S389 · QEMU S141 replacement exact-ACK production writer guard integration

/// S141 runtime acceptance: the exact supervisor task id is part of session
/// authority. Production task-exit observes the pre-ACK death after IPC
/// teardown and requeues the in-flight lease inside the broker lock; the
/// controller never invokes a recovery API. A fresh strict EL0 supervisor
/// replies normally, then parks until controller-side ACK commit/session close
/// and endpoint revocation wake it for a clean exit without second recovery.
#[cfg(feature = "board-qemu")]
unsafe fn run_qemu_s141_automatic_lifecycle_recovery(
    source_event: crate::mm::RuntimeOomEvent,
    baseline_free_frames: u64,
    baseline_active_allocations: usize,
) {
    use crate::elf::load_and_spawn_user_elf_from_boot_runtime_with_arg;
    use crate::elf_plan::{AddressRange, ElfLoadPolicy};
    use crate::mm::{RuntimeOomTransportError, RuntimeOomTransportEvent};
    use crate::ui::capability::{CapabilityRights, IpcMessage};
    use crate::userspace_binaries::{
        OOM_LIFECYCLE_CRASH_SUPERVISOR_BINARY, OOM_LIFECYCLE_RECOVERY_SUPERVISOR_BINARY,
    };

    const S141_EVENT_LABEL: u64 = 0x5331_3431;
    const S141_EXACT_ACK_LABEL: u64 = 0x4143_4b41;
    const S141_TIMEOUT_TICKS: u64 = 1 << 20;

    let controller_task = crate::task::current_task_id().expect("S141 controller task");
    let (crashed_domain, replacement_domain) = crate::mm::with_boot_runtime_memory(|memory| {
        Ok::<_, crate::mm::RuntimeAllocationError>((
            memory.register_domain(QEMU_LIFECYCLE_CRASH_OOM_SUPERVISOR_RUNTIME_DOMAIN_ID)?,
            memory.register_domain(QEMU_LIFECYCLE_RECOVERY_OOM_SUPERVISOR_RUNTIME_DOMAIN_ID)?,
        ))
    })
    .expect("S141 RuntimeMemory authority")
    .expect("S141 supervisor domain registration");

    let endpoint_authority =
        crate::ui::capability::mint_endpoint(controller_task, S141_EVENT_LABEL)
            .expect("S141 controller endpoint authority");
    let no_forbidden_ranges: [AddressRange; 0] = [];
    let crash_publication_guard = crate::arch::aarch64::IrqGuard::new();
    let crashed_supervisor = load_and_spawn_user_elf_from_boot_runtime_with_arg(
        "oom-lifecycle-exit-strict-el0-supervisor-elf",
        OOM_LIFECYCLE_CRASH_SUPERVISOR_BINARY,
        ElfLoadPolicy::new(
            AddressRange::new(0x0340_0000, 0x0341_0000),
            &no_forbidden_ranges,
            16,
        ),
        0x80c3_1000,
        4,
        0,
        8,
        crashed_domain,
        endpoint_authority.id,
    )
    .expect("S141 strict lifecycle-exit supervisor spawn");
    crate::ui::capability::grant_task_endpoint_to_task(
        endpoint_authority,
        controller_task,
        crashed_supervisor.task_id,
        CapabilityRights::ENDPOINT_RECV,
    )
    .expect("S141 crashed supervisor RECV grant");

    let event =
        RuntimeOomTransportEvent::try_new(1, source_event.id, source_event.oom_epoch, 0x5c01)
            .expect("S141 immutable event projection");
    let (crashed_session, old_lease) = crate::mm::with_runtime_oom_supervisor_transport(|broker| {
        let initial = broker.snapshot();
        assert_eq!(
            initial.instance_id,
            crate::mm::RUNTIME_OOM_PRODUCTION_TRANSPORT_INSTANCE_ID
        );
        assert_eq!(initial.queued, 0);
        assert_eq!(initial.active_supervisor_session, None);
        assert_eq!(initial.active_supervisor_task_id, None);
        broker.enqueue(event).expect("S141 event enqueue");
        let session = broker
            .begin_supervisor_session_for_task(crashed_supervisor.task_id)
            .expect("S141 task-bound crashed session");
        let lease = broker
            .claim_next_for_session(
                session,
                crate::arch::aarch64::exceptions::TICKS.load(Ordering::Acquire),
                S141_TIMEOUT_TICKS,
            )
            .expect("S141 task-bound crashed lease");
        (session, lease)
    });
    drop(crash_publication_guard);

    let crash_spawned = crate::mm::with_boot_runtime_memory(|memory| memory.audited_snapshot())
        .expect("S141 crash-spawn RuntimeMemory authority")
        .expect("S141 crash-spawn RuntimeMemory audit");
    assert_eq!(crash_spawned.pmm.free_frames, baseline_free_frames - 5);
    assert_eq!(
        crash_spawned.active_allocations,
        baseline_active_allocations + 5
    );
    kprintln!(
        "[K1-MEM2-S141] pre-ACK lifecycle-bound supervisor strict spawn PASS id={} pages={} domain={} endpoint={} owner={} TASK_BOUND=YES INITIAL_X0=YES W^X=YES",
        crashed_supervisor.task_id,
        crashed_supervisor.page_count,
        crashed_domain.id(),
        endpoint_authority.id,
        controller_task,
    );

    let message = IpcMessage {
        label: S141_EVENT_LABEL,
        badge: controller_task,
        data: [
            old_lease.event().sequence_id(),
            old_lease.event().source_event_id(),
            old_lease.event().oom_epoch(),
            old_lease.event().fingerprint(),
        ],
    };
    let cancelled_reply =
        crate::ui::capability::mint_reply_endpoint_for_call(controller_task, endpoint_authority.id)
            .expect("S141 cancelled reply mint");
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s390_irq_guard = crate::arch::aarch64::IrqGuard::new();
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s390_writer_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s390_qemu_s141_crashed_call_writer_guard_integration::acquire_s390_production_scheduler_writer_access()
        .unwrap_or_else(|error| {
            panic!(
                "S390 QEMU S141 crashed CALL scheduler writer guard failed closed: {:?}",
                error
            )
        });
    let cancelled_call = (&mut *core::ptr::addr_of_mut!(crate::task::scheduler::SCHEDULER))
        .ipc_kernel_call_and_wait(
            endpoint_authority.id,
            endpoint_authority.generation,
            cancelled_reply.id,
            message,
        );
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s390_writer_access);
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s390_irq_guard);
    assert_eq!(cancelled_call, Err(crate::ipc::IpcError::InvalidCapability));
    assert!(!crate::ui::capability::ENDPOINT_REGISTRY
        .lock()
        .iter()
        .any(|endpoint| endpoint.id == cancelled_reply.id));

    let automatically_recovered = crate::mm::with_runtime_oom_supervisor_transport(|broker| {
        let recovered = broker.snapshot();
        assert_eq!(recovered.pending, 1);
        assert_eq!(recovered.in_flight, 0);
        assert_eq!(recovered.supervisor_crashes, 1);
        assert_eq!(recovered.recovered_inflight, 1);
        assert_eq!(recovered.active_supervisor_session, None);
        assert_eq!(recovered.active_supervisor_task_id, None);
        assert_eq!(
            broker.acknowledge_exact(old_lease, old_lease.deadline_tick()),
            Err(RuntimeOomTransportError::StaleLease)
        );
        assert_eq!(broker.snapshot(), recovered);
        recovered
    });
    assert_eq!(automatically_recovered.recovered_inflight, 1);

    let mut crash_reclaimed = false;
    for _ in 0..256 {
        let quota = crate::mm::with_boot_runtime_memory(|memory| {
            memory.audited_domain_quota(crashed_domain)
        })
        .expect("S141 crashed supervisor quota authority")
        .expect("S141 crashed supervisor quota audit");
        if quota.allocated_frames == 0 {
            crash_reclaimed = true;
            break;
        }
        crate::task::yield_now();
    }
    assert!(
        crash_reclaimed,
        "S141 pre-ACK supervisor did not reach exact reclaim"
    );
    let _ = crate::task::service_deferred_current_runtime_oom()
        .expect("S141 crashed-supervisor later-stack reap");
    let post_crash = crate::mm::with_boot_runtime_memory(|memory| memory.audited_snapshot())
        .expect("S141 post-crash RuntimeMemory authority")
        .expect("S141 post-crash RuntimeMemory audit");
    assert_eq!(post_crash.pmm.free_frames, baseline_free_frames);
    assert_eq!(post_crash.active_allocations, baseline_active_allocations);

    let recovery_publication_guard = crate::arch::aarch64::IrqGuard::new();
    let replacement_supervisor = load_and_spawn_user_elf_from_boot_runtime_with_arg(
        "oom-lifecycle-recovery-strict-el0-supervisor-elf",
        OOM_LIFECYCLE_RECOVERY_SUPERVISOR_BINARY,
        ElfLoadPolicy::new(
            AddressRange::new(0x0360_0000, 0x0361_0000),
            &no_forbidden_ranges,
            16,
        ),
        0x80c4_1000,
        4,
        0,
        8,
        replacement_domain,
        endpoint_authority.id,
    )
    .expect("S141 strict lifecycle-recovery supervisor spawn");
    crate::ui::capability::grant_task_endpoint_to_task(
        endpoint_authority,
        controller_task,
        replacement_supervisor.task_id,
        CapabilityRights::ENDPOINT_RECV,
    )
    .expect("S141 replacement supervisor RECV grant");
    let (replacement_session, retry_lease) =
        crate::mm::with_runtime_oom_supervisor_transport(|broker| {
            let session = broker
                .begin_supervisor_session_for_task(replacement_supervisor.task_id)
                .expect("S141 task-bound replacement session");
            assert!(session.epoch() > crashed_session.epoch());
            let lease = broker
                .claim_next_for_session(
                    session,
                    crate::arch::aarch64::exceptions::TICKS.load(Ordering::Acquire),
                    S141_TIMEOUT_TICKS,
                )
                .expect("S141 automatically recovered retry lease");
            assert!(lease.delivery_epoch() > old_lease.delivery_epoch());
            assert_eq!(lease.event(), old_lease.event());
            (session, lease)
        });
    drop(recovery_publication_guard);

    let recovery_spawned = crate::mm::with_boot_runtime_memory(|memory| memory.audited_snapshot())
        .expect("S141 recovery-spawn RuntimeMemory authority")
        .expect("S141 recovery-spawn RuntimeMemory audit");
    assert_eq!(recovery_spawned.pmm.free_frames, baseline_free_frames - 5);
    assert_eq!(
        recovery_spawned.active_allocations,
        baseline_active_allocations + 5
    );
    kprintln!(
        "[K1-MEM2-S141] replacement lifecycle-bound supervisor strict spawn PASS id={} pages={} domain={} endpoint={} owner={} TASK_BOUND=YES HANDOFF=ENDPOINT_CLOSE INITIAL_X0=YES W^X=YES",
        replacement_supervisor.task_id,
        replacement_supervisor.page_count,
        replacement_domain.id(),
        endpoint_authority.id,
        controller_task,
    );

    let retry_message = IpcMessage {
        label: S141_EVENT_LABEL,
        badge: controller_task,
        data: [
            retry_lease.event().sequence_id(),
            retry_lease.event().source_event_id(),
            retry_lease.event().oom_epoch(),
            retry_lease.event().fingerprint(),
        ],
    };
    let exact_reply =
        crate::ui::capability::mint_reply_endpoint_for_call(controller_task, endpoint_authority.id)
            .expect("S141 exact reply mint");
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s389_irq_guard = crate::arch::aarch64::IrqGuard::new();
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s389_writer_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s389_qemu_s141_replacement_exact_ack_writer_guard_integration::acquire_s389_production_scheduler_writer_access()
        .unwrap_or_else(|error| {
            panic!(
                "S389 QEMU S141 replacement exact-ACK scheduler writer guard failed closed: {:?}",
                error
            )
        });
    let exact_ack = (&mut *core::ptr::addr_of_mut!(crate::task::scheduler::SCHEDULER))
        .ipc_kernel_call_and_wait(
            endpoint_authority.id,
            endpoint_authority.generation,
            exact_reply.id,
            retry_message,
        )
        .expect("S141 replacement strict EL0 exact ACK");
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s389_writer_access);
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s389_irq_guard);
    assert_eq!(exact_ack.label, S141_EXACT_ACK_LABEL);
    assert_eq!(exact_ack.badge, replacement_supervisor.task_id);
    assert_eq!(exact_ack.data, retry_message.data);
    crate::mm::with_runtime_oom_supervisor_transport(|broker| {
        assert_eq!(
            broker.acknowledge_exact(
                retry_lease,
                crate::arch::aarch64::exceptions::TICKS.load(Ordering::Acquire),
            ),
            Ok(event)
        );
        broker
            .close_supervisor_session(replacement_session)
            .expect("S141 replacement session close");
    });

