G8l: QEMU parked-IPC observation read-access guard genişletmesi

pub fn preflight_s267_whole_scheduler_read_coverage(
    caller_cpu: usize,
    request: Option<G8lS245WholeSchedulerExclusionAdmissionRequestView>,
) -> Result<
    G8lS267WholeSchedulerReadCoveragePreflightOutcome,
    G8lS267WholeSchedulerReadCoveragePreflightError,
> {
    match preflight_s266_whole_scheduler_read_coverage(caller_cpu, request)
        .map_err(G8lS267WholeSchedulerReadCoveragePreflightError::S266)?
    {
        G8lS266WholeSchedulerReadCoveragePreflightOutcome::Idle => {
            return Ok(G8lS267WholeSchedulerReadCoveragePreflightOutcome::Idle);
        }
        G8lS266WholeSchedulerReadCoveragePreflightOutcome::AwaitingCoverage {
            guarded_sites,
            unrouted_sites,
            ..
        } if guarded_sites == S266_WHOLE_SCHEDULER_GUARDED_SITES
            && unrouted_sites
                == S246_DIRECT_SCHEDULER_ACCESS_SITES - S266_WHOLE_SCHEDULER_GUARDED_SITES => {}
        G8lS266WholeSchedulerReadCoveragePreflightOutcome::AwaitingCoverage {
            guarded_sites,
            unrouted_sites,
            ..
        } => {
            return Err(
                G8lS267WholeSchedulerReadCoveragePreflightError::PriorCoverageDrift {
                    guarded_sites,
                    unrouted_sites,
                },
            );
        }
    }

    let outcome = preflight_s246_whole_scheduler_exclusion_provider(
        caller_cpu,
        request,
        G8lS246WholeSchedulerCoverageAudit::new(
            S246_SOURCE_AUDIT_UNITS,
            S246_DIRECT_SCHEDULER_ACCESS_SITES,
            S267_WHOLE_SCHEDULER_GUARDED_SITES,
        ),
    )
    .map_err(G8lS267WholeSchedulerReadCoveragePreflightError::S246)?;
    match outcome {
        G8lS246WholeSchedulerProviderPreflightOutcome::Idle => {
            Ok(G8lS267WholeSchedulerReadCoveragePreflightOutcome::Idle)
        }
        G8lS246WholeSchedulerProviderPreflightOutcome::AwaitingCoverage {
            request_id,
            guarded_sites,
            unrouted_sites,
        } => Ok(
            G8lS267WholeSchedulerReadCoveragePreflightOutcome::AwaitingCoverage {
                request_id,
                guarded_sites,
                unrouted_sites,
            },
        ),
        G8lS246WholeSchedulerProviderPreflightOutcome::CoverageCompleteAwaitingProvider {
            ..
        } => Err(G8lS267WholeSchedulerReadCoveragePreflightError::UnexpectedCoverageComplete),
    }
}

#[test]
fn s267_coverage_guards_one_existing_read_and_keeps_72_open() {
    assert_eq!(S267_ADDITIONAL_WHOLE_SCHEDULER_READ_SITES, 1);
    assert_eq!(S267_WHOLE_SCHEDULER_GUARDED_SITES, 39);
    assert_eq!(S267_WHOLE_SCHEDULER_UNROUTED_SITES, 72);
}

  {
    id: "g8l-s267-qemu-parked-ipc-observation-read-access-guard-expansion-partial",
    date: "2026-08-26",
    sequence: 267,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: QEMU parked-IPC observation read-access guard genişletmesi",
    summary:
      "S267 12/12 PASS ile qemu_observe_parked_ipc_syscall içindeki immutable scheduler blocked-set ve CNode gözlemini mevcut production reader gate zincirine aldı. Reply CapId ile target/reply capability canlılık sonuçları reader canlıyken owned tuple'a kopyalanıyor; reader ENDPOINT_REGISTRY lock'undan önce explicit düşüyor ve scheduler/CNode referansı kaçmıyor. Coverage 38/111'den 39/111'e çıktı, 72 site unrouted kaldı. Writer'lar, exclusive wrapper ve whole-scheduler exclusion açık olduğundan umbrella PARTIAL kalır.",
    evidence: [
      "S267 focused kaynak kapısı iki byte-equal koşuda 12/12 PASS verdi: 127 B / SHA-256 7c5c027e04834587141f9fff89aea670906490a9f834012d2adbd7279dba720b.",
      "Exact source coverage: 7 audit unit / 111 direct SCHEDULER site; previous=38, additional=1, guarded=39, unrouted=72. Routed read yalnız qemu_observe_parked_ipc_syscall içindeki immutable blocked-set/CNode snapshot'ıdır.",
      "Reply CapId, target grant canlılığı ve reply capability canlılığı reader membership canlıyken owned tuple'a çevrilir. Reader ENDPOINT_REGISTRY lock'undan önce explicit düşer; scheduler, blocked-set veya CNode referansı lease dışına çıkmaz.",
      "S238–S267 exact dependency matrisi iki bağımsız koşuda 31 grup / 411/411 PASS verdi: raw 2944 B / SHA-256 cdd4d98e655d941774d709e84734dfe17d2e739257436f3ef664409e3147df82; süre-normalize 3006 B / SHA-256 32950eab0d762be6c61ae27e3791bfa09ed5b4de55f0dada13a5cf1794eadcec.",
      "Default/QEMU AArch64 check PASS: 110646 B / 291 warning başlığı / SHA-256 43a8eb2b626c1b79c7680c2979cba069dfc6a68b2cc68eacfeb1d0e7bd0623e8. Zero-warning iddiası yoktur.",
      "RPi5 normal/SMP AArch64 check PASS: normal 361869 B / 705 warning / SHA-256 e352d72684820ffac843b96b68dcb53d36076bbe7fef7669c59cbcbf0a13a6d5; SMP 361811 B / 705 warning / SHA-256 9ee5d8b6a5c0204d7c4f0db9d09d23fea9c7888f15719803ee0ab4df0f673ba9.",
      "make verify-qemu iki bağımsız PASS verdi: ilk 116084 B / SHA-256 547e6c6cc1fe0febffb15b266b3b6afe368911702fd975bab89f5229528fc94d, ikinci 116084 B / SHA-256 723f9f80ac09f584ab52f9fee893031c52f13ece1fbf6445ca83b9629ae106dc. W^X 31/31, S130–S154, S154 1024 retirement, IPC 20/20, SEC5 ve kernel faults=0 korunur. Ortak QEMU regresyonu board-rpi5-only S267 reader guard'ını çalıştırmaz.",
      "Supported-profile cfg sınırı açıkça ölçüldü: board-qemu qemu_observe_parked_ipc_syscall çağrı noktasını reader guard olmadan, board-rpi5 ise reader provider'ı bu QEMU-only çağrı noktası olmadan derler. İki board feature'ını birlikte seçme negatif denemesi fail-closed exit 101 / 16 compile error verdi: 18556 B / SHA-256 bde2e59a31ab6e09a8799b7d6595c8ae85b22fc943a087e58979670db75ccfd6. Bu nedenle S267 source-routed kabulüdür; hiçbir desteklenen tek-board profilinde guarded callsite runtime/compile kanıtı yoktur.",
      "Manifest-aware workspace audit'i iki bağımsız koşuda 229 grup / 2167 PASS, 0 fail verdi; exact 7 tarihsel G8h assertion filtrelendi. Ham loglar 57231 B / SHA-256 bc348e75699eeb0a90af5b52ed13316204d9c9dc208e7d652ee486ca4e3c4ea0 ve 57231 B / SHA-256 6657bb29c336ad7fe12a1bcabcf3dfc0fec29c486723f14185ea02f12d7fe7d8; süre-normalize özet 22094 B / SHA-256 513e529cc21a5b1056901af3ae4224b7271ef2ed7e19bbe247406e9858320159'dur. Filtresiz koşu 52578 B / SHA-256 af0c2e454e227b3d6a6a76964176e0b61582bd3e30eca4e330dad65a510e34ff ile frozen S96 exceptions.S identity mismatch'te exit 101 kaldı; beklentiler gevşetilmedi ve full-workspace GREEN iddia edilmez.",
