G8l: QEMU S141 replacement exact-ACK writer-authority audit

pub const S319_WRITER_BOUNDARY_SITES: usize = 1;
pub const S319_WRITER_AUTHORITY_SITES: usize = 0;
pub const S319_MAIN_EXPLICIT_WRITER_SITES: usize = 17;
pub const S319_MAIN_PREVIOUSLY_AUDITED_WRITER_SITES: usize = 9;
pub const S319_MAIN_REMAINING_UNAUDITED_WRITER_SITES: usize = 7;
pub const S319_S141_EXPLICIT_WRITER_SITES: usize = 2;
pub const S319_S141_REMAINING_UNAUDITED_WRITER_SITES: usize = 1;
pub const S319_DIRECT_SCHEDULER_ACCESS_SITES: usize = S318_DIRECT_SCHEDULER_ACCESS_SITES;
pub const S319_IMMUTABLE_READ_SITES: usize = S318_IMMUTABLE_READ_SITES;
pub const S319_WHOLE_SCHEDULER_GUARDED_SITES: usize = S318_WHOLE_SCHEDULER_GUARDED_SITES;
pub const S319_WHOLE_SCHEDULER_UNROUTED_SITES: usize = S318_WHOLE_SCHEDULER_UNROUTED_SITES;
pub const S319_OPEN_WRITER_SITES: usize = S318_OPEN_WRITER_SITES;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS319SchedulerWriterAuthorityAuditOutcome {
    Idle,
    AwaitingWriterAuthority {
        request_id: u64,
        guarded_sites: usize,
        writer_sites: usize,
    },
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS319SchedulerWriterAuthorityAuditError {
    S318(G8lS318SchedulerWriterAuthorityAuditError),
    S245(G8lS245ExclusionAdmissionRequestError),
    PriorCoverageDrift {
        guarded_sites: usize,
        unrouted_sites: usize,
    },
}

/// Revalidate the prior fail-closed authority boundary without taking
/// admission or constructing a production exclusive wrapper.
pub fn preflight_s319_scheduler_writer_authority(
    caller_cpu: usize,
    request: Option<G8lS245WholeSchedulerExclusionAdmissionRequestView>,
) -> Result<G8lS319SchedulerWriterAuthorityAuditOutcome, G8lS319SchedulerWriterAuthorityAuditError>
{
    match preflight_s318_scheduler_writer_authority(caller_cpu, request)
        .map_err(G8lS319SchedulerWriterAuthorityAuditError::S318)?
    {
        G8lS318SchedulerWriterAuthorityAuditOutcome::Idle => {
            Ok(G8lS319SchedulerWriterAuthorityAuditOutcome::Idle)
        }
        G8lS318SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
            request_id,
            guarded_sites,
            writer_sites,
        } if guarded_sites == S319_WHOLE_SCHEDULER_GUARDED_SITES
            && writer_sites == S319_OPEN_WRITER_SITES =>
        {
            Ok(
                G8lS319SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
                    request_id,
                    guarded_sites,
                    writer_sites,
                },
            )
        }
        G8lS318SchedulerWriterAuthorityAuditOutcome::AwaitingWriterAuthority {
            guarded_sites,
            writer_sites: _,
            ..
        } => Err(
            G8lS319SchedulerWriterAuthorityAuditError::PriorCoverageDrift {
                guarded_sites,
                unrouted_sites: S319_DIRECT_SCHEDULER_ACCESS_SITES - guarded_sites,
            },
        ),
    }
}

#[test]
fn s319_continuation_precedes_broker_ack_session_close_and_endpoint_handoff() {
    let scheduler = include_str!("../../kernel/src/task/scheduler.rs");
    let helper = kernel_call_and_wait_boundary(scheduler);
    for required in [
        "drop(blocked)",
        "drop(endpoints)",
        "drop(deadlines)",
        "drop(transaction)",
        "self.switch_after_ipc_park(caller_context)",
        ".filter(|task| task.id == caller_task && !task.is_user)",
        "caller.saved_user_gprs[0] != crate::ipc::IpcError::Ok.as_u64()",
        "caller.saved_user_gprs[7] != 0",
        "label: caller.saved_user_gprs[1]",
        "badge: caller.saved_user_gprs[2]",
        "caller.saved_user_gprs[3]",
        "caller.saved_user_gprs[6]",
    ] {
        assert!(
            helper.contains(required),
            "missing S319 continuation token: {required}"
        );
    }
    let drop_transaction = helper.find("drop(transaction)").unwrap();
    let switch = helper.find("self.switch_after_ipc_park").unwrap();
    let resumed = helper.find("let caller = self").unwrap();
    let reply = helper.find("Ok(crate::ui::capability::IpcMessage").unwrap();
    assert!(drop_transaction < switch && switch < resumed && resumed < reply);

    let main = include_str!("../../kernel/src/main.rs");
    let s141 = s141_automatic_recovery_boundary(main);
    let writer = s141.rfind(".ipc_kernel_call_and_wait(").unwrap();
    let ack = s141
        .find("assert_eq!(exact_ack.data, retry_message.data)")
        .unwrap();
    let broker_ack = s141[writer..]
