feat: U2 UTRW slow path real branches

- slow_path.c: KEY_MISS -> PCKC re-derive (retry OK); EPOCH -> refresh cap epoch via out_cap (retry OK); STALE_CAP permanent; MAC_FAILED/POISONED -> PCKC invalidate + DRR fault report; RETRY passthrough
- status.h: add UTSM_ERR_MAC_FAILED (-11); utrw.h: slow path takes cap/rights/offset/len/reason + out_cap
- selftest: EPOCH refresh + KEY_MISS re-derive + POISONED passthrough coverage, full SELFTEST PASS in QEMU (.build_tmp/qemu_serial_u2slowpath.log)

CODE/UTSM/include/utsm/status.h

@@ -12,7 +12,8 @@ typedef enum {
     UTSM_ERR_KEY_MISS = -7,
     UTSM_ERR_STATE = -8,
     UTSM_ERR_POISONED = -9,
-    UTSM_ERR_RETRY = -10
+    UTSM_ERR_RETRY = -10,
+    UTSM_ERR_MAC_FAILED = -11   /* U2: 页 MAC 校验失败（slow path 处置） */
 } utsm_status;
 
 #endif

CODE/UTSM/include/utsm/utrw.h

@@ -7,6 +7,12 @@
 
 int utsm_read(utsm_capability cap, u64 offset, void *dst, u64 len);
 int utsm_write(utsm_capability cap, u64 offset, const void *src, u64 len);
-int utsm_slow_path(int reason);
+
+/* U2: Slow Path —— Fast Path 失败后的恢复分支。
+ * reason 为 Fast Path 返回的错误码；恢复成功返回 UTSM_OK（可重试），
+ * EPOCH 场景经 out_cap 回传刷新后的凭证（可为 NULL）。
+ * 其余返回值为不可恢复错误。 */
+int utsm_slow_path(utsm_capability cap, u32 rights, u64 offset, u64 len,
+                   int reason, utsm_capability *out_cap);
 
 #endif

CODE/UTSM/test/utsm_selftest.c

@@ -1,4 +1,5 @@
 #include <utsm/utsm.h>
+#include <utsm/pckc.h>
 #include <utsm/log.h>
 #include <utsm/segment.h>
 #include <utsm/arena.h>
@@ -71,6 +72,53 @@ int utsm_selftest_run(void) {
     }
     log_info("[UTSM] selftest read ok");
 
+    /* ==== U2: Slow Path 真分支（EPOCH 刷新 / KEY_MISS 重派生 / POISONED 拒绝） ==== */
+    {
+        /* 1) EPOCH 过期：伪造 stale cap（epoch=desc->key_epoch+1），slow path 应
+         *    返回 OK 并回传刷新后的 cap，重试 read 应成功且内容一致 */
+        utsm_capability stale = cap;
+        stale.epoch = (u32)desc->key_epoch + 1;
+        utsm_capability refreshed = stale;
+        status = utsm_slow_path(stale, UTSM_RIGHT_READ, 128, len,
+                                UTSM_ERR_EPOCH, &refreshed);
+        if (status != UTSM_OK) {
+            log_error("[UTSM] selftest slow EPOCH recover failed");
+            return status;
+        }
+        char slow_rb[64];
+        status = utsm_read(refreshed, 128, slow_rb, len);
+        if (status != UTSM_OK || memcmp(slow_rb, message, len) != 0) {
+            log_error("[UTSM] selftest slow EPOCH retry read failed");
+            return (status == UTSM_OK) ? UTSM_ERR_INVALID : status;
+        }
+        log_info("[UTSM] selftest slow EPOCH ok");
+
+        /* 2) KEY_MISS：清掉该段 PCKC 缓存，slow path 重派生应返回 OK */
+        utsm_pckc_invalidate_slot(cap.segment_slot);
+        status = utsm_slow_path(refreshed, UTSM_RIGHT_READ, 128, len,
+                                UTSM_ERR_KEY_MISS, 0);
+        if (status != UTSM_OK) {
+            log_error("[UTSM] selftest slow KEY_MISS recover failed");
+            return status;
+        }
+        status = utsm_read(refreshed, 128, slow_rb, len);
+        if (status != UTSM_OK || memcmp(slow_rb, message, len) != 0) {
+            log_error("[UTSM] selftest slow KEY_MISS retry read failed");
+            return (status == UTSM_OK) ? UTSM_ERR_INVALID : status;
+        }
+        log_info("[UTSM] selftest slow KEY_MISS ok");
+
+        /* 3) POISONED：不可恢复，原样返回；DRR fault 留痕不重启
+         *    （selftest 场景 drr_report_fault 只计数，无 reboot 语义） */
+        status = utsm_slow_path(refreshed, UTSM_RIGHT_READ, 128, len,
+                                UTSM_ERR_POISONED, 0);
+        if (status != UTSM_ERR_POISONED) {
+            log_error("[UTSM] selftest slow POISONED passthrough failed");
+            return UTSM_ERR_INVALID;
+        }
+        log_info("[UTSM] selftest slow POISONED ok");
+    }
+
     /* ==== SCHED-1: O(1) runqueue 语义（合成 TCB，协作式，无 tick） ==== */
     /* ==== SCHED-1 + SCHED-2: runqueue / block-wake（tick 竞态保护） ==== */
     {

