S392 · QEMU S140 controlled pre-ACK-exit CALL production writer guard integration

/// S140 runtime acceptance: one exact transport lease is delivered to a
/// strict EL0 supervisor that performs a controlled non-zero process exit
/// before ACK. Production responder-exit teardown cancels the bound kernel
/// CALL, the broker atomically requeues the dead session's lease, and a fresh
/// supervisor/session receives a new delivery epoch and ACKs exactly once.
/// This is deliberately not described as a lower-EL fault injection: the
/// general QEMU FATAL/DATA ABORT bans stay unchanged.
#[cfg(feature = "board-qemu")]
unsafe fn run_qemu_s140_supervisor_recovery(
    source_event: crate::mm::RuntimeOomEvent,
    baseline_free_frames: u64,
    baseline_active_allocations: usize,
) {
    use crate::elf::load_and_spawn_user_elf_from_boot_runtime_with_arg;
    use crate::elf_plan::{AddressRange, ElfLoadPolicy};
    use crate::mm::{
        RuntimeOomSupervisorTransport, RuntimeOomTransportError, RuntimeOomTransportEvent,
    };
    use crate::ui::capability::{CapabilityRights, IpcMessage};
    use crate::userspace_binaries::{OOM_CRASH_SUPERVISOR_BINARY, OOM_RECOVERY_SUPERVISOR_BINARY};

    const S140_EVENT_LABEL: u64 = 0x5331_3430;
    const S140_EXACT_ACK_LABEL: u64 = 0x4143_4b40;
    const S140_TRANSPORT_INSTANCE: u64 = 0x5331_3430;
    const S140_TIMEOUT_TICKS: u64 = 1 << 20;

    let controller_task = crate::task::current_task_id().expect("S140 controller task");
    let (crashed_domain, replacement_domain) = crate::mm::with_boot_runtime_memory(|memory| {
        Ok::<_, crate::mm::RuntimeAllocationError>((
            memory.register_domain(QEMU_CRASH_OOM_SUPERVISOR_RUNTIME_DOMAIN_ID)?,
            memory.register_domain(QEMU_RECOVERY_OOM_SUPERVISOR_RUNTIME_DOMAIN_ID)?,
        ))
    })
    .expect("S140 RuntimeMemory authority")
    .expect("S140 supervisor domain registration");

    let mut broker: RuntimeOomSupervisorTransport<{ crate::mm::RUNTIME_OOM_TRANSPORT_CAPACITY }> =
        RuntimeOomSupervisorTransport::with_instance_id(S140_TRANSPORT_INSTANCE);
    let event =
        RuntimeOomTransportEvent::try_new(1, source_event.id, source_event.oom_epoch, 0x5b01)
            .expect("S140 immutable event projection");
    broker.enqueue(event).expect("S140 event enqueue");
    let crashed_session = broker
        .begin_supervisor_session()
        .expect("S140 crashed supervisor session");
    let old_lease = broker
        .claim_next_for_session(
            crashed_session,
            crate::arch::aarch64::exceptions::TICKS.load(Ordering::Acquire),
            S140_TIMEOUT_TICKS,
        )
        .expect("S140 crashed supervisor lease");

    let endpoint_authority =
        crate::ui::capability::mint_endpoint(controller_task, S140_EVENT_LABEL)
            .expect("S140 controller endpoint authority");
    let no_forbidden_ranges: [AddressRange; 0] = [];
    let crash_publication_guard = crate::arch::aarch64::IrqGuard::new();
    let crashed_supervisor = load_and_spawn_user_elf_from_boot_runtime_with_arg(
        "oom-pre-ack-exit-strict-el0-supervisor-elf",
        OOM_CRASH_SUPERVISOR_BINARY,
        ElfLoadPolicy::new(
            AddressRange::new(0x0300_0000, 0x0301_0000),
            &no_forbidden_ranges,
            16,
        ),
        0x80c1_1000,
        4,
        0,
        8,
        crashed_domain,
        endpoint_authority.id,
    )
    .expect("S140 strict pre-ACK exit supervisor spawn");
    crate::ui::capability::grant_task_endpoint_to_task(
        endpoint_authority,
        controller_task,
        crashed_supervisor.task_id,
        CapabilityRights::ENDPOINT_RECV,
    )
    .expect("S140 crashed supervisor RECV grant");
    drop(crash_publication_guard);

    let crash_spawned = crate::mm::with_boot_runtime_memory(|memory| memory.audited_snapshot())
        .expect("S140 crash-spawn RuntimeMemory authority")
        .expect("S140 crash-spawn RuntimeMemory audit");
    assert_eq!(crash_spawned.pmm.free_frames, baseline_free_frames - 5);
    assert_eq!(
        crash_spawned.active_allocations,
        baseline_active_allocations + 5
    );
    kprintln!(
        "[K1-MEM2-S140] pre-ACK supervisor strict spawn PASS id={} pages={} domain={} endpoint={} owner={} INITIAL_X0=YES W^X=YES",
        crashed_supervisor.task_id,
        crashed_supervisor.page_count,
        crashed_domain.id(),
        endpoint_authority.id,
        controller_task,
    );

