feat: SKEL skeleton instrumentation - designed-but-unimplemented paths panic

- hypercall.c: 5 Phase 1.3 stubs -> HCALL-E01..E05 panic (no NOSYS return)
- drr_stub.c: snapshot alloc fail -> DRR-E01; new skeletons DRR-E02 root key
  seal, DRR-E03 task kill crypto erase, DRR-E04/E05 segment/system rollback,
  DRR-E06/E07 driver recovery ops dispatch
- sched.c: enable fail -> SCH-E02 panic (no silent demo skip)
- dkm/kernel_api.c: D1 hot-unload DKM-E01, D2 bare code loader DKM-E02,
  SIPI AP wake DKM-E03 skeletons
- virtio_net tx/rx stubs -> VNET-E01/E02; ath9k tx stub -> ATH-E01;
  xhci port reset -> XHC-E01; nvme MSI/MSI-X fail -> NVME-E01..E03 (no
  silent polling downgrade); e1000 MAC fallback -> E1K-E01
- pe_shim unimpl API -> PE-E01; PE ordinal import -> PE-E02
- kernel/main.c: lib sync / vscode install fail -> LNX-E01/E02
- NEW brand/brand.c (E1 boot anim BRAND-E01, E2 time egg BRAND-E02) and
  pkg/pkg.c (pacman skeleton PKG-E01..03), wired into UTSM MAKEFILE
- Deliberate design-internal fallbacks kept and documented (VMX skip,
  bzImage skip, KDE fallback, boot-module fallback, apic->PIC route)

CODE/DKM/ath9k/ath9k.c

@@ -531,8 +531,11 @@ static void ath9k_rx_drain(void) {
  * 真实硬件验证后增量完善。
  */
 static void ath9k_set_channel(u8 channel) {
-    (void)channel;
-    /* TODO: 完整 ath9k 信道切换序列（参考 ar9002_hw_set_channel） */
+    /* TODO: 完整 ath9k 信道切换序列（参考 ar9002_hw_set_channel）。
+     * 严格错误策略插桩：本序列是占位最小实现，若上层依赖"信道已真正
+     * 切换"的语义（如定向扫描），调用方必须走 panic 版本接口——
+     * 当前扫描状态机明确容忍近似信道，此处保留最小序列并打点。 */
+    raw_hex("[ath9k] set_channel (minimal sequence), ch=", channel);
     /* 触发 RFBUS 请求，等待 grant */
     ath9k_reg_write(AR_PHY_RFBUS_REQ, 0x1);
     dkm_delay_us(5);
@@ -601,9 +604,11 @@ static int ath9k_is_wireless_impl(void *ctx) {
     return 1;
 }
 
-/* ath9k 当前不支持 TX（仅扫描） */
+/* ath9k 当前不支持 TX（仅扫描）——严格错误策略插桩：上层若真把帧交给
+ * 只会扫描的无线驱动，panic 而非静默丢包（ATH-E01）。 */
 static int ath9k_tx_stub(void *ctx, const void *packet, u32 length) {
     (void)ctx; (void)packet; (void)length;
+    g_log->panic("ATH-E01 TX NOT IMPLEMENTED (scan-only driver got a tx)");
     return -1;
 }
 

CODE/DKM/e1000/e1000.c

@@ -735,11 +735,12 @@ int driver_init(const struct dkm_kernel_api *api,
         raw_log("[e1000] MAC from RAL/RAH\n");
     }
 
-    /* 仍为全 0 或多播位错误时使用与虚拟机配置一致的回退 MAC */
+    /* 仍为全 0 或多播位错误时——严格错误策略插桩：MAC 读不到 = 网卡
+     * 身份不可知，零降级 panic（E1K-E01），不再用硬编码 MAC 冒充。 */
     if ((mac[0]==0&&mac[1]==0&&mac[2]==0&&mac[3]==0&&mac[4]==0&&mac[5]==0) ||
         (mac[0] & 1)) {
-        mac[0]=0x52; mac[1]=0x54; mac[2]=0x00; mac[3]=0x12; mac[4]=0x34; mac[5]=0x56;
-        raw_log("[e1000] using fallback MAC 52:54:00:12:34:56\n");
+        raw_log("[e1000] MAC read failed (zero/multicast)\n");
+        g_log->panic("E1K-E01 MAC READ FAILED");
     }
 
     raw_mac("[e1000] MAC=", mac);

CODE/DKM/nvme/nvme.c

@@ -920,13 +920,17 @@ static int nvme_msix_program(const struct dkm_kernel_api *api,
      * 页属性 PCD|PWT (UC), MSI-X 表访问不要求 cache 一致性操作。 */
     volatile u32 *tbl = (volatile u32 *)api->mm_map_mmio(tbl_phys, 4096);
     if (!tbl) {
-        g_log->warn("[nvme] MSI-X: table MMIO map failed; polling");
+        /* 严格错误策略插桩：MSI-X 表映射失败不允许静默转轮询（NVME-E01） */
+        g_log->error("[nvme] MSI-X: table MMIO map failed");
+        g_log->panic("NVME-E01 MSIX TABLE MAP FAILED");
         return 0;
     }
 
     int vector = api->irq_vector_alloc();
     if (vector < 0 || vector > 255) {
-        g_log->warn("[nvme] MSI-X: vector alloc failed; polling");
+        /* 严格错误策略插桩：向量分配失败不允许静默转轮询（NVME-E02） */
+        g_log->error("[nvme] MSI-X: vector alloc failed");
+        g_log->panic("NVME-E02 VECTOR ALLOC FAILED");
         return 0;
     }
     log_dec("[nvme] MSI-X vector=", (u64)vector);
@@ -958,7 +962,10 @@ static int nvme_msix_program(const struct dkm_kernel_api *api,
     log_hex("[nvme] MSI-X readback entry vctl=", rb_vc);
     if (!(rb_ctl & 0x8000u) || rb_a0 != addr || rb_a1 != 0 ||
         (rb_d & 0xffu) != ((u32)vector & 0xffu) || (rb_vc & 1u)) {
-        g_log->warn("[nvme] MSI-X: readback mismatch; rolling back");
+        /* 严格错误策略插桩：MSI-X 编程回读不符 = 硬件/虚拟机拒绝消息中断，
+         * 不允许静默回滚转轮询（NVME-E03）。 */
+        g_log->error("[nvme] MSI-X: readback mismatch");
+        g_log->panic("NVME-E03 MSIX READBACK MISMATCH");
         u32 rb = dkm_pci_read(bus, dev, func, (u8)cap);
         rb = (rb & 0x0000ffffu) | (msg_ctl << 16);      /* 恢复原 msg_ctl */
         dkm_pci_write(bus, dev, func, (u8)cap, rb);

CODE/DKM/virtio_net/virtio_net.c

@@ -775,19 +775,21 @@ static void virtio_net_selftest(void) {
     log_hex("[virtio_net] selftest rx frames seen=", frames);
 }
 
-/* ================= stub（初始化失败时的安全占位，与历史行为一致） ================= */
+/* ================= stub（初始化失败时的安全占位） =================
+ * 严格错误策略插桩：占位不再静默丢包/静默无数据——一旦被上层调用
+ * （即有人真的把流量交给未协商 virtqueue 的设备），立即莲花 panic。
+ * 正常路径 netman 因 flags 缺 LINK_UP 不会选中本驱动，stub 不触发。 */
 
 static int virtio_net_tx_stub(void *ctx, const void *packet, u32 length) {
-    (void)ctx;
-    (void)packet;
-    log_hex("[virtio_net] tx stub: packet dropped, len=", length);
+    (void)ctx; (void)packet;
+    log_hex("[virtio_net] tx stub hit, len=", length);
+    g_log->panic("VNET-E01 TX VIRTQUEUE NOT IMPLEMENTED (stub tx called)");
     return 0;
 }
 
 static int virtio_net_rx_poll_stub(void *ctx, void *buffer, u32 capacity, u32 *out_length) {
-    (void)ctx;
-    (void)buffer;
-    (void)capacity;
+    (void)ctx; (void)buffer; (void)capacity;
+    g_log->panic("VNET-E02 RX VIRTQUEUE NOT IMPLEMENTED (stub rx called)");
     if (out_length) *out_length = 0;
     return 0;
 }

CODE/DKM/xhci/xhci.c

@@ -2073,7 +2073,8 @@ int driver_init(const struct dkm_kernel_api *api,
 
         /* Port Reset */
         if (xhci_reset_port(port) != 0) {
-            g_log->warn("[xhci] port reset failed; skipping");
+            /* 严格错误策略插桩：端口复位失败 = 设备不可用，零降级 panic */
+            g_log->panic("XHC-E01 PORT RESET FAILED");
             continue;
         }
         g_log->info("[xhci] port reset OK");