E2 imaginary time-key easter egg: designed, not implemented", 0);
+}

CODE/UTSM/brand/brand.d

@@ -0,0 +1,5 @@
+brand/brand.o: brand\brand.c include\utsm\types.h include\utsm\panic.h \
+  include\utsm\log.h
+include\utsm\types.h:
+include\utsm\panic.h:
+include\utsm\log.h:

CODE/UTSM/dkm/kernel_api.c

@@ -177,3 +177,33 @@ void dkm_fill_platform_info(void) {
     /* D3: 按名导出表挂入 kernel_api（尾部追加，ABI 兼容） */
     g_kernel_api.kapi = &g_kapi_table;
 }
+
+/* ===================================================================
+ *  严格错误策略插桩：设计已定但未实现的 DKM 能力，建立代码骨架，
+ *  调用即莲花 panic（DKM-E 系列）。当前无调用方（骨架）。
+ * =================================================================== */
+
+/* D1: DKM 驱动热卸载（引用计数）。driver_desc 已有 NO_UNLOAD 标志位，
+ * 但卸载路径本身（refcount + driver_exit + 段回收）未实现。 */
+void dkm_unload_driver(u32 driver_index) {
+    (void)driver_index;
+    panic_full("DKM-E01 DRIVER HOT UNLOAD NOT IMPLEMENTED",
+               "refcount unload path: designed (D1), not implemented", 0);
+}
+
+/* D2: 裸机器码加载器（无 ELF 头，直接映射 .text blob 到可执行页跳转）。
+ * SAS-R0 单地址空间下合法；加载器未实现。 */
+void *dkm_load_bare_code(const void *blob, u64 size) {
+    (void)blob; (void)size;
+    panic_full("DKM-E02 BARE CODE LOADER NOT IMPLEMENTED",
+               "headerless machine-code loader: designed (D2), not implemented", 0);
+    return 0;
+}
+
+/* 多核：SIPI 唤醒 AP（apic.drv 注释预留）。BSP-only 是当前既定边界，
+ * 一旦被调用即 panic 而非静默单核继续。 */
+void dkm_sipi_wake_ap(u32 lapic_id, u64 entry_eip) {
+    (void)lapic_id; (void)entry_eip;
+    panic_full("DKM-E03 SIPI AP WAKE NOT IMPLEMENTED",
+               "AP startup framework: designed, not implemented (BSP-only)", 0);
+}

CODE/UTSM/drr/drr_stub.c

@@ -10,6 +10,7 @@
 
 #include <utsm/drr.h>
 #include <utsm/log.h>
+#include <utsm/panic.h>
 #include <utsm/dma.h>
 #include <utsm/segment.h>
 #include <utsm/config.h>
@@ -317,13 +318,71 @@ void drr_init(void) {
             log_info("[DRR] snapshot region ok");
             log_hex64("[DRR]   pages=", 1 + 128);
         } else {
-            log_warn("[DRR] snapshot region unavailable (metadata-only mode)");
+            /* 严格错误策略插桩：快照区是 DRR 页回滚的前提，缺失即降级
+             * metadata-only——按零降级原则直接 panic（DRR-E01）。 */
+            panic_full("DRR-E01 SNAPSHOT REGION ALLOC FAILED",
+                       "snapshot dma pages unavailable; metadata-only mode is forbidden", 0);
         }
     }
 