    // The replacement parks on a second RECV after replying. Revoking the
    // controller-owned root endpoint wakes it only after broker ACK and
    // session close are durable, so its normal exit is an unrelated no-op.
    let endpoint_cleanup = crate::ui::capability::teardown_task_ipc_lifecycle(controller_task)
        .expect("S141 controller endpoint cleanup");
    assert_eq!(endpoint_cleanup.owned_endpoints, 1);
    assert_eq!(endpoint_cleanup.drained_calls, 0);
    assert_eq!(endpoint_cleanup.cancelled_responder_calls, 0);

    let mut replacement_reclaimed = false;
    for _ in 0..256 {
        let quota = crate::mm::with_boot_runtime_memory(|memory| {
            memory.audited_domain_quota(replacement_domain)
        })
        .expect("S141 replacement supervisor quota authority")
        .expect("S141 replacement supervisor quota audit");
        if quota.allocated_frames == 0 {
            replacement_reclaimed = true;
            break;
        }
        crate::task::yield_now();
    }
    assert!(
        replacement_reclaimed,
        "S141 replacement supervisor did not reach exact reclaim"
    );
    let _ = crate::task::service_deferred_current_runtime_oom()
        .expect("S141 replacement-supervisor later-stack reap");

    let final_snapshot = crate::mm::with_boot_runtime_memory(|memory| memory.audited_snapshot())
        .expect("S141 final RuntimeMemory authority")
        .expect("S141 final RuntimeMemory audit");
    assert_eq!(final_snapshot.pmm.free_frames, baseline_free_frames);
    assert_eq!(
        final_snapshot.active_allocations,
        baseline_active_allocations
    );
    let final_broker = crate::mm::with_runtime_oom_supervisor_transport(|broker| broker.snapshot());
    assert_eq!(final_broker.queued, 0);
    assert_eq!(final_broker.pending, 0);
    assert_eq!(final_broker.in_flight, 0);
    assert_eq!(final_broker.acknowledged, 1);
    assert_eq!(final_broker.supervisor_sessions_started, 2);
    assert_eq!(final_broker.supervisor_crashes, 1);
    assert_eq!(final_broker.recovered_inflight, 1);
    assert_eq!(final_broker.active_supervisor_session, None);
    assert_eq!(final_broker.active_supervisor_task_id, None);
    assert!(!crate::ui::capability::ENDPOINT_REGISTRY
        .lock()
        .iter()
        .any(|endpoint| endpoint.id == endpoint_authority.id
            || endpoint.id == exact_reply.id
            || endpoint.id == cancelled_reply.id));

    kprintln!(
        "[K1-MEM2-S141] source_event={} endpoint={} crashed_supervisor={} replacement_supervisor={} crashed_domain={} replacement_domain={} SESSION=1->2 TASK_BOUND=YES AUTOMATIC_LIFECYCLE_RECOVERY=YES RECOVERY_CALLER=TASK_EXIT CONTROLLER_RECOVERY_CALLS=0 PRE_ACK_EXIT=INVALID_CAPABILITY RECOVERED_INFLIGHT=1 OLD_LEASE_ACK=STALE RETRY_ACK=EXACT RESTARTED_EL0_ACK=YES REPLACEMENT_HANDOFF=ENDPOINT_CLOSE NORMAL_EXIT_RECOVERY=NONE REPLY_ONESHOT=1/1 BROKER_DRAINED=YES SESSIONS=2 CRASHES=1 CRASH_RECLAIM=5 RESTART_RECLAIM=5 OWNER_EP_CLEANUP=1 free={}->{}->{}->{}->{} active={}->{}->{}->{}->{} KERNEL_DIRECT_ACK=NO EXECUTOR=PASS",
        source_event.id,
        endpoint_authority.id,
        crashed_supervisor.task_id,
        replacement_supervisor.task_id,
        crashed_domain.id(),
        replacement_domain.id(),
        baseline_free_frames,
        crash_spawned.pmm.free_frames,
        post_crash.pmm.free_frames,
        recovery_spawned.pmm.free_frames,
        final_snapshot.pmm.free_frames,
        baseline_active_allocations,
        crash_spawned.active_allocations,
        post_crash.active_allocations,
        recovery_spawned.active_allocations,
        final_snapshot.active_allocations,
    );
    run_qemu_s142_lower_el_fault_recovery(
        source_event,
        final_snapshot.pmm.free_frames,
        final_snapshot.active_allocations,
    );
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn acquire_s389_production_scheduler_writer_access(
) -> Result<G8lS389ProductionSchedulerWriterAccess, G8lS247WholeSchedulerAccessError> {
    let caller_cpu =
        crate::percpu::try_current_cpu_id().ok_or(G8lS247WholeSchedulerAccessError::InvalidCpu)?;
    if caller_cpu != crate::g8l_runtime_contract::CPU0 {
        return Err(G8lS247WholeSchedulerAccessError::InvalidCpu);
    }
    let access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s246_whole_scheduler_read_access_guard::S247_PRODUCTION_WHOLE_SCHEDULER_ACCESS_GATE
        .try_acquire_exclusive_for_valid_cpu(caller_cpu)?;
    Ok(G8lS389ProductionSchedulerWriterAccess { _access: access })
}

