S428 · Full-chain reconciliation

#![allow(unexpected_cfgs)]

//! S428 full source-chain reconciliation after the S427 audit.
//!
//! This gate accepts only the exact S401-S426 reachability audit while the
//! shared S247 state word reports neither an exclusive token nor readers. It
//! then advances the individually implemented chain through S427. The state
//! observation is a software source-path boundary, not supported-profile
//! runtime or physical acceptance.

use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s427_source_reachability_audit::{
    G8lS427SourceReachabilityAudit, G8lS427SourceReachabilityAuditError,
    S427_AUDITED_GATE_COUNT, S427_DIRECT_ACCESS_SITES, S427_FIRST_AUDITED_GATE,
    S427_PHYSICAL_OBSERVATIONS, S427_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES,
    S427_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES,
    S427_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS, S427_UNROUTED_DIRECT_ACCESS_SITES,
};

pub const S428_SOURCE_AUDIT_UNITS: usize = 7;
pub const S428_DIRECT_ACCESS_SITES: usize = S427_DIRECT_ACCESS_SITES;
pub const S428_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES: usize =
    S427_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES;
pub const S428_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES: usize =
    S427_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES;
pub const S428_UNROUTED_DIRECT_ACCESS_SITES: usize = S427_UNROUTED_DIRECT_ACCESS_SITES;
pub const S428_FIRST_RECONCILED_GATE: usize = S427_FIRST_AUDITED_GATE;
pub const S428_LAST_RECONCILED_GATE: usize = 427;
pub const S428_RECONCILED_GATE_COUNT: usize =
    S428_LAST_RECONCILED_GATE - S428_FIRST_RECONCILED_GATE + 1;
pub const S428_RECONCILIATION_SLOT_CAPACITY: usize = 1;
pub const S428_PRODUCTION_RECONCILIATION_CALLSITES: usize = 1;
pub const S428_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS: usize = 0;
pub const S428_PHYSICAL_OBSERVATIONS: usize = 0;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS428FullChainReconciliationReceipt {
    pub attempt_id: u64,
    pub provider_request_id: u64,
    pub exclusive_token: u64,
    pub reconciled_gate_count: usize,
    pub all_source_gates_reconciled: bool,
    pub no_live_scheduler_access: bool,
    pub runtime_observed: bool,
    pub physical_observed: bool,
}

#[derive(Debug)]
pub struct G8lS428FullChainReconciliationState {
    pending: Option<G8lS428FullChainReconciliationReceipt>,
}

impl G8lS428FullChainReconciliationState {
    pub const fn new() -> Self {
        Self { pending: None }
    }

    pub const fn pending(&self) -> bool {
        self.pending.is_some()
    }

    pub fn pending_receipt(
        &self,
        caller_cpu: usize,
    ) -> Result<Option<G8lS428FullChainReconciliationReceipt>, G8lS428FullChainReconciliationError>
    {
        if caller_cpu != 1 {
            return Err(G8lS428FullChainReconciliationError::WrongCpu);
        }
        Ok(self.pending)
    }

    pub fn take(
        &mut self,
        caller_cpu: usize,
    ) -> Result<Option<G8lS428FullChainReconciliationReceipt>, G8lS428FullChainReconciliationError>
    {
        if caller_cpu != 1 {
            return Err(G8lS428FullChainReconciliationError::WrongCpu);
        }
        Ok(self.pending.take())
    }
}

impl Default for G8lS428FullChainReconciliationState {
    fn default() -> Self {
        Self::new()
    }
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS428FullChainReconciliationError {
    WrongCpu,
    S427(G8lS427SourceReachabilityAuditError),
    ActiveExclusiveLease { token: u64 },
    ActiveReaders { count: u64 },
    AuditBindingDrift,
    SlotOccupied,
    AuditDisappeared,
    AuditDrift,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS428FullChainReconciliationOutcome {
    Idle,
    ReconciliationPublished(G8lS428FullChainReconciliationReceipt),
    ReconciliationPending(G8lS428FullChainReconciliationReceipt),
}

