S390 · QEMU S141 crashed-CALL production writer guard integration

/// S141 runtime acceptance: the exact supervisor task id is part of session
/// authority. Production task-exit observes the pre-ACK death after IPC
/// teardown and requeues the in-flight lease inside the broker lock; the
/// controller never invokes a recovery API. A fresh strict EL0 supervisor
/// replies normally, then parks until controller-side ACK commit/session close
/// and endpoint revocation wake it for a clean exit without second recovery.
#[cfg(feature = "board-qemu")]
unsafe fn run_qemu_s141_automatic_lifecycle_recovery(
    source_event: crate::mm::RuntimeOomEvent,
    baseline_free_frames: u64,
    baseline_active_allocations: usize,
) {
    use crate::elf::load_and_spawn_user_elf_from_boot_runtime_with_arg;
    use crate::elf_plan::{AddressRange, ElfLoadPolicy};
    use crate::mm::{RuntimeOomTransportError, RuntimeOomTransportEvent};
    use crate::ui::capability::{CapabilityRights, IpcMessage};
    use crate::userspace_binaries::{
        OOM_LIFECYCLE_CRASH_SUPERVISOR_BINARY, OOM_LIFECYCLE_RECOVERY_SUPERVISOR_BINARY,
    };

    const S141_EVENT_LABEL: u64 = 0x5331_3431;
    const S141_EXACT_ACK_LABEL: u64 = 0x4143_4b41;
    const S141_TIMEOUT_TICKS: u64 = 1 << 20;

    let controller_task = crate::task::current_task_id().expect("S141 controller task");
    let (crashed_domain, replacement_domain) = crate::mm::with_boot_runtime_memory(|memory| {
        Ok::<_, crate::mm::RuntimeAllocationError>((
            memory.register_domain(QEMU_LIFECYCLE_CRASH_OOM_SUPERVISOR_RUNTIME_DOMAIN_ID)?,
            memory.register_domain(QEMU_LIFECYCLE_RECOVERY_OOM_SUPERVISOR_RUNTIME_DOMAIN_ID)?,
        ))
    })
    .expect("S141 RuntimeMemory authority")
    .expect("S141 supervisor domain registration");

    let endpoint_authority =
        crate::ui::capability::mint_endpoint(controller_task, S141_EVENT_LABEL)
            .expect("S141 controller endpoint authority");
    let no_forbidden_ranges: [AddressRange; 0] = [];
    let crash_publication_guard = crate::arch::aarch64::IrqGuard::new();
    let crashed_supervisor = load_and_spawn_user_elf_from_boot_runtime_with_arg(
        "oom-lifecycle-exit-strict-el0-supervisor-elf",
        OOM_LIFECYCLE_CRASH_SUPERVISOR_BINARY,
        ElfLoadPolicy::new(
            AddressRange::new(0x0340_0000, 0x0341_0000),
            &no_forbidden_ranges,
            16,
        ),
        0x80c3_1000,
        4,
        0,
        8,
        crashed_domain,
        endpoint_authority.id,
    )
    .expect("S141 strict lifecycle-exit supervisor spawn");
    crate::ui::capability::grant_task_endpoint_to_task(
        endpoint_authority,
        controller_task,
        crashed_supervisor.task_id,
        CapabilityRights::ENDPOINT_RECV,
    )
    .expect("S141 crashed supervisor RECV grant");

    let event =
        RuntimeOomTransportEvent::try_new(1, source_event.id, source_event.oom_epoch, 0x5c01)
            .expect("S141 immutable event projection");
    let (crashed_session, old_lease) = crate::mm::with_runtime_oom_supervisor_transport(|broker| {
        let initial = broker.snapshot();
        assert_eq!(
            initial.instance_id,
            crate::mm::RUNTIME_OOM_PRODUCTION_TRANSPORT_INSTANCE_ID
        );
        assert_eq!(initial.queued, 0);
        assert_eq!(initial.active_supervisor_session, None);
        assert_eq!(initial.active_supervisor_task_id, None);
        broker.enqueue(event).expect("S141 event enqueue");
        let session = broker
            .begin_supervisor_session_for_task(crashed_supervisor.task_id)
            .expect("S141 task-bound crashed session");
        let lease = broker
            .claim_next_for_session(
                session,
                crate::arch::aarch64::exceptions::TICKS.load(Ordering::Acquire),
                S141_TIMEOUT_TICKS,
            )
            .expect("S141 task-bound crashed lease");
        (session, lease)
    });
    drop(crash_publication_guard);

    let crash_spawned = crate::mm::with_boot_runtime_memory(|memory| memory.audited_snapshot())
        .expect("S141 crash-spawn RuntimeMemory authority")
        .expect("S141 crash-spawn RuntimeMemory audit");
    assert_eq!(crash_spawned.pmm.free_frames, baseline_free_frames - 5);
    assert_eq!(
        crash_spawned.active_allocations,
        baseline_active_allocations + 5
    );
    kprintln!(
        "[K1-MEM2-S141] pre-ACK lifecycle-bound supervisor strict spawn PASS id={} pages={} domain={} endpoint={} owner={} TASK_BOUND=YES INITIAL_X0=YES W^X=YES",
        crashed_supervisor.task_id,
        crashed_supervisor.page_count,
        crashed_domain.id(),
        endpoint_authority.id,
        controller_task,
    );

    let message = IpcMessage {
        label: S141_EVENT_LABEL,
        badge: controller_task,
        data: [
            old_lease.event().sequence_id(),
            old_lease.event().source_event_id(),
            old_lease.event().oom_epoch(),
            old_lease.event().fingerprint(),
        ],
    };
    let cancelled_reply =
        crate::ui::capability::mint_reply_endpoint_for_call(controller_task, endpoint_authority.id)
            .expect("S141 cancelled reply mint");
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s390_irq_guard = crate::arch::aarch64::IrqGuard::new();
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s390_writer_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s390_qemu_s141_crashed_call_writer_guard_integration::acquire_s390_production_scheduler_writer_access()
        .unwrap_or_else(|error| {
            panic!(
                "S390 QEMU S141 crashed CALL scheduler writer guard failed closed: {:?}",
                error
            )
        });
    let cancelled_call = (&mut *core::ptr::addr_of_mut!(crate::task::scheduler::SCHEDULER))
        .ipc_kernel_call_and_wait(
            endpoint_authority.id,
            endpoint_authority.generation,
            cancelled_reply.id,
            message,
        );
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s390_writer_access);
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s390_irq_guard);
    assert_eq!(cancelled_call, Err(crate::ipc::IpcError::InvalidCapability));
    assert!(!crate::ui::capability::ENDPOINT_REGISTRY
        .lock()
        .iter()
        .any(|endpoint| endpoint.id == cancelled_reply.id));