#[test]
fn boundary_has_exactly_one_s389_acquire_and_success_release_pair() {
    let boundary = s141_boundary();
    assert_eq!(
        boundary
            .matches("acquire_s389_production_scheduler_writer_access")
            .count(),
        1
    );
    assert_eq!(boundary.matches("drop(s389_writer_access)").count(), 1);
    assert_eq!(boundary.matches("drop(s389_irq_guard)").count(), 1);
}

  {
    id: "g8l-s389-qemu-s141-replacement-exact-ack-writer-guard-integration-partial",
    date: "2026-08-29",
    sequence: 389,
    status: "passed",
    umbrella_status: "partial",
    title:
      "S389 · QEMU S141 replacement exact-ACK production writer guard integration",
    summary:
      "S389, run_qemu_s141_automatic_lifecycle_recovery içindeki iki explicit mutable scheduler aliasından source-order sonra gelen replacement-supervisor exact-ACK CALL sınırını tek başına production guard'a bağlar. Nonzero controller ve controller-owned normal Endpoint SEND authority, crashed strict EL0 supervisor'ın ilk CALL'i, exact InvalidCapability continuation'ı ve cancelled-reply retirement, automatic task-exit recovery, old-lease StaleLease reddi, crashed-supervisor exact reclaim, fresh replacement supervisor, strict RECV grant, daha yeni task-bound session/retry lease, immutable retry message, linked one-shot exact reply ve recovery-publication IRQ release writer'dan önce tamamlanır. Dedicated S389 IRQ guard ardından gerçek per-CPU kimliğiyle CPU0-only exclusive writer S388 ve 44 production reader'ın kullandığı aynı statik S247 state word üzerinde alınır. Exact tek mutable SCHEDULER aliası yalnız endpoint id/generation, exact-reply id ve immutable retry message ile source-order second ipc_kernel_call_and_wait çağrısını kapsar. Owned exact_ack önce writer, sonra IRQ release sınırını geçer; exact label, replacement-task badge ve retry data doğrulaması ancak iki release sonrasında yapılır. Broker exact acknowledge/session close, controller endpoint-close handoff, replacement reclaim, RuntimePmm baseline ve final broker drain downstream'da kalır. Tarihsel S319 replacement ve S320 crashed-CALL audit'leri model-only'dir; source-order first crashed CALL sıradaki S390 kapısı olarak ayrı kalır. Guarded writer 62/69, açık writer 7, provider authority 0 ve whole-scheduler exclusion false'dur. S141 fixture board-qemu, production wrapper RPi5-only olduğundan supported-profile runtime observation=0 açıkça korunur.",
    evidence: [
      "Canonical focused test S389 modülü, kernel/simulation registration'ı, CPU1 coverage service'i ve production S141 replacement membership'i yokken compile RED verdi; tarihsel S319 authority audit'i production entegrasyonu yerine geçirilmedi.",
      "İlk RED exit 101 verdi; /tmp/aselsanos-s389-initial-red.log 1327 B / db378a7c8f4deb0ebae1eb50987c2532610e53655d0edc4f44e3552b4f0e8433 SHA-256'dır.",
      "İlk production-wired odak koşusu 47 PASS / 1 RED verdi; tek red testin genel message, alt dizisini retry_message, içinde de saymasıydı. Ürün kodu, exact ikinci-alias sahipliği veya release sırası değiştirilmedi.",
      "Test source assertion'ı exact satır sınırına daraltıldı; cancelled message ile retry_message ayrımı korunurken hiçbir product/coverage assertion'ı gevşetilmedi.",
      "Final focused koşu 48/48 PASS verdi; /tmp/aselsanos-s389-focused-green.log 3912 B / d6ff80791eda37706513292be59e00930b273530ec479f2f3d1961f54f7ce542 SHA-256'dır.",
      "S389 modülü typed S388 preflight outcome'unu yeniden doğrular; inherited 44 reader + 61 guarded writer + 8 open writer snapshot'ı saparsa InventoryDrift ile fail-closed kapanır.",
      "S389 başarı outcome'u SixtySecondWriterGuardedAwaitingRemaining'dir ve exact 44 guarded reader + 62/69 guarded writer + 7 open writer envanterini sabitler.",
      "Outcome tek toplam sayı taşımaz; request id, reader/writer/open sayıları, S141 transaction, mutable alias, upstream authority/recovery nesneleri, IRQ/CALL, downstream ACK/cleanup sınırları ve runtime-observation alanları typed olarak raporlanır.",
      'Production wrapper exact all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5") cfg kesişimindedir; host executor veya board-qemu fixture production runtime invocation diye sunulmaz.',
      "acquire_s389_production_scheduler_writer_access gerçek try_current_cpu_id sonucunu kullanır; caller-supplied production CPU parametresi yoktur ve CPU0 dışı mutation callback'inden önce InvalidCpu ile kapanır.",
      "Writer lease S247_PRODUCTION_WHOLE_SCHEDULER_ACCESS_GATE üzerinde try_acquire_exclusive_for_valid_cpu ile alınır; S389 yeni static, ikinci state word veya ayrı exclusion domain yaratmaz.",
      "Host executor callback'i exact bir kez çağırır; canlı reader writer'ı, canlı writer ikinci writer'ı ve yeni reader'ı aynı state word üzerinde reddeder; callback error RAII lease'ini exact bırakır.",
      "S388 ve S389 executor token'ları aynı shared gate üzerinde monoton ve ayrıdır; iki kapı tek transaction, range dispatcher veya toplu S335–S400 facade membership'i değildir.",
      "Production main.rs envanterinde S141 replacement CALL source-order positions[7], yani 17 explicit main aliasının sekizincisidir; S389 yalnız bu aliası sahiplenir.",
      "Aynı run_qemu_s141_automatic_lifecycle_recovery öğesinde iki mutable scheduler aliası korunur: source-order first crashed/cancelled CALL S390 için açık, source-order second replacement exact-ACK CALL S389 guarded'dır.",
