feat: U3 @sealed optional segment marking - phase 2 complete

- UTSM_SEG_F_UNSEALED: plaintext direct-store segments (zero crypto overhead) while keeping capability checks, dirty tracking, intent/commit log and seqlock protocol; default remains sealed
- linker.ld: .sealed output section with __sealed_start/__sealed_end symbols for future static sealed data
- selftest: unsealed segment stores plaintext verifiably + read-back, full SELFTEST PASS (.build_tmp/qemu_serial_u3sealed.log)
- phase 2 (UTSM/UTRW) now complete in ROADMAP_INSANE

CODE/UTSM/include/utsm/segment.h

@@ -22,6 +22,10 @@ typedef enum {
 #define UTSM_SEG_F_EXEC            (1U << 2)
 #define UTSM_SEG_F_DMA             (1U << 3)
 #define UTSM_SEG_F_STRONG_RECOVERY (1U << 4)
+/* U3: @sealed 可选标记。默认（不加此 flag）= 封缄段（密文存储，读写走 UTRW
+ * 加解密）；加 UTSM_SEG_F_UNSEALED = 明文直存段（0 加解密开销，读写仍走
+ * capability 校验与 dirty 跟踪，但直接 memcpy）。"用户能选锁不锁"。 */
+#define UTSM_SEG_F_UNSEALED        (1U << 5)
 
 typedef struct utsm_segment_desc {
     uuid128_t segment_uuid;

CODE/UTSM/linker.ld

@@ -27,6 +27,16 @@ SECTIONS
         *(COMMON)
     } :data
 
+    /* U3: @sealed 段标记 —— 用户代码可把静态数据放进 .sealed section
+     *（__attribute__((section(".sealed")))），UTSM 侧可遍历
+     * [__sealed_start, __sealed_end) 对该区建立封缄段。未标记数据 0 开销。 */
+    .sealed : ALIGN(4K) {
+        __sealed_start = .;
+        *(.sealed)
+        *(.sealed.*)
+        __sealed_end = .;
+    } :data
+
     .bss : ALIGN(4K) {
         *(.bss*)
     } :data

CODE/UTSM/test/utsm_selftest.c

@@ -156,6 +156,40 @@ int utsm_selftest_run(void) {
         log_info("[UTSM] selftest slow POISONED ok");
     }
 
+    /* ==== U3: @sealed 可选标记 —— unsealed 段明文直存（0 加解密开销） ==== */
+    {
+        utsm_capability ucap;
+        status = utsm_create_segment(process, UTSM_PAGE_SIZE,
+                                     UTSM_SEG_F_READ | UTSM_SEG_F_WRITE |
+                                         UTSM_SEG_F_UNSEALED,
+                                     &ucap);
+        if (status != UTSM_OK) {
+            log_error("[UTSM] selftest unsealed segment create failed");
+            return status;
+        }
+        const char *upl = "unsealed plain text 00";
+        u64 ulen = strlen(upl) + 1;
+        status = utsm_write(ucap, 128, upl, ulen);
+        if (status != UTSM_OK) {
+            log_error("[UTSM] selftest unsealed write failed");
+            return status;
+        }
+        utsm_segment_desc *udesc = utsm_get_segment(ucap.segment_slot);
+        if (!udesc) return UTSM_ERR_INVALID;
+        /* 明文直存：存储区内容必须与明文完全一致（0 开销的可观察证据） */
+        if (memcmp(udesc->cipher_base + 128, upl, ulen) != 0) {
+            log_error("[UTSM] selftest unsealed store not plaintext");
+            return UTSM_ERR_INVALID;
+        }
+        char urb[64];
+        status = utsm_read(ucap, 128, urb, ulen);
+        if (status != UTSM_OK || memcmp(urb, upl, ulen) != 0) {
+            log_error("[UTSM] selftest unsealed read failed");
+            return (status == UTSM_OK) ? UTSM_ERR_INVALID : status;
+        }
+        log_info("[UTSM] selftest unsealed segment ok (plain storage)");
+    }
+
     /* ==== SCHED-1: O(1) runqueue 语义（合成 TCB，协作式，无 tick） ==== */
     /* ==== SCHED-1 + SCHED-2: runqueue / block-wake（tick 竞态保护） ==== */
     {

CODE/UTSM/utrw/read.c

@@ -20,6 +20,12 @@ int utsm_read(utsm_capability cap, u64 offset, void *dst, u64 len) {
         return status;
     }
 
+    /* U3: @unsealed 段 —— 明文直存，0 加解密开销（capability 校验照走） */
+    if (desc->flags & UTSM_SEG_F_UNSEALED) {
+        memcpy(dst, desc->cipher_base + offset, len);
+        return UTSM_OK;
+    }
+
     utsm_key_material key;
     status = utsm_pckc_get_or_derive(cap.segment_slot, desc, &key);
     if (status != UTSM_OK) {

CODE/UTSM/utrw/read.d

@@ -0,0 +1,14 @@
+utrw/read.o: utrw\read.c include\utsm\utrw.h include\utsm\types.h \
+  include\utsm\status.h include\utsm\capability.h include\utsm\segment.h \
+  include\utsm\uuid.h include\utsm\dirty.h include\utsm\pckc.h \
+  include\utsm\config.h include\utsm\crypto.h
+include\utsm\utrw.h:
+include\utsm\types.h:
+include\utsm\status.h:
+include\utsm\capability.h:
+include\utsm\segment.h:
+include\utsm\uuid.h:
+include\utsm\dirty.h:
+include\utsm\pckc.h:
+include\utsm\config.h:
+include\utsm\crypto.h:

CODE/UTSM/utrw/write.c

@@ -21,6 +21,18 @@ int utsm_write(utsm_capability cap, u64 offset, const void *src, u64 len) {
         return status;
     }
 
+    /* U3: @unsealed 段 —— 明文直存，0 加解密开销；dirty/seqlock/log 照走，
+     * checkpoint 路径对明文页同样适用（页 MAC 语义由 DRR 侧统一处理）。 */
+    if (desc->flags & UTSM_SEG_F_UNSEALED) {
+        drr_log_write_intent(cap.segment_slot, offset, len);
+        desc->writer_seq++;
+        memcpy(desc->cipher_base + offset, src, len);
+        utsm_mark_dirty(desc, offset, len);
+        desc->writer_seq++;
+        drr_log_write_commit(cap.segment_slot, offset, len);
+        return UTSM_OK;
+    }
+
     utsm_key_material key;
     status = utsm_pckc_get_or_derive(cap.segment_slot, desc, &key);
     if (status != UTSM_OK) {

CODE/UTSM/utrw/write.d

@@ -0,0 +1,15 @@
+utrw/write.o: utrw\write.c include\utsm\utrw.h include\utsm\types.h \
+  include\utsm\status.h include\utsm\capability.h include\utsm\segment.h \
+  include\utsm\uuid.h include\utsm\dirty.h include\utsm\pckc.h \
+  include\utsm\config.h include\utsm\crypto.h include\utsm\drr.h
+include\utsm\utrw.h:
+include\utsm\types.h:
+include\utsm\status.h:
+include\utsm\capability.h:
+include\utsm\segment.h:
+include\utsm\uuid.h:
+include\utsm\dirty.h:
+include\utsm\pckc.h:
+include\utsm\config.h:
+include\utsm\crypto.h:
+include\utsm\drr.h: