S382 · QEMU S148 post-arbitration signal production writer guard integration

/// S148 runtime acceptance: three strict EL0 waiters publish independent
/// notification waits, then the existing global IPC transaction is forced
/// through each possible terminal winner. Signal commits Delivered, exact
/// grant revoke commits Cancelled, and the ordinary deadline service commits
/// TimedOut. Every losing operation is retried before the tasks may run and
/// must observe an already-retired waiter/deadline rather than wake twice.
/// This is a deterministic CPU0 transaction matrix; cross-CPU IPI wake and a
/// generic SMP scheduler remain explicitly outside this narrow admission.
#[cfg(feature = "board-qemu")]
unsafe fn run_qemu_s148_notification_race_arbitration(
    baseline_free_frames: u64,
    baseline_active_allocations: usize,
) {
    use crate::elf::load_and_spawn_user_elf_from_boot_runtime_with_arg;
    use crate::elf_plan::{AddressRange, ElfLoadPolicy};
    use crate::ipc::IpcDeadlineCancellation;
    use crate::ipc_notification::{NotificationSignalOutcome, NotificationWaiter};
    use crate::ui::capability::{CapabilityRights, NotificationAuthorityError};
    use crate::userspace_binaries::NOTIFICATION_RACE_WAITER_BINARY;

    let controller_task = crate::task::current_task_id().expect("S148 controller task");
    let before_deadlines = crate::ipc::ipc_call_deadline_snapshot();
    assert_eq!(before_deadlines.active, 0);

    let signal_domain = crate::mm::with_boot_runtime_memory(|memory| {
        memory.register_domain(QEMU_NOTIFICATION_SIGNAL_RACE_RUNTIME_DOMAIN_ID)
    })
    .expect("S148 signal-winner RuntimeMemory authority")
    .expect("S148 signal-winner domain registration");
    let revoke_domain = crate::mm::with_boot_runtime_memory(|memory| {
        memory.register_domain(QEMU_NOTIFICATION_REVOKE_RACE_RUNTIME_DOMAIN_ID)
    })
    .expect("S148 revoke-winner RuntimeMemory authority")
    .expect("S148 revoke-winner domain registration");
    let timeout_domain = crate::mm::with_boot_runtime_memory(|memory| {
        memory.register_domain(QEMU_NOTIFICATION_TIMEOUT_RACE_RUNTIME_DOMAIN_ID)
    })
    .expect("S148 timeout-winner RuntimeMemory authority")
    .expect("S148 timeout-winner domain registration");

    let signal_notification = crate::ui::capability::mint_notification(controller_task)
        .expect("S148 signal-winner notification root");
    let revoke_notification = crate::ui::capability::mint_notification(controller_task)
        .expect("S148 revoke-winner notification root");
    let timeout_notification = crate::ui::capability::mint_notification(controller_task)
        .expect("S148 timeout-winner notification root");
    let no_forbidden_ranges: [AddressRange; 0] = [];

    // Keep timer delivery disabled until all three CNodes and address spaces
    // exist. Once released, each strict task executes the real v1.3 WAIT SVC.
    let spawn_guard = crate::arch::aarch64::IrqGuard::new();
    let signal_waiter = load_and_spawn_user_elf_from_boot_runtime_with_arg(
        "notification-race-signal-strict-el0-waiter-elf",
        NOTIFICATION_RACE_WAITER_BINARY,
        ElfLoadPolicy::new(
            AddressRange::new(0x0431_0000, 0x0432_0000),
            &no_forbidden_ranges,
            16,
        ),
        0x80d0_0000,
        4,
        0,
        8,
        signal_domain,
        signal_notification.id,
    )
    .expect("S148 strict signal-winner waiter spawn");
    let signal_grant = crate::ui::capability::grant_task_notification_to_task(
        signal_notification,
        controller_task,
        signal_waiter.task_id,
        CapabilityRights::NOTIFICATION_WAIT,
    )
    .expect("S148 exact signal-winner WAIT grant");

    let revoke_waiter = load_and_spawn_user_elf_from_boot_runtime_with_arg(
        "notification-race-revoke-strict-el0-waiter-elf",
        NOTIFICATION_RACE_WAITER_BINARY,
        ElfLoadPolicy::new(
            AddressRange::new(0x0431_0000, 0x0432_0000),
            &no_forbidden_ranges,
            16,
        ),
        0x80d1_0000,
        4,
        0,
        8,
        revoke_domain,
        revoke_notification.id,
    )
    .expect("S148 strict revoke-winner waiter spawn");
    let revoke_grant = crate::ui::capability::grant_task_notification_to_task(
        revoke_notification,
        controller_task,
        revoke_waiter.task_id,
        CapabilityRights::NOTIFICATION_WAIT,
    )
    .expect("S148 exact revoke-winner WAIT grant");

    let timeout_waiter = load_and_spawn_user_elf_from_boot_runtime_with_arg(
        "notification-race-timeout-strict-el0-waiter-elf",
        NOTIFICATION_RACE_WAITER_BINARY,
        ElfLoadPolicy::new(
            AddressRange::new(0x0431_0000, 0x0432_0000),
            &no_forbidden_ranges,
            16,
        ),
        0x80d2_0000,
        4,
        0,
        8,
        timeout_domain,
        timeout_notification.id,
    )
    .expect("S148 strict timeout-winner waiter spawn");
    let timeout_grant = crate::ui::capability::grant_task_notification_to_task(
        timeout_notification,
        controller_task,
        timeout_waiter.task_id,
        CapabilityRights::NOTIFICATION_WAIT,
    )
    .expect("S148 exact timeout-winner WAIT grant");
    let spawned = crate::mm::with_boot_runtime_memory(|memory| memory.audited_snapshot())
        .expect("S148 spawned RuntimeMemory authority")
        .expect("S148 spawned RuntimeMemory audit");
    assert_eq!(spawned.pmm.free_frames, baseline_free_frames - 15);
    assert_eq!(spawned.active_allocations, baseline_active_allocations + 15);
    drop(spawn_guard);

    kprintln!(
        "[K2-S148] signal waiter strict spawn PASS id={} pages={} domain={} notification={} INITIAL_X0=YES W^X=YES",
        signal_waiter.task_id,
        signal_waiter.page_count,
        signal_domain.id(),
        signal_notification.id,
    );
    kprintln!(
        "[K2-S148] revoke waiter strict spawn PASS id={} pages={} domain={} notification={} INITIAL_X0=YES W^X=YES",
        revoke_waiter.task_id,
        revoke_waiter.page_count,
        revoke_domain.id(),
        revoke_notification.id,
    );
    kprintln!(
        "[K2-S148] timeout waiter strict spawn PASS id={} pages={} domain={} notification={} INITIAL_X0=YES W^X=YES",
        timeout_waiter.task_id,
        timeout_waiter.page_count,
        timeout_domain.id(),
        timeout_notification.id,
    );

    let mut all_parked = false;
    for _ in 0..4096 {
        let deadline = crate::ipc::ipc_call_deadline_snapshot();
        let registry = crate::ui::capability::NOTIFICATION_REGISTRY.lock();
        let signal_matches = registry
            .iter()
            .find(|object| object.id() == signal_notification.id)
            .and_then(|object| object.waiter_snapshot())
            == Some(
                NotificationWaiter::try_new(signal_waiter.task_id, signal_grant.generation, 0x3)
                    .expect("S148 exact signal waiter identity"),
            );
        let revoke_matches = registry
            .iter()
            .find(|object| object.id() == revoke_notification.id)
            .and_then(|object| object.waiter_snapshot())
            == Some(
                NotificationWaiter::try_new(revoke_waiter.task_id, revoke_grant.generation, 0x3)
                    .expect("S148 exact revoke waiter identity"),
            );
        let timeout_matches = registry
            .iter()
            .find(|object| object.id() == timeout_notification.id)
            .and_then(|object| object.waiter_snapshot())
            == Some(
                NotificationWaiter::try_new(timeout_waiter.task_id, timeout_grant.generation, 0x3)
                    .expect("S148 exact timeout waiter identity"),
            );
        drop(registry);
        let blocked_counts = {
            #[cfg(feature = "board-rpi5")]
            let s261_scheduler_read_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s260_qemu_acceptance_poll_read_access_guard_expansion::acquire_s261_production_scheduler_read_access()
                .unwrap_or_else(|error| panic!("S261 S148 three-waiter poll scheduler read guard failed closed: {:?}", error));
            let scheduler = &*core::ptr::addr_of!(crate::task::scheduler::SCHEDULER);
            let blocked_counts = [
                scheduler.notification_blocked_task_count_on(
                    signal_waiter.task_id,
                    signal_notification.id,
                ),
                scheduler.notification_blocked_task_count_on(
                    revoke_waiter.task_id,
                    revoke_notification.id,
                ),
                scheduler.notification_blocked_task_count_on(
                    timeout_waiter.task_id,
                    timeout_notification.id,
                ),
            ];
            #[cfg(feature = "board-rpi5")]
            drop(s261_scheduler_read_access);
            blocked_counts
        };
        if deadline.active == 3
            && deadline.registered == before_deadlines.registered + 3
            && signal_matches
            && revoke_matches
            && timeout_matches
            && blocked_counts == [1, 1, 1]
        {
            all_parked = true;
            break;
        }
        crate::task::yield_now();
    }
    assert!(
        all_parked,
        "S148 three notification waits were not admitted"
    );

    let signal_record = crate::ipc::IPC_CALL_DEADLINES
        .lock()
        .object_snapshot(signal_notification.id)
        .expect("S148 signal exact deadline");
    let revoke_record = crate::ipc::IPC_CALL_DEADLINES
        .lock()
        .object_snapshot(revoke_notification.id)
        .expect("S148 revoke exact deadline");
    let timeout_record = crate::ipc::IPC_CALL_DEADLINES
        .lock()
        .object_snapshot(timeout_notification.id)
        .expect("S148 timeout exact deadline");

    // No timer IRQ may interleave between the three controlled first commits
    // and their loser probes. Each operation still takes the production IPC
    // transaction lock internally, exactly as an ordinary SVC/IRQ would.
    let arbitration_guard = crate::arch::aarch64::IrqGuard::new();
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s383_writer_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s383_qemu_s148_first_signal_wake_writer_guard_integration::acquire_s383_production_scheduler_writer_access()
        .unwrap_or_else(|error| {
            panic!(
                "S383 QEMU S148 first-signal Wake scheduler writer guard failed closed: {:?}",
                error
            )
        });
    let signal_outcome = (&mut *core::ptr::addr_of_mut!(crate::task::scheduler::SCHEDULER))
        .notification_signal(signal_notification.id, signal_notification.generation, 0x2);
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s383_writer_access);
    assert!(matches!(
        signal_outcome,
        Ok(NotificationSignalOutcome::Wake {
            waiter,
            observed: 0x2,
            pending: 0,
        }) if waiter.task_id() == signal_waiter.task_id
    ));

    assert_eq!(
        crate::ui::capability::revoke_notification_grant(revoke_grant, revoke_waiter.task_id,),
        Ok(true)
    );

    let timeout_outcome =
        crate::ipc::service_expired_ipc_call_deadlines(timeout_record.deadline().tick())
            .expect("S148 exact timeout service")
            .expect("S148 timeout-first record was not serviced");
    assert!(matches!(
        timeout_outcome,
        IpcDeadlineCancellation::Notification(cancellation)
            if cancellation.waiter_task == timeout_waiter.task_id
                && cancellation.notification_id == timeout_notification.id
                && cancellation.mask == 0x3
    ));

    // The other two exact deadline records have already been retired by
    // Delivered/Cancelled. Re-offering all three stored deadline ticks cannot
    // select a stale waiter or create a second terminal completion.
    for stale_tick in [
        signal_record.deadline().tick(),
        revoke_record.deadline().tick(),
        timeout_record.deadline().tick(),
    ] {
        assert!(matches!(
            crate::ipc::service_expired_ipc_call_deadlines(stale_tick),
            Ok(None)
        ));
    }
    assert_eq!(
        crate::ui::capability::revoke_notification_grant(signal_grant, signal_waiter.task_id,),
        Ok(false)
    );
    assert_eq!(
        crate::ui::capability::revoke_notification_grant(timeout_grant, timeout_waiter.task_id,),
        Ok(false)
    );
    assert_eq!(
        crate::ui::capability::revoke_notification_grant(revoke_grant, revoke_waiter.task_id,),
        Err(NotificationAuthorityError::StaleAuthority)
    );

    for notification in [
        signal_notification,
        revoke_notification,
        timeout_notification,
    ] {
        #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
        let s382_writer_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s382_qemu_s148_post_arbitration_signal_writer_guard_integration::acquire_s382_production_scheduler_writer_access()
            .unwrap_or_else(|error| {
                panic!(
                    "S382 QEMU S148 post-arbitration signal scheduler writer guard failed closed: {:?}",
                    error
                )
            });
        assert_eq!(
            (&mut *core::ptr::addr_of_mut!(crate::task::scheduler::SCHEDULER)).notification_signal(
                notification.id,
                notification.generation,
                0x8
            ),
            Ok(NotificationSignalOutcome::Coalesced { pending: 0x8 })
        );
        #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
        drop(s382_writer_access);
        assert_eq!(
            crate::ui::capability::destroy_notification_object(notification, controller_task),
            Ok(1)
        );
    }

    let after_arbitration = crate::ipc::ipc_call_deadline_snapshot();
    assert_eq!(after_arbitration.active, 0);
    assert_eq!(
        after_arbitration.registered - before_deadlines.registered,
        3
    );
    assert_eq!(after_arbitration.delivered - before_deadlines.delivered, 1);
    assert_eq!(after_arbitration.cancelled - before_deadlines.cancelled, 1);
    assert_eq!(after_arbitration.timed_out - before_deadlines.timed_out, 1);
    assert_eq!(after_arbitration.peer_closed, before_deadlines.peer_closed);
    assert_eq!(after_arbitration.replied, before_deadlines.replied);
    drop(arbitration_guard);

    let mut peers_reclaimed = false;
    for _ in 0..4096 {
        let signal_quota = crate::mm::with_boot_runtime_memory(|memory| {
            memory.audited_domain_quota(signal_domain)
        })
        .expect("S148 signal-domain quota authority")
        .expect("S148 signal-domain quota audit");
        let revoke_quota = crate::mm::with_boot_runtime_memory(|memory| {
            memory.audited_domain_quota(revoke_domain)
        })
        .expect("S148 revoke-domain quota authority")
        .expect("S148 revoke-domain quota audit");
        let timeout_quota = crate::mm::with_boot_runtime_memory(|memory| {
            memory.audited_domain_quota(timeout_domain)
        })
        .expect("S148 timeout-domain quota authority")
        .expect("S148 timeout-domain quota audit");
        if signal_quota.allocated_frames == 0
            && revoke_quota.allocated_frames == 0
            && timeout_quota.allocated_frames == 0
        {
            peers_reclaimed = true;
            break;
        }
        crate::task::yield_now();
    }
    assert!(
        peers_reclaimed,
        "S148 strict race waiters did not reclaim exactly"
    );

    let final_snapshot = crate::mm::with_boot_runtime_memory(|memory| memory.audited_snapshot())
        .expect("S148 final RuntimeMemory authority")
        .expect("S148 final RuntimeMemory audit");
    assert_eq!(final_snapshot.pmm.free_frames, baseline_free_frames);
    assert_eq!(
        final_snapshot.active_allocations,
        baseline_active_allocations
    );
    assert!(!crate::ui::capability::NOTIFICATION_REGISTRY
        .lock()
        .iter()
        .any(|object| {
            object.id() == signal_notification.id
                || object.id() == revoke_notification.id
                || object.id() == timeout_notification.id
        }));

    kprintln!(
        "[K2-S148] signal_notification={} revoke_notification={} timeout_notification={} signal_waiter={} revoke_waiter={} timeout_waiter={} signal_domain={} revoke_domain={} timeout_domain={} ABI=UNCHANGED_V1_3 ARBITER=IPC_TRANSACTION_LOCK MATRIX=ALL_6_PERMUTATIONS_HOST AT_EXACT_DEADLINE=3 SIGNAL_FIRST=DELIVERED REVOKE_FIRST=CANCELLED TIMEOUT_FIRST=TIMED_OUT REGISTERED=3 DELIVERED=1 CANCELLED=1 TIMED_OUT=1 PEER_CLOSED=0 REPLIED=0 WAKE_TOTAL=3 LOSER_RETRY=STALE EXACT_ONCE=YES ALL_STRICT=YES RECLAIM=15 NOTIFICATION_CLEANUP=3 free={}->{}->{} active={}->{}->{} KERNEL_FAULTS=0 EXECUTOR=PASS",
        signal_notification.id,
        revoke_notification.id,
        timeout_notification.id,
        signal_waiter.task_id,
        revoke_waiter.task_id,
        timeout_waiter.task_id,
        signal_domain.id(),
        revoke_domain.id(),
        timeout_domain.id(),
        baseline_free_frames,
        spawned.pmm.free_frames,
        final_snapshot.pmm.free_frames,
        baseline_active_allocations,
        spawned.active_allocations,
        final_snapshot.active_allocations,
    );
    run_qemu_s149_ipc_deadline_saturation_recovery();
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn acquire_s382_production_scheduler_writer_access(
) -> Result<G8lS382ProductionSchedulerWriterAccess, G8lS247WholeSchedulerAccessError> {
    let caller_cpu =
        crate::percpu::try_current_cpu_id().ok_or(G8lS247WholeSchedulerAccessError::InvalidCpu)?;
    if caller_cpu != crate::g8l_runtime_contract::CPU0 {
        return Err(G8lS247WholeSchedulerAccessError::InvalidCpu);
    }
    let access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s246_whole_scheduler_read_access_guard::S247_PRODUCTION_WHOLE_SCHEDULER_ACCESS_GATE
        .try_acquire_exclusive_for_valid_cpu(caller_cpu)?;
    Ok(G8lS382ProductionSchedulerWriterAccess { _access: access })
}

#[test]
fn boundary_has_exactly_one_s382_acquire_and_release_source_pair() {
    let loop_body = post_arbitration_loop();
    assert_eq!(
        loop_body
            .matches("acquire_s382_production_scheduler_writer_access")
            .count(),
        1
    );
    assert_eq!(loop_body.matches("drop(s382_writer_access)").count(), 1);
}

