S391 · QEMU S140 replacement exact-ACK production writer guard integration

/// S140 runtime acceptance: one exact transport lease is delivered to a
/// strict EL0 supervisor that performs a controlled non-zero process exit
/// before ACK. Production responder-exit teardown cancels the bound kernel
/// CALL, the broker atomically requeues the dead session's lease, and a fresh
/// supervisor/session receives a new delivery epoch and ACKs exactly once.
/// This is deliberately not described as a lower-EL fault injection: the
/// general QEMU FATAL/DATA ABORT bans stay unchanged.
#[cfg(feature = "board-qemu")]
unsafe fn run_qemu_s140_supervisor_recovery(
    source_event: crate::mm::RuntimeOomEvent,
    baseline_free_frames: u64,
    baseline_active_allocations: usize,
) {
    use crate::elf::load_and_spawn_user_elf_from_boot_runtime_with_arg;
    use crate::elf_plan::{AddressRange, ElfLoadPolicy};
    use crate::mm::{
        RuntimeOomSupervisorTransport, RuntimeOomTransportError, RuntimeOomTransportEvent,
    };
    use crate::ui::capability::{CapabilityRights, IpcMessage};
    use crate::userspace_binaries::{OOM_CRASH_SUPERVISOR_BINARY, OOM_RECOVERY_SUPERVISOR_BINARY};

    const S140_EVENT_LABEL: u64 = 0x5331_3430;
    const S140_EXACT_ACK_LABEL: u64 = 0x4143_4b40;
    const S140_TRANSPORT_INSTANCE: u64 = 0x5331_3430;
    const S140_TIMEOUT_TICKS: u64 = 1 << 20;

    let controller_task = crate::task::current_task_id().expect("S140 controller task");
    let (crashed_domain, replacement_domain) = crate::mm::with_boot_runtime_memory(|memory| {
        Ok::<_, crate::mm::RuntimeAllocationError>((
            memory.register_domain(QEMU_CRASH_OOM_SUPERVISOR_RUNTIME_DOMAIN_ID)?,
            memory.register_domain(QEMU_RECOVERY_OOM_SUPERVISOR_RUNTIME_DOMAIN_ID)?,
        ))
    })
    .expect("S140 RuntimeMemory authority")
    .expect("S140 supervisor domain registration");

    let mut broker: RuntimeOomSupervisorTransport<{ crate::mm::RUNTIME_OOM_TRANSPORT_CAPACITY }> =
        RuntimeOomSupervisorTransport::with_instance_id(S140_TRANSPORT_INSTANCE);
    let event =
        RuntimeOomTransportEvent::try_new(1, source_event.id, source_event.oom_epoch, 0x5b01)
            .expect("S140 immutable event projection");
    broker.enqueue(event).expect("S140 event enqueue");
    let crashed_session = broker
        .begin_supervisor_session()
        .expect("S140 crashed supervisor session");
    let old_lease = broker
        .claim_next_for_session(
            crashed_session,
            crate::arch::aarch64::exceptions::TICKS.load(Ordering::Acquire),
            S140_TIMEOUT_TICKS,
        )
        .expect("S140 crashed supervisor lease");

    let endpoint_authority =
        crate::ui::capability::mint_endpoint(controller_task, S140_EVENT_LABEL)
            .expect("S140 controller endpoint authority");
    let no_forbidden_ranges: [AddressRange; 0] = [];
    let crash_publication_guard = crate::arch::aarch64::IrqGuard::new();
    let crashed_supervisor = load_and_spawn_user_elf_from_boot_runtime_with_arg(
        "oom-pre-ack-exit-strict-el0-supervisor-elf",
        OOM_CRASH_SUPERVISOR_BINARY,
        ElfLoadPolicy::new(
            AddressRange::new(0x0300_0000, 0x0301_0000),
            &no_forbidden_ranges,
            16,
        ),
        0x80c1_1000,
        4,
        0,
        8,
        crashed_domain,
        endpoint_authority.id,
    )
    .expect("S140 strict pre-ACK exit supervisor spawn");
    crate::ui::capability::grant_task_endpoint_to_task(
        endpoint_authority,
        controller_task,
        crashed_supervisor.task_id,
        CapabilityRights::ENDPOINT_RECV,
    )
    .expect("S140 crashed supervisor RECV grant");
    drop(crash_publication_guard);

    let crash_spawned = crate::mm::with_boot_runtime_memory(|memory| memory.audited_snapshot())
        .expect("S140 crash-spawn RuntimeMemory authority")
        .expect("S140 crash-spawn RuntimeMemory audit");
    assert_eq!(crash_spawned.pmm.free_frames, baseline_free_frames - 5);
    assert_eq!(
        crash_spawned.active_allocations,
        baseline_active_allocations + 5
    );
    kprintln!(
        "[K1-MEM2-S140] pre-ACK supervisor strict spawn PASS id={} pages={} domain={} endpoint={} owner={} INITIAL_X0=YES W^X=YES",
        crashed_supervisor.task_id,
        crashed_supervisor.page_count,
        crashed_domain.id(),
        endpoint_authority.id,
        controller_task,
    );

    let message = IpcMessage {
        label: S140_EVENT_LABEL,
        badge: controller_task,
        data: [
            old_lease.event().sequence_id(),
            old_lease.event().source_event_id(),
            old_lease.event().oom_epoch(),
            old_lease.event().fingerprint(),
        ],
    };
    let cancelled_reply =
        crate::ui::capability::mint_reply_endpoint_for_call(controller_task, endpoint_authority.id)
            .expect("S140 cancelled reply mint");
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s392_irq_guard = crate::arch::aarch64::IrqGuard::new();
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s392_writer_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s392_qemu_s140_controlled_pre_ack_exit_call_writer_guard_integration::acquire_s392_production_scheduler_writer_access()
        .unwrap_or_else(|error| {
            panic!(
                "S392 QEMU S140 controlled pre-ACK-exit CALL scheduler writer guard failed closed: {:?}",
                error
            )
        });
    let cancelled_call = (&mut *core::ptr::addr_of_mut!(crate::task::scheduler::SCHEDULER))
        .ipc_kernel_call_and_wait(
            endpoint_authority.id,
            endpoint_authority.generation,
            cancelled_reply.id,
            message,
        );
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s392_writer_access);
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s392_irq_guard);
    assert_eq!(cancelled_call, Err(crate::ipc::IpcError::InvalidCapability));
    assert!(!crate::ui::capability::ENDPOINT_REGISTRY
        .lock()
        .iter()
        .any(|endpoint| endpoint.id == cancelled_reply.id));

