S396 · QEMU S136 stale-ACK CALL production writer guard integration

#[cfg(feature = "board-qemu")]
extern "C" fn qemu_strict_el0_ipc_peers_oom_supervisor() -> ! {
    use crate::elf::load_and_spawn_user_elf_from_boot_runtime_with_arg;
    use crate::elf_plan::{AddressRange, ElfLoadPolicy};
    use crate::mm::{
        PressureLevel, RuntimeOomCoordinatorError, RuntimeOomEventKind, RuntimeOomPolicy,
    };
    use crate::ui::capability::{CapabilityRights, IpcMessage};
    use crate::userspace_binaries::OOM_SUPERVISOR_BINARY;

    const S136_EVENT_LABEL: u64 = 0x5331_3336;
    const S136_STALE_ACK_LABEL: u64 = 0x5354_414c;
    const S136_EXACT_ACK_LABEL: u64 = 0x4143_4b31;

    let state = QEMU_STRICT_EL0_PEERS_OOM_STATE
        .lock()
        .as_ref()
        .copied()
        .expect("S135 strict peers OOM state");
    assert_eq!(crate::task::current_task_id(), Some(state.supervisor_task));
    let mut completion = loop {
        match unsafe { crate::task::service_deferred_current_runtime_oom() } {
            Ok(Some(completion)) => break completion,
            Ok(None) => unsafe { crate::task::yield_now() },
            Err(error) => panic!("S135 later-stack completion failed: {:?}", error),
        }
    };
    assert_eq!(completion.execution.task_id, state.responder_task);
    assert_eq!(completion.execution.ipc_teardown.owned_endpoints, 0);
    assert_eq!(completion.execution.ipc_teardown.drained_calls, 0);
    assert_eq!(
        completion.execution.ipc_teardown.cancelled_responder_calls,
        1
    );
    let reply_cap_id = QEMU_STRICT_EL0_PEERS_REPLY_CAP.load(core::sync::atomic::Ordering::Acquire);
    assert_ne!(reply_cap_id, 0);

    // Depending on equal-vruntime tie-breaking, completion may reach the
    // owner before the newly woken caller has executed its marker and EXIT.
    // Bounded yields preserve fail-closed progress without assuming that
    // scheduler detail; absence also proves the normal later-stack reaper ran.
    let mut peers_reaped = false;
    for _ in 0..128 {
        let witnesses =
            crate::task::qemu_s135_ipc_witnesses_observed(state.caller_task, state.responder_task);
        let graph_absent = unsafe {
            crate::task::qemu_s135_strict_peers_cancellation_state(
                state.caller_task,
                state.responder_task,
                state.supervisor_task,
                state.endpoint_id,
                reply_cap_id,
            )
        };
        if witnesses && graph_absent {
            peers_reaped = true;
            break;
        }
        unsafe { crate::task::yield_now() };
    }
    assert!(
        peers_reaped,
        "S135 strict peers did not reach exact reaped state"
    );

    let event = completion
        .coordinator
        .deliver_next_event()
        .expect("S135 supervisor delivery");
    assert_eq!(event.id, completion.execution.event_id);
    assert_eq!(event.task_id, Some(state.responder_task));
    assert_eq!(event.domain, Some(state.strict_responder_oom));
    assert_eq!(event.kind, RuntimeOomEventKind::TeardownComplete);
    assert_eq!(
        event.expected_reclaimable_frames,
        state.responder_frames_before
    );
    assert_eq!(event.observed_domain_frames, 0);

    // S136: keep the coordinator's fixed event as authority, but transport an
    // immutable projection through the production endpoint. The current
    // kernel supervisor is a normal synchronous CALL client; it blocks in the
    // same bounded rendezvous until the standalone strict EL0 receiver uses
    // the ordinary one-shot SYS_IPC_REPLY path.
    let transport_domain = crate::mm::with_boot_runtime_memory(|memory| {
        memory.register_domain(QEMU_EL0_OOM_SUPERVISOR_RUNTIME_DOMAIN_ID)
    })
    .expect("S136 supervisor runtime-memory authority")
    .expect("S136 strict supervisor domain registration");
    let transport_baseline =
        crate::mm::with_boot_runtime_memory(|memory| memory.audited_snapshot())
            .expect("S136 transport baseline authority")
            .expect("S136 transport baseline audit");
    assert_eq!(
        transport_baseline.pmm.free_frames,
        state.baseline_free_frames
    );
    assert_eq!(
        transport_baseline.active_allocations,
        state.baseline_active_allocations
    );
    let endpoint_authority = crate::task::current_task_cnode()
        .and_then(|cnode| cnode.lookup_capability_by_id(state.endpoint_id).copied())
        .filter(|capability| {
            capability.owner == state.supervisor_task
                && capability.parent.is_none()
                && capability.rights.contains(CapabilityRights::ENDPOINT_SEND)
        })
        .expect("S136 kernel supervisor SEND authority");
    let no_forbidden_ranges: [AddressRange; 0] = [];
    let el0_supervisor = unsafe {
        load_and_spawn_user_elf_from_boot_runtime_with_arg(
            "oom-strict-el0-supervisor-elf",
            OOM_SUPERVISOR_BINARY,
            ElfLoadPolicy::new(
                AddressRange::new(0x02c0_0000, 0x02c1_0000),
