G8l: QEMU S147 post-revoke coalesced-signal writer-authority audit

pub const S315_WRITER_BOUNDARY_SITES: usize = 1;
pub const S315_WRITER_AUTHORITY_SITES: usize = 0;
pub const S315_MAIN_EXPLICIT_WRITER_SITES: usize = 17;
pub const S315_MAIN_PREVIOUSLY_AUDITED_WRITER_SITES: usize = 5;
pub const S315_MAIN_REMAINING_UNAUDITED_WRITER_SITES: usize = 11;
pub const S315_S147_EXPLICIT_WRITER_SITES: usize = 2;
pub const S315_S147_REMAINING_UNAUDITED_WRITER_SITES: usize = 0;
pub const S315_DIRECT_SCHEDULER_ACCESS_SITES: usize = S314_DIRECT_SCHEDULER_ACCESS_SITES;
pub const S315_IMMUTABLE_READ_SITES: usize = S314_IMMUTABLE_READ_SITES;
pub const S315_WHOLE_SCHEDULER_GUARDED_SITES: usize = S314_WHOLE_SCHEDULER_GUARDED_SITES;
pub const S315_WHOLE_SCHEDULER_UNROUTED_SITES: usize = S314_WHOLE_SCHEDULER_UNROUTED_SITES;
pub const S315_OPEN_WRITER_SITES: usize = S314_OPEN_WRITER_SITES;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS315SchedulerWriterAuthorityAuditOutcome {
    Idle,
    AwaitingWriterAuthority {
        request_id: u64,
        guarded_sites: usize,
        writer_sites: usize,
    },
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS315SchedulerWriterAuthorityAuditError {
    S314(G8lS314SchedulerWriterAuthorityAuditError),
    S245(G8lS245ExclusionAdmissionRequestError),
    PriorCoverageDrift {
        guarded_sites: usize,
        unrouted_sites: usize,
    },
}

/// Revalidate the prior fail-closed authority boundary without taking
/// admission or constructing a production exclusive wrapper.
pub fn preflight_s315_scheduler_writer_authority(
    caller_cpu: usize,
    request: Option<G8lS245WholeSchedulerExclusionAdmissionRequestView>,
) -> Result<G8lS315SchedulerWriterAuthorityAuditOutcome, G8lS315SchedulerWriterAuthorityAuditError>
{
    match preflight_s314_scheduler_writer_authority(caller_cpu, request)
        .map_err(G8lS315SchedulerWriterAuthorityAuditError::S314)?
    {
        G8lS314SchedulerWriterAuthorityAuditOutcome::Idle => {
            Ok(G8lS315SchedulerWriterAuthorityAuditOutcome::Idle)
        }
        G8lS314SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
            request_id,
            guarded_sites,
            writer_sites,
        } if guarded_sites == S315_WHOLE_SCHEDULER_GUARDED_SITES
            && writer_sites == S315_OPEN_WRITER_SITES =>
        {
            Ok(
                G8lS315SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
                    request_id,
                    guarded_sites,
                    writer_sites,
                },
            )
        }
        G8lS314SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
            guarded_sites,
            writer_sites: _,
            ..
        } => Err(
            G8lS315SchedulerWriterAuthorityAuditError::PriorCoverageDrift {
                guarded_sites,
                unrouted_sites: S315_DIRECT_SCHEDULER_ACCESS_SITES - guarded_sites,
            },
        ),
    }
}

#[test]
fn s315_later_lifecycle_stale_signal_accounting_and_absence_remain_exact() {
    let source = include_str!("../../kernel/src/main.rs");
    let lifecycle = s147_lifecycle_boundary(source);
    let writer = lifecycle.find(".notification_signal(").unwrap();
    let tail = &lifecycle[writer..];
    for required in [
        "teardown_task_ipc_lifecycle(controller_task)",
        "assert_eq!(lifecycle.owned_notifications, 2)",
        "assert_eq!(lifecycle.revoked_notification_grants, 1)",
        "assert_eq!(lifecycle.cancelled_notification_waiters, 1)",
        "assert_eq!(lifecycle.woken_notification_waiters, 1)",
        "owner_close_notification.id",
        "owner_close_notification.generation",
        "Err(crate::ipc::IpcError::InvalidCapability)",
        "Err(NotificationAuthorityError::StaleAuthority)",
        "assert_eq!(deadline.active, 0)",
        "deadline.registered - before_deadlines.registered, 2",
        "deadline.cancelled - before_deadlines.cancelled, 1",
        "deadline.peer_closed - before_deadlines.peer_closed, 1",
        "get_live_capability(revoke_notification.id).is_none()",
        "get_live_capability(owner_close_notification.id).is_none()",
        "assert_eq!(final_snapshot.pmm.free_frames, baseline_free_frames)",
    ] {
        assert!(
            tail.contains(required),
            "missing S315 post-coalescing token: {required}"
