G8l: QEMU S148 first-signal Wake writer-authority audit

pub const S313_WRITER_BOUNDARY_SITES: usize = 1;
pub const S313_WRITER_AUTHORITY_SITES: usize = 0;
pub const S313_MAIN_EXPLICIT_WRITER_SITES: usize = 17;
pub const S313_MAIN_PREVIOUSLY_AUDITED_WRITER_SITES: usize = 3;
pub const S313_MAIN_REMAINING_UNAUDITED_WRITER_SITES: usize = 13;
pub const S313_S148_EXPLICIT_WRITER_SITES: usize = 2;
pub const S313_S148_REMAINING_UNAUDITED_WRITER_SITES: usize = 0;
pub const S313_DIRECT_SCHEDULER_ACCESS_SITES: usize = S312_DIRECT_SCHEDULER_ACCESS_SITES;
pub const S313_IMMUTABLE_READ_SITES: usize = S312_IMMUTABLE_READ_SITES;
pub const S313_WHOLE_SCHEDULER_GUARDED_SITES: usize = S312_WHOLE_SCHEDULER_GUARDED_SITES;
pub const S313_WHOLE_SCHEDULER_UNROUTED_SITES: usize = S312_WHOLE_SCHEDULER_UNROUTED_SITES;
pub const S313_OPEN_WRITER_SITES: usize = S312_OPEN_WRITER_SITES;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS313SchedulerWriterAuthorityAuditOutcome {
    Idle,
    AwaitingWriterAuthority {
        request_id: u64,
        guarded_sites: usize,
        writer_sites: usize,
    },
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS313SchedulerWriterAuthorityAuditError {
    S312(G8lS312SchedulerWriterAuthorityAuditError),
    S245(G8lS245ExclusionAdmissionRequestError),
    PriorCoverageDrift {
        guarded_sites: usize,
        unrouted_sites: usize,
    },
}

/// Revalidate the prior fail-closed authority boundary without taking
/// admission or constructing a production exclusive wrapper.
pub fn preflight_s313_scheduler_writer_authority(
    caller_cpu: usize,
    request: Option<G8lS245WholeSchedulerExclusionAdmissionRequestView>,
) -> Result<G8lS313SchedulerWriterAuthorityAuditOutcome, G8lS313SchedulerWriterAuthorityAuditError>
{
    match preflight_s312_scheduler_writer_authority(caller_cpu, request)
        .map_err(G8lS313SchedulerWriterAuthorityAuditError::S312)?
    {
        G8lS312SchedulerWriterAuthorityAuditOutcome::Idle => {
            Ok(G8lS313SchedulerWriterAuthorityAuditOutcome::Idle)
        }
        G8lS312SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
            request_id,
            guarded_sites,
            writer_sites,
        } if guarded_sites == S313_WHOLE_SCHEDULER_GUARDED_SITES
            && writer_sites == S313_OPEN_WRITER_SITES =>
        {
            Ok(
                G8lS313SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
                    request_id,
                    guarded_sites,
                    writer_sites,
                },
            )
        }
        G8lS312SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
            guarded_sites,
            writer_sites: _,
            ..
        } => Err(
            G8lS313SchedulerWriterAuthorityAuditError::PriorCoverageDrift {
                guarded_sites,
                unrouted_sites: S313_DIRECT_SCHEDULER_ACCESS_SITES - guarded_sites,
            },
        ),
    }
}

#[test]
fn s313_helper_commits_exact_wake_registers_ready_enqueue_and_deadline_retirement() {
    let source = include_str!("../../kernel/src/task/scheduler.rs");
    let helper = notification_signal_boundary(source);
    for required in [
        "let NotificationSignalOutcome::Wake {",
        "waiter: committed_waiter",
        "assert_eq!(committed_waiter, waiter)",
        "blocked.remove(task_position)",
        "task.saved_user_gprs[0] = crate::ipc::IpcError::Ok.as_u64()",
        "task.saved_user_gprs[1] = observed",
        "task.saved_user_gprs[2..=7]",
        "task.state = TaskState::Ready",
        "self.ready_queue.push(PriorityTask::new(task))",
        "complete_delivery_exact(deadline_record)",
        "Ok(outcome)",
    ] {
        assert!(
            helper.contains(required),
            "missing S313 helper Wake commit token: {required}"
        );
    }
    let signal = helper.rfind(".signal(bits)").unwrap();
    let remove = helper.find("blocked.remove(task_position)").unwrap();
    let ready = helper.find("self.ready_queue.push").unwrap();
    let deadline = helper.find("complete_delivery_exact").unwrap();
    let result = helper.rfind("Ok(outcome)").unwrap();
