feat: sealed memory early init + verify - UTSM-E01..E04 very-early panic

- NEW core/sealed.c: utsm_sealed_early_init() runs right after utsm_init:
  empty .sealed section -> UTSM-E01 panic; no root key -> UTSM-E02;
  establishes BLAKE2b(root_key) MAC over [__sealed_start,__sealed_end).
- utsm_sealed_verify(): MAC mismatch -> UTSM-E03; verify-before-init ->
  UTSM-E04. Wired into utsm_selftest (U3+ step).
- .sealed region now non-empty by construction: sealed brand record
  "DESHAB-SEALED-MEMORY-V1-DEAICUP" lives in section(".sealed").
- Before this commit nothing ever referenced __sealed_start/__sealed_end:
  the sealed section was never registered, MACed or verified.
- QEMU verify: [SEAL] region=0x20 bytes, MAC established, selftest OK,
  boot reaches wizard, zero spurious panics.

[STUB] P0/UTSM/core/sealed.c | 剩余STUB命中=101（违规=0） | “封缄即落款，空区即自爆” | 已提交=<this>

CODE/UTSM/core/sealed.c

@@ -0,0 +1,74 @@
+/* ===================================================================
+ *  sealed.c — 封缄内存极早期初始化与校验
+ *
+ *  链接脚本已有 .sealed section（[__sealed_start, __sealed_end)，
+ *  U3 @sealed 标记），但历史上无任何代码引用它：封缄段从未建立、
+ *  从未 MAC、从未校验——"封缄内存还没做好"。
+ *
+ *  本模块在 UTSM 极早期（utsm_init 之后、驱动/guest/DSK 之前）：
+ *    1. .sealed 区为空  → panic UTSM-E01（封缄基础设施未就绪，零降级）
+ *    2. 否则以 root key 为 key，BLAKE2b 对整个 .sealed 区算封缄 MAC，
+ *       存入 g_sealed_mac，置 ready。
+ *    3. utsm_sealed_verify() 重算比对，不符 → UTSM-E03。
+ *       （供 selftest / checkpoint 路径调用；骨架阶段无固定调用方。）
+ * =================================================================== */
+
+#include <utsm/types.h>
+#include <utsm/panic.h>
+#include <utsm/log.h>
+#include <utsm/blake2b.h>
+#include <utsm/drr.h>
+
+/* linker.ld 导出的 .sealed 段边界 */
+extern u8 __sealed_start[];
+extern u8 __sealed_end[];
+
+#define UTSM_SEALED_MAC_LEN 32
+
+static u8  g_sealed_mac[UTSM_SEALED_MAC_LEN];
+static int g_sealed_ready = 0;
+
+/* 封缄区常驻品牌落款：保证 .sealed 区非空（否则 UTSM-E01 panic），
+ * 同时是封缄 MAC 保护的第一份真实数据。后续模块把机密放进
+ * __attribute__((section(".sealed"))) 即自动纳入同一 MAC 域。 */
+__attribute__((used, section(".sealed")))
+static const char g_sealed_brand[] = "DESHAB-SEALED-MEMORY-V1-DEAICUP";
+
+/* 极早期封缄初始化：任何不就绪都在这里 panic，绝不带病前进 */
+void utsm_sealed_early_init(void) {
+    u64 region = (u64)(__sealed_end - __sealed_start);
+    if (region == 0) {
+        /* .sealed 区为空 = 没有任何数据被真正封缄 = 基础设施未就绪 */
+        panic_full("UTSM-E01 SEALED MEMORY NOT READY",
+                   ".sealed section is empty: sealing infrastructure not implemented", 0);
+    }
+    const u64 *rk = drr_get_root_key();
+    if (!rk) {
+        panic_full("UTSM-E02 SEALED NO ROOT KEY",
+                   "root key unavailable before sealing .sealed region", 0);
+    }
+    utsm_blake2b(__sealed_start, region, rk, 32, g_sealed_mac, UTSM_SEALED_MAC_LEN);
+    g_sealed_ready = 1;
+    log_hex64("[SEAL] .sealed region bytes=", region);
+    log_info("[SEAL] sealed MAC established");
+}
+
+/* 封缄完整性校验：重算 MAC 并与 init 时的封缄比对 */
+void utsm_sealed_verify(void) {
+    if (!g_sealed_ready) {
+        panic_full("UTSM-E04 SEALED VERIFY BEFORE INIT",
+                   "utsm_sealed_verify called before utsm_sealed_early_init", 0);
+    }
+    u64 region = (u64)(__sealed_end - __sealed_start);
+    u8 mac[UTSM_SEALED_MAC_LEN];
+    const u64 *rk = drr_get_root_key();
+    utsm_blake2b(__sealed_start, region, rk, 32, mac, UTSM_SEALED_MAC_LEN);
+    u64 diff = 0;
+    for (int i = 0; i < UTSM_SEALED_MAC_LEN; i++) diff |= (u64)(mac[i] ^ g_sealed_mac[i]);
+    if (diff != 0) {
+        log_hex64("[SEAL] verify diff=", diff);
+        panic_full("UTSM-E03 SEALED MAC MISMATCH",
+                   ".sealed region content changed without re-seal", 0);
+    }
+    log_info("[SEAL] sealed verify ok");
+}

