G8l: QEMU S139 QueueFull probe writer-authority audit

pub const S311_MAIN_EXPLICIT_WRITER_SITES: usize = 17;
pub const S311_MAIN_PREVIOUSLY_AUDITED_WRITER_SITES: usize = 1;
pub const S311_MAIN_REMAINING_UNAUDITED_WRITER_SITES: usize = 15;
pub const S311_S139_CALLER_EXPLICIT_WRITER_SITES: usize = 2;
pub const S311_S139_CALLER_REMAINING_UNAUDITED_WRITER_SITES: usize = 0;
pub const S311_DIRECT_SCHEDULER_ACCESS_SITES: usize = S310_DIRECT_SCHEDULER_ACCESS_SITES;
pub const S311_IMMUTABLE_READ_SITES: usize = S310_IMMUTABLE_READ_SITES;
pub const S311_WHOLE_SCHEDULER_GUARDED_SITES: usize = S310_WHOLE_SCHEDULER_GUARDED_SITES;
pub const S311_WHOLE_SCHEDULER_UNROUTED_SITES: usize = S310_WHOLE_SCHEDULER_UNROUTED_SITES;
pub const S311_OPEN_WRITER_SITES: usize = S310_OPEN_WRITER_SITES;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS311SchedulerWriterAuthorityAuditOutcome {
    Idle,
    AwaitingWriterAuthority {
        request_id: u64,
        guarded_sites: usize,
        writer_sites: usize,
    },
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS311SchedulerWriterAuthorityAuditError {
    S310(G8lS310SchedulerWriterAuthorityAuditError),
    S245(G8lS245ExclusionAdmissionRequestError),
    PriorCoverageDrift {
        guarded_sites: usize,
        unrouted_sites: usize,
    },
}

/// Revalidate the prior fail-closed authority boundary without taking
/// admission or constructing a production exclusive wrapper.
pub fn preflight_s311_scheduler_writer_authority(
    caller_cpu: usize,
    request: Option<G8lS245WholeSchedulerExclusionAdmissionRequestView>,
) -> Result<G8lS311SchedulerWriterAuthorityAuditOutcome, G8lS311SchedulerWriterAuthorityAuditError>
{
    match preflight_s310_scheduler_writer_authority(caller_cpu, request)
        .map_err(G8lS311SchedulerWriterAuthorityAuditError::S310)?
    {
        G8lS310SchedulerWriterAuthorityAuditOutcome::Idle => {
            Ok(G8lS311SchedulerWriterAuthorityAuditOutcome::Idle)
        }
        G8lS310SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
            request_id,
            guarded_sites,
            writer_sites,
        } if guarded_sites == S311_WHOLE_SCHEDULER_GUARDED_SITES
            && writer_sites == S311_OPEN_WRITER_SITES =>
        {
            Ok(
                G8lS311SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
                    request_id,
                    guarded_sites,
                    writer_sites,
                },
            )
        }
        G8lS310SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
            guarded_sites,
            writer_sites: _,
            ..
        } => Err(
            G8lS311SchedulerWriterAuthorityAuditError::PriorCoverageDrift {
                guarded_sites,
                unrouted_sites: S311_DIRECT_SCHEDULER_ACCESS_SITES - guarded_sites,
            },
        ),
    }
}

#[test]
fn s311_helper_revalidates_kernel_caller_send_and_linked_reply_under_transaction() {
    let source = include_str!("../../kernel/src/task/scheduler.rs");
    let helper = kernel_call_and_wait_boundary(source);
    for required in [
        "IrqGuard::new()",
        "IPC_TRANSACTION_LOCK.lock()",
        "IPC_CALL_DEADLINES.lock()",
        ".filter(|task| !task.is_user)",
        ".filter(|task_id| *task_id != 0)",
        "current_endpoint_authority_is_live(",
        "CapabilityRights::ENDPOINT_SEND",
        "ENDPOINT_REGISTRY.lock()",
        "endpoint.id == target_endpoint && !endpoint.is_reply_cap",
        "endpoint.id == reply_cap_id",
        "endpoint.is_reply_cap",
        "endpoint.owner == caller_task",
        "endpoint.reply_target == Some(target_endpoint)",
        "waiting_receiver()",
        "exact_receive_deadline_for_waiter",
        "blocked",
        ".try_reserve(1)",
    ] {
        assert!(
            helper.contains(required),
            "missing S311 helper preflight token: {required}"
        );
    }
    let transaction = helper.find("IPC_TRANSACTION_LOCK.lock()").unwrap();
    let caller = helper.find("let caller_task").unwrap();
    let send = helper.find("current_endpoint_authority_is_live(").unwrap();
    let endpoints = helper.find("ENDPOINT_REGISTRY.lock()").unwrap();
    let call = helper
        .find(".call(caller_task, reply_cap_id, message)")
        .unwrap();
