G8l: production scheduler-mutation exact-token exclusion lease

/// Acquire the production scheduler-owned primitive on the actual CPU1.
/// This function deliberately returns only the guard; it never exposes or
/// mutates the legacy `static mut SCHEDULER` object.
#[cfg(all(target_arch = "aarch64", target_os = "none"))]
pub fn acquire_production_scheduler_mutation_exclusion(
    runtime: &G8lRuntimeAuthority,
    authority: &G8lSchedulerOwnerAuthority,
    commit: G8lSchedulerOwnerSchedulerMutationDispatchReceiptCommit,
) -> Result<G8lProductionSchedulerMutationExclusionGuard, G8lSchedulerMutationExclusionError> {
    let irq_guard = crate::arch::aarch64::IrqGuard::new();
    let hardware_cpu = crate::percpu::try_current_cpu_id()
        .ok_or(G8lSchedulerMutationExclusionError::InvalidCallerCpu)?;
    if hardware_cpu != CPU1 {
        return Err(G8lSchedulerMutationExclusionError::InvalidCallerCpu);
    }
    let lease = crate::task::scheduler::G8L_SCHEDULER_MUTATION_EXCLUSION.try_acquire(
        runtime,
        authority,
        commit,
        hardware_cpu,
    )?;
    Ok(G8lProductionSchedulerMutationExclusionGuard {
        lease,
        _irq_guard: irq_guard,
    })
}

#[test]
fn eight_host_threads_never_overlap_the_atomic_exclusion() {
    use std::sync::atomic::{AtomicUsize, Ordering};
    use std::sync::{Arc, Barrier};

    const WORKERS: usize = 8;
    const ROUNDS: usize = 32;
    let exclusion = Arc::new(G8lSchedulerMutationExclusion::new());
    let start = Arc::new(Barrier::new(WORKERS));
    let in_critical = Arc::new(AtomicUsize::new(0));
    let entries = Arc::new(AtomicUsize::new(0));
    let mut workers = Vec::new();

    for _ in 0..WORKERS {
        let exclusion = Arc::clone(&exclusion);
        let start = Arc::clone(&start);
        let in_critical = Arc::clone(&in_critical);
        let entries = Arc::clone(&entries);
        workers.push(std::thread::spawn(move || {
            start.wait();
            for _ in 0..ROUNDS {
                loop {
                    let (runtime, authority, commit) = scheduler_mutation_commit();
                    match exclusion.try_acquire(&runtime, &authority, commit, CPU1) {
                        Ok(lease) => {
                            assert_eq!(in_critical.fetch_add(1, Ordering::SeqCst), 0);
                            std::hint::spin_loop();
                            entries.fetch_add(1, Ordering::SeqCst);
                            assert_eq!(in_critical.fetch_sub(1, Ordering::SeqCst), 1);
                            lease.release().unwrap();
                            break;
                        }
                        Err(G8lSchedulerMutationExclusionError::Busy { .. }) => {
                            std::thread::yield_now();
                        }
                        Err(error) => panic!("unexpected S198 acquire error: {error:?}"),
                    }
                }
            }
        }));
    }
    for worker in workers {
        worker.join().unwrap();
    }

    assert_eq!(entries.load(Ordering::SeqCst), WORKERS * ROUNDS);
    assert_eq!(in_critical.load(Ordering::SeqCst), 0);
    assert_eq!(exclusion.active_token(), None);
}

