S343 · Runtime-OOM teardown production writer guard integration

/// Execute one S129 ticket against the exact non-current scheduler task bound
/// to its RuntimeMemory domain. The ticket and scheduler binding are both
/// audited before IPC teardown performs the first mutation.
///
/// Current-task termination still requires a deferred context-switch carrier;
/// this narrow executor handles Ready/Blocked tasks whose kernel stacks are
/// provably inactive.
pub unsafe fn execute_runtime_oom_teardown(
    coordinator: &mut crate::mm::RuntimeOomCoordinator,
    ticket: &mut crate::mm::RuntimeOomTeardownTicket,
) -> Result<RuntimeOomTaskExecution, RuntimeOomTaskExecutionError> {
    let _irq_guard = crate::arch::aarch64::IrqGuard::new();
    let ticket_preflight = crate::mm::with_boot_runtime_memory(|memory| {
        coordinator.preflight_teardown(ticket, memory)
    })
    .map_err(|_| RuntimeOomTaskExecutionError::BootMemoryAuthority)?
    .map_err(RuntimeOomTaskExecutionError::CoordinatorPreflight)?;

    #[cfg(feature = "board-rpi5")]
    let s259_binding_scheduler_read_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s258_runtime_oom_arm_read_access_guard_expansion::acquire_s259_production_scheduler_read_access()
        .unwrap_or_else(|error| {
            panic!(
                "S259 non-current runtime OOM binding scheduler read access failed closed: {:?}",
                error
            )
        });
    let binding_result =
        (&*core::ptr::addr_of!(SCHEDULER)).preflight_runtime_oom_task(ticket_preflight);
    #[cfg(feature = "board-rpi5")]
    drop(s259_binding_scheduler_read_access);
    let binding = binding_result?;
    let ipc_teardown = RuntimeOomIpcTeardown::from_lifecycle(
        crate::ui::capability::teardown_task_ipc_lifecycle(binding.task_id)
            .map_err(|_| RuntimeOomTaskExecutionError::IpcLifecycle)?,
    );

    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s343_writer_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s343_runtime_oom_teardown_writer_guard_integration::acquire_s343_production_scheduler_writer_access()
        .unwrap_or_else(|error| {
            panic!(
                "S343 runtime-OOM teardown scheduler writer guard failed closed: {:?}",
                error
            )
        });
    let sched = &mut *core::ptr::addr_of_mut!(SCHEDULER);
    let detached_task = sched.take_runtime_oom_task(binding);
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s343_writer_access);
    let mut task = detached_task.ok_or(RuntimeOomTaskExecutionError::SchedulerCommitMismatch)?;
    if task.id != binding.task_id
        || task.runtime_allocation_domain() != Some(binding.domain)
        || task.asid != binding.asid
        || task
            .runtime_user_frames
            .as_ref()
            .map_or(0, |ledger| ledger.frame_count())
            != binding.frame_count
    {
        core::mem::forget(task);
        return Err(RuntimeOomTaskExecutionError::SchedulerCommitMismatch);
    }

    task.finished.store(true, Ordering::Release);
    task.state = TaskState::Dead;
    task.user_sp = 0;
    task.saved_user_elr = 0;
    task.saved_user_spsr = 0;
    task.saved_user_gprs = [0; 31];
    crate::arch::aarch64::mmu::invalidate_asid(task.asid);
    task.address_space_quiesced = true;

    let witness = reap_detached_runtime_oom_task(task, binding.domain, true);
    let lifecycle_complete = witness.ipc_lifecycle_closed
        && witness.address_space_quiesced
        && witness.page_tables_released
        && witness.asid_released;
    let event_id = crate::mm::with_boot_runtime_memory(|memory| {
        coordinator.complete_teardown(ticket, memory, witness)
    })
    .map_err(|_| RuntimeOomTaskExecutionError::BootMemoryAuthority)?
    .map_err(RuntimeOomTaskExecutionError::CoordinatorCompletion)?;

    Ok(RuntimeOomTaskExecution {
        event_id,
        task_id: binding.task_id,
        domain: binding.domain,
        lifecycle_complete,
        ipc_teardown,
    })
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn acquire_s343_production_scheduler_writer_access(
) -> Result<G8lS343ProductionSchedulerWriterAccess, G8lS247WholeSchedulerAccessError> {
    let caller_cpu =
        crate::percpu::try_current_cpu_id().ok_or(G8lS247WholeSchedulerAccessError::InvalidCpu)?;
    if caller_cpu != crate::g8l_runtime_contract::CPU0 {
        return Err(G8lS247WholeSchedulerAccessError::InvalidCpu);
    }
    let access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s246_whole_scheduler_read_access_guard::S247_PRODUCTION_WHOLE_SCHEDULER_ACCESS_GATE
        .try_acquire_exclusive_for_valid_cpu(caller_cpu)?;
    Ok(G8lS343ProductionSchedulerWriterAccess { _access: access })
}