    let automatically_recovered = crate::mm::with_runtime_oom_supervisor_transport(|broker| {
        let recovered = broker.snapshot();
        assert_eq!(recovered.pending, 1);
        assert_eq!(recovered.in_flight, 0);
        assert_eq!(recovered.supervisor_crashes, 1);
        assert_eq!(recovered.recovered_inflight, 1);
        assert_eq!(recovered.active_supervisor_session, None);
        assert_eq!(recovered.active_supervisor_task_id, None);
        assert_eq!(
            broker.acknowledge_exact(old_lease, old_lease.deadline_tick()),
            Err(RuntimeOomTransportError::StaleLease)
        );
        assert_eq!(broker.snapshot(), recovered);
        recovered
    });
    assert_eq!(automatically_recovered.recovered_inflight, 1);

    let mut crash_reclaimed = false;
    for _ in 0..256 {
        let quota = crate::mm::with_boot_runtime_memory(|memory| {
            memory.audited_domain_quota(crashed_domain)
        })
        .expect("S141 crashed supervisor quota authority")
        .expect("S141 crashed supervisor quota audit");
        if quota.allocated_frames == 0 {
            crash_reclaimed = true;
            break;
        }
        crate::task::yield_now();
    }
    assert!(
        crash_reclaimed,
        "S141 pre-ACK supervisor did not reach exact reclaim"
    );
    let _ = crate::task::service_deferred_current_runtime_oom()
        .expect("S141 crashed-supervisor later-stack reap");
    let post_crash = crate::mm::with_boot_runtime_memory(|memory| memory.audited_snapshot())
        .expect("S141 post-crash RuntimeMemory authority")
        .expect("S141 post-crash RuntimeMemory audit");
    assert_eq!(post_crash.pmm.free_frames, baseline_free_frames);
    assert_eq!(post_crash.active_allocations, baseline_active_allocations);

    let recovery_publication_guard = crate::arch::aarch64::IrqGuard::new();
    let replacement_supervisor = load_and_spawn_user_elf_from_boot_runtime_with_arg(
        "oom-lifecycle-recovery-strict-el0-supervisor-elf",
        OOM_LIFECYCLE_RECOVERY_SUPERVISOR_BINARY,
        ElfLoadPolicy::new(
            AddressRange::new(0x0360_0000, 0x0361_0000),
            &no_forbidden_ranges,
            16,
        ),
        0x80c4_1000,
        4,
        0,
        8,
        replacement_domain,
        endpoint_authority.id,
    )
    .expect("S141 strict lifecycle-recovery supervisor spawn");
    crate::ui::capability::grant_task_endpoint_to_task(
        endpoint_authority,
        controller_task,
        replacement_supervisor.task_id,
        CapabilityRights::ENDPOINT_RECV,
    )
    .expect("S141 replacement supervisor RECV grant");
    let (replacement_session, retry_lease) =
        crate::mm::with_runtime_oom_supervisor_transport(|broker| {
            let session = broker
                .begin_supervisor_session_for_task(replacement_supervisor.task_id)
                .expect("S141 task-bound replacement session");
            assert!(session.epoch() > crashed_session.epoch());
            let lease = broker
                .claim_next_for_session(
                    session,
                    crate::arch::aarch64::exceptions::TICKS.load(Ordering::Acquire),
                    S141_TIMEOUT_TICKS,
                )
                .expect("S141 automatically recovered retry lease");
            assert!(lease.delivery_epoch() > old_lease.delivery_epoch());
            assert_eq!(lease.event(), old_lease.event());
            (session, lease)
        });
    drop(recovery_publication_guard);

    let recovery_spawned = crate::mm::with_boot_runtime_memory(|memory| memory.audited_snapshot())
        .expect("S141 recovery-spawn RuntimeMemory authority")
        .expect("S141 recovery-spawn RuntimeMemory audit");
    assert_eq!(recovery_spawned.pmm.free_frames, baseline_free_frames - 5);
    assert_eq!(
        recovery_spawned.active_allocations,
        baseline_active_allocations + 5
    );
    kprintln!(
        "[K1-MEM2-S141] replacement lifecycle-bound supervisor strict spawn PASS id={} pages={} domain={} endpoint={} owner={} TASK_BOUND=YES HANDOFF=ENDPOINT_CLOSE INITIAL_X0=YES W^X=YES",
        replacement_supervisor.task_id,
        replacement_supervisor.page_count,
        replacement_domain.id(),
        endpoint_authority.id,
        controller_task,
    );