  {
    id: "g8l-s382-qemu-s148-post-arbitration-signal-writer-guard-integration-partial",
    date: "2026-08-29",
    sequence: 382,
    status: "passed",
    umbrella_status: "partial",
    title:
      "S382 · QEMU S148 post-arbitration signal production writer guard integration",
    summary:
      "S382, run_qemu_s148_notification_race_arbitration içindeki final tekrar döngüsünde exact Coalesced { pending: 0x8 } bekleyen notification_signal(...) mutable scheduler sınırını S381 ile 44 production reader'ın kullandığı aynı statik S247 state word'e bağlar. Controller task/grant kökleri, signaler/waiter kimlikleri, notification authority graph'i, altı terminal arbitration commit'i, stale-generation/stale-capability probe'ları, exact zero-pending snapshot ve mevcut outer arbitration IRQ guard writer'dan önce tamamlanır. Döngünün her iteration'ında gerçek per-CPU kimliğiyle CPU0-only S382 exclusive writer yeni mutable aliasından önce alınır; exact tek SCHEDULER aliası değişmeyen notification id/generation ve 0x8 bitlerini signal helper'ına taşır. Exact Coalesced sonucu doğrulandıktan hemen sonra writer bırakılır; notification-object destroy ve sonraki lifecycle cleanup membership dışındadır. Bir kaynak site üç fixture iteration'ı üretir; iteration sayısı üç production site gibi sayılmaz. Tarihsel S312 post-arbitration authority audit'i, S313 first-signal Wake audit'i, S376 EL0 signal membership'i, S381 QueueFull ve sıradaki S383 first-signal Wake membership'i ayrıdır. Guarded writer 55/69, açık writer 14, provider authority 0 ve whole-scheduler exclusion false'dur. S148 fixture board-qemu, wrapper RPi5-only olduğundan supported-profile direct caller/runtime observation=0 açıkça korunur.",
    evidence: [
      "İlk canonical focused komut ayrı S382 module/source registration ve production post-arbitration signal boundary yokken compile RED verdi; S382 tarihsel S312 kartına veya S381'e topluca eklenmedi.",
      "İlk RED exit 101 verdi; log 2173 B / 2417622911b390d25f5b7dd0b582e885dc2f91bc19dd988aafe301b64c714024 SHA-256'dır.",
      "RED exact eksiklikleri ayrı sınıfladı: kernel S382 modülü yoktu, simulation export'u yoktu ve final S148 loop'u production membership taşımıyordu.",
      "İlk production koşusu 38/41 PASS verdi; üç RED davranış veya gate coverage kaybı değil, frozen S312 literal source-format beklentisinin spelling/yerleşim sapmasıydı.",
      "İlk production logu 5216 B / 330adf4331e6e1ece9cd2cb0c2598ca0a0f4cf25af2ecc8137ac99c01dead433 SHA-256'dır.",
      "Tarihsel S312 assertion'ı silinmedi, filtrelenmedi veya gevşetilmedi; production ifade exact tarihsel spelling sözleşmesine döndürüldü.",
      "Final canonical focused koşu CARGO_INCREMENTAL=0 ile 41/41 PASS / 0 fail verdi; log 3266 B / ac9093425a8c9505c400cbc52e0592d4a2e8599c6fadeecdd1741244f6db262e SHA-256'dır.",
      "Ürün, coverage, source-order veya authority assertion'ı gevşetilmedi; compile ve 38/41 RED tarihçesi final PASS ile silinmez.",
      "S382 modülü S381 typed preflight outcome'unu yeniden doğrular; inherited 44 reader + 54 guarded writer + 15 open writer snapshot'ı saparsa InventoryDrift ile fail-closed kapanır.",
      "S382 başarı outcome'u FiftyFifthWriterGuardedAwaitingRemaining'dir ve exact 44 guarded reader + 55/69 guarded writer + 14 open writer envanterini sabitler.",
      "Production wrapper exact target_arch=aarch64, target_os=none, feature=board-rpi5 cfg kesişimindedir; host executor production runtime observation diye sunulmaz.",
      "acquire_s382_production_scheduler_writer_access gerçek try_current_cpu_id sonucunu kullanır; caller-supplied production CPU parametresi yoktur ve CPU0 dışı InvalidCpu verir.",
      "Writer lease S247_PRODUCTION_WHOLE_SCHEDULER_ACCESS_GATE üzerinde try_acquire_exclusive_for_valid_cpu ile alınır; yeni static veya ikinci exclusion domain yaratılmaz.",
      "Host executor callback'i exact bir kez çağırır; canlı reader veya writer callback'ten önce ExclusiveBusy üretir, invalid CPU fail-closed kapanır ve callback error RAII lease'i bırakır.",
      "S381 ve S382 token'ları aynı shared gate üzerinde monoton ve ayrıdır; iki kapı tek transaction, range dispatcher veya Kod kartı değildir.",
      "Exact production/source giriş sınırı kernel/src/main.rs içindeki run_qemu_s148_notification_race_arbitration fonksiyonudur; başka QEMU fixture'ları S382 coverage'ına katılmaz.",
      "Controller task ve controller-owned endpoint/notification root grant'leri final loop ve S382 writer'dan önce kurulup doğrulanır.",
      "Signaler ve waiter task kimlikleri nonzero ve birbirinden ayrıdır; task-owned signal/wait grants generation/provenance bağıyla writer öncesinde doğrulanır.",
      "Notification authority graph'i normal object, owner, generation, SIGNAL/WAIT rights ve child/root ilişkileriyle writer öncesinde kurulur.",
      "Altı exact arbitration permutation'ının terminal commit sonuçları final loop'tan önce tamamlanır; S382 terminal winner hesaplamasını sahiplenmez.",
      "Stale generation ve revoked capability probe'ları exact InvalidCapability sonucuyla S382 membership'inden önce kapanır; stale authority writer'ı açamaz.",
      "Final zero-pending snapshot notification id/generation ve pending=0 sözleşmesini writer öncesinde sabitler.",
      "Mevcut outer arbitration_guard fonksiyonun final replay/cleanup sınırını taşır ve her S382 writer ediniminden önce aktiftir; S382 yeni outer IRQ domain yaratmaz.",
      "Final for-loop exact üç iteration yürütür; production source inventory yalnız tek notification_signal alias site'ı sayar.",
      "Her iteration'da acquire_s382_production_scheduler_writer_access yeni mutable SCHEDULER aliasından önce exact bir kez çağrılır.",
      "Exact tek alias notification.id, notification.generation ve immutable 0x8 bitlerini notification_signal helper'ına taşır.",
      "Signal bitleri nonzero ve exact 0x8'dir; sıfır-bit no-op veya başka bit set'i S382 kabulüne çevrilmez.",
      "Her iteration exact Ok(NotificationSignalOutcome::Coalesced { pending: 0x8 }) bekler; Wake veya error sonucu fail-closed assertion üretir.",
      "Exact Coalesced sonucu writer bırakılmadan önce doğrulanır; result kontrolü membership dışına taşınarak race penceresi yaratılmaz.",
      "drop(s382_writer_access) exact signal assertion'ından hemen sonra gelir; nested writer başka cleanup işlemine genişlemez.",
      "destroy_notification_object çağrısı writer release sonrasındadır; object-registry, grant revoke ve waiter lifecycle mutasyonları S382 lease'i altında değildir.",
      "Her destroy sonrasında object fresh authority ile yeniden kurulur; bu lifecycle tekrarları kendi guard/audit sınırlarını kullanır ve S382 coverage sayılmaz.",
      "Scheduler notification_signal helper'ı kendi IRQ/IPC transaction sırasını korur ve signaler'ın live task-owned SIGNAL authority'sini yeniden doğrular.",
      "Notification registry object shape, generation ve nonzero bits transaction altında yeniden doğrulanır; foreign/stale authority commit'e erişemez.",
      "Final loop'ta waiter bulunmadığı için helper pending alanına 0x8 coalesce eder; ready queue veya task state Wake commit'i oluşmaz.",
      "Coalesced yol deadline cancellation, waiter CNode mutation veya notification grant retirement üretmez; bunlar S382 membership'ine yanlışlıkla dahil edilmez.",
      "S313 source-order ilk signal Wake yoludur; waiter bağlı olduğu için farklı helper branch'i ve farklı scheduler etkisi taşır, S383 için açık kalır.",
      "S312 writer-authority audit model/source sözleşmesidir; canlı S382 membership'i S312 sequence kimliğini veya tarihsel 69-open-writer snapshot'ını değiştirmez.",
      "S376 normal EL0 notification signal syscall membership'idir; S148 QEMU fixture aliasını sahiplenmez ve S382 token'ını paylaşmaz.",
      "CPU1 coverage service timer zincirinde S381'den sonra ve tarihsel S242 sender service'ten önce S382 preflight'ını yürütür; S245 view yalnız inspect edilir.",
      "Coverage service request take etmez, S244 whole-scheduler admission yayımlamaz, writer acquire etmez ve provider authority oluşturmaz.",
      "S148 fixture yalnız feature=board-qemu altında derlenir; S382 production acquire satırları aynı öğede yalnız feature=board-rpi5 altında etkinleşir.",
      "Desteklenen profil matrisi board-qemu ile board-rpi5'i birlikte çalıştırmadığından exact source seam hiçbir desteklenen profilde runtime invoke edilmiş sayılmaz.",
      "Bu cfg ayrımı gizlenmez: supported-profile runtime observations=0 ve production direct supported caller path=0'dır; host executor yalnız shared-gate davranışını kanıtlar.",
      "Seçili regresyon tarihsel S312/S313, S376, komşu S381, yeni S382 ve ipc_notification_deadline/lifecycle/race runtime gruplarını seri çalıştırdı.",
      "Final seçili regresyon 8 grup / 190/190 PASS / 0 fail verdi; log 34271 B / 64df70ecaaf114fc1c4011f0dc3500c1241b27e9cb7f1d977b580f72a1e47158 SHA-256'dır.",
      "S238–S382 dependency listesi 146 gruptur; iki bağımsız seri koşunun her biri 3489/3489 PASS / 0 fail verdi.",
      "İki kanonik dependency özeti 31408 B ve 1de6f787f5e7ec6b56d705ff4cdd3fce303fe81e6b944019b2e448797a3fab15 SHA-256 ile byte-eşittir.",
      "Exact yedi frozen G8h assertion dışındaki seri workspace 345 sonuç grubu / 5362 PASS / 0 fail / 7 filtered verdi.",
      "Filtered workspace log 531650 B / 691ec6f949e3b3145ae94d4df4d0a8bd8c0584b6e786bc04e3a0f84633623636; summary 26100 B / 0806b8528bc036bd91313a83baa453c3fd800e7b85241dc9389d576569ae473e SHA-256'dır.",
      "Filtresiz workspace exit 101 ile yalnız frozen S96 wiring_does_not_mutate_timer_gic_boot_or_expand_runtime_scope reddinde durdu: 298 grup / 5107 PASS / 1 fail; global workspace GREEN iddia edilmez.",
      "Filtresiz log 500000 B / d9632b76bfb01b46b76820ca5b79b495808b7f46a62bf3686af76f217978c8fb; summary 22574 B / 144aadbdaee79438145c544ba669eee26a4828f6192d5c7133a1ef8ac8f4fb6 SHA-256'dır.",
      "Fresh dev AArch64 profilleri 4/4 exit 0 verdi; önceki release denemeleri canonical profil kanıtına katılmadı.",
      "board-qemu log 112142 B / 256cf8a9629d08a2747fd3e26b7030e58075c29970bb25afeffffbb8a3eb2e9f, 293 warning header; ELF 16812984 B / d737d6068cecb20cca3ac4600319d7a888aba2eab8a6b88b0938aafde18f2cec'dir.",
      "board-rpi4 log 151047 B / 82dc222b91113de6cdd5e09624fef6cfe607a21129d368ff7dcf03f3a82eb58d, 391 warning header; ELF 11925456 B / 6241622d9226d3240c95fdaceb168f772512b8c4684beb1f316dc8b4bce1b16b'dır.",
      "board-rpi5 log 635816 B / fbaa88ef7bdfde3eb027b6f1e0bc0dda83e12ecf017dc92d10e1e612d4c447b1, 1450 warning header; ELF 15191304 B / 7f671f577496ebb69788b296a96524c0bb625c15849eaf5fb191b7bbbaf656de'dir.",
