S405 · Scoped authority provider preflight

#![allow(unexpected_cfgs)]

//! S405 scoped-authority/provider-request preflight.
//!
//! S404 leaves one CPU1-targeted scoped attempt request after CPU0 consumes the
//! prior post-release observation. S405 pairs its read-only view with the next
//! pending S245 provider request. The provider request must be the exact
//! successor of the observed request. Both slots remain untouched on success,
//! absence, or drift.
//!
//! This is eligibility only. S405 acquires no S247 lease, consumes neither
//! request, publishes no S244 admission, and carries no authority.

use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s244_whole_scheduler_exclusion_admission_request::{
    G8lS245ExclusionAdmissionRequestError, G8lS245ExclusionAdmissionRequestReason,
    G8lS245WholeSchedulerExclusionAdmissionRequestState,
    G8lS245WholeSchedulerExclusionAdmissionRequestView, S245_SOURCE_CPU0, S245_TARGET_CPU1,
};
use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s404_scoped_authority_request_publication::{
    G8lS404ScopedAuthorityRequestError, G8lS404ScopedAuthorityRequestReason,
    G8lS404ScopedAuthorityRequestState, G8lS404ScopedAuthorityRequestView,
    S404_DIRECT_SCHEDULER_ACCESS_SITES, S404_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES,
    S404_SOURCE_AUDIT_UNITS, S404_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES,
    S404_UNROUTED_DIRECT_ACCESS_SITES,
};

pub const S405_SOURCE_AUDIT_UNITS: usize = S404_SOURCE_AUDIT_UNITS;
pub const S405_DIRECT_SCHEDULER_ACCESS_SITES: usize = S404_DIRECT_SCHEDULER_ACCESS_SITES;
pub const S405_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES: usize =
    S404_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES;
pub const S405_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES: usize =
    S404_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES;
pub const S405_UNROUTED_DIRECT_ACCESS_SITES: usize = S404_UNROUTED_DIRECT_ACCESS_SITES;
pub const S405_PRODUCTION_PREFLIGHT_CALLSITES: usize = 1;
pub const S405_SCOPED_REQUEST_TAKE_SITES: usize = 0;
pub const S405_PROVIDER_REQUEST_TAKE_SITES: usize = 0;
pub const S405_PRODUCTION_ADMISSION_PUBLISHER_SITES: usize = 0;
pub const S405_SCOPED_AUTHORITY_PROVIDER_PREFLIGHT_COMPLETE: bool = true;
pub const S405_END_TO_END_EXCLUSION_ADMISSION_COMPLETE: bool = false;

#[derive(Debug, PartialEq, Eq)]
pub struct G8lS405ScopedAuthorityProviderPreflightReceipt {
    attempt_id: u64,
    observed_request_id: u64,
    prior_exclusive_token: u64,
    provider_request_id: u64,
}

impl G8lS405ScopedAuthorityProviderPreflightReceipt {
    pub const fn attempt_id(&self) -> u64 {
        self.attempt_id
    }

    pub const fn observed_request_id(&self) -> u64 {
        self.observed_request_id
    }

    pub const fn prior_exclusive_token(&self) -> u64 {
        self.prior_exclusive_token
    }

    pub const fn provider_request_id(&self) -> u64 {
        self.provider_request_id
    }

    pub const fn scoped_request_taken(&self) -> bool {
        false
    }

    pub const fn provider_request_taken(&self) -> bool {
        false
    }

    pub const fn is_provider_authority(&self) -> bool {
        false
    }

    pub const fn whole_scheduler_exclusion_proven(&self) -> bool {
        false
    }

    pub const fn admission_published(&self) -> bool {
        false
    }
}

impl Drop for G8lS405ScopedAuthorityProviderPreflightReceipt {
    fn drop(&mut self) {}
}

#[derive(Debug, PartialEq, Eq)]
pub enum G8lS405ScopedAuthorityProviderPreflightOutcome {
    Idle,
    AwaitingProviderRequest { attempt_id: u64 },
    Ready(G8lS405ScopedAuthorityProviderPreflightReceipt),
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS405ScopedAuthorityProviderPreflightError {
    WrongCpu,
    S404(G8lS404ScopedAuthorityRequestError),
    S245(G8lS245ExclusionAdmissionRequestError),
    ScopedRequestMetadataDrift,
    ProviderRequestMetadataDrift,
    RequestIdentityDrift {
        observed_request_id: u64,
        provider_request_id: u64,
    },
}

fn preflight_s405_from_views(
    scoped: G8lS404ScopedAuthorityRequestView,
    provider: G8lS245WholeSchedulerExclusionAdmissionRequestView,
) -> Result<
    G8lS405ScopedAuthorityProviderPreflightReceipt,
    G8lS405ScopedAuthorityProviderPreflightError,
> {
    if scoped.attempt_id == 0
        || scoped.observed_request_id == 0
        || scoped.attempt_id != scoped.observed_request_id
        || scoped.prior_exclusive_token == 0
        || scoped.source_cpu != S245_SOURCE_CPU0
        || scoped.target_cpu != S245_TARGET_CPU1
        || scoped.reason != G8lS404ScopedAuthorityRequestReason::PostReleaseObservationVerified
        || scoped.is_authority
        || scoped.whole_scheduler_exclusion_proven
    {
        return Err(G8lS405ScopedAuthorityProviderPreflightError::ScopedRequestMetadataDrift);
    }
    if provider.request_id == 0
        || provider.source_cpu != S245_SOURCE_CPU0
        || provider.target_cpu != S245_TARGET_CPU1
        || provider.reason
            != G8lS245ExclusionAdmissionRequestReason::S242AuthoritiesAndS240ReceiptReady
    {
        return Err(G8lS405ScopedAuthorityProviderPreflightError::ProviderRequestMetadataDrift);
    }
    if scoped.observed_request_id.checked_add(1) != Some(provider.request_id) {
        return Err(
            G8lS405ScopedAuthorityProviderPreflightError::RequestIdentityDrift {
                observed_request_id: scoped.observed_request_id,
                provider_request_id: provider.request_id,
            },
        );
    }
    Ok(G8lS405ScopedAuthorityProviderPreflightReceipt {
        attempt_id: scoped.attempt_id,
        observed_request_id: scoped.observed_request_id,
        prior_exclusive_token: scoped.prior_exclusive_token,
        provider_request_id: provider.request_id,
    })
}

pub fn preflight_s405_scoped_authority_provider(
    scoped_requests: &G8lS404ScopedAuthorityRequestState,
    provider_requests: &G8lS245WholeSchedulerExclusionAdmissionRequestState,
    caller_cpu: usize,
) -> Result<
    G8lS405ScopedAuthorityProviderPreflightOutcome,
    G8lS405ScopedAuthorityProviderPreflightError,
> {
    if caller_cpu != S245_TARGET_CPU1 {
        return Err(G8lS405ScopedAuthorityProviderPreflightError::WrongCpu);
    }
    let scoped = scoped_requests
        .pending_view(caller_cpu)
        .map_err(G8lS405ScopedAuthorityProviderPreflightError::S404)?;
    let Some(scoped) = scoped else {
        return Ok(G8lS405ScopedAuthorityProviderPreflightOutcome::Idle);
    };
    let provider = provider_requests
        .pending_view(caller_cpu)
        .map_err(G8lS405ScopedAuthorityProviderPreflightError::S245)?;
    let Some(provider) = provider else {
        return Ok(
            G8lS405ScopedAuthorityProviderPreflightOutcome::AwaitingProviderRequest {
                attempt_id: scoped.attempt_id,
            },
        );
    };
    preflight_s405_from_views(scoped, provider)
        .map(G8lS405ScopedAuthorityProviderPreflightOutcome::Ready)
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn service_s405_scoped_authority_provider_preflight_on_cpu1() -> Result<
    G8lS405ScopedAuthorityProviderPreflightOutcome,
    G8lS405ScopedAuthorityProviderPreflightError,
> {
    use crate::g8l_runtime_contract::CPU1;

    if crate::percpu::try_current_cpu_id() != Some(CPU1) {
        return Err(G8lS405ScopedAuthorityProviderPreflightError::WrongCpu);
    }
    let scoped = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s404_scoped_authority_request_publication::inspect_s404_scoped_authority_request_on_cpu1()
        .map_err(G8lS405ScopedAuthorityProviderPreflightError::S404)?;
    let Some(scoped) = scoped else {
        return Ok(G8lS405ScopedAuthorityProviderPreflightOutcome::Idle);
    };
    let provider = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s244_whole_scheduler_exclusion_admission_request::inspect_s245_exclusion_admission_request_on_cpu1()
        .map_err(G8lS405ScopedAuthorityProviderPreflightError::S245)?;
    let Some(provider) = provider else {
        return Ok(
            G8lS405ScopedAuthorityProviderPreflightOutcome::AwaitingProviderRequest {
                attempt_id: scoped.attempt_id,
            },
        );
    };
    preflight_s405_from_views(scoped, provider)
        .map(G8lS405ScopedAuthorityProviderPreflightOutcome::Ready)
}

#![recursion_limit = "256"]

use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s244_whole_scheduler_exclusion_admission_request::{
    service_s245_exclusion_admission_request, G8lS245ExclusionAdmissionRequestOutcome,
    G8lS245WholeSchedulerExclusionAdmissionRequestState, S245_SOURCE_CPU0, S245_TARGET_CPU1,
};
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s246_whole_scheduler_read_access_guard::G8lS247WholeSchedulerAccessGate;
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s402_provider_invocation_observation_publication::{
    service_s402_model_provider_invocation_observation_publication,
    G8lS402ProviderInvocationObservationState,
};
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s404_scoped_authority_request_publication::{
    service_s404_model_scoped_authority_request_publication,
    G8lS404ScopedAuthorityRequestState, S404_DIRECT_SCHEDULER_ACCESS_SITES,
    S404_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES, S404_SOURCE_AUDIT_UNITS,
    S404_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES, S404_UNROUTED_DIRECT_ACCESS_SITES,
};
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s405_scoped_authority_provider_preflight::*;

fn paired_states(
    first_request_id: u64,
) -> (
    G8lS247WholeSchedulerAccessGate,
    G8lS245WholeSchedulerExclusionAdmissionRequestState,
    G8lS404ScopedAuthorityRequestState,
) {
    let gate = G8lS247WholeSchedulerAccessGate::new();
    let mut provider_requests =
        G8lS245WholeSchedulerExclusionAdmissionRequestState::with_next_request_id(first_request_id);
    assert!(matches!(
        service_s245_exclusion_admission_request(
            &mut provider_requests,
            S245_SOURCE_CPU0,
            true,
            true
        ),
        Ok(G8lS245ExclusionAdmissionRequestOutcome::RequestPublished(id)) if id == first_request_id
    ));
    let mut observations = G8lS402ProviderInvocationObservationState::new();
    service_s402_model_provider_invocation_observation_publication(
        &mut observations,
        &gate,
        &mut provider_requests,
        S245_TARGET_CPU1,
    )
    .unwrap();
    let mut scoped = G8lS404ScopedAuthorityRequestState::new();
    service_s404_model_scoped_authority_request_publication(
        &mut scoped,
        &mut observations,
        S245_SOURCE_CPU0,
    )
    .unwrap();
    assert!(matches!(
        service_s245_exclusion_admission_request(
            &mut provider_requests,
            S245_SOURCE_CPU0,
            true,
            true
        ),
        Ok(G8lS245ExclusionAdmissionRequestOutcome::RequestPublished(id)) if id == first_request_id + 1
    ));
    (gate, provider_requests, scoped)
}

fn module_source() -> &'static str {
    include_str!("../../kernel/src/g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s405_scoped_authority_provider_preflight.rs")
}

fn exception_source() -> &'static str {
    include_str!("../../kernel/src/arch/aarch64/exceptions.rs")
}

fn kernel_main_source() -> &'static str {
    include_str!("../../kernel/src/main.rs")
}

fn simulation_lib_source() -> &'static str {
    include_str!("../src/lib.rs")
}

#[test]
fn constants_promote_only_the_two_request_preflight() {
    assert_eq!(S405_SOURCE_AUDIT_UNITS, 7);
    assert_eq!(S405_DIRECT_SCHEDULER_ACCESS_SITES, 113);
    assert_eq!(S405_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES, 113);
    assert_eq!(S405_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES, 113);
    assert_eq!(S405_UNROUTED_DIRECT_ACCESS_SITES, 0);
    assert_eq!(S405_PRODUCTION_PREFLIGHT_CALLSITES, 1);
    assert_eq!(S405_SCOPED_REQUEST_TAKE_SITES, 0);
    assert_eq!(S405_PROVIDER_REQUEST_TAKE_SITES, 0);
    assert_eq!(S405_PRODUCTION_ADMISSION_PUBLISHER_SITES, 0);
    assert!(S405_SCOPED_AUTHORITY_PROVIDER_PREFLIGHT_COMPLETE);
    assert!(!S405_END_TO_END_EXCLUSION_ADMISSION_COMPLETE);
}