                &no_forbidden_ranges,
                16,
            ),
            0x8090_1000,
            4,
            0,
            8,
            transport_domain,
            state.endpoint_id,
        )
    }
    .expect("S136 strict EL0 supervisor spawn");
    crate::ui::capability::grant_task_endpoint_to_task(
        endpoint_authority,
        state.supervisor_task,
        el0_supervisor.task_id,
        CapabilityRights::ENDPOINT_RECV,
    )
    .expect("S136 typed supervisor RECV grant");
    let spawned_transport = crate::mm::with_boot_runtime_memory(|memory| {
        Ok::<_, crate::mm::RuntimeAllocationError>((
            memory.audited_domain_quota(transport_domain)?,
            memory.audited_snapshot()?,
        ))
    })
    .expect("S136 spawned transport authority")
    .expect("S136 spawned transport audit");
    assert_eq!(spawned_transport.0.allocated_frames, 5);
    assert_eq!(
        spawned_transport.1.pmm.free_frames,
        transport_baseline.pmm.free_frames - 5
    );
    assert_eq!(
        spawned_transport.1.active_allocations,
        transport_baseline.active_allocations + 5
    );
    kprintln!(
        "[K1-MEM2-S136] supervisor strict spawn PASS id={} pages={} domain={} endpoint={} INITIAL_X0=YES W^X=YES",
        el0_supervisor.task_id,
        el0_supervisor.page_count,
        transport_domain.id(),
        state.endpoint_id,
    );

    let packed_reclaim = event
        .expected_reclaimable_frames
        .checked_shl(32)
        .and_then(|expected| expected.checked_add(event.observed_domain_frames))
        .expect("S136 event projection overflow");
    let event_message = IpcMessage {
        label: S136_EVENT_LABEL,
        badge: state.supervisor_task,
        data: [
            event.id,
            state.responder_task,
            state.strict_responder_oom.id() as u64,
            packed_reclaim,
        ],
    };
    let stale_reply_cap = crate::ui::capability::mint_reply_endpoint_for_call(
        state.supervisor_task,
        state.endpoint_id,
    )
    .expect("S136 stale transport reply mint");
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s396_irq_guard = crate::arch::aarch64::IrqGuard::new();
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s396_writer_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s396_qemu_s136_stale_ack_writer_guard_integration::acquire_s396_production_scheduler_writer_access()
        .unwrap_or_else(|error| {
            panic!(
                "S396 QEMU S136 stale-ACK CALL scheduler writer guard failed closed: {:?}",
                error
            )
        });
    let stale_ack = unsafe {
        (&mut *core::ptr::addr_of_mut!(crate::task::scheduler::SCHEDULER)).ipc_kernel_call_and_wait(
            state.endpoint_id,
            endpoint_authority.generation,
            stale_reply_cap.id,
            event_message,
        )
    }
    .expect("S136 stale EL0 ACK transport");
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s396_writer_access);
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s396_irq_guard);
    assert_eq!(stale_ack.label, S136_STALE_ACK_LABEL);
    assert_eq!(stale_ack.badge, el0_supervisor.task_id);
    assert_eq!(stale_ack.data[0], event.id + 1);
    assert_eq!(stale_ack.data[1..], event_message.data[1..]);
    let before_stale = completion.coordinator.snapshot();
    assert_eq!(
        completion.coordinator.acknowledge(stale_ack.data[0]),
        Err(RuntimeOomCoordinatorError::AckMismatch {
            expected: event.id,
            provided: event.id + 1,
        })
    );
    assert_eq!(completion.coordinator.snapshot(), before_stale);
    assert_eq!(
        completion
            .coordinator
            .rearm_monitor(&mut completion.monitor),
        Err(RuntimeOomCoordinatorError::AttemptInFlight)
    );

    let exact_reply_cap = crate::ui::capability::mint_reply_endpoint_for_call(
        state.supervisor_task,
        state.endpoint_id,
    )
    .expect("S136 exact transport reply mint");
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s395_irq_guard = crate::arch::aarch64::IrqGuard::new();
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s395_writer_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s395_qemu_s136_exact_ack_writer_guard_integration::acquire_s395_production_scheduler_writer_access()
        .unwrap_or_else(|error| {
            panic!(
                "S395 QEMU S136 exact-ACK CALL scheduler writer guard failed closed: {:?}",
                error
            )
        });
    let exact_ack = unsafe {
        (&mut *core::ptr::addr_of_mut!(crate::task::scheduler::SCHEDULER)).ipc_kernel_call_and_wait(
            state.endpoint_id,
            endpoint_authority.generation,
            exact_reply_cap.id,
            event_message,
        )
    }
    .expect("S136 exact EL0 ACK transport");
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s395_writer_access);
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s395_irq_guard);
    assert_eq!(exact_ack.label, S136_EXACT_ACK_LABEL);
    assert_eq!(exact_ack.badge, el0_supervisor.task_id);
    assert_eq!(exact_ack.data, event_message.data);
    completion
        .coordinator
        .acknowledge(exact_ack.data[0])
        .expect("S136 exact EL0 supervisor ACK");
    let rearmed_epoch = completion
        .coordinator
        .rearm_monitor(&mut completion.monitor)
        .expect("S136 post-ACK monitor rearm");

    let mut transport_reclaimed = false;
    for _ in 0..128 {
        let quota = crate::mm::with_boot_runtime_memory(|memory| {
            memory.audited_domain_quota(transport_domain)
        })
        .expect("S136 supervisor quota authority")
        .expect("S136 supervisor quota audit");
        if quota.allocated_frames == 0 {
            transport_reclaimed = true;
            break;
        }
        unsafe { crate::task::yield_now() };
    }
    assert!(
        transport_reclaimed,
        "S136 strict EL0 supervisor did not reach normal reclaim"
    );
    let _ = unsafe { crate::task::service_deferred_current_runtime_oom() }
        .expect("S136 later-stack normal-exit reap");
    let transport_final = crate::mm::with_boot_runtime_memory(|memory| memory.audited_snapshot())
        .expect("S136 final transport authority")
        .expect("S136 final transport audit");
    assert_eq!(
        transport_final.pmm.free_frames,
        transport_baseline.pmm.free_frames
    );
    assert_eq!(
        transport_final.active_allocations,
        transport_baseline.active_allocations
    );
    assert!(!crate::ui::capability::ENDPOINT_REGISTRY
        .lock()
        .iter()
        .any(|endpoint| endpoint.id == stale_reply_cap.id || endpoint.id == exact_reply_cap.id));
    kprintln!(
        "[K1-MEM2-S136] event={} victim={} domain={} endpoint={} stale_reply={} exact_reply={} supervisor={} free={}->{}->{} active={}->{}->{} REAL_ENDPOINT=YES BOUNDED=8 KERNEL_CALL_BLOCKED=YES REAL_RECV_REPLY=YES STALE_ACK_REJECTED=YES EXACT_EL0_ACK=YES REPLY_ONESHOT=2/2 SUPERVISOR_RECLAIM=5 ACK=YES REARM={} LEVEL=NORMAL",
        event.id,
        state.responder_task,
        state.strict_responder_oom.id(),
        state.endpoint_id,
        stale_reply_cap.id,
        exact_reply_cap.id,
        el0_supervisor.task_id,
        transport_baseline.pmm.free_frames,
        spawned_transport.1.pmm.free_frames,
        transport_final.pmm.free_frames,
        transport_baseline.active_allocations,
        spawned_transport.1.active_allocations,
        transport_final.active_allocations,
        rearmed_epoch,
    );
    let policies = [
        RuntimeOomPolicy::new(state.primary, i16::MAX, true),
        RuntimeOomPolicy::new(state.prior_oom, i16::MAX, true),
        RuntimeOomPolicy::new(state.current_oom, i16::MAX, true),
        RuntimeOomPolicy::new(state.live_ipc_oom, i16::MAX, true),
        RuntimeOomPolicy::new(state.el0_ipc_oom, i16::MAX, true),
        RuntimeOomPolicy::new(state.s134_responder_oom, i16::MAX, true),
        RuntimeOomPolicy::new(state.strict_caller_oom, i16::MAX, true),
        RuntimeOomPolicy::new(state.strict_responder_oom, 0, false),
        RuntimeOomPolicy::new(transport_domain, i16::MAX, true),
    ];
    let recovered =
        crate::mm::with_boot_runtime_memory(|memory| completion.monitor.observe(memory, &policies))
            .expect("S135 recovered memory authority")
            .expect("S135 recovered pressure observation");
    assert_eq!(recovered.observation.current, PressureLevel::Normal);

    let (caller_quota, responder_quota, final_snapshot) =
        crate::mm::with_boot_runtime_memory(|memory| {
            Ok::<_, crate::mm::RuntimeAllocationError>((
                memory.audited_domain_quota(state.strict_caller_oom)?,
                memory.audited_domain_quota(state.strict_responder_oom)?,
                memory.audited_snapshot()?,
            ))
        })
        .expect("S135 final RuntimeMemory authority")
        .expect("S135 final RuntimeMemory reconciliation");
    assert_eq!(caller_quota.allocated_frames, 0);
    assert_eq!(responder_quota.allocated_frames, 0);
    assert_eq!(
        final_snapshot.active_allocations,
        state.baseline_active_allocations
    );
    assert_eq!(final_snapshot.pmm.free_frames, state.baseline_free_frames);
    assert_eq!(
        final_snapshot.pmm.free_frames,
        event
            .observed_free_frames
            .checked_add(state.caller_frames_before)
            .expect("S135 final free-frame expectation overflow")
    );
    let strict_caller_reclaim = state
        .caller_frames_before
        .checked_sub(caller_quota.allocated_frames)
        .expect("S135 strict caller reclaim underflow");

    let endpoint_cleanup =
        crate::ui::capability::teardown_task_ipc_lifecycle(state.supervisor_task)
            .expect("S135 empty owner endpoint cleanup");
    assert_eq!(endpoint_cleanup.owned_endpoints, 1);
    assert_eq!(endpoint_cleanup.drained_calls, 0);
    assert_eq!(endpoint_cleanup.cancelled_responder_calls, 0);