      "board-rpi5+smp log 635759 B / 7ac72f10b2a437e3835591066f2be03329c44d86a067f08238068cc4f965f689, 1450 warning header; ELF 15214544 B / 077b9e9e92920cbebf57c3b415190cbbed56c52d0654619abfa2cdb04a95d7a8'dir. Zero-warning iddiası yoktur.",
      "CARGO_INCREMENTAL=0 make verify-qemu exit 0 verdi. 116354 B log / 95c16eed39c89d364d5981ad70354e023dc568c0f4781dc3258f96df0c48f5db SHA-256 ile W^X 31/31, S130–S154+S271, RuntimePmm, EL0x4096, IPC 20/20 ve scheduler SEC5 PASS'tir.",
      "Ortak board-qemu regresyonu RPi5-only S382 wrapper invocation kanıtı değildir; supported-profile runtime observation=0 kalır.",
      "Source-bound Kod hedefi S1–S382 382/382 ayrı kapı, pre-S328 S1–S327 327/327, missing=none ve duplicate=0'dır.",
      "S382 Code kartı tam run_qemu_s148_notification_race_arbitration Rust öğesi içinde yalnız final post-arbitration loop signal'in upstream proof→outer IRQ→writer→single alias→exact Coalesced→release→destroy sınırını yayımlar.",
      "Ayrı S382 guard modülü, focused test, proof ve exact Operations object'i kendi source excerpt'leriyle yayımlanır; her excerpt repository path, satır aralığı, file SHA-256 ve snippet SHA-256 taşır.",
      "S1–S327 tarihsel kapılar Operations sequence kimliğiyle 327/327 ayrı kart olarak korunur; S328 öncesi kayıtlar generic placeholder içinde birleştirilmez veya S328 kartına eklenmez.",
      "S312, S313, S376, S381 ve S383 kartları S382 kod kutusuna katılmaz; sequence başına exact bir kart ve unique kaynak bağı zorunludur.",
      "İlk source-bound registry S1–S382 aralığında 382/382 unique kapı, 1096 exact excerpt, pre-S328 S1–S327 327/327, missing=none ve duplicate=0 üretti; JSON 8388829 B / 6a8d1d0ac9c2238abae459e91dff63d8822d70ffa9d529fc23a0cd6ba2d900c8 dosya SHA-256 ve ae2e002909baea7f3f4b69c8aa710c477c6e3c9b8b9fe872470aaa0774093404 registry SHA-256 taşır.",
      "İlk website kabulü 682/682 test, lint PASS, TypeScript exit 0 ve 0 B çıktı, 24/24 static page, 201 export dosyası ve Timeline/yol-haritasi 221 ayrı gate-policy kartı verdi.",
      "İlk website test logu 63388 B / 84babfb09ad6b957c1314852da6d7f9d0b1129c3f2439a27d41c8dd82fd253a4, lint 218 B / 79c084453e339ceb2efe76ed96d1d68be8ac51442957a7a048fd17dba3067ba2, TypeScript 0 B / e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 ve build 1213 B / 6e6927075461a154c5ccaebac7e86dcdced25971524c67440be9ebe3938e8a68 SHA-256'dır.",
      "S382 core Operations policy'si ilk yayında 12896 karakter / 13406 UTF-8 byte ölçüldü; tek satırlık özet değil, kaynak/guard/test/proof/publication ayrımı taşıyan kanıt-yoğun karttır.",
      "İlk production/main deployment 572aeb0c-38de-44d4-aaa2-6474902bec7a ile 116 uploaded + 84 existing = 200 asset olarak tamamlandı; deploy logu 1822 B / 3ca27205ccfe3212f4ad37a67fca30b559bc50fc3addeeafc1c17fa69312c9b9 SHA-256'dır.",
      "İlk cache-busted custom-domain readback dört rotada HTTP 200 ve raw byte-exact PASS verdi: /code/ 23672038 B / 5f99be5577d27b054bb7f838125fb3aa2e9ad28f9ab1edfd0fae16f397f31ea6, /operations/ 13939425 B / 2bd5074722e32e1655bd14e1ccf62771e47e081dcf4c1429a1202827264639fc, /timeline/ 5636995 B / bd1bfd339b7ddd04b70a819de126a19bca97c212fee74bb3168e0f50a19b2e68 ve /yol-haritasi/ 5636743 B / 76945a55b9c13b2da7d50d805f24f1b6b802a5723b4d0ab0816e38af93e6d385 SHA-256'dır.",
      "İlk canlı /code/ no-transform header'ı taşıdı; literal kart sayımı 382/382, pre-S328 327/327, duplicate=0, S1=1, S327=1, S328=1, S381=1, S382=1 ve S383=0'dır.",
      "S382 sırasında güç, SD kart, Mac kart erişimi, UART capture, raw validation, archive veya promotion yapılmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S382=NO.",
      "S382 bazlı bağlayıcı olmayan planlama görünümü R1 S382–S412, R2 S437–S487, R3 S566+, kaba S542–S592 ve risk paylı merkez yaklaşık S567'dir; ürün veya sıra taahhüdü değildir.",
    ],
    commands: [
      "CARGO_INCREMENTAL=0 cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s382_qemu_s148_post_arbitration_signal_writer_guard_integration -- --test-threads=1",
      "run S312, S313, S376, S381, S382 and three notification runtime groups serially",
      "run four fresh isolated dev AArch64 profiles; run S238-S382 dependency list twice; run filtered and unfiltered serial workspace audits; CARGO_INCREMENTAL=0 make verify-qemu",
      "python3 scripts/render-project-status.py --write && python3 scripts/render-project-status.py --check; cargo test -p aselsan_microkernel_simulation --test project_status_manifest -- --test-threads=1",
      "npm run code:generate && npm test && npm run lint && npx tsc --noEmit && npm run build",
      "npm run deploy; cache-busted curl + raw cmp for /code/, /operations/, /timeline/ and /yol-haritasi/",
    ],
    terminalSessions: [
      {
        id: "g8l-s382-focused-source-contract",
        title:
          "S382 focused QEMU S148 post-arbitration signal writer membership",
        commandLines: [
          "CARGO_INCREMENTAL=0 cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s382_qemu_s148_post_arbitration_signal_writer_guard_integration -- --test-threads=1",
        ],
        outputLines: [
          "initial result: compile RED; separate S382 module/source registration and production boundary absent",
