G8l: QEMU delivered-IPC observation read-access guard genişletmesi

pub fn preflight_s268_whole_scheduler_read_coverage(
    caller_cpu: usize,
    request: Option<G8lS245WholeSchedulerExclusionAdmissionRequestView>,
) -> Result<
    G8lS268WholeSchedulerReadCoveragePreflightOutcome,
    G8lS268WholeSchedulerReadCoveragePreflightError,
> {
    match preflight_s267_whole_scheduler_read_coverage(caller_cpu, request)
        .map_err(G8lS268WholeSchedulerReadCoveragePreflightError::S267)?
    {
        G8lS267WholeSchedulerReadCoveragePreflightOutcome::Idle => {
            return Ok(G8lS268WholeSchedulerReadCoveragePreflightOutcome::Idle);
        }
        G8lS267WholeSchedulerReadCoveragePreflightOutcome::AwaitingCoverage {
            guarded_sites,
            unrouted_sites,
            ..
        } if guarded_sites == S267_WHOLE_SCHEDULER_GUARDED_SITES
            && unrouted_sites
                == S246_DIRECT_SCHEDULER_ACCESS_SITES - S267_WHOLE_SCHEDULER_GUARDED_SITES => {}
        G8lS267WholeSchedulerReadCoveragePreflightOutcome::AwaitingCoverage {
            guarded_sites,
            unrouted_sites,
            ..
        } => {
            return Err(
                G8lS268WholeSchedulerReadCoveragePreflightError::PriorCoverageDrift {
                    guarded_sites,
                    unrouted_sites,
                },
            );
        }
    }

    let outcome = preflight_s246_whole_scheduler_exclusion_provider(
        caller_cpu,
        request,
        G8lS246WholeSchedulerCoverageAudit::new(
            S246_SOURCE_AUDIT_UNITS,
            S246_DIRECT_SCHEDULER_ACCESS_SITES,
            S268_WHOLE_SCHEDULER_GUARDED_SITES,
        ),
    )
    .map_err(G8lS268WholeSchedulerReadCoveragePreflightError::S246)?;
    match outcome {
        G8lS246WholeSchedulerProviderPreflightOutcome::Idle => {
            Ok(G8lS268WholeSchedulerReadCoveragePreflightOutcome::Idle)
        }
        G8lS246WholeSchedulerProviderPreflightOutcome::AwaitingCoverage {
            request_id,
            guarded_sites,
            unrouted_sites,
        } => Ok(
            G8lS268WholeSchedulerReadCoveragePreflightOutcome::AwaitingCoverage {
                request_id,
                guarded_sites,
                unrouted_sites,
            },
        ),
        G8lS246WholeSchedulerProviderPreflightOutcome::CoverageCompleteAwaitingProvider {
            ..
        } => Err(G8lS268WholeSchedulerReadCoveragePreflightError::UnexpectedCoverageComplete),
    }
}

#[test]
fn s268_coverage_guards_one_existing_read_and_keeps_71_open() {
    assert_eq!(S268_ADDITIONAL_WHOLE_SCHEDULER_READ_SITES, 1);
    assert_eq!(S268_WHOLE_SCHEDULER_GUARDED_SITES, 40);
    assert_eq!(S268_WHOLE_SCHEDULER_UNROUTED_SITES, 71);
}

  {
    id: "g8l-s268-qemu-delivered-ipc-observation-read-access-guard-expansion-partial",
    date: "2026-08-26",
    sequence: 268,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: QEMU delivered-IPC observation read-access guard genişletmesi",
    summary:
      "S268 12/12 PASS ile qemu_observe_delivered_ipc_syscalls içindeki scheduler-derived reply identity, caller/responder/owner capability-authority ve received-register gözlemlerini mevcut production reader gate zincirine aldı. Sonuçlar reader canlıyken owned tuple'a kopyalanıyor; reader ENDPOINT_REGISTRY lock'undan önce explicit düşüyor ve scheduler/task/CNode referansı kaçmıyor. Coverage 39/111'den 40/111'e çıktı, 71 site unrouted kaldı. Writer'lar, exclusive wrapper ve whole-scheduler exclusion açık olduğundan umbrella PARTIAL kalır.",
    evidence: [
      "S268 focused kaynak kapısı iki byte-equal koşuda 12/12 PASS verdi: 127 B / SHA-256 7c5c027e04834587141f9fff89aea670906490a9f834012d2adbd7279dba720b.",
      "Exact source coverage: 7 audit unit / 111 direct SCHEDULER site; previous=39, additional=1, guarded=40, unrouted=71. Routed read yalnız qemu_observe_delivered_ipc_syscalls içindeki immutable scheduler-derived observation snapshot'ıdır.",
      "Reply identity, caller/responder/owner capability authority ve received-register sonuçları reader membership canlıyken owned tuple'a çevrilir. Reader ENDPOINT_REGISTRY lock'undan önce explicit düşer; scheduler/task/CNode referansı lease dışına çıkmaz.",
      "S238–S268 exact dependency matrisi iki bağımsız koşuda 32 grup / 423/423 PASS verdi: raw 3039 B / SHA-256 7864f34953fce935f0a3a9a75577fd4a009806e09eda9f06de2145cab7c455ac; süre-normalize 3103 B / SHA-256 e88315aff6483f7ae51dec2b59f8f6284cb6aa1181300314dcd76eb446fb0713.",
      "Default/QEMU AArch64 check iki byte-equal koşuda PASS: 110646 B / 291 warning başlığı / SHA-256 df60ef72ba60517b7a37c60731e16587303d7b70a4b8362938f9588c59344d8b. Zero-warning iddiası yoktur.",
      "RPi5 normal/SMP profilleri ikişer byte-equal PASS: normal 362627 B / 707 warning / SHA-256 20efe424d0427f3d777457274d5bc0086a9a14e0b8aea657bee262b8ea7c7d11; SMP 362569 B / 707 warning / SHA-256 8e3ef17af31e0a6d4bcc3aa4299dca069b4997cfde2006e465162002b6b84ffa.",
      "make verify-qemu iki bağımsız PASS verdi: ilk 116084 B / SHA-256 c3f2a0258c9cf95bb5aa874e862f06efb86f103c283c999d6c412491144c1da8, ikinci 116084 B / SHA-256 2f968e8f774146c581ff24b589a1f347742835b17d2e2843ad1b2f045fb98fb7. W^X 31/31, S130–S154, S154 1024 retirement, IPC 20/20, SEC5 ve kernel faults=0 korunur. Ortak QEMU regresyonu board-rpi5-only S268 reader guard'ını çalıştırmaz.",
      "Supported-profile cfg sınırı açıkça ölçüldü: board-qemu çağrı noktasını reader guard olmadan, board-rpi5 reader provider'ını QEMU-only çağrı noktası olmadan derler. İki board feature'ını birlikte seçme negatif denemesi fail-closed exit 101 / 16 compile error verdi: 18556 B / SHA-256 6e656bdc7e3d21e9d05e1bef21cb50ddad1b5a48a68965a0a1f023db9a3aed5a. Bu nedenle S268 source-routed kabulüdür; hiçbir desteklenen tek-board profilinde guarded callsite compile/runtime kanıtı yoktur.",
      "Manifest-aware workspace audit'i iki bağımsız koşuda 230 grup / 2181 PASS, 0 fail verdi; exact 7 tarihsel G8h assertion filtrelendi. Ham loglar 57360 B / SHA-256 9b773a12cb06c68f37cfa46f0f1cf48f6d9edb6bb9f4e096460858197477d098 ve 57360 B / SHA-256 30e8b949c16e6f0807df8aba89064e720aa0a5ce69eb70270e166d8ab58c50c7; süre-normalize özet 22191 B / SHA-256 be20e99fb438232385a4ae1c2b2783ea848b7a876a891ebe2c8a2ba74c2a5f99'dur. Filtresiz koşu 52707 B / SHA-256 66b8616ddd6d8a9e5d4eca64f6ab2bb85ba62e577336c10e56036aae209c28f5 ile frozen S96 exceptions.S identity mismatch'te exit 101 kaldı; beklentiler gevşetilmedi ve full-workspace GREEN iddia edilmez.",
      "S268 physical/device operations=0; RUNBOOK_EXECUTED_IN_S268=NO. Tarihsel S124 physical BOOT8H PASS ve tam operatör sırası görünür biçimde korunur.",
      "Canlı marker: S268_12_OF_12_QEMU_DELIVERED_IPC_OBSERVATION_READ_ACCESS_GUARD_ONE_ADDITIONAL_IMMUTABLE_SCHEDULER_DELIVERED_IPC_OBSERVATION_REPLY_ID_AUTHORITY_AND_REGISTER_SNAPSHOT_OWNED_TUPLE_READER_DROPPED_BEFORE_ENDPOINT_REGISTRY_LOCK_NO_SCHEDULER_OR_CNODE_REFERENCE_ESCAPE_PREVIOUS_39_OF_111_TOTAL_40_OF_111_GUARDED_71_UNROUTED_QEMU_COMMON_REGRESSION_DOES_NOT_EXERCISE_BOARD_RPI5_ONLY_GUARD_WORKSPACE_2181_PASS_7_HISTORICAL_G8H_ASSERTIONS_RED_NO_WRITER_COVERAGE_NO_PRODUCTION_EXCLUSIVE_WRAPPER_NO_WHOLE_SCHEDULER_EXCLUSION_PHYSICAL_CPU2_CPU3_HOTPLUG_SOAK_GENERIC_SMP_OPEN_FULL_PHYSICAL_RUNBOOK_VISIBLE_S428_TO_S478_S453_NO_RUNBOOK_EXECUTED_IN_S268_VERIFIED.",
    ],
    commands: [
      "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s267_qemu_delivered_ipc_observation_read_access_guard_expansion -- --test-threads=1",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
      "make verify-qemu",
    ],
    terminalSessions: [
      {
        id: "s268-g8l-qemu-delivered-ipc-observation-read-access-guard-expansion",
        title:
          "G8l S268 QEMU delivered-IPC observation read-access guard genişletmesi",
        commandLines: [
          "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s267_qemu_delivered_ipc_observation_read_access_guard_expansion -- --test-threads=1",
          "make verify-qemu",
        ],
        outputLines: [
          "test result: ok; S268 focused 1 group / 12 passed; 0 failed",
          "coverage: previous 39 + additional 1 = 40/111 guarded; 71 unrouted",
          "reply/authority/register values copied into an owned tuple; reader dropped before ENDPOINT_REGISTRY lock",
          "QEMU common regression PASS: W^X 31/31 · S130–S154 · S154 retired 1024 · IPC 20/20 · SEC5 · kernel faults 0",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S268 yalnız bir immutable QEMU delivered-IPC observation scheduler snapshot route'unu guard'lar; ortak QEMU regresyonu board-rpi5-only reader route'unun runtime invocation kanıtı değildir.",
    limitations: [
      "Toplam 40/111 scheduler erişimi guarded, 71 erişim unrouted kalır.",
      "Bütün scheduler writer yolları, production exclusive wrapper, provider authority ve whole-scheduler exclusion proof yoktur.",
      "QEMU ortak runtime regresyonudur; board-rpi5-only S268 reader route'unu çalıştırmaz.",
      "board-qemu çağrı noktasını guardsız, board-rpi5 reader provider'ını çağrı noktası olmadan derler; guarded callsite hiçbir desteklenen profilde compile/runtime kanıtı değildir.",
      "Exact yedi tarihsel G8h assertion filtresiz workspace'i kırmızı tutar; full-workspace GREEN iddia edilmez.",
      "Fiziksel RPi, CPU2/CPU3, hotplug, soak ve Generic SMP açık kalır.",
      "S268 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S268=NO.",
    ],
  },