#[test]
fn target_function_contains_one_mutable_alias_and_one_s343_guard() {
    let target = runtime_oom_teardown_boundary();
    assert_eq!(target.matches("addr_of_mut!(SCHEDULER)").count(), 1);
    assert_eq!(
        target
            .matches("acquire_s343_production_scheduler_writer_access()")
            .count(),
        1
    );
    assert_eq!(target.matches("take_runtime_oom_task(binding)").count(), 1);
}

  {
    id: "g8l-s343-runtime-oom-teardown-writer-guard-integration-partial",
    date: "2026-08-28",
    sequence: 343,
    status: "passed",
    umbrella_status: "partial",
    title: "S343 · Runtime-OOM teardown production writer guard integration",
    summary:
      "S343, execute_runtime_oom_teardown içindeki tek mutable SCHEDULER task-detach sınırını S342 ve 44 production reader'ın kullandığı aynı statik S247 state word'e bağlar. Mevcut IRQ guard altında ticket preflight tamamlanır; tarihsel S259 reader audited non-current RuntimeOomTaskBinding sonucunu owned Copy değer olarak çıkarıp IPC teardown'dan önce düşer. IPC lifecycle kapandıktan sonra CPU0-only S343 writer alınır ve yalnız take_runtime_oom_task(binding) detach commit'ini kapsar. Writer hemen bırakılır; detached binding revalidation, task death/context sıfırlama, ASID TLBI/quiescence, frame/page-table/ASID reap ve coordinator completion writer dışında kalır. Guarded writer 16/69, açık writer 53 ve provider authority 0'dır. Production kaynakta bir direct callsite vardır fakat supported-profile S343 runtime observation=0'dır; service_deferred_current_runtime_oom içindeki ayrı mutable writer S344 için açık kalır.",
    evidence: [
      "Focused runtime-OOM teardown writer-integration kapısı 30/30 PASS verdi. Önceki S342 31/31, tarihsel S260 notification-grant reader 12/12, Runtime-OOM scheduler executor 5/5, effect transaction 5/5, current deferred 5/5, lifecycle recovery 7/7 ve live IPC teardown 5/5 regresyonları ayrıca geçti.",
      "Aynı S247 state word üzerinde CPU0-only writer membership, non-CPU0 pre-commit rejection, reader→writer ve writer→reader exclusion, exact-once success/error release ve S342→S343 token monotonluğu doğrulandı.",
      "Production kaynak sırası mevcut IRQ guard → ticket preflight → S259 reader acquire → audited binding owned Copy → reader drop → IPC lifecycle teardown → acquire_s343 writer → tek mutable alias → take_runtime_oom_task(binding) → writer drop olarak kilitlendi.",
      "S343 lease yalnız Scheduler içinden exact task detach işlemini kapsar. SchedulerCommitMismatch kontrolü, detached task kimlik/domain/ASID/frame-count revalidation, finished Release/Dead publication, user context zeroing, invalidate_asid, address_space_quiesced, detached reap ve coordinator.complete_teardown writer bırakıldıktan sonra yürür.",
      "Tarihsel finished → Dead → context zeroing → ASID TLBI → quiesced sırası korunur. Detached task artık Scheduler koleksiyonunda olmadığı için bu etkiler shared Scheduler writer lease'ini gereksiz yere uzun tutmaz ve nested reader/writer üyeliği üretmez.",
      "kernel/src/main.rs içinde bir production execute_runtime_oom_teardown çağrı noktası kaynakta sayıldı. Bu source-wiring envanteridir; RPi5 supported-profile invocation, runtime telemetry veya cihaz gözlemi değildir.",
      "Fresh izole AArch64 profilleri 4/4 exit 0 verdi: board-qemu 112295 B / 5ac45e3c…9547 / 293 warning header; board-rpi4 151012 B / d9dbee7b…3bef / 391; board-rpi5 534988 B / e3219e6a…483b / 1188; board-rpi5+smp check 534929 B / 94c2da65…a500 / 1188. Zero-warning iddiası yoktur.",
      "S238–S343 dependency matrisi iki bağımsız seri koşuda 107 ayrı grup / 1697/1697 PASS verdi. İki ham çıktı da 14000 B ve 1ad2301f…59c5 SHA-256 ile byte-eşittir; 14107 B süre-normalize kanonik çıktılar d07aa1fc…43d1 ile byte-eşittir.",
      "Exact yedi tarihsel assertion adı dışlanıp --test-threads=1 kabulü kullanıldığında workspace 305 sonuç grubu / 3528 PASS / 0 fail / 7 filtered verdi; 67341 B log fbd450b3…f758'dir.",
      "Filtresiz workspace exit 101 ile yalnız frozen S96 wiring_does_not_mutate_timer_gic_boot_or_expand_runtime_scope source-identity reddinde durdu; 258 sonuç grubunda 3273 PASS / 1 fail, 62563 B log 0278eff0…8b7c'dir ve global workspace GREEN iddia edilmez.",
      "make verify-qemu ortak regresyonu 116447 B / a5bd3069…beb0 ile strict ELF W^X 31/31, S130–S154, IPC 20/20, scheduler SEC5 ve kernel fault marker 0 PASS verdi. RPi5-only S343 writer bu QEMU koşusunda runtime-observed değildir.",
