S346 · Current-runtime-OOM IPC-lifecycle error restore production writer guard integration

/// If the armed S131 target is current, re-audit both authority boundaries,
/// close IPC, publish Dead, move the carrier back into static scheduler
/// storage, quiesce the address space and switch away. The active task and its
/// stack are deliberately never detached or reaped in this function.
pub unsafe fn execute_armed_current_runtime_oom_if_target(
) -> Result<(), RuntimeOomTaskExecutionError> {
    #[cfg(feature = "board-rpi5")]
    let s258_identity_scheduler_read_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s257_runtime_oom_preflight_read_access_guard_expansion::acquire_s258_production_scheduler_read_access()
        .unwrap_or_else(|error| {
            panic!(
                "S258 current OOM identity scheduler read access failed closed: {:?}",
                error
            )
        });
    let (armed_target, current_task_id) = {
        let sched = &*core::ptr::addr_of!(SCHEDULER);
        (
            sched
                .deferred_current_runtime_oom
                .as_ref()
                .map(|carrier| carrier.binding.task_id),
            sched.current_task.as_ref().map(|task| task.id),
        )
    };
    #[cfg(feature = "board-rpi5")]
    drop(s258_identity_scheduler_read_access);
    let Some(armed_target) = armed_target else {
        return Ok(());
    };
    if current_task_id != Some(armed_target) {
        return Ok(());
    }

    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s351_irq_guard = crate::arch::aarch64::IrqGuard::new();
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s351_writer_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s351_current_runtime_oom_carrier_take_writer_guard_integration::acquire_s351_production_scheduler_writer_access()
        .unwrap_or_else(|error| {
            panic!(
                "S351 current-runtime-OOM carrier-take writer guard failed closed: {:?}",
                error
            )
        });
    let carrier_result = (&mut *core::ptr::addr_of_mut!(SCHEDULER))
        .deferred_current_runtime_oom
        .take();
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s351_writer_access);
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s351_irq_guard);
    let mut carrier = carrier_result.ok_or(RuntimeOomTaskExecutionError::DeferredTargetMismatch)?;
    let ticket_preflight = match crate::mm::with_boot_runtime_memory(|memory| {
        carrier
            .coordinator
            .preflight_teardown(&carrier.ticket, memory)
    }) {
        Ok(Ok(preflight)) => preflight,
        Ok(Err(error)) => {
            #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
            let s350_irq_guard = crate::arch::aarch64::IrqGuard::new();
            #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
            let s350_writer_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s350_current_runtime_oom_coordinator_preflight_error_restore_writer_guard_integration::acquire_s350_production_scheduler_writer_access()
                .unwrap_or_else(|access_error| {
                    panic!(
                        "S350 current-runtime-OOM coordinator-preflight error carrier restore writer guard failed closed: {:?}",
                        access_error
                    )
                });
            (&mut *core::ptr::addr_of_mut!(SCHEDULER)).deferred_current_runtime_oom = Some(carrier);
            #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
            drop(s350_writer_access);
            #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
            drop(s350_irq_guard);
            return Err(RuntimeOomTaskExecutionError::CoordinatorPreflight(error));
        }
        Err(_) => {
            #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
            let s349_irq_guard = crate::arch::aarch64::IrqGuard::new();
            #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
            let s349_writer_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s349_current_runtime_oom_boot_memory_error_restore_writer_guard_integration::acquire_s349_production_scheduler_writer_access()
                .unwrap_or_else(|error| {
                    panic!(