        );
    }
    assert_eq!(tail.matches(".notification_signal(").count(), 2);
}

  {
    id: "g8l-s315-qemu-s147-post-revoke-coalesced-signal-writer-authority-audit-partial",
    date: "2026-08-27",
    sequence: 315,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: QEMU S147 post-revoke coalesced-signal writer-authority audit",
    summary:
      "S315 focused 15/15 PASS ile main.rs içindeki kaynak sırasına göre S314 post-lifecycle stale-signal aliasından hemen önceki explicit mutable scheduler sınırını doğrular: run_qemu_s147_notification_lifecycle içindeki exact derived WAIT-grant revoke sonrasındaki ilk notification_signal writer'ı. Nonzero controller task, controller-owned exact iki Notification root/WAIT grant, iki strict waiter'ın deadline active/registered=2 admission'ı ve exact waiter/generation/mask snapshot'ları writer'dan önce doğrulanır. revoke_notification_grant exact wait/deadline'ı iptal eder, yalnız derived WAIT authority'yi kaldırır ve matching waiter'ı exact wake eder; stale tekrar StaleAuthority verir. Hâlâ canlı revoke root id/generation/0x8 helper'a exact forward edilir ve yalnız Coalesced pending=0x8 kabul edilir. notification_signal helper canlı NOTIFICATION_SIGNAL authority ve registry object'ini yeniden doğrular; no-waiter coalescing dönüşü blocked-task, wake-capacity, Ready ve deadline-delivery mutation'ından önce terminaldir. S314 sonrasındaki lifecycle/stale-signal accounting, object/capability absence ve RuntimePmm baseline zinciri korunur. Writer authority yalnız model gate'inin exclusive lease'iyle mümkündür; reader lease'i writer'ı açmaz. main.rs 17 explicit writer / 5 previously audited / 11 remaining unaudited; S147 işlevi 2 / 0 source/model covered; production inventory 113 direct / 44 immutable guarded / 69 open writer olarak değişmez ve production exclusive wrapper, provider authority, whole-scheduler exclusion veya scheduler mutation üretilmez.",
    evidence: [
      "S315 focused kaynak/model kapısı iki bağımsız koşuda 15/15 PASS verdi: 130 B / SHA-256 0447f2fe9dc6fdf30815a6962cf23d978425e51bef2acde1efb27e5da13a78b3.",
      "main.rs içindeki 17 explicit addr_of_mut!(crate::task::scheduler::SCHEDULER) sitesinin positions[11], kaynakta alttan altıncı sınırı audit edilir. run_qemu_s147_notification_lifecycle 2 explicit alias taşır; S314 daha sonraki stale-signal aliasını, S315 daha önceki post-revoke coalesced-signal aliasını kapatır. İşlevde 0, main.rs genelinde 11 alias ayrıca açık kalır.",
      "Exact controller task, controller-owned revoke/owner-close Notification root'ları, iki NOTIFICATION_WAIT grant'i, first_parked ve both_parked admission'ları ile deadline active/registered=2 writer'dan önce gelir.",
      "revoke_notification_grant ilk çağrıda Ok(true), stale tekrarda StaleAuthority verir; helper exact wait/deadline'ı iptal eder, yalnız derived WAIT capability'yi revoke eder ve matching waiter'ı exact wake eder. Root object, root SIGNAL authority ve ilgisiz authority korunur.",
      "Hâlâ canlı revoke_notification.id, revoke_notification.generation ve 0x8 ilk S147 writer'ına exact forward edilir; caller yalnız Ok(NotificationSignalOutcome::Coalesced { pending: 0x8 }) kabul eder.",
      "Scheduler notification_signal helper IRQ/IPC transaction altında nonzero current signaler, bits!=0, canlı NOTIFICATION_SIGNAL authority ve exact registry object'ini yeniden doğrular; no-waiter coalescing return blocked-task lookup, wake capacity, Ready enqueue ve deadline delivery commit'ten önce terminaldir.",
      "Daha sonraki controller teardown exact owned_notifications=2, revoked_notification_grants=1, cancelled_notification_waiters=1 ve woken_notification_waiters=1 özetini üretir; owner-close stale signal InvalidCapability, exact destroy retry StaleAuthority verir. Deadline delta registered/cancelled/peer_closed=2/1/1, iki registry object ve iki live capability absence ile RuntimePmm baseline korunur.",
      "Model gate reader membership exclusive writer authority'yi ExclusiveBusy ile bloklar; reader bırakıldıktan sonra non-zero token'lı exclusive lease alınır. Wrong CPU InvalidCpu ile fail-closed kalır. Bu host/model evidence'tır.",
      "S314 authority preflight yeniden doğrulanır; pending S245 request korunur ve sonuç AwaitingWriterAuthority { guarded_sites: 44, writer_sites: 69 } olarak döner.",
