S395 · QEMU S136 exact-ACK CALL production writer guard integration

#[cfg(feature = "board-qemu")]
extern "C" fn qemu_strict_el0_ipc_peers_oom_supervisor() -> ! {
    use crate::elf::load_and_spawn_user_elf_from_boot_runtime_with_arg;
    use crate::elf_plan::{AddressRange, ElfLoadPolicy};
    use crate::mm::{
        PressureLevel, RuntimeOomCoordinatorError, RuntimeOomEventKind, RuntimeOomPolicy,
    };
    use crate::ui::capability::{CapabilityRights, IpcMessage};
    use crate::userspace_binaries::OOM_SUPERVISOR_BINARY;

    const S136_EVENT_LABEL: u64 = 0x5331_3336;
    const S136_STALE_ACK_LABEL: u64 = 0x5354_414c;
    const S136_EXACT_ACK_LABEL: u64 = 0x4143_4b31;

    let state = QEMU_STRICT_EL0_PEERS_OOM_STATE
        .lock()
        .as_ref()
        .copied()
        .expect("S135 strict peers OOM state");
    assert_eq!(crate::task::current_task_id(), Some(state.supervisor_task));
    let mut completion = loop {
        match unsafe { crate::task::service_deferred_current_runtime_oom() } {
            Ok(Some(completion)) => break completion,
            Ok(None) => unsafe { crate::task::yield_now() },
            Err(error) => panic!("S135 later-stack completion failed: {:?}", error),
        }
    };
    assert_eq!(completion.execution.task_id, state.responder_task);
    assert_eq!(completion.execution.ipc_teardown.owned_endpoints, 0);
    assert_eq!(completion.execution.ipc_teardown.drained_calls, 0);
    assert_eq!(
        completion.execution.ipc_teardown.cancelled_responder_calls,
        1
    );
    let reply_cap_id = QEMU_STRICT_EL0_PEERS_REPLY_CAP.load(core::sync::atomic::Ordering::Acquire);
    assert_ne!(reply_cap_id, 0);

    // Depending on equal-vruntime tie-breaking, completion may reach the
    // owner before the newly woken caller has executed its marker and EXIT.
    // Bounded yields preserve fail-closed progress without assuming that
    // scheduler detail; absence also proves the normal later-stack reaper ran.
    let mut peers_reaped = false;
    for _ in 0..128 {
        let witnesses =
            crate::task::qemu_s135_ipc_witnesses_observed(state.caller_task, state.responder_task);
        let graph_absent = unsafe {
            crate::task::qemu_s135_strict_peers_cancellation_state(
                state.caller_task,
                state.responder_task,
                state.supervisor_task,
                state.endpoint_id,
                reply_cap_id,
            )
        };
        if witnesses && graph_absent {
            peers_reaped = true;
            break;
        }
        unsafe { crate::task::yield_now() };
    }
    assert!(
        peers_reaped,
        "S135 strict peers did not reach exact reaped state"
    );

    let event = completion
        .coordinator
        .deliver_next_event()
        .expect("S135 supervisor delivery");
    assert_eq!(event.id, completion.execution.event_id);
    assert_eq!(event.task_id, Some(state.responder_task));
    assert_eq!(event.domain, Some(state.strict_responder_oom));
    assert_eq!(event.kind, RuntimeOomEventKind::TeardownComplete);
    assert_eq!(
        event.expected_reclaimable_frames,
        state.responder_frames_before
    );
    assert_eq!(event.observed_domain_frames, 0);

    // S136: keep the coordinator's fixed event as authority, but transport an
    // immutable projection through the production endpoint. The current
    // kernel supervisor is a normal synchronous CALL client; it blocks in the
    // same bounded rendezvous until the standalone strict EL0 receiver uses
    // the ordinary one-shot SYS_IPC_REPLY path.
    let transport_domain = crate::mm::with_boot_runtime_memory(|memory| {
        memory.register_domain(QEMU_EL0_OOM_SUPERVISOR_RUNTIME_DOMAIN_ID)
    })
    .expect("S136 supervisor runtime-memory authority")
    .expect("S136 strict supervisor domain registration");
    let transport_baseline =
        crate::mm::with_boot_runtime_memory(|memory| memory.audited_snapshot())
            .expect("S136 transport baseline authority")
            .expect("S136 transport baseline audit");
    assert_eq!(
        transport_baseline.pmm.free_frames,
        state.baseline_free_frames
    );
    assert_eq!(
        transport_baseline.active_allocations,
        state.baseline_active_allocations
    );
    let endpoint_authority = crate::task::current_task_cnode()
        .and_then(|cnode| cnode.lookup_capability_by_id(state.endpoint_id).copied())
        .filter(|capability| {
            capability.owner == state.supervisor_task
                && capability.parent.is_none()
                && capability.rights.contains(CapabilityRights::ENDPOINT_SEND)
        })
        .expect("S136 kernel supervisor SEND authority");
    let no_forbidden_ranges: [AddressRange; 0] = [];
    let el0_supervisor = unsafe {
        load_and_spawn_user_elf_from_boot_runtime_with_arg(
            "oom-strict-el0-supervisor-elf",
            OOM_SUPERVISOR_BINARY,
            ElfLoadPolicy::new(
                AddressRange::new(0x02c0_0000, 0x02c1_0000),
                &no_forbidden_ranges,
                16,
            ),
            0x8090_1000,
            4,
            0,
            8,
            transport_domain,
            state.endpoint_id,
        )
    }
    .expect("S136 strict EL0 supervisor spawn");