                        "S349 current-runtime-OOM boot-memory error carrier restore writer guard failed closed: {:?}",
                        error
                    )
                });
            (&mut *core::ptr::addr_of_mut!(SCHEDULER)).deferred_current_runtime_oom = Some(carrier);
            #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
            drop(s349_writer_access);
            #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
            drop(s349_irq_guard);
            return Err(RuntimeOomTaskExecutionError::BootMemoryAuthority);
        }
    };
    #[cfg(feature = "board-rpi5")]
    let s258_binding_scheduler_read_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s257_runtime_oom_preflight_read_access_guard_expansion::acquire_s258_production_scheduler_read_access()
        .unwrap_or_else(|error| {
            panic!(
                "S258 current OOM binding scheduler read access failed closed: {:?}",
                error
            )
        });
    let binding_result =
        (&*core::ptr::addr_of!(SCHEDULER)).audit_runtime_oom_task_binding(ticket_preflight);
    #[cfg(feature = "board-rpi5")]
    drop(s258_binding_scheduler_read_access);
    let binding = match binding_result {
        Ok(binding) => binding,
        Err(error) => {
            #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
            let s348_irq_guard = crate::arch::aarch64::IrqGuard::new();
            #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
            let s348_writer_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s348_current_runtime_oom_binding_audit_error_restore_writer_guard_integration::acquire_s348_production_scheduler_writer_access()
                .unwrap_or_else(|access_error| {
                    panic!(
                        "S348 current-runtime-OOM binding-audit error carrier restore writer guard failed closed: {:?}",
                        access_error
                    )
                });
            (&mut *core::ptr::addr_of_mut!(SCHEDULER)).deferred_current_runtime_oom = Some(carrier);
            #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
            drop(s348_writer_access);
            #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
            drop(s348_irq_guard);
            return Err(error);
        }
    };
    if binding.location != RuntimeOomTaskLocation::Current
        || binding.task_id != carrier.binding.task_id
        || binding.domain != carrier.binding.domain
        || binding.asid != carrier.binding.asid
        || binding.frame_count != carrier.binding.frame_count
    {
        #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
        let s347_irq_guard = crate::arch::aarch64::IrqGuard::new();
        #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
        let s347_writer_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s347_current_runtime_oom_binding_mismatch_restore_writer_guard_integration::acquire_s347_production_scheduler_writer_access()
            .unwrap_or_else(|error| {
                panic!(
                    "S347 current-runtime-OOM binding-mismatch carrier restore writer guard failed closed: {:?}",
                    error
                )
            });
        (&mut *core::ptr::addr_of_mut!(SCHEDULER)).deferred_current_runtime_oom = Some(carrier);
        #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
        drop(s347_writer_access);
        #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
        drop(s347_irq_guard);
        return Err(RuntimeOomTaskExecutionError::DeferredTargetMismatch);
    }

    let ipc_teardown = match crate::ui::capability::teardown_task_ipc_lifecycle(binding.task_id) {
        Ok(lifecycle) => RuntimeOomIpcTeardown::from_lifecycle(lifecycle),
        Err(_) => {
            #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
            let s346_irq_guard = crate::arch::aarch64::IrqGuard::new();
            #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
            let s346_writer_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s346_current_runtime_oom_ipc_lifecycle_restore_writer_guard_integration::acquire_s346_production_scheduler_writer_access()