    let mut crash_reclaimed = false;
    for _ in 0..256 {
        let quota = crate::mm::with_boot_runtime_memory(|memory| {
            memory.audited_domain_quota(crashed_domain)
        })
        .expect("S140 crashed supervisor quota authority")
        .expect("S140 crashed supervisor quota audit");
        if quota.allocated_frames == 0 {
            crash_reclaimed = true;
            break;
        }
        crate::task::yield_now();
    }
    assert!(
        crash_reclaimed,
        "S140 pre-ACK supervisor did not reach exact reclaim"
    );
    let _ = crate::task::service_deferred_current_runtime_oom()
        .expect("S140 crashed-supervisor later-stack reap");
    let post_crash = crate::mm::with_boot_runtime_memory(|memory| memory.audited_snapshot())
        .expect("S140 post-crash RuntimeMemory authority")
        .expect("S140 post-crash RuntimeMemory audit");
    assert_eq!(post_crash.pmm.free_frames, baseline_free_frames);
    assert_eq!(post_crash.active_allocations, baseline_active_allocations);

    assert_eq!(broker.recover_supervisor_session(crashed_session), Ok(1));
    let recovered = broker.snapshot();
    assert_eq!(recovered.pending, 1);
    assert_eq!(recovered.in_flight, 0);
    assert_eq!(recovered.supervisor_crashes, 1);
    assert_eq!(recovered.recovered_inflight, 1);
    assert_eq!(recovered.active_supervisor_session, None);
    assert_eq!(
        broker.acknowledge_exact(old_lease, old_lease.deadline_tick()),
        Err(RuntimeOomTransportError::StaleLease)
    );
    assert_eq!(broker.snapshot(), recovered);

    let replacement_session = broker
        .begin_supervisor_session()
        .expect("S140 replacement supervisor session");
    assert!(replacement_session.epoch() > crashed_session.epoch());
    let retry_lease = broker
        .claim_next_for_session(
            replacement_session,
            crate::arch::aarch64::exceptions::TICKS.load(Ordering::Acquire),
            S140_TIMEOUT_TICKS,
        )
        .expect("S140 recovered retry lease");
    assert!(retry_lease.delivery_epoch() > old_lease.delivery_epoch());
    assert_eq!(retry_lease.event(), old_lease.event());

    let recovery_publication_guard = crate::arch::aarch64::IrqGuard::new();
    let replacement_supervisor = load_and_spawn_user_elf_from_boot_runtime_with_arg(
        "oom-recovery-strict-el0-supervisor-elf",
        OOM_RECOVERY_SUPERVISOR_BINARY,
        ElfLoadPolicy::new(
            AddressRange::new(0x0320_0000, 0x0321_0000),
            &no_forbidden_ranges,
            16,
        ),
        0x80c2_1000,
        4,
        0,
        8,
        replacement_domain,
        endpoint_authority.id,
    )
    .expect("S140 strict recovery supervisor spawn");
    crate::ui::capability::grant_task_endpoint_to_task(
        endpoint_authority,
        controller_task,
        replacement_supervisor.task_id,
        CapabilityRights::ENDPOINT_RECV,
    )
    .expect("S140 replacement supervisor RECV grant");
    drop(recovery_publication_guard);

    let recovery_spawned = crate::mm::with_boot_runtime_memory(|memory| memory.audited_snapshot())
        .expect("S140 recovery-spawn RuntimeMemory authority")
        .expect("S140 recovery-spawn RuntimeMemory audit");
    assert_eq!(recovery_spawned.pmm.free_frames, baseline_free_frames - 5);
    assert_eq!(
        recovery_spawned.active_allocations,
        baseline_active_allocations + 5
    );
    kprintln!(
        "[K1-MEM2-S140] replacement supervisor strict spawn PASS id={} pages={} domain={} endpoint={} owner={} INITIAL_X0=YES W^X=YES",
        replacement_supervisor.task_id,
        replacement_supervisor.page_count,
        replacement_domain.id(),
        endpoint_authority.id,
        controller_task,
    );

    let retry_message = IpcMessage {
        label: S140_EVENT_LABEL,
        badge: controller_task,
        data: [
            retry_lease.event().sequence_id(),
            retry_lease.event().source_event_id(),
            retry_lease.event().oom_epoch(),
            retry_lease.event().fingerprint(),
        ],
    };
    let exact_reply =
        crate::ui::capability::mint_reply_endpoint_for_call(controller_task, endpoint_authority.id)
            .expect("S140 exact reply mint");
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s391_irq_guard = crate::arch::aarch64::IrqGuard::new();
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s391_writer_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s391_qemu_s140_replacement_exact_ack_writer_guard_integration::acquire_s391_production_scheduler_writer_access()
        .unwrap_or_else(|error| {
            panic!(
                "S391 QEMU S140 replacement exact-ACK scheduler writer guard failed closed: {:?}",
                error
            )
        });
    let exact_ack = (&mut *core::ptr::addr_of_mut!(crate::task::scheduler::SCHEDULER))
        .ipc_kernel_call_and_wait(
            endpoint_authority.id,
            endpoint_authority.generation,
            exact_reply.id,
            retry_message,
        )
        .expect("S140 restarted strict EL0 exact ACK");
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s391_writer_access);
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s391_irq_guard);
    assert_eq!(exact_ack.label, S140_EXACT_ACK_LABEL);
    assert_eq!(exact_ack.badge, replacement_supervisor.task_id);
    assert_eq!(exact_ack.data, retry_message.data);
    assert_eq!(
        broker.acknowledge_exact(
            retry_lease,
            crate::arch::aarch64::exceptions::TICKS.load(Ordering::Acquire),
        ),
        Ok(event)
    );
    broker
        .close_supervisor_session(replacement_session)
        .expect("S140 replacement session close");

    let mut replacement_reclaimed = false;
    for _ in 0..256 {
        let quota = crate::mm::with_boot_runtime_memory(|memory| {
            memory.audited_domain_quota(replacement_domain)
        })
        .expect("S140 replacement supervisor quota authority")
        .expect("S140 replacement supervisor quota audit");
        if quota.allocated_frames == 0 {
            replacement_reclaimed = true;
            break;
        }
        crate::task::yield_now();
    }
    assert!(
        replacement_reclaimed,
        "S140 replacement supervisor did not reach exact reclaim"
    );
    let _ = crate::task::service_deferred_current_runtime_oom()
        .expect("S140 replacement-supervisor later-stack reap");

    let endpoint_cleanup = crate::ui::capability::teardown_task_ipc_lifecycle(controller_task)
        .expect("S140 controller endpoint cleanup");
    assert_eq!(endpoint_cleanup.owned_endpoints, 1);
    assert_eq!(endpoint_cleanup.drained_calls, 0);
    assert_eq!(endpoint_cleanup.cancelled_responder_calls, 0);

    let final_snapshot = crate::mm::with_boot_runtime_memory(|memory| memory.audited_snapshot())
        .expect("S140 final RuntimeMemory authority")
        .expect("S140 final RuntimeMemory audit");
    assert_eq!(final_snapshot.pmm.free_frames, baseline_free_frames);
    assert_eq!(
        final_snapshot.active_allocations,
        baseline_active_allocations
    );
    let final_broker = broker.snapshot();
    assert_eq!(final_broker.queued, 0);
    assert_eq!(final_broker.pending, 0);
    assert_eq!(final_broker.in_flight, 0);
    assert_eq!(final_broker.acknowledged, 1);
    assert_eq!(final_broker.supervisor_sessions_started, 2);
    assert_eq!(final_broker.supervisor_crashes, 1);
    assert_eq!(final_broker.recovered_inflight, 1);
    assert_eq!(final_broker.active_supervisor_session, None);
    assert!(!crate::ui::capability::ENDPOINT_REGISTRY
        .lock()
        .iter()
        .any(|endpoint| endpoint.id == endpoint_authority.id
            || endpoint.id == exact_reply.id
            || endpoint.id == cancelled_reply.id));

    kprintln!(
        "[K1-MEM2-S140] source_event={} endpoint={} crashed_supervisor={} replacement_supervisor={} crashed_domain={} replacement_domain={} SESSION=1->2 FRESH_SESSION=YES PRE_ACK_EXIT=INVALID_CAPABILITY RECOVERED_INFLIGHT=1 OLD_LEASE_ACK=STALE RETRY_ACK=EXACT RESTARTED_EL0_ACK=YES REPLY_ONESHOT=1/1 BROKER_DRAINED=YES SESSIONS=2 CRASHES=1 CRASH_RECLAIM=5 RESTART_RECLAIM=5 OWNER_EP_CLEANUP=1 free={}->{}->{}->{}->{} active={}->{}->{}->{}->{} KERNEL_DIRECT_ACK=NO EXECUTOR=PASS",
        source_event.id,
        endpoint_authority.id,
        crashed_supervisor.task_id,
        replacement_supervisor.task_id,
        crashed_domain.id(),
        replacement_domain.id(),
        baseline_free_frames,
        crash_spawned.pmm.free_frames,
        post_crash.pmm.free_frames,
        recovery_spawned.pmm.free_frames,
        final_snapshot.pmm.free_frames,
        baseline_active_allocations,
        crash_spawned.active_allocations,
        post_crash.active_allocations,
        recovery_spawned.active_allocations,
        final_snapshot.active_allocations,
    );
    run_qemu_s141_automatic_lifecycle_recovery(
        source_event,
        final_snapshot.pmm.free_frames,
        final_snapshot.active_allocations,
    );
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn acquire_s391_production_scheduler_writer_access(
) -> Result<G8lS391ProductionSchedulerWriterAccess, G8lS247WholeSchedulerAccessError> {
    let caller_cpu =
        crate::percpu::try_current_cpu_id().ok_or(G8lS247WholeSchedulerAccessError::InvalidCpu)?;
    if caller_cpu != crate::g8l_runtime_contract::CPU0 {
        return Err(G8lS247WholeSchedulerAccessError::InvalidCpu);
    }
    let access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s246_whole_scheduler_read_access_guard::S247_PRODUCTION_WHOLE_SCHEDULER_ACCESS_GATE
        .try_acquire_exclusive_for_valid_cpu(caller_cpu)?;
    Ok(G8lS391ProductionSchedulerWriterAccess { _access: access })
}

#[test]
fn boundary_has_exactly_one_s391_acquire_and_success_release_pair() {
    let boundary = s140_boundary();
    assert_eq!(
        boundary
            .matches("acquire_s391_production_scheduler_writer_access")
            .count(),
        1
    );
    assert_eq!(boundary.matches("drop(s391_writer_access)").count(), 1);
    assert_eq!(boundary.matches("drop(s391_irq_guard)").count(), 1);
}