     log_info("[DRR] init ok");
 }
 
+/* ===================================================================
+ *  严格错误策略插桩：设计已定但未实现的 DRR 能力，建立代码骨架，
+ *  调用即 panic（DRR-E2x 系列）。当前无调用方（骨架）。
+ * =================================================================== */
+
+/* Root key 持久化（sealed disk region）：drr_init 可重入要求 root key
+ * 跨 emergency reset 固化。当前实现走内存 fallback key（见
+ * drr_root_key_generate），sealed disk 尚未落盘。 */
+void drr_root_key_seal_to_disk(void) {
+    panic_full("DRR-E02 ROOT KEY SEAL NOT IMPLEMENTED",
+               "sealed disk region for root key persistence: designed, not implemented", 0);
+}
+
+/* task_kill crypto erase：任务被杀时 key_epoch++ 并擦除其密钥材料。
+ * 当前 task_exit 只回收 slot，不做 crypto erase。 */
+void drr_task_kill_crypto_erase(u32 task_slot) {
+    (void)task_slot;
+    panic_full("DRR-E03 TASK KILL CRYPTO ERASE NOT IMPLEMENTED",
+               "key_epoch++ erase on task kill: designed, not implemented", 0);
+}
+
+/* segment/system 级回滚入口（R4 遗留）：页级回滚已实现，
+ * segment/system 级接口的调用方尚未接线。 */
+void drr_rollback_segment(u32 seg_slot) {
+    (void)seg_slot;
+    panic_full("DRR-E04 SEGMENT ROLLBACK NOT IMPLEMENTED",
+               "segment-level rollback: designed (R4), not verified/implemented", 0);
+}
+
+void drr_rollback_system(void) {
+    panic_full("DRR-E05 SYSTEM ROLLBACK NOT IMPLEMENTED",
+               "system-level rollback: designed (R4), not verified/implemented", 0);
+}
+
+/* DKM 驱动 recovery ops（DKM README 设计：quiesce/reset/reinit/dump_state）。
+ * 驱动侧从未提供该回调表，DRR 亦未在恢复路径调用。 */
+typedef struct {
+    u32 magic;          /* 'D','R','O','P' */
+    u32 version;
+    void (*quiesce)(void *drv);
+    void (*reset)(void *drv);
+    void (*reinit)(void *drv);
+    void (*dump_state)(void *drv);
+} dkm_driver_recovery_ops;
+
+void drr_driver_recovery_dispatch(const dkm_driver_recovery_ops *ops, void *drv) {
+    (void)drv;
+    if (!ops) {
+        panic_full("DRR-E06 DRIVER RECOVERY OPS MISSING",
+                   "driver did not provide dkm_driver_recovery_ops", 0);
+    }
+    panic_full("DRR-E07 DRIVER RECOVERY NOT IMPLEMENTED",
+               "quiesce/reset/reinit dispatch: designed (DKM README), not implemented", 0);
+}
+
 const u64 *drr_get_root_key(void) {
     return g_drr.root_key;
 }

CODE/UTSM/drr/drr_stub.d

@@ -1,13 +1,14 @@
 drr/drr_stub.o: drr\drr_stub.c include\utsm\drr.h include\utsm\types.h \
-  include\utsm\config.h include\utsm\log.h include\utsm\dma.h \
-  include\utsm\segment.h include\utsm\uuid.h include\utsm\status.h \
-  include\utsm\capability.h include\utsm\dirty.h include\utsm\dkm.h \
-  include\utsm\block.h include\utsm\net.h include\utsm\paging.h \
-  include\utsm\crypto.h include\utsm\blake2b.h
+  include\utsm\config.h include\utsm\log.h include\utsm\panic.h \
+  include\utsm\dma.h include\utsm\segment.h include\utsm\uuid.h \
+  include\utsm\status.h include\utsm\capability.h include\utsm\dirty.h \
+  include\utsm\dkm.h include\utsm\block.h include\utsm\net.h \
+  include\utsm\paging.h include\utsm\crypto.h include\utsm\blake2b.h
 include\utsm\drr.h:
 include\utsm\types.h:
 include\utsm\config.h:
 include\utsm\log.h:
+include\utsm\panic.h:
 include\utsm\dma.h:
 include\utsm\segment.h:
 include\utsm\uuid.h:

CODE/UTSM/kernel/main.c

@@ -1,4 +1,5 @@
 #include <utsm/log.h>
+#include <utsm/panic.h>
 #include <utsm/arena.h>
 #include <utsm/utsm.h>
 #include <utsm/drr.h>
@@ -427,14 +428,22 @@ void kernel_main(void) {
                     if (g_compat_linux_lib_sync) {
                         int lsrc = lxc_sync_lib_dir(g_compat_linux_guest_path);
                         if (lsrc == 0) log_info("[UTSM] lib sync ok");
-                        else log_warn("[UTSM] lib sync skipped (non-fatal)");
+                        else {
+                            /* 严格错误策略插桩：lib 同步失败零降级（LNX-E01） */
+                            panic_full("LNX-E01 LIB SYNC FAILED",
+                                       "FAT32 lib dir sync to Linux guest failed", 0);
+                        }
                     }
                     /* VSCode Phase 5: tarball module 存在时装到 guest /opt/vscode
-                     * （已安装则秒跳过；失败不阻断启动，桌面降级显示未安装） */
+                     * （已安装则秒跳过；失败零降级 panic） */
                     if (g_compat_vscode_install) {
                         int vsrc = lxc_vscode_install();
                         if (vsrc == 0) log_info("[UTSM] vscode ready");
-                        else log_warn("[UTSM] vscode install skipped (non-fatal)");
+                        else {
+                            /* 严格错误策略插桩：VSCode 安装失败零降级（LNX-E02） */
+                            panic_full("LNX-E02 VSCODE INSTALL FAILED",
+                                       "vscode tarball install into guest failed", 0);
+                        }
                     }
                 } else {
                     log_error("[UTSM] Linux launch failed");

CODE/UTSM/kernel/main.d

@@ -1,17 +1,19 @@
 kernel/main.o: kernel\main.c include\utsm\log.h include\utsm\types.h \
-  include\utsm\arena.h include\utsm\utsm.h include\utsm\status.h \
-  include\utsm\config.h include\utsm\uuid.h include\utsm\process.h \
-  include\utsm\capability.h include\utsm\segment.h include\utsm\dirty.h \
-  include\utsm\utrw.h include\utsm\vmm.h include\utsm\linux_loader.h \
-  include\utsm\ipc_shm.h ..\utsm-ipc\ipc_proto.h \
-  include\utsm\hypercall.h include\utsm\drr.h include\utsm\sched_ext.h \
-  include\utsm\sched.h include\utsm\dkm.h include\utsm\dma.h \
-  include\utsm\block.h include\utsm\net.h include\utsm\paging.h \
-  include\utsm\idt.h include\utsm\dsk.h include\utsm\linux_compat.h \
-  include\utsm\xj380_loader.h include\utsm\instr.h kernel\ini_parser.h \
+  include\utsm\panic.h include\utsm\arena.h include\utsm\utsm.h \
+  include\utsm\status.h include\utsm\config.h include\utsm\uuid.h \
+  include\utsm\process.h include\utsm\capability.h \
+  include\utsm\segment.h include\utsm\dirty.h include\utsm\utrw.h \
+  include\utsm\vmm.h include\utsm\linux_loader.h include\utsm\ipc_shm.h \
+  ..\utsm-ipc\ipc_proto.h include\utsm\hypercall.h include\utsm\drr.h \
+  include\utsm\sched_ext.h include\utsm\sched.h include\utsm\dkm.h \
+  include\utsm\dma.h include\utsm\block.h include\utsm\net.h \
+  include\utsm\paging.h include\utsm\idt.h include\utsm\dsk.h \
+  include\utsm\linux_compat.h include\utsm\xj380_loader.h \
+  include\utsm\instr.h kernel\ini_parser.h \
   kernel\..\arch\x86_64\limine.h kernel\..\pe\pe_dll_manager.h
 include\utsm\log.h:
 include\utsm\types.h:
+include\utsm\panic.h:
 include\utsm\arena.h:
 include\utsm\utsm.h:
 include\utsm\status.h:

CODE/UTSM/pe/pe_loader.c

@@ -17,6 +17,7 @@
 #include "../include/utsm/pe.h"
 #include <utsm/arena.h>
 #include <utsm/log.h>
+#include <utsm/panic.h>
 #include <utsm/types.h>
 
 /* 合成 shim 地址范围（32位解释器用）：0x00010000..0x0001FFFF */
@@ -202,7 +203,11 @@ static void resolve_imports(u8 *image, u64 image_base_actual,
 
             const char *func_name = 0;
             if (thunk & 0x80000000ULL) {
-                /* 序号导入：暂不支持，记为未实现 */
+                /* 严格错误策略插桩：序号导入是未实现路径，零降级 panic
+                 * （PE-E02）。shim 表按名称索引，序号导入无法解析语义。 */
+                log_error("[PE] ordinal import encountered");
+                panic_full("PE-E02 ORDINAL IMPORT NOT IMPLEMENTED",
+                           "PE import by ordinal: designed, not implemented", 0);
                 func_name = "#ordinal";
             } else {
                 /* 名称导入：thunk 是 IMAGE_IMPORT_BY_NAME 的 RVA */