        .find("broker.acknowledge_exact(")
        .map(|position| writer + position)
        .unwrap();
    let session_close = s141[writer..]
        .find("close_supervisor_session(replacement_session)")
        .map(|position| writer + position)
        .unwrap();
    let cleanup = s141
        .find("teardown_task_ipc_lifecycle(controller_task)")
        .unwrap();
    let reclaim = s141.find("let mut replacement_reclaimed").unwrap();
    let final_snapshot = s141.find("let final_snapshot").unwrap();
    assert!(
        writer < ack
            && ack < broker_ack
            && broker_ack < session_close
            && session_close < cleanup
            && cleanup < reclaim
            && reclaim < final_snapshot
    );
    for required in [
        "Ok(event)",
        "assert_eq!(endpoint_cleanup.owned_endpoints, 1)",
        "assert_eq!(endpoint_cleanup.drained_calls, 0)",
        "assert_eq!(endpoint_cleanup.cancelled_responder_calls, 0)",
        "assert_eq!(final_snapshot.pmm.free_frames, baseline_free_frames)",
        "assert_eq!(final_broker.queued, 0)",
        "assert_eq!(final_broker.pending, 0)",
        "assert_eq!(final_broker.in_flight, 0)",
        "assert_eq!(final_broker.acknowledged, 1)",
        "assert_eq!(final_broker.supervisor_sessions_started, 2)",
        "assert_eq!(final_broker.supervisor_crashes, 1)",
        "assert_eq!(final_broker.recovered_inflight, 1)",
        "endpoint.id == exact_reply.id",
        "endpoint.id == cancelled_reply.id",
    ] {
        assert!(
            s141.contains(required),
            "missing S319 post-ACK token: {required}"
        );
    }
    let after_writer = &s141[writer..];
    assert_eq!(after_writer.matches("acknowledge_exact(").count(), 1);
    assert_eq!(after_writer.matches("close_supervisor_session(").count(), 1);
}

  {
    id: "g8l-s319-qemu-s141-replacement-exact-ack-writer-authority-audit-partial",
    date: "2026-08-27",
    sequence: 319,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: QEMU S141 replacement exact-ACK writer-authority audit",
    summary:
      "S319 focused 15/15 PASS ile main.rs kaynak sırasındaki bir sonraki explicit mutable scheduler sınırını doğrular: run_qemu_s141_automatic_lifecycle_recovery içindeki iki ipc_kernel_call_and_wait writer'ından daha sonraki replacement-supervisor exact-ACK çağrısı. İlk crashed-supervisor CALL'i ordinary task-exit lifecycle sonrasında InvalidCapability döner, cancelled reply retired olur, broker lease otomatik requeue edilir, old lease StaleLease olur ve crashed supervisor writer'dan önce reclaim edilir. Nonzero controller, controller-owned normal Endpoint SEND authority, fresh strict EL0 replacement RECV grant, newer task-bound session/retry lease, immutable retry message ve linked one-shot reply writer'dan önce doğrulanır. Helper aynı IRQ/IPC transaction altında non-user caller SEND authority'sini, normal endpoint'i, linked reply'ı, optional receiver authority/deadline'ını ve park kapasitesini yeniden doğrular; CALL publication/park ve optional delivery tek transaction içindedir. Continuation aynı caller'ı resume eder ve exact replacement ACK'i yeniden kurar; broker exact acknowledge/session close, endpoint-close handoff ve replacement normal exit bundan sonra gelir. Writer authority yalnız model gate'inin exclusive lease'iyle mümkündür; reader lease'i writer'ı açmaz. main.rs 17 explicit writer / 9 previously audited / 7 remaining unaudited; S141 işlevi 2 / 1; production inventory 113 direct / 44 immutable guarded / 69 open writer olarak değişmez ve production exclusive wrapper, provider authority, whole-scheduler exclusion veya scheduler mutation üretilmez.",
