G8l: QEMU S138 exact-ACK writer-authority audit

pub const S323_WRITER_BOUNDARY_SITES: usize = 1;
pub const S323_WRITER_AUTHORITY_SITES: usize = 0;
pub const S323_MAIN_EXPLICIT_WRITER_SITES: usize = 17;
pub const S323_MAIN_PREVIOUSLY_AUDITED_WRITER_SITES: usize = 13;
pub const S323_MAIN_REMAINING_UNAUDITED_WRITER_SITES: usize = 3;
pub const S323_S138_EXPLICIT_WRITER_SITES: usize = 2;
pub const S323_S138_REMAINING_UNAUDITED_WRITER_SITES: usize = 1;
pub const S323_DIRECT_SCHEDULER_ACCESS_SITES: usize = S322_DIRECT_SCHEDULER_ACCESS_SITES;
pub const S323_IMMUTABLE_READ_SITES: usize = S322_IMMUTABLE_READ_SITES;
pub const S323_WHOLE_SCHEDULER_GUARDED_SITES: usize = S322_WHOLE_SCHEDULER_GUARDED_SITES;
pub const S323_WHOLE_SCHEDULER_UNROUTED_SITES: usize = S322_WHOLE_SCHEDULER_UNROUTED_SITES;
pub const S323_OPEN_WRITER_SITES: usize = S322_OPEN_WRITER_SITES;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS323SchedulerWriterAuthorityAuditOutcome {
    Idle,
    AwaitingWriterAuthority {
        request_id: u64,
        guarded_sites: usize,
        writer_sites: usize,
    },
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS323SchedulerWriterAuthorityAuditError {
    S322(G8lS322SchedulerWriterAuthorityAuditError),
    S245(G8lS245ExclusionAdmissionRequestError),
    PriorCoverageDrift {
        guarded_sites: usize,
        unrouted_sites: usize,
    },
}

/// Revalidate the prior fail-closed authority boundary without taking
/// admission or constructing a production exclusive wrapper.
pub fn preflight_s323_scheduler_writer_authority(
    caller_cpu: usize,
    request: Option<G8lS245WholeSchedulerExclusionAdmissionRequestView>,
) -> Result<G8lS323SchedulerWriterAuthorityAuditOutcome, G8lS323SchedulerWriterAuthorityAuditError>
{
    match preflight_s322_scheduler_writer_authority(caller_cpu, request)
        .map_err(G8lS323SchedulerWriterAuthorityAuditError::S322)?
    {
        G8lS322SchedulerWriterAuthorityAuditOutcome::Idle => {
            Ok(G8lS323SchedulerWriterAuthorityAuditOutcome::Idle)
        }
        G8lS322SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
            request_id,
            guarded_sites,
            writer_sites,
        } if guarded_sites == S323_WHOLE_SCHEDULER_GUARDED_SITES
            && writer_sites == S323_OPEN_WRITER_SITES =>
        {
            Ok(
                G8lS323SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
                    request_id,
                    guarded_sites,
                    writer_sites,
                },
            )
        }
        G8lS322SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
            guarded_sites,
            writer_sites: _,
            ..
        } => Err(
            G8lS323SchedulerWriterAuthorityAuditError::PriorCoverageDrift {
                guarded_sites,
                unrouted_sites: S323_DIRECT_SCHEDULER_ACCESS_SITES - guarded_sites,
            },
        ),
    }
}

#[test]
fn s323_continuation_precedes_ack_rearm_reclaim_baseline_and_endpoint_cleanup() {
    let scheduler = include_str!("../../kernel/src/task/scheduler.rs");
    let helper = kernel_call_and_wait_boundary(scheduler);
    for required in [
        "drop(blocked)",
        "drop(endpoints)",
        "drop(deadlines)",
        "drop(transaction)",
        "self.switch_after_ipc_park(caller_context)",
        ".filter(|task| task.id == caller_task && !task.is_user)",
        "label: caller.saved_user_gprs[1]",
        "badge: caller.saved_user_gprs[2]",
    ] {
        assert!(
            helper.contains(required),
            "missing S323 continuation token: {required}"
        );
    }

    let source = include_str!("../../kernel/src/main.rs");
    let s138 = s138_transport_boundary(source);
    let writer = s138.rfind(".ipc_kernel_call_and_wait(").unwrap();
    let validate = s138.find("assert_eq!(exact_ack.data").unwrap();
    let acknowledge = s138
        .find(".coordinator\n        .acknowledge(exact_ack.data[0])")
        .unwrap();
    let rearm = s138.find("S138 post-ACK monitor rearm").unwrap();
    let normal = s138.find("S137 audited recovery observation").unwrap();
    let reclaim = s138.find("let mut supervisor_reclaimed").unwrap();
    let baseline = s138
        .find("let (victim_quota, supervisor_quota, final_snapshot)")
        .unwrap();
    let cleanup = s138.find("S138 completion endpoint cleanup").unwrap();
    assert!(
        writer < validate
            && validate < acknowledge
            && acknowledge < rearm
            && rearm < normal
            && normal < reclaim
            && reclaim < baseline
            && baseline < cleanup
    );
}