  {
    id: "g8l-s198-scheduler-mutation-exclusion-lease-partial",
    date: "2026-08-24",
    sequence: 198,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: production scheduler-mutation exact-token exclusion lease",
    summary:
      "S198, non-Copy S197 dispatch-receipt commit'ini by-value tüketen allocation-free bir scheduler-mutation exclusion lease'i kurdu. Production-owned AtomicU64 primitive fresh nonzero token ile acquire olur ve yalnız exact token ile bırakılır; 8 host thread × 32 turda 256 kritik giriş sıfır overlap verdi. AArch64 seam IrqGuard ve gerçek MPIDR CPU1 kimliğini primitive'den önce alıyor. Constructor henüz runtime'da çağrılmadı, production scheduler değiştirilmedi ve legacy SCHEDULER erişimleri guard altına taşınmadı.",
    evidence: [
      "g8l_target_dispatch_scheduler_owner_scheduler_mutation_exclusion: 12/12 PASS; exact S197 commit by-value consumption, fresh-token acquire, exact release/drop and fail-closed contention.",
      "8 host thread × 32 tur = 256 kritik-section girişi; overlap=0, final active_token=None.",
      "Odaklı test iki bağımsız koşuda byte-eşit kaldı: 127 B / SHA-256 7c5c027e04834587141f9fff89aea670906490a9f834012d2adbd7279dba720b.",
      "S155–S198 sıra-düzenli birleşik matris iki bağımsız koşuda 44 grup / 396/396 PASS ve 5404 B / SHA-256 4a6213954747a9927eb9c23c278651d2be10a81485e60321054c60f8a10cd023 verdi.",
      "RPi5 AArch64 compile PASS: 493 warning envanterlendi, hata yok; 224106 B / SHA-256 9ee7fdb98379b74ebbc150d22a7776018c5f771fea462e76a707c3a2c91984e3. Zero-warning iddiası yoktur.",
      "RPi5 AArch64 smp compile PASS: 493 warning envanterlendi, hata yok; 224048 B / SHA-256 c330aa9de1aa4e5539d2fcc3a11fe05850558e8dac8529270b023956d61a553e.",
      "Production-owned static primitive task::scheduler yanında tanımlı; AArch64 production seam IrqGuard → try_current_cpu_id/CPU1 → exact-token acquire sırasını koruyor.",
      "Constructor runtime'da invoke edilmedi; mevcut static mut SCHEDULER çağrıları lease ile sarılmadı. Bu nedenle production scheduler mutation, whole-scheduler global exclusion, GIC/hardware veya Generic SMP runtime kanıtı değildir.",
      "Kalıcı kapsam: `docs/M8.1-RPi5-G8l-S198-Scheduler-Mutation-Exclusion-Lease-Proof.md`.",
      "Production core publication ddcedf3a-0b54-4cfd-bdd5-97876f493619 ile yayınlandı; custom domain Operations/Timeline/Yol Haritası local static ile byte-exact doğrulandı: 6417034 B / f1ba5cb868c2710346c85e6fbb4d7c06e73239b20ef4b0f7f05f7423e969f826, 953336 B / 10508c0a4357c753f698785858de1998b2f8c6c25b6dc3736ed55ca5cadd5713 ve 953084 B / bff1fe0471ff9b228881aed76ba079d44c3a4a6c75ef0a3d0cd2b41743c543e1.",
      "Immutable pages.dev direct fetch current host'tan 10 saniyelik connect timeout verdi; bu probe PASS olarak sayılmadı.",
      "S198 fiziksel/device operasyonu yapmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S198=NO.",
      "Görünür fiziksel sıra: Gücü kapat → SD kartı Pi'den çıkar → SD kartı Mac'e tak → Yetkili write/verify/read-back işlemini tamamla → SD kartı Mac'ten güvenli çıkar → SD kartı güçsüz Pi'ye tak → UART capture pre-arm ve exact identity kapısını doğrula → Güç ver. Bu sıra yalnız tarihsel S124'te tamamlandı.",
      "Canlı marker: S198_12_OF_12_G8L_PRODUCTION_SCHEDULER_MUTATION_EXCLUSION_LEASE_SOURCE_EXACT_S197_COMMIT_CONSUMED_BY_VALUE_NONCOPY_NONCLONE_CPU_LOCAL_ATOMIC_U64_FRESH_NONZERO_EXACT_TOKEN_ABA_STALE_RELEASE_FAIL_CLOSED_8_THREADS_256_ENTRIES_ZERO_OVERLAP_PRODUCTION_STATIC_AARCH64_IRQ_GUARD_MPIDR_CPU1_WIRED_NOT_INVOKED_LEGACY_SCHEDULER_ACCESSES_UNCOVERED_PRODUCTION_SCHEDULER_MUTATION_WHOLE_SCHEDULER_GLOBAL_EXCLUSION_GIC_HARDWARE_QEMU_PHYSICAL_CPU2_CPU3_HOTPLUG_SOAK_GENERIC_SMP_OPEN_FULL_PHYSICAL_RUNBOOK_VISIBLE_S358_TO_S408_S383_NO_RUNBOOK_EXECUTED_IN_S198_VERIFIED; deployment-specific route/hash evidence is recorded in the project-status manifest.",
    ],
    commands: [
      "cargo test --quiet --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_exclusion -- --test-threads=1",
      "cargo check --quiet --manifest-path kernel/Cargo.toml --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
    ],
    terminalSessions: [
      {
        id: "s198-g8l-scheduler-mutation-exclusion-lease",
        title: "G8l S198 production scheduler-mutation exclusion lease",
        commandLines: [
          "cargo test --quiet --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_exclusion -- --test-threads=1",
        ],
        outputLines: [
          "running 12 tests",
          "test result: ok; 12 passed; 0 failed",
          "8 host threads × 32 rounds: 256 entries; overlap=0",
          "production static/IrqGuard/MPIDR CPU1: wired; runtime invoke/scheduler mutation: not claimed",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "Terminal özeti atomic exclusion primitive'inin host ve source kabulünü gösterir; QEMU veya fiziksel cihaz çalıştırması değildir.",
    limitations: [
      "S198 production-owned exclusion primitive'ini ve AArch64 acquire seam'ini kabul eder; constructor henüz runtime'da çağrılmadı.",
      "Legacy static mut SCHEDULER erişimleri lease kapsamına alınmadığı için whole-scheduler global exclusion ve production mutation açık kalır.",
      "S198 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S198=NO.",
    ],
  },