K2: Notification signal/revoke/timeout exact-once arbitration

impl<const N: usize> IpcCallDeadlineRegistry<N> {
    pub const fn new() -> Self {
        Self {
            waits: WaitTable::new(),
            next_wait_epoch: 0,
            registered: 0,
            replied: 0,
            delivered: 0,
            timed_out: 0,
            peer_closed: 0,
            cancelled: 0,
        }
    }

    #[allow(clippy::too_many_arguments)]
    pub fn register_call(
        &mut self,
        task_id: u64,
        endpoint_id: u64,
        endpoint_generation: u64,
        reply_cap_id: u64,
        reply_generation: u64,
        now_tick: u64,
        timeout_ticks: u64,
    ) -> Result<WaitRecord, IpcCallDeadlineRegistryError> {
        let wait_epoch = self
            .next_wait_epoch
            .checked_add(1)
            .ok_or(IpcCallDeadlineRegistryError::WaitEpochExhausted)?;
        let key = WaitKey::try_new(task_id, wait_epoch)?;
        let kind = WaitKind::try_call(
            endpoint_id,
            endpoint_generation,
            reply_cap_id,
            reply_generation,
        )?;
        let record = WaitRecord::try_after(key, kind, now_tick, timeout_ticks)?;
        self.waits.register(record)?;
        self.next_wait_epoch = wait_epoch;
        self.registered = self
            .registered
            .checked_add(1)
            .expect("IPC deadline registration counter exhausted");
        Ok(record)
    }

    pub fn register_receive(
        &mut self,
        task_id: u64,
        endpoint_id: u64,
        endpoint_generation: u64,
        now_tick: u64,
        timeout_ticks: u64,
    ) -> Result<WaitRecord, IpcCallDeadlineRegistryError> {
        let wait_epoch = self
            .next_wait_epoch
            .checked_add(1)
            .ok_or(IpcCallDeadlineRegistryError::WaitEpochExhausted)?;
        let key = WaitKey::try_new(task_id, wait_epoch)?;
        let kind = WaitKind::try_receive(endpoint_id, endpoint_generation)?;
        let record = WaitRecord::try_after(key, kind, now_tick, timeout_ticks)?;
        self.waits.register(record)?;
        self.next_wait_epoch = wait_epoch;
        self.registered = self
            .registered
            .checked_add(1)
            .expect("IPC deadline registration counter exhausted");
        Ok(record)
    }

    pub fn register_notification(
        &mut self,
        task_id: u64,
        notification_id: u64,
        notification_generation: u64,
        mask: u64,
        now_tick: u64,
        timeout_ticks: u64,
    ) -> Result<WaitRecord, IpcCallDeadlineRegistryError> {
        let wait_epoch = self
            .next_wait_epoch
            .checked_add(1)
            .ok_or(IpcCallDeadlineRegistryError::WaitEpochExhausted)?;
        let key = WaitKey::try_new(task_id, wait_epoch)?;
        let kind = WaitKind::try_notification(notification_id, notification_generation, mask)?;
        let record = WaitRecord::try_after(key, kind, now_tick, timeout_ticks)?;
        self.waits.register(record)?;
        self.next_wait_epoch = wait_epoch;
        self.registered = self
            .registered
            .checked_add(1)
            .expect("IPC deadline registration counter exhausted");
        Ok(record)
    }

    pub fn expired_snapshot(&self, now_tick: u64) -> Option<WaitRecord> {
        self.waits.expired_snapshot(now_tick)
    }

    pub fn reply_snapshot(&self, reply_cap_id: u64) -> Option<WaitRecord> {
        self.waits.reply_id_snapshot(reply_cap_id)
    }

    pub fn task_snapshot(&self, task_id: u64) -> Option<WaitRecord> {
        self.waits.task_snapshot(task_id)
    }

    pub fn object_snapshot(&self, object_id: u64) -> Option<WaitRecord> {
        self.waits.object_id_snapshot(object_id)
    }

    pub fn object_wait_count(&self, object_id: u64) -> usize {
        self.waits.object_id_count(object_id)
    }

    pub fn expire_exact(
        &mut self,
        expected: WaitRecord,
        now_tick: u64,
    ) -> Result<CompletedWait, WaitMutationError> {
        let completed = self.waits.expire_exact(expected, now_tick)?;
        self.timed_out = self
            .timed_out
            .checked_add(1)
            .expect("IPC deadline timeout counter exhausted");
        Ok(completed)
    }

    pub fn complete_reply_exact(
        &mut self,
        expected: WaitRecord,
    ) -> Result<CompletedWait, WaitMutationError> {
        let completed = self.waits.cancel_exact(expected, WaitCompletion::Replied)?;
        self.replied = self
            .replied
            .checked_add(1)
            .expect("IPC deadline reply counter exhausted");
        Ok(completed)
    }

    pub fn complete_delivery_exact(
        &mut self,
        expected: WaitRecord,
    ) -> Result<CompletedWait, WaitMutationError> {
        let completed = self
            .waits
            .cancel_exact(expected, WaitCompletion::Delivered)?;
        self.delivered = self
            .delivered
            .checked_add(1)
            .expect("IPC deadline delivery counter exhausted");
        Ok(completed)
    }

    pub fn complete_peer_closed_exact(
        &mut self,
        expected: WaitRecord,
    ) -> Result<CompletedWait, WaitMutationError> {
        let completed = self
            .waits
            .cancel_exact(expected, WaitCompletion::PeerClosed)?;
        self.peer_closed = self
            .peer_closed
            .checked_add(1)
            .expect("IPC deadline peer-close counter exhausted");
        Ok(completed)
    }

    pub fn cancel_exact(
        &mut self,
        expected: WaitRecord,
    ) -> Result<CompletedWait, WaitMutationError> {
        let completed = self
            .waits
            .cancel_exact(expected, WaitCompletion::Cancelled)?;
        self.cancelled = self
            .cancelled
            .checked_add(1)
            .expect("IPC deadline cancellation counter exhausted");
        Ok(completed)
    }

    pub const fn snapshot(&self) -> IpcCallDeadlineSnapshot {
        IpcCallDeadlineSnapshot {
            active: self.waits.len(),
            capacity: self.waits.capacity(),
            next_wait_epoch: self.next_wait_epoch,
            registered: self.registered,
            replied: self.replied,
            delivered: self.delivered,
            timed_out: self.timed_out,
            peer_closed: self.peer_closed,
            cancelled: self.cancelled,
        }
    }
}

#[test]
fn s148_keeps_abi_v1_3_and_adds_no_syscall() {
    assert!(ABI.contains("pub const ABI_MAJOR: u16 = 1"));
    assert!(ABI.contains("pub const ABI_MINOR: u16 = 3"));
    assert!(ABI.contains("pub const NOTIFICATION_SIGNAL: u64 = 17"));
    assert!(ABI.contains("pub const NOTIFICATION_WAIT_TIMEOUT: u64 = 18"));
    assert!(!ABI.contains("S148"));
}

  {
    id: "k2-notification-race-arbitration-partial",
    date: "2026-08-24",
    sequence: 148,
    status: "passed",
    umbrella_status: "partial",
    title: "K2: Notification signal/revoke/timeout exact-once arbitration",
    summary:
      "S148, ABI v1.3'ü ve syscall tablosunu değiştirmeden notification signal, grant revoke ve exact-deadline timeout yarışını tek global IPC transaction altında first-transaction-wins kuralına bağlar. Altı host permütasyonunun tamamı ve üç strict RuntimePmm EL0 waiter QEMU'da çalıştı: signal-first Delivered, revoke-first Cancelled, timeout-first TimedOut üretti; kaybeden işlemler stale kaldı ve ikinci wake oluşmadı. Generic SMP cross-CPU arbitration ile imzalı ürün kapasite/latency bütçeleri açık olduğundan K2/K1/MEM0–MEM2 PARTIAL kalır.",
    evidence: [
      "S148 notification race kaynak/model kapısı 8/8 PASS; signal/revoke/timeout işlemlerinin altı sıralamasının tamamında ilk transaction kazanır, iki kaybeden mutasyonsuz stale kalır ve ikinci wake oluşmaz.",
      "ABI UNCHANGED_V1_3: yeni syscall yok; SYS_NOTIFICATION_SIGNAL=17 ve SYS_NOTIFICATION_WAIT_TIMEOUT=18 korunur.",
      "S129–S148 exact envanteri 37 binary / 224 testtir; 224/224 PASS. Ortak ABI/IPC odaklı kapı 9 binary / 86/86 PASS.",
      "QEMU notification=54/55/56, waiter=59/60/61, domain=1330597195/1330597196/1330597197; AT_EXACT_DEADLINE=3 ve ARBITER=IPC_TRANSACTION_LOCK.",
      "SIGNAL_FIRST=DELIVERED, REVOKE_FIRST=CANCELLED ve TIMEOUT_FIRST=TIMED_OUT; REGISTERED=3, DELIVERED/CANCELLED/TIMED_OUT=1/1/1, PEER_CLOSED=0, REPLIED=0 ve WAKE_TOTAL=3.",
      "LOSER_RETRY=STALE, EXACT_ONCE=YES ve ALL_STRICT=YES; her strict EL0 waiter yalnız kendi kazanan sonucuyla exact bir kez uyandı.",
      "Reclaim=15, NOTIFICATION_CLEANUP=3, free 6139→6124→6139, active 5→20→5, KERNEL_FAULTS=0 ve EXECUTOR=PASS.",
      "QEMU strict ELF W^X 31/31, başarılı IPC reply 20/20 ve mevcut RuntimePmm/scheduler regresyonları PASS.",
      "Manuel 8 saniyelik QEMU log'u 487363 B / SHA-256 8a10d39c2e47cf12afd45a649cf2ae25e5612f5acf7aedc40f1a7d3760d040c0 olarak ölçüldü.",
      "AArch64 board-qemu, board-rpi4, board-rpi5 ve board-rpi5+smp applicability 4/4 PASS.",
      "Tam workspace yedi S148-dışı frozen G8h identity/closure assertion'ında kırmızıdır. Exact yedisi dışlanınca kalan 109 result group / 697 test 697/697 PASS; assertion'lar gevşetilmedi ve full GREEN iddia edilmez.",
      "Fiziksel operatör sırası görünürdür: Gücü kapat → SD kartı Pi'den çıkar → SD kartı Mac'e tak → yetkili write/verify/read-back işlemini tamamla → SD kartı Mac'ten güvenli çıkar → SD kartı güçsüz Pi'ye tak → UART capture pre-arm ve exact identity kapısını doğrula → Güç ver.",
      "Bu fiziksel sıra S148'de uygulanmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S148=NO. Bu, S148'in tarihsel fiziksel sınırıdır; güncel son fiziksel boot/runtime PASS S124 BOOT8H ve S124 archive/promotion PASS'tir. S149'da runbook tekrar edilmedi.",
      "S148 tarihli planlama tahmini S324–378, risk-paylı merkez ≈S351 idi; bu tarihsel projeksiyondur. Güncel baz S149, güncel risk-paylı merkez ≈S343'dür; taahhüt veya fiziksel PASS değildir ve yeni bir S150 işlemi oluşturmaz.",
      "Güncel PASS-dışı denetimi S149 dahil 148 kaydı yeniden sayar: 21 Kısmi + 7 Başarısız + 7 Gözlem = 35 literal PASS-dışı tarihsel kayıt; 46 Passed + 58 Verified + 9 Fixed = 113 kapalı/yeşil kayıt. S111–S112 ve S125–S149 toplam 27 dar PASS kaydı umbrella_status=partial taşır; gerçek ileri çalışma 16 ana kabul bloğudur. Tarihsel olaylar yeniden koşturulmaz.",
      "Güncel web kapıları: içerik 248/248, ESLint, TypeScript --noEmit ve Next.js static export 23/23 route / 191 file PASS; Operations ve Timeline ortak PASS-dışı denetimi ile exact fiziksel operatör sırasını birlikte gösterir.",
      "Kalıcı kapsam: `docs/K2-S148-Notification-Race-Arbitration-Proof.md`.",
    ],
    commands: [
      "cargo test -p aselsan_microkernel_simulation --test ipc_notification_race_runtime -- --test-threads=1",
      "cargo test -p aselsan_microkernel_simulation [37 exact focused test binary] -- --test-threads=1",
      "cargo test -p aselsan_microkernel_simulation [9 exact ABI/IPC test binary] -- --test-threads=1",
