S422 · S187 continuation preflight

#![allow(unexpected_cfgs)]

//! S422 non-consuming preflight for the delivered S187 continuation.
//!
//! CPU1 verifies the exact S421 reconciliation envelope, confirms that the
//! provider's exclusive lease has already ended, and establishes an IRQ-masked
//! continuation scope. The handoff remains in S421; S422 never invokes the
//! S187 -> S223 production continuation.

use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s421_reconciled_s187_handoff_delivery::{
    G8lS421ReconciledS187HandoffDeliveryError, G8lS421ReconciledS187HandoffView,
    S421_DIRECT_SCHEDULER_ACCESS_SITES, S421_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES,
    S421_SOURCE_AUDIT_UNITS, S421_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES,
    S421_UNROUTED_DIRECT_ACCESS_SITES,
};

pub const S422_SOURCE_AUDIT_UNITS: usize = S421_SOURCE_AUDIT_UNITS;
pub const S422_DIRECT_SCHEDULER_ACCESS_SITES: usize = S421_DIRECT_SCHEDULER_ACCESS_SITES;
pub const S422_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES: usize =
    S421_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES;
pub const S422_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES: usize =
    S421_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES;
pub const S422_UNROUTED_DIRECT_ACCESS_SITES: usize = S421_UNROUTED_DIRECT_ACCESS_SITES;
pub const S422_PRODUCTION_PREFLIGHT_CALLSITES: usize = 1;
pub const S422_HANDOFF_TAKE_SITES: usize = 0;
pub const S422_S187_CONTINUATION_CALLSITES: usize = 0;
pub const S422_S187_CONTINUATION_PREFLIGHT_COMPLETE: bool = true;
pub const S422_S187_CONTINUATION_INVOCATION_COMPLETE: bool = false;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS422S187ContinuationPreflightReceipt {
    attempt_id: u64,
    provider_request_id: u64,
    exclusive_token: u64,
}

impl G8lS422S187ContinuationPreflightReceipt {
    pub const fn attempt_id(&self) -> u64 {
        self.attempt_id
    }
    pub const fn provider_request_id(&self) -> u64 {
        self.provider_request_id
    }
    pub const fn exclusive_token(&self) -> u64 {
        self.exclusive_token
    }
    pub const fn handoff_remains_owned_by_s421(&self) -> bool {
        true
    }
    pub const fn is_authority(&self) -> bool {
        false
    }
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS422S187ContinuationPreflightOutcome {
    Idle,
    Ready(G8lS422S187ContinuationPreflightReceipt),
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS422S187ContinuationPreflightError {
    WrongCpu,
    S421(G8lS421ReconciledS187HandoffDeliveryError),
    BindingDrift,
    ExclusiveLeaseStillActive,
    IrqsNotMasked,
}

pub fn preflight_s422_s187_continuation(
    handoff: Option<G8lS421ReconciledS187HandoffView>,
    caller_cpu: usize,
    active_exclusive_token: Option<u64>,
    irqs_masked: bool,
) -> Result<G8lS422S187ContinuationPreflightOutcome, G8lS422S187ContinuationPreflightError> {
    if caller_cpu != 1 {
        return Err(G8lS422S187ContinuationPreflightError::WrongCpu);
    }
    let Some(handoff) = handoff else {
        return Ok(G8lS422S187ContinuationPreflightOutcome::Idle);
    };
    if handoff.attempt_id == 0
        || handoff.provider_request_id == 0
        || handoff.exclusive_token == 0
        || !handoff.reconciliation_ack_consumed
        || !handoff.s187_handoff_owned
        || handoff.is_authority
    {
        return Err(G8lS422S187ContinuationPreflightError::BindingDrift);
    }
    if active_exclusive_token.is_some() {
        return Err(G8lS422S187ContinuationPreflightError::ExclusiveLeaseStillActive);
    }
    if !irqs_masked {
        return Err(G8lS422S187ContinuationPreflightError::IrqsNotMasked);
    }
    Ok(G8lS422S187ContinuationPreflightOutcome::Ready(
        G8lS422S187ContinuationPreflightReceipt {
            attempt_id: handoff.attempt_id,
            provider_request_id: handoff.provider_request_id,
            exclusive_token: handoff.exclusive_token,
        },
    ))
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn service_s422_s187_continuation_preflight_on_cpu1(
) -> Result<G8lS422S187ContinuationPreflightOutcome, G8lS422S187ContinuationPreflightError> {
    use crate::g8l_runtime_contract::CPU1;
    if crate::percpu::try_current_cpu_id() != Some(CPU1) {
        return Err(G8lS422S187ContinuationPreflightError::WrongCpu);
    }
    let _irq_guard = crate::arch::aarch64::IrqGuard::new();
    let handoff = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s421_reconciled_s187_handoff_delivery::inspect_s421_reconciled_s187_handoff_on_cpu1()
        .map_err(G8lS422S187ContinuationPreflightError::S421)?;
    let active_token = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s246_whole_scheduler_read_access_guard::S247_PRODUCTION_WHOLE_SCHEDULER_ACCESS_GATE
        .active_exclusive_token();
    preflight_s422_s187_continuation(handoff, CPU1, active_token, true)
}

use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s421_reconciled_s187_handoff_delivery::G8lS421ReconciledS187HandoffView;
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s422_s187_continuation_preflight::*;

fn view() -> G8lS421ReconciledS187HandoffView {
    G8lS421ReconciledS187HandoffView {
        attempt_id: 7,
        provider_request_id: 8,
        exclusive_token: 9,
        reconciliation_ack_consumed: true,
        s187_handoff_owned: true,
        is_authority: false,
    }
}