    let message = IpcMessage {
        label: S140_EVENT_LABEL,
        badge: controller_task,
        data: [
            old_lease.event().sequence_id(),
            old_lease.event().source_event_id(),
            old_lease.event().oom_epoch(),
            old_lease.event().fingerprint(),
        ],
    };
    let cancelled_reply =
        crate::ui::capability::mint_reply_endpoint_for_call(controller_task, endpoint_authority.id)
            .expect("S140 cancelled reply mint");
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s392_irq_guard = crate::arch::aarch64::IrqGuard::new();
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s392_writer_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s392_qemu_s140_controlled_pre_ack_exit_call_writer_guard_integration::acquire_s392_production_scheduler_writer_access()
        .unwrap_or_else(|error| {
            panic!(
                "S392 QEMU S140 controlled pre-ACK-exit CALL scheduler writer guard failed closed: {:?}",
                error
            )
        });
    let cancelled_call = (&mut *core::ptr::addr_of_mut!(crate::task::scheduler::SCHEDULER))
        .ipc_kernel_call_and_wait(
            endpoint_authority.id,
            endpoint_authority.generation,
            cancelled_reply.id,
            message,
        );
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s392_writer_access);
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s392_irq_guard);
    assert_eq!(cancelled_call, Err(crate::ipc::IpcError::InvalidCapability));
    assert!(!crate::ui::capability::ENDPOINT_REGISTRY
        .lock()
        .iter()
        .any(|endpoint| endpoint.id == cancelled_reply.id));

    let mut crash_reclaimed = false;
    for _ in 0..256 {
        let quota = crate::mm::with_boot_runtime_memory(|memory| {
            memory.audited_domain_quota(crashed_domain)
        })
        .expect("S140 crashed supervisor quota authority")
        .expect("S140 crashed supervisor quota audit");
        if quota.allocated_frames == 0 {
            crash_reclaimed = true;
            break;
        }
        crate::task::yield_now();
    }
    assert!(
        crash_reclaimed,
        "S140 pre-ACK supervisor did not reach exact reclaim"
    );
    let _ = crate::task::service_deferred_current_runtime_oom()
        .expect("S140 crashed-supervisor later-stack reap");
    let post_crash = crate::mm::with_boot_runtime_memory(|memory| memory.audited_snapshot())
        .expect("S140 post-crash RuntimeMemory authority")
        .expect("S140 post-crash RuntimeMemory audit");
    assert_eq!(post_crash.pmm.free_frames, baseline_free_frames);
    assert_eq!(post_crash.active_allocations, baseline_active_allocations);

    assert_eq!(broker.recover_supervisor_session(crashed_session), Ok(1));
    let recovered = broker.snapshot();
    assert_eq!(recovered.pending, 1);
    assert_eq!(recovered.in_flight, 0);
    assert_eq!(recovered.supervisor_crashes, 1);
    assert_eq!(recovered.recovered_inflight, 1);
    assert_eq!(recovered.active_supervisor_session, None);
    assert_eq!(
        broker.acknowledge_exact(old_lease, old_lease.deadline_tick()),
        Err(RuntimeOomTransportError::StaleLease)
    );
    assert_eq!(broker.snapshot(), recovered);

    let replacement_session = broker
        .begin_supervisor_session()
        .expect("S140 replacement supervisor session");
    assert!(replacement_session.epoch() > crashed_session.epoch());
    let retry_lease = broker
        .claim_next_for_session(
            replacement_session,
            crate::arch::aarch64::exceptions::TICKS.load(Ordering::Acquire),
            S140_TIMEOUT_TICKS,
        )
        .expect("S140 recovered retry lease");
    assert!(retry_lease.delivery_epoch() > old_lease.delivery_epoch());
    assert_eq!(retry_lease.event(), old_lease.event());

    let recovery_publication_guard = crate::arch::aarch64::IrqGuard::new();
    let replacement_supervisor = load_and_spawn_user_elf_from_boot_runtime_with_arg(
        "oom-recovery-strict-el0-supervisor-elf",
        OOM_RECOVERY_SUPERVISOR_BINARY,
        ElfLoadPolicy::new(
            AddressRange::new(0x0320_0000, 0x0321_0000),
            &no_forbidden_ranges,
            16,
        ),
        0x80c2_1000,
        4,
        0,
        8,
        replacement_domain,
        endpoint_authority.id,
    )
    .expect("S140 strict recovery supervisor spawn");
    crate::ui::capability::grant_task_endpoint_to_task(
        endpoint_authority,
        controller_task,
        replacement_supervisor.task_id,
        CapabilityRights::ENDPOINT_RECV,
    )
    .expect("S140 replacement supervisor RECV grant");
    drop(recovery_publication_guard);

    let recovery_spawned = crate::mm::with_boot_runtime_memory(|memory| memory.audited_snapshot())
        .expect("S140 recovery-spawn RuntimeMemory authority")
        .expect("S140 recovery-spawn RuntimeMemory audit");
    assert_eq!(recovery_spawned.pmm.free_frames, baseline_free_frames - 5);
    assert_eq!(
        recovery_spawned.active_allocations,
        baseline_active_allocations + 5
    );
    kprintln!(
        "[K1-MEM2-S140] replacement supervisor strict spawn PASS id={} pages={} domain={} endpoint={} owner={} INITIAL_X0=YES W^X=YES",
        replacement_supervisor.task_id,
        replacement_supervisor.page_count,
        replacement_domain.id(),
        endpoint_authority.id,
        controller_task,
    );