    assert!(!crate::ui::capability::ENDPOINT_REGISTRY
        .lock()
        .iter()
        .any(|endpoint| endpoint.id == state.endpoint_id || endpoint.id == reply_cap_id));
    assert!(crate::ui::capability::get_live_capability(state.endpoint_id).is_none());
    assert!(crate::ui::capability::get_live_capability(reply_cap_id).is_none());

    kprintln!(
        "[K1-MEM2-S135] responder={} caller={} owner={} responder_domain={} caller_domain={} endpoint={} reply={} event={} expected={} observed={} free={}->{}->{} OWNED_EP=0 DRAINED_CALLS=0 RESPONDER_CALLS=1 STRICT_CALLER_RECLAIM={} CALLER_DOMAIN_FRAMES={} RESPONDER_DOMAIN_FRAMES={} ACTIVE_ALLOCATIONS={}->{} GLOBAL_BASELINE=PASS EL0_CALL_RETURN=INVALID_CAPABILITY EL0_RECV=DELIVERED BOTH_STRICT=YES GRAPH=ABSENT OWNER_EP_CLEANUP=1 CURRENT=YES LATER_STACK=YES ACK=YES REARM={} LEVEL=NORMAL EXECUTOR=PASS",
        completion.execution.task_id,
        state.caller_task,
        state.supervisor_task,
        state.strict_responder_oom.id(),
        state.strict_caller_oom.id(),
        state.endpoint_id,
        reply_cap_id,
        event.id,
        event.expected_reclaimable_frames,
        event.observed_domain_frames,
        event.baseline_free_frames,
        event.observed_free_frames,
        final_snapshot.pmm.free_frames,
        strict_caller_reclaim,
        caller_quota.allocated_frames,
        responder_quota.allocated_frames,
        state.spawned_active_allocations,
        final_snapshot.active_allocations,
        rearmed_epoch,
    );
    drop(completion);
    unsafe { run_qemu_s137_timer_pressure_smoke(state, transport_domain) };
    unsafe { crate::task::task_exit() }
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn acquire_s396_production_scheduler_writer_access(
) -> Result<G8lS396ProductionSchedulerWriterAccess, G8lS247WholeSchedulerAccessError> {
    let caller_cpu =
        crate::percpu::try_current_cpu_id().ok_or(G8lS247WholeSchedulerAccessError::InvalidCpu)?;
    if caller_cpu != crate::g8l_runtime_contract::CPU0 {
        return Err(G8lS247WholeSchedulerAccessError::InvalidCpu);
    }
    let access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s246_whole_scheduler_read_access_guard::S247_PRODUCTION_WHOLE_SCHEDULER_ACCESS_GATE
        .try_acquire_exclusive_for_valid_cpu(caller_cpu)?;
    Ok(G8lS396ProductionSchedulerWriterAccess { _access: access })
}

#[test]
fn boundary_has_exactly_one_s396_acquire_and_success_release_pair() {
    let boundary = s136_boundary();
    assert_eq!(
        boundary
            .matches("acquire_s396_production_scheduler_writer_access")
            .count(),
        1
    );
    assert_eq!(boundary.matches("drop(s396_writer_access)").count(), 1);
    assert_eq!(boundary.matches("drop(s396_irq_guard)").count(), 1);
}

  {
    id: "g8l-s396-qemu-s136-stale-ack-call-writer-guard-integration-partial",
    date: "2026-08-29",
    sequence: 396,
    status: "passed",
    umbrella_status: "partial",
    title:
      "S396 · QEMU S136 stale-ACK CALL production writer guard integration",
    summary:
      "S396, qemu_strict_el0_ipc_peers_oom_supervisor içindeki iki explicit mutable scheduler aliasından source-order önce gelen stale-ACK CALL sınırını tek başına production guard'a bağlar. Nonzero current supervisor identity, completed responder lifecycle, reaped strict peers, fixed coordinator event, audited transport baseline, task-owned parentless normal Endpoint SEND authority, strict EL0 supervisor ile RECV grant, immutable event message ve linked stale reply writer'dan önce tamamlanır. Dedicated S396 IRQ guard ardından gerçek per-CPU kimliğiyle CPU0-only exclusive writer S395 ve 44 production reader'ın kullandığı aynı statik S247 state word üzerinde alınır. Exact tek mutable SCHEDULER aliası yalnız endpoint id/generation, stale-reply id ve immutable message ile source-order first ipc_kernel_call_and_wait çağrısını kapsar. Owned stale_ack önce writer, sonra IRQ release sınırını geçer; stale label/badge, deliberately mismatched event id ve unchanged message tail doğrulaması iki release sonrasındadır. AckMismatch coordinator snapshot'ını değiştirmez ve monitor rearm AttemptInFlight ile fail-closed kalır. Linked exact reply, ayrı S395 exact-ACK CALL, coordinator acknowledge/rearm, bounded supervisor reclaim, later-stack service, RuntimePmm baseline ve endpoint cleanup downstream'da kalır. Tarihsel S325 exact ve S326 stale authority audit'leri model-only'dir. Guarded writer 69/69, açık writer 0'dır; buna rağmen S397 reconciliation, provider authority=0 ve whole-scheduler exclusion false açıkça korunur. S136 fixture board-qemu, production wrapper RPi5-only olduğundan supported-profile runtime observation=0'dır.",
    evidence: [
      "Canonical focused test S396 modülü, simulation export'u, CPU1 coverage service'i ve production S136 source-order first stale-ACK membership'i yokken unresolved import ile compile RED verdi.",
      "İlk RED exit 101 ile unresolved import g8l_..._s396_qemu_s136_stale_ack_writer_guard_integration üretti; tarihsel S326 authority audit'i production entegrasyonu yerine geçirilmedi.",
      "RED aşamasında S395 exact writer kaynak ve testleri GREEN kalırken yalnız yeni S396 kaynak kimliğinin yokluğu görünürdü.",
      "Final canonical S396 focused koşu 50/50 PASS verdi; hiçbir assertion filtrelenmedi veya ignored yapılmadı.",
      "S396 guard modülü 14809 B / 029ba51c3d8dd27a605156db3298138d175514b58db2db960374cede64f3fd6f SHA-256'dır.",
      "S396 focused test kaynağı 31204 B / d0557191e0eae8eb8d52c4decfc2a30e9d25314541e2d1f185eb3a13a7729b1a SHA-256'dır.",
      "S396 modülü typed S395 preflight outcome'unu yeniden doğrular; inherited 44 reader + 68 guarded writer + 1 open writer snapshot'ı saparsa InventoryDrift ile fail-closed kapanır.",
      "S396 başarı outcome'u SixtyNinthWriterGuardedAwaitingReconciliation'dır ve exact 44 reader + 69/69 writer + 0 open writer envanterini sabitler.",
      "S396_ALL_PRODUCTION_WRITERS_GUARDED=true yalnız writer membership sonucudur; S396_WRITER_COVERAGE_RECONCILIATION_COMPLETE=false ayrı S397 kapısını korur.",
      "S396_PRODUCTION_PROVIDER_AUTHORITY_SITES=0 ve S396_WHOLE_SCHEDULER_EXCLUSION_COMPLETE=false değerleri 69/69 writer sonucundan ayrı tutulur.",
      "Pending S245 view non-consuming incelenir; preflight request'i take etmez ve request id 1 aynı state içinde kalır.",
      "Wrong preflight CPU, S395 typed zinciri üzerinden callback veya inventory sonucu üretmeden kapanır.",
      "Host executor yalnız CPU0 kabul eder; CPU1 dahil tüm non-CPU0 kimlikleri commit callback'inden önce InvalidCpu verir.",
      "Reader lease açıkken S396 executor callback'e girmeden ExclusiveBusy döndürür; reader writer yetkisine dönüşmez.",
      "Başka writer lease açıkken S396 executor callback'e girmeden ExclusiveBusy döndürür.",
      "S396 callback çalışırken nested reader ve writer acquire'ları aynı S247 state word üzerinde fail-closed kalır.",
      "Commit callback'i başarı yolunda exact bir kez çalışır; token nonzero ve release sonrasında active exclusive token yoktur.",
      "Commit callback error'u owned exclusive membership'i exact bir kez bırakır; hata yolu state word'ü kilitli bırakmaz.",
      "S395 exact executor ile S396 stale executor token'ları aynı shared gate üzerinde monoton ve ayrıdır.",
      "acquire_s396_production_scheduler_writer_access gerçek try_current_cpu_id sonucunu kullanır; caller-supplied production CPU parametresi yoktur.",
      "Production wrapper CPU0 dışı kimliği mutation'dan önce reddeder ve try_acquire_exclusive_for_valid_cpu kullanır.",
      "Writer lease S247_PRODUCTION_WHOLE_SCHEDULER_ACCESS_GATE üzerinde alınır; yeni static state word veya ikinci exclusion domain yaratılmaz.",
      "Production-only wrapper, access type ve CPU1 service exact aarch64 + target_os=none + board-rpi5 cfg'si taşır.",
      "S396 modülü try_construct_s400, publish_s244 ve request_state.take kaynaklarını içermez.",
      "CPU1 service yalnız inspect_s245_exclusion_admission_request_on_cpu1 çağrısı ve typed preflight sonucu üretir.",
      "Kernel main ve simulation lib registration'ları exact uzun S396 modül adıyla ayrıdır; generic S335–S400 facade kullanılmaz.",
      "CPU1 timer service sırası S395 service < S396 service < S242 request service olarak sabitlenir.",
      "CPU1 service gövdesi mutable SCHEDULER aliası veya acquire_s396 çağrısı içermez; coverage-only kalır.",
      "Complete qemu_strict_el0_ipc_peers_oom_supervisor öğesinde iki mutable scheduler aliası korunur.",
      "S396 hedef aliası main.rs içindeki 17 explicit mutable aliasın source-order ilkidir; S395 exact aliası ikincidir.",
      "Current task id state.supervisor_task ile eşitlenmeden S396 writer'a erişilemez.",
      "Deferred responder OOM completion ve exact task/domain/event ilişkisi writer'dan önce doğrulanır.",
      "Strict peer witnesses ile caller/responder/supervisor endpoint/reply graph absence bounded loop içinde writer'dan önce kapanır.",
      "Coordinator deliver_next_event sabit event id, victim task, domain, TeardownComplete kind ve reclaim alanlarını writer'dan önce verir.",
      "Transport RuntimePmm baseline free_frames ve active_allocations alanlarını S396 öncesinde state baseline'a bağlar.",
      "endpoint_authority current supervisor CNode'undan owner, parentless ve ENDPOINT_SEND şartlarıyla seçilir.",
      "Strict EL0 supervisor ayrı runtime domain, W^X ELF policy, x0 endpoint ve bounded quota ile writer'dan önce spawn edilir.",
      "Supervisor'a exact endpoint generation üzerinden ENDPOINT_RECV grant writer'dan önce verilir.",
      "Spawn sonrası quota=5, free_frames baseline-5 ve active_allocations baseline+5 sonuçları writer'dan önce denetlenir.",
      "event_message immutable label, supervisor badge ve event/victim/domain/reclaim data projection'ını taşır.",
      "stale_reply_cap supervisor-task/endpoint ilişkisiyle writer'dan önce mint edilir.",
      "Dedicated s396_irq_guard acquire_s396_production_scheduler_writer_access çağrısından önce kurulur.",
      "S396 nested focus tam bir acquire→single mutable alias→source-order first CALL→writer drop zinciridir.",
      "S396 focus exactly bir mutable SCHEDULER aliası ve exactly bir ipc_kernel_call_and_wait içerir.",
      "CALL state.endpoint_id, endpoint_authority.generation, stale_reply_cap.id ve event_message değerlerini aynı sırada forward eder.",
      "S396 focus exact_reply_cap.id, exact_ack veya s395_writer_access içermez.",
      "Owned stale_ack .expect başarı sonucundan sonra drop(s396_writer_access), ardından drop(s396_irq_guard) sırası korunur.",
      "stale_ack label S136_STALE_ACK_LABEL ve badge exact strict supervisor task id ile iki release sonrasında doğrulanır.",
      "stale_ack.data[0] deliberately event.id+1'dir; data[1..] immutable message tail ile aynıdır.",
      "before_stale snapshot writer/IRQ release sonrasında alınır; coordinator acknowledge exact AckMismatch expected/provided çiftini verir.",
      "AckMismatch sonrası coordinator snapshot byte-semantic olarak değişmeden kalır.",
      "Monitor rearm stale mismatch sonrasında exact AttemptInFlight ile reddedilir.",
      "exact_reply_cap yalnız S396 release sonrasında mint edilir; stale focus'a sızmaz.",
      "Dedicated S395 IRQ/writer acquire ve source-order second exact CALL S396 release sonrasında ayrı membership olarak kalır.",
      "Exact ACK label/badge/data validation, coordinator acknowledge ve monitor rearm S395 release sonrasında yürür.",
      "Supervisor quota reclaim bounded 128-yield loop ile gözlenir; bu lifecycle S396 writer scope'una alınmaz.",
      "Later-stack normal-exit reap, final RuntimePmm free/active baseline ve endpoint cleanup downstream'da kalır.",
      "Endpoint registry final kontrolü stale_reply_cap.id ve exact_reply_cap.id nesnelerinin ikisini de reddeder.",
      "Scheduler helper aynı IRQ + IPC_TRANSACTION_LOCK altında caller SEND, normal endpoint ve linked one-shot reply revalidation yapar.",
      "Helper optional receiver authority/deadline ile ready queue, blocked table, reply table ve endpoint rendezvous kapasitesini mutation'dan önce doğrular.",
      "Helper CALL publish, caller park ve optional delivery'yi transaction release'ten önce tamamlar.",
      "Helper context switch ve terminal IpcMessage reconstruction'ı transaction release ve resume sonrasında yapar.",
      "Historical S325 exact-ACK authority audit 15/15 ve S326 stale-ACK authority audit 15/15 ayrı model kaynakları olarak korunur.",
      "S395 production exact-ACK module'ü S396 acquire sembolünü içermez; iki production membership tek kapıda birleşmez.",
      "S396 module source S335_TO_S396_WRITER_STAGES veya writer_stage(396) kullanmaz.",
      "S397 adı yalnız next reconciliation boundary olarak dokümante edilir; S396 source S397 sonucu veya yayın iddiası üretmez.",
      "board-qemu S136 fixture ile board-rpi5 production wrapper arasında supported cfg intersection yoktur; runtime observation=0'dır.",
      "Final selected regression S396, S395, tarihsel S325/S326 ve runtime_oom_supervisor_recovery ile 5 grup / 136 PASS / 0 fail verdi.",
      "S238–S395 dependency hedef listesi korunup yalnız S396 sona eklendi; iki seri koşu 160 grup / 4150/4150 PASS verdi.",
      "Dependency normalized özetleri 15519 B / 20beb82537e6a307b9cc66a9d5b9bada146fdec27bac6003daf583269937000a SHA-256 ile byte-equal=true oldu.",
      "Dependency raw run1/run2 386063/369995 B ve 693d8be8799cc63bbc82da90d6bf33f6e01f9297e82eda6ea02ca764dc17477a / 66dcf98ae25a34d55677499188681d2417e5b96f1427ff9d2c431d9c39fcfe74 SHA-256'dır.",
      "Dependency artifact root /tmp/aselsanos-s396-dependency.geQi72'dir; yalnız elapsed timing suffix'leri normalize edildi.",
      "Filtered serial workspace aynı yedi historical assertion dışında 359 result group / 6034 PASS / 0 fail verdi.",
      "Filtered workspace raw 585347 B / 1a30b8cfb3dfe3e318527075b4bc471b28790e61f525adf3fb7812f793e5705a SHA-256'dır.",
      "Unfiltered workspace exit 101 ile yalnız frozen S96 wiring_does_not_mutate_timer_gic_boot_or_expand_runtime_scope assertion'ında RED kaldı; tamamlanan sınırda 5771 PASS vardı.",
      "Unfiltered sınır 311 completed group / 5771 PASS / 1 failed group; raw 553697 B / c7f7ab3069a1484374bf93c75bde65a15ffbb3901ee05f4feed8872c44675fd1 SHA-256'dır.",
      "Dört fresh canonical AArch64 profil qemu/rpi4/rpi5/rpi5+smp 4/4 exit 0 verdi; zero-warning claim yapılmadı.",
      "Profile warning header sayıları 293/391/1564/1564; her profile ayrı target directory, log ve ELF digest'i taşır.",
      "QEMU verify logu 116354 B / 39ad57c2fdea3cd51a87cf7cd1806486509abb5ac959f599250d81ad58e6d1fc SHA-256 ve exit 0'dır.",
      "QEMU strict ELF W^X 31/31, S130–S154+S271, S136 transport, IPC reply 20/20 ve scheduler SEC5 PASS verdi.",
      "QEMU S136 stale rejection/exact ACK transport product senaryosudur; RPi5-only S396 writer runtime invocation kanıtı değildir.",
      "cargo fmt --all -- --check ve git diff --check empty output ile exit 0 verdi.",
      "Pre-publication Code generator bütün Operations kayıtlarını yeniden taradı ve S1–S396 aralığını 396/396 unique kapıyla kapattı; özellikle S328 öncesindeki S1–S327 aralığı 327/327 tekil kaldı, missingSequences boş ve duplicate sequence sayısı sıfırdır.",
      "Pre-publication Code mapping envanteri 69 writer-guard + 225 focused-test + 94 command-contract + 8 operation-record = 396 kapıdır; S396 eklenirken tarihsel S1–S395 mapping türleri değiştirilmedi.",
      "Generated registry 1152 exact excerpt taşır. Her kapı Operations id/title bağı, source path, complete line range, boundary kind ve SHA-256 içerik kimliğiyle doğrulanır; yalnız görünen etiket listesi yayımlanmaz.",
      "S396 production Code excerpt'i kernel/src/main.rs içindeki complete qemu_strict_el0_ipc_peers_oom_supervisor Rust item'ını yayımlar; complete item sınırı source-order iki CALL'i, bütün precondition'ları ve downstream cleanup'ı bağlamıyla korur.",
      "S396 exact nested focus complete item içinde acquire_s396_production_scheduler_writer_access ile başlar, tek mutable alias ve stale_reply_cap.id kullanan tek CALL'i kapsar, drop(s396_writer_access) ile biter; IRQ release ve doğrulamalar focus dışında fakat complete item içinde görünür kalır.",
      "S396 guard excerpt'i complete acquire_s396_production_scheduler_writer_access öğesidir; shared S247 static gate ve try_acquire_exclusive_for_valid_cpu çağrısı kartta source-bound görünürdür.",
      "S396 test excerpt'i boundary_has_exactly_one_s396_acquire_and_success_release_pair adlı complete Rust test öğesidir; kartın focused-test bağı gerçek 50-test dosyasına gider ve yalnız test komutu metnine dayanmaz.",
      "Code registry compatibility denetimi S396 için sourceBound=true ve testBound=true üretir; S1, S327, S328, S395 ve S396 kartları birer kez, S397 sıfır kez bulunur.",
      "Code yayın hedefi S1–S396 396/396 ayrı kapıdır; S328 öncesi S1–S327 aralığı 327/327 tekil kalmalıdır.",
      "S1, S327, S328, S395 ve S396 kartları exact birer kez; missing=none, duplicate=0 ve S397=0 olmalıdır.",
      "S396 Code kartı complete guard modülü, complete 50-test target, complete S136 ürün işlevi, exact stale focus, proof ve complete Operations object yayımlar.",
      "Complete S136 item iki CALL'i bağlamıyla korur; nested S396 focus yalnız stale_reply_cap.id kullanan first CALL'i kapsar.",
      "Her Code excerpt source path, complete line range, mapping strategy, excerpt kind ve SHA-256 kimliği taşır.",
      "İlk production Code registry S1–S396 396/396 unique kapı, 1152 exact excerpt ve S1–S327 aralığında 327/327 tekil kart taşıdı; missing=none, duplicate=0, mapping 69 writer-guard + 225 focused-test + 94 command-contract + 8 operation-record oldu.",
      "İlk deployment'ta generated JSON 9083249 B / 211f3f30e4f1ed0ae1106415a169587b5aa6ed0025c3283c1d32304155abefd4 dosya SHA-256 ve b2b383cfc6ac7bb99ee21c9b6d8551a76e30fe4026bfb8eea94a9faae07e3b3f registry SHA-256 taşıdı.",
      "İlk website kabulü 724/724 test, lint PASS, TypeScript exit 0 ve 0 B çıktı, 24/24 static route, 200 export dosyası ve Timeline/yol-haritasi için ayrı ayrı 235 data-gate-policy kartı verdi.",
      "İlk yayın öncesi S396 core policy 15251 karakter / 15797 UTF-8 byte, 99 evidence, 3 teknik terminal session ve 10 limitation ile S324 5965 karakter / 6122 byte yoğunluk tabanının üstündeydi.",
      "Production/main ilk yayın 28b0003a-252f-4834-a8ce-8e2b5c1180f1 kimliği ve https://28b0003a.aselsan-microkernel.pages.dev URL'siyle tamamlandı; 115 uploaded + 84 existing = 199 asset ve _headers yayımlandı.",
      "İlk deploy logu 1822 B / dfa489ab7af07e5d73f17f695619c9bd2b99903406d53288880c805cacc177fe ve production deployment-list JSON'u 9512 B / 802a5def15e08e41fb10b2b8ab17ff266ef27d6448a44149551f424ec4626b44 SHA-256'dır.",
      "Cache-busted custom-domain /code/ 25388220 B / af572397e150088eb9a729c28048ffa43044da30cbaa9d2cfad6a6a892832393, /operations/ 15808510 B / be458b0326950910e0c3a0f8a2cf9be3b0a348d19a94c35ab96fbbe1201eae9b, /timeline/ 6705675 B / 6e76616369f31e1280428a9c2b1677a802603134a744276891ae72c7ff842c97 ve /yol-haritasi/ 6705423 B / 0cfe0dd26eb41f808c4854d11fae081ba4b9a277fef9a7519c75e1b0e0d6822b SHA-256 ile HTTP 200 ve deployment out'una raw byte-exact=true verdi.",
      "Canlı Code total=396, unique=396, pre-S328=327, missing=none, duplicate=0; S1/S327/S328/S395/S396 exact birer ve S397=0'dır. /code/ yanıtı no-transform ve nosniff taşır; readback root /tmp/aselsanos-s396-readback-initial.ji3p5X'tir.",
      "Immutable 28b0003a hostname probe'u curl exit 28 / HTTP 000 verdi; custom-domain PASS bu erişim sınırının yerine geçirilmedi.",
      "İlk yayın ölçülerinin işlendiği payload ayrı evidence-sync production/main transaction'ında yayımlanacaktır; evidence-sync deployment id'si self-referential zincir oluşturmamak için ilk ölçüm satırlarına geri yazılmayacaktır.",
      "S396 için güç, SD kart, Mac kart erişimi, UART capture, raw validation, archive veya promotion yapılmadı: physical/device operations=0.",
      "RUNBOOK_EXECUTED_IN_S396=NO; fiziksel RPi5 writer observation veya device acceptance iddiası yoktur.",
      "Bağlayıcı olmayan S396 projeksiyonu R1 S396–S426, R2 S451–S501, R3 S580+, risk aralığı S556–S606 ve merkez yaklaşık S581'dir.",
    ],
    commands: [
      "CARGO_INCREMENTAL=0 cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s396_qemu_s136_stale_ack_writer_guard_integration -- --test-threads=1",
      "run S396, S395, S325, S326 and runtime_oom_supervisor_recovery serially",
      "run S238-S396 dependency list twice and normalize timing fields",
      "run filtered and unfiltered serial workspace audits",
      "run four fresh isolated AArch64 profile builds",
      "CARGO_INCREMENTAL=0 make verify-qemu",
      "npm test && npm run lint && npx tsc --noEmit && npm run build",
      "npm run deploy and cache-busted custom-domain byte comparison",
    ],
    terminalSessions: [
      {
        id: "g8l-s396-focused-source-contract",
        title: "S396 focused S136 stale-ACK writer membership",
        commandLines: [
          "CARGO_INCREMENTAL=0 cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s396_qemu_s136_stale_ack_writer_guard_integration -- --test-threads=1",
        ],
        outputLines: [
          "initial result: compile RED; distinct S396 module/export absent",
          "final result: ok; 50 passed; 0 failed",
          "shared S247 gate: 44 readers + 69/69 writers; 0 open",
          "S397 reconciliation/provider/admission/whole exclusion remain open",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8l-s396-selected-regression",
        title: "S396/S395 exact-stale membership and supervisor regression",
        commandLines: [
          "run S396, S395, S325, S326 and runtime_oom_supervisor_recovery serially",
        ],
        outputLines: [
          "5 groups / 136 passed / 0 failed",
          "S396 first stale CALL and S395 second exact CALL remain distinct",
          "historical S325/S326 authority audits remain model-only",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8l-s396-full-acceptance",
        title: "S396 dependency, workspace, profiles and QEMU acceptance",
        commandLines: [
          "run S238-S396 dependency list twice and normalize timing fields",
          "run filtered and unfiltered serial workspace audits",
          "run four final fresh isolated AArch64 profile builds",
          "CARGO_INCREMENTAL=0 make verify-qemu",
        ],
        outputLines: [
          "dependency: 160 groups / 4150/4150 twice; canonical summaries byte-equal",
          "filtered workspace: 359 groups / 6034 PASS / 7 filtered; unfiltered frozen-S96 remains RED",
          "four profiles: 4/4 exit 0; warning and ELF identities recorded separately",
          "QEMU W^X 31/31 + S130-S154 + S136 + IPC 20/20 + SEC5 PASS; not an S396 writer runtime observation",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8l-s396-production-publication",
        title: "S396 Operations/Timeline/Code production publication",
        commandLines: [
          "npm test && npm run lint && npx tsc --noEmit && npm run build",
          "npm run deploy",
          "cache-busted curl + cmp for /code/, /operations/, /timeline/ and /yol-haritasi/",
        ],
        outputLines: [
          "website tests 724/724 PASS; lint PASS; TypeScript exit 0 with empty output; static routes 24/24",
          "Code registry S1-S396 396/396; pre-S328 S1-S327 327/327; missing none; duplicate 0; excerpts 1152",
          "deployment 28b0003a-252f-4834-a8ce-8e2b5c1180f1; 115 upload + 84 existing",
          "four custom-domain routes HTTP 200 and byte-exact=true; code no-transform/nosniff; immutable hostname curl exit 28 / HTTP 000",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
    ],
    terminalSessionsNote:
      "TAM ÇIKTI kayıtları compile RED→50/50 focused geçişini, seçili 136/136 regresyonu, iki kez 4150/4150 dependency tekrarını, filtreli/filtresiz workspace ayrımını, dört fresh AArch64 profili, QEMU kabulünü ve ilk production yayını birbirine karıştırmadan taşır. S396 yalnız first stale-ACK CALL writer üyeliğidir; S395 second exact-ACK ve S397 reconciliation ayrı kapılardır.",
    limitations: [
      "S396 69/69 writer membership'i kapatır; all-writer reconciliation S397'de ayrı doğrulanacaktır.",
      "113 direct scheduler access reconciliation S398 kapısına aittir.",
      "S399 provider preflight ve S400 provider-authority constructor henüz işlenmedi.",
      "Provider authority=0, S245 request take=0, S244 admission publish=0 ve whole-scheduler exclusion=false korunur.",
      "CPU1 timer service coverage-only'dir; CPU0 writer lease veya mutable scheduler çağırmaz.",
      "board-qemu fixture ile RPi5-only wrapper cfg kesişmediği için supported-profile runtime invocation=0'dır.",
      "QEMU S136 PASS fiziksel RPi5 veya production writer liveness kanıtı değildir.",
      "Filtresiz global workspace donmuş S96 exact-source assertion'ında RED; global GREEN iddia edilmez.",
      "Fiziksel/device işlem yapılmadı ve RUNBOOK_EXECUTED_IN_S396=NO.",
      "Planlama aralıkları tahmindir; kapı veya ürün bitiş taahhüdü değildir.",
    ],
  },