#[test]
fn s404_is_the_exact_scoped_request_predecessor() {
    assert_eq!(S405_SOURCE_AUDIT_UNITS, S404_SOURCE_AUDIT_UNITS);
    assert_eq!(
        S405_DIRECT_SCHEDULER_ACCESS_SITES,
        S404_DIRECT_SCHEDULER_ACCESS_SITES
    );
    assert_eq!(
        S405_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES,
        S404_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES
    );
    assert_eq!(
        S405_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES,
        S404_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES
    );
    assert_eq!(
        S405_UNROUTED_DIRECT_ACCESS_SITES,
        S404_UNROUTED_DIRECT_ACCESS_SITES
    );
}

#[test]
fn exact_adjacent_request_pair_returns_non_authoritative_preflight_receipt() {
    let (_gate, provider_requests, scoped) = paired_states(20);
    let outcome =
        preflight_s405_scoped_authority_provider(&scoped, &provider_requests, S245_TARGET_CPU1)
            .unwrap();
    let G8lS405ScopedAuthorityProviderPreflightOutcome::Ready(receipt) = outcome else {
        panic!("adjacent pair must be ready")
    };
    assert_eq!(receipt.attempt_id(), 20);
    assert_eq!(receipt.observed_request_id(), 20);
    assert_eq!(receipt.prior_exclusive_token(), 1);
    assert_eq!(receipt.provider_request_id(), 21);
    assert!(!receipt.scoped_request_taken());
    assert!(!receipt.provider_request_taken());
    assert!(!receipt.is_provider_authority());
    assert!(!receipt.whole_scheduler_exclusion_proven());
    assert!(!receipt.admission_published());
}

#[test]
fn missing_scoped_request_is_idle_without_touching_provider_request() {
    let mut provider_requests = G8lS245WholeSchedulerExclusionAdmissionRequestState::new();
    service_s245_exclusion_admission_request(&mut provider_requests, S245_SOURCE_CPU0, true, true)
        .unwrap();
    let scoped = G8lS404ScopedAuthorityRequestState::new();
    assert!(matches!(
        preflight_s405_scoped_authority_provider(&scoped, &provider_requests, S245_TARGET_CPU1),
        Ok(G8lS405ScopedAuthorityProviderPreflightOutcome::Idle)
    ));
    assert_eq!(provider_requests.pending_request_id(), Some(1));
}

#[test]
fn missing_provider_request_preserves_scoped_request_and_reports_waiting() {
    let (_gate, mut provider_requests, scoped) = paired_states(1);
    provider_requests.take(S245_TARGET_CPU1).unwrap();
    let outcome =
        preflight_s405_scoped_authority_provider(&scoped, &provider_requests, S245_TARGET_CPU1)
            .unwrap();
    assert!(matches!(
        outcome,
        G8lS405ScopedAuthorityProviderPreflightOutcome::AwaitingProviderRequest { attempt_id: 1 }
    ));
    assert_eq!(
        scoped
            .pending_view(S245_TARGET_CPU1)
            .unwrap()
            .unwrap()
            .attempt_id,
        1
    );
}

#[test]
fn wrong_cpu_fails_before_inspection() {
    let (_gate, provider_requests, scoped) = paired_states(8);
    assert!(matches!(
        preflight_s405_scoped_authority_provider(&scoped, &provider_requests, S245_SOURCE_CPU0),
        Err(G8lS405ScopedAuthorityProviderPreflightError::WrongCpu)
    ));
    assert_eq!(provider_requests.pending_request_id(), Some(9));
    assert!(scoped.pending());
}

#[test]
fn non_adjacent_pair_fails_closed_and_preserves_both_requests() {
    let (_gate, _provider_requests, scoped) = paired_states(1);
    let mut drifted = G8lS245WholeSchedulerExclusionAdmissionRequestState::with_next_request_id(9);
    service_s245_exclusion_admission_request(&mut drifted, S245_SOURCE_CPU0, true, true).unwrap();
    assert!(matches!(
        preflight_s405_scoped_authority_provider(&scoped, &drifted, S245_TARGET_CPU1),
        Err(
            G8lS405ScopedAuthorityProviderPreflightError::RequestIdentityDrift {
                observed_request_id: 1,
                provider_request_id: 9
            }
        )
    ));
    assert_eq!(drifted.pending_request_id(), Some(9));
    assert!(scoped.pending());
}