    evidence: [
      "S319 focused kaynak/model kapısı iki bağımsız koşuda 15/15 PASS verdi: 130 B / SHA-256 0447f2fe9dc6fdf30815a6962cf23d978425e51bef2acde1efb27e5da13a78b3.",
      "main.rs içindeki 17 explicit addr_of_mut!(crate::task::scheduler::SCHEDULER) sitesinin positions[7], kaynakta alttan onuncu sınırı audit edilir. run_qemu_s141_automatic_lifecycle_recovery içindeki daha sonraki replacement exact-ACK CALL kapanır; S141 işlevinde 1, main.rs genelinde 7 unaudited alias kalır.",
      "İlk crashed-supervisor CALL'i InvalidCapability verir; production task-exit teardown cancelled reply'ı retire eder, broker lease'i pending kuyruğuna otomatik requeue eder, old lease StaleLease olur ve crashed supervisor exact reclaim ile RuntimePmm baseline'a döner.",
      "Nonzero controller ve controller-owned normal Endpoint ENDPOINT_SEND authority korunur; fresh strict EL0 replacement'a exact ENDPOINT_RECV grant verilir. Replacement session crashed session'dan, retry lease old lease'ten yenidir; retry event old event ile exact eşittir. Immutable retry IpcMessage ve controller-owned linked one-shot reply-cap writer'dan önce kurulur.",
      "ipc_kernel_call_and_wait exact endpoint id/generation, reply id ve immutable retry_message'i alır; yalnız exact ACK label, replacement-task badge ve retry_message.data eşleşmesi kabul edilir.",
      "Helper IrqGuard ve IPC_TRANSACTION_LOCK altında nonzero non-user caller, canlı SEND authority, normal endpoint, linked reply, optional receiver authority/deadline ve ready/blocked kapasiteyi yeniden doğrular. CALL publish/finish-park, caller BlockedOnIpc publication ve optional delivery/deadline retirement/Ready enqueue tek transaction içindedir.",
      "Transaction bırakıldıktan sonra aynı kernel caller resume edilir ve saved GPR'lerden exact reply yeniden kurulur. Broker acknowledge_exact ve replacement session close birer kez, ardından controller endpoint-close handoff ve replacement normal exit/reclaim çalışır; ikinci recovery üretilmez.",
      "Final RuntimePmm baseline korunur; broker queued=0, pending=0, in_flight=0, acknowledged=1, supervisor_sessions_started=2, supervisor_crashes=1 ve recovered_inflight=1 olur. Exact ve cancelled reply endpoint absence'ı korunur.",
      "Model gate reader membership exclusive writer authority'yi ExclusiveBusy ile bloklar; reader bırakıldıktan sonra non-zero token'lı exclusive lease alınır. Wrong CPU InvalidCpu ile fail-closed kalır. Bu host/model evidence'tır.",
      "S318 authority preflight yeniden doğrulanır; pending S245 request korunur ve sonuç AwaitingWriterAuthority { guarded_sites: 44, writer_sites: 69 } olarak döner.",
      "Dört AArch64 profil derlemesi iki koşuda byte-equal exit 0 verdi: QEMU 110646 B / fada356a, RPi4 149371 B / b9fd6b52, RPi5 468517 B / 15c67c01 ve RPi5+SMP 468459 B / 3ca3eeae. Warning header'ları sırasıyla 291, 389, 1005 ve 1005'tir; zero-warning iddiası değildir.",
      "Birleşik board-rpi5,board-qemu özellikleri iki koşuda beklenen exit 101, 18590 B / 9e367ea9, 17 error ve 22 warning header ile fail-closed kaldı.",
      "S238–S319 dependency matrisi iki koşuda 83 grup / 1169/1169 PASS; ham loglar 10712 B / d32f5384 ve ff62284f, süre-normalize özetler byte-equal 10878 B / 8eaf367bc3c45408f567bb13912316354ee8dd0db2fb6d06e4452ef009cdd88e. Bu production writer-authority invocation kanıtı değildir.",