#[test]
fn constants_keep_preflight_non_consuming() {
    assert_eq!(S422_PRODUCTION_PREFLIGHT_CALLSITES, 1);
    assert_eq!(S422_HANDOFF_TAKE_SITES, 0);
    assert_eq!(S422_S187_CONTINUATION_CALLSITES, 0);
    assert!(S422_S187_CONTINUATION_PREFLIGHT_COMPLETE);
    assert!(!S422_S187_CONTINUATION_INVOCATION_COMPLETE);
}

#[test]
fn exact_released_irq_masked_delivery_is_ready() {
    let outcome = preflight_s422_s187_continuation(Some(view()), 1, None, true).unwrap();
    let G8lS422S187ContinuationPreflightOutcome::Ready(receipt) = outcome else {
        panic!("ready")
    };
    assert_eq!(
        (
            receipt.attempt_id(),
            receipt.provider_request_id(),
            receipt.exclusive_token()
        ),
        (7, 8, 9)
    );
    assert!(receipt.handoff_remains_owned_by_s421());
    assert!(!receipt.is_authority());
}

#[test]
fn absent_handoff_is_idle() {
    assert_eq!(
        preflight_s422_s187_continuation(None, 1, None, true),
        Ok(G8lS422S187ContinuationPreflightOutcome::Idle)
    );
}

#[test]
fn active_exclusion_or_unmasked_irq_fails_closed() {
    assert_eq!(
        preflight_s422_s187_continuation(Some(view()), 1, Some(9), true),
        Err(G8lS422S187ContinuationPreflightError::ExclusiveLeaseStillActive)
    );
    assert_eq!(
        preflight_s422_s187_continuation(Some(view()), 1, None, false),
        Err(G8lS422S187ContinuationPreflightError::IrqsNotMasked)
    );
}

#[test]
fn binding_drift_and_wrong_cpu_fail_closed() {
    let mut drift = view();
    drift.s187_handoff_owned = false;
    assert_eq!(
        preflight_s422_s187_continuation(Some(drift), 1, None, true),
        Err(G8lS422S187ContinuationPreflightError::BindingDrift)
    );
    assert_eq!(
        preflight_s422_s187_continuation(Some(view()), 0, None, true),
        Err(G8lS422S187ContinuationPreflightError::WrongCpu)
    );
}

#[test]
fn production_preflight_only_inspects_s421_and_gate_under_irq_guard() {
    let source = include_str!("../../kernel/src/g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s422_s187_continuation_preflight.rs");
    let start = source
        .find("service_s422_s187_continuation_preflight_on_cpu1")
        .unwrap();
    let body = &source[start..];
    assert!(body.contains("IrqGuard::new"));
    assert!(body.contains("inspect_s421_reconciled_s187_handoff_on_cpu1"));
    assert!(body.contains("active_exclusive_token"));
    assert!(!body.contains("take_s421_reconciled_s187_handoff_on_cpu1"));
    assert!(!body.contains("publish_runtime_owner_tuple_from_production_s187_handoff"));
}

#[test]
fn exact_s423_successor_invokes_s422_after_s421_delivery() {
    let source = include_str!("../../kernel/src/g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s423_s187_continuation_invocation.rs");
    assert!(source.contains("service_s422_s187_continuation_preflight_on_cpu1"));
    let exceptions = include_str!("../../kernel/src/arch/aarch64/exceptions.rs");
    let s421 = exceptions
        .find("service_s421_reconciled_s187_handoff_delivery_on_cpu1")
        .unwrap();
    let s423 = exceptions
        .find("service_s423_s187_continuation_invocation_on_cpu1")
        .unwrap();
    assert!(s421 < s423);
    let name = "g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s422_s187_continuation_preflight";
    assert!(include_str!("../../kernel/src/main.rs").contains(&format!("mod {name};")));
    assert!(include_str!("../src/lib.rs").contains(&format!("pub mod {name};")));
}

  {
    id: "g8l-s422-s187-continuation-preflight-partial",
    sequence: 422,
    slug: "s187_continuation_preflight",
    title: "S187 continuation preflight",
    focusedTests: 7,
    sourceBytes: 4958,
    sourceSha256:
      "a4599d6bf596c7bdffd2b82294ba67f0bc7f1f098a1c4d415bddbf3e4760be3a",
    testBytes: 4225,
    testSha256:
      "f19d0a1fe1718efb2abe000c971a1c3aadf5719a73a7c7d421a0573c102f7ecc",
    acceptance:
      "S421 reconciled handoff view CPU1, request, attempt ve S187 envelope açısından non-consuming preflight receipt ile doğrulanır.",
    retainedBoundary:
      "Handoff take ve continuation çağrısı bu kapıda sıfırdır.",
  },