What causes "kernel refused storage unmount authorization: {error}" in astrid-runtime/astrid?

Inspect the embedded {error} text to learn why status was refused.

kernel refused storage unmount authorization: {error}

Error message

kernel refused storage unmount authorization: {error}

What it means

unmount_status() treats only two specific kernel error texts ('was not found', 'expired or revoked') as 'lease is not live'; every other kernel error on a StorageMountStatus request is fatal and bails with this message. It is the pre-unmount authorization check, so this error means the kernel actively refused to report mount status.

Source

Thrown at crates/astrid-storage-provider-fskit/src/main.rs:316

    match body {
        AdminResponseBody::Success(value) => Ok(value),
        AdminResponseBody::Error(error) => {
            bail!("kernel refused storage lifecycle request: {error}")
        },
        _ => bail!("kernel returned an unexpected storage lifecycle response"),
    }
}

fn unmount_status(body: AdminResponseBody) -> Result<bool> {
    match body {
        AdminResponseBody::Success(_) => Ok(true),
        AdminResponseBody::Error(error)
            if error.contains("was not found") || error.contains("expired or revoked") =>
        {
            Ok(false)
        },
        AdminResponseBody::Error(error) => {
            bail!("kernel refused storage unmount authorization: {error}")
        },
        _ => bail!("kernel returned an unexpected storage unmount response"),
    }
}

async fn revoke_after_registry_failure(client: &mut AdminClient, mount_id: StorageMountId) {
    let _ = client
        .request(AdminRequestKind::StorageMountRevoke { mount_id })
        .await;
}

fn with_native_rollback(
    error: anyhow::Error,
    rollback: Result<()>,
) -> Result<StorageProviderSuccessV1> {
    match rollback {
        Ok(()) => Err(error),
        Err(rollback) => Err(error).context(rollback),

View on GitHub (pinned to affd8760f4)

Solutions

Inspect the embedded {error} text to learn why status was refused.
Retry as the principal recorded in the mount registry's requested_by field.
Verify the mount_id is well-formed and known to the kernel (a truly unknown mount returns 'was not found' and is handled as Ok(false), so reaching this error means something else is wrong).
If a new kernel error string was added, extend the matcher or upgrade the provider to a matching version.

Defensive patterns

Strategy: try-catch

Validate before calling

let lease_live = unmount_status(client.request(AdminRequestKind::StorageMountStatus { mount_id }).await?)?;
if !lease_live { /* skip unmount path entirely */ }

Try / catch

match unmount_status(body) {
    Ok(live) => { /* proceed only if live */ },
    Err(e) if e.to_string().contains("refused storage unmount authorization") => {
        // inspect embedded kernel error, retry as requested_by principal or abort cleanly
    },
    Err(e) => return Err(e),
}

Prevention

Perform unmount as the same principal recorded in requested_by.
Pre-check lease liveness with StorageMountStatus before unmount.
Handle 'was not found' / 'expired or revoked' as already-unmounted instead of retrying.
Keep kernel error-string contract in sync with provider matchers when upgrading.

When it happens

Trigger: unmount() sends AdminRequestKind::StorageMountStatus and the kernel replies with an Error whose text matches neither 'was not found' nor 'expired or revoked' — e.g. permission denied for the acting principal, malformed mount id, or an internal kernel fault.

Common situations: Unmounting from a session under a different principal than the lease owner in a way the kernel itself rejects; kernel policy changes; transient kernel errors producing new error strings the matcher does not recognize.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/9eeaef74b5e7f880. Report an issue: GitHub.