59 lines
2.3 KiB
Markdown
59 lines
2.3 KiB
Markdown
|
---
|
||
|
|
type: ADR
|
||
|
|
id: "0163"
|
||
|
|
title: "Guanghu-owned raw recovery beacon for native-default boot"
|
||
|
|
status: active
|
||
|
|
date: 2026-07-31
|
||
|
|
---
|
||
|
|
|
||
|
|
## Context
|
||
|
|
|
||
|
|
The first native recovery path wrote GRUB's normal environment block by a
|
||
|
|
physical extent discovered while Ubuntu was running. It worked from a one-time
|
||
|
|
native boot, but failed after Guanghu OS became the permanent GRUB default.
|
||
|
|
The normal environment file can move when hosted tools rewrite GRUB state, so
|
||
|
|
its old sector address is not a stable native interface.
|
||
|
|
|
||
|
|
Guanghu OS must preserve an independently verifiable hosted recovery path
|
||
|
|
until native recovery is equivalent. The recovery signal itself must not
|
||
|
|
depend on an ext4 path, a Linux process, or the changing extent of
|
||
|
|
`/boot/grub/grubenv`.
|
||
|
|
|
||
|
|
## Decision
|
||
|
|
|
||
|
|
Register GLS-0843, the Guanghu Native Recovery Protocol (GHNRP). The protocol
|
||
|
|
owns `/dev/vda` LBA 68-69 as one 1024-byte GRUB environment block. GOSK/GHAL
|
||
|
|
writes only:
|
||
|
|
|
||
|
|
`guanghu_recovery=ubuntu`
|
||
|
|
|
||
|
|
and reads back the same 1024 bytes before resetting. GRUB loads only the
|
||
|
|
`guanghu_recovery` variable from the raw block list `(hd0)68+2`. When the
|
||
|
|
value is `ubuntu`, GRUB selects the pinned hosted entry for one boot and clears
|
||
|
|
the variable. A hosted startup service verifies and clears the beacon again as
|
||
|
|
a fail-closed fallback.
|
||
|
|
|
||
|
|
The standard GRUB environment remains owned by the hosted compatibility
|
||
|
|
layer. GHNRP never writes it and never discovers a filesystem extent.
|
||
|
|
|
||
|
|
## Acceptance
|
||
|
|
|
||
|
|
The protocol is complete only when the real `BS-SH-005` passes this sequence:
|
||
|
|
|
||
|
|
1. Guanghu OS is the permanent default and Linux is absent;
|
||
|
|
2. `HLDP-RECOVER-OS!` writes and reads back LBA 68-69;
|
||
|
|
3. the next boot enters the pinned Ubuntu recovery entry;
|
||
|
|
4. GRUB consumes the marker;
|
||
|
|
5. the following boot returns to the unchanged Guanghu default;
|
||
|
|
6. native wake, five-domain world storage, and the code channel still pass.
|
||
|
|
|
||
|
|
QEMU and script contract tests are required before a physical write. A native
|
||
|
|
reply or a successful sector write alone is not equivalent recovery.
|
||
|
|
|
||
|
|
## Consequences
|
||
|
|
|
||
|
|
Recovery ownership moves into the Guanghu protocol namespace while GRUB
|
||
|
|
remains a temporary bootstrap compatibility layer. The reserved LBA range is
|
||
|
|
part of the disk map and cannot be allocated to another service. Unknown or
|
||
|
|
malformed beacon data fails closed to the existing default.
|
||
|
|
|