    assert!(signal < remove && remove < ready && ready < deadline && deadline < result);
}

  {
    id: "g8l-s313-qemu-s148-first-signal-wake-writer-authority-audit-partial",
    date: "2026-08-27",
    sequence: 313,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: QEMU S148 first-signal Wake writer-authority audit",
    summary:
      "S313 focused 15/15 PASS ile main.rs içindeki kaynak sırasına göre S312 post-arbitration aliasından hemen önceki explicit mutable scheduler sınırını doğrular: run_qemu_s148_notification_race_arbitration içindeki signal_outcome notification_signal writer'ı. Nonzero controller task, controller-owned exact üç Notification root/WAIT grant, üç strict waiter'ın deadline.active=3 ve blocked_counts=[1,1,1] admission'ı, exact waiter/generation/mask snapshot'ları ve üç deadline record writer'dan önce doğrulanır. Arbitration IrqGuard altında signal_notification.id/generation ve 0x2 exact forward edilir; caller yalnız exact Wake waiter=signal_waiter, observed=0x2 ve pending=0 sonucunu kabul eder. Helper IRQ/IPC transaction altında nonzero current signaler, canlı NOTIFICATION_SIGNAL authority, exact registry waiter/deadline, BlockedOnNotification task ve task CNode generation/NOTIFICATION_WAIT authority ile wake capacity'yi yeniden doğrular; exact signal commit, saved X0=Ok/X1=observed/X2..X7=0, Ready enqueue ve deadline retirement sırası korunur. Writer authority yalnız model gate'inin exclusive lease'iyle mümkündür; reader lease'i writer'ı açmaz. main.rs 17 explicit writer / 3 previously audited / 13 remaining unaudited; S148 işlevi 2 / 0 source/model covered; production inventory 113 direct / 44 immutable guarded / 69 open writer olarak değişmez ve production exclusive wrapper, provider authority, whole-scheduler exclusion veya scheduler mutation üretilmez.",
    evidence: [
      "S313 focused kaynak/model kapısı bağımsız koşularda 15/15 PASS verdi: 130 B / SHA-256 0447f2fe9dc6fdf30815a6962cf23d978425e51bef2acde1efb27e5da13a78b3.",
      "main.rs içindeki 17 explicit addr_of_mut!(crate::task::scheduler::SCHEDULER) sitesinin kaynakta alttan dördüncü sınırı audit edilir. run_qemu_s148_notification_race_arbitration 2 explicit alias taşır; S312 post-arbitration aliasını, S313 first-signal Wake aliasını kapatır. İşlevde 0, main.rs genelinde 13 alias ayrıca açık kalır.",
      "Exact controller task, controller-owned signal/revoke/timeout Notification root'ları ve her strict waiter'a NOTIFICATION_WAIT grant'i writer'dan önce gelir.",
      "Üç registry waiter snapshot'ı exact task/generation/mask=0x3, deadline active/registered sayıları 3 ve blocked_counts [1,1,1] olarak doğrulanır; signal/revoke/timeout exact deadline record'ları writer'dan önce alınır.",
      "Arbitration IrqGuard writer'dan önce alınır; signal_notification.id, signal_notification.generation ve 0x2 helper'a exact forward edilir. Caller yalnız Ok(NotificationSignalOutcome::Wake { waiter, observed: 0x2, pending: 0 }) ve waiter.task_id()==signal_waiter.task_id sonucunu kabul eder.",
      "Scheduler helper IrqGuard/IPC_TRANSACTION_LOCK altında nonzero current signaler, bits != 0, canlı NOTIFICATION_SIGNAL authority, exact Notification registry object/waiter ve waiter task'ına ait exact Notification deadline shape'ini yeniden doğrular.",
      "Helper blocked set içinde exact waiter task/BlockedOnNotification object id'sini ve waiter CNode içindeki Notification generation/NOTIFICATION_WAIT authority'yi doğrular; ipc_wake_capacity_available(1) signal commit'ten önce fail-closed kapıdır.",
      "Exact Wake commit committed_waiter eşitliğini, blocked task removal'ı, saved_user_gprs X0=Ok/X1=observed/X2..X7=0 yazımını, TaskState::Ready, Ready enqueue ve complete_delivery_exact(deadline_record) sırasını korur.",
      "Model gate reader membership exclusive writer authority'yi ExclusiveBusy ile bloklar; reader bırakıldıktan sonra non-zero token'lı exclusive lease alınır. Bu host/model evidence'tır.",
      "S312 authority preflight yeniden doğrulanır; pending S245 request korunur ve sonuç AwaitingWriterAuthority { guarded_sites: 44, writer_sites: 69 } olarak döner.",
