G8l: QEMU strict-peers cancellation-state read-access guard genişletmesi

pub fn preflight_s269_whole_scheduler_read_coverage(
    caller_cpu: usize,
    request: Option<G8lS245WholeSchedulerExclusionAdmissionRequestView>,
) -> Result<
    G8lS269WholeSchedulerReadCoveragePreflightOutcome,
    G8lS269WholeSchedulerReadCoveragePreflightError,
> {
    match preflight_s268_whole_scheduler_read_coverage(caller_cpu, request)
        .map_err(G8lS269WholeSchedulerReadCoveragePreflightError::S268)?
    {
        G8lS268WholeSchedulerReadCoveragePreflightOutcome::Idle => {
            return Ok(G8lS269WholeSchedulerReadCoveragePreflightOutcome::Idle);
        }
        G8lS268WholeSchedulerReadCoveragePreflightOutcome::AwaitingCoverage {
            guarded_sites,
            unrouted_sites,
            ..
        } if guarded_sites == S268_WHOLE_SCHEDULER_GUARDED_SITES
            && unrouted_sites
                == S246_DIRECT_SCHEDULER_ACCESS_SITES - S268_WHOLE_SCHEDULER_GUARDED_SITES => {}
        G8lS268WholeSchedulerReadCoveragePreflightOutcome::AwaitingCoverage {
            guarded_sites,
            unrouted_sites,
            ..
        } => {
            return Err(
                G8lS269WholeSchedulerReadCoveragePreflightError::PriorCoverageDrift {
                    guarded_sites,
                    unrouted_sites,
                },
            );
        }
    }

    let outcome = preflight_s246_whole_scheduler_exclusion_provider(
        caller_cpu,
        request,
        G8lS246WholeSchedulerCoverageAudit::new(
            S246_SOURCE_AUDIT_UNITS,
            S246_DIRECT_SCHEDULER_ACCESS_SITES,
            S269_WHOLE_SCHEDULER_GUARDED_SITES,
        ),
    )
    .map_err(G8lS269WholeSchedulerReadCoveragePreflightError::S246)?;
    match outcome {
        G8lS246WholeSchedulerProviderPreflightOutcome::Idle => {
            Ok(G8lS269WholeSchedulerReadCoveragePreflightOutcome::Idle)
        }
        G8lS246WholeSchedulerProviderPreflightOutcome::AwaitingCoverage {
            request_id,
            guarded_sites,
            unrouted_sites,
        } => Ok(
            G8lS269WholeSchedulerReadCoveragePreflightOutcome::AwaitingCoverage {
                request_id,
                guarded_sites,
                unrouted_sites,
            },
        ),
        G8lS246WholeSchedulerProviderPreflightOutcome::CoverageCompleteAwaitingProvider {
            ..
        } => Err(G8lS269WholeSchedulerReadCoveragePreflightError::UnexpectedCoverageComplete),
    }
}

#[test]
fn s269_coverage_guards_one_existing_read_and_keeps_70_open() {
    assert_eq!(S269_ADDITIONAL_WHOLE_SCHEDULER_READ_SITES, 1);
    assert_eq!(S269_WHOLE_SCHEDULER_GUARDED_SITES, 41);
    assert_eq!(S269_WHOLE_SCHEDULER_UNROUTED_SITES, 70);
}

  {
    id: "g8l-s269-qemu-strict-peers-cancellation-state-read-access-guard-expansion-partial",
    date: "2026-08-26",
    sequence: 269,
    status: "passed",
    umbrella_status: "partial",
    title:
      "G8l: QEMU strict-peers cancellation-state read-access guard genişletmesi",
    summary:
      "S269 12/12 PASS ile qemu_strict_peers_cancellation_state içindeki caller/responder task presence ve owner CNode authority okumalarını mevcut production reader gate zincirine aldı. Scheduler-derived sonuçlar reader canlıyken owned tuple'a kopyalanıyor; reader ENDPOINT_REGISTRY ve capability-provenance lock'larından önce explicit düşüyor ve scheduler/task/CNode referansı kaçmıyor. Coverage 40/111'den 41/111'e çıktı, 70 site unrouted kaldı. Writer'lar, exclusive wrapper ve whole-scheduler exclusion açık olduğundan umbrella PARTIAL kalır.",
    evidence: [
      "S269 focused kaynak kapısı iki byte-equal koşuda 12/12 PASS verdi: 127 B / SHA-256 7c5c027e04834587141f9fff89aea670906490a9f834012d2adbd7279dba720b.",
      "Exact source coverage: 7 audit unit / 111 direct SCHEDULER site; previous=40, additional=1, guarded=41, unrouted=70. Routed read qemu_strict_peers_cancellation_state içindeki immutable caller/responder presence ve owner CNode authority snapshot'ıdır.",
      "Caller/responder task presence ve owner CNode authority reader membership canlıyken owned tuple'a çevrilir. Reader ENDPOINT_REGISTRY ve capability-provenance lock'larından önce explicit düşer; scheduler/task/CNode referansı lease dışına çıkmaz.",
      "S238–S269 exact dependency matrisi iki bağımsız koşuda 33 grup / 435/435 PASS verdi: ham özet 3134 B; yalnız bir finished-in alanında 0.01s↔0.00s değişti; süre-normalize 3200 B / SHA-256 5feb96da88770386dabb2e6c29c0c1f593b3afcdc47d9347dc257b68429d9745 byte-equal oldu.",
      "Default/QEMU AArch64 check iki byte-equal koşuda PASS: 110646 B / 291 warning başlığı / SHA-256 a33df20e7271294ab54e6b075dbc21e247076cd1af7c1977c76c48eb215c4830. Zero-warning iddiası yoktur.",
      "RPi5 normal/SMP profilleri ikişer byte-equal PASS: normal 363397 B / 709 warning / SHA-256 abbd56234a80d4cdb3370b314564784401611b302ad5d2dd7998e52d69c2093c; SMP 363339 B / 709 warning / SHA-256 4642b81e95c0d6797463cfec2bd06e9d7f4fdfff536090ba7de1962799bf9840.",
      "make verify-qemu iki bağımsız PASS verdi: ilk 116084 B / SHA-256 419f2e45a3d75b0cfcc5aaf239fc8b273b87c328acf1fdabdd8b62f36b8ba432, ikinci 116084 B / SHA-256 88acb3ae48b13e25ccc649e0e32a71ec0d299e8a30718ebe8ee0d30e425eade3. W^X 31/31, S130–S154, S154 1024 retirement, IPC 20/20, SEC5 ve kernel faults=0 korunur. Ortak QEMU regresyonu board-rpi5-only S269 reader guard'ını çalıştırmaz.",
      "Supported-profile cfg sınırı açıkça ölçüldü: board-qemu çağrı noktasını reader guard olmadan, board-rpi5 reader provider'ını QEMU-only çağrı noktası olmadan derler. İki board feature'ını birlikte seçme negatif denemesi fail-closed exit 101 / 16 compiler error verdi: 18556 B / SHA-256 9d27c37dfc9680eee2cae6bb4ada1fcda4f8bf71b6ee34c1873d62f07d2737b2. Bu nedenle S269 source-routed kabulüdür; hiçbir desteklenen tek-board profilinde guarded callsite compile/runtime kanıtı yoktur.",
      "Manifest-aware workspace audit'i exact 7 tarihsel G8h assertion filtrelenerek 231 grup / 2194 PASS, 0 fail kapsamındadır; frozen S96 exceptions.S identity mismatch beklentileri gevşetilmez ve full-workspace GREEN iddia edilmez.",
      "S269 physical/device operations=0; RUNBOOK_EXECUTED_IN_S269=NO. Tarihsel S124 physical BOOT8H PASS ve tam operatör sırası görünür biçimde korunur.",
      "Canlı marker: S269_12_OF_12_QEMU_STRICT_PEERS_CANCELLATION_STATE_READ_ACCESS_GUARD_ONE_ADDITIONAL_IMMUTABLE_SCHEDULER_TASK_PRESENCE_AND_OWNER_CNODE_AUTHORITY_SNAPSHOT_OWNED_TUPLE_READER_DROPPED_BEFORE_ENDPOINT_REGISTRY_AND_CAPABILITY_PROVENANCE_LOCKS_NO_SCHEDULER_OR_CNODE_REFERENCE_ESCAPE_PREVIOUS_40_OF_111_TOTAL_41_OF_111_GUARDED_70_UNROUTED_QEMU_COMMON_REGRESSION_DOES_NOT_EXERCISE_BOARD_RPI5_ONLY_GUARD_WORKSPACE_2194_PASS_7_HISTORICAL_G8H_ASSERTIONS_RED_NO_WRITER_COVERAGE_NO_PRODUCTION_EXCLUSIVE_WRAPPER_NO_WHOLE_SCHEDULER_EXCLUSION_PHYSICAL_CPU2_CPU3_HOTPLUG_SOAK_GENERIC_SMP_OPEN_FULL_PHYSICAL_RUNBOOK_VISIBLE_S429_TO_S479_S454_NO_RUNBOOK_EXECUTED_IN_S269_VERIFIED.",
    ],
    commands: [
      "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s268_qemu_strict_peers_cancellation_state_read_access_guard_expansion -- --test-threads=1",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
      "make verify-qemu",
    ],
    terminalSessions: [
      {
        id: "s269-g8l-qemu-strict-peers-cancellation-state-read-access-guard-expansion",
        title:
          "G8l S269 QEMU strict-peers cancellation-state read-access guard genişletmesi",
        commandLines: [
          "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s268_qemu_strict_peers_cancellation_state_read_access_guard_expansion -- --test-threads=1",
          "make verify-qemu",
        ],
        outputLines: [
          "test result: ok; S269 focused 1 group / 12 passed; 0 failed",
          "coverage: previous 40 + additional 1 = 41/111 guarded; 70 unrouted",
          "caller/responder presence and owner CNode authority copied into an owned tuple; reader dropped before endpoint registry and capability provenance locks",
          "QEMU common regression PASS: W^X 31/31 · S130–S154 · S154 retired 1024 · IPC 20/20 · SEC5 · kernel faults 0",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S269 yalnız bir immutable QEMU strict-peers cancellation-state scheduler snapshot route'unu guard'lar; ortak QEMU regresyonu board-rpi5-only reader route'unun runtime invocation kanıtı değildir.",
    limitations: [
      "Toplam 41/111 scheduler erişimi guarded, 70 erişim unrouted kalır.",
      "Bütün scheduler writer yolları, production exclusive wrapper, provider authority ve whole-scheduler exclusion proof yoktur.",
      "QEMU ortak runtime regresyonudur; board-rpi5-only S269 reader route'unu çalıştırmaz.",
      "board-qemu çağrı noktasını guardsız, board-rpi5 reader provider'ını çağrı noktası olmadan derler; guarded callsite hiçbir desteklenen profilde compile/runtime kanıtı değildir.",
      "Exact yedi tarihsel G8h assertion filtresiz workspace'i kırmızı tutar; full-workspace GREEN iddia edilmez.",
      "Fiziksel RPi, CPU2/CPU3, hotplug, soak ve Generic SMP açık kalır.",
      "S269 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S269=NO.",
    ],
  },