# K1081–K1099 scheduler policy preparation

The policy exclusively retains nonclone backend membership subscriptions and consumes independent nonclone timer deliveries at a masked, owning-CPU task safe point. The unsafe backend must bind observations to the actual retained Table/Context/Queue membership and stack owner; a caller supplied CPU, counter, class or owner label is not authority. No mutable policy, queue or context loan may span assembly or an unmasked IRQ. Failures return the actual delivery or membership. Constructor refusal returns the actual exclusive backend.

The fairness window uses actual completed Queue selection epochs and member selection epochs, counting eligible Ready/Running members. Sleeping members do not accrue an eligibility debt; re-entry starts a new bounded window. A Normal waiter records every live Low owner in its checked, bounded ownership chain. A running waiter whose Low owner is Sleeping is rejected as a busy loop. Dead, foreign, cyclic and stale owner chains cannot be accepted.

Each successful delivery increments exactly one CPU Running/Idle ledger and one state ledger per retained member. Every member's Running + Sleeping + Ready + Dead sum equals deliveries since registration. All arithmetic and all member checks finish before consuming a delivery or publishing any ledger.

A long-run receipt binds a checked episode, policy identity, complete policy Handle and ThreadId generations, exact page inventory/fingerprints and fresh per-task progress baselines. Begin and finish admit only live Ready/Running/Sleeping members. Every charged observation additionally updates a bounded private workload monitor for the exact baseline cohort. Each member must show at least sixty distinct charged useful-progress advances and never go longer than frequency × 60 counter units without observed useful work, including while Sleeping. The old deadline is checked before a new progress update, and any Dead member, changed cohort or missed deadline latches failure for that episode while ordinary time accounting continues. A newer episode invalidates the old receipt. Finish also checks the true current backend counter against the last observed progress deadline, so unsampled late progress cannot forgive stopped work. This is deliberately a controlled three-task workload contract; a long-term sleeping job cannot count as continued workload. Finish requires at least frequency × 3600 elapsed counter units, at least sixty new charged observations, fresh progress and running time for every member, and no whole-history sample gap greater than frequency × 60. The maximum gap deliberately includes all earlier policy observations. A guest must start a new controlled policy episode before its measured hour; an earlier large gap cannot be reset by begin_long_run.

The host fixture executes frozen Table, AsyncBank and AsyncQueue implementations on three separately owned host stack byte vectors. An appended immutable Queue observer checks actual CPU/I1/nonIRQ before observing its private membership. Four explicitly bound changes to the frozen context fixture add a std Vec import and retain real nonclone Table Waits in four independent slots. The frozen Queue fixture prefix is unchanged except removal of its last separator blank line for the standalone rustfmt gate. Policy subscriptions grant read permission to these retained memberships and do not invent another backing-page acquisition. CPU, DAIF, registers, task bodies, source epochs, timer counters and resource observer faults are MODELED_ONLY. Mathematical one-hour counter progression is a contract test, not elapsed guest time or acceleration evidence.

K1085/K1090/K1095/K1100 remain pending actual source/ELF/raw CPU/QMP evidence on canonical K1080. No scheduler policy guest or actual one-hour stability acceptance is claimed.