    crate::ui::capability::grant_task_endpoint_to_task(
        endpoint_authority,
        state.supervisor_task,
        el0_supervisor.task_id,
        CapabilityRights::ENDPOINT_RECV,
    )
    .expect("S136 typed supervisor RECV grant");
    let spawned_transport = crate::mm::with_boot_runtime_memory(|memory| {
        Ok::<_, crate::mm::RuntimeAllocationError>((
            memory.audited_domain_quota(transport_domain)?,
            memory.audited_snapshot()?,
        ))
    })
    .expect("S136 spawned transport authority")
    .expect("S136 spawned transport audit");
    assert_eq!(spawned_transport.0.allocated_frames, 5);
    assert_eq!(
        spawned_transport.1.pmm.free_frames,
        transport_baseline.pmm.free_frames - 5
    );
    assert_eq!(
        spawned_transport.1.active_allocations,
        transport_baseline.active_allocations + 5
    );
    kprintln!(
        "[K1-MEM2-S136] supervisor strict spawn PASS id={} pages={} domain={} endpoint={} INITIAL_X0=YES W^X=YES",
        el0_supervisor.task_id,
        el0_supervisor.page_count,
        transport_domain.id(),
        state.endpoint_id,
    );

    let packed_reclaim = event
        .expected_reclaimable_frames
        .checked_shl(32)
        .and_then(|expected| expected.checked_add(event.observed_domain_frames))
        .expect("S136 event projection overflow");
    let event_message = IpcMessage {
        label: S136_EVENT_LABEL,
        badge: state.supervisor_task,
        data: [
            event.id,
            state.responder_task,
            state.strict_responder_oom.id() as u64,
            packed_reclaim,
        ],
    };
    let stale_reply_cap = crate::ui::capability::mint_reply_endpoint_for_call(
        state.supervisor_task,
        state.endpoint_id,
    )
    .expect("S136 stale transport reply mint");
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s396_irq_guard = crate::arch::aarch64::IrqGuard::new();
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s396_writer_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s396_qemu_s136_stale_ack_writer_guard_integration::acquire_s396_production_scheduler_writer_access()
        .unwrap_or_else(|error| {
            panic!(
                "S396 QEMU S136 stale-ACK CALL scheduler writer guard failed closed: {:?}",
                error
            )
        });
    let stale_ack = unsafe {
        (&mut *core::ptr::addr_of_mut!(crate::task::scheduler::SCHEDULER)).ipc_kernel_call_and_wait(
            state.endpoint_id,
            endpoint_authority.generation,
            stale_reply_cap.id,
            event_message,
        )
    }
    .expect("S136 stale EL0 ACK transport");
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s396_writer_access);
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s396_irq_guard);
    assert_eq!(stale_ack.label, S136_STALE_ACK_LABEL);
    assert_eq!(stale_ack.badge, el0_supervisor.task_id);
    assert_eq!(stale_ack.data[0], event.id + 1);
    assert_eq!(stale_ack.data[1..], event_message.data[1..]);
    let before_stale = completion.coordinator.snapshot();
    assert_eq!(
        completion.coordinator.acknowledge(stale_ack.data[0]),
        Err(RuntimeOomCoordinatorError::AckMismatch {
            expected: event.id,
            provided: event.id + 1,
        })
    );
    assert_eq!(completion.coordinator.snapshot(), before_stale);
    assert_eq!(
        completion
            .coordinator
            .rearm_monitor(&mut completion.monitor),
        Err(RuntimeOomCoordinatorError::AttemptInFlight)
    );

    let exact_reply_cap = crate::ui::capability::mint_reply_endpoint_for_call(
        state.supervisor_task,
        state.endpoint_id,
    )
    .expect("S136 exact transport reply mint");
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s395_irq_guard = crate::arch::aarch64::IrqGuard::new();
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s395_writer_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s395_qemu_s136_exact_ack_writer_guard_integration::acquire_s395_production_scheduler_writer_access()
        .unwrap_or_else(|error| {
            panic!(
                "S395 QEMU S136 exact-ACK CALL scheduler writer guard failed closed: {:?}",
                error
            )
        });
    let exact_ack = unsafe {
        (&mut *core::ptr::addr_of_mut!(crate::task::scheduler::SCHEDULER)).ipc_kernel_call_and_wait(
            state.endpoint_id,
            endpoint_authority.generation,
            exact_reply_cap.id,
            event_message,
        )
    }
    .expect("S136 exact EL0 ACK transport");
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s395_writer_access);
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s395_irq_guard);
    assert_eq!(exact_ack.label, S136_EXACT_ACK_LABEL);
    assert_eq!(exact_ack.badge, el0_supervisor.task_id);
    assert_eq!(exact_ack.data, event_message.data);
    completion
        .coordinator
        .acknowledge(exact_ack.data[0])
        .expect("S136 exact EL0 supervisor ACK");
    let rearmed_epoch = completion
        .coordinator
        .rearm_monitor(&mut completion.monitor)
        .expect("S136 post-ACK monitor rearm");

    let mut transport_reclaimed = false;
    for _ in 0..128 {
        let quota = crate::mm::with_boot_runtime_memory(|memory| {