  {
    id: "g8l-s391-qemu-s140-replacement-exact-ack-writer-guard-integration-partial",
    date: "2026-08-29",
    sequence: 391,
    status: "passed",
    umbrella_status: "partial",
    title:
      "S391 · QEMU S140 replacement exact-ACK production writer guard integration",
    summary:
      "S391, run_qemu_s140_supervisor_recovery içindeki iki explicit mutable scheduler aliasından source-order sonra gelen replacement-supervisor exact-ACK CALL sınırını tek başına production guard'a bağlar. Nonzero controller ve controller-owned normal Endpoint SEND authority, controlled pre-ACK-exit strict supervisor'ın ilk CALL'i, exact InvalidCapability continuation'ı ve cancelled-reply retirement, crashed-supervisor exact reclaim, explicit broker recovery, old-lease StaleLease reddi, fresh replacement supervisor, strict RECV grant, daha yeni task-bound session/retry lease, immutable retry message, linked one-shot exact reply ve recovery-publication IRQ release writer'dan önce tamamlanır. Dedicated S391 IRQ guard ardından gerçek per-CPU kimliğiyle CPU0-only exclusive writer S390 ve 44 production reader'ın kullandığı aynı statik S247 state word üzerinde alınır. Exact tek mutable SCHEDULER aliası yalnız endpoint id/generation, exact-reply id ve immutable retry message ile source-order second ipc_kernel_call_and_wait çağrısını kapsar. Owned exact_ack önce writer, sonra IRQ release sınırını geçer; exact label, replacement-task badge ve unchanged retry data ancak iki release sonrasında doğrulanır. Broker exact acknowledge/session close, endpoint-close handoff, replacement reclaim ve RuntimePmm baseline downstream'da kalır. Tarihsel S321 replacement ve S322 controlled-exit audit'leri model-only'dir; source-order first controlled CALL sıradaki S392 kapısı olarak ayrı kalır. Guarded writer 64/69, açık writer 5, provider authority 0 ve whole-scheduler exclusion false'dur. S140 fixture board-qemu, production wrapper RPi5-only olduğundan supported-profile runtime observation=0 açıkça korunur.",
    evidence: [
      "Canonical focused test S391 modülü, kernel/simulation registration'ı, CPU1 coverage service'i ve production S140 replacement exact-ACK membership'i yokken compile RED verdi; tarihsel S321 authority audit'i production entegrasyonu yerine geçirilmedi.",
      "İlk RED exit 101 verdi; /tmp/aselsanos-s391-initial-red.log 3774 B / 12924f24c72283b5786b963f45bd15e06e5cae2672c0b625060c7085aa742e22 SHA-256'dır.",
      "RED S391 module include_str dosyasının ve simulation crate export'unun yokluğunu exact gösterdi; provisional clone içindeki iki tarihsel include yolu gerçek S321/S322 dosya adlarına product wiring'den önce düzeltildi.",
      "Provisional tarihsel yol düzeltmesi yeni bir geçmiş uydurmadı: S321 replacement exact-ACK ve S322 controlled pre-ACK-exit authority-audit kaynakları ayrı ve mevcut dosyalara bağlandı.",
      "İlk production-wired test şekli 47/48 PASS verdi; tek RED, stale old lease'i crashed reclaim'den önce varsayan test-order hatasıydı ve product kodu değiştirilmedi.",
      "Korunan gerçek S140 source order controlled CALL → crash reclaim → explicit recover → stale old lease → replacement writer'dır; focused assertion bu sıraya daraltıldı.",
      "Final canonical focused koşu 48/48 PASS verdi; /tmp/aselsanos-s391-focused-green.log 4017 B / 87557a31ae186d3879778a7a8bf90bb14ff30faab9cb301137d24cb05c986514 SHA-256'dır.",
      "S391 modülü typed S390 preflight outcome'unu yeniden doğrular; inherited 44 reader + 63 guarded writer + 6 open writer snapshot'ı saparsa InventoryDrift ile fail-closed kapanır.",
      "S391 başarı outcome'u SixtyFourthWriterGuardedAwaitingRemaining'dir ve exact 44 guarded reader + 64/69 guarded writer + 5 open writer envanterini sabitler.",
      "Outcome request id, reader/writer/open sayıları, S140 replacement transaction, mutable alias, upstream crash/recovery/session/message/reply nesneleri, IRQ/CALL ve downstream ACK/cleanup alanlarını typed raporlar.",
      'Production wrapper exact all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5") cfg kesişimindedir; board-qemu fixture production runtime invocation diye sunulmaz.',
      "acquire_s391_production_scheduler_writer_access gerçek try_current_cpu_id sonucunu kullanır; caller-supplied production CPU parametresi yoktur ve CPU0 dışı mutation callback'inden önce InvalidCpu ile kapanır.",
      "Writer lease S247_PRODUCTION_WHOLE_SCHEDULER_ACCESS_GATE üzerinde try_acquire_exclusive_for_valid_cpu ile alınır; S391 yeni static, ikinci state word veya ayrı exclusion domain yaratmaz.",
      "Host executor callback'i exact bir kez çağırır; canlı reader writer'ı, canlı writer ikinci writer'ı ve yeni reader'ı aynı state word üzerinde reddeder; callback error RAII lease'ini exact bırakır.",
      "S390 ve S391 executor token'ları aynı shared gate üzerinde monoton ve ayrıdır; iki kapı tek transaction, range dispatcher veya toplu S335–S400 facade membership'i değildir.",
      "Production main.rs envanterinde S140 replacement CALL source-order positions[5], yani 17 explicit main aliasının altıncısıdır; S391 yalnız bu aliası sahiplenir.",
      "Aynı run_qemu_s140_supervisor_recovery öğesinde exact iki mutable scheduler aliası korunur: source-order first controlled/cancelled CALL S392 için açık, source-order second replacement exact-ACK CALL S391 guarded'dır.",
      "Controller current_task_id üzerinden nonzero alınır ve normal endpoint controller adına mint edilir; endpoint authority id/generation writer'a owned scalar girdiler olarak taşınır.",
      "Crashed supervisor ayrı RuntimeMemory domain'inde strict lifecycle-exit ELF olarak spawn edilir ve exact ENDPOINT_RECV authority ilk CALL'den önce grant edilir.",
      "Immutable RuntimeOomTransportEvent broker'a enqueue edilir; crashed session ile old lease exact controlled-exit supervisor identity'sine bağlanır.",
      "İlk S140 mutable alias halen S392 kapsamıdır; cancelled_reply.id ve original message kullanan controlled pre-ACK-exit CALL S391 guard focus'una katılmaz.",
      "İlk CALL exact InvalidCapability verir ve cancelled reply registry'den retired olur; S391 bu sonucu yeniden sahiplenmez veya ikinci CALL ile birleştirmez.",
      "Crashed supervisor domain quota 256 bounded yield içinde allocated_frames=0'a döner; deferred later-stack service ve RuntimePmm baseline doğrulaması replacement hazırlığından önce tamamlanır.",
      "broker.recover_supervisor_session(crashed_session) exact Ok(1) üretir; pending=1, in_flight=0, crashes=1, recovered_inflight=1 ve active session=None snapshot'ı korunur.",
      "Old lease exact deadline tick ile acknowledge edilmeye çalışıldığında yalnız StaleLease kabul edilir ve broker snapshot unchanged kalır.",
      "Replacement session epoch crashed session epoch'tan; retry delivery epoch old lease epoch'tan büyüktür ve immutable event identity exact aynıdır.",
      "Fresh replacement supervisor ayrı RuntimeMemory domain'inde strict recovery ELF olarak spawn edilir ve exact RECV grant writer sınırından önce tamamlanır.",
      "recovery_publication_guard replacement task ve authority publication tamamlandıktan sonra explicit bırakılır; dedicated S391 IRQ guard bununla nested tutulmaz.",
      "Recovery-spawn RuntimeMemory snapshot'ı baseline free frame -5 ve active allocation +5 değerlerini writer acquisition'dan önce doğrular.",
      "retry_message retry_lease event sequence/source/epoch/fingerprint tuple'ından immutable kurulur; writer message içeriğini yeniden oluşturmaz veya mutate etmez.",
      "exact_reply capability exact controller/endpoint ilişkisiyle writer'dan önce mint edilir; reply id S391 CALL'e owned scalar olarak aktarılır.",
      "Dedicated s391_irq_guard writer acquire'dan önce kurulur; acquire_s391_production_scheduler_writer_access, drop(s391_writer_access) ve drop(s391_irq_guard) exact birer kez görünür.",
      "Exact mutable alias ipc_kernel_call_and_wait(endpoint_authority.id, endpoint_authority.generation, exact_reply.id, retry_message) çağrısını bir kez yapar.",
      "CALL terminal mesajı borrowed Scheduler referansı dışarı taşınmadan owned exact_ack değerine alınır; guard release sonrasında Scheduler üzerinden sonuç okunmaz.",
      "drop(s391_writer_access), drop(s391_irq_guard), exact_ack.label, exact_ack.badge ve exact_ack.data kontrolleri bu kesin source sırasındadır.",
      "ACK label yalnız S140_EXACT_ACK_LABEL, badge yalnız replacement_supervisor.task_id ve data yalnız unchanged retry_message.data olabilir.",
      "broker.acknowledge_exact(retry_lease, current tick) ve replacement session close ancak ACK alanları iki release sonrasında doğrulanınca çalışır.",
      "Endpoint-close handoff, replacement supervisor exact reclaim, deferred later-stack service, final RuntimePmm baseline ve broker drain S391 membership'inin dışındadır.",
      "Scheduler helper aynı IRQ/IPC transaction altında caller SEND authority, normal Endpoint object ve linked one-shot reply ilişkisini commit'ten önce yeniden doğrular.",
      "Optional receiver authority/generation ve exact receive deadline ile ready queue, blocked call, reply table ve endpoint queue kapasitesi CALL publish öncesinde fail-closed sınanır.",
      "CALL envelope publish, caller context park ve optional immediate receiver delivery aynı helper transaction'ındadır; transaction release edilmeden context switch yapılmaz.",
      "Continuation transaction release ve resume sonrasında aynı caller task'ı bulur ve yalnız owned IpcMessage veya exact stored IPC error terminal sonucunu yeniden kurar.",
      "Focused source testi complete run_qemu_s140_supervisor_recovery Rust öğesini ve exact S391 acquire→single mutable alias→CALL→writer drop nested focus'unu birlikte doğrular.",
      "Focused test complete S140 öğesinde exact iki mutable alias sayar, S391 focus'unda yalnız second aliası ve tek ipc_kernel_call_and_wait görür.",
      "Argument-forwarding testi endpoint_authority.id, endpoint_authority.generation, exact_reply.id ve retry_message değerlerinin exact second CALL'e eksiksiz aktarıldığını doğrular.",
      "Focused test cancelled_reply.id ve original message'in S391 focus'una girmediğini; exact_reply.id ile retry_message'in ise girdiğini ayrı assertion'larla sabitler.",
      "Focused grup request yokken Idle, exact pending request ile SixtyFourthWriterGuardedAwaitingRemaining ve yanlış CPU'da inherited S390 hatasını ayrı test eder.",