      "Dört AArch64 profil derlemesi iki koşuda byte-equal exit 0 verdi: QEMU 110646 B / 42a9fa4d, RPi4 149371 B / 97333e41, RPi5 446636 B / e79ac39f ve RPi5+SMP 446578 B / 0add3459. Warning header'ları sırasıyla 291, 389, 945 ve 945'tir; zero-warning iddiası değildir.",
      "Birleşik board-rpi5,board-qemu özellikleri iki koşuda beklenen exit 101, 18590 B / 0ede7d4d, 17 error ve 22 warning header ile fail-closed kaldı.",
      "S238–S313 dependency matrisi iki koşuda 77 grup / 1079/1079 PASS; ham loglar 9932 B / 549048f1 ve db54df3e, süre-normalize özetler byte-equal 10086 B / 58cdcf203dff3f95b35a6b9fac73eead5e525ea4d8e6fd0bf25b000af4cdabb4. Bu production writer-authority invocation kanıtı değildir.",
      "Ortak make verify-qemu iki koşuda PASS verdi: 116222 B / 0a736cb9 ve 116139 B / f1975131; guest logları 2151347 B / ac487c65 ve 2161376 B / 5575850c. W^X 31/31, S271 GRAPH_ABSENT=YES, RuntimePmm baseline, EL0 x4096, IPC 20/20, koşu başına tek S142 containment, SEC5 ve 13 KERNEL_FAULTS=0 marker'ı korunur. Bu ortak smoke S313 production writer-authority invocation kanıtı değildir.",
      "Exact yedi tarihsel G8h assertion adıyla dışlandığında workspace iki koşuda 275 sonuç grubu / 2881 PASS / 7 filtered verdi: ham loglar 63244 B / 56196c7b ve ca6d5116, sonuç özetleri 26008 B / 901c0a7d ve 548d4e87, süre-normalize 26556 B özet byte-equal / SHA-256 3aeddc21f2e9a7b92a181278081f66c14a2b819670dd71b84e434cb7ace0eff0. Filtresiz koşu exit 101, 58466 B / 263754bb ile frozen S96 exceptions.S identity kapısında RED kaldı; full-workspace GREEN iddia edilmez.",
      "S313 production exclusive wrapper, provider authority, whole-scheduler exclusion, QEMU fixture mutation veya scheduler mutation iddiası eklemez; physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S313=NO.",
    ],
    commands: [
      "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s313_qemu_s148_first_signal_wake_writer_authority_audit -- --test-threads=1",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-qemu",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi4",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,board-qemu",
      "make verify-qemu",
    ],
    terminalSessions: [
      {
        id: "g8l-s313-qemu-s148-first-signal-wake-writer-authority-audit",
        title: "G8l S313 QEMU S148 first-signal Wake writer-authority audit",
        commandLines: [
          "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s313_qemu_s148_first_signal_wake_writer_authority_audit -- --test-threads=1",
        ],
        outputLines: [
          "test result: ok; S313 focused 1 group / 15 passed; 0 failed",
          "repeat-stable quiet output: 130 B / 0447f2fe9dc6fdf30815a6962cf23d978425e51bef2acde1efb27e5da13a78b3",
          "QEMU S148 first-signal Wake writer authority remains model-only: exact admission/deadline/forward/Wake/register/Ready/deadline-retirement paths are source-audited; S148 has 0 unaudited aliases, main.rs retains 13 and all 69 production writer sites remain open",
          "dependency: S238–S313 · 77 groups · 1079/1079 PASS; workspace: 275 groups · 2881 PASS · 7 historical filtered",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S313 kaynak/model fail-closed authority boundary'sidir; production writer guard/migration, QEMU fixture mutation ve fiziksel/device execution claim edilmez.",
    limitations: [
      "S313 run_qemu_s148_notification_race_arbitration first-signal Wake mutable scheduler aliasını audit eder; bu işlev 2/2 source/model covered olsa da main.rs genelinde 13 ve toplam 69 production writer site authority wrapper dışında açık kalır.",
      "Exclusive lease yalnız host/model gate'inde test edilir; production exclusive wrapper, provider authority ve whole-scheduler exclusion açık kalır.",
      "S238–S313 dependency matrisi exact 77 grup / 1079/1079 PASS'tir; bu production writer authority invocation kanıtı değildir.",
      "Filtresiz workspace frozen S96 identity kapısında RED'dir; workspace umbrella GREEN iddia edilmez.",
      "Supported-profile writer-authority runtime invocation, Generic SMP ve fiziksel RPi kabulü açık kalır; S313 physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S313=NO.",
    ],
  },