G8g dormant bounded runtime gerçek AArch64 source kapısından geçti

pub const EXPECTED_CPU1_HEAP_OPS: u64 = 0;
pub const EXPECTED_CPU1_UART_WRITES: u64 = 0;
pub const MAX_CPU_INDEX: usize = 4;
pub const MAX_STAGE_PERIODS: u64 = 100;
pub const THIRD_CHECK_MAX_PERIODS: u64 = 1;

pub const SLOT_CPU0: usize = 0;
pub const SLOT_CPU1: usize = 1;
pub const INVALID_SLOT: usize = usize::MAX;

pub const STAGE_IDLE: u64 = 0;
pub const STAGE_ARMED: u64 = 1;
pub const STAGE_IRQ1: u64 = 2;
pub const STAGE_IRQ2: u64 = 3;
pub const STAGE_PARKED: u64 = 4;
pub const STAGE_ERROR: u64 = u64::MAX;

/// Fail-closed logical timer slot lookup.
///
/// Invalid CPU IDs never wrap, modulo, clamp, or alias CPU0.
pub const fn timer_slot(cpu_id: usize) -> Option<usize> {
    if cpu_id < MAX_CPU_INDEX {
        Some(cpu_id)
    } else {
        None
    }
}

/// Absolute CVAL of the most recently processed CPU-local periodic tick.
///
/// A zero period is never a valid timer configuration. Every arithmetic edge
/// is checked so malformed evidence cannot wrap onto an apparently valid
/// deadline.
pub const fn last_processed_cval(start: u64, period: u64, ticks: u64) -> Option<u64> {
    if period == 0 {
        return None;
    }
    let elapsed_counts = match ticks.checked_mul(period) {
        Some(value) => value,
        None => return None,
    };
    start.checked_add(elapsed_counts)
}

/// Absolute CVAL that must be programmed after `ticks` completed deliveries.
///
/// The next deadline is `start + (ticks + 1) * period`; all three operations
/// fail closed on overflow and a zero period is rejected.
pub const fn expected_next_cval(start: u64, period: u64, ticks: u64) -> Option<u64> {
    if period == 0 {
        return None;
    }
    let elapsed_periods = match ticks.checked_add(1) {
        Some(value) => value,
        None => return None,
    };
    let elapsed_counts = match elapsed_periods.checked_mul(period) {
        Some(value) => value,
        None => return None,
    };
    start.checked_add(elapsed_counts)
}

#[test]
fn parked_publication_follows_timer_third_count_and_ppi_quiescence_checks() {
    let runtime = runtime();
    let secondary = between(
        &runtime,
        "pub extern \"C\" fn rpi5_g8g_secondary_run",
        "/// G8g IRQ ownership",
    );
    assert_order(
        secondary,
        &[
            "timer_ctl & 0b11 != 0b10",
            "active_poll_third_deadline(third_cval, period)",
            "IRQ_DELIVERIES.load(Ordering::Acquire) != EXPECTED_CPU1_DELIVERIES",
            "gic::rpi5_g8g_read_secondary_ppi_state(TIMER_PPI)",
            "ppi_state.enabled != ppi_bit",
            "ppi_state.pending != 0",
            "ppi_state.active != 0",
            "THIRD_CHECK_COUNT.store(third_check_count, Ordering::Relaxed);",
            "IRQ_HANDLER_ACTIVE.store(false, Ordering::Release);",
            "STAGE_IRQ2",
            "STAGE_PARKED",
        ],
    );

    let error = between(&runtime, "fn publish_secondary_error", "fn secondary_fail");
    assert!(error.contains("IRQ_HANDLER_ACTIVE.store(false, Ordering::Release)"));
    let prerequisite = between(
        &runtime,
        "pub extern \"C\" fn rpi5_g8g_prerequisite_complete",
        "// End of bounded G8g runtime.",
    );
    assert!(prerequisite.contains("!IRQ_HANDLER_ACTIVE.load(Ordering::Acquire)"));
}