      "Controller current_task_id üzerinden nonzero alınır ve normal endpoint controller adına mint edilir; endpoint authority id/generation writer'a owned scalar girdiler olarak taşınır.",
      "Crashed supervisor ayrı RuntimeMemory domain'inde strict lifecycle-exit ELF olarak spawn edilir ve exact ENDPOINT_RECV authority writer sınırından önce grant edilir.",
      "Immutable RuntimeOomTransportEvent broker'a enqueue edilir; crashed session ile old lease exact crashed-supervisor task identity'sine bağlanır ve crash-publication IRQ guard açıkça bırakılır.",
      "Original message old_lease event tuple'ından immutable kurulur ve linked cancelled reply exact controller/endpoint bağıyla mint edilir; ilk mutable alias S389 kapsamına girmez.",
      "Source-order first ipc_kernel_call_and_wait yalnız exact Err(InvalidCapability) kabul eder; cancelled reply registry'den emekli olur ve bu tamamlanmadan replacement path'e geçilmez.",
      "Automatic lifecycle recovery pending=1, in_flight=0, crashes=1 ve recovered_inflight=1 snapshot'ını üretir; controller manual recovery API çağırmaz.",
      "Old lease exact deadline tick ile acknowledge edilmeye çalışıldığında yalnız StaleLease kabul edilir ve broker snapshot'ı unchanged kalır.",
      "Crashed supervisor domain quota 256 bounded yield içinde allocated_frames=0'a döner; deferred later-stack service sonrası RuntimePmm baseline exact geri gelir.",
      "Fresh replacement supervisor ayrı domain'de strict lifecycle-recovery ELF olarak spawn edilir ve yalnız exact controller endpoint RECV grant'i alır.",
      "Replacement session epoch'i crashed session'dan, retry lease delivery epoch'i old lease'ten büyük olmak zorundadır; retry event identity exact old event olarak korunur.",
      "Recovery-publication IRQ guard replacement spawn/grant/session/lease hazırlığını kapsar ve dedicated S389 IRQ guard kurulmadan önce explicit bırakılır; iki guard nested tutulmaz.",
      "retry_message label=S141_EVENT_LABEL, badge=controller_task ve retry_lease event sequence/source/epoch/fingerprint tuple'ından immutable olarak kurulur.",
      "exact_reply capability exact controller/endpoint ilişkisiyle writer'dan önce mint edilir; reply id S389 CALL'e owned scalar olarak aktarılır.",
      "Dedicated s389_irq_guard writer acquire'dan önce kurulur; acquire_s389_production_scheduler_writer_access, drop(s389_writer_access) ve drop(s389_irq_guard) exact birer kez görünür.",
      "Exact mutable alias ipc_kernel_call_and_wait(endpoint_authority.id, endpoint_authority.generation, exact_reply.id, retry_message) çağrısını bir kez yapar.",
      "CALL success exact S141 replacement strict EL0 exact ACK expect sözleşmesiyle owned exact_ack değerine çevrilir; borrowed Scheduler referansı lease dışına taşınmaz.",
      "drop(s389_writer_access), drop(s389_irq_guard), exact_ack.label, exact_ack.badge ve exact_ack.data kontrolleri bu kesin source sırasındadır.",
      "ACK label exact S141_EXACT_ACK_LABEL, badge exact replacement_supervisor.task_id ve data exact retry_message.data olmak zorundadır.",
      "Broker acknowledge_exact(retry_lease, current TICKS) ve close_supervisor_session(replacement_session) üçlü ACK doğrulamasından sonra yürür.",
      "Controller-owned endpoint teardown broker ACK/session close durable olduktan sonra ikinci RECV'de park etmiş replacement supervisor'ı endpoint-close handoff ile uyandırır.",
      "Endpoint cleanup owned_endpoints=1, drained_calls=0 ve cancelled_responder_calls=0 sonuçlarını doğrular; cleanup writer lease süresini büyütmez.",
      "Replacement domain quota 256 bounded yield içinde allocated_frames=0'a döner ve deferred later-stack service sonrasında final RuntimeMemory baseline doğrulanır.",
      "Final broker queued=0, pending=0, in_flight=0, acknowledged=1, sessions=2, crashes=1, recovered_inflight=1 ve active session/task=None olmalıdır.",
      "Final endpoint registry controller endpoint, exact reply ve cancelled reply id'lerinin hiçbirini taşımamalıdır; one-shot reply ve owner cleanup birlikte kapanır.",
      "S141 terminal runtime marker AUTOMATIC_LIFECYCLE_RECOVERY=YES, PRE_ACK_EXIT=INVALID_CAPABILITY, OLD_LEASE_ACK=STALE, RETRY_ACK=EXACT ve BROKER_DRAINED=YES alanlarını korur.",
      "Scheduler helper aynı IRQ/IPC transaction altında caller SEND authority, normal Endpoint object ve linked one-shot reply ilişkisini commit'ten önce yeniden doğrular.",
      "Optional receiver authority/generation ve exact receive deadline ile ready queue, blocked call, reply table ve endpoint queue kapasitesi CALL publish öncesinde fail-closed sınanır.",
      "CALL envelope publish, caller context park ve optional immediate receiver delivery aynı helper transaction'ındadır; transaction release edilmeden context switch yapılmaz.",
      "Continuation transaction release ve resume sonrasında aynı caller task'ı bulur ve yalnız owned IpcMessage terminal sonucunu yeniden kurar.",
      "Focused source testi complete run_qemu_s141_automatic_lifecycle_recovery Rust öğesini ve exact S389 acquire→single mutable alias→CALL→writer drop nested focus'unu birlikte doğrular.",
      "Focused test complete S141 öğesinde exact iki mutable alias sayar, S389 focus'unda yalnız second aliası ve tek ipc_kernel_call_and_wait görür.",