    let retry_message = IpcMessage {
        label: S141_EVENT_LABEL,
        badge: controller_task,
        data: [
            retry_lease.event().sequence_id(),
            retry_lease.event().source_event_id(),
            retry_lease.event().oom_epoch(),
            retry_lease.event().fingerprint(),
        ],
    };
    let exact_reply =
        crate::ui::capability::mint_reply_endpoint_for_call(controller_task, endpoint_authority.id)
            .expect("S141 exact reply mint");
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s389_irq_guard = crate::arch::aarch64::IrqGuard::new();
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s389_writer_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s389_qemu_s141_replacement_exact_ack_writer_guard_integration::acquire_s389_production_scheduler_writer_access()
        .unwrap_or_else(|error| {
            panic!(
                "S389 QEMU S141 replacement exact-ACK scheduler writer guard failed closed: {:?}",
                error
            )
        });
    let exact_ack = (&mut *core::ptr::addr_of_mut!(crate::task::scheduler::SCHEDULER))
        .ipc_kernel_call_and_wait(
            endpoint_authority.id,
            endpoint_authority.generation,
            exact_reply.id,
            retry_message,
        )
        .expect("S141 replacement strict EL0 exact ACK");
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s389_writer_access);
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s389_irq_guard);
    assert_eq!(exact_ack.label, S141_EXACT_ACK_LABEL);
    assert_eq!(exact_ack.badge, replacement_supervisor.task_id);
    assert_eq!(exact_ack.data, retry_message.data);
    crate::mm::with_runtime_oom_supervisor_transport(|broker| {
        assert_eq!(
            broker.acknowledge_exact(
                retry_lease,
                crate::arch::aarch64::exceptions::TICKS.load(Ordering::Acquire),
            ),
            Ok(event)
        );
        broker
            .close_supervisor_session(replacement_session)
            .expect("S141 replacement session close");
    });

    // The replacement parks on a second RECV after replying. Revoking the
    // controller-owned root endpoint wakes it only after broker ACK and
    // session close are durable, so its normal exit is an unrelated no-op.
    let endpoint_cleanup = crate::ui::capability::teardown_task_ipc_lifecycle(controller_task)
        .expect("S141 controller endpoint cleanup");
    assert_eq!(endpoint_cleanup.owned_endpoints, 1);
    assert_eq!(endpoint_cleanup.drained_calls, 0);
    assert_eq!(endpoint_cleanup.cancelled_responder_calls, 0);

    let mut replacement_reclaimed = false;
    for _ in 0..256 {
        let quota = crate::mm::with_boot_runtime_memory(|memory| {
            memory.audited_domain_quota(replacement_domain)
        })
        .expect("S141 replacement supervisor quota authority")
        .expect("S141 replacement supervisor quota audit");
        if quota.allocated_frames == 0 {
            replacement_reclaimed = true;
            break;
        }
        crate::task::yield_now();
    }
    assert!(
        replacement_reclaimed,
        "S141 replacement supervisor did not reach exact reclaim"
    );
    let _ = crate::task::service_deferred_current_runtime_oom()
        .expect("S141 replacement-supervisor later-stack reap");

    let final_snapshot = crate::mm::with_boot_runtime_memory(|memory| memory.audited_snapshot())
        .expect("S141 final RuntimeMemory authority")
        .expect("S141 final RuntimeMemory audit");
    assert_eq!(final_snapshot.pmm.free_frames, baseline_free_frames);
    assert_eq!(
        final_snapshot.active_allocations,
        baseline_active_allocations
    );
    let final_broker = crate::mm::with_runtime_oom_supervisor_transport(|broker| broker.snapshot());
    assert_eq!(final_broker.queued, 0);
    assert_eq!(final_broker.pending, 0);
    assert_eq!(final_broker.in_flight, 0);
    assert_eq!(final_broker.acknowledged, 1);
    assert_eq!(final_broker.supervisor_sessions_started, 2);
    assert_eq!(final_broker.supervisor_crashes, 1);
    assert_eq!(final_broker.recovered_inflight, 1);
    assert_eq!(final_broker.active_supervisor_session, None);
    assert_eq!(final_broker.active_supervisor_task_id, None);
    assert!(!crate::ui::capability::ENDPOINT_REGISTRY
        .lock()
        .iter()
        .any(|endpoint| endpoint.id == endpoint_authority.id
            || endpoint.id == exact_reply.id
            || endpoint.id == cancelled_reply.id));

    kprintln!(
        "[K1-MEM2-S141] source_event={} endpoint={} crashed_supervisor={} replacement_supervisor={} crashed_domain={} replacement_domain={} SESSION=1->2 TASK_BOUND=YES AUTOMATIC_LIFECYCLE_RECOVERY=YES RECOVERY_CALLER=TASK_EXIT CONTROLLER_RECOVERY_CALLS=0 PRE_ACK_EXIT=INVALID_CAPABILITY RECOVERED_INFLIGHT=1 OLD_LEASE_ACK=STALE RETRY_ACK=EXACT RESTARTED_EL0_ACK=YES REPLACEMENT_HANDOFF=ENDPOINT_CLOSE NORMAL_EXIT_RECOVERY=NONE REPLY_ONESHOT=1/1 BROKER_DRAINED=YES SESSIONS=2 CRASHES=1 CRASH_RECLAIM=5 RESTART_RECLAIM=5 OWNER_EP_CLEANUP=1 free={}->{}->{}->{}->{} active={}->{}->{}->{}->{} KERNEL_DIRECT_ACK=NO EXECUTOR=PASS",
        source_event.id,
        endpoint_authority.id,
        crashed_supervisor.task_id,
        replacement_supervisor.task_id,
        crashed_domain.id(),
        replacement_domain.id(),
        baseline_free_frames,
        crash_spawned.pmm.free_frames,
        post_crash.pmm.free_frames,
        recovery_spawned.pmm.free_frames,
        final_snapshot.pmm.free_frames,
        baseline_active_allocations,
        crash_spawned.active_allocations,
        post_crash.active_allocations,
        recovery_spawned.active_allocations,
        final_snapshot.active_allocations,
    );
    run_qemu_s142_lower_el_fault_recovery(
        source_event,
        final_snapshot.pmm.free_frames,
        final_snapshot.active_allocations,
    );
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn acquire_s390_production_scheduler_writer_access(
) -> Result<G8lS390ProductionSchedulerWriterAccess, G8lS247WholeSchedulerAccessError> {
    let caller_cpu =
        crate::percpu::try_current_cpu_id().ok_or(G8lS247WholeSchedulerAccessError::InvalidCpu)?;
    if caller_cpu != crate::g8l_runtime_contract::CPU0 {
        return Err(G8lS247WholeSchedulerAccessError::InvalidCpu);
    }
    let access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s246_whole_scheduler_read_access_guard::S247_PRODUCTION_WHOLE_SCHEDULER_ACCESS_GATE
        .try_acquire_exclusive_for_valid_cpu(caller_cpu)?;
    Ok(G8lS390ProductionSchedulerWriterAccess { _access: access })
}

#[test]
fn boundary_has_exactly_one_s390_acquire_and_success_release_pair() {
    let boundary = s141_boundary();
    assert_eq!(
        boundary
            .matches("acquire_s390_production_scheduler_writer_access")
            .count(),
        1
    );
    assert_eq!(boundary.matches("drop(s390_writer_access)").count(), 1);
    assert_eq!(boundary.matches("drop(s390_irq_guard)").count(), 1);
}

  {
    id: "g8l-s390-qemu-s141-crashed-call-writer-guard-integration-partial",
    date: "2026-08-29",
    sequence: 390,
    status: "passed",
    umbrella_status: "partial",
    title: "S390 · QEMU S141 crashed-CALL production writer guard integration",
    summary:
      "S390, run_qemu_s141_automatic_lifecycle_recovery içindeki iki explicit mutable scheduler aliasından source-order önce gelen crashed-supervisor CALL sınırını tek başına production guard'a bağlar. Nonzero controller, controller-owned normal Endpoint SEND authority, strict lifecycle-exit supervisor spawn ve exact RECV grant, immutable broker event, task-bound crashed session/old lease, crash-publication IRQ release, RuntimePmm allocation snapshot, immutable original message ve linked cancelled reply writer'dan önce tamamlanır. Dedicated S390 IRQ guard ardından gerçek per-CPU kimliğiyle CPU0-only exclusive writer, S389 ve 44 production reader'ın kullandığı aynı statik S247 state word üzerinde alınır. Exact tek mutable SCHEDULER aliası yalnız endpoint id/generation, cancelled-reply id ve immutable message ile source-order first ipc_kernel_call_and_wait çağrısını kapsar. Owned cancelled_call önce writer, sonra IRQ release sınırını geçer; exact InvalidCapability ve cancelled-reply retirement ancak iki release sonrasında doğrulanır. Automatic lifecycle recovery, old-lease StaleLease reddi, crashed-supervisor exact reclaim, RuntimePmm baseline ve ayrı S389 replacement exact-ACK transaction'ı downstream'da kalır. Tarihsel S320 crashed-CALL ve S319 replacement audit'leri model-only'dir. Guarded writer 63/69, açık writer 6, provider authority 0 ve whole-scheduler exclusion false'dur. S141 fixture board-qemu, production wrapper RPi5-only olduğundan supported-profile runtime observation=0 açıkça korunur; sıradaki ayrı kapı S391 QEMU S140 replacement exact-ACK CALL'dir.",
    evidence: [
      "Canonical focused test S390 modülü, kernel/simulation registration'ı, CPU1 coverage service'i ve production S141 crashed-CALL membership'i yokken compile RED verdi; tarihsel S320 authority audit'i production entegrasyonu yerine geçirilmedi.",
      "İlk RED exit 101 verdi; /tmp/aselsanos-s390-initial-red.log 2063 B / fad6b2e9faee3268bfadc9076f334b786a9ce3e988b1c2dedbac499355320994 SHA-256'dır.",
      "RED exact iki eksikliği gösterdi: S390 module include_str dosyası yoktu ve simulation crate uzun S390 modül import'unu çözümleyemedi; var olan S389 veya S335–S400 range facade otomatik PASS sayılmadı.",
      "İlk production-wired odak koşusu doğrudan 48/48 PASS verdi; /tmp/aselsanos-s390-first-wired.log 3950 B / c78606c90fb68d4623d4643663c9dfa72d14010b7066c8ab3d9bfea2bf050b40 SHA-256'dır.",
      "Final canonical focused koşu 48/48 PASS verdi; /tmp/aselsanos-s390-focused-green.log 3846 B / b3e456db2ad264321eb035d1a5cfe3fb093198cff76f23a56acab4e5e32e0ac0 SHA-256'dır.",
      "S390 modülü typed S389 preflight outcome'unu yeniden doğrular; inherited 44 reader + 62 guarded writer + 7 open writer snapshot'ı saparsa InventoryDrift ile fail-closed kapanır.",
      "S390 başarı outcome'u SixtyThirdWriterGuardedAwaitingRemaining'dir ve exact 44 guarded reader + 63/69 guarded writer + 6 open writer envanterini sabitler.",
      "Outcome request id, reader/writer/open sayıları, S141 crashed transaction, mutable alias, upstream authority/message/reply nesneleri, IRQ/CALL, downstream recovery/reclaim/S389 sınırları ve runtime-observation alanlarını typed olarak raporlar.",
      'Production wrapper exact all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5") cfg kesişimindedir; host executor veya board-qemu fixture production runtime invocation diye sunulmaz.',
      "acquire_s390_production_scheduler_writer_access gerçek try_current_cpu_id sonucunu kullanır; caller-supplied production CPU parametresi yoktur ve CPU0 dışı mutation callback'inden önce InvalidCpu ile kapanır.",
      "Writer lease S247_PRODUCTION_WHOLE_SCHEDULER_ACCESS_GATE üzerinde try_acquire_exclusive_for_valid_cpu ile alınır; S390 yeni static, ikinci state word veya ayrı exclusion domain yaratmaz.",
      "Host executor callback'i exact bir kez çağırır; canlı reader writer'ı, canlı writer ikinci writer'ı ve yeni reader'ı aynı state word üzerinde reddeder; callback error RAII lease'ini exact bırakır.",
      "S389 ve S390 executor token'ları aynı shared gate üzerinde monoton ve ayrıdır; iki kapı tek transaction, range dispatcher veya toplu S335–S400 facade membership'i değildir.",
      "Production main.rs envanterinde S141 crashed CALL source-order positions[6], yani 17 explicit main aliasının yedincisidir; S390 yalnız bu aliası sahiplenir.",
      "Aynı run_qemu_s141_automatic_lifecycle_recovery öğesinde exact iki mutable scheduler aliası korunur: source-order first crashed/cancelled CALL S390, source-order second replacement exact-ACK CALL S389 guarded'dır.",