pub fn service_s428_model_full_chain_reconciliation(
    state: &mut G8lS428FullChainReconciliationState,
    caller_cpu: usize,
    active_exclusive_token: Option<u64>,
    active_readers: u64,
    audit: G8lS427SourceReachabilityAudit,
) -> Result<G8lS428FullChainReconciliationOutcome, G8lS428FullChainReconciliationError> {
    if caller_cpu != 1 {
        return Err(G8lS428FullChainReconciliationError::WrongCpu);
    }
    if let Some(token) = active_exclusive_token {
        return Err(G8lS428FullChainReconciliationError::ActiveExclusiveLease { token });
    }
    if active_readers != 0 {
        return Err(G8lS428FullChainReconciliationError::ActiveReaders {
            count: active_readers,
        });
    }
    if audit.attempt_id == 0
        || audit.provider_request_id == 0
        || audit.exclusive_token == 0
        || audit.audited_gate_count != S427_AUDITED_GATE_COUNT
        || !audit.main_software_lifecycle_complete
        || !audit.all_direct_access_guarded
        || audit.runtime_observed
        || audit.physical_observed
        || S427_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS != 0
        || S427_PHYSICAL_OBSERVATIONS != 0
        || S428_DIRECT_ACCESS_SITES != 113
        || S428_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES != S428_DIRECT_ACCESS_SITES
        || S428_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES != S428_DIRECT_ACCESS_SITES
        || S428_UNROUTED_DIRECT_ACCESS_SITES != 0
    {
        return Err(G8lS428FullChainReconciliationError::AuditBindingDrift);
    }
    let receipt = G8lS428FullChainReconciliationReceipt {
        attempt_id: audit.attempt_id,
        provider_request_id: audit.provider_request_id,
        exclusive_token: audit.exclusive_token,
        reconciled_gate_count: S428_RECONCILED_GATE_COUNT,
        all_source_gates_reconciled: true,
        no_live_scheduler_access: true,
        runtime_observed: false,
        physical_observed: false,
    };
    if let Some(existing) = state.pending {
        return if existing == receipt {
            Ok(G8lS428FullChainReconciliationOutcome::ReconciliationPending(existing))
        } else {
            Err(G8lS428FullChainReconciliationError::SlotOccupied)
        };
    }
    state.pending = Some(receipt);
    Ok(G8lS428FullChainReconciliationOutcome::ReconciliationPublished(receipt))
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
static S428_PRODUCTION_RECONCILIATIONS: spin::Mutex<G8lS428FullChainReconciliationState> =
    spin::Mutex::new(G8lS428FullChainReconciliationState::new());

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn service_s428_full_chain_reconciliation_on_cpu1(
) -> Result<G8lS428FullChainReconciliationOutcome, G8lS428FullChainReconciliationError> {
    use crate::g8l_runtime_contract::CPU1;

    if crate::percpu::try_current_cpu_id() != Some(CPU1) {
        return Err(G8lS428FullChainReconciliationError::WrongCpu);
    }
    if let Some(existing) = S428_PRODUCTION_RECONCILIATIONS
        .lock()
        .pending_receipt(CPU1)?
    {
        return Ok(G8lS428FullChainReconciliationOutcome::ReconciliationPending(existing));
    }
    let gate = &crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s246_whole_scheduler_read_access_guard::S247_PRODUCTION_WHOLE_SCHEDULER_ACCESS_GATE;
    let active_exclusive_token = gate.active_exclusive_token();
    if let Some(token) = active_exclusive_token {
        return Err(G8lS428FullChainReconciliationError::ActiveExclusiveLease { token });
    }
    let active_readers = gate.active_readers();
    if active_readers != 0 {
        return Err(G8lS428FullChainReconciliationError::ActiveReaders {
            count: active_readers,
        });
    }
    let Some(audit) = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s427_source_reachability_audit::inspect_s427_source_reachability_audit_on_cpu1()
        .map_err(G8lS428FullChainReconciliationError::S427)? else {
        return Ok(G8lS428FullChainReconciliationOutcome::Idle);
    };
    let taken = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s427_source_reachability_audit::take_s427_source_reachability_audit_on_cpu1()
        .map_err(G8lS428FullChainReconciliationError::S427)?
        .ok_or(G8lS428FullChainReconciliationError::AuditDisappeared)?;
    if taken != audit {
        return Err(G8lS428FullChainReconciliationError::AuditDrift);
    }
    service_s428_model_full_chain_reconciliation(
        &mut S428_PRODUCTION_RECONCILIATIONS.lock(),
        CPU1,
        active_exclusive_token,
        active_readers,
        taken,
    )
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn inspect_s428_full_chain_reconciliation_on_cpu1(
) -> Result<Option<G8lS428FullChainReconciliationReceipt>, G8lS428FullChainReconciliationError> {
    S428_PRODUCTION_RECONCILIATIONS.lock().pending_receipt(1)
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn take_s428_full_chain_reconciliation_on_cpu1(
) -> Result<Option<G8lS428FullChainReconciliationReceipt>, G8lS428FullChainReconciliationError> {
    S428_PRODUCTION_RECONCILIATIONS.lock().take(1)
}

