G8l: QEMU acceptance-poll read-access guard genişletmesi

//! ASELSAN Milli Telefon — gerçek aarch64 microkernel.
//!
//! M0   : bare-metal boot + PL011 UART
//! M1.1 : Exception Vector Table (VBAR_EL1) + trampolines
//! M1.2 : EC decode + BRK/SVC recover + panic on bad cases
//! M1.3 : GICv2 + ARM Virtual Timer (CNTV) using CVAL (low drift)
//! M1.4 : 100 Hz periodic tick + per-second drift measurement + irq_lock!

#![no_std]
#![no_main]
// The typed S401+ fail-closed error chain is intentionally deep.  Production
// AArch64 builds need enough query headroom to lay it out while compiling the
// post-S430 acceptance callsites.
#![recursion_limit = "256"]

extern crate alloc;

use core::panic::PanicInfo;

mod arch;
// Hands-free altyapısı (radyo değişkeni DEĞİL): PM watchdog + UART 'R'.
#[cfg(all(feature = "board-rpi5", feature = "rpi5-auto-reset"))]
mod auto_reset;
mod board; // M8.1 — Board/Platform abstraction (QEMU vs RPi4 vs future SoC)
mod driver; // M8.1.2 — Mailbox, UART driver'ları vs. (RPi4 için kritik)
mod dt; // M9.1 — Device Tree Blob parser (RPi5 + telefon SoC hazırlığı)
mod elf; // M8 — ELF64 Loader (başlangıç)
#[allow(dead_code)]
mod elf_plan; // K1 — allocation-free validator + production ELF page plan
#[cfg(feature = "board-rpi5")]
mod g7c_contract;
#[cfg(feature = "board-rpi5")]
mod g7d_contract;
#[cfg(feature = "board-rpi5")]
mod g8_contract;
#[cfg(feature = "board-rpi5")]
mod g8b_contract;
#[cfg(feature = "board-rpi5")]
mod g8c_contract;
#[cfg(feature = "board-rpi5")]
mod g8d_contract;
#[cfg(feature = "board-rpi5")]
mod g8e_contract;
#[cfg(feature = "board-rpi5")]
mod g8f_contract;
#[cfg(feature = "board-rpi5")]
mod g8g_contract;
#[cfg(feature = "board-rpi5")]
mod g8h_contract;
#[cfg(feature = "board-rpi5")]
mod g8l_arch_execution_contract;
#[cfg(feature = "board-rpi5")]
mod g8l_authority_contract;
#[cfg(feature = "board-rpi5")]
mod g8l_irq_tlbi_wiring;
#[cfg(feature = "board-rpi5")]
mod g8l_runtime_contract;
#[cfg(feature = "board-rpi5")]
mod g8l_scheduler_admission;
#[cfg(feature = "board-rpi5")]
mod g8l_target_aarch64_dispatch;
#[cfg(feature = "board-rpi5")]
mod g8l_target_dispatch_admission;
#[cfg(feature = "board-rpi5")]
mod g8l_target_dispatch_callsite;
#[cfg(feature = "board-rpi5")]
mod g8l_target_dispatch_context_switch;

#[test]
fn s261_s147_two_notification_wait_polls_drop_before_yield_and_mutation() {
    let main = include_str!("../../kernel/src/main.rs");
    let s147 = function_slice(
        main,
        "unsafe fn run_qemu_s147_notification_lifecycle(",
        "unsafe fn run_qemu_s148_notification_race_arbitration(",
    );
    assert_copy_reads_guarded_and_dropped(s147, 2);
    assert!(s147.contains("S261 S147 first-waiter poll"));
    assert!(s147.contains("S261 S147 second-waiter poll"));
    let first_drop = s147.find("drop(s261_scheduler_read_access)").unwrap();
    let first_mutation = s147.find("revoke_notification_grant").unwrap();
    assert!(first_drop < first_mutation);
}

  {
    id: "g8l-s261-qemu-acceptance-poll-read-access-guard-expansion-partial",
    date: "2026-08-25",
    sequence: 261,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: QEMU acceptance-poll read-access guard genişletmesi",
    summary:
      "S261 14/14 PASS ile S260 production reader gate'ini S144–S148 QEMU kabul yollarındaki yedi immutable SCHEDULER polling okumasına taşıdı. Her erişim owned usize veya [usize;3] Copy sonucu çıkarır; reader yield_now, notification/capability mutasyonu veya sonraki scheduler erişiminden önce explicit düşer. Coverage 27/111'den 34/111'e ilerledi; 77 site unrouted kalır. İlk QEMU denemesi runtime'a ulaşmadan 119 profile-import hatasında durdu ve ayrı S262 ile kapatıldı.",
    evidence: [
      "S261 focused host grubu güncel birleşik kaynakta 14/14 PASS verdi: 129 B / SHA-256 d50e861f1dfd8fdd2073cabf26227d26186302c2793942941ffd436c5ff90d25.",
      "Exact source coverage: S144 responder, S145 receiver, S146 waiter+holder, S147 iki waiter ve S148 üç-waiter poll olmak üzere yedi read; previous=27, additional=7, guarded=34/111, unrouted=77.",
      "Her route yalnız owned usize veya [usize;3] üretir. Reader yield_now, notification/capability mutasyonu ve sonraki scheduler erişiminden önce düşer; scheduler referansı guard dışına kaçmaz.",
      "S238–S261 dependency matrisi iki byte-equal koşuda 25 grup / 343/343 PASS: raw 2375 B / SHA-256 df57a68def055366de5b62884fcc382f4ac929fe15dac23380f32677bbb6e0f4; süre-normalize 2500 B / SHA-256 7b2a07765721e69b88d0dc1dd2b71033b571e74b0468fdada50a08823ab6fe26.",
      "İlk S261 RPi5 normal/SMP derlemeleri ikişer byte-equal PASS verdi: normal 359581 B / 699 warning / SHA-256 14c81d92e3e5caff817f462aa776ea86e5fa00c17178bef7e1038f539d01187f; SMP 359523 B / 699 warning / SHA-256 11bed8c4abd5f3a2d486093cb9247492a6191e76f643c03de8f09ba152742828.",
      "İlk make verify-qemu QEMU başlamadan 119 unresolved import ile RED kaldı; test gevşetilmedi. S262 profile closure sonrasında aynı S261 testleri ve kanonik QEMU regresyonu PASS verdi.",
      "Birleşik S261/S262 manifest-aware workspace audit'i iki koşuda 224 grup / 2103/2103 PASS, 0 fail ve exact 7 tarihsel G8h assertion filtered verdi; süre-normalize özet 21609 B / SHA-256 1dad065af7e7b30b69f86603330c453a25624ce077a25cefc3a82a20cc4c89b9 ile byte-equal'dır. Filtresiz koşu frozen S96 exceptions.S identity mismatch'inde exit 101 kaldı; beklentiler gevşetilmedi ve full-workspace GREEN iddia edilmez.",
      "S261 physical/device operations=0; RUNBOOK_EXECUTED_IN_S261=NO. Tarihsel S124 physical BOOT8H PASS ve tam operatör sırası görünür biçimde korunur.",
      "Canlı marker: S261_14_OF_14_QEMU_ACCEPTANCE_POLL_READ_ACCESS_GUARD_EXPANSION_SEVEN_ADDITIONAL_IMMUTABLE_COPY_RETURNING_S144_TO_S148_READS_OWNED_USIZE_OR_ARRAY_3_READER_DROPPED_BEFORE_YIELD_NOTIFICATION_CAPABILITY_MUTATION_OR_LATER_SCHEDULER_ACCESS_NO_REFERENCE_ESCAPE_PREVIOUS_27_OF_111_TOTAL_34_OF_111_GUARDED_77_UNROUTED_INITIAL_QEMU_BUILD_RED_119_IMPORT_ERRORS_CLOSED_BY_S262_WORKSPACE_2103_PASS_7_HISTORICAL_G8H_ASSERTIONS_RED_PRODUCTION_EXCLUSIVE_WRAPPER_ABSENT_S245_REQUEST_INSPECTED_NOT_TAKEN_PENDING_AWAITING_COVERAGE_NO_PROVIDER_AUTHORITY_NO_EXCLUSION_PROOF_NO_SCHEDULER_MUTATION_PHYSICAL_CPU2_CPU3_HOTPLUG_SOAK_GENERIC_SMP_OPEN_FULL_PHYSICAL_RUNBOOK_VISIBLE_S421_TO_S471_S446_NO_RUNBOOK_EXECUTED_IN_S261_VERIFIED.",
    ],
    commands: [
      "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s260_qemu_acceptance_poll_read_access_guard_expansion",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
      "make verify-qemu",
    ],
    terminalSessions: [
      {
        id: "s261-g8l-qemu-acceptance-poll-read-access-guard-expansion",
        title: "G8l S261 QEMU acceptance-poll read-access guard genişletmesi",
        commandLines: [
          "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s260_qemu_acceptance_poll_read_access_guard_expansion",
        ],
        outputLines: [
          "test result: ok; S261 focused 1 group / 14 passed; 0 failed",
          "source coverage: 7 units / 111 direct SCHEDULER sites / previous=27 / additional=7 / guarded=34 / unrouted=77",
          "routes: S144 one + S145 one + S146 two + S147 two + S148 one",
          "owned Copy result; reader drop precedes yield or mutation; no scheduler reference escape",
          "initial QEMU profile compile RED=119 errors; closure tracked separately as S262",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S261 yedi QEMU acceptance polling okumasını guard'lar; 77 unrouted site nedeniyle provider authority, exclusive wrapper veya whole-scheduler exclusion değildir.",
    limitations: [
      "S261 yalnız 7 ek immutable scheduler okumasıyla toplam 34/111 coverage'tır; 77 scheduler erişimi unrouted kalır.",
      "RPi5-only reader gate QEMU'da çalıştırılmaz; QEMU mevcut acceptance regresyonunu doğrular.",
      "Production exclusive wrapper, provider authority, exclusion proof ve scheduler mutation yoktur.",
      "Fiziksel RPi, CPU2/CPU3, hotplug, soak ve Generic SMP açık kalır.",
      "S261 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S261=NO.",
    ],
  },