                .unwrap_or_else(|error| {
                    panic!(
                        "S346 current-runtime-OOM IPC-lifecycle carrier restore writer guard failed closed: {:?}",
                        error
                    )
                });
            (&mut *core::ptr::addr_of_mut!(SCHEDULER)).deferred_current_runtime_oom = Some(carrier);
            #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
            drop(s346_writer_access);
            #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
            drop(s346_irq_guard);
            return Err(RuntimeOomTaskExecutionError::IpcLifecycle);
        }
    };
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s345_irq_guard = crate::arch::aarch64::IrqGuard::new();
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    let s345_writer_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s345_current_runtime_oom_commit_writer_guard_integration::acquire_s345_production_scheduler_writer_access()
        .unwrap_or_else(|error| {
            panic!(
                "S345 current-runtime-OOM final scheduler commit writer guard failed closed: {:?}",
                error
            )
        });
    let sched = &mut *core::ptr::addr_of_mut!(SCHEDULER);
    let Some(task) = sched.current_task.as_mut() else {
        sched.deferred_current_runtime_oom = Some(carrier);
        #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
        drop(s345_writer_access);
        #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
        drop(s345_irq_guard);
        return Err(RuntimeOomTaskExecutionError::SchedulerCommitMismatch);
    };
    if task.id != binding.task_id
        || task.runtime_allocation_domain() != Some(binding.domain)
        || task.asid != binding.asid
        || task
            .runtime_user_frames
            .as_ref()
            .map_or(0, |ledger| ledger.frame_count())
            != binding.frame_count
    {
        sched.deferred_current_runtime_oom = Some(carrier);
        #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
        drop(s345_writer_access);
        #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
        drop(s345_irq_guard);
        return Err(RuntimeOomTaskExecutionError::SchedulerCommitMismatch);
    }

    task.finished.store(true, Ordering::Release);
    task.state = TaskState::Dead;
    task.user_sp = 0;
    task.saved_user_elr = 0;
    task.saved_user_spsr = 0;
    task.saved_user_gprs = [0; 31];
    carrier.binding = binding;
    carrier.ipc_lifecycle_closed = true;
    carrier.ipc_teardown = Some(ipc_teardown);
    sched.deferred_current_runtime_oom = Some(carrier);
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s345_writer_access);
    #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
    drop(s345_irq_guard);

    retire_current_asid_after_kernel_switch();
    yield_now();
    crate::arch::aarch64::disable_irqs();
    loop {
        core::arch::asm!("wfe", options(nomem, nostack));
    }
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn acquire_s346_production_scheduler_writer_access(
) -> Result<G8lS346ProductionSchedulerWriterAccess, G8lS247WholeSchedulerAccessError> {
    let caller_cpu =
        crate::percpu::try_current_cpu_id().ok_or(G8lS247WholeSchedulerAccessError::InvalidCpu)?;
    if caller_cpu != crate::g8l_runtime_contract::CPU0 {
        return Err(G8lS247WholeSchedulerAccessError::InvalidCpu);
    }
    let access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s246_whole_scheduler_read_access_guard::S247_PRODUCTION_WHOLE_SCHEDULER_ACCESS_GATE
        .try_acquire_exclusive_for_valid_cpu(caller_cpu)?;
    Ok(G8lS346ProductionSchedulerWriterAccess { _access: access })
}

#[test]
fn ipc_error_branch_has_exactly_one_s346_acquire() {
    assert_eq!(
        ipc_match_boundary()
            .matches("acquire_s346_production_scheduler_writer_access")
            .count(),
        1
    );
}

  {
    id: "g8l-s346-current-runtime-oom-ipc-lifecycle-restore-writer-guard-integration-partial",
    date: "2026-08-28",
    sequence: 346,
    status: "passed",
    umbrella_status: "partial",
    title:
      "S346 · Current-runtime-OOM IPC-lifecycle error restore production writer guard integration",
    summary:
      "S346, execute_armed_current_runtime_oom_if_target içindeki kaynak sırasına göre S345 final commit'ten hemen önce gelen tek IPC-lifecycle error carrier-restore writer sınırını aynı statik S247 state word'e bağlar. teardown_task_ipc_lifecycle hata verdikten sonra ayrı IrqGuard kurulur; gerçek per-CPU kimliğiyle CPU0-only S346 writer mutable SCHEDULER aliasından önce alınır. Owned carrier exact deferred_current_runtime_oom slotuna geri yayınlanır; writer, ardından IRQ guard explicit bırakılır ve yalnız sonra tarihsel IpcLifecycle hatası döner. Guarded writer 19/69, açık writer 50 ve provider authority 0'dır. İki board-qemu source callsite vardır, fakat RPi5-only wrapper supported-profile runtime observation=0'dır. Binding-mismatch, binding-audit, boot-memory, coordinator-preflight restore ve carrier-take aliasları S347–S351 için ayrı açık kalır; sıradaki kapı S347 binding-mismatch restore entegrasyonudur.",
    evidence: [
      "Focused IPC-lifecycle error restore writer-integration kapısı 36/36 PASS verdi. Önceki S345 37/37; S258 reader 11/11; current-deferred 5/5; effect 5/5; lifecycle recovery 7/7; live IPC teardown 5/5; scheduler executor 5/5; timer trigger 5/5; S341 31/31 ve S334 26/26 regresyonları ayrıca geçti.",
      "Aynı S247 state word üzerinde CPU0-only membership, non-CPU0 pre-restore rejection, reader→writer, writer→reader ve writer→writer exclusion, callback-error sonrası exact release ve S345→S346 token monotonluğu doğrulandı.",
      "Production error sırası teardown_task_ipc_lifecycle Err → S346 IrqGuard → S346 writer acquire → tek mutable SCHEDULER alias → exact carrier restore → writer drop → IRQ drop → IpcLifecycle return olarak kaynak-kilitlidir.",
      "Error kolunda exact bir S346 acquire, bir mutable alias ve bir explicit writer drop vardır. Success IPC teardown kolu S346 membership almaz; S345 final commit ancak match kapandıktan sonra başlar ve nested lease oluşmaz.",
      "S347 binding-mismatch restore, S348 binding-audit restore, S349 boot-memory restore, S350 coordinator-preflight restore ve S351 carrier-take aliasları S346 acquisition'dan önce kalır ve bu kapıda guarded sayılmaz.",
      "kernel/src/arch/aarch64/exceptions.rs içinde execute_armed_current_runtime_oom_if_target için iki direct board-qemu source callsite sayıldı. Bu çağrılar RPi5-only S346 wrapper'ın runtime invocation kanıtı değildir; supported-profile runtime observations=0'dır.",
      "Fresh ve birbirinden yalıtılmış AArch64 profilleri 4/4 exit 0 verdi: board-qemu build 111595 B / 5863bed5…d80e / 293 warning header; board-rpi4 build 150268 B / 997584c7…1a90 / 391; board-rpi5 build 543274 B / c49010e4…35f8 / 1212; board-rpi5+smp check 543164 B / a60ba102…c7e / 1212. Warning başlıkları sayılmıştır; zero-warning iddiası yoktur.",
      "S238–S346 dependency matrisi exact sıra listesiyle iki bağımsız seri koşuda 110 ayrı grup / 1799/1799 PASS verdi. 25578 B ham özetler 30ea916e…bfe5 ve 3f6a1b77…eeb7 olup yalnız altı ölçülen 0.00/0.01 s alanında ayrışır; raw byte equality iddia edilmez. 26128 B süre-normalize kanonik özetler 369bc30f…a43 ile byte-eşittir.",
      "Exact yedi tarihsel assertion adı dışlanıp --test-threads=1 kabulü kullanıldığında workspace 308 sonuç grubu / 3633 PASS / 0 fail / 7 filtered verdi; 67791 B log 6511fa26…681 SHA-256'dır.",
      "Filtresiz workspace exit 101 ile yalnız frozen S96 wiring_does_not_mutate_timer_gic_boot_or_expand_runtime_scope source-identity reddinde durdu; 261 sonuç grubunda 3378 PASS / 1 fail, 63013 B log 15f241e5…d42'dir ve global workspace GREEN iddia edilmez.",
      "make verify-qemu ortak regresyonu 116447 B / 67df60f0…c0ee ile strict ELF W^X 31/31, S130–S154, IPC reply 20/20, scheduler SEC5 ve kernel fault marker 0 PASS verdi. RPi5-only S346 writer bu QEMU koşusunda runtime-observed değildir.",
      "Website S346 yüzeyi 540/540 test, lint, boş çıktılı TypeScript ve 23/23 static route build PASS verdi; çıktı 193 dosya ve Timeline 185 ayrı gate-policy kartıdır. İlk production/main içerik yayını cb79052f-ca4f-45f8-a952-e85c9fae7ebf kimliğiyle 109 upload + 84 mevcut = 193 dosya olarak tamamlandı; 1450 B deploy logu 2fa5abb7…cfb SHA-256'dır. Cache-busted custom-domain Operations HTTP 200 / 10714457 B / a86c2506…a484, Timeline HTTP 200 / 2877109 B / 64a44c01…22e ve yol-haritasi HTTP 200 / 2876857 B / e1975b60…1ae6 artifact'leri deployment build yerel out'u ile byte-exact PASS verdi. Immutable cb79052f hostname probe'u 10 saniyede curl exit 28 / HTTP 000 verdi; custom-domain PASS bu sınırı gizlemez.",