    assert!(transaction < caller && caller < send && send < endpoints && endpoints < call);
}

  {
    id: "g8l-s311-qemu-s139-queue-full-probe-writer-authority-audit-partial",
    date: "2026-08-27",
    sequence: 311,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: QEMU S139 QueueFull probe writer-authority audit",
    summary:
      "S311 focused 15/15 PASS ile main.rs içindeki kaynak sırasına göre alttan ikinci explicit mutable scheduler aliasını doğrular: qemu_s139_multi_event_caller QueueFull probe yolundaki ipc_kernel_call_and_wait sınırı. Nonzero kernel caller, current-task CNode exact Endpoint owner/parent/nonzero generation/ENDPOINT_SEND authority ve linked reply-cap mint probe öncesindedir. Exact queued/in-flight full snapshot ve overflow message writer'dan önce kurulur; endpoint/generation/reply/overflow-message zarfı helper'a exact forward edilir. Helper existing IRQ/IPC transaction altında non-user caller SEND authority, normal endpoint, linked reply, optional receiver authority/deadline ve ready/blocked capacity'yi yeniden doğrular; bounded rendezvous QueueFull veya ReplyTableFull durumunu park/current-task take/switch öncesinde IpcError::QueueFull olarak döndürür. Caller yalnız exact QueueFull sonucunu kabul eder, unpublished reply'ı discard eder, QEMU_S139_QUEUE_FULL sentinel'ını Release ile yayınlar ve normal yola girmeden terminal task_exit yapar. Writer authority yalnız model gate'inin exclusive lease'iyle mümkündür; reader lease'i writer'ı açmaz. main.rs 17 explicit writer / 15 remaining unaudited, qemu_s139_multi_event_caller 2 / 0 ve iki alias da source/model covered; production inventory 113 direct / 44 immutable guarded / 69 open writer olarak değişmez ve production exclusive wrapper, provider authority, whole-scheduler exclusion veya scheduler mutation üretilmez.",
    evidence: [
      "S311 focused kaynak/model kapısı iki bağımsız koşuda 15/15 PASS verdi: 130 B / SHA-256 0447f2fe9dc6fdf30815a6962cf23d978425e51bef2acde1efb27e5da13a78b3.",
      "main.rs içindeki 17 explicit addr_of_mut!(crate::task::scheduler::SCHEDULER) sitesinin kaynakta alttan ikinci sınırı audit edilir. qemu_s139_multi_event_caller 2 explicit alias taşır; S310 normal exact-ACK aliasını, S311 QueueFull probe aliasını kapatır. İşlevde 0, main.rs genelinde 15 alias ayrıca açık kalır.",
      "QEMU_S139_TRANSPORT_STATE, nonzero current kernel caller, controller/supervisor ayrıklığı, bounded caller index, current-task CNode exact Endpoint owner/parent/nonzero generation/ENDPOINT_SEND authority ve mint_reply_endpoint_for_call probe writer'ından önce gelir.",
      "caller_index == QEMU_S139_BATCH dalı QEMU_S139_TRANSPORT exact snapshot'ında queued ve in_flight değerlerinin QEMU_S139_BATCH olduğunu doğrular; label/badge ve [QEMU_S139_CALLERS,1,1,0x5a09] verili exact overflow message writer'dan önce kurulur.",
      "ipc_kernel_call_and_wait(state.endpoint_id, endpoint_authority.generation, reply_cap.id, overflow_message) exact forward edilir ve yalnız Err(crate::ipc::IpcError::QueueFull) kabul edilir; broad error eşleşmesi yoktur.",
      "Scheduler helper IrqGuard/IPC_TRANSACTION_LOCK altında non-user nonzero caller, canlı SEND generation, normal target endpoint, caller-owned linked reply object, optional waiting receiver state/RECV authority/generation/deadline ve ready/blocked capacity koşullarını yeniden doğrular.",
      "Rendezvous CallError::QueueFull veya ReplyTableFull exact IpcError::QueueFull'a map edilir ve soru işaretiyle finish_call_park, current_task.take ve switch_after_ipc_park öncesinde döner.",
      "Exact QueueFull sonrasında discard_unpublished_reply_endpoint(reply_cap.id, Some(caller_task)) başarılı olmalıdır; QEMU_S139_CALL_RESULTS[caller_index] QEMU_S139_QUEUE_FULL sentinel'ını Release ile yayınlar ve task_exit normal now_tick/lease/message yolundan önce terminaldir.",
      "Model gate reader membership exclusive writer authority'yi ExclusiveBusy ile bloklar; reader bırakıldıktan sonra non-zero token'lı exclusive lease alınır. Bu host/model evidence'tır.",
      "S310 authority preflight yeniden doğrulanır; pending S245 request korunur ve sonuç AwaitingWriterAuthority { guarded_sites: 44, writer_sites: 69 } olarak döner.",