CODE/UTSM/pe/pe_loader.d

@@ -0,0 +1,14 @@
+pe/pe_loader.o: pe\pe_loader.c pe\pe_loader.h include\utsm\types.h \
+  include\utsm\pe.h pe\pe_shim.h pe\pe_dll_manager.h pe\x86emu32.h \
+  pe\..\include\utsm\pe.h include\utsm\arena.h include\utsm\log.h \
+  include\utsm\panic.h
+pe\pe_loader.h:
+include\utsm\types.h:
+include\utsm\pe.h:
+pe\pe_shim.h:
+pe\pe_dll_manager.h:
+pe\x86emu32.h:
+pe\..\include\utsm\pe.h:
+include\utsm\arena.h:
+include\utsm\log.h:
+include\utsm\panic.h:

CODE/UTSM/pe/pe_shim.c

@@ -29,6 +29,7 @@
 #include "../include/utsm/pe.h"   /* P5: pe_window_host */
 #include <utsm/arena.h>
 #include <utsm/log.h>
+#include <utsm/panic.h>
 #include <utsm/types.h>
 #include "../arch/x86_64/limine.h"
 
@@ -1753,11 +1754,15 @@ static u64 __attribute__((ms_abi)) shim_SetDIBitsToDevice(
     return copied;
 }
 
-/* 未实现 stub(64位)— 日志告警(含调用点返回地址)并返回 0 */
+/* 未实现 stub(64位)——严格错误策略插桩：PE 应用调到 shim 表未覆盖的
+ * API = 未实现路径，按零降级原则 panic（PE-E01），不再告警返回 0。
+ * shim 表没有的 API 一旦被调用，PE 程序的语义已经是错的。 */
 static u64 __attribute__((ms_abi)) shim_unimpl64(u64 a0, u64 a1, u64 a2, u64 a3) {
     (void)a0; (void)a1; (void)a2; (void)a3;
-    log_warn("[PE] unimplemented API called");
+    log_error("[PE] unimplemented API called");
     log_hex64("[PE]   caller rip=", (u64)__builtin_return_address(0));
+    panic_full("PE-E01 UNSHIMMED API CALLED",
+               "PE app imported an API outside the shim table: not implemented", 0);
     return 0;
 }
 

CODE/UTSM/pe/pe_shim.d

@@ -0,0 +1,11 @@
+pe/pe_shim.o: pe\pe_shim.c pe\pe_shim.h include\utsm\types.h \
+  pe\pe_dll_manager.h pe\..\include\utsm\pe.h include\utsm\arena.h \
+  include\utsm\log.h include\utsm\panic.h pe\..\arch\x86_64\limine.h
+pe\pe_shim.h:
+include\utsm\types.h:
+pe\pe_dll_manager.h:
+pe\..\include\utsm\pe.h:
+include\utsm\arena.h:
+include\utsm\log.h:
+include\utsm\panic.h:
+pe\..\arch\x86_64\limine.h:

CODE/UTSM/pkg/pkg.c

@@ -0,0 +1,38 @@
+/* ===================================================================
+ *  pkg.c — 包管理器骨架（Pacman 五阶段方案，docs/STATUS.md）
+ *
+ *  设计已定（五阶段：清单 → 仓库索引 → 差分下载 → 安装事务 →
+ *  回滚钩子接 DRR），实现未动。建立代码骨架：调用即莲花 panic，
+ *  零降级零静默。
+ * =================================================================== */
+
+#include <utsm/types.h>
+#include <utsm/panic.h>
+#include <utsm/log.h>
+
+/* 阶段1: 从仓库清单解析包元数据（名称/版本/依赖/文件清单） */
+int pkg_query(const char *name) {
+    (void)name;
+    log_error("[PKG] query requested");
+    panic_full("PKG-E01 PKG QUERY NOT IMPLEMENTED",
+               "pacman-style package query: designed (5-phase), not implemented", 0);
+    return -1;
+}
+
+/* 阶段2+3: 仓库索引 + 差分下载 */
+int pkg_install(const char *name) {
+    (void)name;
+    log_error("[PKG] install requested");
+    panic_full("PKG-E02 PKG INSTALL NOT IMPLEMENTED",
+               "package install transaction: designed (5-phase), not implemented", 0);
+    return -1;
+}
+
+/* 阶段4+5: 安装事务 + DRR 回滚钩子 */
+int pkg_remove(const char *name) {
+    (void)name;
+    log_error("[PKG] remove requested");
+    panic_full("PKG-E03 PKG REMOVE NOT IMPLEMENTED",
+               "package removal + DRR rollback hook: designed (5-phase), not implemented", 0);
+    return -1;
+}

