G8l: QEMU EL0 IPC cancellation-absence read-access guard genişletmesi

pub fn preflight_s270_whole_scheduler_read_coverage(
    caller_cpu: usize,
    request: Option<G8lS245WholeSchedulerExclusionAdmissionRequestView>,
) -> Result<
    G8lS270WholeSchedulerReadCoveragePreflightOutcome,
    G8lS270WholeSchedulerReadCoveragePreflightError,
> {
    match preflight_s269_whole_scheduler_read_coverage(caller_cpu, request)
        .map_err(G8lS270WholeSchedulerReadCoveragePreflightError::S269)?
    {
        G8lS269WholeSchedulerReadCoveragePreflightOutcome::Idle => {
            return Ok(G8lS270WholeSchedulerReadCoveragePreflightOutcome::Idle);
        }
        G8lS269WholeSchedulerReadCoveragePreflightOutcome::AwaitingCoverage {
            guarded_sites,
            unrouted_sites,
            ..
        } if guarded_sites == S269_WHOLE_SCHEDULER_GUARDED_SITES
            && unrouted_sites
                == S246_DIRECT_SCHEDULER_ACCESS_SITES - S269_WHOLE_SCHEDULER_GUARDED_SITES => {}
        G8lS269WholeSchedulerReadCoveragePreflightOutcome::AwaitingCoverage {
            guarded_sites,
            unrouted_sites,
            ..
        } => {
            return Err(
                G8lS270WholeSchedulerReadCoveragePreflightError::PriorCoverageDrift {
                    guarded_sites,
                    unrouted_sites,
                },
            );
        }
    }

    let outcome = preflight_s246_whole_scheduler_exclusion_provider(
        caller_cpu,
        request,
        G8lS246WholeSchedulerCoverageAudit::new(
            S246_SOURCE_AUDIT_UNITS,
            S246_DIRECT_SCHEDULER_ACCESS_SITES,
            S270_WHOLE_SCHEDULER_GUARDED_SITES,
        ),
    )
    .map_err(G8lS270WholeSchedulerReadCoveragePreflightError::S246)?;
    match outcome {
        G8lS246WholeSchedulerProviderPreflightOutcome::Idle => {
            Ok(G8lS270WholeSchedulerReadCoveragePreflightOutcome::Idle)
        }
        G8lS246WholeSchedulerProviderPreflightOutcome::AwaitingCoverage {
            request_id,
            guarded_sites,
            unrouted_sites,
        } => Ok(
            G8lS270WholeSchedulerReadCoveragePreflightOutcome::AwaitingCoverage {
                request_id,
                guarded_sites,
                unrouted_sites,
            },
        ),
        G8lS246WholeSchedulerProviderPreflightOutcome::CoverageCompleteAwaitingProvider {
            ..
        } => Err(G8lS270WholeSchedulerReadCoveragePreflightError::UnexpectedCoverageComplete),
    }
}

#[test]
fn s270_coverage_guards_one_existing_read_and_keeps_69_open() {
    assert_eq!(S270_ADDITIONAL_WHOLE_SCHEDULER_READ_SITES, 1);
    assert_eq!(S270_WHOLE_SCHEDULER_GUARDED_SITES, 42);
    assert_eq!(S270_WHOLE_SCHEDULER_UNROUTED_SITES, 69);
}