    let retry_message = IpcMessage {
        label: S140_EVENT_LABEL,
        badge: controller_task,
        data: [
            retry_lease.event().sequence_id(),
            retry_lease.event().source_event_id(),
            retry_lease.event().oom_epoch(),
            retry_lease.event().fingerprint(),
        ],
    };
    let exact_reply =
        crate::ui::capability::mint_reply_endpoint_for_call(controller_task, endpoint_authority.id)
            .expect("S140 exact reply mint");
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s391_irq_guard = crate::arch::aarch64::IrqGuard::new();
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s391_writer_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s391_qemu_s140_replacement_exact_ack_writer_guard_integration::acquire_s391_production_scheduler_writer_access()
        .unwrap_or_else(|error| {
            panic!(
                "S391 QEMU S140 replacement exact-ACK scheduler writer guard failed closed: {:?}",
                error
            )
        });
    let exact_ack = (&mut *core::ptr::addr_of_mut!(crate::task::scheduler::SCHEDULER))
        .ipc_kernel_call_and_wait(
            endpoint_authority.id,
            endpoint_authority.generation,
            exact_reply.id,
            retry_message,
        )
        .expect("S140 restarted strict EL0 exact ACK");
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s391_writer_access);
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s391_irq_guard);
    assert_eq!(exact_ack.label, S140_EXACT_ACK_LABEL);
    assert_eq!(exact_ack.badge, replacement_supervisor.task_id);
    assert_eq!(exact_ack.data, retry_message.data);
    assert_eq!(
        broker.acknowledge_exact(
            retry_lease,
            crate::arch::aarch64::exceptions::TICKS.load(Ordering::Acquire),
        ),
        Ok(event)
    );
    broker
        .close_supervisor_session(replacement_session)
        .expect("S140 replacement session close");

    let mut replacement_reclaimed = false;
    for _ in 0..256 {
        let quota = crate::mm::with_boot_runtime_memory(|memory| {
            memory.audited_domain_quota(replacement_domain)
        })
        .expect("S140 replacement supervisor quota authority")
        .expect("S140 replacement supervisor quota audit");
        if quota.allocated_frames == 0 {
            replacement_reclaimed = true;
            break;
        }
        crate::task::yield_now();
    }
    assert!(
        replacement_reclaimed,
        "S140 replacement supervisor did not reach exact reclaim"
    );
    let _ = crate::task::service_deferred_current_runtime_oom()
        .expect("S140 replacement-supervisor later-stack reap");

    let endpoint_cleanup = crate::ui::capability::teardown_task_ipc_lifecycle(controller_task)
        .expect("S140 controller endpoint cleanup");
    assert_eq!(endpoint_cleanup.owned_endpoints, 1);
    assert_eq!(endpoint_cleanup.drained_calls, 0);
    assert_eq!(endpoint_cleanup.cancelled_responder_calls, 0);

    let final_snapshot = crate::mm::with_boot_runtime_memory(|memory| memory.audited_snapshot())
        .expect("S140 final RuntimeMemory authority")
        .expect("S140 final RuntimeMemory audit");
    assert_eq!(final_snapshot.pmm.free_frames, baseline_free_frames);
    assert_eq!(
        final_snapshot.active_allocations,
        baseline_active_allocations
    );
    let final_broker = broker.snapshot();
    assert_eq!(final_broker.queued, 0);
    assert_eq!(final_broker.pending, 0);
    assert_eq!(final_broker.in_flight, 0);
    assert_eq!(final_broker.acknowledged, 1);
    assert_eq!(final_broker.supervisor_sessions_started, 2);
    assert_eq!(final_broker.supervisor_crashes, 1);
    assert_eq!(final_broker.recovered_inflight, 1);
    assert_eq!(final_broker.active_supervisor_session, None);
    assert!(!crate::ui::capability::ENDPOINT_REGISTRY
        .lock()
        .iter()
        .any(|endpoint| endpoint.id == endpoint_authority.id
            || endpoint.id == exact_reply.id
            || endpoint.id == cancelled_reply.id));

    kprintln!(
        "[K1-MEM2-S140] source_event={} endpoint={} crashed_supervisor={} replacement_supervisor={} crashed_domain={} replacement_domain={} SESSION=1->2 FRESH_SESSION=YES PRE_ACK_EXIT=INVALID_CAPABILITY RECOVERED_INFLIGHT=1 OLD_LEASE_ACK=STALE RETRY_ACK=EXACT RESTARTED_EL0_ACK=YES REPLY_ONESHOT=1/1 BROKER_DRAINED=YES SESSIONS=2 CRASHES=1 CRASH_RECLAIM=5 RESTART_RECLAIM=5 OWNER_EP_CLEANUP=1 free={}->{}->{}->{}->{} active={}->{}->{}->{}->{} KERNEL_DIRECT_ACK=NO EXECUTOR=PASS",
        source_event.id,
        endpoint_authority.id,
        crashed_supervisor.task_id,
        replacement_supervisor.task_id,
        crashed_domain.id(),
        replacement_domain.id(),
        baseline_free_frames,
        crash_spawned.pmm.free_frames,
        post_crash.pmm.free_frames,
        recovery_spawned.pmm.free_frames,
        final_snapshot.pmm.free_frames,
        baseline_active_allocations,
        crash_spawned.active_allocations,
        post_crash.active_allocations,
        recovery_spawned.active_allocations,
        final_snapshot.active_allocations,
    );
    run_qemu_s141_automatic_lifecycle_recovery(
        source_event,
        final_snapshot.pmm.free_frames,
        final_snapshot.active_allocations,
    );
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn acquire_s392_production_scheduler_writer_access(
) -> Result<G8lS392ProductionSchedulerWriterAccess, G8lS247WholeSchedulerAccessError> {
    let caller_cpu =
        crate::percpu::try_current_cpu_id().ok_or(G8lS247WholeSchedulerAccessError::InvalidCpu)?;
    if caller_cpu != crate::g8l_runtime_contract::CPU0 {
        return Err(G8lS247WholeSchedulerAccessError::InvalidCpu);
    }
    let access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s246_whole_scheduler_read_access_guard::S247_PRODUCTION_WHOLE_SCHEDULER_ACCESS_GATE
        .try_acquire_exclusive_for_valid_cpu(caller_cpu)?;
    Ok(G8lS392ProductionSchedulerWriterAccess { _access: access })
}