      "S245 request preflight sonrasında state.pending_request_id()==Some(1) kalır; take, publish, consume veya authority promotion yapılmaz.",
      "Reader-vs-writer, writer-vs-writer, nested reader/writer, callback-error release ve exact-once callback yolları birbirinden bağımsız test edilir.",
      "Production-only sembollerin tamamı aynı RPi5 AArch64 bare-metal cfg'sine bağlıdır; hostta sahte yarım production yolu oluşturulmaz.",
      "S391 modül kaynak testi provider constructor, S244 publisher ve request-state take adlarını reddeder; provider authority=0 ve exclusion=false kaynak yüzeyiyle korunur.",
      "Kernel main ve simulation lib registration'ları exact uzun S391 modül adıyla ayrı doğrulanır; sıra tablosundaki model satırı production membership yerine geçirilmez.",
      "CPU1 coverage service exceptions.rs içinde S390 service çağrısından sonra ve tarihsel S242 consumer'dan önce çalışır; mutable SCHEDULER veya S391 acquire çağırmaz.",
      "Tarihsel S321 replacement audit'i ve S322 controlled-exit audit'i model-level kalır; production S390 S141 crashed membership'i de ayrı prior source unit'tir.",
      "S392 acquire sembolü S391 modülünde ve guarded focus'ta yoktur; QEMU S140 controlled pre-ACK-exit CALL sonraki kapı olarak açık kalır.",
      "S321 15/15, S322 15/15 ve runtime_oom_supervisor_recovery 7/7 ilk seçili ön koşu içinde seri PASS verdi.",
      "İlk seçili log /tmp/aselsanos-s391-selected-initial.log 4642 B / 6cb4bec1b95ea46d39c169f38aa891b8428ff5de1f34f93c9c37f103a9327a63 SHA-256'dır.",
      "Final selected regression S391, S390, tarihsel S321/S322 ve runtime_oom_supervisor_recovery ile 5 grup / 133 PASS / 0 fail verdi.",
      "Selected log /tmp/aselsanos-s391-selected.log 12196 B / 8fc59452a7afa7e0a765e5db5f783c03d184de6524b9a8c382ff981d03f820f8 SHA-256'dır.",
      "S238–S390 dependency hedef listesi korunup yalnız S391 sona eklendi; iki bağımsız seri koşu 155 grup / 3907/3907 PASS verdi.",
      "Dependency timing-normalized ve LC_ALL=C sıralı özetlerin her biri 33419 B / 954defe474da8459841600a157841321b0927f68df5531fea3143e69682ad3f3 SHA-256 ile byte-exact eşittir.",
      "Dependency artifact root /tmp/aselsanos-s391-dependency.hlOovG; raw run1 388751 B / beb4b75a8762c45a53748570743d6da87fbe39577c95b8ad3bc8f354cf8c6b5a ve run2 373198 B / c130d44ef2dcd7452cca4577604d02699c3047fea3e35aa1534bf9ac26a30b76'dır.",
      "Yalnız finished in süre suffix'i normalization kapsamındadır; test isimleri, hedef sırası, pass/fail adetleri ve durum payload'ı canonical özette kalır.",
      "Yedi exact frozen assertion dışındaki serial workspace 354 result group / 5786 PASS / 0 fail / 7 filtered verdi.",
      "Filtered workspace raw log 565523 B / 3770760c23f493879c6565f8483b6801c5fa231fc22102804b7fc5dc77c66c7c ve summary 33512 B / de508a80650309dc8e820974dd5becf4878257d29295084a4976b25b8e5692e9'tur.",
      "Filtresiz workspace exit 101 ile yalnız frozen S96 wiring_does_not_mutate_timer_gic_boot_or_expand_runtime_scope assertion'ında durdu; 307 result group / 5531 PASS / 1 fail ve global workspace GREEN claimed=false'dur.",
      "Filtresiz raw log 533859 B / e47671ae765de0b9ed7612df0219cae2649adfc267963feeab0647f16fdb25f9 ve summary 29093 B / fae133fd9b443de289bd9a70632dc0206a69fad540edba4cd0f326b8fb0ac20b'dir.",
      "Workspace artifact root /tmp/aselsanos-s391-workspace.Eh1CY7'dir; yedi filtre adı S390 kabulünden değiştirilmeden korunur.",
      "Dört fresh canonical AArch64 profil kernel çalışma dizininden CARGO_INCREMENTAL=0, explicit feature ve birbirinden ayrı target dizinleriyle 4/4 exit 0 verdi; zero-warning iddiası yoktur.",
      "Fresh board-qemu logu 112253 B / 239437e581363b366d4ad54a885e7fc7080384bc11fbd4bf0bfa4d3f33627a1e ve 293 warning header; ELF 16813800 B / 9f8c63d08a27da5cf05d82689758f8328410c5f3300bff4bb9d2a0bd6f4ddd6b'dır.",
      "Fresh board-rpi4 logu 150891 B / 91e6636b577ff03c87b89e478b21ddc0d4dc8c57f4628ae50b58ba135f68e794 ve 391 warning header; ELF 11925568 B / 6f4908803fb506fa2b331d386fbca428ad88ccd3f5e887b9baa7e534a0d54340'dır.",
      "Fresh board-rpi5 logu 664519 B / d99c773f21505d2e3bae91c6f0b26813b826359207308c284f936c9b04830843 ve 1522 warning header; ELF 15371088 B / 7e669ab396effd61641f32bfe026e63e57dda10c42f8a467f165f33e340666ce'dir.",
      "Fresh board-rpi5+smp logu 664453 B / 129f1f094b0bfc718c3b7f4a466bf14a17f5845d484eb6ab94f5648861364b54 ve 1522 warning header; ELF 15359304 B / c0676da4e1e88e00a6ba90c9f57785e40ab60faa961f6487f31c3873e7e23fd0'dır.",
      "Dört profil /tmp/aselsanos-s391-profiles.b06uGK altında tutulur; build log ve ELF byte/hash ölçüleri birbirine karıştırılmaz.",
      "CARGO_INCREMENTAL=0 make verify-qemu 116354 B / 7c260c615e7989a1f6c39dc5423049048fc962e07ad1715b279833a5f790c9fd SHA-256 ile strict ELF W^X 31/31, S130–S154 + S271, IPC 20/20 ve scheduler SEC5 PASS verdi.",
      "QEMU logunda S140 pre-ACK exit, explicit recovery ve exact retry senaryosu gözlendi; board-qemu guest RPi5-only S391 lease'ini compile etmediği için bu writer runtime observation değildir.",
      "Final cargo fmt --all -- --check ve git diff --check exit 0 ve boş çıktı verdi; 0 B / e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 SHA-256'dır.",