      "Argument-forwarding testi endpoint_authority.id, endpoint_authority.generation, exact_reply.id ve retry_message değerlerinin exact ikinci CALL'e eksiksiz aktarıldığını doğrular.",
      "Focused test cancelled_reply.id ve original message satırının S389 focus'una girmediğini, exact_reply.id ile retry_message'in ise girdiğini ayrı assertion'larla sabitler.",
      "Focused grup request yokken Idle, exact pending request ile SixtySecondWriterGuardedAwaitingRemaining ve yanlış CPU'da inherited S388 hatasını ayrı test eder.",
      "S245 request preflight sonrasında state.pending_request_id()==Some(1) kalır; take, publish, consume veya authority promotion yapılmaz.",
      "Reader-vs-writer, writer-vs-writer, nested reader/writer, callback-error release ve exact-once callback yolları birbirinden bağımsız test edilir.",
      "Production-only sembollerin tamamı aynı RPi5 AArch64 bare-metal cfg'sine bağlıdır; hostta sahte yarım production yolu oluşturulmaz.",
      "S389 modül kaynak testi provider constructor, S244 publisher ve request-state take adlarını reddeder; provider authority=0 ve exclusion=false kaynak yüzeyiyle korunur.",
      "Kernel main ve simulation lib registration'ları exact uzun S389 modül adıyla ayrı doğrulanır; sıra tablosundaki model satırı production membership yerine geçirilmez.",
      "CPU1 coverage service exceptions.rs içinde S388 service çağrısından sonra ve tarihsel S242 consumer'dan önce çalışır; mutable SCHEDULER veya S389 acquire çağırmaz.",
      "Tarihsel S319 replacement audit'i ve S320 crashed-CALL audit'i model-level kalır; production S388 fault-cancelled membership'i de ayrı prior source unit'tir.",
      "S390 acquire sembolü S389 modülünde ve guarded focus'ta yoktur; source-order first S141 crashed CALL sonraki kapı olarak açık kalır.",
      "Final selected regression S389, S388, tarihsel S319/S320, runtime_oom_lifecycle_recovery ve runtime_oom_lower_el_fault_recovery ile 6 grup / 140 PASS / 0 fail verdi.",
      "Selected log /tmp/aselsanos-s389-selected.log 13643 B / e323c916097a3970c4f4edc0619623e00525a97c7eb2e3d63cf53e7cc280e44c SHA-256'dır.",
      "S238–S388 dependency hedef listesi byte-for-byte korunup yalnız S389 sona eklendi; iki bağımsız seri koşu 153 grup / 3811/3811 PASS verdi.",
      "Dependency timing-normalized ve LC_ALL=C sıralı özetlerin her biri 32980 B / 8effcf7ec7b171cb4e2996877986e1c00356386086647fe7cb3a98f4150c2c0b SHA-256 ile byte-exact eşittir.",
      "Dependency artifact root /tmp/aselsanos-s389-dependency.bj3chI; raw run1 380587 B / 32f34df2c26ee8f74987efd8e67fee8d86137338b5dface369cd1934b2d30afb ve run2 365137 B / ad6ec97f63c2fcaec1dcba1b4cadb5f075250bf9dd4036c356353ca9843aba11'dir.",
      "İlk kanonik karşılaştırma finished in 0.00/0.01s alanlarını taşıdığı için farklı çıktı; yalnız timing alanı çıkarılınca test isim/sayı/status payload'ı exact eşitlendi.",
      "Yedi exact frozen assertion dışındaki serial workspace 352 result group / 5689 PASS / 0 fail / 7 filtered verdi.",
      "Filtered workspace raw log 557790 B / 677975b1d757ec419a3247f1d1b741c8238f093f1242396b8520caec818932c6 ve summary 33322 B / c91a3af01087c5ecc9c36bb89cdb7ac892c7f32aa677864c468631838c2b6303'tür.",
      "Filtresiz workspace exit 101 ile yalnız frozen S96 wiring_does_not_mutate_timer_gic_boot_or_expand_runtime_scope assertion'ında durdu; 305 result group / 5434 PASS / 1 fail ve global workspace GREEN claimed=false'dur.",
      "Filtresiz raw log 526125 B / 66da652e7a1ed1c9adc73384c0f48a2b6155ed008543252166468230271dd538 ve summary 28903 B / 6c74294eaafc49d8fe63c9e4994198834b80f8ac198840c747583c2ba887dc81'dir.",
      "Workspace artifact root /tmp/aselsanos-s389-workspace.pGuoxm'dir; yedi filtre adı S388 kabulünden değiştirilmeden korunur.",
      "Dört fresh canonical AArch64 profil kernel çalışma dizininden CARGO_INCREMENTAL=0 ve birbirinden ayrı target dizinleriyle 4/4 exit 0 verdi; zero-warning iddiası yoktur.",
      "Fresh board-qemu logu 111882 B / d7331c345c5ba8a2c8e93d6bd18c6ceec2131e0a89b9dc32f35a717d2baee2b6 ve 293 warning header; ELF 16814072 B / a742596fd21e7c14650b312ada9eb37c9b1afe713dc85850bf2a2a960be59185'dir.",
      "Fresh board-rpi4 logu 150623 B / 9d7764c6b67cb5539c91780fad8229fd7bafc9707df38c809c6334644746a3c5 ve 391 warning header; ELF 11925488 B / 216744dda3e825dca91126f441d74bb84c8011d8f02c6d467b6e365d5ff67338'dir.",
      "Fresh board-rpi5 logu 657936 B / 250a746cc3745a8b76dbaf215a0a4096cfe594593fbd63ecc56b1ec68afabefb ve 1506 warning header; ELF 15331184 B / d0a2ee3895c7c22b9931be00ec1a705b4a03d6d5a346f9ad715fe4854fe569da'dır.",
      "Fresh board-rpi5+smp logu 657878 B / 4ca77cf3f3c1b92c6814c88b6be242371ae05db029f7435c47a5ef3fc4bb550b ve 1506 warning header; ELF 15324952 B / 1c45537fe7718afb376fc7b3bd870a8df51f6817a60682d2cc673a9e63d04e03'dür.",
      "Dört profil /tmp/aselsanos-s389-profiles.aR08q8 altında tutulur; build log ve ELF byte/hash ölçüleri birbirine karıştırılmaz.",
      "CARGO_INCREMENTAL=0 make verify-qemu 116354 B / 5bb84d9ca265f4580e9fc2fd4c66827467da85a5e2549e5536ce31d1534d22ca SHA-256 ile strict ELF W^X 31/31, S130–S154 + S271, IPC 20/20 ve scheduler SEC5 PASS verdi.",
      "QEMU logunda S141 task-bound automatic lifecycle recovery/exact retry senaryosu gözlendi; board-qemu guest RPi5-only S389 lease'ini compile etmediği için bu writer runtime observation değildir.",
      "Final cargo fmt --all -- --check exit 0 ve boş çıktı verdi; 0 B / e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 SHA-256'dır.",