  {
    id: "rpi5-g8g-dormant-bounded-runtime-source-green",
    date: "2026-08-21",
    sequence: 84,
    status: "partial",
    title: "G8g dormant bounded runtime gerçek AArch64 source kapısından geçti",
    summary:
      "Sıra 83 corrected counter sözleşmesinden sonra G8g'nin bounded runtime'ı fail-closed yeniden kuruldu ve yalnız dormant source olarak kabul edildi. CPU0 BOOT8F UART sonrasındaki capture'ın tek sahibidir; capture→release CAS→DSB/SEV sırası, ayrı ARMED-observed handshake, exact iki CPU1 PPI27 delivery/ack/EOI, ilk IRQ'da unmasked dönüş, ikinci IRQ'da timer off+masked, CPU1-owned active raw-CNTVCT third-deadline kontrolü ve PARKED publication donduruldu. CPU0 dört marker'ı ancak PARKED/evidence atomiklerini Acquire-okuduktan sonra yazar. Actual runtime+contract+timer+GIC kaynaklarını board-rpi5 cfg ile typecheck eden AArch64 no_std harness, runtime source matrisi ve actual board-RPi5 kernel check PASS verdi; aggregate 41/41 + CLI + board check, tam simulation 216/216 ve bağımsız reviewer GO'dur. Runtime main/G8f/exception akışından erişilemez: wiring, machine-code/layout, image, microSD, UART ve fiziksel BOOT8G hâlâ STOP'tur.",
    evidence: [
      "Değişmeyen fiziksel prerequisite Sıra 80 BOOT8F raw'ıdır: 17.363 B, mode 0444, e70e1a9a2cf35f9079ee1b1a73d992106bf5ee9a19f1bbf2628582e836ea5068, direct validator PASS ve SCOPE=QUIESCENT_ATOMIC_HANDOFF_ONLY.",
      "Dormant bounded runtime exact 37.982 B / 77b9dc8046a9417ec85aa010e78b7210e67e6a4e5b6b423e40f3db0a4dcf00a0; başarı state machine'i IDLE→ARMED→IRQ1→IRQ2→PARKED, terminal error publication ise ayrı Release store'dur.",
      "Read-only CPU1 PPI snapshot helper'ını taşıyan GIC exact 18.271 B / b00d8cf530dd24d071eb33da82e4a37b1c39148036ebc55b2fe3e3623bda774c; enabled/pending/active state okunur, GIC re-init veya write yapılmaz.",
      "Read-only BOOT8F prerequisite getter'ını taşıyan G8f source exact 23.580 B / 06b770d3f19ac4b3941ccb86eb7cec47a5298c908f1430fa03d125d2d0e9c9df; getter state mutasyonu, UART veya G8g continuation çağrısı yapmaz.",
      "CPU0 `CPU0_CAPTURE_COUNT` değerini release'den önce Release yayımlar; release CAS sonrasındaki notify_peer DSB ISHST→SEV'dir. CPU1 capture'ı Acquire-okur ve `CPU1_START > CPU0_CAPTURE_COUNT` olmadan timer'ı kabul etmez.",
      "CPU1 IRQ maskesini yalnız IDLE→ARMED publication'ın CPU0 tarafından ayrı `ARMED_OBSERVED_BY_CPU0` acknowledgement'ı ile gözlenmesinden sonra açar; bekleme raw CNTVCT ve contract `MAX_STAGE_PERIODS` ile checked/bounded'dır.",
      "İlk PPI27 raw EOI + completion barrier sonrasında exception context unmasked döner; ikinci tur CPU0/UART ilerlemesinden bağımsız gelir. İkinci tur timer'ı off+masked yapar ve context IRQ maskeli kalır.",
      "CPU1 ikinci next-CVAL'e aktif raw-CNTVCT spin ile ulaşır, `THIRD_CHECK_COUNT` ve read-only PPI27 quiescence evidence'ının tek sahibidir; IRQ handler ancak CPU1 + explicit active bayrağında sahiplik alır ve aktifken yanlış INTID/stage'i dispatcher'a düşürmeden fail-closed tüketir.",
      "CPU0 `STAGE_PARKED` ve bütün evidence'ı Acquire-okumadan hiçbir G8g başarı marker'ı yazamaz; CPU1 ve IRQ handler dilimlerinde UART/logging, scheduler, task, heap, SGI, TLBI veya GIC re-init yüzeyi yoktur.",
      "Runtime source acceptance test exact 18.545 B / 423f80dd2e18dc78a1dbeaf295deff7de4a0de16fe5a35094e59f860038f1177 ve 13/13 PASS'tir.",
      "AArch64 compile test exact 1.136 B / d5a1c75c588221db9ea6886d82e7015cc0b2fea4ab6cc4cec9752f46984a6806; harness exact 1.711 B / bd9a6745d9f66f35614ff04e3eb9e287e377f6804a30d3533b5c7678e55083ae.",
      "Compile harness actual g8_contract/g8g_contract/timer/GIC/runtime kaynaklarını `aarch64-unknown-none`, `board-rpi5`, no_std metadata derlemesinde birlikte typecheck eder; yalnız G8f getter, ExceptionContext/TICKS ve arch IRQ guard/control minimal mirror'dır.",
      "Yeni `make verify-rpi5-g8g-runtime` hedefi exact 15.942 B / 91060b60145763ab71634d8d0902929f84c2a34cd83860133fbd1f0160767940 Makefile'dadır; G8f 9/9 + G8g source 7/7 + UART 11/11 + runtime source 13/13 + compile 1/1 = 41/41, CLI ve actual board-RPi5 cargo check PASS.",
