S338 · First-ERET production writer guard integration

/// M4.3-yield SPIKE — İlk kullanıcı görevi için sadeleştirilmiş direkt eret yolu.
/// `user_task_entry_trampoline` içinden çağrılır. `return_to_user`'u kullanmıyoruz.
pub unsafe fn first_eret_to_user_direct() -> ! {
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s338_irq_guard = crate::arch::aarch64::IrqGuard::new();
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s338_writer_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s338_first_eret_writer_guard_integration::acquire_s338_production_scheduler_writer_access()
        .unwrap_or_else(|error| {
            panic!(
                "S338 first-ERET scheduler writer guard failed closed: {:?}",
                error
            )
        });
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s338_saved_user_frame: (u64, u64, u64, [u64; 31]);
    let sched = &mut *core::ptr::addr_of_mut!(SCHEDULER);

    if let Some(curr) = &mut sched.current_task {
        if !curr.is_user {
            panic!("[SPIKE] first_eret_to_user_direct: current task is not user");
        }

        #[cfg(not(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5")))]
        crate::arch::aarch64::initial_eret_to_user(
            curr.saved_user_elr,
            curr.saved_user_spsr,
            curr.user_sp,
            &curr.saved_user_gprs,
            curr.saved_user_gprs[30], // lr
        );

        #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
        {
            s338_saved_user_frame = (
                curr.saved_user_elr,
                curr.saved_user_spsr,
                curr.user_sp,
                curr.saved_user_gprs,
            );
        }
    } else {
        panic!("[SPIKE] first_eret_to_user_direct: no current task");
    }

    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    {
        let (saved_user_elr, saved_user_spsr, user_sp, saved_user_gprs) = s338_saved_user_frame;
        drop(s338_writer_access);
        drop(s338_irq_guard);
        crate::arch::aarch64::initial_eret_to_user(
            saved_user_elr,
            saved_user_spsr,
            user_sp,
            &saved_user_gprs,
            saved_user_gprs[30], // lr
        );
    }
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn acquire_s338_production_scheduler_writer_access(
) -> Result<G8lS338ProductionSchedulerWriterAccess, G8lS247WholeSchedulerAccessError> {
    let caller_cpu =
        crate::percpu::try_current_cpu_id().ok_or(G8lS247WholeSchedulerAccessError::InvalidCpu)?;
    if caller_cpu != crate::g8l_runtime_contract::CPU0 {
        return Err(G8lS247WholeSchedulerAccessError::InvalidCpu);
    }
    let access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s246_whole_scheduler_read_access_guard::S247_PRODUCTION_WHOLE_SCHEDULER_ACCESS_GATE
        .try_acquire_exclusive_for_valid_cpu(caller_cpu)?;
    Ok(G8lS338ProductionSchedulerWriterAccess { _access: access })
}

#[test]
fn target_function_contains_one_scheduler_alias_and_one_s338_guard() {
    let target = first_eret_boundary();
    assert_eq!(target.matches("addr_of_mut!(SCHEDULER)").count(), 1);
    assert_eq!(
        target
            .matches("acquire_s338_production_scheduler_writer_access()")
            .count(),
        1
    );
    assert_eq!(
        target
            .matches("if let Some(curr) = &mut sched.current_task")
            .count(),
        1
    );
}

  {
    id: "g8l-s338-first-eret-writer-guard-integration-partial",
    date: "2026-08-27",
    sequence: 338,
    status: "passed",
    umbrella_status: "partial",
    title: "S338 · First-ERET production writer guard integration",
    summary:
      "S338, first_eret_to_user_direct içindeki tek mutable SCHEDULER yolunu IRQ-masked CPU0 sınırında S337 ve 44 production reader'ın kullandığı aynı S247 state word'e bağlar. Current user task'ın ELR/SPSR/SP ve 31 GPR değeri writer lease altında owned frame'e kopyalanır; writer lease bırakılır, ardından IRQ guard bırakılır ve ancak sonra diverging initial_eret_to_user/eret yolu başlar. Guarded writer 11/69, açık writer 58 ve provider authority 0'dır. user_task_entry_trampoline tek direct production callsite'tır fakat supported-profile runtime gözlemi yapılmamıştır; downstream user_first_kernel_entry writer'ı S339 için açıktır.",
    evidence: [
      "Focused first-ERET writer-integration kapısı 27/27 PASS verdi; tarihsel S300 15/15 ve bir önceki S337 24/24 regresyonları ayrıca geçti.",
      "Aynı S247 state word üzerinde CPU0-only writer membership, non-CPU0 pre-commit rejection, reader→writer ve writer→reader exclusion, exact-once commit/error release ve S337→S338 token monotonluğu doğrulandı.",
      "Production kaynak sırası IRQ guard → acquire_s338 writer → tek mutable alias/current-task user doğrulaması → ELR/SPSR/SP/[u64;31] owned snapshot → writer drop → IRQ restore → initial_eret_to_user olarak kilitlendi.",
      "Writer lease veya IRQ guard eret sınırını geçmez. Non-user ve missing-current-task fail-closed panic metinleri ile RPi5 dışı tarihsel S300 direct-forwarding şekli korunur.",
      "arch/aarch64/mod.rs::user_task_entry_trampoline hedef fonksiyonu exact bir kez çağırır. Bu source-wired direct callsite kanıtıdır; QEMU/RPi supported-profile invocation veya cihaz gözlemi değildir.",
      "QEMU, RPi4, RPi5 ve RPi5+SMP AArch64 compile profilleri fresh ve izole target dizinlerinde 4/4 exit 0 verdi; zero-warning iddiası yoktur.",
      "S238–S338 dependency matrisi iki bağımsız seri koşuda 102 grup / 1545/1545 PASS verdi.",
      "Exact yedi tarihsel G8h assertion adı dışlanıp --test-threads=1 kabulü kullanıldığında tam workspace 300 sonuç grubu / 3371 PASS / 0 fail / 7 filtered verdi. Filtresiz koşu yalnız frozen S96 source-identity reddinde exit 101 verdi; global workspace GREEN iddia edilmez.",
      "make verify-qemu ortak regresyonu strict ELF W^X 31/31, S130–S154, IPC 20/20, scheduler SEC5 ve kernel fault 0 ile PASS verdi. Bu S338 runtime invocation kanıtı değildir.",
      "Website 524/524 test ile PASS; lint, boş çıktılı TypeScript kontrolü ve 23/23 static route ayrıca geçti. Cloudflare Pages production/main ilk S338 içerik yayını c5d5b0b7 ile tamamlandı; cache-busted custom-domain /operations/ ve /timeline/ HTTP 200 döndü ve yerel out ile byte-exact eşleşti.",
      "Timeline 177 bağımsız gate-policy kartı taşır; S338, S337, S325, S324 ve S323 kartları ayrı ayrı tam birer kez bulunur. S325–S338 kartları en az 1055 karakterdir ve birleşik gate-policy kutusu yoktur.",
      "S245 request ve S244 admission dokunulmadan kalır; production provider authority=0, whole-scheduler exclusion=false ve toplam 58 production writer açık kalır.",
      "Fiziksel/device işlem yapılmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S338=NO.",
    ],
    commands: [
      "cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s338_first_eret_writer_guard_integration -- --nocapture",
      "cargo check -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo check -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
      "cargo test --workspace --quiet -- --test-threads=1 [seven exact historical --skip filters]",
      "make verify-qemu",
    ],
    terminalSessions: [
      {
        id: "g8l-s338-first-eret-writer-guard-integration",
        title: "G8l S338 first-ERET writer guard integration",
        commandLines: [
          "cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s338_first_eret_writer_guard_integration -- --nocapture",
        ],
        outputLines: [
          "test result: ok; S338 focused 1 group / 27 passed; 0 failed",
          "shared S247 gate: 44 guarded readers + 11/69 guarded writers; 58 writers open",
          "writer drop < IRQ restore < initial_eret_to_user; membership does not cross eret",
          "direct production callsite=1; supported-profile runtime observations=0",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8l-s338-operations-timeline-production-publication",
        title: "S338 Operations/Timeline production publication",
        commandLines: [
          "npm run deploy",
          "curl --cache-busted https://aselsan.kerege.net/{operations,timeline}/ and compare with local out",
        ],
        outputLines: [
          "Cloudflare Pages production/main initial content deployment: c5d5b0b7",
          "custom domain: operations HTTP 200 / timeline HTTP 200; both byte-exact with local out",
          "timeline gate-policy cards=177; S338=1; S337=1; S325=1; S324=1; S323=1; combined gate-policy box absent",
          "S324 policy chars=1573; S325-S338 minimum policy chars=1055",
          "direct immutable pages.dev fetch: curl exit 28 / HTTP 000 timeout; direct-host equality not claimed",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
    ],
    terminalSessionsNote:
      "S338 on birinci production writer'ın kaynak entegrasyonudur. Direct callsite source-wired olsa da supported-profile runtime veya cihaz gözlemi yapılmadı; global exclusion ya da provider authority oluşmadı.",
    limitations: [
      "58 production writer aynı shared gate dışında kaldığı için whole-scheduler exclusion ve provider authority açık kalır.",
      "user_task_entry_trampoline direct callsite'tır; supported-profile runtime invocation/observation kanıtı yoktur.",
      "Downstream user_first_kernel_entry writer entegrasyonu S339 için açık bırakılmıştır.",
      "Default-parallel PTY determinism S331'den açık taşınır; kayıtlı seri kabul matrisi kullanılır.",
      "Transient-contention liveness/soak, Generic SMP ve fiziksel RPi kabulü açık kalır.",
    ],
  },