      "cargo check -p aselsan_kernel --target aarch64-unknown-none [board-qemu, board-rpi4, board-rpi5, board-rpi5+smp]",
      "make verify-qemu",
      "cargo test --workspace -- --test-threads=1",
      "cargo test --workspace -- --test-threads=1 [seven exact historical --skip filters]",
      "python3 scripts/render-project-status.py --check",
      "cd website && npm test && npm run lint && npx tsc --noEmit && npm run build",
    ],
    terminalSessions: [
      {
        id: "s148-red-before-race-runtime",
        title: "Notification üç-yollu yarış kapısı: fail-closed bring-up",
        commandLines: [
          "cargo test -p aselsan_microkernel_simulation --test ipc_notification_race_runtime -- --test-threads=1",
        ],
        outputLines: [
          "strict image RO segment missing: measured 12 frames, exact contract requires 15",
          "SHF_GNU_RETAIN attempt rejected by strict ELF identity gate",
          "final SystemV image with KEEP(*(.rodata.s148)): 8/8 PASS",
        ],
        exitCode: 101,
        outputMode: "selected",
      },
      {
        id: "s148-green-focused-aarch64-qemu",
        title: "Altı permütasyon, üç strict EL0 kazanan ve exact reclaim",
        commandLines: [
          "cargo test -p aselsan_microkernel_simulation [37 exact focused test binary] -- --test-threads=1",
          "cargo test -p aselsan_microkernel_simulation [9 exact ABI/IPC test binary] -- --test-threads=1",
          "cargo check -p aselsan_kernel --target aarch64-unknown-none [4 profiles]",
          "make verify-qemu",
        ],
        outputLines: [
          "ipc_notification_race_runtime: 8/8 PASS · all six permutations",
          "combined exact focused inventory: 224/224 PASS · 37 binaries",
          "focused ABI/IPC: 86/86 PASS · 9 binaries · AArch64 compile profiles: 4/4 PASS",
          "[K2-S148] STRICT EL0 RACE WAKE=DELIVERED",
          "[K2-S148] STRICT EL0 RACE WAKE=INVALID_CAPABILITY",
          "[K2-S148] STRICT EL0 RACE WAKE=TIMED_OUT",
          "[K2-S148] ARBITER=IPC_TRANSACTION_LOCK MATRIX=ALL_6_PERMUTATIONS_HOST AT_EXACT_DEADLINE=3 SIGNAL_FIRST=DELIVERED REVOKE_FIRST=CANCELLED TIMEOUT_FIRST=TIMED_OUT REGISTERED=3 WAKE_TOTAL=3 LOSER_RETRY=STALE EXACT_ONCE=YES ALL_STRICT=YES RECLAIM=15 NOTIFICATION_CLEANUP=3 free=6139->6124->6139 active=5->20->5 KERNEL_FAULTS=0 EXECUTOR=PASS",
          "QEMU smoke PASS: strict ELF W^X 31/31 · IPC reply 20/20 · S148 PASS",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
      {
        id: "s148-workspace-independent-history-red",
        title:
          "Tam workspace: yedi S148-dışı frozen G8h identity/closure kırmızısı",
        commandLines: [
          "cargo test --workspace -- --test-threads=1",
          "cargo test --workspace -- --test-threads=1 [seven exact historical --skip filters]",
        ],
        outputLines: [
          "full workspace: FAIL-CLOSED · 7 historical frozen G8h identity/closure assertions",
          "raw run stops at the independent S96 exceptions.S SHA assertion",
          "excluding exactly those seven assertion names: 109 result groups · 697/697 PASS",
          "historical assertions were not relaxed · full-workspace GREEN is not claimed",
        ],
        exitCode: 101,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S148 CPU0/global transaction sınırında signal/revoke/timeout ilk-kazanan yarışını exact-once kapatır. Generic SMP cross-CPU arbitration ve ürün bütçeleri açık olduğundan K2 COMPLETE değildir. Fiziksel runbook açıkça görünür, fakat uygulanmadı.",
    limitations: [
      "Generic SMP cross-CPU timer/signal/revoke/wake/TLB/reaper arbitration matrisi kapanmadı.",
      "Allocation-free wait/deadline registry ürün kapasite ve latency bütçeleri imzalı değildir.",
      "Cross-subsystem rollback, genel capability transferi, shared-memory loan ve ortak frame/cap/endpoint/ASID reconciliation açıktır.",
      "Diğer fault/concurrency sınıfları, signed product thresholds ve uzun süreli spawn–fault–exit/SMP soak açıktır.",
      "Full workspace yedi S148-dışı frozen G8h identity/closure assertion'ı nedeniyle GREEN değildir; exact yedi assertion dışlandığında kalan 697/697 PASS'tir.",
      "S124 fiziksel archive/promotion STOP; görüntülenen güç/SD/Mac/UART sırası S148'de yürütülmedi.",
    ],
  },