G8l: QEMU Ready-task initial-arg writer-authority audit

pub const S275_WRITER_BOUNDARY_SITES: usize = 1;
pub const S275_WRITER_AUTHORITY_SITES: usize = 0;
pub const S275_DIRECT_SCHEDULER_ACCESS_SITES: usize = S274_DIRECT_SCHEDULER_ACCESS_SITES;
pub const S275_IMMUTABLE_READ_SITES: usize = S274_IMMUTABLE_READ_SITES;
pub const S275_WHOLE_SCHEDULER_GUARDED_SITES: usize = S274_WHOLE_SCHEDULER_GUARDED_SITES;
pub const S275_WHOLE_SCHEDULER_UNROUTED_SITES: usize = S274_WHOLE_SCHEDULER_UNROUTED_SITES;
pub const S275_OPEN_WRITER_SITES: usize = S274_OPEN_WRITER_SITES;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS275SchedulerWriterAuthorityAuditOutcome {
    Idle,
    AwaitingWriterAuthority {
        request_id: u64,
        guarded_sites: usize,
        writer_sites: usize,
    },
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS275SchedulerWriterAuthorityAuditError {
    S274(G8lS274SchedulerWriterCommitPreflightError),
    PriorCoverageDrift {
        guarded_sites: usize,
        unrouted_sites: usize,
    },
}

/// Keep the S274 request and read-coverage checks fail-closed while exposing
/// the one writer boundary as an authority-audit result. This function does
/// not take the request, acquire production authority, or mutate `SCHEDULER`.
pub fn preflight_s275_scheduler_writer_authority(
    caller_cpu: usize,
    request: Option<G8lS245WholeSchedulerExclusionAdmissionRequestView>,
) -> Result<G8lS275SchedulerWriterAuthorityAuditOutcome, G8lS275SchedulerWriterAuthorityAuditError>
{
    match preflight_s274_scheduler_writer_commit(caller_cpu, request)
        .map_err(G8lS275SchedulerWriterAuthorityAuditError::S274)?
    {
        G8lS274SchedulerWriterCommitPreflightOutcome::Idle => {
            Ok(G8lS275SchedulerWriterAuthorityAuditOutcome::Idle)
        }
        G8lS274SchedulerWriterCommitPreflightOutcome::AwaitingWriterCoverage {
            request_id,
            guarded_sites,
            unrouted_sites,
        } if guarded_sites == S274_WHOLE_SCHEDULER_GUARDED_SITES
            && unrouted_sites == S274_WHOLE_SCHEDULER_UNROUTED_SITES =>
        {
            Ok(
                G8lS275SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
                    request_id,
                    guarded_sites,
                    writer_sites: S275_OPEN_WRITER_SITES,
                },
            )
        }
        G8lS274SchedulerWriterCommitPreflightOutcome::AwaitingWriterCoverage {
            guarded_sites,
            unrouted_sites,
            ..
        } => Err(
            G8lS275SchedulerWriterAuthorityAuditError::PriorCoverageDrift {
                guarded_sites,
                unrouted_sites,
            },
        ),
    }
}

#[test]
fn s275_keeps_the_explicit_writer_open_until_exclusive_authority_exists() {
    assert_eq!(S275_WRITER_BOUNDARY_SITES, 1);
    assert_eq!(S275_WRITER_AUTHORITY_SITES, 0);
    assert_eq!(S275_DIRECT_SCHEDULER_ACCESS_SITES, 113);
    assert_eq!(S275_IMMUTABLE_READ_SITES, 44);
    assert_eq!(S275_WHOLE_SCHEDULER_GUARDED_SITES, 44);
    assert_eq!(S275_WHOLE_SCHEDULER_UNROUTED_SITES, 69);
    assert_eq!(S275_OPEN_WRITER_SITES, 69);
}

  {
    id: "g8l-s275-qemu-ready-user-initial-arg-writer-authority-audit-partial",
    date: "2026-08-26",
    sequence: 275,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: QEMU Ready-task initial-arg writer-authority audit",
    summary:
      "S275 focused 15/15 PASS ile qemu_set_ready_user_initial_arg içindeki tek explicit mutable writer sınırını kaynakta ayrıştırır. Writer authority yalnız model gate'inin exclusive lease'iyle mümkündür; reader lease'i writer'ı açmaz. Writer-authority exclusive sınırı 44/113 guarded ve 69 açık writer ile korunur; production exclusive wrapper, provider authority, whole-scheduler exclusion ve scheduler mutation üretilmez.",
    evidence: [
      "S275 focused kaynak kapısı iki bağımsız koşuda 15/15 PASS verdi: 130 B / SHA-256 0447f2fe9dc6fdf30815a6962cf23d978425e51bef2acde1efb27e5da13a78b.",
      "qemu_set_ready_user_initial_arg içindeki tek mutable writer boundary explicit olarak core::mem::take + BinaryHeap restore ile görünür; writer authority site sayısı 0, açık writer sayısı 69'dur.",
      "Model gate testinde reader membership exclusive writer authority'yi ExclusiveBusy ile bloklar; reader bırakıldıktan sonra non-zero token'lı exclusive lease alınır ve bırakılır. Bu host/model evidence'tır.",
      "S274 fail-closed preflight yeniden doğrulanır; pending S245 request korunur ve sonuç AwaitingWriterAuthority { guarded_sites: 44, writer_sites: 69 } olarak döner.",
      "S275 production exclusive wrapper, provider authority, whole-scheduler exclusion, QEMU runtime fixture veya scheduler mutation iddiası eklemez; physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S275=NO.",
    ],
    commands: [
      "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s275_qemu_ready_user_initial_arg_writer_authority_audit -- --test-threads=1",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-qemu",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
    ],
    terminalSessions: [
      {
        id: "g8l-s275-qemu-ready-user-initial-arg-writer-authority-audit",
        title: "G8l S275 QEMU Ready-task writer-authority audit",
        commandLines: [
          "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s275_qemu_ready_user_initial_arg_writer_authority_audit -- --test-threads=1",
        ],
        outputLines: [
          "test result: ok; S275 focused 1 group / 15 passed; 0 failed",
          "repeat-stable quiet output: 130 B / 0447f2fe9dc6fdf30815a6962cf23d978425e51bef2acde1efb27e5da13a78b",
          "writer authority remains model-only: reader blocks exclusive lease; 69 production writer sites remain open",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S275 kaynak/model fail-closed authority boundary'sidir; production writer guard, QEMU fixture mutation ve fiziksel/device execution claim edilmez.",
    limitations: [
      "S275 yalnız tek qemu_set_ready_user_initial_arg writer boundary'sini audit eder; 69 production writer site açık kalır.",
      "Exclusive lease yalnız host/model gate'inde test edilir; production exclusive wrapper, provider authority ve whole-scheduler exclusion açık kalır.",
      "S238–S274 dependency baseline'ı inherit edilir; S275 için genişletilmiş dependency matrisi bu kayda dahil değildir.",
      "Supported-profile runtime invocation, Generic SMP ve fiziksel RPi kabulü açık kalır; S275 physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S275=NO.",
    ],
  },