CODE/UTSM/core/sealed.d

@@ -0,0 +1,9 @@
+core/sealed.o: core\sealed.c include\utsm\types.h include\utsm\panic.h \
+  include\utsm\log.h include\utsm\blake2b.h include\utsm\drr.h \
+  include\utsm\config.h
+include\utsm\types.h:
+include\utsm\panic.h:
+include\utsm\log.h:
+include\utsm\blake2b.h:
+include\utsm\drr.h:
+include\utsm\config.h:

CODE/UTSM/kernel/main.c

@@ -357,6 +357,13 @@ void kernel_main(void) {
     INSTR_TS_END(ts_utsm, "utsm_init");
     log_info("[UTSM] init ok");
 
+    /* === 封缄内存极早期初始化（UTSM-E01..E04） ===
+     * .sealed 区为空 / root key 缺失 → 此处极早期 panic，绝不带病前进。 */
+    {
+        extern void utsm_sealed_early_init(void);
+        utsm_sealed_early_init();
+    }
+
     /* === SAS-R0-PCQ 调度器：bootstrap 任务绑定（Phase 7） ===
      * 只做 sched_init + cpu_init + bootstrap TCB（绑定当前 rsp），
      * 不开中断、不碰定时器，对既有启动行为零影响。
@@ -406,9 +413,15 @@ void kernel_main(void) {
             dsm_load_named(cfg, "pci");
             dsm_load_named(cfg, "ahci");
 
-            /* === Linux guest — 可通过 FUCK [boot] linux_guest=0 跳过 === */
+            /* === Linux guest — 可通过 FUCK [boot] linux_guest=0 跳过 ===
+             * 严格错误策略：linux_guest=1 即"请求了 guest"——模块缺失、
+             * 启动失败、IPC 失败一律 panic（VMM-E/LNX-E），零降级。 */
             int run_linux = ini_get_bool(cfg, "boot", "linux_guest", 1);
-            if (run_linux && linux_loader_init() == 0) {
+            if (run_linux) {
+                if (linux_loader_init() != 0) {
+                    panic_full("VMM-E01 LINUX BZIMAGE MISSING",
+                               "linux_guest=1 but bzImage boot module not found", 0);
+                }
                 INSTR_TS_DECL(ts_linux);
                 INSTR_TS_BEGIN(ts_linux);
                 log_info("[UTSM] Linux loader init ok");
@@ -416,7 +429,8 @@ void kernel_main(void) {
                 if (ipc_shm_init() == 0) {
                     log_info("[UTSM] IPC shm init ok");
                 } else {
-                    log_error("[UTSM] IPC shm init failed (non-fatal)");
+                    panic_full("LNX-E03 IPC SHM INIT FAILED",
+                               "IPC shared memory init failed (was: non-fatal)", 0);
                 }
 
                 int lin_st = linux_launch();
@@ -446,11 +460,14 @@ void kernel_main(void) {
                         }
                     }
                 } else {
+                    /* 严格错误策略插桩：guest 启动失败零降级（VMM-E02） */
                     log_error("[UTSM] Linux launch failed");
                     log_hex64("[UTSM] Linux st=", (u64)(i64)lin_st);
+                    panic_full("VMM-E02 LINUX LAUNCH FAILED",
+                               "linux_guest=1 requested but VMX launch failed", 0);
                 }
             } else {
-                log_warn("[UTSM] Linux loader unavailable (no bzImage or disabled)");
+                log_warn("[UTSM] Linux guest disabled by FUCK (linux_guest=0)");
             }
         } else {
             INSTR_TS_END(ts_vmm, "vmm_init+selftest");
@@ -460,10 +477,14 @@ void kernel_main(void) {
 