      "S391 proof owned boundary, coverage, TDD, selected regression, dependency reproducibility, workspace, profiles, QEMU/format ve Code publication contract bölümlerini ayrı taşır.",
      "Code yayın hedefi S1–S391 391/391 ayrı kapıdır; kullanıcının özellikle istediği S328 öncesi S1–S327 aralığı 327/327 tekil kalmalı, missing=none ve duplicate=0 olmalıdır.",
      "S391 Code kartı complete run_qemu_s140_supervisor_recovery Rust öğesini, yalnız second replacement CALL'e ait nested acquire→release focus'unu, complete S391 guard modülünü, complete 48-test target'ını, proof'u ve complete Operations object'ini yayımlar.",
      "Complete production excerpt iki S140 CALL'i bağlamıyla gösterirken nested focus yalnız s391_writer_access acquisition'dan drop(s391_writer_access)'e kadar kesilir; S392 first controlled membership bu focus'a katılmaz.",
      "S1, S327, S328, S390 ve S391 kartlarının exact birer kez görünmesi; S392'nin pre-publish edilmemesi website kabulünde sayılacaktır.",
      "Her Code kartı mappingStrategy, kind, sourcePath, complete excerpt, satır aralığı ve SHA-256 kimliği taşır; test komutu asıl uygulama/model kodunun yerine geçirilmez.",
      "S391 için güç, SD kart, Mac kart erişimi, UART capture, raw validation, archive veya promotion işlemi yapılmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S391=NO.",
      "Bağlayıcı olmayan S391 projeksiyonu R1 S391–S421, R2 S446–S496, R3 S575+, risk aralığı S551–S601 ve merkez yaklaşık S576'dır; sıra veya ürün taahhüdü değildir.",
      "İlk deterministic Code registry S1–S391 391/391 unique kapı ve 1132 exact excerpt üretti; missing=none, duplicate=0 ve özellikle S328 öncesi S1–S327 aralığı 327/327 tekil kaldı.",
      "İlk registry mapping dağılımı 64 writer-guard + 225 focused-test + 94 command-contract + 8 operation-record = 391'dir; test komutu hiçbir kartta asıl uygulama/model kaynağının yerine geçirilmedi.",
      "İlk generated JSON 8847808 B / 60124993d106b898a83d2e318d8a7e43a4a0f010bdf7b71c2ed2bb40439acc0f dosya SHA-256 ve d660b15d9a4a1df863814a04a6e82ba6e76aeb595cef8e9d9d2fedd32e577a17 registry SHA-256 taşıdı.",
      "Website kabulü 709/709 test PASS, lint PASS, boş TypeScript çıktısı ve 24/24 static page PASS verdi; export 200 dosya, Timeline ile yol-haritasi ayrı ayrı 230 data-gate-policy kartı üretti.",
      "İlk publication öncesi S391 core policy 17325 karakter / 17901 UTF-8 byte, 85 evidence satırı, 4 terminal session ve 8 limitation taşıdı; S324 tabanı 5965 karakter / 6122 byte'dır.",
      "Website test logu 66064 B / ce5b874b7697e5f7d582b14d34143690cd5b1ac43ab7de07f9f48eaf2732eec3, build logu 1213 B / 6f061fdbdb3e43f552342736734c68804112cc3a76c3fbab994877e79fe9e9a6 SHA-256'dır.",
      "İlk production/main deployment 85a50c22 ile 115 upload + 84 existing = 199 asset ve ayrı _headers yayımladı; deploy logu 1714 B / 2c242c093cd41142c5252e0c587754cc841ca6c70074cb7900d0a6b7ca45228a SHA-256'dır.",
      "Cache-busted custom-domain /code/ readback 24800979 B / 487e5fbd3940c4f4ed74347eb48f4d994ce656d0704c7a29b84a7086676e9403 SHA-256 ile HTTP 200 ve post-deploy local out'a byte-exact=true verdi.",
      "Cache-busted custom-domain /operations/ readback 15156913 B / 67aa5fc26a53bcf0a77c0ba3f5ec783a6ea3098f145bafa47ea6d724a340a818 SHA-256 ile HTTP 200 ve post-deploy local out'a byte-exact=true verdi.",
      "Cache-busted custom-domain /timeline/ readback 6339540 B / 5408a63e2d8716cfbda0c4231db19123211e7f91f98820241dc06ac43f918097 SHA-256 ile HTTP 200 ve post-deploy local out'a byte-exact=true verdi.",
      "Cache-busted custom-domain /yol-haritasi/ readback 6339288 B / 04c93994f8dcfa9fa8b5e07a8da71ce1b93ff3fd8a603a29074c2557f2bc780c SHA-256 ile HTTP 200 ve post-deploy local out'a byte-exact=true verdi.",
      "Canlı Code HTML total=391, unique=391, pre-S328=327, S1/S327/S328/S390/S391 exact birer ve S392=0 ölçtü; /code/ cache-control no-transform ve x-content-type-options nosniff taşıdı.",
      "İlk readback artefakt kökü /tmp/aselsanos-s391-readback-initial.I2AXXe ve website kabul kökü /tmp/aselsanos-s391-website-initial.DyswZN'dir.",
      "Immutable 85a50c22.aselsan-microkernel.pages.dev hostname probe'u curl exit 28 / HTTP 000 verdi; bu yol doğrulanmış sayılmaz ve yalnız custom-domain byte-exact kabulü PASS'tir.",
      "Bu ölçülmüş initial kimlikleri taşıyan payload ayrı evidence-sync production/main transaction'ında yayımlanır; dönen final deployment kimliği project-status kapanışına yazılır ve self-referential sonsuz yayın zinciri kurulmaz.",
    ],
    commands: [
      "CARGO_INCREMENTAL=0 cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s391_qemu_s140_replacement_exact_ack_writer_guard_integration -- --test-threads=1",
      "run S391, S390, S321, S322 and runtime_oom_supervisor_recovery serially",
      "run S238-S391 dependency list twice and normalize timing fields",
      "run filtered and unfiltered serial workspace audits",
      "run four fresh isolated AArch64 profile builds",
      "CARGO_INCREMENTAL=0 make verify-qemu",
      "cargo fmt --all -- --check && git diff --check",
      "npm run code:generate && npm run code:check",
      "npm test && npm run lint && npx tsc --noEmit && npm run build",
