G8l: S243 whole-scheduler exclusion fail-closed admission

/// Production CPU0 timer service. S244 has no authority to manufacture the
/// missing whole-scheduler proof, so the only valid current outcome is
/// `AwaitingExclusion`. Even an impossible occupied slot is rejected rather
/// than used to enter S243/S236.
#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn service_s244_whole_scheduler_exclusion_admission_on_cpu0(
) -> Result<G8lS244ExclusionGatedConsumerOutcome, G8lS244ProductionExclusionAdmissionError> {
    use crate::g8l_runtime_contract::CPU0;

    if crate::percpu::try_current_cpu_id() != Some(CPU0) {
        return Err(G8lS244ProductionExclusionAdmissionError::WrongCpu);
    }
    if S244_PRODUCTION_ADMISSION.lock().pending() {
        return Err(
            G8lS244ProductionExclusionAdmissionError::UnexpectedAdmissionWithoutConstructor,
        );
    }
    Ok(G8lS244ExclusionGatedConsumerOutcome::AwaitingExclusion)
}

#[test]
fn s244_output_backpressure_restores_admission_and_inputs() {
    let mut admission = G8lS244WholeSchedulerExclusionAdmissionSlot::new();
    admission.publish(31u64).unwrap();
    let mut s242 = returned_authorities();
    let mut s240 = delivered_receipt();
    let mut output = G8lS243DeferredS187HandoffSlot::new();
    output.publish(37u64).unwrap();
    let result = service_s244_exclusion_gated_deferred_join(
        &mut admission,
        &mut s242,
        &mut s240,
        &mut output,
        S244_SOURCE_CPU0,
        |_, _, _, _| -> Result<u64, ()> { panic!("backpressure must not consume") },
    );
    assert!(matches!(
        result,
        Ok(G8lS244ExclusionGatedConsumerOutcome::Backpressured)
    ));
    assert!(admission.pending());
    assert!(s242.returned_pending());
    assert!(s240.receipt_pending());
    assert_eq!(output.take(1).unwrap(), Some(37));
}

