Why an Operating System Should Not Panic When a Single Service Fails

The Danger of Using panic!() as a Security Mechanism

When programmers first design a safety-critical system, it is tempting to write code that says: "If anything unexpected happens, immediately call panic!() and stop the whole computer." At first glance, that sounds cautious. After all, if the computer stops, nothing worse can happen, right?

In practice, halting the entire operating system whenever a single component encounters an error creates a massive weakness: it turns every minor bug or malformed input into a system-wide Denial-of-Service (DoS) outage.

Imagine an office building where, if one person jams a photocopier or drops a coffee mug, the main fire alarm automatically locks all doors and evacuates the entire building for the rest of the day. Nobody would get any work done. Yet that is exactly what happens in an operating system that calls panic!() when a single driver or background service hits an error.

How PangeaOS Separates Local Problems From True Emergencies

In PangeaOS v1.2.4b, we redesigned the fault model around a simple question: Can we prove that the core referee of the operating system (Domain 0) is still unharmed?

If a service running in Domain 5 tries to divide by zero, executes an invalid instruction, or tries to read memory outside its 1-Terabyte workspace, the processor stops Domain 5 immediately. Because Domain 5's hardware keycard (PKRU) had Domain 0's memory locked the entire time Domain 5 was running, we know for a fact that Domain 5 could not have corrupted the core kernel's data structures.

Therefore, there is no reason to stop the whole computer:

1. The processor jumps to an independent emergency rescue stack (IST 1).
2. The entry stub unlocks the kernel's master keycard (0xCBFF_FFFC) and pivots onto the kernel's private exception stack (k0_priv_rsp).
3. The kernel marks Domain 5 as Quarantined, cancels its old permission tokens by incrementing its generation number, and jumps straight back to the scheduler bookmark (SchedulerContinuation).
4. All other services (Domains 1, 2, 3, 4, and 6 through 12) keep running as if nothing happened.

When Should the Operating System Stop?

PangeaOS only halts the entire machine (Global Fail-Stop) in the rare case where the core kernel itself (Domain 0) suffers an internal fault, a security canary word is corrupted, or physical RAM hardware reports an uncorrectable silicon error (#MC). By separating local service faults (L0–L3) from core integrity faults (F1–F3), PangeaOS achieves both strong memory safety and continuous availability.