#[test]
fn boundary_has_exactly_one_s392_acquire_and_success_release_pair() {
    let boundary = s140_boundary();
    assert_eq!(
        boundary
            .matches("acquire_s392_production_scheduler_writer_access")
            .count(),
        1
    );
    assert_eq!(boundary.matches("drop(s392_writer_access)").count(), 1);
    assert_eq!(boundary.matches("drop(s392_irq_guard)").count(), 1);
}

  {
    id: "g8l-s392-qemu-s140-controlled-pre-ack-exit-call-writer-guard-integration-partial",
    date: "2026-08-29",
    sequence: 392,
    status: "passed",
    umbrella_status: "partial",
    title:
      "S392 · QEMU S140 controlled pre-ACK-exit CALL production writer guard integration",
    summary:
      "S392, run_qemu_s140_supervisor_recovery içindeki iki explicit mutable scheduler aliasından source-order önce gelen controlled pre-ACK-exit CALL sınırını tek başına production guard'a bağlar. Nonzero controller, RuntimeMemory domain'leri, immutable transport event, crashed task-bound session/old lease, controller-owned normal Endpoint SEND authority, strict controlled-exit supervisor spawn ve exact RECV grant, crash-publication IRQ release, RuntimePmm snapshot, immutable original message ve linked cancelled reply writer'dan önce tamamlanır. Dedicated S392 IRQ guard ardından gerçek per-CPU kimliğiyle CPU0-only exclusive writer S391 ve 44 production reader'ın kullandığı aynı statik S247 state word üzerinde alınır. Exact tek mutable SCHEDULER aliası yalnız endpoint id/generation, cancelled-reply id ve immutable original message ile source-order first ipc_kernel_call_and_wait çağrısını kapsar. Owned cancelled_call önce writer, sonra IRQ release sınırını geçer; exact InvalidCapability ancak iki release sonrasında doğrulanır. Cancelled-reply retirement, crashed-supervisor exact reclaim, later-stack service, RuntimePmm baseline, explicit broker recovery, old-lease StaleLease reddi ve ayrı S391 replacement exact-ACK transaction'ı downstream'da kalır. Tarihsel S321 replacement ve S322 controlled-exit audit'leri model-only'dir; S393 S138 exact-ACK CALL ayrı sıradaki kapıdır. Guarded writer 65/69, açık writer 4, provider authority 0 ve whole-scheduler exclusion false'dur. S140 fixture board-qemu, production wrapper RPi5-only olduğundan supported-profile runtime observation=0 açıkça korunur.",
    evidence: [
      "Canonical focused test S392 modülü, kernel/simulation registration'ı, CPU1 coverage service'i ve production S140 controlled pre-ACK-exit CALL membership'i yokken compile RED verdi; tarihsel S322 authority audit'i production entegrasyonu yerine geçirilmedi.",
      "İlk RED exit 101 verdi; /tmp/aselsanos-s392-initial-red.log 2223 B / dd5ee4ce0978e3e44c403f02704a32255b8b14e419351036ff38f95aea87f345 SHA-256'dır.",
      "RED distinct S392 module include_str kaynağının ve simulation crate export'unun yokluğunu exact gösterdi; S391 ikinci alias üyeliği S392 first alias üyeliği sayılmadı.",
      "İlk production-wired kaynak şekli 44/48 PASS verdi; dört RED yalnız formatter-dependent multiline assert_eq slicer varsayımıydı ve product kodu değiştirilmedi.",
      "cargo fmt sonrasındaki one-line assert_eq!(cancelled_call, ...) biçimi focused slicer'a canonical olarak öğretildi; ürün veya coverage assertion'ı gevşetilmedi.",
      "Final canonical focused koşu 48/48 PASS verdi; /tmp/aselsanos-s392-focused-green.log 3994 B / ee281e01a8fc9aa6023670a07bd259338e9c46305eec6c23524e770d200a507b SHA-256'dır.",
      "S392 guard modülü 13893 B / 79cac041ebda765c45a900cc2ff97d9922ab2f972c0e020d91625411ce24d84a SHA-256'dır.",
      "S392 focused test kaynağı 28353 B / 593e2573b1206caa7d132c7d18f489c0e4a6420980bfca0af47adea9127cf4f2 SHA-256'dır.",
      "S392 modülü typed S391 preflight outcome'unu yeniden doğrular; inherited 44 reader + 64 guarded writer + 5 open writer snapshot'ı saparsa InventoryDrift ile fail-closed kapanır.",
      "S392 başarı outcome'u SixtyFifthWriterGuardedAwaitingRemaining'dir ve exact 44 guarded reader + 65/69 guarded writer + 4 open writer envanterini sabitler.",
      "Outcome request id, reader/writer/open sayıları, S140 controlled transaction, mutable alias, upstream authority/message/reply nesneleri ve downstream InvalidCapability/recovery/S391 alanlarını typed raporlar.",
      'Production wrapper exact all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5") cfg kesişimindedir; board-qemu fixture production runtime invocation diye sunulmaz.',
      "acquire_s392_production_scheduler_writer_access gerçek try_current_cpu_id sonucunu kullanır; caller-supplied production CPU parametresi yoktur ve CPU0 dışı mutation callback'inden önce InvalidCpu ile kapanır.",
      "Writer lease S247_PRODUCTION_WHOLE_SCHEDULER_ACCESS_GATE üzerinde try_acquire_exclusive_for_valid_cpu ile alınır; S392 yeni static, ikinci state word veya ayrı exclusion domain yaratmaz.",
      "Host executor callback'i exact bir kez çağırır; canlı reader writer'ı, canlı writer ikinci writer'ı ve yeni reader'ı aynı state word üzerinde reddeder; callback error RAII lease'ini exact bırakır.",
