G8l: QEMU S141 crashed CALL writer-authority audit

pub const S320_WRITER_BOUNDARY_SITES: usize = 1;
pub const S320_WRITER_AUTHORITY_SITES: usize = 0;
pub const S320_MAIN_EXPLICIT_WRITER_SITES: usize = 17;
pub const S320_MAIN_PREVIOUSLY_AUDITED_WRITER_SITES: usize = 10;
pub const S320_MAIN_REMAINING_UNAUDITED_WRITER_SITES: usize = 6;
pub const S320_S141_EXPLICIT_WRITER_SITES: usize = 2;
pub const S320_S141_REMAINING_UNAUDITED_WRITER_SITES: usize = 0;
pub const S320_DIRECT_SCHEDULER_ACCESS_SITES: usize = S319_DIRECT_SCHEDULER_ACCESS_SITES;
pub const S320_IMMUTABLE_READ_SITES: usize = S319_IMMUTABLE_READ_SITES;
pub const S320_WHOLE_SCHEDULER_GUARDED_SITES: usize = S319_WHOLE_SCHEDULER_GUARDED_SITES;
pub const S320_WHOLE_SCHEDULER_UNROUTED_SITES: usize = S319_WHOLE_SCHEDULER_UNROUTED_SITES;
pub const S320_OPEN_WRITER_SITES: usize = S319_OPEN_WRITER_SITES;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS320SchedulerWriterAuthorityAuditOutcome {
    Idle,
    AwaitingWriterAuthority {
        request_id: u64,
        guarded_sites: usize,
        writer_sites: usize,
    },
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS320SchedulerWriterAuthorityAuditError {
    S319(G8lS319SchedulerWriterAuthorityAuditError),
    S245(G8lS245ExclusionAdmissionRequestError),
    PriorCoverageDrift {
        guarded_sites: usize,
        unrouted_sites: usize,
    },
}

/// Revalidate the prior fail-closed authority boundary without taking
/// admission or constructing a production exclusive wrapper.
pub fn preflight_s320_scheduler_writer_authority(
    caller_cpu: usize,
    request: Option<G8lS245WholeSchedulerExclusionAdmissionRequestView>,
) -> Result<G8lS320SchedulerWriterAuthorityAuditOutcome, G8lS320SchedulerWriterAuthorityAuditError>
{
    match preflight_s319_scheduler_writer_authority(caller_cpu, request)
        .map_err(G8lS320SchedulerWriterAuthorityAuditError::S319)?
    {
        G8lS319SchedulerWriterAuthorityAuditOutcome::Idle => {
            Ok(G8lS320SchedulerWriterAuthorityAuditOutcome::Idle)
        }
        G8lS319SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
            request_id,
            guarded_sites,
            writer_sites,
        } if guarded_sites == S320_WHOLE_SCHEDULER_GUARDED_SITES
            && writer_sites == S320_OPEN_WRITER_SITES =>
        {
            Ok(
                G8lS320SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
                    request_id,
                    guarded_sites,
                    writer_sites,
                },
            )
        }
        G8lS319SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
            guarded_sites,
            writer_sites: _,
            ..
        } => Err(
            G8lS320SchedulerWriterAuthorityAuditError::PriorCoverageDrift {
                guarded_sites,
                unrouted_sites: S320_DIRECT_SCHEDULER_ACCESS_SITES - guarded_sites,
            },
        ),
    }
}

#[test]
fn s320_controller_crashed_supervisor_broker_lease_message_and_reply_precede_writer() {
    let source = include_str!("../../kernel/src/main.rs");
    let s141 = s141_automatic_recovery_boundary(source);
    let writer = s141.find(".ipc_kernel_call_and_wait(").unwrap();
    for required in [
        "current_task_id().expect(\"S141 controller task\")",
        "mint_endpoint(controller_task, S141_EVENT_LABEL)",
        "S141 strict lifecycle-exit supervisor spawn",
        "S141 crashed supervisor RECV grant",
        "RuntimeOomTransportEvent::try_new",
        "begin_supervisor_session_for_task(crashed_supervisor.task_id)",
        "S141 task-bound crashed lease",
        "drop(crash_publication_guard)",
        "assert_eq!(crash_spawned.pmm.free_frames, baseline_free_frames - 5)",
        "let message = IpcMessage",
        "S141 cancelled reply mint",
    ] {
        let position = s141
            .find(required)
            .unwrap_or_else(|| panic!("missing S320 authority token: {required}"));
        assert!(position < writer, "late S320 authority token: {required}");