      "Dört AArch64 profil derlemesi iki koşuda byte-equal exit 0 verdi: QEMU 110646 B / 0c054853, RPi4 149371 B / ddeb663f, RPi5 439388 B / e45719cb ve RPi5+SMP 439330 B / 29dbcbdd. Warning header'ları sırasıyla 291, 389, 925 ve 925'tir; zero-warning iddiası değildir.",
      "Birleşik board-rpi5,board-qemu özellikleri iki koşuda beklenen exit 101, 18590 B / a56e00fa, 17 error ve 22 warning header ile fail-closed kaldı; S311 writer boundary'si iki board profilinin birlikte etkinleşmesini açmaz.",
      "S238–S311 dependency matrisi iki koşuda 75 grup / 1049/1049 PASS; ham loglar byte-equal 9672 B / 2944c31f7a4dd3d7059b6373c5a42a0bdb8b2f511507db8b529992fe75fc96b2, süre-normalize özetler byte-equal 9822 B / 85522aebe7d53f7636777731c75164d01f8c6348f5deb28916dc82c1bfa3901a. Bu production writer-authority invocation kanıtı değildir.",
      "Ortak make verify-qemu iki koşuda PASS verdi: 116222 B / 0e0d8720 ve 116139 B / 20634924; guest logları 2158000 B / 7353ae99 ve 2131877 B / 70a07fc9. W^X 31/31, S271 GRAPH_ABSENT=YES, RuntimePmm baseline, EL0 x4096, IPC 20/20, koşu başına tek S142 containment, SEC5 ve 13 KERNEL_FAULTS=0 marker'ı korunur. Bu ortak smoke S311 production writer-authority invocation kanıtı değildir.",
      "Exact yedi tarihsel G8h assertion adıyla dışlandığında workspace iki koşuda 273 sonuç grubu / 2849 PASS / 7 filtered verdi: ham loglar 62982 B / d6db0994 ve 7621cac9, sonuç özetleri 25818 B / 5fb75c40 ve 0a170241, süre-normalize 26362 B özet byte-equal / SHA-256 46b930a1d13cd74933867e7ba02ee2f0c6cd30e2d8aa1b6f7919dcababfe2cb1. Filtresiz koşu exit 101, 58204 B / 3e9254da ile frozen S96 exceptions.S identity kapısında RED kaldı; full-workspace GREEN iddia edilmez.",
      "S311 production exclusive wrapper, provider authority, whole-scheduler exclusion, QEMU fixture mutation veya scheduler mutation iddiası eklemez; physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S311=NO.",
    ],
    commands: [
      "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s311_qemu_s139_queue_full_probe_writer_authority_audit -- --test-threads=1",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-qemu",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi4",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --features board-rpi5",
      "make verify-qemu",
    ],
    terminalSessions: [
      {
        id: "g8l-s311-qemu-s139-queue-full-probe-writer-authority-audit",
        title: "G8l S311 QEMU S139 QueueFull probe writer-authority audit",
        commandLines: [
          "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s311_qemu_s139_queue_full_probe_writer_authority_audit -- --test-threads=1",
        ],
        outputLines: [
          "test result: ok; S311 focused 1 group / 15 passed; 0 failed",
          "repeat-stable quiet output: 130 B / 0447f2fe9dc6fdf30815a6962cf23d978425e51bef2acde1efb27e5da13a78b3",
          "QEMU S139 QueueFull-probe writer authority remains model-only: exact full snapshot/message/call/result/cleanup/publication/exit are source-audited; the S139 caller has 0 unaudited aliases, main.rs retains 15 and all 69 production writer sites remain open",
          "dependency: S238–S311 · 75 groups · 1049/1049 PASS; workspace: 273 groups · 2849 PASS · 7 historical filtered",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S311 kaynak/model fail-closed authority boundary'sidir; production writer guard/migration, QEMU fixture mutation ve fiziksel/device execution claim edilmez.",
    limitations: [
      "S311 main.rs içindeki kaynakta alttan ikinci qemu_s139_multi_event_caller QueueFull-probe mutable scheduler aliasını audit eder; bu işlev 2/2 source/model covered olsa da main.rs genelinde 15 ve toplam 69 production writer site authority wrapper dışında açık kalır.",
      "Exclusive lease yalnız host/model gate'inde test edilir; production exclusive wrapper, provider authority ve whole-scheduler exclusion açık kalır.",
      "S238–S311 dependency matrisi exact 75 grup / 1049/1049 PASS'tir; bu production writer authority invocation kanıtı değildir.",
      "Filtresiz workspace frozen S96 identity kapısında RED'dir; workspace umbrella GREEN iddia edilmez.",
      "Supported-profile writer-authority runtime invocation, Generic SMP ve fiziksel RPi kabulü açık kalır; S311 physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S311=NO.",
    ],
  },