         /* === OpenXJ380 guest — 可通过 FUCK [boot] xj380_guest=0 跳过 ===
          * 三内核架构路线 B：XJ380 作为第二 guest（与 Linux 并列）。
-         * 需要 Limine boot module xj380.krl（OpenXJ380 构建产物 kernel.krl）。
+         * 严格错误策略：xj380_guest=1 即"请求了 guest"——模块缺失或
-         * guest 终止前 host 挂起；无模块/被禁用时优雅跳过。 */
+         * 启动失败一律 panic（VMM-E03/E04），零降级。 */
         int run_xj380 = ini_get_bool(cfg, "boot", "xj380_guest", 1);
-        if (run_xj380 && xj380_loader_init() == 0) {
+        if (run_xj380) {
+            if (xj380_loader_init() != 0) {
+                panic_full("VMM-E03 XJ380 KERNEL.KRL MISSING",
+                           "xj380_guest=1 but kernel.krl boot module not found", 0);
+            }
             INSTR_TS_DECL(ts_xj380);
             INSTR_TS_BEGIN(ts_xj380);
             log_info("[UTSM] XJ380 loader init ok");
@@ -472,11 +493,14 @@ void kernel_main(void) {
             if (xj_st == 0) {
                 log_info("[UTSM] XJ380 guest terminated (host resumed)");
             } else {
+                /* 严格错误策略插桩：XJ380 启动失败零降级（VMM-E04） */
                 log_error("[UTSM] XJ380 launch failed");
                 log_hex64("[UTSM] XJ380 st=", (u64)(i64)xj_st);
+                panic_full("VMM-E04 XJ380 LAUNCH FAILED",
+                           "xj380_guest=1 requested but launch failed", 0);
             }
         } else {
-            log_warn("[UTSM] XJ380 loader unavailable (no kernel.krl or disabled)");
+            log_warn("[UTSM] XJ380 guest disabled by FUCK (xj380_guest=0)");
         }
     } else {
         log_warn("[UTSM] VMM unavailable (VMX not supported or disabled by FUCK)");

CODE/UTSM/sched/sched.c

@@ -629,6 +629,11 @@ void utsm_sched_demo_window(void) {
     int b = utsm_task_create(UTSM_SCHED_NO_PROCESS, 20, demo_task_body, (void *)2ULL);
     int c = utsm_task_create(UTSM_SCHED_NO_PROCESS, 40, demo_task_body, (void *)3ULL);
     log_hex64("[SCHED] demo tasks=", (u64)((a >= 0) + (b >= 0) + (c >= 0)));
+    if (a < 0 || b < 0 || c < 0) {
+        /* 严格错误策略插桩：demo 任务建不全 = 调度器内部状态损坏，panic（SCH-E03） */
+        panic_full("SCH-E03 DEMO TASK CREATE FAILED",
+                   "utsm_task_create failed inside demo window", 0);
+    }
 
     if (utsm_sched_enable(0) != 0) {
         /* 严格错误策略插桩：enable 失败不允许静默跳过演示窗口继续启动 */

CODE/UTSM/test/utsm_selftest.c

@@ -100,6 +100,13 @@ int utsm_selftest_run(void) {
             return UTSM_ERR_INVALID;
         }
         log_info("[UTSM] selftest page MAC determinism ok");
+
+        /* ==== U3+: 封缄内存 .sealed 区 MAC 校验（UTSM-E03 路径自证） ==== */
+        {
+            extern void utsm_sealed_verify(void);
+            utsm_sealed_verify();   /* 不符即 panic，返回即通过 */
+            log_info("[UTSM] selftest sealed MAC verify ok");
+        }
     }
 
     /* ==== U4: 密文页 dump —— 串口输出密文/明文 hex 对照 ==== */

CODE/dsk/main.c

@@ -2033,15 +2033,15 @@ static void dsk_spinner_and_check(const void *boot_ctx_ptr) {
             dsk_run_login(ctx);
         }
 
-        /* default_shell=cmd → 直接进 CMD.ELF（PE/EXE 兼容层前端），
+        /* default_shell=cmd → 直接进 CMD.ELF（PE/EXE 兼容层前端）。
-         * cmd 退出后回落桌面。 */
+         * 严格错误策略：FUCK 明确要求 cmd 却加载失败 = 零降级 panic（DSK-E09）。 */
         const char *def_shell = dsk_cfg_ok ? dsk_ini_get(&dsk_cfg, "dsk", "default_shell") : 0;
         if (def_shell && dsk_ini_streq(def_shell, "cmd")) {
             logl("[DSK:SCHED] default_shell=cmd -> cmd.elf");
             char cn[12]; /* CMD      ELF */
             cn[0]='C';cn[1]='M';cn[2]='D';cn[3]=' ';cn[4]=' ';cn[5]=' ';cn[6]=' ';cn[7]=' ';cn[8]='E';cn[9]='L';cn[10]='F';
             if (dsk_load_and_run(cn, ctx) == 0) logl("[DSK] cmd.elf returned, falling back to desktop");
-            else logl("[DSK] cmd.elf load failed, falling back to desktop");
+            else dsk_fatal("DSK-E09 DEFAULT SHELL CMD.ELF MISSING");
         }
 
         logl("[DSK:SCHED] loading desktop");