CODE/UTSM/test/utsm_selftest.d

@@ -3,9 +3,9 @@ test/utsm_selftest.o: test\utsm_selftest.c include\utsm\utsm.h \
   include\utsm\uuid.h include\utsm\process.h include\utsm\capability.h \
   include\utsm\segment.h include\utsm\dirty.h include\utsm\utrw.h \
   include\utsm\vmm.h include\utsm\linux_loader.h include\utsm\ipc_shm.h \
-  ..\utsm-ipc\ipc_proto.h include\utsm\hypercall.h include\utsm\log.h \
-  include\utsm\arena.h include\utsm\drr.h include\utsm\sched_ext.h \
-  include\utsm\sched.h
+  ..\utsm-ipc\ipc_proto.h include\utsm\hypercall.h include\utsm\pckc.h \
+  include\utsm\crypto.h include\utsm\log.h include\utsm\arena.h \
+  include\utsm\drr.h include\utsm\sched_ext.h include\utsm\sched.h
 include\utsm\utsm.h:
 include\utsm\types.h:
 include\utsm\status.h:
@@ -21,6 +21,8 @@ include\utsm\linux_loader.h:
 include\utsm\ipc_shm.h:
 ..\utsm-ipc\ipc_proto.h:
 include\utsm\hypercall.h:
+include\utsm\pckc.h:
+include\utsm\crypto.h:
 include\utsm\log.h:
 include\utsm\arena.h:
 include\utsm\drr.h:

CODE/UTSM/utrw/slow_path.c

@@ -1,5 +1,101 @@
 #include <utsm/utrw.h>
+#include <utsm/segment.h>
+#include <utsm/pckc.h>
+#include <utsm/drr.h>
+#include <utsm/log.h>
 
