{"record":{"id":"8a33d94fdbe04fc2","repo":"astrid-runtime/astrid","slug":"kernel-refused-storage-lifecycle-request-error-8a33d9","errorCode":null,"errorMessage":"kernel refused storage lifecycle request: {error}","messagePattern":"kernel refused storage lifecycle request: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-storage-provider-fuse/src/main.rs","lineNumber":765,"sourceCode":") -> Result<Option<LeaseStatus>> {\n    let body = client\n        .request(AdminRequestKind::StorageMountStatus {\n            mount_id: *mount_id,\n        })\n        .await?;\n    match body {\n        AdminResponseBody::Success(value) => {\n            let status =\n                serde_json::from_value(value).context(\"decode kernel storage mount status\")?;\n            Ok(Some(status))\n        },\n        AdminResponseBody::Error(error)\n            if error.contains(\"was not found\") || error.contains(\"expired or revoked\") =>\n        {\n            Ok(None)\n        },\n        AdminResponseBody::Error(error) => {\n            bail!(\"kernel refused storage lifecycle request: {error}\")\n        },\n        _ => bail!(\"kernel returned an unexpected storage lifecycle response\"),\n    }\n}\n\nasync fn require_live_lease(\n    client: &mut AdminClient,\n    acting_principal: &astrid_core::PrincipalId,\n    record: &registry::MountRecord,\n) -> Result<LeaseStatus> {\n    if &record.requested_by != acting_principal {\n        bail!(\"mount was issued to another acting principal\");\n    }\n    kernel_lease_status(client, &record.mount_id)\n        .await?\n        .with_context(|| format!(\"storage mount lease {} is stale\", record.mount_id))\n}\n","sourceCodeStart":747,"sourceCodeEnd":783,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-storage-provider-fuse/src/main.rs#L747-L783","documentation":"kernel_lease_status queries the kernel's AdminClient with StorageMountStatus. When the kernel replies with AdminResponseBody::Error that is not a recognized 'not found' / 'expired or revoked' condition, the provider treats it as a hard refusal of the storage lifecycle request and bails with the kernel's error text inlined. Only Success and the two recognized soft-failure strings are accepted.","triggerScenarios":"An admin API call (StorageMountStatus, and same helper used around revoke/renew) returns AdminResponseBody::Error whose message lacks the 'was not found' or 'expired or revoked' substrings — e.g. permission denied at the kernel, malformed mount_id, kernel-side internal error, or a kernel version whose error wording changed.","commonSituations":"Calling lifecycle operations with a principal lacking kernel admin rights; kernel upgraded so its error strings no longer match the hardcoded 'was not found'/'expired or revoked' patterns, turning soft misses into hard errors; sending a corrupt mount_id.","solutions":["Read the kernel error text after the colon and address the kernel-side cause (usually authorization or request validity)","If a kernel upgrade changed error wording, update the substring match at main.rs:760 so soft 'not found' cases are still recognized","Verify the acting principal has kernel admin permission for storage mount operations","Re-check the StorageMountId being sent matches a lease the kernel knows"],"exampleFix":"// before: brittle substring match\nif error.contains(\"was not found\") || error.contains(\"expired or revoked\") { Ok(None) }\n// after: typed variants where possible\nAdminResponseBody::Error(AdminError::NotFound(_)) | AdminResponseBody::Error(AdminError::LeaseExpired) => Ok(None),","handlingStrategy":"try-catch","validationCode":"// Before lifecycle calls, confirm the acting principal has kernel admin rights\nlet permitted = client.request(AdminRequestKind::WhoAmI).await?;\nif !permitted.implies_admin_storage() { return Err(anyhow!(\"principal lacks kernel storage admin rights\")); }","typeGuard":"fn is_soft_miss(err: &str) -> bool {\n    err.contains(\"was not found\") || err.contains(\"expired or revoked\")\n}","tryCatchPattern":"match kernel_lease_status(client, &mount_id).await {\n    Err(e) if e.to_string().contains(\"kernel refused storage lifecycle request:\") => {\n        let kernel_msg = extract_kernel_message(&e);\n        if is_soft_miss(kernel_msg) { handle_as_absent() } else { return Err(e); }\n    }\n    other => other,\n}","preventionTips":["Address the kernel message after the colon; it is the authoritative cause","After kernel upgrades, re-check that the 'was not found'/'expired or revoked' substring match still classifies soft misses","Grant the acting principal kernel storage admin permissions before lifecycle operations","Validate mount ids before sending them to the kernel"],"tags":["kernel","ipc","storage","admin-api"],"backgroundTag":"api-error-response","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}