  {
    id: "g8l-s323-qemu-s138-exact-ack-writer-authority-audit-partial",
    date: "2026-08-27",
    sequence: 323,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: QEMU S138 exact-ACK writer-authority audit",
    summary:
      "S323 focused 15/15 PASS ile main.rs kaynak sırasındaki bir sonraki explicit mutable scheduler sınırını doğrular: qemu_s137_runtime_pressure_completion içindeki iki ipc_kernel_call_and_wait writer'ından daha sonraki S138 exact-ACK CALL. Nonzero completion task, task-owned normal Endpoint SEND authority, strict EL0 supervisor RECV grant, coordinator event, immutable message ve linked exact reply writer'dan önce doğrulanır. Daha önceki stale-ACK CALL mismatched event id döndürür; acknowledge hata verirken coordinator snapshot değişmez ve monitor rearm AttemptInFlight ile kapalı kalır. Helper aynı IRQ/IPC transaction altında non-user caller SEND authority'sini, normal endpoint'i, linked reply'ı, optional receiver authority/deadline'ını ve tüm park kapasitesini yeniden doğrular; CALL publication/park ve optional delivery tek transaction içindedir. Continuation exact ACK'i kurar; coordinator acknowledge, monitor rearm, normal observation, supervisor reclaim, RuntimePmm baseline ve endpoint cleanup bundan sonra gelir. Writer authority yalnız model gate'inin exclusive lease'iyle mümkündür; reader lease'i writer'ı açmaz. main.rs 17 explicit writer / 13 previously audited / 3 remaining unaudited; S138 işlevi 2 / 1; production inventory 113 direct / 44 immutable guarded / 69 open writer olarak değişmez ve production exclusive wrapper, provider authority, whole-scheduler exclusion veya scheduler mutation üretilmez.",
    evidence: [
      "S323 focused kaynak/model kapısı iki bağımsız koşuda 15/15 PASS verdi: 130 B / SHA-256 0447f2fe9dc6fdf30815a6962cf23d978425e51bef2acde1efb27e5da13a78b3.",
      "main.rs içindeki 17 explicit addr_of_mut!(crate::task::scheduler::SCHEDULER) sitesinin positions[3], kaynakta alttan on dördüncü sınırı audit edilir. qemu_s137_runtime_pressure_completion içindeki daha sonraki exact-ACK CALL kapanır; S138 işlevinde 1, main.rs genelinde 3 unaudited alias kalır.",
      "Nonzero completion task, task-owned normal Endpoint ENDPOINT_SEND authority, strict EL0 supervisor'a exact ENDPOINT_RECV grant, coordinator event, immutable IpcMessage ve completion-owned linked exact reply-cap writer'dan önce kurulur.",
      "Daha önceki stale CALL mismatched event id döndürür. AckMismatch coordinator snapshot'ını değiştirmez ve monitor rearm AttemptInFlight ile fail-closed kalır; exact reply bundan sonra mint edilir.",
      "ipc_kernel_call_and_wait exact endpoint id/generation, exact reply id ve immutable event_message'i alır. Helper IrqGuard ve IPC_TRANSACTION_LOCK altında nonzero non-user caller, canlı SEND authority, normal endpoint, linked reply, optional receiver authority/deadline ve ready/blocked kapasiteyi yeniden doğrular; CALL publish/finish-park, caller BlockedOnIpc publication ve optional delivery/deadline retirement/Ready enqueue aynı transaction içindedir.",
      "Transaction bırakıldıktan sonra aynı kernel caller saved GPR continuation'ından resume edilir. Yalnız exact supervisor ACK label/badge/data kabul edilir; ardından coordinator exact acknowledge, monitor rearm, NORMAL pressure observation, supervisor reclaim, victim/supervisor quota baseline ve completion endpoint cleanup sıralıdır.",
      "Model gate reader membership exclusive writer authority'yi ExclusiveBusy ile bloklar; reader bırakıldıktan sonra non-zero token'lı exclusive lease alınır. Wrong CPU InvalidCpu ile fail-closed kalır. Bu host/model evidence'tır.",
      "S322 authority preflight yeniden doğrulanır; pending S245 request korunur ve sonuç AwaitingWriterAuthority { guarded_sites: 44, writer_sites: 69 } olarak döner.",
      "Dört AArch64 profil derlemesi iki koşuda byte-equal exit 0 verdi: QEMU 110646 B / 94c56d98, RPi4 149371 B / d186e7e7, RPi5 482913 B / 5a42923b ve RPi5+SMP 482855 B / f2b9ae37. Warning header'ları sırasıyla 291, 389, 1045 ve 1045'tir; zero-warning iddiası değildir.",