      "npm run deploy",
      "cache-busted curl + cmp for /code/, /operations/, /timeline/ and /yol-haritasi/",
    ],
    terminalSessions: [
      {
        id: "g8l-s391-focused-source-contract",
        title: "S391 focused S140 replacement exact-ACK writer membership",
        commandLines: [
          "CARGO_INCREMENTAL=0 cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s391_qemu_s140_replacement_exact_ack_writer_guard_integration -- --test-threads=1",
        ],
        outputLines: [
          "initial result: compile RED; S391 module/export and production S140 second-call boundary missing; provisional historical paths corrected",
          "first wired result: 47/48 PASS; source-order test corrected, product code unchanged",
          "final result: 48/48 PASS; exact second alias and owned ACK release order",
          "shared S247 gate: 44 guarded readers + 64/69 guarded writers; 5 writers open",
          "board-qemu fixture / board-rpi5 wrapper supported-profile intersection=0; provider authority=0",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8l-s391-selected-regression",
        title:
          "S391 selected S140 replacement/control and supervisor recovery regression",
        commandLines: [
          "run S391, S390, S321, S322 and runtime_oom_supervisor_recovery serially",
        ],
        outputLines: [
          "initial direct dependencies: S321 15/15 + S322 15/15 + S140 runtime 7/7 PASS",
          "final result: 5 groups / 133 passed / 0 failed",
          "S392 controlled pre-ACK-exit CALL remains unguarded and separate",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8l-s391-full-acceptance",
        title:
          "S391 dependency, workspace, profiles, QEMU and format acceptance",
        commandLines: [
          "run S238-S391 dependency list twice and normalize timing fields",
          "run filtered and unfiltered serial workspace audits",
          "run four fresh isolated AArch64 profile builds",
          "CARGO_INCREMENTAL=0 make verify-qemu",
          "cargo fmt --all -- --check && git diff --check",
        ],
        outputLines: [
          "dependency 155 groups / 3907/3907 twice; normalized 33419-byte summaries are SHA-256 identical",
          "filtered workspace 354 groups / 5786 PASS / 7 filtered; unfiltered frozen-S96 remains RED at 5531 PASS / 1 fail",
          "four fresh profiles 4/4 exit 0; build-log and ELF identities measured separately; zero-warning claim=false",
          "QEMU W^X 31/31 + S130-S154 + S271 + IPC 20/20 + SEC5 PASS; not an S391 writer runtime observation",
          "final rustfmt and diff whitespace checks exit 0 with empty output",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8l-s391-production-publication",
        title:
          "S391 Operations, Timeline, roadmap and Code production publication",
        commandLines: [
          "npm run code:generate && npm run code:check",
          "npm test && npm run lint && npx tsc --noEmit && npm run build",
          "npm run deploy",
          "cache-busted curl + cmp for /code/, /operations/, /timeline/ and /yol-haritasi/",
        ],
        outputLines: [
          "initial registry: S1-S391 391/391 unique, pre-S328 S1-S327 327/327, 1132 excerpts, missing=none, duplicate=0, S392=0",
          "website: 709/709 PASS; lint PASS; TypeScript empty; static routes 24/24; export files=200; Timeline/yol-haritasi gate cards=230 each",
          "initial production deployment 85a50c22: 115 upload + 84 existing = 199 assets; custom-domain four-route HTTP 200 and byte-exact=true",
          "live Code total=391, unique=391, pre-S328=327, S1/S327/S328/S390/S391=1, S392=0; immutable hostname exit 28 / HTTP 000 is not claimed",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
    ],
    terminalSessionsNote:
      "S391 altmış dördüncü production writer'ın dar kaynak entegrasyonudur. Yalnız S140 source-order second replacement exact-ACK CALL mutable scheduler aliası guarded'dır; first controlled CALL, upstream authority/recovery/publication ve downstream ACK commit/reclaim dışında kalır. Teknik kanıt GREEN, bütün scheduler exclusion ve ürün kabulü PARTIAL'dır.",
    limitations: [
      "Beş production writer aynı shared gate dışında kaldığı için whole-scheduler exclusion ve provider authority açık kalır.",
      "Board-qemu S140 fixture ile board-rpi5-only S391 wrapper aynı supported profilde kesişmez; production writer runtime invocation/observation kanıtı yoktur.",
      "QEMU S140 kabulü explicit supervisor recovery ürün senaryosunu doğrular, fakat RPi5-only writer lease'in runtime'da alındığını doğrulamaz.",
      "Source-order first controlled pre-ACK-exit S140 CALL ayrı S392 membership'idir; S391 iki aliası tek range guard altında birleştirmez.",
      "S392 QEMU S140 controlled pre-ACK-exit CALL ayrı sıradaki kapıdır ve S391 tarafından completed sayılmaz.",
      "S245 request tüketilmez, S244 admission yayınlanmaz ve provider authority kurulmaz.",
      "Generic SMP arbitration, transient-contention liveness/soak ve fiziksel RPi kabulü açık kalır.",
      "S391 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S391=NO.",
    ],
  },