use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s427_source_reachability_audit::G8lS427SourceReachabilityAudit;
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s428_full_chain_reconciliation::*;

fn audit() -> G8lS427SourceReachabilityAudit {
    G8lS427SourceReachabilityAudit {
        attempt_id: 17,
        provider_request_id: 18,
        exclusive_token: 19,
        audited_gate_count: 26,
        main_software_lifecycle_complete: true,
        all_direct_access_guarded: true,
        runtime_observed: false,
        physical_observed: false,
    }
}

#[test]
fn constants_extend_the_individual_source_chain_through_s427() {
    assert_eq!(S428_FIRST_RECONCILED_GATE, 401);
    assert_eq!(S428_LAST_RECONCILED_GATE, 427);
    assert_eq!(S428_RECONCILED_GATE_COUNT, 27);
    assert_eq!(S428_DIRECT_ACCESS_SITES, 113);
    assert_eq!(S428_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES, 113);
    assert_eq!(S428_UNROUTED_DIRECT_ACCESS_SITES, 0);
    assert_eq!(S428_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS, 0);
    assert_eq!(S428_PHYSICAL_OBSERVATIONS, 0);
}

#[test]
fn released_gate_and_exact_audit_publish_reconciliation() {
    let mut state = G8lS428FullChainReconciliationState::new();
    let outcome =
        service_s428_model_full_chain_reconciliation(&mut state, 1, None, 0, audit()).unwrap();
    let G8lS428FullChainReconciliationOutcome::ReconciliationPublished(receipt) = outcome else {
        panic!("reconciliation")
    };
    assert_eq!(
        (
            receipt.attempt_id,
            receipt.provider_request_id,
            receipt.exclusive_token
        ),
        (17, 18, 19)
    );
    assert_eq!(receipt.reconciled_gate_count, 27);
    assert!(receipt.all_source_gates_reconciled && receipt.no_live_scheduler_access);
    assert!(!receipt.runtime_observed && !receipt.physical_observed);
}

#[test]
fn live_exclusive_or_reader_membership_fails_closed() {
    let mut state = G8lS428FullChainReconciliationState::new();
    assert_eq!(
        service_s428_model_full_chain_reconciliation(&mut state, 1, Some(77), 0, audit()),
        Err(G8lS428FullChainReconciliationError::ActiveExclusiveLease { token: 77 })
    );
    assert_eq!(
        service_s428_model_full_chain_reconciliation(&mut state, 1, None, 2, audit()),
        Err(G8lS428FullChainReconciliationError::ActiveReaders { count: 2 })
    );
    assert!(!state.pending());
}

#[test]
fn incomplete_or_runtime_claiming_audit_is_rejected() {
    let mut state = G8lS428FullChainReconciliationState::new();
    let mut drift = audit();
    drift.audited_gate_count = 25;
    assert_eq!(
        service_s428_model_full_chain_reconciliation(&mut state, 1, None, 0, drift),
        Err(G8lS428FullChainReconciliationError::AuditBindingDrift)
    );
    let mut drift = audit();
    drift.runtime_observed = true;
    assert_eq!(
        service_s428_model_full_chain_reconciliation(&mut state, 1, None, 0, drift),
        Err(G8lS428FullChainReconciliationError::AuditBindingDrift)
    );
}