      "Tam simulation matrisi 216/216, cargo workspace check, fmt ve diff-check PASS verdi; workspace check'teki 232 mevcut warning hata değildir.",
      "Production reachability taraması main, G8f continuation ve exception dispatcher'da G8g runtime referansı olmadığını doğruladı. Reviewer kararı yalnız dormant source için GO; wiring/layout/image/physical kapsam için STOP'tur.",
      "Sıra 84 source proof exact 8.687 B / 1732119e5bd77ee5920cbe068e2bbd64a1a5903baf70547be63a661601db7aa2; updated staged proof 8.551 B / 980518533544971ed53efe5f65b0d4f41cf9a01253f3ed1876f9330e4f5751aa.",
      "Güncellenmiş Sıra 85–93 roadmap exact 24.363 B / 87c27e95c6fd40b33977f6a8e28097217c5196ac4e6e2abe8990148874798853; sıradaki tek yetkili işlem Sıra 85 IRQ + handoff wiring'dir.",
    ],
    terminalSessionsNote:
      "Oturumlar dormant source semantics, gerçek AArch64 typecheck ve production-unreachable sınırını gösterir. Bunlar machine-code/layout, image veya fiziksel BOOT8G kanıtı değildir.",
    terminalSessions: [
      {
        id: "g8g-dormant-runtime-ordering",
        title: "Bounded state machine, IRQ ownership ve evidence-before-UART",
        commandLines: [
          "cargo test -p aselsan_microkernel_simulation --test rpi5_g8g_runtime_source",
          "audit capture→release→ARMED-observed→IRQ1→IRQ2→third-check→PARKED→markers",
        ],
        outputLines: [
          "rpi5_g8g_runtime_source=13/13 PASS",
          "CPU0 capture owner · CPU1 third-check/PARKED owner=PASS",
          "IRQ1 return=unmasked · IRQ2 final=timer off+masked",
          "G8g UART before PARKED=0 · forbidden CPU1 paths=0",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8g-real-aarch64-runtime-gate",
        title: "Actual AArch64 sources, aggregate gate ve full simulation",
        commandLines: [
          "make verify-rpi5-g8g-runtime",
          "cargo test -p aselsan_microkernel_simulation",
          "cargo check --workspace",
        ],
        outputLines: [
          "contract/runtime aggregate=41/41 PASS · CLI=PASS",
          "actual aarch64-unknown-none + board-rpi5 metadata typecheck=PASS",
          "actual board-rpi5 kernel cargo check=PASS",
          "simulation=216/216 PASS · workspace check=PASS (232 existing warnings)",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8g-sequence84-dormant-stop",
        title: "Production reachability ve reviewer kapsam kararı",
        commandLines: [
          "scan main, G8f continuation and exception dispatcher for G8g runtime references",
          "independent reviewer rerun and source-semantics audit",
        ],
        outputLines: [
          "production_g8g_reachability=ABSENT",
          "reviewer verdict=GO FOR DORMANT SOURCE ONLY",
          "next authorized gate=Sequence 85 IRQ + handoff wiring",
          "layout/image/SD/UART/physical BOOT8G=STOP",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    limitations: [
      "Bu kayıt yalnız dormant bounded runtime source, AArch64 typecheck ve supporting read-only API kanıtıdır; production runtime veya fiziksel BOOT8G PASS değildir.",
      "Compile harness actual timer/GIC/contract/runtime kaynaklarını içerir; G8f prerequisite, ExceptionContext/TICKS ve arch IRQ guard/control minimal mirror'dır. Nihai production instruction/call/store kanıtı değildir.",
      "`main.rs`, G8f CPU0/CPU1 continuation seam'leri ve exception dispatcher interceptor'ı G8g'ye bağlı değildir; runtime production ELF'ten erişilemez.",
      "Machine-code/layout Sıra 86'ya aittir. Önce Sıra 85 wiring yeşil olmadan production image veya package üretilmez.",
      "Yeni image/package üretilmedi; microSD, UART, Debug Probe ve Pi güç durumuna dokunulmadı. Son fiziksel PASS Sıra 80 BOOT8F'tir.",
      "Generic SMP, CPU1 preemption, runqueue, migration, TLBI, CPU2/CPU3, soak ve hotplug kapalıdır.",
      "Production deployment dirty/untracked workspace ve stale 47d22c9 source etiketiyle yapılır; canlı artifact doğrulansa da Git-provider provenance kurulmuş sayılmaz.",
    ],
  },