  {
    id: "g8l-s270-qemu-el0-ipc-cancellation-absence-read-access-guard-expansion-partial",
    date: "2026-08-26",
    sequence: 270,
    status: "passed",
    umbrella_status: "partial",
    title:
      "G8l: QEMU EL0 IPC cancellation-absence read-access guard genişletmesi",
    summary:
      "S270 12/12 PASS ile qemu_el0_ipc_cancellation_absence içindeki caller/target task presence okumalarını mevcut S269 production reader gate zincirine aldı. Scheduler-derived sonuçlar reader canlıyken owned tuple'a kopyalanıyor; reader ENDPOINT_REGISTRY ve capability-provenance lock'larından önce explicit düşüyor ve scheduler/task/CNode referansı kaçmıyor. Coverage 41/111'den 42/111'e çıktı, 69 site unrouted kaldı. Writer'lar, exclusive wrapper ve whole-scheduler exclusion açık olduğundan umbrella PARTIAL kalır.",
    evidence: [
      "S270 focused kaynak kapısı iki byte-equal koşuda 12/12 PASS verdi: 127 B / SHA-256 7c5c027e04834587141f9fff89aea670906490a9f834012d2adbd7279dba720b.",
      "Exact source coverage: 7 audit unit / 111 direct SCHEDULER site; previous=41, additional=1, guarded=42, unrouted=69. Routed read qemu_el0_ipc_cancellation_absence içindeki immutable caller/target presence snapshot'ıdır.",
      "Caller/target task presence reader membership canlıyken owned tuple'a çevrilir. Reader ENDPOINT_REGISTRY ve capability-provenance lock'larından önce explicit düşer; scheduler/task/CNode referansı lease dışına çıkmaz.",
      "S238–S270 exact dependency matrisi S271 kronoloji denetiminde düzeltildi: doğru alt toplam iki bağımsız koşuda 34 grup / 447/447 PASS'tir; ham özet 3229 B / SHA-256 2bddf42fb99317f9e7eac3e51fb1926c42c627b7dab0de08a1217835aafa4b24, süre-normalize 3297 B / SHA-256 214a02f31445a9af8ebb6e370017f3af6d13a0f29a500df0e3c41aed8a61ea06 byte-equal oldu. Önceki 452/452 ifadesi aritmetik hataydı ve kabul kanıtı değildir.",
      "Default/QEMU, RPi5 normal ve RPi5 SMP AArch64 check'leri ikişer byte-equal PASS verdi: 291 / 711 / 711 warning başlığı; kanonik loglar 110646 B / SHA-256 2769f913263768b99411158ae46f6a13a95ffe0ad257021e2b681c15f8f5b097, 364161 B / SHA-256 1c67496bfa40c8a239d4873bc3439b0ec0c92d96258321133ae94de007c6e3e0 ve 364103 B / SHA-256 fba40391fe2f414e547dcba8e2af470b7a4bda39dcf5268a07e2b450036a1198. Zero-warning iddiası yoktur.",
      "make verify-qemu iki bağımsız PASS verdi: ilk 116222 B / SHA-256 e77aef36a1c4b63a8d50d787332742cd9527548c8385f8b0b3d3669652f2b368, ikinci 116139 B / SHA-256 b2acf04b094076b2869fac419688cb9b3c606c84c9b2048229737a4dfe4b4002. W^X 31/31, S130–S154, S154 retired 1024, IPC 20/20, SEC5 ve kernel faults=0 korunur. Ortak QEMU regresyonu board-rpi5-only S270 reader guard'ını çalıştırmaz.",
      "S270 yayını sonrasında aralıklı S133 fixture yarışı gözlendi; ilk QEMU repeat-stability iddiası geri çekildi. RED raw 32081 B / SHA-256 f55f9677381ff9f7e7ffe12ac1fdbcb7f1303584824bcbea6fda695b52520acb olarak korunur. Bu S270 reader-guard kusuru değildir ve S271 bounded exact-witness politikasıyla kapatılmıştır.",
      "Supported-profile cfg sınırı açıkça ölçüldü: board-qemu çağrı noktasını reader guard olmadan, board-rpi5 reader provider'ını QEMU-only çağrı noktası olmadan derler. İki board feature'ını birlikte seçme negatif denemesi fail-closed exit 101 / 16 compiler error verdi: 18556 B / SHA-256 9d27c37dfc9680eee2cae6bb4ada1fcda4f8bf71b6ee34c1873d62f07d2737b2.",
      "S270 physical/device operations=0; RUNBOOK_EXECUTED_IN_S270=NO. Tarihsel S124 physical BOOT8H PASS ve tam operatör sırası görünür biçimde korunur.",
      "Canlı marker: S270_12_OF_12_QEMU_EL0_IPC_CANCELLATION_ABSENCE_READ_ACCESS_GUARD_ONE_ADDITIONAL_IMMUTABLE_SCHEDULER_CALLER_TARGET_PRESENCE_SNAPSHOT_OWNED_TUPLE_READER_DROPPED_BEFORE_ENDPOINT_REGISTRY_AND_CAPABILITY_PROVENANCE_LOCKS_NO_SCHEDULER_OR_CNODE_REFERENCE_ESCAPE_PREVIOUS_41_OF_111_TOTAL_42_OF_111_GUARDED_69_UNROUTED_QEMU_COMMON_REGRESSION_DOES_NOT_EXERCISE_BOARD_RPI5_ONLY_GUARD_WORKSPACE_2217_PASS_7_HISTORICAL_G8H_ASSERTIONS_RED_NO_WRITER_COVERAGE_NO_PRODUCTION_EXCLUSIVE_WRAPPER_NO_WHOLE_SCHEDULER_EXCLUSION_PHYSICAL_CPU2_CPU3_HOTPLUG_SOAK_GENERIC_SMP_OPEN_FULL_PHYSICAL_RUNBOOK_VISIBLE_S430_TO_S480_S455_NO_RUNBOOK_EXECUTED_IN_S270_VERIFIED.",
    ],
    commands: [
      "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s269_qemu_el0_ipc_cancellation_absence_read_access_guard_expansion -- --test-threads=1",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
      "make verify-qemu",
    ],
    terminalSessions: [
      {
        id: "s270-g8l-qemu-el0-ipc-cancellation-absence-read-access-guard-expansion",
        title:
          "G8l S270 QEMU EL0 IPC cancellation-absence read-access guard genişletmesi",
        commandLines: [
          "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s269_qemu_el0_ipc_cancellation_absence_read_access_guard_expansion -- --test-threads=1",
          "make verify-qemu",
        ],
        outputLines: [
          "test result: ok; S270 focused 1 group / 12 passed; 0 failed",
          "coverage: previous 41 + additional 1 = 42/111 guarded; 69 unrouted",
          "caller/target task presence copied into an owned tuple; reader dropped before endpoint registry and capability provenance locks",
          "QEMU common regression PASS: W^X 31/31 · S130–S154 · S154 retired 1024 · IPC 20/20 · SEC5 · kernel faults 0",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S270 yalnız bir immutable QEMU EL0 IPC cancellation-absence scheduler snapshot route'unu guard'lar; ortak QEMU regresyonu board-rpi5-only reader route'unun runtime invocation kanıtı değildir.",
    limitations: [
      "Toplam 42/111 scheduler erişimi guarded, 69 erişim unrouted kalır.",
      "Bütün scheduler writer yolları, production exclusive wrapper, provider authority ve whole-scheduler exclusion proof yoktur.",
      "QEMU ortak runtime regresyonudur; board-rpi5-only S270 reader route'unu çalıştırmaz.",
      "board-qemu çağrı noktasını guardsız, board-rpi5 reader provider'ını çağrı noktası olmadan derler; guarded callsite hiçbir desteklenen profilde compile/runtime kanıtı değildir.",
      "Fiziksel RPi, CPU2/CPU3, hotplug, soak ve Generic SMP açık kalır.",
      "S270 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S270=NO.",
    ],
  },