            memory.audited_domain_quota(transport_domain)
        })
        .expect("S136 supervisor quota authority")
        .expect("S136 supervisor quota audit");
        if quota.allocated_frames == 0 {
            transport_reclaimed = true;
            break;
        }
        unsafe { crate::task::yield_now() };
    }
    assert!(
        transport_reclaimed,
        "S136 strict EL0 supervisor did not reach normal reclaim"
    );
    let _ = unsafe { crate::task::service_deferred_current_runtime_oom() }
        .expect("S136 later-stack normal-exit reap");
    let transport_final = crate::mm::with_boot_runtime_memory(|memory| memory.audited_snapshot())
        .expect("S136 final transport authority")
        .expect("S136 final transport audit");
    assert_eq!(
        transport_final.pmm.free_frames,
        transport_baseline.pmm.free_frames
    );
    assert_eq!(
        transport_final.active_allocations,
        transport_baseline.active_allocations
    );
    assert!(!crate::ui::capability::ENDPOINT_REGISTRY
        .lock()
        .iter()
        .any(|endpoint| endpoint.id == stale_reply_cap.id || endpoint.id == exact_reply_cap.id));
    kprintln!(
        "[K1-MEM2-S136] event={} victim={} domain={} endpoint={} stale_reply={} exact_reply={} supervisor={} free={}->{}->{} active={}->{}->{} REAL_ENDPOINT=YES BOUNDED=8 KERNEL_CALL_BLOCKED=YES REAL_RECV_REPLY=YES STALE_ACK_REJECTED=YES EXACT_EL0_ACK=YES REPLY_ONESHOT=2/2 SUPERVISOR_RECLAIM=5 ACK=YES REARM={} LEVEL=NORMAL",
        event.id,
        state.responder_task,
        state.strict_responder_oom.id(),
        state.endpoint_id,
        stale_reply_cap.id,
        exact_reply_cap.id,
        el0_supervisor.task_id,
        transport_baseline.pmm.free_frames,
        spawned_transport.1.pmm.free_frames,
        transport_final.pmm.free_frames,
        transport_baseline.active_allocations,
        spawned_transport.1.active_allocations,
        transport_final.active_allocations,
        rearmed_epoch,
    );
    let policies = [
        RuntimeOomPolicy::new(state.primary, i16::MAX, true),
        RuntimeOomPolicy::new(state.prior_oom, i16::MAX, true),
        RuntimeOomPolicy::new(state.current_oom, i16::MAX, true),
        RuntimeOomPolicy::new(state.live_ipc_oom, i16::MAX, true),
        RuntimeOomPolicy::new(state.el0_ipc_oom, i16::MAX, true),
        RuntimeOomPolicy::new(state.s134_responder_oom, i16::MAX, true),
        RuntimeOomPolicy::new(state.strict_caller_oom, i16::MAX, true),
        RuntimeOomPolicy::new(state.strict_responder_oom, 0, false),
        RuntimeOomPolicy::new(transport_domain, i16::MAX, true),
    ];
    let recovered =
        crate::mm::with_boot_runtime_memory(|memory| completion.monitor.observe(memory, &policies))
            .expect("S135 recovered memory authority")
            .expect("S135 recovered pressure observation");
    assert_eq!(recovered.observation.current, PressureLevel::Normal);

    let (caller_quota, responder_quota, final_snapshot) =
        crate::mm::with_boot_runtime_memory(|memory| {
            Ok::<_, crate::mm::RuntimeAllocationError>((
                memory.audited_domain_quota(state.strict_caller_oom)?,
                memory.audited_domain_quota(state.strict_responder_oom)?,
                memory.audited_snapshot()?,
            ))
        })
        .expect("S135 final RuntimeMemory authority")
        .expect("S135 final RuntimeMemory reconciliation");
    assert_eq!(caller_quota.allocated_frames, 0);
    assert_eq!(responder_quota.allocated_frames, 0);
    assert_eq!(
        final_snapshot.active_allocations,
        state.baseline_active_allocations
    );
    assert_eq!(final_snapshot.pmm.free_frames, state.baseline_free_frames);
    assert_eq!(
        final_snapshot.pmm.free_frames,
        event
            .observed_free_frames
            .checked_add(state.caller_frames_before)
            .expect("S135 final free-frame expectation overflow")
    );
    let strict_caller_reclaim = state
        .caller_frames_before
        .checked_sub(caller_quota.allocated_frames)
        .expect("S135 strict caller reclaim underflow");

    let endpoint_cleanup =
        crate::ui::capability::teardown_task_ipc_lifecycle(state.supervisor_task)
            .expect("S135 empty owner endpoint cleanup");
    assert_eq!(endpoint_cleanup.owned_endpoints, 1);
    assert_eq!(endpoint_cleanup.drained_calls, 0);
    assert_eq!(endpoint_cleanup.cancelled_responder_calls, 0);
    assert!(!crate::ui::capability::ENDPOINT_REGISTRY
        .lock()
        .iter()
        .any(|endpoint| endpoint.id == state.endpoint_id || endpoint.id == reply_cap_id));
    assert!(crate::ui::capability::get_live_capability(state.endpoint_id).is_none());
    assert!(crate::ui::capability::get_live_capability(reply_cap_id).is_none());

    kprintln!(
        "[K1-MEM2-S135] responder={} caller={} owner={} responder_domain={} caller_domain={} endpoint={} reply={} event={} expected={} observed={} free={}->{}->{} OWNED_EP=0 DRAINED_CALLS=0 RESPONDER_CALLS=1 STRICT_CALLER_RECLAIM={} CALLER_DOMAIN_FRAMES={} RESPONDER_DOMAIN_FRAMES={} ACTIVE_ALLOCATIONS={}->{} GLOBAL_BASELINE=PASS EL0_CALL_RETURN=INVALID_CAPABILITY EL0_RECV=DELIVERED BOTH_STRICT=YES GRAPH=ABSENT OWNER_EP_CLEANUP=1 CURRENT=YES LATER_STACK=YES ACK=YES REARM={} LEVEL=NORMAL EXECUTOR=PASS",