CODE/UTSM/pkg/pkg.d

@@ -0,0 +1,5 @@
+pkg/pkg.o: pkg\pkg.c include\utsm\types.h include\utsm\panic.h \
+  include\utsm\log.h
+include\utsm\types.h:
+include\utsm\panic.h:
+include\utsm\log.h:

CODE/UTSM/sched/sched.c

@@ -17,6 +17,7 @@
 #include <utsm/sched.h>
 #include <utsm/sched_ext.h>
 #include <utsm/log.h>
+#include <utsm/panic.h>
 #include <utsm/arena.h>
 #include <utsm/config.h>
 #include <utsm/process.h>
@@ -630,7 +631,9 @@ void utsm_sched_demo_window(void) {
     log_hex64("[SCHED] demo tasks=", (u64)((a >= 0) + (b >= 0) + (c >= 0)));
 
     if (utsm_sched_enable(0) != 0) {
-        log_warn("[SCHED] enable failed, demo window skipped");
+        /* 严格错误策略插桩：enable 失败不允许静默跳过演示窗口继续启动 */
+        panic_full("SCH-E02 SCHED ENABLE FAILED",
+                   "utsm_sched_enable failed; skipping demo window is forbidden", 0);
         return;
     }
 

CODE/UTSM/sched/sched.d

@@ -1,14 +1,15 @@
 sched/sched.o: sched\sched.c include\utsm\sched.h include\utsm\types.h \
-  include\utsm\sched_ext.h include\utsm\log.h include\utsm\arena.h \
-  include\utsm\config.h include\utsm\process.h include\utsm\uuid.h \
-  include\utsm\capability.h include\utsm\status.h include\utsm\idt.h \
-  include\utsm\drr.h include\utsm\lapic_timer.h include\utsm\dkm.h \
-  include\utsm\dma.h include\utsm\block.h include\utsm\net.h \
-  include\utsm\paging.h
+  include\utsm\sched_ext.h include\utsm\log.h include\utsm\panic.h \
+  include\utsm\arena.h include\utsm\config.h include\utsm\process.h \
+  include\utsm\uuid.h include\utsm\capability.h include\utsm\status.h \
+  include\utsm\idt.h include\utsm\drr.h include\utsm\lapic_timer.h \
+  include\utsm\dkm.h include\utsm\dma.h include\utsm\block.h \
+  include\utsm\net.h include\utsm\paging.h
 include\utsm\sched.h:
 include\utsm\types.h:
 include\utsm\sched_ext.h:
 include\utsm\log.h:
+include\utsm\panic.h:
 include\utsm\arena.h:
 include\utsm\config.h:
 include\utsm\process.h:

CODE/UTSM/vmm/hypercall.c

@@ -160,31 +160,37 @@ static long hcall_surface_info(u64 a0, u64 a1, u64 a2) {
     return UTSM_HCALL_OK;
 }
 
+/* ===================================================================
+ *  严格错误策略插桩：Phase 1.3 设计已定但未实现的 hypercall，
+ *  一律 panic（HCALL-E 系列），零降级零 NOSYS 静默返回。
+ * =================================================================== */
+#include <utsm/panic.h>
+
 static long hcall_cap_validate(u64 a0, u64 a1, u64 a2) {
-    /* Phase 1.3: stub — capability validation not yet implemented */
     (void)a0; (void)a1; (void)a2;
-    log_info("[HCALL] CAP_VALIDATE (stub)");
+    panic_full("HCALL-E01 CAP_VALIDATE NOT IMPLEMENTED",
+               "capability validation hypercall: designed (Phase 1.3), not implemented", 0);
     return UTSM_HCALL_NOSYS;
 }
 
