S394 · QEMU S138 stale-ACK CALL production writer guard integration

#[cfg(feature = "board-qemu")]
extern "C" fn qemu_s137_runtime_pressure_completion() -> ! {
    use crate::mm::{PressureLevel, RuntimeOomCoordinatorError, RuntimeOomEventKind};
    use crate::ui::capability::{CapabilityRights, IpcMessage};

    const S138_EVENT_LABEL: u64 = 0x5331_3338;
    const S138_STALE_ACK_LABEL: u64 = 0x5354_4138;
    const S138_EXACT_ACK_LABEL: u64 = 0x4143_4b38;

    let state = QEMU_TIMER_PRESSURE_STATE
        .lock()
        .as_ref()
        .copied()
        .expect("S137 completion state");
    assert_eq!(crate::task::current_task_id(), Some(state.completion_task));
    assert!(state.first_scan_tick > state.installed_tick);
    assert!(state.second_scan_tick > state.first_scan_tick);
    assert_eq!(state.committed_scans, 2);

    let mut completion = loop {
        match unsafe { crate::task::service_deferred_current_runtime_oom() } {
            Ok(Some(completion)) => break completion,
            Ok(None) => unsafe { crate::task::yield_now() },
            Err(error) => panic!("S137 later-stack completion failed: {:?}", error),
        }
    };
    assert_eq!(completion.execution.task_id, state.victim_task);
    assert_eq!(completion.execution.domain, state.victim_domain);
    assert!(completion.execution.lifecycle_complete);
    assert_eq!(completion.execution.ipc_teardown.owned_endpoints, 0);
    assert_eq!(completion.execution.ipc_teardown.drained_calls, 0);
    assert_eq!(
        completion.execution.ipc_teardown.cancelled_responder_calls,
        0
    );

    let post_victim = crate::mm::with_boot_runtime_memory(|memory| memory.audited_snapshot())
        .expect("S138 post-victim RuntimeMemory authority")
        .expect("S138 post-victim RuntimeMemory audit");
    assert_eq!(post_victim.pmm.free_frames, state.spawned_free_frames);
    assert_eq!(
        post_victim.active_allocations,
        state.spawned_active_allocations
    );

    let event = completion
        .coordinator
        .deliver_next_event()
        .expect("S138 timer supervisor delivery");
    assert_eq!(event.id, completion.execution.event_id);
    assert_eq!(event.kind, RuntimeOomEventKind::TeardownComplete);
    assert_eq!(event.task_id, Some(state.victim_task));
    assert_eq!(event.domain, Some(state.victim_domain));
    assert_eq!(
        event.expected_reclaimable_frames,
        state.victim_frames_before
    );
    assert_eq!(event.observed_domain_frames, 0);

    let endpoint_authority = crate::task::current_task_cnode()
        .and_then(|cnode| cnode.lookup_capability_by_id(state.endpoint_id).copied())
        .filter(|capability| {
            capability.owner == state.completion_task
                && capability.parent.is_none()
                && capability.generation == state.endpoint_generation
                && capability.rights.contains(CapabilityRights::ENDPOINT_SEND)
        })
        .expect("S138 completion SEND authority");
    let packed_reclaim = event
        .expected_reclaimable_frames
        .checked_shl(32)
        .and_then(|expected| expected.checked_add(event.observed_domain_frames))
        .expect("S138 event projection overflow");
    let event_message = IpcMessage {
        label: S138_EVENT_LABEL,
        badge: state.completion_task,
        data: [
            event.id,
            state.victim_task,
            state.victim_domain.id() as u64,
            packed_reclaim,
        ],
    };

    let stale_reply_cap = crate::ui::capability::mint_reply_endpoint_for_call(
        state.completion_task,
        state.endpoint_id,
    )
    .expect("S138 stale transport reply mint");
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s394_irq_guard = crate::arch::aarch64::IrqGuard::new();
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s394_writer_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s394_qemu_s138_stale_ack_writer_guard_integration::acquire_s394_production_scheduler_writer_access()
        .unwrap_or_else(|error| {
            panic!(
                "S394 QEMU S138 stale-ACK CALL scheduler writer guard failed closed: {:?}",
                error
            )
        });
    let stale_ack = unsafe {
        (&mut *core::ptr::addr_of_mut!(crate::task::scheduler::SCHEDULER)).ipc_kernel_call_and_wait(
            state.endpoint_id,
            endpoint_authority.generation,
            stale_reply_cap.id,
            event_message,
        )
    }
    .expect("S138 stale EL0 ACK transport");
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s394_writer_access);
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s394_irq_guard);
    assert_eq!(stale_ack.label, S138_STALE_ACK_LABEL);
    assert_eq!(stale_ack.badge, state.supervisor_task);
    assert_eq!(stale_ack.data[0], event.id + 1);
    assert_eq!(stale_ack.data[1..], event_message.data[1..]);
    let before_stale = completion.coordinator.snapshot();
    assert_eq!(
        completion.coordinator.acknowledge(stale_ack.data[0]),
        Err(RuntimeOomCoordinatorError::AckMismatch {
            expected: event.id,
            provided: event.id + 1,
        })
    );
    assert_eq!(completion.coordinator.snapshot(), before_stale);
    assert_eq!(
        completion
            .coordinator
            .rearm_monitor(&mut completion.monitor),
        Err(RuntimeOomCoordinatorError::AttemptInFlight)
    );

    let exact_reply_cap = crate::ui::capability::mint_reply_endpoint_for_call(
        state.completion_task,
        state.endpoint_id,
    )
    .expect("S138 exact transport reply mint");
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s393_irq_guard = crate::arch::aarch64::IrqGuard::new();
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s393_writer_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s393_qemu_s138_exact_ack_writer_guard_integration::acquire_s393_production_scheduler_writer_access()
        .unwrap_or_else(|error| {
            panic!(
                "S393 QEMU S138 exact-ACK CALL scheduler writer guard failed closed: {:?}",
                error
            )
        });
    let exact_ack = unsafe {
        (&mut *core::ptr::addr_of_mut!(crate::task::scheduler::SCHEDULER)).ipc_kernel_call_and_wait(
            state.endpoint_id,
            endpoint_authority.generation,
            exact_reply_cap.id,
            event_message,
        )
    }
    .expect("S138 exact EL0 ACK transport");
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s393_writer_access);
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s393_irq_guard);
    assert_eq!(exact_ack.label, S138_EXACT_ACK_LABEL);
    assert_eq!(exact_ack.badge, state.supervisor_task);
    assert_eq!(exact_ack.data, event_message.data);
    completion
        .coordinator
        .acknowledge(exact_ack.data[0])
        .expect("S138 exact EL0 supervisor ACK");
    let rearmed_epoch = completion
        .coordinator
        .rearm_monitor(&mut completion.monitor)
        .expect("S138 post-ACK monitor rearm");

    let policies = qemu_s137_pressure_policies(state);
    let recovered =
        crate::mm::with_boot_runtime_memory(|memory| completion.monitor.observe(memory, &policies))
            .expect("S137 recovery RuntimeMemory authority")
            .expect("S137 audited recovery observation");
    assert_eq!(recovered.observation.current, PressureLevel::Normal);

    let mut supervisor_reclaimed = false;
    for _ in 0..128 {
        let quota = crate::mm::with_boot_runtime_memory(|memory| {
            memory.audited_domain_quota(state.supervisor_domain)
        })
        .expect("S138 supervisor quota authority")
        .expect("S138 supervisor quota audit");
        if quota.allocated_frames == 0 {
            supervisor_reclaimed = true;
            break;
        }
        unsafe { crate::task::yield_now() };
    }
    assert!(
        supervisor_reclaimed,
        "S138 strict EL0 timer supervisor did not reach normal reclaim"
    );
    let _ = unsafe { crate::task::service_deferred_current_runtime_oom() }
        .expect("S138 later-stack normal-exit reap");

    let (victim_quota, supervisor_quota, final_snapshot) =
        crate::mm::with_boot_runtime_memory(|memory| {
            Ok::<_, crate::mm::RuntimeAllocationError>((
                memory.audited_domain_quota(state.victim_domain)?,
                memory.audited_domain_quota(state.supervisor_domain)?,
                memory.audited_snapshot()?,
            ))
        })
        .expect("S137 final RuntimeMemory authority")
        .expect("S137 final RuntimeMemory reconciliation");
    assert_eq!(victim_quota.allocated_frames, 0);
    assert_eq!(victim_quota.retired_frames, 0);
    assert_eq!(victim_quota.pin_references, 0);
    assert_eq!(supervisor_quota.allocated_frames, 0);
    assert_eq!(supervisor_quota.retired_frames, 0);
    assert_eq!(supervisor_quota.pin_references, 0);
    assert_eq!(final_snapshot.pmm.free_frames, state.baseline_free_frames);
    assert_eq!(
        final_snapshot.active_allocations,
        state.baseline_active_allocations
    );

    let endpoint_cleanup =
        crate::ui::capability::teardown_task_ipc_lifecycle(state.completion_task)
            .expect("S138 completion endpoint cleanup");
    assert_eq!(endpoint_cleanup.owned_endpoints, 1);
    assert_eq!(endpoint_cleanup.drained_calls, 0);
    assert_eq!(endpoint_cleanup.cancelled_responder_calls, 0);
    assert!(!crate::ui::capability::ENDPOINT_REGISTRY
        .lock()
        .iter()
        .any(|endpoint| endpoint.id == state.endpoint_id
            || endpoint.id == stale_reply_cap.id
            || endpoint.id == exact_reply_cap.id));