#[test]
fn exact_replay_is_pending_and_different_attempt_backpressures() {
    let mut state = G8lS428FullChainReconciliationState::new();
    service_s428_model_full_chain_reconciliation(&mut state, 1, None, 0, audit()).unwrap();
    let receipt = state.pending_receipt(1).unwrap().unwrap();
    assert_eq!(
        service_s428_model_full_chain_reconciliation(&mut state, 1, None, 0, audit()),
        Ok(G8lS428FullChainReconciliationOutcome::ReconciliationPending(receipt))
    );
    let mut next = audit();
    next.attempt_id += 1;
    assert_eq!(
        service_s428_model_full_chain_reconciliation(&mut state, 1, None, 0, next),
        Err(G8lS428FullChainReconciliationError::SlotOccupied)
    );
}

#[test]
fn reconciliation_take_is_cpu1_only_and_one_shot() {
    let mut state = G8lS428FullChainReconciliationState::new();
    service_s428_model_full_chain_reconciliation(&mut state, 1, None, 0, audit()).unwrap();
    assert_eq!(
        state.take(0),
        Err(G8lS428FullChainReconciliationError::WrongCpu)
    );
    assert!(state.take(1).unwrap().is_some());
    assert!(state.take(1).unwrap().is_none());
}

#[test]
fn production_checks_release_before_consuming_s427_and_timer_orders_s428() {
    let source = include_str!("../../kernel/src/g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s428_full_chain_reconciliation.rs");
    let start = source
        .find("service_s428_full_chain_reconciliation_on_cpu1")
        .unwrap();
    let body = &source[start..];
    let pending = body.find("pending_receipt(CPU1)").unwrap();
    let exclusive = body.find("active_exclusive_token()").unwrap();
    let readers = body.find("active_readers()").unwrap();
    let inspect = body
        .find("inspect_s427_source_reachability_audit_on_cpu1")
        .unwrap();
    let take = body
        .find("take_s427_source_reachability_audit_on_cpu1")
        .unwrap();
    let publish = body
        .find("service_s428_model_full_chain_reconciliation")
        .unwrap();
    assert!(
        pending < exclusive
            && exclusive < readers
            && readers < inspect
            && inspect < take
            && take < publish
    );

    let exceptions = include_str!("../../kernel/src/arch/aarch64/exceptions.rs");
    let s427 = exceptions
        .find("service_s427_source_reachability_audit_on_cpu1")
        .unwrap();
    let s428 = exceptions
        .find("service_s428_full_chain_reconciliation_on_cpu1")
        .unwrap();
    let scheduler = exceptions.rfind("rpi5_g7d::on_timer_irq").unwrap();
    assert!(s427 < s428 && s428 < scheduler);
    let name = "g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s428_full_chain_reconciliation";
    assert!(include_str!("../../kernel/src/main.rs").contains(&format!("mod {name};")));
    assert!(include_str!("../src/lib.rs").contains(&format!("pub mod {name};")));
}

  {
    id: "g8l-s428-full-chain-reconciliation-partial",
    sequence: 428,
    slug: "full_chain_reconciliation",
    title: "Full-chain reconciliation",
    focusedTests: 7,
    sourceBytes: 9143,
    sourceSha256:
      "2735910c567dac7f240910e2e8d9e4b2bf93a8daa68e886ff379f62c0e6a16f8",
    testBytes: 6065,
    testSha256:
      "478a5d11a9c48dfb867b7c81019cb32dfc273863f797e69b228d0019a57f1e8f",
    acceptance:
      "S401–S427 arasındaki 27 kapı tek reconciliation receipt'te toplanır; S247 active token/readers sıfır olmadan başarı yayımlanmaz.",
    retainedBoundary:
      "Reconciliation yazılım kanıtıdır; supported-profile runtime ve physical observation sıfır kalır.",
  },