      "Controller current_task_id üzerinden nonzero alınır ve normal endpoint controller adına mint edilir; endpoint authority id/generation writer'a owned scalar girdiler olarak taşınır.",
      "Crashed supervisor ayrı RuntimeMemory domain'inde strict lifecycle-exit ELF olarak spawn edilir ve exact ENDPOINT_RECV authority writer sınırından önce grant edilir.",
      "Immutable RuntimeOomTransportEvent broker'a enqueue edilir; crashed session ile old lease exact crashed-supervisor task identity'sine bağlanır.",
      "crash_publication_guard task/session/lease publication tamamlandıktan sonra explicit bırakılır; dedicated S390 IRQ guard bununla nested tutulmaz.",
      "Crash-spawn RuntimeMemory snapshot'ı baseline free frame -5 ve active allocation +5 değerlerini writer acquisition'dan önce doğrular.",
      "Original message old_lease event sequence/source/epoch/fingerprint tuple'ından immutable kurulur; writer message içeriğini yeniden oluşturmaz veya mutate etmez.",
      "cancelled_reply capability exact controller/endpoint ilişkisiyle writer'dan önce mint edilir; reply id S390 CALL'e owned scalar olarak aktarılır.",
      "Dedicated s390_irq_guard writer acquire'dan önce kurulur; acquire_s390_production_scheduler_writer_access, drop(s390_writer_access) ve drop(s390_irq_guard) exact birer kez görünür.",
      "Exact mutable alias ipc_kernel_call_and_wait(endpoint_authority.id, endpoint_authority.generation, cancelled_reply.id, message) çağrısını bir kez yapar.",
      "CALL terminal sonucu borrowed Scheduler referansı dışarı taşınmadan owned cancelled_call değerine alınır; guard release sonrasında Scheduler üzerinden sonuç okunmaz.",
      "drop(s390_writer_access), drop(s390_irq_guard) ve assert_eq!(cancelled_call, Err(InvalidCapability)) kontrolleri bu kesin source sırasındadır.",
      "Exact InvalidCapability dışında başarı ACK'i veya farklı IPC error kabul edilmez; crashed supervisor'ın pre-ACK exit sözleşmesi korunur.",
      "Cancelled reply registry yokluk kontrolü yalnız iki release ve exact terminal-result doğrulamasından sonra çalışır; endpoint registry lock S390 lease süresini büyütmez.",
      "Automatic lifecycle recovery pending=1, in_flight=0, crashes=1, recovered_inflight=1 ve active session/task=None snapshot'ını üretir; controller manual recovery API çağırmaz.",
      "Old lease exact deadline tick ile acknowledge edilmeye çalışıldığında yalnız StaleLease kabul edilir ve broker snapshot'ı unchanged kalır.",
      "Crashed supervisor domain quota 256 bounded yield içinde allocated_frames=0'a döner; deferred later-stack service sonrasında RuntimePmm baseline exact geri gelir.",
      "Fresh replacement supervisor spawn, strict RECV grant, yeni session/retry lease ve recovery publication S390 release'inden sonra başlar; first CALL lease'i replacement hazırlığına taşınmaz.",
      "S389 replacement exact-ACK acquire ve ikinci mutable alias S390'dan downstream ve ayrı kalır; S390 modülü acquire_s389 çağırmaz.",
      "Replacement ACK label/badge/data, broker acknowledge/session close, endpoint-close handoff, replacement reclaim ve final drain S390 membership'inin parçası değildir.",
      "Scheduler helper aynı IRQ/IPC transaction altında caller SEND authority, normal Endpoint object ve linked one-shot reply ilişkisini commit'ten önce yeniden doğrular.",
      "Optional receiver authority/generation ve exact receive deadline ile ready queue, blocked call, reply table ve endpoint queue kapasitesi CALL publish öncesinde fail-closed sınanır.",
      "CALL envelope publish, caller context park ve optional immediate receiver delivery aynı helper transaction'ındadır; transaction release edilmeden context switch yapılmaz.",
      "Continuation transaction release ve resume sonrasında aynı caller task'ı bulur ve yalnız owned IpcMessage veya exact stored IPC error terminal sonucunu yeniden kurar.",
      "Focused source testi complete run_qemu_s141_automatic_lifecycle_recovery Rust öğesini ve exact S390 acquire→single mutable alias→CALL→writer drop nested focus'unu birlikte doğrular.",
      "Focused test complete S141 öğesinde exact iki mutable alias sayar, S390 focus'unda yalnız first aliası ve tek ipc_kernel_call_and_wait görür.",
      "Argument-forwarding testi endpoint_authority.id, endpoint_authority.generation, cancelled_reply.id ve message değerlerinin exact first CALL'e eksiksiz aktarıldığını doğrular.",
      "Focused test exact_reply.id ve retry_message'in S390 focus'una girmediğini; cancelled_reply.id ile original message'in ise girdiğini ayrı assertion'larla sabitler.",
      "Focused grup request yokken Idle, exact pending request ile SixtyThirdWriterGuardedAwaitingRemaining ve yanlış CPU'da inherited S389 hatasını ayrı test eder.",
      "S245 request preflight sonrasında state.pending_request_id()==Some(1) kalır; take, publish, consume veya authority promotion yapılmaz.",
      "Reader-vs-writer, writer-vs-writer, nested reader/writer, callback-error release ve exact-once callback yolları birbirinden bağımsız test edilir.",
      "Production-only sembollerin tamamı aynı RPi5 AArch64 bare-metal cfg'sine bağlıdır; hostta sahte yarım production yolu oluşturulmaz.",
      "S390 modül kaynak testi provider constructor, S244 publisher ve request-state take adlarını reddeder; provider authority=0 ve exclusion=false kaynak yüzeyiyle korunur.",