        completion.execution.task_id,
        state.caller_task,
        state.supervisor_task,
        state.strict_responder_oom.id(),
        state.strict_caller_oom.id(),
        state.endpoint_id,
        reply_cap_id,
        event.id,
        event.expected_reclaimable_frames,
        event.observed_domain_frames,
        event.baseline_free_frames,
        event.observed_free_frames,
        final_snapshot.pmm.free_frames,
        strict_caller_reclaim,
        caller_quota.allocated_frames,
        responder_quota.allocated_frames,
        state.spawned_active_allocations,
        final_snapshot.active_allocations,
        rearmed_epoch,
    );
    drop(completion);
    unsafe { run_qemu_s137_timer_pressure_smoke(state, transport_domain) };
    unsafe { crate::task::task_exit() }
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn acquire_s395_production_scheduler_writer_access(
) -> Result<G8lS395ProductionSchedulerWriterAccess, G8lS247WholeSchedulerAccessError> {
    let caller_cpu =
        crate::percpu::try_current_cpu_id().ok_or(G8lS247WholeSchedulerAccessError::InvalidCpu)?;
    if caller_cpu != crate::g8l_runtime_contract::CPU0 {
        return Err(G8lS247WholeSchedulerAccessError::InvalidCpu);
    }
    let access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s246_whole_scheduler_read_access_guard::S247_PRODUCTION_WHOLE_SCHEDULER_ACCESS_GATE
        .try_acquire_exclusive_for_valid_cpu(caller_cpu)?;
    Ok(G8lS395ProductionSchedulerWriterAccess { _access: access })
}

#[test]
fn boundary_has_exactly_one_s395_acquire_and_success_release_pair() {
    let boundary = s136_boundary();
    assert_eq!(
        boundary
            .matches("acquire_s395_production_scheduler_writer_access")
            .count(),
        1
    );
    assert_eq!(boundary.matches("drop(s395_writer_access)").count(), 1);
    assert_eq!(boundary.matches("drop(s395_irq_guard)").count(), 1);
}

  {
    id: "g8l-s395-qemu-s136-exact-ack-call-writer-guard-integration-partial",
    date: "2026-08-29",
    sequence: 395,
    status: "passed",
    umbrella_status: "partial",
    title:
      "S395 · QEMU S136 exact-ACK CALL production writer guard integration",
    summary:
      "S395, qemu_strict_el0_ipc_peers_oom_supervisor içindeki iki explicit mutable scheduler aliasından source-order sonra gelen exact-ACK CALL sınırını tek başına production guard'a bağlar. Nonzero current supervisor identity, completed responder lifecycle, reaped strict peers, fixed coordinator event, audited transport baseline, task-owned parentless normal Endpoint SEND authority, strict EL0 supervisor ile RECV grant, immutable event message, source-order first stale-ACK CALL, stale label/badge/mismatched event id/unchanged tail doğrulaması, AckMismatch ile unchanged coordinator snapshot, AttemptInFlight rearm reddi ve linked exact reply writer'dan önce tamamlanır. Dedicated S395 IRQ guard ardından gerçek per-CPU kimliğiyle CPU0-only exclusive writer S394 ve 44 production reader'ın kullandığı aynı statik S247 state word üzerinde alınır. Exact tek mutable SCHEDULER aliası yalnız endpoint id/generation, exact-reply id ve immutable message ile source-order second ipc_kernel_call_and_wait çağrısını kapsar. Owned exact_ack önce writer, sonra IRQ release sınırını geçer; exact label/badge/data doğrulaması iki release sonrasındadır. Coordinator acknowledge/rearm, bounded supervisor reclaim, later-stack service, transport RuntimePmm baseline ve endpoint cleanup downstream'da kalır. Tarihsel S325 exact ve S326 stale authority audit'leri model-only'dir; source-order first S136 stale CALL S396 için ayrı ve açıktır. Guarded writer 68/69, açık writer 1, provider authority 0 ve whole-scheduler exclusion false'dur. S136 fixture board-qemu, production wrapper RPi5-only olduğundan supported-profile runtime observation=0 açıkça korunur.",
    evidence: [
      "Canonical focused test S395 modülü, kernel/simulation registration'ı, CPU1 coverage service'i ve production S136 exact-ACK CALL membership'i yokken compile RED verdi; tarihsel S325 authority audit'i production entegrasyonu yerine geçirilmedi.",
      "İlk RED exit 101 verdi; /tmp/aselsanos-s395-initial-red.log 3212 B / 68bd36a7401d3e62758c08f7d8a45e45a0760c39b238d57e69e5061ee1bd8b95 SHA-256'dır.",
      "RED distinct S395 source include_str dosyasının ve simulation crate export'unun yokluğunu compiler diagnostic ile gösterdi.",
      "İlk wired koşu 7 PASS / 1 test-only RED verdi; test gerçek helper yerine invented linked_reply_capability_is_live/IpcTransaction isimlerini arıyordu, ürün kodu değiştirilmedi.",
      "Helper testi gerçek IPC_TRANSACTION_LOCK, current_endpoint_authority_is_live, reply_is_linked, call, finish_call_park, capacity, deadline ve continuation marker'larına bağlandı.",
      "49-test genişletmesinin ilk koşusu 48 PASS / 1 test-only boundary-slicer RED verdi; nonexistent S137 declaration marker'ı main.rs sonuna kadar dilimliyordu.",
      "Boundary slicer gerçek /// S137 runtime acceptance sınırına bağlandı; product membership, sayaç veya release sırası gevşetilmedi.",
      "Final canonical focused koşu 49/49 PASS verdi; /tmp/aselsanos-s395-focused-green-final.log 3996 B / 4d78be61cefa8fcefcb40f33a4cb49b56ac05a6256ec608fc7e88490343615eb SHA-256'dır.",