      "S391 ve S392 executor token'ları aynı shared gate üzerinde monoton ve ayrıdır; iki kapı tek transaction, range dispatcher veya toplu S335–S400 facade membership'i değildir.",
      "Production main.rs envanterinde S140 controlled CALL source-order positions[4], yani 17 explicit main aliasının beşincisidir; S392 yalnız bu aliası sahiplenir.",
      "Aynı run_qemu_s140_supervisor_recovery öğesinde exact iki mutable scheduler aliası korunur: first controlled/cancelled CALL S392, second replacement exact-ACK CALL S391 guarded'dır.",
      "Controller current_task_id üzerinden nonzero alınır ve normal endpoint controller adına mint edilir; endpoint authority id/generation writer'a owned scalar girdiler olarak taşınır.",
      "Crashed supervisor ayrı RuntimeMemory domain'inde strict lifecycle-exit ELF olarak spawn edilir ve exact ENDPOINT_RECV authority controlled CALL'den önce grant edilir.",
      "Immutable RuntimeOomTransportEvent broker'a enqueue edilir; crashed session ile old lease exact controlled-exit supervisor identity'sine writer'dan önce bağlanır.",
      "Crash-publication IRQ guard strict supervisor ve RECV authority publication tamamlandıktan sonra düşer; dedicated S392 IRQ guard bununla nested tutulmaz.",
      "Crash-spawn RuntimeMemory snapshot'ı baseline free frame -5 ve active allocation +5 değerlerini writer acquisition'dan önce doğrular.",
      "Original message old_lease event sequence/source/epoch/fingerprint tuple'ından immutable kurulur; S392 writer message içeriğini yeniden oluşturmaz veya mutate etmez.",
      "cancelled_reply capability exact controller/endpoint ilişkisiyle writer'dan önce mint edilir; reply id S392 CALL'e owned scalar olarak aktarılır.",
      "Dedicated s392_irq_guard writer acquire'dan önce kurulur; acquire_s392_production_scheduler_writer_access, drop(s392_writer_access) ve drop(s392_irq_guard) exact birer kez görünür.",
      "Exact mutable alias ipc_kernel_call_and_wait(endpoint_authority.id, endpoint_authority.generation, cancelled_reply.id, message) çağrısını bir kez yapar.",
      "CALL terminal sonucu borrowed Scheduler referansı dışarı taşınmadan owned cancelled_call değerine alınır; guard release sonrasında Scheduler üzerinden sonuç okunmaz.",
      "drop(s392_writer_access), drop(s392_irq_guard) ve exact InvalidCapability assertion'ı bu kesin source sırasındadır.",
      "InvalidCapability yalnız controlled supervisor lifecycle reply'ı retire edip aynı caller continuation'ını uyandırdığında kabul edilir; başka hata başarı sayılmaz.",
      "Cancelled reply registry absence kontrolü InvalidCapability ve iki release sonrasındadır; S392 writer reply registry lock'unu kapsamına almaz.",
      "Crashed supervisor domain quota en fazla 256 bounded yield içinde allocated_frames=0'a dönmelidir; bu reclaim döngüsü writer lease dışında kalır.",
      "Deferred later-stack service ile post-crash RuntimePmm baseline doğrulaması S392 writer bırakıldıktan sonra yürür.",
      "broker.recover_supervisor_session(crashed_session) exact Ok(1) üretir; pending=1, in_flight=0, crashes=1, recovered_inflight=1 ve active session=None snapshot'ı korunur.",
      "Old lease exact deadline tick ile acknowledge edilmeye çalışıldığında yalnız StaleLease kabul edilir ve broker snapshot unchanged kalır.",
      "Fresh replacement session, retry lease, replacement strict supervisor, RECV grant, retry message ve exact reply S392 writer membership'inin downstream bağlamıdır.",
      "Ayrı S391 IRQ/writer transaction source-order second CALL'i kapsar; acquire_s391 ve drop(s391_writer_access) S392 exact focus'una dahil edilmez.",
      "S391 exact ACK label/badge/data, broker acknowledge/session close, replacement reclaim ve endpoint cleanup S392 release sonrasında kalır.",
      "Scheduler helper aynı IRQ/IPC transaction altında caller SEND authority, normal Endpoint object ve linked one-shot reply ilişkisini commit'ten önce yeniden doğrular.",
      "Optional receiver authority/generation ve exact receive deadline ile ready queue, blocked call, reply table ve endpoint queue kapasitesi CALL publish öncesinde fail-closed sınanır.",
      "CALL envelope publish, caller context park ve optional immediate receiver delivery aynı helper transaction'ındadır; transaction release edilmeden context switch yapılmaz.",
      "Continuation transaction release ve resume sonrasında aynı caller task'ı bulur ve yalnız owned IpcMessage veya exact stored IPC error terminal sonucunu yeniden kurar.",
      "Focused source testi complete run_qemu_s140_supervisor_recovery Rust öğesini ve exact S392 acquire→single mutable alias→first CALL→writer drop nested focus'unu birlikte doğrular.",
      "Focused test complete S140 öğesinde exact iki mutable alias sayar, S392 focus'unda yalnız first aliası ve tek ipc_kernel_call_and_wait görür.",
      "Argument-forwarding testi endpoint_authority.id, endpoint_authority.generation, cancelled_reply.id ve message değerlerinin exact first CALL'e eksiksiz aktarıldığını doğrular.",
      "Focused test exact_reply.id ve retry_message'in S392 focus'una girmediğini; cancelled_reply.id ile original message'in ise girdiğini ayrı assertion'larla sabitler.",