 static long hcall_utrw_read(u64 a0, u64 a1, u64 a2) {
-    /* Phase 1.3: stub — sealed memory read not yet implemented */
     (void)a0; (void)a1; (void)a2;
-    log_info("[HCALL] UTRW_READ (stub)");
+    panic_full("HCALL-E02 UTRW_READ NOT IMPLEMENTED",
+               "sealed memory read hypercall: designed (Phase 1.3), not implemented", 0);
     return UTSM_HCALL_NOSYS;
 }
 
 static long hcall_utrw_write(u64 a0, u64 a1, u64 a2) {
-    /* Phase 1.3: stub — sealed memory write not yet implemented */
     (void)a0; (void)a1; (void)a2;
-    log_info("[HCALL] UTRW_WRITE (stub)");
+    panic_full("HCALL-E03 UTRW_WRITE NOT IMPLEMENTED",
+               "sealed memory write hypercall: designed (Phase 1.3), not implemented", 0);
     return UTSM_HCALL_NOSYS;
 }
 
 static long hcall_drr_checkpoint(u64 a0, u64 a1, u64 a2) {
-    /* Phase 1.3: stub — DRR checkpoint trigger not yet implemented */
     (void)a0; (void)a1; (void)a2;
-    log_info("[HCALL] DRR_CHECKPOINT (stub)");
+    panic_full("HCALL-E04 DRR_CHECKPOINT NOT IMPLEMENTED",
+               "DRR checkpoint hypercall: designed (Phase 1.3), not implemented", 0);
     return UTSM_HCALL_NOSYS;
 }
 
@@ -213,8 +219,9 @@ static long hcall_console_write(u64 a0, u64 a1, u64 a2) {
 }
 
 static long hcall_console_read(u64 a0, u64 a1, u64 a2) {
-    /* Phase 1.3: stub — console read not yet implemented */
     (void)a0; (void)a1; (void)a2;
+    panic_full("HCALL-E05 CONSOLE_READ NOT IMPLEMENTED",
+               "console read hypercall: designed (Phase 1.3), not implemented", 0);
     return UTSM_HCALL_NOSYS;
 }
 

CODE/UTSM/vmm/hypercall.d

@@ -0,0 +1,17 @@
+vmm/hypercall.o: vmm\hypercall.c include\utsm\hypercall.h \
+  include\utsm\types.h include\utsm\vmx.h include\utsm\ept.h \
+  include\utsm\vmm.h include\utsm\ipc_shm.h ..\utsm-ipc\ipc_proto.h \
+  include\utsm\linux_compat.h include\utsm\linux_loader.h \
+  include\utsm\log.h vmm\..\arch\x86_64\limine.h include\utsm\panic.h
+include\utsm\hypercall.h:
+include\utsm\types.h:
+include\utsm\vmx.h:
+include\utsm\ept.h:
+include\utsm\vmm.h:
+include\utsm\ipc_shm.h:
+..\utsm-ipc\ipc_proto.h:
+include\utsm\linux_compat.h:
+include\utsm\linux_loader.h:
+include\utsm\log.h:
+vmm\..\arch\x86_64\limine.h:
+include\utsm\panic.h:

CODE/dsk/main.c

@@ -1327,10 +1327,11 @@ static int dsk_load_elf(u8 *data, u32 size, void **entry_out) {
         if (rela_off && rela_sz) {
             /* P0 修复: 边界检查 rela_off 和 rela_off+rela_sz 必须在 [min_vaddr, min_vaddr+isize) 内 */
             if (rela_off < min_vaddr || rela_off >= min_vaddr + isize) {
-                logl("[DSK] ELF: rela_off out of bounds, skipping reloc");
+                /* 严格错误策略：重定位表越界 = 镜像损坏，零降级 panic */
                 logh("[DSK] ELF: rela_off=", rela_off);
                 logh("[DSK] ELF: min_vaddr=", min_vaddr);
                 logh("[DSK] ELF: isize=", isize);
+                dsk_fatal("ELF-E01 RELA OUT OF BOUNDS");
                 continue;
             }
             if (rela_off + rela_sz > min_vaddr + isize) {