      "S395 guard modülü 14163 B / 4e221f37998ea70df14184f88bde51711a8f6de4a98e94872e2718aaa07a1414 SHA-256'dır.",
      "S395 focused test kaynağı 29541 B / bb539765ff636d141949b671ebd161829f9a4d599a4534feca5f210137db63cb SHA-256'dır.",
      "S395 modülü typed S394 preflight outcome'unu yeniden doğrular; inherited 44 reader + 67 guarded writer + 2 open writer snapshot'ı saparsa InventoryDrift ile fail-closed kapanır.",
      "S395 başarı outcome'u SixtyEighthWriterGuardedAwaitingFinal'dır ve exact 44 guarded reader + 68/69 guarded writer + 1 open writer envanterini sabitler.",
      "Outcome request id, reader/writer/open sayıları, S136 exact transaction, mutable alias, tüm upstream authority/stale-path alanları ve downstream ACK/rearm/reclaim/cleanup alanlarını typed raporlar.",
      'Production wrapper exact all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5") cfg kesişimindedir; board-qemu fixture production runtime invocation diye sunulmaz.',
      "acquire_s395_production_scheduler_writer_access gerçek try_current_cpu_id sonucunu kullanır; caller-supplied production CPU parametresi yoktur ve CPU0 dışı mutation callback'inden önce InvalidCpu ile kapanır.",
      "Writer lease S247_PRODUCTION_WHOLE_SCHEDULER_ACCESS_GATE üzerinde try_acquire_exclusive_for_valid_cpu ile alınır; S395 yeni static, ikinci state word veya ayrı exclusion domain yaratmaz.",
      "Host executor callback'i exact bir kez çağırır; canlı reader writer'ı, canlı writer ikinci writer'ı ve yeni reader'ı aynı state word üzerinde reddeder; callback error RAII lease'ini exact bırakır.",
      "S394 ve S395 executor token'ları aynı shared gate üzerinde monoton ve ayrıdır; iki kapı tek transaction, range dispatcher veya toplu S335–S400 facade membership'i değildir.",
      "Production main.rs envanterinde S136 exact CALL source-order positions[1], yani 17 explicit main aliasının ikincisidir; S395 yalnız bu aliası sahiplenir.",
      "Aynı qemu_strict_el0_ipc_peers_oom_supervisor öğesinde exact iki mutable scheduler aliası korunur: first stale-ACK CALL S396 için açık, second exact-ACK CALL S395 guarded'dır.",
      "current_task_id yalnız state.supervisor_task ile eşleştiğinde ilerlenir; zero veya başka caller identity writer acquisition'a ulaşamaz.",
      "service_deferred_current_runtime_oom bounded yield döngüsü exact responder lifecycle completion üretmeden coordinator event teslim edilmez.",
      "Completed responder task, owned endpoint/drained call sıfırları ve exact bir cancelled responder call writer'dan önce doğrulanır.",
      "Caller/responder witnesses ve absent capability graph en fazla 128 bounded yield içinde writer'dan önce kanıtlanır.",
      "Coordinator deliver_next_event exact TeardownComplete event'i üretir; id, responder task/domain, expected reclaim ve observed zero domain frames immutable doğrulanır.",
      "Transport domain registration ve audited RuntimeMemory snapshot, baseline PMM free-frame/active-allocation eşitlikleriyle writer'dan önce kapanır.",
      "Current supervisor CNode lookup'ı state.endpoint_id üzerinde owner, parent=None ve ENDPOINT_SEND right şartlarını writer'dan önce yeniden doğrular.",
      "Strict EL0 supervisor exact W^X policy ve bounded frame bütçesiyle spawn edilir; yalnız ENDPOINT_RECV grant'i task-bound verilir.",
      "Spawned transport quota exact 5 frame, RuntimePmm free delta -5 ve active-allocation delta +5 olarak writer'dan önce doğrulanır.",
      "packed_reclaim checked shift/add ile overflow fail-closed kurulur; event_message event id, responder, domain ve reclaim tuple'ını immutable taşır.",
      "stale_reply_cap exact supervisor-task/endpoint ilişkisiyle mint edilir ve source-order first stale ipc_kernel_call_and_wait S395 writer'dan önce yürür.",
      "Stale continuation yalnız S136_STALE_ACK_LABEL, exact EL0 supervisor badge, deliberately event.id+1 ve unchanged message tail ile kabul edilir.",
      "before_stale coordinator snapshot'ı AckMismatch sonrasında unchanged kalır; yanlış ACK event'i consume etmez.",
      "Monitor rearm exact AttemptInFlight ile kapanır; stale yol S395 exact writer'a geçmeden başarı yayımlayamaz.",
      "exact_reply_cap writer'dan önce supervisor-task/endpoint ilişkisiyle mint edilir; exact reply id S395 CALL'e owned scalar olarak aktarılır.",
      "Dedicated s395_irq_guard writer acquire'dan önce kurulur; acquire_s395_production_scheduler_writer_access, drop(s395_writer_access) ve drop(s395_irq_guard) exact birer kez görünür.",
      "Exact mutable alias ipc_kernel_call_and_wait(state.endpoint_id, endpoint_authority.generation, exact_reply_cap.id, event_message) çağrısını bir kez yapar.",
      "CALL terminal sonucu borrowed Scheduler referansı dışarı taşınmadan owned exact_ack değerine alınır; guard release sonrasında Scheduler üzerinden sonuç okunmaz.",
      "S395 focus tek mutable SCHEDULER aliası ve tek ipc_kernel_call_and_wait içerir; stale_reply_cap.id ve let stale_ack bu nested focus'a girmez.",
      "drop(s395_writer_access), drop(s395_irq_guard), exact label, badge ve data assertions bu kesin source sırasındadır.",
      "Exact ACK yalnız S136_EXACT_ACK_LABEL, el0_supervisor.task_id badge ve event_message.data bütünü değişmeden döndüğünde kabul edilir.",
      "Coordinator acknowledge(exact_ack.data[0]) S395 release ve exact validation sonrasındadır; writer coordinator state'ini kapsamına almaz.",