    kprintln!(
        "[K1-MEM2-S137] victim={} domain={} event={} expected={} observed={} ticks={}->{}->{} TIMER_DAEMON=YES DISTINCT_TICKS=YES SCANS=2 AUDITED=YES CALLER_COUNTERS=ABSENT SYS_WRITE_HOOK=ABSENT SAFE_SVC_BOUNDARY=YES free={}->{}->{} active={}->{}->{} CURRENT=YES LATER_STACK=YES IPC=YES QUIESCED=YES TABLES=YES ASID=YES TRANSPORT_DELEGATED=S138 EXECUTOR=PASS",
        state.victim_task,
        state.victim_domain.id(),
        event.id,
        event.expected_reclaimable_frames,
        event.observed_domain_frames,
        state.installed_tick,
        state.first_scan_tick,
        state.second_scan_tick,
        state.baseline_free_frames,
        state.spawned_free_frames,
        final_snapshot.pmm.free_frames,
        state.baseline_active_allocations,
        state.spawned_active_allocations,
        final_snapshot.active_allocations,
    );
    kprintln!(
        "[K1-MEM2-S138] event={} victim={} domain={} supervisor={} supervisor_domain={} endpoint={} stale_reply={} exact_reply={} ticks={}->{}->{} TIMER_TO_EL0=YES REAL_ENDPOINT=YES BOUNDED=8 KERNEL_CALL_BLOCKED=YES REAL_EL0_RECV_REPLY=YES STALE_ACK_REJECTED=YES EXACT_EL0_ACK=YES KERNEL_DIRECT_ACK=NO REAL_EL0_ACK=YES REPLY_ONESHOT=2/2 free={}->{}->{}->{}->{} active={}->{}->{}->{}->{} VICTIM_RECLAIM=5 SUPERVISOR_RECLAIM=5 OWNER_EP_CLEANUP=1 ACK=YES REARM={} LEVEL=NORMAL EXECUTOR=PASS",
        event.id,
        state.victim_task,
        state.victim_domain.id(),
        state.supervisor_task,
        state.supervisor_domain.id(),
        state.endpoint_id,
        stale_reply_cap.id,
        exact_reply_cap.id,
        state.installed_tick,
        state.first_scan_tick,
        state.second_scan_tick,
        state.baseline_free_frames,
        state.spawned_free_frames,
        state.transport_spawned_free_frames,
        post_victim.pmm.free_frames,
        final_snapshot.pmm.free_frames,
        state.baseline_active_allocations,
        state.spawned_active_allocations,
        state.transport_spawned_active_allocations,
        post_victim.active_allocations,
        final_snapshot.active_allocations,
        rearmed_epoch,
    );
    drop(completion);
    unsafe {
        run_qemu_s139_multi_event_transport(
            event,
            final_snapshot.pmm.free_frames,
            final_snapshot.active_allocations,
        )
    };
    unsafe { crate::task::task_exit() }
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn acquire_s394_production_scheduler_writer_access(
) -> Result<G8lS394ProductionSchedulerWriterAccess, G8lS247WholeSchedulerAccessError> {
    let caller_cpu =
        crate::percpu::try_current_cpu_id().ok_or(G8lS247WholeSchedulerAccessError::InvalidCpu)?;
    if caller_cpu != crate::g8l_runtime_contract::CPU0 {
        return Err(G8lS247WholeSchedulerAccessError::InvalidCpu);
    }
    let access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s246_whole_scheduler_read_access_guard::S247_PRODUCTION_WHOLE_SCHEDULER_ACCESS_GATE
        .try_acquire_exclusive_for_valid_cpu(caller_cpu)?;
    Ok(G8lS394ProductionSchedulerWriterAccess { _access: access })
}

#[test]
fn boundary_has_exactly_one_s394_acquire_and_success_release_pair() {
    let boundary = s138_boundary();
    assert_eq!(
        boundary
            .matches("acquire_s394_production_scheduler_writer_access")
            .count(),
        1
    );
    assert_eq!(boundary.matches("drop(s394_writer_access)").count(), 1);
    assert_eq!(boundary.matches("drop(s394_irq_guard)").count(), 1);
}

  {
    id: "g8l-s394-qemu-s138-stale-ack-call-writer-guard-integration-partial",
    date: "2026-08-29",
    sequence: 394,
    status: "passed",
    umbrella_status: "partial",
    title:
      "S394 · QEMU S138 stale-ACK CALL production writer guard integration",
    summary:
      "S394, qemu_s137_runtime_pressure_completion içindeki iki explicit mutable scheduler aliasından source-order önce gelen deliberate stale-ACK CALL sınırını tek başına production guard'a bağlar. Nonzero completion task/state, completed victim lifecycle, post-victim RuntimePmm snapshot, fixed coordinator event, task-owned normal Endpoint SEND authority, immutable event message ve linked stale reply writer'dan önce tamamlanır. Dedicated S394 IRQ guard ardından gerçek per-CPU kimliğiyle CPU0-only exclusive writer S393 ve 44 production reader'ın kullandığı aynı statik S247 state word üzerinde alınır. Exact tek mutable SCHEDULER aliası yalnız endpoint id/generation, stale-reply id ve immutable event message ile source-order first ipc_kernel_call_and_wait çağrısını kapsar. Owned stale_ack önce writer, sonra IRQ release sınırını geçer; stale label/badge, deliberately mismatched event id ve unchanged message tail doğrulaması iki release sonrasındadır. AckMismatch coordinator snapshot'ını değiştirmez ve monitor rearm AttemptInFlight ile kapalı kalır. Linked exact reply, ayrı S393 exact-ACK CALL, coordinator acknowledge/rearm, NORMAL observation, supervisor reclaim, later-stack service, RuntimePmm baseline ve endpoint cleanup downstream'da kalır. Tarihsel S323 exact ve S324 stale authority audit'leri model-only'dir; S395/S396 iki S136 production writer kapısı ayrı ve açıktır. Guarded writer 67/69, açık writer 2, provider authority 0 ve whole-scheduler exclusion false'dur. S138 fixture board-qemu, production wrapper RPi5-only olduğundan supported-profile runtime observation=0 açıkça korunur.",
    evidence: [
      "Canonical focused test S394 modülü, kernel/simulation registration'ı, CPU1 coverage service'i ve production S138 stale-ACK CALL membership'i yokken compile RED verdi; tarihsel S324 authority audit'i production entegrasyonu yerine geçirilmedi.",
      "İlk RED exit 101 verdi; /tmp/aselsanos-s394-initial-red.log 2033 B / de590cec4f008e3d6211155b9bef859f5ed6dc2530c35b3ef1b1e02efefa8dd7 SHA-256'dır.",
      "RED distinct S394 source include_str dosyasının ve simulation crate export'unun yokluğunu ayrı iki compiler diagnostic ile gösterdi.",
      "Final canonical focused koşu 48/48 PASS verdi; /tmp/aselsanos-s394-focused-green.log 3862 B / c861ccbb720730005c07b612e809f1a476b94c1a6f5450ed3d582fbad7047690 SHA-256'dır.",
      "S394 guard modülü 13684 B / d47f47baa8d0c6abdae6ed8a4894a2c3918d69dd77407feb51934a5a237ce5f2 SHA-256'dır.",
      "S394 focused test kaynağı 29053 B / c376b27a0de2006c85cf66fd428ae9d341df8beadadcacd8fde35632d5457be5 SHA-256'dır.",
      "S394 modülü typed S393 preflight outcome'unu yeniden doğrular; inherited 44 reader + 66 guarded writer + 3 open writer snapshot'ı saparsa InventoryDrift ile fail-closed kapanır.",
      "S394 başarı outcome'u SixtySeventhWriterGuardedAwaitingRemaining'dir ve exact 44 guarded reader + 67/69 guarded writer + 2 open writer envanterini sabitler.",
      "Outcome request id, reader/writer/open sayıları, S138 stale transaction, mutable alias, upstream completion/event/authority/message/reply alanları ve downstream mismatch/S393/recovery alanlarını typed raporlar.",
      'Production wrapper exact all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5") cfg kesişimindedir; board-qemu fixture production runtime invocation diye sunulmaz.',
      "acquire_s394_production_scheduler_writer_access gerçek try_current_cpu_id sonucunu kullanır; caller-supplied production CPU parametresi yoktur ve CPU0 dışı mutation callback'inden önce InvalidCpu ile kapanır.",
      "Writer lease S247_PRODUCTION_WHOLE_SCHEDULER_ACCESS_GATE üzerinde try_acquire_exclusive_for_valid_cpu ile alınır; S394 yeni static, ikinci state word veya ayrı exclusion domain yaratmaz.",
      "Host executor callback'i exact bir kez çağırır; canlı reader writer'ı, canlı writer ikinci writer'ı ve yeni reader'ı aynı state word üzerinde reddeder; callback error RAII lease'ini exact bırakır.",
      "S393 ve S394 executor token'ları aynı shared gate üzerinde monoton ve ayrıdır; iki kapı tek transaction, range dispatcher veya toplu S335–S400 facade membership'i değildir.",
      "Production main.rs envanterinde S138 stale CALL source-order positions[2], yani 17 explicit main aliasının üçüncüsüdür; S394 yalnız bu aliası sahiplenir.",
      "Aynı qemu_s137_runtime_pressure_completion öğesinde exact iki mutable scheduler aliası korunur: first stale-ACK CALL S394, second exact-ACK CALL S393 guarded'dır.",
      "QEMU_TIMER_PRESSURE_STATE completion task id, endpoint id/generation, supervisor task/domain, victim lifecycle ve scan tick kimliklerini exact completion fonksiyonuna taşır.",
      "current_task_id yalnız state.completion_task ile eşleştiğinde ilerlenir; zero veya başka caller identity writer acquisition'a ulaşamaz.",
      "service_deferred_current_runtime_oom bounded yield döngüsü exact lifecycle completion üretmeden coordinator event teslim edilmez.",
      "Completed victim task/domain, lifecycle_complete ve boş IPC teardown özeti writer'dan önce doğrulanır.",
      "Post-victim audited RuntimeMemory snapshot spawned free-frame ve active-allocation değerleriyle writer'dan önce eşitlenir.",
      "Coordinator deliver_next_event exact TeardownComplete event'i üretir; id, victim task/domain, expected reclaim ve observed zero domain frames immutable doğrulanır.",
      "Completion task CNode lookup'ı state.endpoint_id üzerinde owner, parent=None, exact generation ve ENDPOINT_SEND right şartlarını writer'dan önce yeniden doğrular.",
      "packed_reclaim checked shift/add ile overflow fail-closed kurulur; event_message event id, victim, domain ve reclaim tuple'ını immutable taşır.",
      "stale_reply_cap exact completion-task/endpoint ilişkisiyle mint edilir; reply id S394 CALL'e owned scalar olarak aktarılır.",
      "Dedicated s394_irq_guard writer acquire'dan önce kurulur; acquire_s394_production_scheduler_writer_access, drop(s394_writer_access) ve drop(s394_irq_guard) exact birer kez görünür.",
      "Exact mutable alias ipc_kernel_call_and_wait(state.endpoint_id, endpoint_authority.generation, stale_reply_cap.id, event_message) çağrısını bir kez yapar.",
      "CALL terminal sonucu borrowed Scheduler referansı dışarı taşınmadan owned stale_ack değerine alınır; guard release sonrasında Scheduler üzerinden sonuç okunmaz.",
      "S394 focus tek mutable SCHEDULER aliası ve tek ipc_kernel_call_and_wait içerir; exact_reply_cap.id ve let exact_ack bu nested focus'a girmez.",
      "drop(s394_writer_access), drop(s394_irq_guard), stale label, badge, mismatched id ve tail assertions bu kesin source sırasındadır.",
      "Stale ACK yalnız S138_STALE_ACK_LABEL, state.supervisor_task badge, event.id+1 ve event_message.data[1..] değişmeden döndüğünde kabul edilir.",
      "before_stale coordinator snapshot'ı AckMismatch sonrasında unchanged kalır; yanlış event id pending event'i consume etmez.",
      "Monitor rearm exact AttemptInFlight ile kapanır; stale yol S393 exact writer'a geçmeden başarı veya NORMAL state yayımlayamaz.",
      "exact_reply_cap S394 release sonrasında completion-task/endpoint ilişkisiyle mint edilir; S394 writer exact reply graph'ını kapsamaz.",
      "Ayrı s393_irq_guard ve S393 writer source-order second CALL'i kapsar; S394 lease'i bu transaction boyunca tutulmaz veya yeniden kullanılmaz.",
      "Exact ACK label/badge/data, coordinator acknowledge, monitor rearm, NORMAL observation ve supervisor reclaim S394 release sonrasındadır.",
      "Deferred later-stack normal-exit reap S394 release sonrasında yürür; stale CALL transaction'ına lifecycle cleanup eklenmez.",
      "Victim ve supervisor quota allocated/retired/pin değerleri sıfır; final RuntimePmm free frames ve active allocations baseline ile exact eşittir.",
      "teardown_task_ipc_lifecycle completion owner için exact bir owned endpoint, sıfır drained call ve sıfır cancelled responder call raporlar.",
      "Endpoint registry cleanup state.endpoint_id, stale_reply_cap.id ve exact_reply_cap.id'nin tamamını iki ayrı writer release sonrasında yok sayar.",
      "Scheduler helper aynı IRQ/IPC transaction altında caller SEND authority, normal Endpoint object ve linked one-shot reply ilişkisini commit'ten önce yeniden doğrular.",
      "Optional receiver authority/generation ve exact receive deadline ile ready queue, blocked call, reply table ve endpoint queue kapasitesi CALL publish öncesinde fail-closed sınanır.",
      "CALL envelope publish, caller context park ve optional immediate receiver delivery aynı helper transaction'ındadır; transaction release edilmeden context switch yapılmaz.",
      "Continuation transaction release ve resume sonrasında aynı caller task'ı bulur ve yalnız owned IpcMessage veya exact stored IPC error terminal sonucunu yeniden kurar.",
      "Focused source testi complete qemu_s137_runtime_pressure_completion Rust öğesini ve exact S394 acquire→single mutable alias→first CALL→writer drop nested focus'unu birlikte doğrular.",
      "Focused test complete S138 öğesinde exact iki mutable alias sayar, S394 focus'unda yalnız first aliası ve tek ipc_kernel_call_and_wait görür.",
      "Argument-forwarding testi state.endpoint_id, endpoint_authority.generation, stale_reply_cap.id ve event_message değerlerinin exact first CALL'e eksiksiz aktarıldığını doğrular.",