      "S389 proof owned boundary, coverage, TDD, selected regression, dependency reproducibility, workspace, profiles, QEMU/format ve Code publication contract bölümlerini ayrı taşıyacaktır.",
      "Code yayın hedefi S1–S389 389/389 ayrı kapıdır; kullanıcının özellikle istediği S328 öncesi S1–S327 aralığı 327/327 tekil kalmalı, missing=none ve duplicate=0 olmalıdır.",
      "S389 Code kartı complete run_qemu_s141_automatic_lifecycle_recovery Rust öğesini, yalnız second replacement CALL'e ait nested acquire→release focus'unu, complete S389 guard modülünü, complete 48-test target'ını, proof'u ve complete Operations object'ini yayımlar.",
      "Complete production excerpt iki S141 CALL'i bağlamıyla gösterirken nested focus yalnız s389_writer_access acquisition'dan drop(s389_writer_access)'e kadar kesilir; S390 first crashed CALL guard kapsamında gösterilmez.",
      "S1, S327, S328, S388 ve S389 kartlarının exact birer kez görünmesi; S390'ın pre-publish edilmemesi website kabulünde sayılacaktır.",
      "Deterministic initial source registry S1–S389 389/389 unique gate, 1124 exact excerpt, pre-S328 S1–S327 327/327, missing=none ve duplicate=0 üretti; S390 count=0'dır.",
      "Initial mapping exact 62 writer-guard + 225 focused-test + 94 command-contract + 8 operation-record = 389'dur; her gate kendi compatible source türüne bağlanır ve Operations satırı uygulama kodu yerine geçirilmez.",
      "Initial generated JSON 8746793 B / 8424fb600ca8b4201c4696e5f270324c2bbcb4599eb144fcc72cec82d30728ea SHA-256, payload registry 4af72f53a7a204d5dbad3a317eb12c5602c2cff07e7989319afb084c6343e3a8 SHA-256'dır.",
      "Initial Code acceptance S389 production excerpt'ini complete run_qemu_s141_automatic_lifecycle_recovery öğesi olarak ve exact nested focus'u yalnız acquire_s389_production_scheduler_writer_access→drop(s389_writer_access) aralığı olarak doğruladı.",
      "Code source-order test complete S141 öğesinde iki ipc_kernel_call_and_wait saydı; S389 focus yalnız exact_reply.id + retry_message second CALL'ini içerdi, cancelled_reply.id + original message first CALL'ini ve acquire_s390 sembolünü içermedi.",
      "Initial website matrisi 703/703 PASS verdi; /tmp/aselsanos-s389-website-test-initial.log 65488 B / a58c957ae02b6f1484e8623d2c8df83b2a0afcfc3152aa5a75c5d0cb1b62cfca SHA-256'dır.",
      "Initial lint PASS logu 218 B / 79c084453e339ceb2efe76ed96d1d68be8ac51442957a7a048fd17dba3067ba2, TypeScript --noEmit exit 0 boş log 0 B / e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 ve build logu 1213 B / 280b7a0e0eb65621520ccb1710024d4ef942d6c8be5493980f775703fba3cb42 SHA-256'dır.",
      "Initial static build 24/24 page, 200 export file ve Timeline/yol-haritasi rotalarının her birinde 228 ayrı data-gate-policy kartı üretti.",
      "Initial publication öncesi S389 core policy 17295 karakter / 17880 UTF-8 byte, 84 evidence satırı, 4 terminal session ve 7 limitation taşır; full source/test kodu ayrıca Code kartında eksiksiz yayımlanır.",
      "Initial production/main deployment a3025aa2 ile 115 uploaded + 84 existing = 199 asset yayımladı; /tmp/aselsanos-s389-deploy-initial.log 1715 B / fd6f1eefae44bce7583226bfe75cc361d77dd2e621990433c5e7ef2ba6473bff SHA-256'dır.",
      "Initial cache-busted /code/ readback HTTP 200, 24552276 B / 5d33c7a46431eab82262f5001ff58cdce43db7b81e83ad46e3bca3c9736f916b SHA-256 ve yerel out ile raw byte-exact=true verdi.",
      "Initial cache-busted /operations/ readback HTTP 200, 14884791 B / 1c27010e6764b6f2d2124440e97ad27820ea331163a6b14f537b6748796dabd1 SHA-256 ve yerel out ile raw byte-exact=true verdi.",
      "Initial cache-busted /timeline/ readback HTTP 200, 6182813 B / fb6e106d9fde1d854b07fdcf04c7189db4936a5824fd4c30ec1a16912d768eda ve /yol-haritasi/ 6182561 B / ac48b1a90024563595446874f27fdeeca3554915416deee8e346af75e6315b7f SHA-256 ile yerel out'a raw byte-exact=true verdi.",
      "Initial live Code sayımı total=389, unique=389, pre-S328=327, S1=1, S327=1, S328=1, S388=1, S389=1 ve S390=0'dır; /code/ header'ı no-transform ve x-content-type-options=nosniff taşır.",
      "Initial custom-domain readback artifact root /tmp/aselsanos-s389-readback-initial.2JDsSl'dir; dört rota HTTP 200 ve all_raw_byte_exact_to_local_out=true olarak ölçüldü.",
      "Immutable a3025aa2.aselsan-microkernel.pages.dev probe'u connect timeout ile curl exit 28 / HTTP 000 verdi; custom-domain PASS sonucu immutable hostname doğrulaması diye yeniden etiketlenmez.",
      "Bu initial ölçüleri taşıyan payload ayrı evidence-sync production transaction'ında yayımlanacaktır; dönen final deployment kimliği self-reference oluşturmamak için yalnız project-status kapanışına yazılır.",
      "S389 için güç, SD kart, Mac kart erişimi, UART capture, raw validation, archive veya promotion işlemi yapılmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S389=NO.",
      "Bağlayıcı olmayan S389 projeksiyonu R1 S389–S419, R2 S444–S494, R3 S573+, risk aralığı S549–S599 ve merkez yaklaşık S574'tür; sıra veya ürün taahhüdü değildir.",
    ],
    commands: [
      "CARGO_INCREMENTAL=0 cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s389_qemu_s141_replacement_exact_ack_writer_guard_integration -- --test-threads=1",
      "run S389, S388, S319, S320, runtime_oom_lifecycle_recovery and runtime_oom_lower_el_fault_recovery serially",