      "Monitor rearm exact coordinator ACK sonrasında yeni epoch üretir; stale AttemptInFlight sonucu başarı yerine geçirilmez.",
      "Supervisor domain quota en fazla 128 bounded yield içinde allocated_frames=0'a dönmelidir; reclaim döngüsü writer lease dışında kalır.",
      "Deferred later-stack normal-exit reap S395 release sonrasında yürür; exact CALL transaction'ına lifecycle cleanup eklenmez.",
      "Final transport RuntimePmm free frames ve active allocations exact pre-spawn baseline'a döner.",
      "Endpoint registry cleanup stale_reply_cap.id ve exact_reply_cap.id nesnelerinin ikisini de S395 release sonrasında yok sayar.",
      "S135 policy observation, caller/responder final quota ve owner endpoint cleanup S395'in complete S136 item bağlamında görünür, fakat writer membership değildir.",
      "Scheduler helper aynı IRQ/IPC transaction altında caller SEND authority, normal Endpoint object ve linked one-shot reply ilişkisini commit'ten önce yeniden doğrular.",
      "Optional receiver authority/generation ve exact receive deadline ile ready queue ve blocked-call kapasitesi CALL publish öncesinde fail-closed sınanır.",
      "CALL envelope publish, caller context park ve optional immediate receiver delivery aynı helper transaction'ındadır; transaction release edilmeden context switch yapılmaz.",
      "Continuation transaction release ve resume sonrasında aynı caller task'ı bulur ve yalnız owned IpcMessage veya exact stored IPC error terminal sonucunu yeniden kurar.",
      "Focused source testi complete qemu_strict_el0_ipc_peers_oom_supervisor Rust öğesini ve exact S395 acquire→single mutable alias→second CALL→writer drop nested focus'unu birlikte doğrular.",
      "Focused test complete S136 öğesinde exact iki mutable alias sayar, S395 focus'unda yalnız second aliası ve tek ipc_kernel_call_and_wait görür.",
      "Argument-forwarding testi state.endpoint_id, endpoint_authority.generation, exact_reply_cap.id ve event_message değerlerinin exact second CALL'e eksiksiz aktarıldığını doğrular.",
      "Focused test stale_reply_cap.id ve stale_ack'in S395 focus'una girmediğini; exact_reply_cap.id ile immutable event_message'in ise girdiğini ayrı assertion'larla sabitler.",
      "S396 stale CALL'in exact-reply mint ve s395_irq_guard öncesinde, s395_writer_access kapsamı dışında kaldığı ayrı test edilir.",
      "Focused grup request yokken Idle, exact pending request ile SixtyEighthWriterGuardedAwaitingFinal ve yanlış CPU'da inherited S394 hatasını ayrı test eder.",
      "S245 request preflight sonrasında state.pending_request_id()==Some(1) kalır; take, publish, consume veya authority promotion yapılmaz.",
      "Reader-vs-writer, writer-vs-writer, nested reader/writer, callback-error release ve exact-once callback yolları birbirinden bağımsız test edilir.",
      "Production-only sembollerin tamamı aynı RPi5 AArch64 bare-metal cfg'sine bağlıdır; hostta sahte yarım production yolu oluşturulmaz.",
      "S395 modül kaynak testi provider constructor, S244 publisher ve request-state take adlarını reddeder; provider authority=0 ve exclusion=false kaynak yüzeyiyle korunur.",
      "Kernel main ve simulation lib registration'ları exact uzun S395 modül adıyla ayrı doğrulanır; sıra tablosundaki model satırı production membership yerine geçirilmez.",
      "CPU1 coverage service exceptions.rs içinde S394 service çağrısından sonra ve tarihsel S242 consumer'dan önce çalışır; mutable SCHEDULER veya S395 acquire çağırmaz.",
      "Tarihsel S325 exact-ACK ve S326 stale-ACK audit'leri model-level kalır; production S394 S138 stale membership de ayrı prior source unit'tir.",
      "Final selected regression S395, S394, tarihsel S325/S326 ve runtime_oom_supervisor_recovery ile 5 grup / 134 PASS / 0 fail verdi.",
      "Selected log /tmp/aselsanos-s395-selected-final.log 11096 B / 8fdc65bc83207e15d47e5bc66790a081673f8df4dd2586c60685de95cdd107f3 SHA-256'dır.",
      "S238–S394 dependency hedef listesi korunup yalnız S395 sona eklendi; iki bağımsız seri koşu 159 grup / 4100/4100 PASS verdi.",
      "Dependency timing-normalized özetlerin her biri 34286 B / 64d6e5d2d3b30ab4b717144c039e79282260c6641b95e253d3d4b46efc77f38a SHA-256 ile byte-exact eşittir.",
      "Dependency artifact root /tmp/aselsanos-s395-dependency.Q5LJY8; raw run1/run2 logları 377301/365971 B ve ayrı SHA-256 kimlikleri taşır.",
      "Yalnız finished in süre suffix'i normalization kapsamındadır; test isimleri, hedef sırası, pass/fail adetleri ve durum payload'ı canonical özette kalır.",
      "Yedi exact frozen assertion dışındaki serial workspace 358 result group / 5983 PASS / 0 fail / 7 filtered verdi.",
      "Filtered workspace raw log 581289 B / 546c0f6a0a8c0ef080b7f8cf72c25de5ca664118aa171ca00e0b244c53f5e033 ve summary 33892 B / 0bae3e24c396655acd0657b4a68a3a65926bd0aba99c1a9d44e98fe6942b22f9'dur.",
      "Filtresiz workspace exit 101 ile yalnız frozen S96 wiring_does_not_mutate_timer_gic_boot_or_expand_runtime_scope assertion'ında durdu; 311 result group / 5728 PASS / 1 fail ve global workspace GREEN claimed=false'dur.",
      "Filtresiz raw log 549639 B / 12ce1b62062d3d7be95fab874dd25f2da5e984cab677763598f482c5e406d2d2 ve summary 29473 B / aecbfab4102f844825c47b216386eb25dcf9201746cea42522ee2589e7ef7bab'dır.",