      "S245 request yalnız non-consuming incelenir; S244 admission dokunulmadan kalır. Production provider authority=0, whole-scheduler exclusion=false ve toplam 53 production writer açık kalır.",
      "Website 534/534 test ile PASS; lint yalnız Roadmap 500 KB Babel optimizasyon notunu verdi, boş çıktılı TypeScript kontrolü ve 23/23 static page üretimi ayrıca geçti. İlk Cloudflare Pages production/main S343 içerik yayını c0c39de7 ile tamamlandı; çıktı 193 statik dosyadır.",
      "Cache-busted custom-domain /operations/ ve /timeline/ rotaları HTTP 200 döndü ve dağıtım sonrası yerel out ile byte-exact eşleşti. Operations 10570535 B / 151692d5…011a, Timeline 2754293 B / d377b1c1…081f'dir.",
      "Timeline'da 182 ayrı data-gate-policy kartı vardır; S343, S342, S341, S340, S339, S338, S337, S325, S324 ve S323 tam birer kez bulunur. S343 policy 5640 karakter, S324–S343 minimum yoğunluğu 1055 karakterdir ve birleşik gate-policy kutusu yoktur.",
      "Immutable https://c0c39de7.aselsan-microkernel.pages.dev/timeline/ erişimi bu doğrulama ortamından 10 saniyede curl exit 28 / HTTP 000 verdi; custom-domain byte-exact PASS'i bu sonucu gizlemez.",
      "S343 için güç, SD kart, Mac kart erişimi, UART capture, raw validation, archive veya promotion işlemi yapılmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S343=NO.",
    ],
    commands: [
      "cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s343_runtime_oom_teardown_writer_guard_integration -- --nocapture",
      "cargo build -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo check -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
      "cargo test --workspace --quiet -- --test-threads=1 [seven exact historical --skip filters]",
      "make verify-qemu",
      "npm run deploy",
    ],
    terminalSessions: [
      {
        id: "g8l-s343-runtime-oom-teardown-writer-guard-integration",
        title: "G8l S343 runtime-OOM teardown writer guard integration",
        commandLines: [
          "cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s343_runtime_oom_teardown_writer_guard_integration -- --nocapture",
        ],
        outputLines: [
          "test result: ok; S343 focused 1 group / 30 passed; 0 failed",
          "shared S247 gate: 44 guarded readers + 16/69 guarded writers; 53 writers open",
          "IRQ < ticket < S259 Copy/drop < IPC teardown < S343 writer < exact detach < writer drop < detached validation/death/TLBI/reap/completion",
          "production source callsites=1; supported-profile runtime observations=0",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8l-s343-operations-timeline-production-publication",
        title: "S343 Operations/Timeline production publication",
        commandLines: [
          "npm run deploy",
          "curl --cache-busted https://aselsan.kerege.net/{operations,timeline}/ and compare with local out",
        ],
        outputLines: [
          "website 534/534; lint PASS with Babel size note; TypeScript PASS; static routes 23/23; files=193",
          "Cloudflare Pages production/main initial content deployment: c0c39de7 · https://c0c39de7.aselsan-microkernel.pages.dev",
          "custom-domain operations HTTP 200 · 10570535 B · SHA-256 151692d5403e6a788652db881cdef67d7b0b81d7954d910a2eb74acfd676011a · byte-exact PASS",
          "custom-domain timeline HTTP 200 · 2754293 B · SHA-256 d377b1c1fc245ca26c4be88315b7dbed98174a42dc48b6c60a5e71f335cd081f · byte-exact PASS",
          "timeline cards=182; S343/S342/S341/S340/S339/S338/S337/S325/S324/S323 exact-once; S343 policy=5640 chars; S324-S343 minimum=1055 chars",
          "immutable deployment URL probe: curl exit 28 after 10 s · HTTP 000; custom-domain evidence remains authoritative",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
    ],
    terminalSessionsNote:
      "S343 on altıncı production writer'ın kaynak entegrasyonudur. Bir source callsite vardır, fakat supported-profile runtime/cihaz gözlemi yoktur; global exclusion ya da provider authority oluşmadı.",
    limitations: [
      "53 production writer aynı shared gate dışında kaldığı için whole-scheduler exclusion ve provider authority açık kalır.",
      "Bir production source callsite wiring kanıtıdır; supported-profile S343 invocation/observation kanıtı yoktur.",
      "Downstream service_deferred_current_runtime_oom writer entegrasyonu S344 için açık bırakılmıştır.",
      "Default-parallel PTY determinism S331'den açık taşınır; kayıtlı seri kabul matrisi kullanılır.",
      "Transient-contention liveness/soak, Generic SMP ve fiziksel RPi kabulü açık kalır.",
    ],
  },