      "Focused test exact_reply_cap.id ve exact_ack'in S394 focus'una girmediğini; stale_reply_cap.id ile immutable event_message'in ise girdiğini ayrı assertion'larla sabitler.",
      "Focused grup request yokken Idle, exact pending request ile SixtySeventhWriterGuardedAwaitingRemaining ve yanlış CPU'da inherited S393 hatasını ayrı test eder.",
      "S245 request preflight sonrasında state.pending_request_id()==Some(1) kalır; take, publish, consume veya authority promotion yapılmaz.",
      "Reader-vs-writer, writer-vs-writer, nested reader/writer, callback-error release ve exact-once callback yolları birbirinden bağımsız test edilir.",
      "Production-only sembollerin tamamı aynı RPi5 AArch64 bare-metal cfg'sine bağlıdır; hostta sahte yarım production yolu oluşturulmaz.",
      "S394 modül kaynak testi provider constructor, S244 publisher ve request-state take adlarını reddeder; provider authority=0 ve exclusion=false kaynak yüzeyiyle korunur.",
      "Kernel main ve simulation lib registration'ları exact uzun S394 modül adıyla ayrı doğrulanır; sıra tablosundaki model satırı production membership yerine geçirilmez.",
      "CPU1 coverage service exceptions.rs içinde S393 service çağrısından sonra ve tarihsel S242 consumer'dan önce çalışır; mutable SCHEDULER veya S394 acquire çağırmaz.",
      "Tarihsel S323 exact-ACK ve S324 stale-ACK audit'leri model-level kalır; production S393 exact membership de ayrı prior source unit'tir.",
      "S395/S396 acquire sembolleri S394 modülünde ve guarded focus'ta yoktur; iki S136 CALL sonraki ayrı kapılar olarak açık kalır.",
      "Final selected regression S394, S393, tarihsel S323/S324 ve runtime_oom_supervisor_recovery ile 5 grup / 133 PASS / 0 fail verdi.",
      "Selected log /tmp/aselsanos-s394-selected.log 12343 B / 4821060be3ff7c1601f62e8c4cf703d6f3c81342cfbe0c6a2c1c8e6d93a20067 SHA-256'dır.",
      "S238–S393 dependency hedef listesi korunup yalnız S394 sona eklendi; iki bağımsız seri koşu 158 grup / 4051/4051 PASS verdi.",
      "Dependency timing-normalized ve LC_ALL=C sıralı özetlerin her biri 34074 B / 379829020f6ca0023c73edfb896a28bd81cb81b9b13fe9485c8097a2606ecc27 SHA-256 ile byte-exact eşittir.",
      "Dependency artifact root /tmp/aselsanos-s394-dependency.uz2n34; raw run1 377941 B / 2b41c0199257ce8a8a79cfce1d1777fdc1f02544e209bda9f754438369a5772f ve run2 362079 B / ab15494ff615cbda289b1cfe59c48a6be98be9570b95739a0219caf54996ca26'dır.",
      "Yalnız finished in süre suffix'i normalization kapsamındadır; test isimleri, hedef sırası, pass/fail adetleri ve durum payload'ı canonical özette kalır.",
      "Yedi exact frozen assertion dışındaki serial workspace 357 result group / 5933 PASS / 0 fail / 7 filtered verdi.",
      "Filtered workspace raw log 577349 B / 8c45ac914775c0b70a510e6a17ab2a7d2e1dcf6a3b877ce66994453c97a33253 ve summary 33797 B / 9032f54d9119db5a51fc65d44541c9bda5017e7d752c9a05bed19f52e6d49b9d'dir.",
      "Filtresiz workspace exit 101 ile yalnız frozen S96 wiring_does_not_mutate_timer_gic_boot_or_expand_runtime_scope assertion'ında durdu; 310 result group / 5678 PASS / 1 fail ve global workspace GREEN claimed=false'dur.",
      "Filtresiz raw log 545670 B / 6325f437a11ce532f101d4a12344acdb4233c9b70ff6b737a07c6739edf36328 ve summary 29378 B / b253744833ef20dbe139317a576cf665bd823806a81c04bb74c2dd087f000daa'dır.",
      "Dört fresh canonical AArch64 profil kernel çalışma dizininden CARGO_INCREMENTAL=0, explicit feature ve birbirinden ayrı target dizinleriyle 4/4 exit 0 verdi; zero-warning iddiası yoktur.",
      "Fresh board-qemu logu 112039 B / 29d4bd6f8daef4b717a5bfafdb45c99180c7f6854a61aeed6d4e27db4e87bfe6 ve 293 warning header; ELF 16814008 B / 6ef08c8490a435002ac5c03c123146ee8febf7e315988dc92882d822fdf3c483'dür.",
      "Fresh board-rpi4 logu 150676 B / 8f420f2a7f203d8d219ee170011b155806514546ea6255a90eba44eb8edd95f0 ve 391 warning header; ELF 11925368 B / 7dcb9ab92cc710df0462efa11e5853aaa6b3973f73a63a226a77bd4d82ebb0fc'dir.",
      "Fresh board-rpi5 logu 673578 B / 9517625d2f98cb18acac8207110895de58f9620900c5e2526f8f2b3bbffb6733 ve 1546 warning header; ELF 15466176 B / bdd36a090d2e421a10b7a69f13d7362ba4d0dff333ec21202609aba3b46d3693'tür.",
      "Fresh board-rpi5+smp logu 673520 B / 708822b6bb55a8b010907f9113020d8ecfa156ffc811bf49d9f11e779979edfa ve 1546 warning header; ELF 15448592 B / 9f80d58a515d2f04da4b206a7e6b11768deb7cd289475ddeacf6923ea275b8bb'dir.",
      "Dört profil /tmp/aselsanos-s394-profiles.TooqWl altında tutulur; build log ve ELF byte/hash ölçüleri birbirine karıştırılmaz.",
      "CARGO_INCREMENTAL=0 make verify-qemu 116354 B / 9a642e47df8b4f4387c0750c439f57e583ec326ed594a1bb7ec33bc1469a7049 SHA-256 ile strict ELF W^X 31/31, S130–S154 + S271, IPC 20/20 ve scheduler SEC5 PASS verdi.",