      "S245 request yalnız non-consuming incelenir; S244 admission dokunulmadan kalır. Production provider authority=0, whole-scheduler exclusion=false ve toplam 50 production writer açık kalır.",
      "S346 için güç, SD kart, Mac kart erişimi, UART capture, raw validation, archive veya promotion işlemi yapılmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S346=NO.",
    ],
    commands: [
      "cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s346_current_runtime_oom_ipc_lifecycle_restore_writer_guard_integration -- --test-threads=1",
      "cargo build -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo check -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
      "cargo test --workspace --quiet -- --test-threads=1 [seven exact historical --skip filters]",
      "make verify-qemu",
      "npm run deploy",
    ],
    terminalSessions: [
      {
        id: "g8l-s346-current-runtime-oom-ipc-lifecycle-restore-writer-guard-integration",
        title:
          "G8l S346 current-runtime-OOM IPC-lifecycle error restore writer guard integration",
        commandLines: [
          "cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s346_current_runtime_oom_ipc_lifecycle_restore_writer_guard_integration -- --test-threads=1",
        ],
        outputLines: [
          "test result: ok; S346 focused 1 group / 36 passed; 0 failed",
          "shared S247 gate: 44 guarded readers + 19/69 guarded writers; 50 writers open",
          "IPC teardown Err < S346 IRQ/writer < one carrier restore < writer/IRQ drop < IpcLifecycle return",
          "production source callsites=2 board-qemu; supported-profile RPi5 runtime observations=0",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8l-s346-operations-timeline-production-publication",
        title: "S346 Operations/Timeline production publication",
        commandLines: [
          "npm run deploy",
          "curl --cache-busted https://aselsan.kerege.net/{operations,timeline,yol-haritasi}/ and compare with local out",
        ],
        outputLines: [
          "website test 540/540; lint PASS; TypeScript PASS; static routes 23/23; files 193; Timeline cards 185",
          "initial production/main deployment cb79052f-ca4f-45f8-a952-e85c9fae7ebf; upload 109 + existing 84 = 193",
          "custom operations HTTP 200; 10714457 B; a86c2506392d6316de7df595206847e1da02b66aea32dc2178798e38ae89a484; local cmp PASS",
          "custom timeline HTTP 200; 2877109 B; 64a44c0151c47446015cd671f5b6b72dadd4c571753dc45a13e2c597010fc22e; local cmp PASS",
          "custom yol-haritasi HTTP 200; 2876857 B; e1975b60092d5a6a89dbb7809250c16a628e7e8aaf9d7b6d545ccc06a0ff1ae6; local cmp PASS",
          "immutable cb79052f probe curl exit 28; HTTP 000; no immutable-host PASS claimed",
        ],
        exitCode: 0,
        outputMode: "selected",
        outputNote:
          "Bu oturum ilk içerik yayınının exact kimliğini, üç canlı artifact'in byte eşitliğini ve immutable-host erişim sınırını ayrı tutar; yayın kanıtını içeren final deployment ayrıca kaydedilecektir.",
      },
    ],
    terminalSessionsNote:
      "S346 on dokuzuncu production writer'ın dar kaynak entegrasyonudur. Yalnız IPC teardown error restore kolu guarded'dır; success/final commit S345'te, daha erken restore/take aliasları S347–S351'de ayrı kalır.",
    limitations: [
      "50 production writer aynı shared gate dışında kaldığı için whole-scheduler exclusion ve provider authority açık kalır.",
      "İki board-qemu source callsite wiring kanıtıdır; RPi5-only S346 wrapper için supported-profile invocation/observation kanıtı yoktur.",
      "Binding-mismatch carrier restore writer entegrasyonu sıradaki ayrı S347 kapısıdır.",
      "Binding-audit, boot-memory, coordinator-preflight restore ve carrier-take aliasları S348–S351 için açık bırakılmıştır.",
      "Default-parallel PTY determinism, transient-contention liveness/soak, Generic SMP ve fiziksel RPi kabulü açık kalır.",
    ],
  },