      "Focused grup request yokken Idle, exact pending request ile SixtyFifthWriterGuardedAwaitingRemaining ve yanlış CPU'da inherited S391 hatasını ayrı test eder.",
      "S245 request preflight sonrasında state.pending_request_id()==Some(1) kalır; take, publish, consume veya authority promotion yapılmaz.",
      "Reader-vs-writer, writer-vs-writer, nested reader/writer, callback-error release ve exact-once callback yolları birbirinden bağımsız test edilir.",
      "Production-only sembollerin tamamı aynı RPi5 AArch64 bare-metal cfg'sine bağlıdır; hostta sahte yarım production yolu oluşturulmaz.",
      "S392 modül kaynak testi provider constructor, S244 publisher ve request-state take adlarını reddeder; provider authority=0 ve exclusion=false kaynak yüzeyiyle korunur.",
      "Kernel main ve simulation lib registration'ları exact uzun S392 modül adıyla ayrı doğrulanır; sıra tablosundaki model satırı production membership yerine geçirilmez.",
      "CPU1 coverage service exceptions.rs içinde S391 service çağrısından sonra ve tarihsel S242 consumer'dan önce çalışır; mutable SCHEDULER veya S392 acquire çağırmaz.",
      "Tarihsel S321 replacement audit'i ve S322 controlled-exit audit'i model-level kalır; production S391 second membership de ayrı prior source unit'tir.",
      "S393 acquire sembolü S392 modülünde ve guarded focus'ta yoktur; QEMU S138 exact-ACK CALL sonraki kapı olarak açık kalır.",
      "İlk selected regression tarihsel S322 testinin eski inline assert_eq source spelling'ini yakaladı; ürün source order veya runtime semantiği kırılmadı.",
      "Yalnız S322 source assertion'ı owned cancelled_call → writer drop → IRQ drop → InvalidCapability → reply absence sırasını talep edecek biçimde güçlendirildi.",
      "Reconciled S322 standalone koşusu 15/15 PASS verdi; /tmp/aselsanos-s392-s322-regression-fix.log 1718 B / 759879a43ff74f472c20680e3be3044acec25b2f546b3ea6bf7408cf84f8d19d SHA-256'dır.",
      "Final selected regression S392, S391, tarihsel S321/S322 ve runtime_oom_supervisor_recovery ile 5 grup / 133 PASS / 0 fail verdi.",
      "Selected log /tmp/aselsanos-s392-selected.log 12138 B / 44fa993e9a46dfd7007085c7c8f141381b4e7dd1f9412241bbe823a4e5fd5f2f SHA-256'dır.",
      "S238–S391 dependency hedef listesi korunup yalnız S392 sona eklendi; iki bağımsız seri koşu 156 grup / 3955/3955 PASS verdi.",
      "Dependency timing-normalized ve LC_ALL=C sıralı özetlerin her biri 33650 B / a4440e70ec6965b5e62f4141b77e3e7e6aa07c3b1ed866dddfbd701e305707d8 SHA-256 ile byte-exact eşittir.",
      "Dependency artifact root /tmp/aselsanos-s392-dependency.BxIwZM; raw run1 392907 B / cae9f54fa715ef27e4a0f7a0c32fee35f1c705348ed899ea563d23396ad8169c ve run2 377251 B / 387b8b09e6ec095989a572f493b97e50a9be531dae8cf2b83a7d2ea1153977d3'tür.",
      "Yalnız finished in süre suffix'i normalization kapsamındadır; test isimleri, hedef sırası, pass/fail adetleri ve durum payload'ı canonical özette kalır.",
      "Yedi exact frozen assertion dışındaki serial workspace 355 result group / 5835 PASS / 0 fail / 7 filtered verdi.",
      "Filtered workspace raw log 75405 B / 97406c3f46a051da94b46fda6791bcd24747cbea6444e6545713e44195e9792c ve summary 33607 B / 4ef6ea8b5dcefbbb9e1800d6b3a19cdd0738d175037fbb7d17f50ad91fc2e2a1'dir.",
      "Filtresiz workspace exit 101 ile yalnız frozen S96 wiring_does_not_mutate_timer_gic_boot_or_expand_runtime_scope assertion'ında durdu; 308 result group / 5580 PASS / 1 fail ve global workspace GREEN claimed=false'dur.",
      "Filtresiz raw log 70627 B / 1b7ad81b30fe93ee50675f79bdf09a50778e8d68923f1fa80b00fa5f04090027 ve summary 29188 B / 907e1658ff24f662134ba40287feb13a4dfceedf6f1b0abef51b053298b3e8c1'dir.",
      "Workspace artifact root /tmp/aselsanos-s392-workspace.UyvSNS'dir; yedi filtre adı S391 kabulünden değiştirilmeden korunur.",
      "Dört fresh canonical AArch64 profil kernel çalışma dizininden CARGO_INCREMENTAL=0, explicit feature ve birbirinden ayrı target dizinleriyle 4/4 exit 0 verdi; zero-warning iddiası yoktur.",
      "Fresh board-qemu logu 111882 B / cc4c5698257ac6bd633c81753edeb7294a7a3a3f822daa437d9fec06324a6601 ve 293 warning header; ELF 16814112 B / 675772f2185cda652c122d6603d83f6bec1192431078cac958aba611dfba66af'dır.",
      "Fresh board-rpi4 logu 150623 B / e06ee7ab6bef90087d4f97d904d89b8a9dce223b394cb3e340784981b42b1af4 ve 391 warning header; ELF 11925440 B / d3c5bcd1c908574a9bcb2ea4cf08b9398da97cbceeaca1fa2380b558ea8b1e91'dir.",
      "Fresh board-rpi5 logu 667511 B / 4ccdc2c10573cbc39dc67bc73f9d0ec2a83fceb6b0d9a4e6e8d0e87c413e118c ve 1530 warning header; ELF 15385928 B / 50004200b199264ae75a335672af5d0a7459b59d1721ce908eea1e21305b18cb'dır.",
      "Fresh board-rpi5+smp logu 667453 B / 80f0b7c57f08b821a4c5902cac20e0c620cfa47a34740b994d69a243e74971cf ve 1530 warning header; ELF 15416064 B / de1470c57b9a308af92e960d9216563ce39512c41fb4c81ff4dd31836fa89e97'dir.",
      "Dört profil /tmp/aselsanos-s392-profiles.UArk8C altında tutulur; build log ve ELF byte/hash ölçüleri birbirine karıştırılmaz.",