      "run S238-S389 dependency list twice and normalize timing fields",
      "run filtered and unfiltered serial workspace audits",
      "run four fresh isolated AArch64 profiles",
      "CARGO_INCREMENTAL=0 make verify-qemu",
      "cargo fmt --all -- --check",
      "npm test && npm run lint && npx tsc --noEmit && npm run build",
      "npm run deploy",
      "cache-busted curl + cmp for /code/, /operations/, /timeline/ and /yol-haritasi/",
    ],
    terminalSessions: [
      {
        id: "g8l-s389-focused-source-contract",
        title: "S389 focused S141 replacement exact-ACK writer membership",
        commandLines: [
          "CARGO_INCREMENTAL=0 cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s389_qemu_s141_replacement_exact_ack_writer_guard_integration -- --test-threads=1",
        ],
        outputLines: [
          "initial result: compile RED; S389 module/source/service and production S141 replacement boundary missing",
          "first wired result: 47 PASS / 1 test-substring RED; product behavior unchanged",
          "final result: 48/48 PASS; exact second alias and owned ACK release order",
          "shared S247 gate: 44 guarded readers + 62/69 guarded writers; 7 writers open",
          "board-qemu fixture / board-rpi5 wrapper supported-profile intersection=0; provider authority=0",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8l-s389-selected-regression",
        title: "S389 selected S141 replacement and lifecycle regression",
        commandLines: [
          "run S389, S388, S319, S320, runtime_oom_lifecycle_recovery and runtime_oom_lower_el_fault_recovery serially",
        ],
        outputLines: [
          "final result: 6 groups / 140 passed / 0 failed",
          "S319/S320 remain model-level audits; S388 and S389 remain separate production memberships",
          "S141 automatic lifecycle recovery and S142 lower-EL recovery regressions both remain GREEN",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
      {
        id: "g8l-s389-full-acceptance",
        title:
          "S389 dependency, workspace, profiles, QEMU and format acceptance",
        commandLines: [
          "run S238-S389 dependency list twice and normalize timing fields",
          "run filtered and unfiltered serial workspace audits",
          "run four fresh isolated AArch64 profile builds",
          "CARGO_INCREMENTAL=0 make verify-qemu",
          "cargo fmt --all -- --check",
        ],
        outputLines: [
          "dependency 153 groups / 3811/3811 twice; normalized 32980-byte summaries are SHA-256 identical",
          "filtered workspace 352 groups / 5689 PASS / 7 filtered; unfiltered frozen-S96 remains RED at 5434 PASS / 1 fail",
          "four fresh profiles 4/4 exit 0; build-log and ELF identities measured separately; zero-warning claim=false",
          "QEMU W^X 31/31 + S130-S154 + S271 + IPC 20/20 + SEC5 PASS; not an S389 writer runtime observation",
          "final global rustfmt check exit 0 with empty output; post-format S319/S320/S389 PASS",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8l-s389-production-publication",
        title: "S389 Operations/Timeline/Code production publication",
        commandLines: [
          "npm test && npm run lint && npx tsc --noEmit && npm run build",
          "npm run deploy",
          "cache-busted curl + cmp for /code/, /operations/, /timeline/ and /yol-haritasi/",
        ],
        outputLines: [
          "initial website 703/703 PASS; lint PASS; TypeScript empty; static pages 24/24; export files=200",
          "initial registry S1-S389 389/389, 1124 excerpts; pre-S328 S1-S327 327/327; missing=none; duplicate=0; S390=0",
          "initial deployment a3025aa2; 115 upload + 84 existing; four custom-domain routes HTTP 200 and raw byte-exact=true",
          "live Code total/unique=389/389; pre-S328=327; S1/S327/S328/S388/S389=1; S390=0; no-transform/nosniff",
          "immutable deployment hostname curl exit 28 / HTTP 000; evidence-sync publication remains a separate transaction",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
    ],
    terminalSessionsNote:
      "S389 altmış ikinci production writer'ın dar kaynak entegrasyonudur. Yalnız S141 source-order second replacement exact-ACK CALL mutable scheduler aliası guarded'dır; source-order first crashed CALL, upstream crash/recovery hazırlığı ve downstream ACK/broker/cleanup/reclaim membership dışında kalır. Teknik kanıt GREEN, bütün scheduler exclusion ve ürün kabulü PARTIAL'dır.",
    limitations: [
      "Yedi production writer aynı shared gate dışında kaldığı için whole-scheduler exclusion ve provider authority açık kalır.",
      "Board-qemu S141 fixture ile board-rpi5-only S389 wrapper aynı supported profilde kesişmez; production writer runtime invocation/observation kanıtı yoktur.",
      "QEMU S141 kabulü automatic lifecycle recovery ürün senaryosunu doğrular, fakat RPi5-only writer lease'in runtime'da alındığını doğrulamaz.",
      "Source-order first crashed/cancelled S141 CALL ayrı S390 membership'i olarak açık kalır; S389 iki aliası tek range guard altında birleştirmez.",
      "S245 request tüketilmez, S244 admission yayınlanmaz ve provider authority kurulmaz.",
      "Generic SMP arbitration, transient-contention liveness/soak ve fiziksel RPi kabulü açık kalır.",
      "S389 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S389=NO.",
    ],
  },