          "first production result: 38/41; three exact S312 source-format assertions RED",
          "final result: ok; S382 focused 1 group / 41 passed / 0 failed",
          "shared S247 gate: 44 guarded readers + 55/69 guarded writers; 14 writers open",
          "upstream arbitration proofs + outer IRQ < S382 writer < one signal alias < exact Coalesced < release < object destroy",
          "one source site executes three fixture iterations; source coverage is not multiplied",
          "board-qemu fixture and RPi5-only wrapper do not intersect in a supported runtime profile; observations=0",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8l-s382-selected-notification-regression",
        title:
          "S382 selected notification arbitration and lifecycle regression",
        commandLines: [
          "run S312, S313, S376, S381, S382, ipc_notification_deadline_runtime, ipc_notification_lifecycle_runtime and ipc_notification_race_runtime serially",
        ],
        outputLines: [
          "result: 8 groups / 190 passed / 0 failed",
          "historical S312 post-arbitration and S313 first-Wake audits remain separate",
          "S376 EL0 signal and S381 QueueFull production memberships remain distinct",
          "S382 owns only the final post-arbitration Coalesced signal source site",
          "three runtime groups preserve deadline, revoke/destroy and six-order arbitration semantics",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8l-s382-full-acceptance",
        title: "S382 four-profile, dependency, workspace and QEMU acceptance",
        commandLines: [
          "run four fresh isolated dev AArch64 profile builds with CARGO_INCREMENTAL=0",
          "run S238-S382 dependency list twice and compare canonical summaries",
          "run filtered and unfiltered serial workspace audits",
          "CARGO_INCREMENTAL=0 make verify-qemu",
        ],
        outputLines: [
          "four AArch64 profiles: 4/4 exit 0; release attempts excluded; individual log/ELF identities recorded",
          "dependency: 146 groups / 3489/3489 twice; 31408-byte canonical summaries byte-equal",
          "filtered workspace: 345 groups / 5362 PASS / 0 fail / 7 frozen filtered",
          "unfiltered workspace: exit 101; 298 groups / 5107 PASS / 1 frozen S96 failure; global GREEN=false",
          "QEMU: W^X 31/31 + S130-S154/S271 + RuntimePmm + EL0x4096 + IPC 20/20 + scheduler SEC5 PASS",
          "QEMU common regression is not an S382 RPi5 runtime observation",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8l-s382-production-publication",
        title: "S382 source-code registry and production publication",
        commandLines: [
          "npm run code:generate && npm test && npm run lint && npx tsc --noEmit && npm run build",
          "npm run deploy",
          "cache-busted curl + raw cmp for /code/, /operations/, /timeline/ and /yol-haritasi/",
        ],
        outputLines: [
          "target registry: S1-S382 382/382 unique gates; pre-S328 S1-S327 327/327; missing=none; duplicate=0",
          "S382 code layers: complete S148 Rust item + exact final-loop focus + shared guard module + focused test + proof + Operations object",
          "S312/S313/S376/S381/S383 remain separate sequence cards",
          "initial registry: S1-S382 382/382 unique gates / 1096 exact excerpts; pre-S328 S1-S327 327/327; missing=none; duplicate=0",
          "website: 682/682 tests; lint PASS; TypeScript empty; 24/24 routes; 201 files; Timeline cards=221",
          "initial deployment: 572aeb0c-38de-44d4-aaa2-6474902bec7a; 116 uploaded + 84 existing",
          "custom-domain four routes: HTTP 200 and raw byte-exact; /code no-transform; live code=382/382; pre-S328=327/327; S382=1; S383=0",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
    ],
    terminalSessionsNote:
      "TAM ÇIKTI kayıtları S382 focused 41/41, seçili 8 grup / 190 PASS, iki kez 146 grup / 3489 PASS, filtreli workspace 345 grup / 5362 PASS, filtresiz yalnız frozen-S96 RED, dört dev AArch64 profil 4/4 ve ortak QEMU kabulünü ayrı oturumlar halinde taşır. İlk /code registry ve canlı readback S1–S382 aralığını 382/382 ayrı source-bound kart, S1–S327 tarihsel kapsamını 327/327 tekil, missing=none ve duplicate=0 olarak doğruladı; ilk production deployment 572aeb0c-38de-44d4-aaa2-6474902bec7a'dır.",
    limitations: [
      "S382 yalnız run_qemu_s148_notification_race_arbitration final loop içindeki post-arbitration Coalesced signal sınırını kapatır; S383 first-signal Wake ve kalan 14 writer açıktır.",
      "Production provider authority 0 ve whole-scheduler exclusion false kalır; S245 request tüketilmez ve S244 admission yayınlanmaz.",
      "board-qemu fixture ile RPi5-only production wrapper supported profilde kesişmez; runtime observation=0'dır.",
      "Bir source site'ın üç fixture iteration'ı üç production coverage site veya soak/liveness kanıtı değildir.",
      "Filtresiz global workspace frozen S96 source-identity reddi nedeniyle GREEN değildir.",
      "Generic SMP contention, CPU2/CPU3, migration/load balancing/hotplug ve product-level scheduler exclusion açıktır.",
      "Fiziksel RPi latency/power/thermal, UART/raw ve product threshold kabulü yapılmadı; RUNBOOK_EXECUTED_IN_S382=NO.",
    ],
  },