    }
}

  {
    id: "g8l-s320-qemu-s141-crashed-call-writer-authority-audit-partial",
    date: "2026-08-27",
    sequence: 320,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: QEMU S141 crashed CALL writer-authority audit",
    summary:
      "S320 focused 15/15 PASS ile main.rs kaynak sırasındaki bir sonraki explicit mutable scheduler sınırını doğrular: run_qemu_s141_automatic_lifecycle_recovery içindeki iki ipc_kernel_call_and_wait writer'ından daha önceki crashed-supervisor CALL. Nonzero controller, controller-owned normal Endpoint SEND authority, strict EL0 crashed-supervisor RECV grant, task-bound broker session/lease, immutable message ve linked cancelled reply writer'dan önce doğrulanır. Helper aynı IRQ/IPC transaction altında non-user caller SEND authority'sini, normal endpoint'i, linked reply'ı, optional receiver authority/deadline'ını ve park kapasitesini yeniden doğrular; CALL publication/park ve optional delivery tek transaction içindedir. Ordinary task-exit lifecycle cancelled reply'ı retire eder, broker lease'i otomatik requeue eder, old lease'i stale yapar ve continuation yalnız exact InvalidCapability kabul eder; crashed supervisor daha sonraki S319 replacement exact-ACK CALL'den önce reclaim edilir. Writer authority yalnız model gate'inin exclusive lease'iyle mümkündür; reader lease'i writer'ı açmaz. main.rs 17 explicit writer / 10 previously audited / 6 remaining unaudited; S141 işlevi 2 / 0 ve tüm S141 aliasları source/model covered; production inventory 113 direct / 44 immutable guarded / 69 open writer olarak değişmez ve production exclusive wrapper, provider authority, whole-scheduler exclusion veya scheduler mutation üretilmez.",
    evidence: [
      "S320 focused kaynak/model kapısı iki bağımsız koşuda 15/15 PASS verdi: 130 B / SHA-256 0447f2fe9dc6fdf30815a6962cf23d978425e51bef2acde1efb27e5da13a78b3.",
      "main.rs içindeki 17 explicit addr_of_mut!(crate::task::scheduler::SCHEDULER) sitesinin positions[6], kaynakta alttan on birinci sınırı audit edilir. run_qemu_s141_automatic_lifecycle_recovery içindeki daha önceki crashed CALL kapanır; S141 işlevinde 0, main.rs genelinde 6 unaudited alias kalır.",
      "Nonzero controller, controller-owned normal Endpoint ENDPOINT_SEND authority, strict EL0 crashed supervisor'a exact ENDPOINT_RECV grant, task-bound broker session/lease, immutable IpcMessage ve controller-owned linked one-shot cancelled reply-cap writer'dan önce kurulur.",
      "ipc_kernel_call_and_wait exact endpoint id/generation, cancelled reply id ve immutable message'i alır. Ordinary task-exit lifecycle cancelled reply'ı retire eder; broker pending=1/in_flight=0/supervisor_crashes=1/recovered_inflight=1 olur, old lease StaleLease verir ve continuation yalnız exact InvalidCapability kabul eder.",
      "Helper IrqGuard ve IPC_TRANSACTION_LOCK altında nonzero non-user caller, canlı SEND authority, normal endpoint, linked reply, optional receiver authority/deadline ve ready/blocked kapasitesini yeniden doğrular. CALL publish/park, optional delivery ve aynı caller'ın saved GPR continuation'ı sıralıdır.",
      "Crashed supervisor exact reclaim ile RuntimePmm baseline'a döner ve daha sonraki S319 replacement exact-ACK CALL bundan sonra gelir. S141 içindeki iki explicit mutable aliasın ikisi de source/model düzeyinde kapsanmıştır.",
      "Model gate reader membership exclusive writer authority'yi ExclusiveBusy ile bloklar; reader bırakıldıktan sonra non-zero token'lı exclusive lease alınır. Wrong CPU InvalidCpu ile fail-closed kalır. Bu host/model evidence'tır.",
      "S319 authority preflight yeniden doğrulanır; pending S245 request korunur ve sonuç AwaitingWriterAuthority { guarded_sites: 44, writer_sites: 69 } olarak döner.",
      "Dört AArch64 profil derlemesi iki koşuda byte-equal exit 0 verdi: QEMU 110646 B / a00cdb57, RPi4 149371 B / c39a808b, RPi5 472061 B / 27e29736 ve RPi5+SMP 472003 B / 0f1052e5. Warning header'ları sırasıyla 291, 389, 1015 ve 1015'tir; zero-warning iddiası değildir.",