      "S267 physical/device operations=0; RUNBOOK_EXECUTED_IN_S267=NO. Tarihsel S124 physical BOOT8H PASS ve tam operatör sırası görünür biçimde korunur.",
      "Canlı marker: S267_12_OF_12_QEMU_PARKED_IPC_OBSERVATION_READ_ACCESS_GUARD_ONE_ADDITIONAL_IMMUTABLE_SCHEDULER_BLOCKED_SET_AND_CNODE_SNAPSHOT_OWNED_REPLY_CAP_ID_AND_CAPABILITY_LIVENESS_TUPLE_READER_DROPPED_BEFORE_ENDPOINT_REGISTRY_LOCK_NO_REFERENCE_ESCAPE_PREVIOUS_38_OF_111_TOTAL_39_OF_111_GUARDED_72_UNROUTED_QEMU_COMMON_REGRESSION_DOES_NOT_EXERCISE_BOARD_RPI5_ONLY_GUARD_WORKSPACE_2167_PASS_7_HISTORICAL_G8H_ASSERTIONS_RED_NO_WRITER_COVERAGE_NO_PRODUCTION_EXCLUSIVE_WRAPPER_NO_WHOLE_SCHEDULER_EXCLUSION_PHYSICAL_CPU2_CPU3_HOTPLUG_SOAK_GENERIC_SMP_OPEN_FULL_PHYSICAL_RUNBOOK_VISIBLE_S427_TO_S477_S452_NO_RUNBOOK_EXECUTED_IN_S267_VERIFIED.",
    ],
    commands: [
      "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s266_qemu_parked_ipc_observation_read_access_guard_expansion -- --test-threads=1",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
      "make verify-qemu",
    ],
    terminalSessions: [
      {
        id: "s267-g8l-qemu-parked-ipc-observation-read-access-guard-expansion",
        title:
          "G8l S267 QEMU parked-IPC observation read-access guard genişletmesi",
        commandLines: [
          "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s266_qemu_parked_ipc_observation_read_access_guard_expansion -- --test-threads=1",
          "make verify-qemu",
        ],
        outputLines: [
          "test result: ok; S267 focused 1 group / 12 passed; 0 failed",
          "coverage: previous 38 + additional 1 = 39/111 guarded; 72 unrouted",
          "blocked-set/CNode values copied into an owned tuple; reader dropped before ENDPOINT_REGISTRY lock",
          "QEMU common regression PASS: W^X 31/31 · S130–S154 · S154 retired 1024 · IPC 20/20 · SEC5 · kernel faults 0",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S267 yalnız bir immutable QEMU parked-IPC observation snapshot route'unu guard'lar; ortak QEMU regresyonu board-rpi5-only reader route'unun runtime invocation kanıtı değildir.",
    limitations: [
      "Toplam 39/111 scheduler erişimi guarded, 72 erişim unrouted kalır.",
      "Bütün scheduler writer yolları, production exclusive wrapper, provider authority ve whole-scheduler exclusion proof yoktur.",
      "QEMU ortak runtime regresyonudur; board-rpi5-only S267 reader route'unu çalıştırmaz.",
      "board-qemu çağrı noktasını guardsız, board-rpi5 guard provider'ını QEMU çağrı noktası olmadan derler; birlikte board seçimi desteklenmez. Guarded callsite hiçbir desteklenen profilde compile/runtime kanıtı değildir.",
      "Exact yedi tarihsel G8h assertion filtresiz workspace'i kırmızı tutar; full-workspace GREEN iddia edilmez.",
      "Fiziksel RPi, CPU2/CPU3, hotplug, soak ve Generic SMP açık kalır.",
      "S267 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S267=NO.",
    ],
  },