      "CARGO_INCREMENTAL=0 make verify-qemu 116354 B / b810e2bbe5465ff13e4d6e26f03e16cbce911a9646ba5135ccac935ae14a57b4 SHA-256 ile strict ELF W^X 31/31, S130–S154 + S271, IPC 20/20 ve scheduler SEC5 PASS verdi.",
      "QEMU logunda S140 pre-ACK exit, explicit recovery ve exact retry senaryosu gözlendi; board-qemu guest RPi5-only S392 lease'ini compile etmediği için bu writer runtime observation değildir.",
      "Final cargo fmt --all -- --check ve git diff --check exit 0 ve boş çıktı verdi; 0 B / e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 SHA-256'dır.",
      "S392 proof owned boundary, coverage, source identities, TDD, S322 reconciliation, selected regression, dependency reproducibility, workspace, profiles, QEMU/format ve Code publication contract bölümlerini ayrı taşır.",
      "Code yayın hedefi S1–S392 392/392 ayrı kapıdır; kullanıcının özellikle istediği S328 öncesi S1–S327 aralığı 327/327 tekil kalmalı, missing=none ve duplicate=0 olmalıdır.",
      "S392 Code kartı complete run_qemu_s140_supervisor_recovery Rust öğesini, yalnız first controlled CALL'e ait nested acquire→release focus'unu, complete S392 guard modülünü, complete 48-test target'ını, proof'u ve complete Operations object'ini yayımlar.",
      "Complete production excerpt iki S140 CALL'i bağlamıyla gösterirken nested focus yalnız s392_writer_access acquisition'dan drop(s392_writer_access)'e kadar kesilir; S391 second membership bu focus'a katılmaz.",
      "S1, S327, S328, S391 ve S392 kartlarının exact birer kez görünmesi; S393'ün pre-publish edilmemesi website kabulünde sayılacaktır.",
      "Her Code kartı mappingStrategy, kind, sourcePath, complete excerpt, satır aralığı ve SHA-256 kimliği taşır; test komutu asıl uygulama/model kodunun yerine geçirilmez.",
      "S392 için güç, SD kart, Mac kart erişimi, UART capture, raw validation, archive veya promotion işlemi yapılmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S392=NO.",
      "Bağlayıcı olmayan S392 projeksiyonu R1 S392–S422, R2 S447–S497, R3 S576+, risk aralığı S552–S602 ve merkez yaklaşık S577'dir; sıra veya ürün taahhüdü değildir.",
      "İlk production publication registry'si S1–S392 392/392 unique kapı, 1136 exact excerpt ve özellikle S328 öncesi S1–S327 327/327 tekil kart üretti; missing=none, duplicate=0, S1/S327/S328/S391/S392 exact birer ve S393=0'dır.",
      "İlk registry mapping'i 65 writer-guard + 225 focused-test + 94 command-contract + 8 operation-record = 392'dir; generated JSON 8897129 B / 035ac5b3d115dad26f8f1b0da03a0b8148ee926cf22b9ab6a8f7ecb70ba3d925 dosya SHA-256 ve fb42fa4705129694648746cee11ca4ae58357c1fa07a0766d7db49a3a6e7d41f registry SHA-256 taşır.",
      "Website production kabulü 712/712 test PASS, lint PASS, boş TypeScript çıktısı ve 24/24 static page verdi; export 200 dosya, Timeline ve yol-haritasi ayrı ayrı 231 data-gate-policy kartıdır.",
      "Publication öncesi S392 core Operations policy 17158 karakter / 17738 UTF-8 byte, 86 evidence satırı, 3 teknik terminal session ve 8 limitation taşıdı; S324 tabanı 5965 karakter / 6122 byte'dır.",
      "İlk production/main deployment a645f5d1 ile 115 uploaded + 84 existing = 199 asset ve _headers yayımladı; deploy logu 1713 B / 50192ab23983c46a6db7f1ccbfdff87cbfccac5c5e86ec7a29cb766604090506 SHA-256'dır.",
      "Cache-busted custom-domain readback /code/ 24922971 B / 35cb55461cf2e4a4123366ffb9f723f025f928b3aaaf15a53532a425408dc95e, /operations/ 15286355 B / b1470edbfc34666ad5a953c912c59436ea99bbf316feab125a0da8e55d566b0b, /timeline/ 6416720 B / 5954cd420c985bd7649d0e922443943eee561fd70a6e7c66edcecde898ccfb74 ve /yol-haritasi/ 6416468 B / eba1bae1dec5e636453a2564358faf0d8ab6369535e98fe94ad8b983be46a10c SHA-256 ile HTTP 200 ve deployment out'una raw byte-exact=true verdi.",
      "Canlı /code/ total=392, unique=392, pre-S328=327, S1=1, S327=1, S328=1, S391=1, S392=1 ve S393=0 ölçtü; cache-control no-transform ve x-content-type-options nosniff başlıkları doğrulandı.",
      "İlk readback artifact root /tmp/aselsanos-s392-readback-initial.1GkQnI'dir; immutable a645f5d1 hostname probe'u curl exit 28 / HTTP 000 verdi ve custom-domain PASS yerine geçirilmedi.",
    ],
    commands: [
      "CARGO_INCREMENTAL=0 cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s392_qemu_s140_controlled_pre_ack_exit_call_writer_guard_integration -- --test-threads=1",
      "run S392, S391, S321, S322 and runtime_oom_supervisor_recovery serially",
      "run S238-S392 dependency list twice and normalize timing fields",
      "run filtered and unfiltered serial workspace audits",
      "run four fresh isolated AArch64 profile builds",
      "CARGO_INCREMENTAL=0 make verify-qemu",
      "cargo fmt --all -- --check && git diff --check",
      "npm run code:generate && npm run code:check",
      "npm test && npm run lint && npx tsc --noEmit && npm run build",
      "npm run deploy",
      "cache-busted curl + cmp for /code/, /operations/, /timeline/ and /yol-haritasi/",
    ],
    terminalSessions: [
      {
        id: "g8l-s392-focused-source-contract",
        title:
          "S392 focused S140 controlled pre-ACK-exit CALL writer membership",
        commandLines: [
          "CARGO_INCREMENTAL=0 cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s392_qemu_s140_controlled_pre_ack_exit_call_writer_guard_integration -- --test-threads=1",
        ],
        outputLines: [
          "initial result: compile RED; distinct S392 module/export and production S140 first-call boundary missing",
          "first wired result: 44/48 PASS; formatter-sensitive source slicer corrected, product code unchanged",
          "final result: 48/48 PASS; exact first alias and owned InvalidCapability release order",
          "shared S247 gate: 44 guarded readers + 65/69 guarded writers; 4 writers open",
          "board-qemu fixture / board-rpi5 wrapper supported-profile intersection=0; provider authority=0",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8l-s392-selected-regression",
        title:
          "S392 selected S140 controlled/replacement and supervisor recovery regression",
        commandLines: [
          "run S392, S391, S321, S322 and runtime_oom_supervisor_recovery serially",
        ],
        outputLines: [
          "historical S322 source assertion reconciled to owned result → writer drop → IRQ drop → InvalidCapability order; standalone 15/15 PASS",
          "final result: 5 groups / 133 passed / 0 failed",
          "S391 replacement exact-ACK CALL remains guarded separately; S393 S138 exact-ACK remains open",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8l-s392-full-acceptance",
        title:
          "S392 dependency, workspace, profiles, QEMU and format acceptance",
        commandLines: [
          "run S238-S392 dependency list twice and normalize timing fields",
          "run filtered and unfiltered serial workspace audits",
          "run four fresh isolated AArch64 profile builds",
          "CARGO_INCREMENTAL=0 make verify-qemu",
          "cargo fmt --all -- --check && git diff --check",
        ],
        outputLines: [
          "dependency 156 groups / 3955/3955 twice; normalized 33650-byte summaries are SHA-256 identical",
          "filtered workspace 355 groups / 5835 PASS / 7 filtered; unfiltered frozen-S96 remains RED at 5580 PASS / 1 fail",
          "four fresh profiles 4/4 exit 0; build-log and ELF identities measured separately; zero-warning claim=false",
          "QEMU W^X 31/31 + S130-S154 + S271 + IPC 20/20 + SEC5 PASS; not an S392 writer runtime observation",
          "final rustfmt and diff whitespace checks exit 0 with empty output",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8l-s392-production-publication",
        title:
          "S392 Operations, Timeline, roadmap and Code production publication",
        commandLines: [
          "npm run code:generate && npm run code:check",
          "npm test && npm run lint && npx tsc --noEmit && npm run build",
          "npm run deploy",
          "cache-busted curl + cmp for /code/, /operations/, /timeline/ and /yol-haritasi/",
        ],
        outputLines: [
          "registry S1-S392 392/392 unique; S1-S327 327/327; 1136 excerpts; missing=none; duplicate=0; S393=0",
          "website 712/712 PASS; lint PASS; TypeScript empty; static pages 24/24; export files 200; Timeline cards 231",
          "production/main deployment a645f5d1; 115 uploaded + 84 existing = 199 assets",
          "four cache-busted custom-domain routes HTTP 200 and raw byte-exact=true; /code/ no-transform/nosniff",
          "live Code total=392 unique=392 pre-S328=327; S1/S327/S328/S391/S392=1; S393=0",
          "immutable deployment hostname exit 28 / HTTP 000; not counted as custom-domain acceptance",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
    ],
    terminalSessionsNote:
      "S392 altmış beşinci production writer'ın dar kaynak entegrasyonudur. Yalnız S140 source-order first controlled pre-ACK-exit CALL mutable scheduler aliası guarded'dır; upstream authority/publication ve downstream InvalidCapability/reclaim/recovery/S391 dışında kalır. Teknik kanıt GREEN, bütün scheduler exclusion ve ürün kabulü PARTIAL'dır.",
    limitations: [
      "Dört production writer aynı shared gate dışında kaldığı için whole-scheduler exclusion ve provider authority açık kalır.",
      "Board-qemu S140 fixture ile board-rpi5-only S392 wrapper aynı supported profilde kesişmez; production writer runtime invocation/observation kanıtı yoktur.",
      "QEMU S140 kabulü controlled-exit ve explicit recovery ürün senaryosunu doğrular, fakat RPi5-only writer lease'in runtime'da alındığını doğrulamaz.",
      "Source-order second replacement exact-ACK S140 CALL ayrı S391 membership'idir; S392 iki aliası tek range guard altında birleştirmez.",
      "S393 QEMU S138 exact-ACK CALL ayrı sıradaki kapıdır ve S392 tarafından completed sayılmaz.",
      "S245 request tüketilmez, S244 admission yayınlanmaz ve provider authority kurulmaz.",
      "Generic SMP arbitration, transient-contention liveness/soak ve fiziksel RPi kabulü açık kalır.",
      "S392 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S392=NO.",
    ],
  },