      "Birleşik board-rpi5,board-qemu özellikleri iki koşuda beklenen exit 101, 18590 B / ce3734e1, 17 error ve 22 warning header ile fail-closed kaldı.",
      "S238–S320 dependency matrisi iki koşuda 84 grup / 1184/1184 PASS; ham loglar 10842 B / 56e1455f ve 95725cc0, süre-normalize özetler byte-equal 11010 B / e1a33e3d237bd53e9cbb84bbf77ae9d45501a99e55b602ad9574c6f720ebc576. Bu production writer-authority invocation kanıtı değildir.",
      "Ortak make verify-qemu iki koşuda PASS verdi: 116222 B / c3232cc2 ve 116139 B / b76e9c83; guest logları 2160219 B / 63e11fef ve 2127948 B / 82b3e12d. W^X 31/31, S271 GRAPH_ABSENT=YES, RuntimePmm baseline, EL0 x4096, IPC 20/20, koşu başına tek beklenen S142 fatal containment, SEC5 ve 13 KERNEL_FAULTS=0 marker'ı korunur. Bu ortak smoke S320 production writer-authority invocation kanıtı değildir.",
      "Exact yedi tarihsel G8h assertion adıyla dışlandığında workspace iki koşuda 282 sonuç grubu / 2994 PASS / 7 filtered verdi: ham loglar 64162 B / fddb1f66 ve 4bacc2f9, sonuç özetleri 26673 B / 950dedf0 ve df196f50, süre-normalize 27235 B özet byte-equal / SHA-256 03f6570827c52f5a549525e7c1b226954ad5a77effa9e400f683bdf4d81686e0. Filtresiz koşu exit 101, 59384 B / 9d28fcfa ile frozen S96 exceptions.S identity kapısında RED kaldı; full-workspace GREEN iddia edilmez.",
      "S320 production exclusive wrapper, provider authority, whole-scheduler exclusion, QEMU fixture mutation veya scheduler mutation iddiası eklemez; physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S320=NO.",
    ],
    commands: [
      "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s320_qemu_s141_crashed_call_writer_authority_audit -- --test-threads=1",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-qemu",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi4",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,board-qemu",
      "make verify-qemu",
    ],
    terminalSessions: [
      {
        id: "g8l-s320-qemu-s141-crashed-call-writer-authority-audit",
        title: "G8l S320 QEMU S141 crashed CALL writer-authority audit",
        commandLines: [
          "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s320_qemu_s141_crashed_call_writer_authority_audit -- --test-threads=1",
        ],
        outputLines: [
          "test result: ok; S320 focused 1 group / 15 passed; 0 failed",
          "repeat-stable quiet output: 130 B / 0447f2fe9dc6fdf30815a6962cf23d978425e51bef2acde1efb27e5da13a78b3",
          "QEMU S141 crashed CALL writer authority remains model-only: exact forwarding returns InvalidCapability after reply retirement and broker requeue; S141 is now 2/2 source/model covered, main.rs retains 6 unaudited aliases and all 69 production writer sites remain open",
          "dependency: S238–S320 · 84 groups · 1184/1184 PASS; workspace: 282 groups · 2994 PASS · 7 historical filtered",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S320 kaynak/model fail-closed authority boundary'sidir; production writer guard/migration, QEMU fixture mutation ve fiziksel/device execution claim edilmez.",
    limitations: [
      "S320 run_qemu_s141_automatic_lifecycle_recovery içindeki daha önceki crashed ipc_kernel_call_and_wait mutable scheduler aliasını audit eder; S141 source/model düzeyinde kapanırken main.rs genelinde 6 ve toplam 69 production writer site authority wrapper dışında açık kalır.",
      "Exclusive lease yalnız host/model gate'inde test edilir; production exclusive wrapper, provider authority ve whole-scheduler exclusion açık kalır.",
      "S238–S320 dependency matrisi exact 84 grup / 1184/1184 PASS'tir; bu production writer authority invocation kanıtı değildir.",
      "Filtresiz workspace frozen S96 identity kapısında RED'dir; workspace umbrella GREEN iddia edilmez.",
      "Supported-profile writer-authority runtime invocation, Generic SMP ve fiziksel RPi kabulü açık kalır; S320 physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S320=NO.",
    ],
  },