      "Ortak make verify-qemu iki koşuda PASS verdi: 116139 B / f1aa4804 ve 116139 B / a1fbe983; guest logları 2180970 B / 34ef7a62 ve 2145881 B / 8c2447e8. W^X 31/31, S271 GRAPH_ABSENT=YES, RuntimePmm baseline, EL0 x4096, IPC 20/20, koşu başına tek FATAL_TASK_EXIT, SEC5 ve 13 KERNEL_FAULTS=0 marker'ı korunur. Bu ortak smoke S319 production writer-authority invocation kanıtı değildir.",
      "Exact yedi tarihsel G8h assertion adıyla dışlandığında workspace iki koşuda 281 sonuç grubu / 2978 PASS / 7 filtered verdi: ham loglar 64031 B / 222954f2 ve 4b9ba69e, sonuç özetleri 26578 B / 5312b651 ve 705c6357, süre-normalize 27138 B özet byte-equal / SHA-256 6e7b05095b9b2238ea25089c07a38130795d0f42d7f88d83a351d43410d1c3eb. Filtresiz koşu exit 101, 59253 B / 253f164d ile frozen S96 exceptions.S identity kapısında RED kaldı; full-workspace GREEN iddia edilmez.",
      "S319 production exclusive wrapper, provider authority, whole-scheduler exclusion, QEMU fixture mutation veya scheduler mutation iddiası eklemez; physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S319=NO.",
    ],
    commands: [
      "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s319_qemu_s141_replacement_exact_ack_writer_authority_audit -- --test-threads=1",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-qemu",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi4",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,board-qemu",
      "make verify-qemu",
    ],
    terminalSessions: [
      {
        id: "g8l-s319-qemu-s141-replacement-exact-ack-writer-authority-audit",
        title:
          "G8l S319 QEMU S141 replacement exact-ACK writer-authority audit",
        commandLines: [
          "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s319_qemu_s141_replacement_exact_ack_writer_authority_audit -- --test-threads=1",
        ],
        outputLines: [
          "test result: ok; S319 focused 1 group / 15 passed; 0 failed",
          "repeat-stable quiet output: 130 B / 0447f2fe9dc6fdf30815a6962cf23d978425e51bef2acde1efb27e5da13a78b3",
          "QEMU S141 replacement exact-ACK writer authority remains model-only: crashed CALL retirement/requeue/reclaim and fresh replacement session/lease precede exact retry forwarding; S141 retains 1 unaudited alias, main.rs retains 7 unaudited aliases and all 69 production writer sites remain open",
          "dependency: S238–S319 · 83 groups · 1169/1169 PASS; workspace: 281 groups · 2978 PASS · 7 historical filtered",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S319 kaynak/model fail-closed authority boundary'sidir; production writer guard/migration, QEMU fixture mutation ve fiziksel/device execution claim edilmez.",
    limitations: [
      "S319 run_qemu_s141_automatic_lifecycle_recovery içindeki daha sonraki replacement exact-ACK ipc_kernel_call_and_wait mutable scheduler aliasını audit eder; S141 işlevindeki önceki cancelled CALL, main.rs genelinde 7 ve toplam 69 production writer site authority wrapper dışında açık kalır.",
      "Exclusive lease yalnız host/model gate'inde test edilir; production exclusive wrapper, provider authority ve whole-scheduler exclusion açık kalır.",
      "S238–S319 dependency matrisi exact 83 grup / 1169/1169 PASS'tir; bu production writer authority invocation kanıtı değildir.",
      "Filtresiz workspace frozen S96 identity kapısında RED'dir; workspace umbrella GREEN iddia edilmez.",
      "Supported-profile writer-authority runtime invocation, Generic SMP ve fiziksel RPi kabulü açık kalır; S319 physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S319=NO.",
    ],
  },