{"record":{"id":"9eeaef74b5e7f880","repo":"astrid-runtime/astrid","slug":"kernel-refused-storage-unmount-authorization-err","errorCode":null,"errorMessage":"kernel refused storage unmount authorization: {error}","messagePattern":"kernel refused storage unmount authorization: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-storage-provider-fskit/src/main.rs","lineNumber":316,"sourceCode":"    match body {\n        AdminResponseBody::Success(value) => Ok(value),\n        AdminResponseBody::Error(error) => {\n            bail!(\"kernel refused storage lifecycle request: {error}\")\n        },\n        _ => bail!(\"kernel returned an unexpected storage lifecycle response\"),\n    }\n}\n\nfn unmount_status(body: AdminResponseBody) -> Result<bool> {\n    match body {\n        AdminResponseBody::Success(_) => Ok(true),\n        AdminResponseBody::Error(error)\n            if error.contains(\"was not found\") || error.contains(\"expired or revoked\") =>\n        {\n            Ok(false)\n        },\n        AdminResponseBody::Error(error) => {\n            bail!(\"kernel refused storage unmount authorization: {error}\")\n        },\n        _ => bail!(\"kernel returned an unexpected storage unmount response\"),\n    }\n}\n\nasync fn revoke_after_registry_failure(client: &mut AdminClient, mount_id: StorageMountId) {\n    let _ = client\n        .request(AdminRequestKind::StorageMountRevoke { mount_id })\n        .await;\n}\n\nfn with_native_rollback(\n    error: anyhow::Error,\n    rollback: Result<()>,\n) -> Result<StorageProviderSuccessV1> {\n    match rollback {\n        Ok(()) => Err(error),\n        Err(rollback) => Err(error).context(rollback),","sourceCodeStart":298,"sourceCodeEnd":334,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-storage-provider-fskit/src/main.rs#L298-L334","documentation":"unmount_status() treats only two specific kernel error texts ('was not found', 'expired or revoked') as 'lease is not live'; every other kernel error on a StorageMountStatus request is fatal and bails with this message. It is the pre-unmount authorization check, so this error means the kernel actively refused to report mount status.","triggerScenarios":"unmount() sends AdminRequestKind::StorageMountStatus and the kernel replies with an Error whose text matches neither 'was not found' nor 'expired or revoked' — e.g. permission denied for the acting principal, malformed mount id, or an internal kernel fault.","commonSituations":"Unmounting from a session under a different principal than the lease owner in a way the kernel itself rejects; kernel policy changes; transient kernel errors producing new error strings the matcher does not recognize.","solutions":["Inspect the embedded {error} text to learn why status was refused.","Retry as the principal recorded in the mount registry's requested_by field.","Verify the mount_id is well-formed and known to the kernel (a truly unknown mount returns 'was not found' and is handled as Ok(false), so reaching this error means something else is wrong).","If a new kernel error string was added, extend the matcher or upgrade the provider to a matching version."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"let lease_live = unmount_status(client.request(AdminRequestKind::StorageMountStatus { mount_id }).await?)?;\nif !lease_live { /* skip unmount path entirely */ }","typeGuard":null,"tryCatchPattern":"match unmount_status(body) {\n    Ok(live) => { /* proceed only if live */ },\n    Err(e) if e.to_string().contains(\"refused storage unmount authorization\") => {\n        // inspect embedded kernel error, retry as requested_by principal or abort cleanly\n    },\n    Err(e) => return Err(e),\n}","preventionTips":["Perform unmount as the same principal recorded in requested_by.","Pre-check lease liveness with StorageMountStatus before unmount.","Handle 'was not found' / 'expired or revoked' as already-unmounted instead of retrying.","Keep kernel error-string contract in sync with provider matchers when upgrading."],"tags":["unmount","authorization","admin-client","lease"],"backgroundTag":"permission-denied","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}