#[test]
fn preflight_is_non_copy_non_clone_and_contains_no_authority() {
    assert!(core::mem::needs_drop::<
        G8lS405ScopedAuthorityProviderPreflightReceipt,
    >());
    let source = module_source();
    let start = source
        .find("pub struct G8lS405ScopedAuthorityProviderPreflightReceipt")
        .unwrap();
    let derive = source[..start].rfind("#[derive").unwrap();
    assert_eq!(
        source[derive..start].trim(),
        "#[derive(Debug, PartialEq, Eq)]"
    );
    let body = &source[start..source[start..].find("}\n\nimpl").unwrap() + start];
    assert!(!body.contains("lease"));
    assert!(!body.contains("authority:"));
}

#[test]
fn model_preflight_only_inspects_both_pending_views() {
    let source = module_source();
    let start = source
        .find("pub fn preflight_s405_scoped_authority_provider")
        .unwrap();
    let function: String = source[start..].split_whitespace().collect();
    assert!(function.contains("scoped_requests.pending_view(caller_cpu)"));
    assert!(function.contains("provider_requests.pending_view(caller_cpu)"));
    assert!(!function.contains(".take("));
}

#[test]
fn production_service_inspects_exact_s404_and_s245_slots() {
    let source = module_source();
    assert!(source.contains("inspect_s404_scoped_authority_request_on_cpu1"));
    assert!(source.contains("inspect_s245_exclusion_admission_request_on_cpu1"));
    assert!(!source.contains("take_s404_scoped_authority_request_on_cpu1"));
    assert!(!source.contains("take_s245_exclusion_admission_request_on_cpu1"));
}

#[test]
fn cpu1_timer_chain_orders_s405_after_s399_before_s402() {
    let source = exception_source();
    let s399 = source
        .find("service_s399_whole_scheduler_provider_preflight_on_cpu1")
        .unwrap();
    let s405 = source
        .find("service_s405_scoped_authority_provider_preflight_on_cpu1")
        .unwrap();
    let s402 = source
        .find("service_s402_provider_invocation_observation_publication_on_cpu1")
        .unwrap();
    assert!(s399 < s405 && s405 < s402);
}

#[test]
fn timer_chain_accepts_idle_waiting_ready_and_panics_on_error() {
    let source = exception_source();
    for marker in [
        "G8lS405ScopedAuthorityProviderPreflightOutcome::Idle",
        "G8lS405ScopedAuthorityProviderPreflightOutcome::AwaitingProviderRequest",
        "G8lS405ScopedAuthorityProviderPreflightOutcome::Ready",
        "S405 scoped-authority provider preflight failed closed",
    ] {
        assert!(source.contains(marker), "missing timer marker {marker}");
    }
}

#[test]
fn s405_does_not_acquire_take_publish_admission_or_touch_scheduler() {
    let source = module_source();
    for forbidden in [
        "try_acquire_exclusive",
        "take_s404_scoped_authority_request_on_cpu1",
        "take_s245_exclusion_admission_request_on_cpu1",
        "publish_s244",
        "addr_of!(",
        "addr_of_mut!(",
    ] {
        assert!(
            !source.contains(forbidden),
            "forbidden promotion: {forbidden}"
        );
    }
}

#[test]
fn s405_and_its_exact_s406_constructor_are_registered_separately() {
    let s405 = "g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s405_scoped_authority_provider_preflight";
    let s406 = "g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s406_scoped_provider_authority_constructor";
    assert!(kernel_main_source().contains(&format!("mod {s405};")));
    assert!(simulation_lib_source().contains(&format!("pub mod {s405};")));
    assert!(kernel_main_source().contains(&format!("mod {s406};")));
    assert!(simulation_lib_source().contains(&format!("pub mod {s406};")));
}

  {
    id: "g8l-s405-scoped-authority-provider-preflight-partial",
    sequence: 405,
    slug: "scoped_authority_provider_preflight",
    title: "Scoped authority provider preflight",
    focusedTests: 14,
    sourceBytes: 8448,
    sourceSha256:
      "a14bd0fe2c0c0b572e1834a1e82dafb558ba5fef5e650c86a7e73c24e90fcb1a",
    testBytes: 11782,
    testSha256:
      "e4ce72a0b9fb9bd9d624e3afafe5dc0144e2004039508936dc39df5f4e3e0894",
    acceptance:
      "CPU1 exact pending S245 request ile S404 scoped request'i non-consuming inspect ederek ortak request/reason/CPU zarfını fail-closed doğrular.",
    retainedBoundary:
      "Scoped request take, provider request take ve S247 lease acquire bu preflight kapısında sıfırdır.",
  },