      "Dört AArch64 profil derlemesi iki koşuda byte-equal exit 0 verdi: QEMU 110646 B / 0ca1a160, RPi4 149371 B / 7f8e16c4, RPi5 454034 B / c3f3f3bf ve RPi5+SMP 453976 B / 6914ed95. Warning header'ları sırasıyla 291, 389, 965 ve 965'tir; zero-warning iddiası değildir.",
      "Birleşik board-rpi5,board-qemu özellikleri iki koşuda beklenen exit 101, 18590 B / c94139f0, 17 error ve 22 warning header ile fail-closed kaldı.",
      "S238–S315 dependency matrisi iki koşuda 79 grup / 1109/1109 PASS; ham loglar 10192 B / 1d577617 ve 1b5219ce, süre-normalize özetler byte-equal 10350 B / f6543c14d89aad2eaee1d0aed257c03d0f23e4e46ab14db362797bf8980c833f. Bu production writer-authority invocation kanıtı değildir.",
      "Ortak make verify-qemu iki koşuda PASS verdi: 116222 B / 34829f45 ve 116139 B / bb236cc2; guest logları 2139003 B / 18b5befa ve 2122857 B / 1c47b1a4. W^X 31/31, S271 GRAPH_ABSENT=YES, RuntimePmm baseline, EL0 x4096, IPC 20/20, koşu başına tek S142 containment, SEC5 ve 13 KERNEL_FAULTS=0 marker'ı korunur. Bu ortak smoke S315 production writer-authority invocation kanıtı değildir.",
      "Exact yedi tarihsel G8h assertion adıyla dışlandığında workspace iki koşuda 277 sonuç grubu / 2913 PASS / 7 filtered verdi: ham loglar 63506 B / 15c4cb83 ve 41972bf0, sonuç özetleri 26198 B / f04534ff ve 3ce2d681, süre-normalize 26750 B özet byte-equal / SHA-256 210ff84c335a37b8847ebc6a319b1df226dc60301c3e8de9136d86bfd7ed22b2. Filtresiz koşu exit 101, 58728 B / ac0c747f ile frozen S96 exceptions.S identity kapısında RED kaldı; full-workspace GREEN iddia edilmez.",
      "S315 production exclusive wrapper, provider authority, whole-scheduler exclusion, QEMU fixture mutation veya scheduler mutation iddiası eklemez; physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S315=NO.",
    ],
    commands: [
      "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s315_qemu_s147_post_revoke_coalesced_signal_writer_authority_audit -- --test-threads=1",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-qemu",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi4",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,board-qemu",
      "make verify-qemu",
    ],
    terminalSessions: [
      {
        id: "g8l-s315-qemu-s147-post-revoke-coalesced-signal-writer-authority-audit",
        title:
          "G8l S315 QEMU S147 post-revoke coalesced-signal writer-authority audit",
        commandLines: [
          "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s315_qemu_s147_post_revoke_coalesced_signal_writer_authority_audit -- --test-threads=1",
        ],
        outputLines: [
          "test result: ok; S315 focused 1 group / 15 passed; 0 failed",
          "repeat-stable quiet output: 130 B / 0447f2fe9dc6fdf30815a6962cf23d978425e51bef2acde1efb27e5da13a78b3",
          "QEMU S147 post-revoke coalesced-signal writer authority remains model-only: exact grant revoke precedes live root id/generation/0x8 forwarding and helper returns Coalesced pending=0x8 before graph mutation; S147 is 2/2 source/model covered, main.rs retains 11 unaudited aliases and all 69 production writer sites remain open",
          "dependency: S238–S315 · 79 groups · 1109/1109 PASS; workspace: 277 groups · 2913 PASS · 7 historical filtered",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S315 kaynak/model fail-closed authority boundary'sidir; production writer guard/migration, QEMU fixture mutation ve fiziksel/device execution claim edilmez.",
    limitations: [
      "S315 run_qemu_s147_notification_lifecycle post-revoke coalesced-signal mutable scheduler aliasını audit eder; S147 işlevinin 2/2 aliası source/model covered olsa da main.rs genelinde 11 ve toplam 69 production writer site authority wrapper dışında açık kalır.",
      "Exclusive lease yalnız host/model gate'inde test edilir; production exclusive wrapper, provider authority ve whole-scheduler exclusion açık kalır.",
      "S238–S315 dependency matrisi exact 79 grup / 1109/1109 PASS'tir; bu production writer authority invocation kanıtı değildir.",
      "Filtresiz workspace frozen S96 identity kapısında RED'dir; workspace umbrella GREEN iddia edilmez.",
      "Supported-profile writer-authority runtime invocation, Generic SMP ve fiziksel RPi kabulü açık kalır; S315 physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S315=NO.",
    ],
  },