      "Kernel main ve simulation lib registration'ları exact uzun S390 modül adıyla ayrı doğrulanır; sıra tablosundaki model satırı production membership yerine geçirilmez.",
      "CPU1 coverage service exceptions.rs içinde S389 service çağrısından sonra ve tarihsel S242 consumer'dan önce çalışır; mutable SCHEDULER veya S390 acquire çağırmaz.",
      "Tarihsel S320 crashed-CALL audit'i ve S319 replacement audit'i model-level kalır; production S389 replacement membership'i de ayrı prior source unit'tir.",
      "S391 acquire sembolü S390 modülünde ve guarded focus'ta yoktur; QEMU S140 replacement exact-ACK CALL sonraki kapı olarak açık kalır.",
      "İlk selected regression tarihsel S320'nin eski inline assert_eq!(CALL, error) spelling assertion'ını 14/15 RED yakaladı; S390 product kodu bu nedenle değiştirilmedi.",
      "S320 assertion'ı exact envelope ile acquire < CALL < writer drop < IRQ drop < InvalidCapability < reply absence sırasını doğrulayacak biçimde güncellendi; authority veya error koşulu gevşetilmedi.",
      "Düzeltilen S320 target 15/15 PASS verdi; /tmp/aselsanos-s390-s320-regression-fix.log 1799 B / 9235308158df140b9011b50f931e5050b2351644d1ac4db38bcd552933e6329d SHA-256'dır.",
      "Final selected regression S390, S389, tarihsel S320/S319, runtime_oom_lifecycle_recovery ve runtime_oom_lower_el_fault_recovery ile 6 grup / 140 PASS / 0 fail verdi.",
      "Selected log /tmp/aselsanos-s390-selected.log 13287 B / 547cfdd4ce5325e4ba8d67354f6303267e598904c71f38b94bf22b683f10983c SHA-256'dır.",
      "S238–S389 dependency hedef listesi byte-for-byte korunup yalnız S390 sona eklendi; iki bağımsız seri koşu 154 grup / 3859/3859 PASS verdi.",
      "Dependency timing-normalized ve LC_ALL=C sıralı özetlerin her biri 33195 B / 32ff642599e749e1d286848f0d945f600d8f9e1c5ef9756ffa751e0cac441643 SHA-256 ile byte-exact eşittir.",
      "Dependency artifact root /tmp/aselsanos-s390-dependency.fBPRpt; raw run1 362009 B / 69e56a556d803e3fbcf3a5d48c5595d2ee8019ec6450082f042a90e3ae647318 ve run2 346559 B / ac68968d54dfa8ac7e42b75d74714a2aa4fd1849182d7970f4f5fe28f66f282b'dir.",
      "Yalnız finished in süre suffix'i normalization kapsamındadır; test isimleri, hedef sırası, pass/fail adetleri ve durum payload'ı canonical özette kalır.",
      "Yedi exact frozen assertion dışındaki serial workspace 353 result group / 5737 PASS / 0 fail / 7 filtered verdi.",
      "Filtered workspace raw log 561550 B / 359bc3a012b38eade5b078a9a5cdf514fd69715295e2c99eef72e29fc53f3b69 ve summary 33417 B / 882733cb9c67bc6d70a7ba9a2fd837534805448c881ecc69abd3e2d35b79b923'tür.",
      "Filtresiz workspace exit 101 ile yalnız frozen S96 wiring_does_not_mutate_timer_gic_boot_or_expand_runtime_scope assertion'ında durdu; 306 result group / 5482 PASS / 1 fail ve global workspace GREEN claimed=false'dur.",
      "Filtresiz raw log 529900 B / ea445a1bf6a3351632acf96bbc6f9da3a586375cfacf5b93904ea2976113edeb ve summary 28998 B / 8c29e4f8af50157bff05f142c924c45c436413704b960e69ae866acee761e169'dir.",
      "Workspace artifact root /tmp/aselsanos-s390-workspace.Bqe3iY'dir; yedi filtre adı S389 kabulünden değiştirilmeden korunur.",
      "Dört fresh canonical AArch64 profil kernel çalışma dizininden CARGO_INCREMENTAL=0, explicit feature ve birbirinden ayrı target dizinleriyle 4/4 exit 0 verdi; zero-warning iddiası yoktur.",
      "Fresh board-qemu logu 111882 B / a8646e54df9076389b1f0127b66285f57035c4a67f6b72f26854a97733f5b145 ve 293 warning header; ELF 16813648 B / 7819e8546e07daf010b6ea79217f8c6874278988f3a4b6599f7872ced3c50bad'dır.",
      "Fresh board-rpi4 logu 150623 B / 58c21c1d5bf8354e7cac45a0ab343fe86a937c21cf5f621ed5d5f9bf13daed21 ve 391 warning header; ELF 11925440 B / 438a6e49d4722467709058135f40950d07dc53b233118b5ec048f1bcd93f7181'dir.",
      "Fresh board-rpi5 logu 660994 B / 2863170c836c92410e12169e5a2cf7428e2b9dbb56ed4670023592601aa0025b ve 1514 warning header; ELF 15344528 B / 6eb7435b3d46d663dfedbe1f3a1c537a7f55a9a5fba4288d99b3359fbcfadaf5'dir.",
      "Fresh board-rpi5+smp logu 660936 B / 239fc1c3f05bea29401e4fb9441e331311f9ddb23fc6844b7f03acb7bcc660be ve 1514 warning header; ELF 15366104 B / add3aa99cb36dba4260132cb6243d7d0576b4fa71ceaba53c3c69537da0b45fe'dir.",
      "Dört profil /tmp/aselsanos-s390-profiles.ihQ7UA altında tutulur; build log ve ELF byte/hash ölçüleri birbirine karıştırılmaz.",
      "CARGO_INCREMENTAL=0 make verify-qemu 116354 B / 0a8064433528be664eecae5ae327648579f467a354608ae7c8d6dc3879950ca3 SHA-256 ile strict ELF W^X 31/31, S130–S154 + S271, IPC 20/20 ve scheduler SEC5 PASS verdi.",
      "QEMU logunda S141 task-bound automatic lifecycle recovery/exact retry senaryosu gözlendi; board-qemu guest RPi5-only S390 lease'ini compile etmediği için bu writer runtime observation değildir.",
      "Final cargo fmt --all -- --check exit 0 ve boş çıktı verdi; 0 B / e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 SHA-256'dır.",
      "S390 proof owned boundary, coverage, TDD, historical reconciliation, selected regression, dependency reproducibility, workspace, profiles, QEMU/format ve Code publication contract bölümlerini ayrı taşır.",
      "Code yayın hedefi S1–S390 390/390 ayrı kapıdır; kullanıcının özellikle istediği S328 öncesi S1–S327 aralığı 327/327 tekil kalmalı, missing=none ve duplicate=0 olmalıdır.",