      "Dört final fresh canonical AArch64 profil kernel çalışma dizininden CARGO_INCREMENTAL=0, explicit feature ve ayrı target dizinleriyle 4/4 exit 0 verdi; zero-warning iddiası yoktur.",
      "Final board-qemu/rpi4/rpi5/rpi5+smp warning header sayıları 293/391/1554/1554'tür; log ve ELF byte/hash kimlikleri proof'ta ayrı kaydedildi.",
      "Dört profil /tmp/aselsanos-s395-profiles-final.d2MwQd altında tutulur; build log ve ELF ölçüleri birbirine karıştırılmaz.",
      "CARGO_INCREMENTAL=0 make verify-qemu 116354 B / f4f0f2d3b7b84cc96bae97c24cebbd2e921f664cbafe43fddf84fc7b0de44e81 SHA-256 ile strict ELF W^X 31/31, S130–S154 + S271, IPC 20/20 ve scheduler SEC5 PASS verdi.",
      "QEMU logunda S136 strict EL0 stale rejection ve exact ACK transport gözlendi; board-qemu guest RPi5-only S395 lease'ini compile etmediği için bu writer runtime observation değildir.",
      "Final cargo fmt --all -- --check ve git diff --check exit 0 ve boş çıktı verdi; 0 B / e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 SHA-256'dır.",
      "Kalıcı proof owned boundary, coverage, source identities, focused TDD, selected regression, dependency reproducibility, workspace, profiles, QEMU/format, Code contract ve explicit limitations bölümlerini ayrı taşır.",
      "Code yayın hedefi S1–S395 395/395 ayrı kapıdır; kullanıcının özellikle istediği S328 öncesi S1–S327 aralığı 327/327 tekil kalmalı, missing=none ve duplicate=0 olmalıdır.",
      "S395 Code kartı complete qemu_strict_el0_ipc_peers_oom_supervisor Rust öğesini, yalnız second exact CALL'e ait nested acquire→release focus'unu, complete guard modülünü, complete 49-test target'ını, proof'u ve complete Operations object'ini yayımlar.",
      "Complete production excerpt iki S136 CALL'i bağlamıyla gösterirken nested focus yalnız s395_writer_access acquisition'dan drop(s395_writer_access)'e kadar kesilir; S396 stale transaction bu focus'a katılmaz.",
      "S1, S327, S328, S394 ve S395 kartlarının exact birer kez görünmesi; S396'nın pre-publish edilmemesi website kabulünde sayılacaktır.",
      "Her Code kartı mappingStrategy, kind, sourcePath, complete excerpt, satır aralığı ve SHA-256 kimliği taşır; test komutu asıl uygulama/model kodunun yerine geçirilmez.",
      "İlk source-bound Code registry S1–S395 395/395 unique kapı, 1148 exact excerpt ve pre-S328 S1–S327 327/327 tekil kart üretti; missing=none, duplicate=0, S1/S327/S328/S394/S395 exact birer ve S396=0'dır.",
      "İlk registry mapping 68 writer-guard + 225 focused-test + 94 command-contract + 8 operation-record = 395'tir; generated JSON 9034825 B / cd55e421db27071926c156e9403e28752b37a3d927487d66cfbad8f37ce54302 dosya SHA-256 ve 44777562f857755f4a26028a7f622182a77dec763647f3d6f156e9420eeac104 registry SHA-256 taşır.",
      "İlk publication öncesi S395 promotion policy 16958 karakter / 17565 UTF-8 byte, 89 evidence, 3 teknik terminal session ve 9 limitation ile S324 5965 karakter / 6122 byte yoğunluk tabanının üstündedir.",
      "Website ilk kabulü 721/721 test, lint PASS, TypeScript exit 0 ve 24/24 static page PASS verdi; export 200 dosya, Timeline ile yol-haritasi ayrı ayrı 234 data-gate-policy kartıdır.",
      "İlk production/main deployment dcdb23b0-62f7-45e7-9799-c768e87a7b93 ile 115 uploaded + 84 existing = 199 asset ve _headers yayımladı; deploy logu 1714 B / 1a660a57e65384d5a2a180c594e392697c80b61d4882378cfc8d9d2b2a5e2ce6 SHA-256'dır.",
      "Wrangler deployment-list kaydı 29554 B / 605d0dcd5fb1b99b379175afcb4419c1ecfca4a0276b11c25e21dd69b8420e8d SHA-256 ile dcdb23b0-62f7-45e7-9799-c768e87a7b93 Production/main durumunu doğruladı.",
      "Cache-busted custom-domain /code/ 25268134 B / 080287be771dda5e64af306380659d4d32daf77a261cc80c230d731b708c8fcf, /operations/ 15678610 B / 6ae69e89d2be9b47e1a97073337db4ac0bc3a9bc5e52959fdc6b661856269bdc, /timeline/ 6635675 B / 5a10fbecfce1b17ed0f79005a32840c253aa015ab542a69df73017d3c50f75bb ve /yol-haritasi/ 6635423 B / 36bc81838f67ed2cb2e51f845b36518266c814874ff3f884858bcab2a5c43485 SHA-256 ile HTTP 200 ve deployment out'una raw byte-exact=true verdi.",
      "Canlı Code total=395, unique=395, pre-S328=327, S1/S327/S328/S394/S395 exact birer ve S396=0'dır; /code/ no-transform/nosniff taşır. Readback artifact root /tmp/aselsanos-s395-readback-initial.JcXwal'dır.",
      "Immutable dcdb23b0 hostname /code/ probe'u 30 saniyede curl exit 28 / HTTP 000 verdi ve custom-domain PASS yerine geçirilmedi.",
      "İlk yayın ölçülerini içeren payload ayrı evidence-sync transaction'ında production/main'e yayımlanır; dönen evidence-sync kimliği self-referential içerik zinciri oluşturmamak için bu ilk ölçüm metnine geri yazılmaz.",
      "S395 için güç, SD kart, Mac kart erişimi, UART capture, raw validation, archive veya promotion işlemi yapılmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S395=NO.",
      "Bağlayıcı olmayan S395 projeksiyonu R1 S395–S425, R2 S450–S500, R3 S579+, risk aralığı S555–S605 ve merkez yaklaşık S580'dir; sıra veya ürün taahhüdü değildir.",
    ],
    commands: [
      "CARGO_INCREMENTAL=0 cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s395_qemu_s136_exact_ack_writer_guard_integration -- --test-threads=1",
      "run S395, S394, S325, S326 and runtime_oom_supervisor_recovery serially",
      "run S238-S395 dependency list twice and normalize timing fields",