      "QEMU logunda S138 timer-driven stale rejection ve exact EL0 ACK transport gözlendi; board-qemu guest RPi5-only S394 lease'ini compile etmediği için bu writer runtime observation değildir.",
      "Final cargo fmt --all -- --check ve git diff --check exit 0 ve boş çıktı verdi; 0 B / e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 SHA-256'dır.",
      "S394 proof owned boundary, coverage, source identities, TDD, selected regression, dependency reproducibility, workspace, profiles, QEMU/format ve Code publication contract bölümlerini ayrı taşır.",
      "Code yayın hedefi S1–S394 394/394 ayrı kapıdır; kullanıcının özellikle istediği S328 öncesi S1–S327 aralığı 327/327 tekil kalmalı, missing=none ve duplicate=0 olmalıdır.",
      "S394 Code kartı complete qemu_s137_runtime_pressure_completion Rust öğesini, yalnız first stale CALL'e ait nested acquire→release focus'unu, complete S394 guard modülünü, complete 48-test target'ını, proof'u ve complete Operations object'ini yayımlar.",
      "Complete production excerpt iki S138 CALL'i bağlamıyla gösterirken nested focus yalnız s394_writer_access acquisition'dan drop(s394_writer_access)'e kadar kesilir; S393 exact transaction bu focus'a katılmaz.",
      "S1, S327, S328, S393 ve S394 kartlarının exact birer kez görünmesi; S395'in pre-publish edilmemesi website kabulünde sayılacaktır.",
      "Her Code kartı mappingStrategy, kind, sourcePath, complete excerpt, satır aralığı ve SHA-256 kimliği taşır; test komutu asıl uygulama/model kodunun yerine geçirilmez.",
      "İlk deterministic production registry S1–S394 394/394 unique kapı, 1144 exact excerpt, missing=none ve duplicate=0 üretti; kullanıcının özellikle istediği S328 öncesi S1–S327 aralığı 327/327 tekil kaldı.",
      "İlk registry mapping'i 67 writer-guard + 225 focused-test + 94 command-contract + 8 operation-record = 394'tür; generated JSON 8986349 B / 6139ebbbce959eae718eb4139dc8fb0169bd81fd3203a4cf4ea80b7aeffd789e dosya SHA-256 ve 7d1d47e611d1c5b2fb100ea2fd5057b72652c8a4363a6239e45cd709b49a3b20 registry payload SHA-256 taşır.",
      "Website ilk yayın öncesinde 718/718 test, lint, boş TypeScript çıktısı ve 24/24 static page PASS verdi; export 200 dosya ve Timeline/yol-haritasi ayrı ayrı 233 data-gate-policy kartıdır.",
      "İlk yayın öncesi S394 promotion policy 16568 karakter / 17122 UTF-8 byte, 84 evidence, 3 teknik terminal session ve 8 limitation ile S324 5965 karakter / 6122 byte yoğunluk tabanının üstündedir.",
      "İlk production/main deployment 139b6f54-2f9c-4cb5-928a-8092d9b628e8 kimliğiyle 115 upload + 84 existing = 199 asset ve _headers yayımladı; Wrangler deployment-list kaydı 29446 B / ff888edad0f2aedfaeef50f2e3998f0233cb729ae47e5a4d4d68fd39bd54fb0 SHA-256 ile Production/main durumunu doğrular.",
      "Cache-busted custom-domain /code/ 25148072 B / bd51c16d18b771291fcbdf9aa13b7db7fa767e047221fd334a40a3e05b809808 ve /operations/ 15547403 B / a228d1ecc149baa7c1bdc2752db2a5503105d4be0eaf9c37bd55b4db0d52e28d SHA-256 ile HTTP 200 ve deployment out'una raw byte-exact=true verdi.",
      "Cache-busted custom-domain /timeline/ 6560803 B / 52964e169403b7f9830a350f5c9ffd857e198d1c1e2388e0ff2220b1d8b706c3 ve /yol-haritasi/ 6560551 B / 5478fcc5fb5dbb3f3461da35a08a6b68ac03d786fecffce8ee9a6ec6c65a92d SHA-256 ile HTTP 200 ve deployment out'una raw byte-exact=true verdi.",
      "Canlı Code sayfası total=394, unique=394 ve pre-S328=327 ölçüldü; S1=1, S327=1, S328=1, S393=1, S394=1 ve S395=0'dır. no-transform ve nosniff response sınırları korunur.",
      "İlk readback artifact root /tmp/aselsanos-s394-readback-initial.V2ZUI2'dir; immutable 139b6f54 hostname probe'u curl exit 28 / HTTP 000 verdi ve custom-domain byte-exact PASS yerine geçirilmedi.",
      "Gerçek ilk yayın ölçümlerini taşıyan içerik ayrı evidence-sync deployment'ında production/main'e yayımlanır; dönen ikinci deployment kimliği self-referential içerik zinciri oluşturmamak için bu ilk ölçüm metnine geri yazılmaz.",
      "S394 için güç, SD kart, Mac kart erişimi, UART capture, raw validation, archive veya promotion işlemi yapılmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S394=NO.",
      "Bağlayıcı olmayan S394 projeksiyonu R1 S394–S424, R2 S449–S499, R3 S578+, risk aralığı S554–S604 ve merkez yaklaşık S579'dur; sıra veya ürün taahhüdü değildir.",
    ],
    commands: [
      "CARGO_INCREMENTAL=0 cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s394_qemu_s138_stale_ack_writer_guard_integration -- --test-threads=1",
      "run S394, S393, S323, S324 and runtime_oom_supervisor_recovery serially",
      "run S238-S394 dependency list twice and normalize timing fields",
      "run filtered and unfiltered serial workspace audits",
      "run four fresh isolated AArch64 profile builds",
      "CARGO_INCREMENTAL=0 make verify-qemu",
      "cargo fmt --all -- --check && git diff --check",
      "npm run code:generate && npm run code:check",
      "npm test && npm run lint && npx tsc --noEmit && npm run build",
      "npm run deploy",
      "cache-busted curl + cmp for /code/, /operations/, /timeline/ and /yol-haritasi/",
    ],
    terminalSessions: [
      {
        id: "g8l-s394-focused-source-contract",
        title: "S394 focused S138 stale-ACK writer membership",
        commandLines: [
          "CARGO_INCREMENTAL=0 cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s394_qemu_s138_stale_ack_writer_guard_integration -- --test-threads=1",
        ],
        outputLines: [
          "initial result: compile RED; distinct S394 module/export and production S138 first stale-CALL boundary absent",
          "final result: 48/48 PASS; exact first alias and owned stale-ACK writer→IRQ release order",
          "shared S247 gate: 44 guarded readers + 67/69 guarded writers; 2 writers open",
          "board-qemu fixture / board-rpi5 wrapper supported-profile intersection=0; provider authority=0",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8l-s394-selected-regression",
        title:
          "S394 selected S138 stale/exact and supervisor recovery regression",
        commandLines: [
          "run S394, S393, S323, S324 and runtime_oom_supervisor_recovery serially",
        ],
        outputLines: [
          "final result: 5 groups / 133 passed / 0 failed",
          "historical S323/S324 authority audits remain model-only; S393 exact CALL remains separately guarded",
          "S395/S396 S136 writers remain open",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8l-s394-full-acceptance",
        title: "S394 dependency, workspace, profile and QEMU acceptance",
        commandLines: [
          "run S238-S394 dependency list twice and normalize timing fields",
          "run filtered and unfiltered serial workspace audits",
          "run four fresh isolated AArch64 profile builds",
          "CARGO_INCREMENTAL=0 make verify-qemu",
        ],
        outputLines: [
          "dependency: 158 groups / 4051/4051 twice; normalized 34074-byte summaries SHA-256 identical",
          "filtered workspace: 357 groups / 5933 PASS / 7 filtered; unfiltered frozen-S96 remains RED",
          "four profiles: 4/4 exit 0; warning and ELF identities recorded separately",
          "QEMU W^X 31/31 + S130-S154 + IPC 20/20 + SEC5 PASS; not an S394 writer runtime observation",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8l-s394-production-publication",
        title: "S394 Operations/Timeline/Code production publication",
        commandLines: [
          "npm test && npm run lint && npx tsc --noEmit && npm run build",
          "npm run deploy",
          "cache-busted curl + cmp for /code/, /operations/, /timeline/ and /yol-haritasi/",
        ],
        outputLines: [
          "website: 718/718 PASS; lint PASS; TypeScript exit 0 with empty output; 24/24 static pages",
          "Code registry: S1-S394 394/394 unique; 1144 excerpts; pre-S328 327/327; S395=0",
          "deployment 139b6f54-2f9c-4cb5-928a-8092d9b628e8: 115 uploaded + 84 existing; _headers published",
          "custom-domain four-route HTTP 200 and raw byte-exact=true; immutable hostname exit 28 / HTTP 000",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
    ],
    terminalSessionsNote:
      "TAM ÇIKTI kayıtları compile RED→48/48 focused geçişini, seçili 133/133 regresyonu, iki kez 4051/4051 dependency tekrarını, filtreli/filtresiz workspace ayrımını, dört fresh AArch64 profili, QEMU kabulünü ve 394/394 canlı Code yayınını birbirine karıştırmadan taşır. S394 yalnız first stale-ACK CALL writer üyeliğidir; S393 exact-ACK ve S395/S396 S136 kapıları ayrıdır.",
    limitations: [
      "S394 yalnız qemu_s137_runtime_pressure_completion içindeki source-order first stale-ACK CALL sınırını kapatır; iki S136 writer S395/S396 için açıktır.",
      "board-qemu caller ile RPi5-only production wrapper desteklenen tek bir profilde kesişmez; supported-profile runtime invocation=0'dır.",
      "Production provider authority=0, whole-scheduler exclusion=false ve S244 admission publication yoktur.",
      "Transient contention liveness/soak ve default-parallel PTY determinism ürün kabulü değildir.",
      "CPU2/CPU3, migration, load balancing, hotplug ve Generic SMP cross-CPU arbitration açıktır.",
      "Filtresiz workspace frozen S96 source assertion'ı nedeniyle global GREEN değildir.",
      "Fiziksel RPi latency/power/thermal, UART/raw ve product threshold kabulü yapılmadı; RUNBOOK_EXECUTED_IN_S394=NO.",
      "R1/R2/R3 sıra görünümü bağlayıcı olmayan planlama projeksiyonudur; ürün teslim taahhüdü değildir.",
    ],
  },