2.3 KiB
| type | id | title | status | date |
|---|---|---|---|---|
| ADR | 0163 | Guanghu-owned raw recovery beacon for native-default boot | active | 2026-07-31 |
Context
The first native recovery path wrote GRUB's normal environment block by a physical extent discovered while Ubuntu was running. It worked from a one-time native boot, but failed after Guanghu OS became the permanent GRUB default. The normal environment file can move when hosted tools rewrite GRUB state, so its old sector address is not a stable native interface.
Guanghu OS must preserve an independently verifiable hosted recovery path
until native recovery is equivalent. The recovery signal itself must not
depend on an ext4 path, a Linux process, or the changing extent of
/boot/grub/grubenv.
Decision
Register GLS-0843, the Guanghu Native Recovery Protocol (GHNRP). The protocol
owns /dev/vda LBA 68-69 as one 1024-byte GRUB environment block. GOSK/GHAL
writes only:
guanghu_recovery=ubuntu
and reads back the same 1024 bytes before resetting. GRUB loads only the
guanghu_recovery variable from the raw block list (hd0)68+2. When the
value is ubuntu, GRUB selects the pinned hosted entry for one boot and clears
the variable. A hosted startup service verifies and clears the beacon again as
a fail-closed fallback.
The standard GRUB environment remains owned by the hosted compatibility layer. GHNRP never writes it and never discovers a filesystem extent.
Acceptance
The protocol is complete only when the real BS-SH-005 passes this sequence:
- Guanghu OS is the permanent default and Linux is absent;
HLDP-RECOVER-OS!writes and reads back LBA 68-69;- the next boot enters the pinned Ubuntu recovery entry;
- GRUB consumes the marker;
- the following boot returns to the unchanged Guanghu default;
- native wake, five-domain world storage, and the code channel still pass.
QEMU and script contract tests are required before a physical write. A native reply or a successful sector write alone is not equivalent recovery.
Consequences
Recovery ownership moves into the Guanghu protocol namespace while GRUB remains a temporary bootstrap compatibility layer. The reserved LBA range is part of the disk map and cannot be allocated to another service. Unknown or malformed beacon data fails closed to the existing default.