      "run filtered and unfiltered serial workspace audits",
      "run four fresh isolated AArch64 profile builds",
      "CARGO_INCREMENTAL=0 make verify-qemu",
      "cargo fmt --all -- --check && git diff --check",
      "npm test && npm run lint && npx tsc --noEmit && npm run build",
      "npm run deploy",
      "cache-busted curl + cmp for /code/, /operations/, /timeline/ and /yol-haritasi/",
    ],
    terminalSessions: [
      {
        id: "g8l-s395-focused-source-contract",
        title: "S395 focused S136 exact-ACK writer membership",
        commandLines: [
          "CARGO_INCREMENTAL=0 cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s395_qemu_s136_exact_ack_writer_guard_integration -- --test-threads=1",
        ],
        outputLines: [
          "initial result: compile RED; distinct S395 module/export and production S136 second exact-CALL boundary absent",
          "intermediate: 7/8 then 48/49 test-only marker/slicer RED; product membership unchanged",
          "final result: 49/49 PASS; exact second alias and owned exact-ACK writer→IRQ release order",
          "shared S247 gate: 44 guarded readers + 68/69 guarded writers; 1 writer open for S396",
          "board-qemu fixture / board-rpi5 wrapper supported-profile intersection=0; provider authority=0",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8l-s395-selected-regression",
        title:
          "S395 selected S136 exact/stale and supervisor recovery regression",
        commandLines: [
          "run S395, S394, S325, S326 and runtime_oom_supervisor_recovery serially",
        ],
        outputLines: [
          "final result: 5 groups / 134 passed / 0 failed",
          "historical S325/S326 authority audits remain model-only; S394 S138 membership remains separately guarded",
          "S396 source-order first S136 stale CALL remains open and outside S395 membership",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8l-s395-full-acceptance",
        title: "S395 dependency, workspace, profile and QEMU acceptance",
        commandLines: [
          "run S238-S395 dependency list twice and normalize timing fields",
          "run filtered and unfiltered serial workspace audits",
          "run four final fresh isolated AArch64 profile builds",
          "CARGO_INCREMENTAL=0 make verify-qemu",
        ],
        outputLines: [
          "dependency: 159 groups / 4100/4100 twice; normalized 34286-byte summaries SHA-256 identical",
          "filtered workspace: 358 groups / 5983 PASS / 7 filtered; unfiltered frozen-S96 remains RED",
          "four profiles: 4/4 exit 0; warning and ELF identities recorded separately",
          "QEMU W^X 31/31 + S130-S154 + S136 + IPC 20/20 + SEC5 PASS; not an S395 writer runtime observation",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8l-s395-production-publication",
        title:
          "S395 Code, Operations, Timeline and roadmap production publication",
        commandLines: [
          "npm test && npm run lint && npx tsc --noEmit && npm run build",
          "npm run deploy",
          "cache-busted curl + cmp for /code/, /operations/, /timeline/ and /yol-haritasi/",
        ],
        outputLines: [
          "website: 721/721 PASS; lint PASS; TypeScript exit 0; 24/24 static pages",
          "Code registry: S1-S395 395/395 unique; 1148 exact excerpts; pre-S328 327/327; missing=none; duplicate=0; S396=0",
          "initial production/main deployment: dcdb23b0-62f7-45e7-9799-c768e87a7b93; 115 uploaded + 84 existing = 199 assets",
          "custom-domain four routes: HTTP 200 and raw byte-exact=true; /code/ no-transform/nosniff",
          "immutable hostname: curl exit 28 / HTTP 000; not substituted for custom-domain PASS",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
    ],
    terminalSessionsNote:
      "TAM ÇIKTI kayıtları compile RED→test-only düzeltmeler→49/49 focused geçişini, seçili 134/134 regresyonu, iki kez 4100/4100 dependency tekrarını, filtreli/filtresiz workspace ayrımını, dört final fresh AArch64 profili, QEMU kabulünü ve ayrı production publication/readback işlemini birbirine karıştırmadan taşır. S395 yalnız second exact-ACK CALL writer üyeliğidir; S396 first stale-ACK kapısı ayrı ve açıktır.",
    limitations: [
      "S395 yalnız qemu_strict_el0_ipc_peers_oom_supervisor içindeki source-order second exact-ACK CALL sınırını kapatır; first stale-ACK CALL S396 için açıktır.",
      "board-qemu caller ile RPi5-only production wrapper desteklenen tek bir profilde kesişmez; supported-profile runtime invocation=0'dır.",
      "Production provider authority=0, whole-scheduler exclusion=false ve S244 admission publication yoktur.",
      "CPU1 timer service yalnız coverage preflight'tır; CPU0 mutation lease'i almaz.",
      "Transient contention liveness/soak ve default-parallel PTY determinism ürün kabulü değildir.",
      "CPU2/CPU3, migration, load balancing, hotplug ve Generic SMP cross-CPU arbitration açıktır.",
      "Filtresiz workspace frozen S96 source assertion'ı nedeniyle global GREEN değildir.",
      "Fiziksel RPi latency/power/thermal, UART/raw ve product threshold kabulü yapılmadı; RUNBOOK_EXECUTED_IN_S395=NO.",
      "R1/R2/R3 sıra görünümü bağlayıcı olmayan planlama projeksiyonudur; ürün teslim taahhüdü değildir.",
    ],
  },