      "S390 Code kartı complete run_qemu_s141_automatic_lifecycle_recovery Rust öğesini, yalnız first crashed CALL'e ait nested acquire→release focus'unu, complete S390 guard modülünü, complete 48-test target'ını, proof'u ve complete Operations object'ini yayımlar.",
      "Complete production excerpt iki S141 CALL'i bağlamıyla gösterirken nested focus yalnız s390_writer_access acquisition'dan drop(s390_writer_access)'e kadar kesilir; S389 second replacement membership bu focus'a katılmaz.",
      "S1, S327, S328, S389 ve S390 kartlarının exact birer kez görünmesi; S391'in pre-publish edilmemesi website kabulünde sayılacaktır.",
      "Her Code kartı mappingStrategy, kind, sourcePath, complete excerpt, satır aralığı ve SHA-256 kimliği taşır; test komutu asıl uygulama/model kodunun yerine geçirilmez.",
      "S390 için güç, SD kart, Mac kart erişimi, UART capture, raw validation, archive veya promotion işlemi yapılmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S390=NO.",
      "Bağlayıcı olmayan S390 projeksiyonu R1 S390–S420, R2 S445–S495, R3 S574+, risk aralığı S550–S600 ve merkez yaklaşık S575'tir; sıra veya ürün taahhüdü değildir.",
      "İlk deterministic Code registry S1–S390 aralığında 390/390 unique kapı ve 1128 exact excerpt üretti; missing=none, duplicate=0 ve özellikle kullanıcının istediği S328 öncesi S1–S327 aralığı 327/327 ayrı karttır.",
      "İlk registry boundary sayımı S1=1, S327=1, S328=1, S389=1, S390=1 ve pre-publish S391=0 verdi; hiçbir önceki kapı S390 kartına katılmadı.",
      "İlk registry mapping dağılımı 63 writer-guard + 225 focused-test + 94 command-contract + 8 operation-record = 390'dır; test komutu uygulama kodu yerine geçirilmez.",
      "İlk generated JSON 8797516 B / 64f7188e82cf2381d7bb7cd2b79fb6030ebeaa0cb5dfd320f9eacd5117fe8c00 dosya SHA-256 ve 995523b506c0a6fc3a82d1781c84e9fec552352cb04dffe143562ef2eb123593 registry SHA-256 taşıdı.",
      "İlk website kabulü 706/706 test PASS, lint exit 0, TypeScript exit 0 ve boş çıktı, 24/24 static page PASS verdi; export 200 dosyadır.",
      "Website kabul logları test için 65787 B / 854a41b01d1efeb437308a3bef888743d32b64f6da4120858cfebaa932ac0199, lint için 218 B / 79c084453e339ceb2efe76ed96d1d68be8ac51442957a7a048fd17dba3067ba2, TypeScript için 0 B / e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 ve build için 1213 B / 8294c0811a6ac8fce397ba5ec317dc3ee9ed1f9f7cf55ff41b25f70aeafd8441 SHA-256'dır.",
      "Timeline ve yol-haritasi ilk export'unda ayrı ayrı 229 data-gate-policy kartı vardır; S390 kartı S389'dan önce gelir ve önceki kartların hiçbiri birleştirilmez.",
      "İlk yayın öncesi S390 core policy 16913 karakter / 17475 UTF-8 byte, 82 evidence, 3 terminal session ve 8 limitation taşıdı; 5965 karakter / 6122 byte S324 yoğunluk tabanının açıkça üstündedir.",
      "İlk production/main deployment 06608e4c ile 115 upload + 84 existing = 199 asset ve ayrı _headers yayını olarak tamamlandı; deploy logu 1823 B / 9b6dd28d80ad00bdf6066c97edb9f11a74d5edcb6754c348ba12a5d9f2343023 SHA-256'dır.",
      "Cache-busted custom-domain /code/ readback HTTP 200, 24676885 B / 126173bbb74321b99cf65b949ede61d83d61e2c17ceed13d8d6e7bdccfec266d SHA-256 ve post-deploy local out ile byte-exact=true verdi.",
      "Cache-busted custom-domain /operations/ readback HTTP 200, 15015172 B / 5a7e090f18b296fd19933067a8c81ae47ae80654f59c9c93a4f0672b18444dec SHA-256 ve post-deploy local out ile byte-exact=true verdi.",
      "Cache-busted custom-domain /timeline/ readback HTTP 200, 6259054 B / b5d54e1926ae610b44b655b6e4e8bddb322905aff79402711498ddfa932e3e1e SHA-256; /yol-haritasi/ HTTP 200, 6258802 B / b39e80fa15001c118e82ec672db653e8e9fa6e50a620938fda0d2b7d6d43858d SHA-256 ve ikisi de post-deploy local out ile byte-exact=true verdi.",
      "Canlı /code/ sayımı total=390, unique=390, pre-S328=327, S1/S327/S328/S389/S390 exact birer ve S391=0'dır; response cache-control no-transform ve x-content-type-options nosniff taşır.",
      "İlk readback artifact root /tmp/aselsanos-s390-readback-initial.hrbV4b'dir; dört custom-domain route'un gövde ve header kayıtlarını ayrı tutar.",
      "Immutable 06608e4c.aselsan-microkernel.pages.dev /code/ probe'u 30 saniyede curl exit 28 / HTTP 000 verdi; bu hostname doğrulandı sayılmaz ve yalnız custom-domain byte-exact kanıtı kabul edilir.",
      "İlk yayın ölçülerini içeren evidence-sync payload ayrı production/main transaction'ında yayımlanır; dönen final deployment kimliği yalnız project-status kapanışında tutulur ve self-referential sonsuz yayın zinciri kurulmaz.",
    ],
    commands: [
      "CARGO_INCREMENTAL=0 cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s390_qemu_s141_crashed_call_writer_guard_integration -- --test-threads=1",
      "run S390, S389, S320, S319, runtime_oom_lifecycle_recovery and runtime_oom_lower_el_fault_recovery serially",
      "run S238-S390 dependency list twice and normalize timing fields",
      "run filtered and unfiltered serial workspace audits",
      "run four fresh isolated AArch64 profile builds",
      "CARGO_INCREMENTAL=0 make verify-qemu",
      "cargo fmt --all -- --check",
      "npm run code:generate && npm run code:check",
      "npm test && npm run lint && npx tsc --noEmit && npm run build",
      "npm run deploy",
      "cache-busted curl + cmp for /code/, /operations/, /timeline/ and /yol-haritasi/",