-int utsm_slow_path(int reason) {
-    return reason;
+/* ===================================================================
+ *  U2: UTRW Slow Path 真分支
+ *
+ *  "快柜空着，慢柜要你先念 UUID 咒语——念错也给你件，只是晚一拍。"
+ *
+ *  Fast Path（read.c/write.c）失败后进入本分支，按 reason 分派：
+ *    KEY_MISS     -> PCKC 重派生密钥，成功即 OK（可重试）
+ *    EPOCH        -> 刷新 cap.epoch（out_cap 回传），OK（可重试）
+ *    STALE_CAP    -> generation 不匹配，不可恢复，原样返回
+ *    MAC_FAILED   -> PCKC 失效 + DRR fault（回滚路径接管），返回原错误
+ *    POISONED     -> DRR fault 留痕，返回原错误（段已坏）
+ *    RETRY        -> seqlock 忙，无恢复动作，返回 RETRY
+ *
+ *  返回 UTSM_OK 表示"已恢复，Fast Path 可立即重试"；
+ *  其余返回值为不可恢复错误，调用方不得对同一 cap 继续访问。
+ *
+ *  Slow 路径有审计日志（log_warn）——慢要慢得可解释。
+ * =================================================================== */
+
+/* 轻量校验（绕过 epoch 检查）：EPOCH/KEY_MISS 恢复前确认段其余属性仍然合法 */
+static int slow_validate_ignoring_epoch(utsm_capability cap, u32 required_rights,
+                                        u64 offset, u64 len,
+                                        utsm_segment_desc **out_desc) {
+    utsm_segment_desc *desc = utsm_get_segment(cap.segment_slot);
+    if (!desc) return UTSM_ERR_INVALID;
+    if (desc->state != UTSM_SEG_ACTIVE) {
+        return (desc->state == UTSM_SEG_POISONED) ? UTSM_ERR_POISONED : UTSM_ERR_STATE;
+    }
+    if (desc->generation != cap.generation) return UTSM_ERR_STALE_CAP;
+    if ((cap.rights & required_rights) != required_rights) return UTSM_ERR_ACCESS;
+    if (offset > desc->cipher_length || len > desc->cipher_length ||
+        offset + len > desc->cipher_length) return UTSM_ERR_BOUNDS;
+    *out_desc = desc;
+    return UTSM_OK;
+}
+
+int utsm_slow_path(utsm_capability cap, u32 rights, u64 offset, u64 len,
+                   int reason, utsm_capability *out_cap) {
+    switch (reason) {
+    case UTSM_ERR_KEY_MISS: {
+        /* 咒语没背熟：PCKC 失效后重派生 */
+        utsm_segment_desc *desc = NULL;
+        int st = slow_validate_ignoring_epoch(cap, rights, offset, len, &desc);
+        if (st != UTSM_OK) return st;
+        utsm_pckc_invalidate_slot(cap.segment_slot);
+        utsm_key_material key;
+        st = utsm_pckc_get_or_derive(cap.segment_slot, desc, &key);
+        if (st != UTSM_OK) {
+            log_warn("[UTRW] slow: KEY_MISS re-derive failed");
+            return st;
+        }
+        log_warn("[UTRW] slow: KEY_MISS -> key re-derived (retry)");
+        return UTSM_OK;
+    }
+
+    case UTSM_ERR_EPOCH: {
+        /* 纪元过期：cap.epoch 落后于段 key_epoch —— 刷新后可重试 */
+        utsm_segment_desc *desc = NULL;
+        int st = slow_validate_ignoring_epoch(cap, rights, offset, len, &desc);
+        if (st != UTSM_OK) return st;
+        if (out_cap) {
+            *out_cap = cap;
+            out_cap->epoch = (u32)desc->key_epoch;
+        }
+        log_warn("[UTRW] slow: EPOCH expired -> cap refreshed (retry)");
+        return UTSM_OK;
+    }
+
+    case UTSM_ERR_STALE_CAP:
+        /* generation 不匹配：凭证指向已销毁的段世代，不可恢复 */
+        log_warn("[UTRW] slow: STALE_CAP -> permanent");
+        return reason;
+
+    case UTSM_ERR_MAC_FAILED:
+        /* 页 MAC 校验失败：疑似静默损坏 —— 交 DRR（回滚）处置 */
+        log_warn("[UTRW] slow: MAC_FAILED -> DRR fault reported");
+        utsm_pckc_invalidate_slot(cap.segment_slot);
+        drr_report_fault("utrw slow path: page MAC verification failed");
+        return reason;
+
+    case UTSM_ERR_POISONED:
+        /* 段已中毒：留痕后原样拒绝 */
+        log_warn("[UTRW] slow: POISONED -> DRR notified, access denied");
+        drr_report_fault("utrw slow path: access to poisoned segment");
+        return reason;
+
+    case UTSM_ERR_RETRY:
+        /* seqlock 忙（writer 正在写）：无恢复动作，调用方自旋重试 */
+        return UTSM_ERR_RETRY;
+
+    default:
+        log_warn("[UTRW] slow: unhandled reason -> pass through");
+        return reason;
+    }
 }

CODE/UTSM/utrw/slow_path.d

@@ -0,0 +1,17 @@
+utrw/slow_path.o: utrw\slow_path.c include\utsm\utrw.h \
+  include\utsm\types.h include\utsm\status.h include\utsm\capability.h \
+  include\utsm\segment.h include\utsm\uuid.h include\utsm\dirty.h \
+  include\utsm\pckc.h include\utsm\config.h include\utsm\crypto.h \
+  include\utsm\drr.h include\utsm\log.h
+include\utsm\utrw.h:
+include\utsm\types.h:
+include\utsm\status.h:
+include\utsm\capability.h:
+include\utsm\segment.h:
+include\utsm\uuid.h:
+include\utsm\dirty.h:
+include\utsm\pckc.h:
+include\utsm\config.h:
+include\utsm\crypto.h:
+include\utsm\drr.h:
+include\utsm\log.h: