K1/MEM1–MEM2: ticket-bound scheduler OOM teardown

/// Move one live S129 authority bundle into the scheduler before its exact
/// Ready target becomes current. The target and one alternate switch target
/// must both exist before publication; no effect occurs in this arm phase.
pub unsafe fn arm_current_runtime_oom_teardown(
    monitor: crate::mm::RuntimePressureMonitor,
    coordinator: crate::mm::RuntimeOomCoordinator,
    ticket: crate::mm::RuntimeOomTeardownTicket,
    target_task_id: u64,
) -> Result<(), RuntimeOomTaskExecutionError> {
    let s352_irq_guard = crate::arch::aarch64::IrqGuard::new();
    #[cfg(feature = "board-rpi5")]
    let s259_deferred_carrier_scheduler_read_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s258_runtime_oom_arm_read_access_guard_expansion::acquire_s259_production_scheduler_read_access()
        .unwrap_or_else(|error| {
            panic!(
                "S259 runtime OOM deferred-carrier scheduler read access failed closed: {:?}",
                error
            )
        });
    let deferred_carrier_busy = (&*core::ptr::addr_of!(SCHEDULER))
        .deferred_current_runtime_oom
        .is_some();
    #[cfg(feature = "board-rpi5")]
    drop(s259_deferred_carrier_scheduler_read_access);
    if deferred_carrier_busy {
        return Err(RuntimeOomTaskExecutionError::DeferredCarrierBusy);
    }

    let ticket_preflight = crate::mm::with_boot_runtime_memory(|memory| {
        coordinator.preflight_teardown(&ticket, memory)
    })
    .map_err(|_| RuntimeOomTaskExecutionError::BootMemoryAuthority)?
    .map_err(RuntimeOomTaskExecutionError::CoordinatorPreflight)?;
    if monitor.instance_epoch() != ticket_preflight.domain.instance_epoch() {
        return Err(RuntimeOomTaskExecutionError::DeferredTargetMismatch);
    }

    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s352_writer_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s352_current_runtime_oom_arm_writer_guard_integration::acquire_s352_production_scheduler_writer_access()
        .unwrap_or_else(|error| {
            panic!(
                "S352 current-runtime-OOM arm scheduler writer guard failed closed: {:?}",
                error
            )
        });
    let sched = &mut *core::ptr::addr_of_mut!(SCHEDULER);
    let binding = match sched.preflight_runtime_oom_task(ticket_preflight) {
        Ok(binding) => binding,
        Err(error) => {
            #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
            drop(s352_writer_access);
            drop(s352_irq_guard);
            return Err(error);
        }
    };
    if binding.location != RuntimeOomTaskLocation::Ready || binding.task_id != target_task_id {
        #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
        drop(s352_writer_access);
        drop(s352_irq_guard);
        return Err(RuntimeOomTaskExecutionError::DeferredWrongLocation);
    }
    if !sched
        .ready_queue
        .iter()
        .any(|candidate| candidate.task.id != target_task_id)
    {
        #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
        drop(s352_writer_access);
        drop(s352_irq_guard);
        return Err(RuntimeOomTaskExecutionError::DeferredExitUnavailable);
    }
    sched.deferred_current_runtime_oom = Some(DeferredCurrentRuntimeOom {
        monitor,
        coordinator,
        ticket,
        binding,
        ipc_lifecycle_closed: false,
        ipc_teardown: None,
        witness: None,
    });
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s352_writer_access);
    drop(s352_irq_guard);
    Ok(())
}

#[test]
fn qemu_runs_a_real_ready_task_oom_executor_and_requires_its_marker() {
    assert!(MAIN.contains("run_qemu_runtime_oom_executor_smoke"));
    assert!(MAIN.contains("execute_runtime_oom_teardown"));
    assert!(MAIN.contains("[K1-MEM2-S130]"));
    assert!(QEMU_SMOKE.contains("K1-MEM2-S130"));
    assert!(QEMU_SMOKE.contains("EXECUTOR=PASS"));
}

  {
    id: "k1-mem1-mem2-scheduler-oom-teardown-partial",
    date: "2026-08-23",
    sequence: 130,
    status: "passed",
    umbrella_status: "partial",
    title: "K1/MEM1–MEM2: ticket-bound scheduler OOM teardown",
    summary:
      "S130, S129'un lineer teardown ticket'ını gerçek non-current strict RuntimePmm scheduler göreviyle fail-closed eşler. İlk etkiden önce ticket/memory baseline'ı ve exact-one task/domain/frame bağı tekrar doğrulanır; IPC lifecycle close, Ready/Blocked detach, Dead geçişi, ASID quiescence, page-table forest/root sökümü, typed scrub/free ve ASID-last retirement tek IRQ guard altında sıralanır. QEMU'da ayrı bir Ready kurban 5 frame ile spawn edildi, executor domain envanterini 5→0 ve PMM free sayısını 6134→6139 döndürdü; event exact teslim/ACK edildi ve monitor NORMAL seviyede epoch 2'ye rearm oldu. Current-task yolu etkiden önce deferred olarak reddedilir; K1/MEM1/MEM2 PARTIAL kalır.",
    evidence: [
      "RED kapısı üretim executorü yokken 0/5 oldu; beş scheduler OOM kabul testi missing preflight/task binding/executor/reaper/QEMU marker nedeniyle kapalıydı.",
      "GREEN scheduler executor kaynak/host kapısı 5/5; birleşik K1/MEM1–MEM2 focused matrisi 99/99 PASS.",
      "Preflight, canlı S129 ticket'ı ile authoritative RuntimeMemory snapshot ve victim-domain quota baseline'ını ilk etkiden önce exact doğrular; araya giren allocation `InventoryChanged` ile mutasyonsuz reddedilir.",
      "Scheduler Ready ve Blocked envanterini allocation-free tarar; exact-one domain/frame bağı dışındaki ambiguous/current/retired hedefler fail-closed kalır.",
      "QEMU marker: task=2, domain=1330597169, event=1, victim frames 5→0, free 6134→6139, IPC=YES, QUIESCED=YES, TABLES=YES, ASID=YES, ACK=YES, REARM=2, LEVEL=NORMAL, EXECUTOR=PASS.",
      "QEMU smoke strict ELF W^X 3/3, runtime MEM0 ledger/reclaim, EL0 return x4096, IPC reply 3/3 ve scheduler SEC5 regresyonlarını da geçti.",
      "AArch64 board-qemu, board-rpi4, board-rpi5 ve board-rpi5+smp compile applicability 4/4 PASS.",
      "Tam workspace yalnız bağımsız frozen S96 exceptions.S SHA-256 uyuşmazlığında durdu: observed f7b47672…04fd, expected c0eed3e2…cb89. Full-workspace GREEN iddia edilmedi.",
      "Kalıcı kapsam ve açık S131 sınırı: `docs/K1-S130-Scheduler-OOM-Teardown-Proof.md`.",
    ],
    commands: [
      "cargo test -p aselsan_microkernel_simulation --test runtime_oom_scheduler_executor -- --test-threads=1",
      "cargo test -p aselsan_microkernel_simulation --test aarch64_asid_encoding --test ipc_queue_source --test kernel_kmap_source --test memory_accounting --test memory_pressure --test runtime_allocation_token --test runtime_boot_authority --test runtime_boot_authority_fail_closed --test runtime_boot_authority_no_alloc --test runtime_domain_quota --test runtime_elf_reclaim_source --test runtime_memory_reconciliation --test runtime_oom_effect --test runtime_oom_scheduler_executor --test runtime_pressure_authority --test task_id_allocator --test task_lifecycle_source --test task_publication_source --test task_spawn_asid_source -- --test-threads=1",
      "cargo check -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-qemu",
      "cargo check -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi4",
      "cargo check -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo check -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
      "make verify-qemu",
      "cargo test --workspace -- --test-threads=1",
    ],
    terminalSessions: [
      {
        id: "s130-red-missing-scheduler-executor",
        title: "S130 RED: scheduler OOM yürütücüsü yok",
        commandLines: [
          "cargo test -p aselsan_microkernel_simulation --test runtime_oom_scheduler_executor -- --test-threads=1",
        ],
        outputLines: [
          "runtime_oom_scheduler_executor: 0/5 PASS",
          "missing ticket preflight, exact task binding, executor/reaper and QEMU marker",
        ],
        exitCode: 101,
        outputMode: "selected",
      },
      {
        id: "s130-green-and-focused-executor",
        title: "Scheduler executor ve birleşik authority/lifecycle kapıları",
        commandLines: [
          "cargo test -p aselsan_microkernel_simulation --test runtime_oom_scheduler_executor -- --test-threads=1",
          "cargo test -p aselsan_microkernel_simulation --test aarch64_asid_encoding --test ipc_queue_source --test kernel_kmap_source --test memory_accounting --test memory_pressure --test runtime_allocation_token --test runtime_boot_authority --test runtime_boot_authority_fail_closed --test runtime_boot_authority_no_alloc --test runtime_domain_quota --test runtime_elf_reclaim_source --test runtime_memory_reconciliation --test runtime_oom_effect --test runtime_oom_scheduler_executor --test runtime_pressure_authority --test task_id_allocator --test task_lifecycle_source --test task_publication_source --test task_spawn_asid_source -- --test-threads=1",
        ],
        outputLines: [
          "runtime_oom_scheduler_executor: 5/5 PASS",
          "combined focused matrix: 99/99 PASS",
          "intervening memory mutation: InventoryChanged without coordinator mutation",
          "current task: CurrentTaskRequiresDeferredExit before effects",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
      {
        id: "s130-aarch64-and-qemu-runtime",
        title: "Dört AArch64 profil ve injected Ready-task QEMU teardown",
        commandLines: [
          "cargo check -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-qemu",
          "cargo check -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi4",
          "cargo check -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
          "cargo check -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
          "make verify-qemu",
        ],
        outputLines: [
          "AArch64 compile profiles: 4/4 PASS",
          "[K1-MEM2-S130] oom-victim strict spawn PASS id=2 pages=2 domain=1330597169 W^X=YES",
          "[K1-MEM2-S130] task=2 domain=1330597169 event=1 expected=5 observed=0 free=6134->6139 IPC=YES QUIESCED=YES TABLES=YES ASID=YES ACK=YES REARM=2 LEVEL=NORMAL EXECUTOR=PASS",
          "QEMU smoke PASS: strict ELF W^X 3/3 + S130 OOM executor + runtime regressions",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
      {
        id: "s130-workspace-independent-history-red",
        title: "Tam workspace: S130 dışı frozen S96 identity kırmızısı",
        commandLines: ["cargo test --workspace -- --test-threads=1"],
        outputLines: [
          "rpi5_g8h_integration_source::wiring_does_not_mutate_timer_gic_boot_or_expand_runtime_scope: FAILED",
          "S96 exceptions.S SHA-256: observed f7b47672...04fd, frozen expected c0eed3e2...cb89",
          "full-workspace GREEN is not claimed",
        ],
        exitCode: 101,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S130 gerçek QEMU Ready-task teardown kanıtıdır. QEMU kurbanının IPC grafiği boştur; Blocked yolu kaynak/host kanıtlı, current-task yolu ise S131'e ertelenmiştir. Fiziksel veya device işlemi yapılmadı.",
    limitations: [
      "Current-task OOM teardown henüz deferred context-switch taşıyıcısına bağlı değildir; ilk etkiden önce açıkça reddedilir ve S131 kabulidir.",
      "QEMU victim Ready durumunda ve IPC grafiği boştur. Blocked-task lifecycle/IPC kapanışı kaynak/host doğruludur ancak runtime enjeksiyonu değildir.",
      "Supervisor olayı sabit in-kernel kuyruktadır; gerçek endpoint/syscall consumer ve recovery politikası bağlı değildir.",
      "Yalnız strict RuntimePmm-owned task'larda authoritative frame/domain bağı vardır; legacy producers ve generic SMP coordination açıktır.",
      "K1, MEM0, MEM1 ve MEM2 COMPLETE değildir; full workspace bağımsız frozen S96 identity kırmızısı nedeniyle GREEN değildir.",
      "S124 archive/promotion STOP kalır. Son fiziksel boot/runtime PASS S92 BOOT8G; fiziksel veya device işlemi yapılmadı.",
    ],
  },