    ],
    terminalSessions: [
      {
        id: "g8l-s390-focused-source-contract",
        title: "S390 focused S141 crashed-CALL writer membership",
        commandLines: [
          "CARGO_INCREMENTAL=0 cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s390_qemu_s141_crashed_call_writer_guard_integration -- --test-threads=1",
        ],
        outputLines: [
          "initial result: compile RED; S390 module/source/service and production S141 first-call boundary missing",
          "first wired result: 48/48 PASS; exact first alias and owned InvalidCapability release order",
          "final result: 48/48 PASS; no production correction required after first wiring",
          "shared S247 gate: 44 guarded readers + 63/69 guarded writers; 6 writers open",
          "board-qemu fixture / board-rpi5 wrapper supported-profile intersection=0; provider authority=0",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8l-s390-selected-regression",
        title: "S390 selected S141 crash/replacement and lifecycle regression",
        commandLines: [
          "run S390, S389, S320, S319, runtime_oom_lifecycle_recovery and runtime_oom_lower_el_fault_recovery serially",
        ],
        outputLines: [
          "initial historical S320 source assertion: 14/15 RED; old inline CALL/error spelling",
          "S320 exact envelope + acquire/CALL/writer-drop/IRQ-drop/InvalidCapability/reply-absence order preserved",
          "final result: 6 groups / 140 passed / 0 failed",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8l-s390-full-acceptance",
        title:
          "S390 dependency, workspace, profiles, QEMU and format acceptance",
        commandLines: [
          "run S238-S390 dependency list twice and normalize timing fields",
          "run filtered and unfiltered serial workspace audits",
          "run four fresh isolated AArch64 profile builds",
          "CARGO_INCREMENTAL=0 make verify-qemu",
          "cargo fmt --all -- --check",
        ],
        outputLines: [
          "dependency 154 groups / 3859/3859 twice; normalized 33195-byte summaries are SHA-256 identical",
          "filtered workspace 353 groups / 5737 PASS / 7 filtered; unfiltered frozen-S96 remains RED at 5482 PASS / 1 fail",
          "four fresh profiles 4/4 exit 0; build-log and ELF identities measured separately; zero-warning claim=false",
          "QEMU W^X 31/31 + S130-S154 + S271 + IPC 20/20 + SEC5 PASS; not an S390 writer runtime observation",
          "final global rustfmt check exit 0 with empty output",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8l-s390-production-publication",
        title:
          "S390 Operations, Timeline, roadmap and Code production publication",
        commandLines: [
          "npm run code:generate && npm run code:check",
          "npm test && npm run lint && npx tsc --noEmit && npm run build",
          "npm run deploy",
          "cache-busted curl + cmp for /code/, /operations/, /timeline/ and /yol-haritasi/",
        ],
        outputLines: [
          "initial registry S1-S390 390/390, 1128 excerpts; pre-S328 S1-S327 327/327; missing=none; duplicate=0; S391=0",
          "mapping 63 writer-guard + 225 focused-test + 94 command-contract + 8 operation-record = 390",
          "website 706/706 PASS; lint PASS; TypeScript empty; static pages 24/24; export files=200; Timeline/roadmap cards=229 each",
          "pre-publication S390 policy 16913 chars / 17475 bytes; evidence=82; sessions=3; limitations=8; S324 density floor exceeded",
          "initial production/main deployment 06608e4c; 115 uploaded + 84 existing; custom-domain four-route HTTP 200 and byte-exact=true",
          "live Code total/unique=390/390; pre-S328=327; S1/S327/S328/S389/S390=1; S391=0; no-transform/nosniff",
          "immutable hostname probe curl exit 28 / HTTP 000; verified=false",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
    ],
    terminalSessionsNote:
      "S390 altmış üçüncü production writer'ın dar kaynak entegrasyonudur. Yalnız S141 source-order first crashed/cancelled CALL mutable scheduler aliası guarded'dır; upstream authority/publication ve downstream recovery/reclaim/S389 replacement membership dışında kalır. Teknik kanıt GREEN, bütün scheduler exclusion ve ürün kabulü PARTIAL'dır.",
    limitations: [
      "Altı production writer aynı shared gate dışında kaldığı için whole-scheduler exclusion ve provider authority açık kalır.",
      "Board-qemu S141 fixture ile board-rpi5-only S390 wrapper aynı supported profilde kesişmez; production writer runtime invocation/observation kanıtı yoktur.",
      "QEMU S141 kabulü automatic lifecycle recovery ürün senaryosunu doğrular, fakat RPi5-only writer lease'in runtime'da alındığını doğrulamaz.",
      "Source-order second replacement S141 CALL ayrı S389 membership'idir; S390 iki aliası tek range guard altında birleştirmez.",
      "S391 QEMU S140 replacement exact-ACK CALL ayrı sıradaki kapıdır ve S390 tarafından completed sayılmaz.",
      "S245 request tüketilmez, S244 admission yayınlanmaz ve provider authority kurulmaz.",
      "Generic SMP arbitration, transient-contention liveness/soak ve fiziksel RPi kabulü açık kalır.",
      "S390 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S390=NO.",
    ],
  },