      "Birleşik board-rpi5,board-qemu özellikleri beklenen exit 101, 18624 B / c4154648, 17 error ve 22 warning header ile fail-closed kaldı.",
      "S238–S323 dependency matrisi iki koşuda 87 grup / 1229/1229 PASS; ham loglar byte-equal 11232 B / ef6e09ec, süre-normalize özetler byte-equal 11406 B / e2b60af7787e6dfdc0855596d43145ca4a310af384875ce797989f3a5c8332ee. Önceki S322 prefix'i 11102 B / 6ea53ba4 ile birebir yeniden üretildi. Bu production writer-authority invocation kanıtı değildir.",
      "Ortak make verify-qemu iki koşuda PASS verdi: 116222 B / 2edfa787 ve 116139 B / aef2ae65; guest logları 2085865 B / c7bc2219 ve 2094342 B / 2ff134c2. W^X 31/31, tek kontrollü S140 exit, S271 GRAPH_ABSENT=YES, RuntimePmm baseline, EL0 x4096, IPC 20/20, koşu başına tek beklenen S142 fatal containment, SEC5 ve 13 KERNEL_FAULTS=0 marker'ı korunur. Bu ortak smoke S323 production writer-authority invocation kanıtı değildir.",
      "Exact yedi frozen tarihsel assertion dışlandığında tam workspace iki bağımsız koşuda 285 sonuç grubu / 3042 PASS / 7 filtered verdi. Ham loglar 64555 B / 8ab27cbe ve 64555 B / 3153cba3; süre-normalize sonuç özetleri byte-equal 27526 B / f322b66fd2838e2b25c94ef3680db9683082ed247e3468f6dec1742f6aaac380. Filtresiz workspace exit 101, 59777 B / 87aae98b ile frozen S96 exceptions.S identity kapısında RED kaldı; full-workspace GREEN iddia edilmez.",
      "S323 production exclusive wrapper, provider authority, whole-scheduler exclusion, QEMU fixture mutation veya scheduler mutation iddiası eklemez; physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S323=NO.",
    ],
    commands: [
      "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s323_qemu_s138_exact_ack_writer_authority_audit -- --test-threads=1",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-qemu",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi4",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,board-qemu",
      "make verify-qemu",
    ],
    terminalSessions: [
      {
        id: "g8l-s323-qemu-s138-exact-ack-writer-authority-audit",
        title: "G8l S323 QEMU S138 exact-ACK writer-authority audit",
        commandLines: [
          "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s323_qemu_s138_exact_ack_writer_authority_audit -- --test-threads=1",
        ],
        outputLines: [
          "test result: ok; S323 focused 1 group / 15 passed; 0 failed",
          "repeat-stable quiet output: 130 B / 0447f2fe9dc6fdf30815a6962cf23d978425e51bef2acde1efb27e5da13a78b3",
          "QEMU S138 exact-ACK CALL writer authority remains model-only: stale mismatch is nonmutating, rearm stays blocked, then exact ACK precedes acknowledge/rearm/reclaim/baseline/cleanup; S138 retains 1 and main.rs retains 3 unaudited aliases while all 69 production writer sites remain open",
          "dependency: S238–S323 · 87 groups · 1229/1229 PASS; workspace: 285 groups · 3042 PASS · 7 historical filtered; unfiltered frozen S96 RED",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S323 kaynak/model fail-closed authority boundary'sidir; production writer guard/migration, QEMU fixture mutation ve fiziksel/device execution claim edilmez.",
    limitations: [
      "S323 qemu_s137_runtime_pressure_completion içindeki daha sonraki exact-ACK ipc_kernel_call_and_wait mutable scheduler aliasını audit eder; S138 içinde 1, main.rs genelinde 3 ve toplam 69 production writer site authority wrapper dışında açık kalır.",
      "Exclusive lease yalnız host/model gate'inde test edilir; production exclusive wrapper, provider authority ve whole-scheduler exclusion açık kalır.",
      "S238–S323 dependency matrisi exact 87 grup / 1229/1229 PASS'tir; bu production writer authority invocation kanıtı değildir.",
      "Filtresiz workspace frozen S96 identity kapısında RED'dir; workspace umbrella GREEN iddia edilmez.",
      "Supported-profile writer-authority runtime invocation, Generic SMP ve fiziksel RPi kabulü açık kalır; S323 physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S323=NO.",
    ],
  },