  {
    id: "g8l-s244-production-s243-whole-scheduler-exclusion-admission-partial",
    date: "2026-08-25",
    sequence: 244,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: S243 whole-scheduler exclusion fail-closed admission",
    summary:
      "S244 13/13 PASS ile production CPU0 timer-IRQ yolunu gerçek whole-scheduler exclusion admission olmadan S243/S236'ya giremeyecek biçimde fail-closed yaptı. Admission yoksa AwaitingExclusion döner ve hazır S242 runtime/owner authorities ile S240 post-EOI receipt'e dokunmaz. Host modelinde exact admission Idle/output-backpressure boyunca korunur ve yalnız iki input hazırken tuple ile by-value tüketilir. Production admission tipi sealed/non-Copy'dir; constructor veya publisher yoktur. Bu nedenle exclusion kurulmuş, güvenli runtime execution yapılmış ya da scheduler mutation gözlenmiş sayılmaz.",
    evidence: [
      "S244 focused host grubu final kaynak üzerinde iki bağımsız koşuda 13/13 PASS verdi: canonical test-result 95 B / SHA-256 77a722e477a8a66ab195b19a56513dde8937dd0e52e5ddc9a05806a2b9f8c4d7.",
      "S238 + S239 + S240 receipt/SGI + S241 + S242 + S243 + S244 dependency matrisi 8 grup / 141/141 PASS verdi; canonical summary 760 B / SHA-256 7030cf0b657e1ca84094ae8f936d83300b17ea3647e3de6a602c29f6e78deb33 ve iki bağımsız koşuda byte-equal.",
      "İlk AArch64 preflight, sealed placeholder'ın yapay !Send işareti nedeniyle static cross-CPU spin::Mutex'te E0277 verdi ve PASS sayılmadı. Private sealed/non-Copy/no-constructor/no-publisher sözleşmesi korunup yapay !Send engeli kaldırıldıktan sonra normal/SMP profilleri ikişer kez byte-equal PASS verdi.",
      "Final RPi5 AArch64 normal: 347174 B / 673 warning başlığı / SHA-256 1fc33a35c955b00e632c6ae486e9537be869f180215b4f4f09cf9e548d9acdcf. SMP: 347116 B / 673 warning başlığı / SHA-256 9e8a3ab3527a4b9bf9a4876f8181d965572efa1676d773f27d89eb7aef8ec7c4. Zero-warning iddiası yoktur.",
      "Exact production sırası: CPU0 timer IRQ → GIC EOI → S244 admission probe → admission yoksa AwaitingExclusion. exceptions.rs içindeki doğrudan S243 production çağrısı kaldırıldı; mevcut kaynakta S243/S236 admission olmadan ulaşılamaz.",
      "Yedi tarihsel G8h assertion'ı isim isim değiştirilmeden dışlayan final workspace audit'i 206 grup / 1875 PASS / 0 fail / 7 filtered verdi: log 54296 B / SHA-256 0002b8bcb14bb759fcdee0cda316e6395ea0e8ffa385bdf8c0376a2480aeee3a. Filtresiz koşu aynı frozen S96 identity kapısında exit 101 verdi; full-workspace GREEN iddia edilmez.",
      "S244 physical/device operations=0; RUNBOOK_EXECUTED_IN_S244=NO. Tarihsel S124 physical BOOT8H PASS ve tam operatör sırası görünür biçimde korunur.",
      "Canlı marker: S244_13_OF_13_WHOLE_SCHEDULER_EXCLUSION_FAIL_CLOSED_ADMISSION_CPU0_TIMER_IRQ_AFTER_EOI_BEFORE_SCHEDULER_MISSING_ADMISSION_AWAITING_EXCLUSION_S242_AUTHORITIES_S240_RECEIPT_UNTOUCHED_WRONG_CPU_NONDESTRUCTIVE_IDLE_OUTPUT_BACKPRESSURE_RESTORE_EXACT_ADMISSION_BOTH_READY_CONSUMES_ADMISSION_BY_VALUE_CONSUMER_ERROR_TERMINAL_PRODUCTION_ADMISSION_SEALED_NONCOPY_NO_CONSTRUCTOR_NO_PUBLISHER_DIRECT_S243_TIMER_CALL_REMOVED_S243_S236_UNREACHABLE_WITHOUT_ADMISSION_NO_UPSTREAM_REQUEST_REQUEST_NOT_OBSERVED_NO_GLOBAL_SCHEDULER_EXCLUSION_PROOF_NO_SAFE_RUNTIME_EXECUTION_CLAIM_NO_S187_PRODUCTION_HANDOFF_NO_HARDWARE_WAKE_AARCH64_NORMAL_SMP_COMPILED_WORKSPACE_1875_PASS_7_HISTORICAL_G8H_ASSERTIONS_RED_PHYSICAL_QEMU_CPU2_CPU3_HOTPLUG_SOAK_GENERIC_SMP_OPEN_FULL_PHYSICAL_RUNBOOK_VISIBLE_S404_TO_S454_S429_NO_RUNBOOK_EXECUTED_IN_S244_VERIFIED.",
    ],
    commands: [
      "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s243_whole_scheduler_exclusion_admission -- --test-threads=1",
      "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s179_execution_caller_notification_delivery_request --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s179_execution_caller_notification_delivery_descriptor --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s179_execution_caller_notification_delivery_dispatch_receipt --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s179_execution_caller_notification_sgi_delivery --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s179_execution_caller_notification_sgi_sender_runtime_callsite --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s179_execution_caller_notification_sgi_sender_runtime_callsite_request --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s242_authority_return_s240_receipt_deferred_consumer --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s243_whole_scheduler_exclusion_admission -- --test-threads=1",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo check --quiet -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
    ],
    terminalSessions: [
      {
        id: "s244-g8l-s243-whole-scheduler-exclusion-admission",
        title: "G8l S244 S243 whole-scheduler exclusion admission",
        commandLines: [
          "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s243_whole_scheduler_exclusion_admission -- --test-threads=1",
        ],
        outputLines: [
          "test result: ok; S244 focused 1 group / 13 passed; 0 failed",
          "missing production admission → AwaitingExclusion; S242 authorities + S240 receipt untouched",
          "direct S243 timer call removed; S243/S236 unreachable without a later real exclusion proof",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S244 terminal özeti fail-closed admission davranışını doğrular; whole-scheduler exclusion'ın kurulduğu, S187 production handoff, scheduler mutation, ERET veya hardware execution kanıtı değildir.",
    limitations: [
      "S244 gerçek whole-scheduler exclusion provider kurmaz; eksik proof varken S243/S236 production girişini kapatır.",
      "Production admission constructor ve publisher yoktur; güncel timer yolunun tek meşru sonucu AwaitingExclusion'dır.",
      "Upstream S242 request producer yoktur; request, CPU0 wake, S187 production handoff veya scheduler mutation gözlenmedi.",
      "TTBR0-root/authority-lifetime proof, gerçek cross-CPU exclusion provider, CPU1 S224/S223 continuation, ERET/context-switch ve present tuple açık kalır.",
      "QEMU RPi5 GICv2 SGI MMIO ve whole-scheduler exclusion yolunu doğrulamaz; fiziksel RPi, CPU2/CPU3, hotplug, soak ve Generic SMP açıktır.",
      "S244 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S244=NO.",
    ],
  },