G8l: AArch64 TTBR0/TLBI instruction seam

use crate::g8l_authority_contract::{MigrationTicket, CPU0, CPU1};
use crate::g8l_runtime_contract::{G8lRuntimeAuthority, RuntimePhase};

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct ArchInstructionInput {
    pub ticket: MigrationTicket,
    pub context_generation: u64,
    pub caller_cpu: usize,
    pub target_cpu: usize,
    pub ttbr0_operand: u64,
    pub irqs_masked: bool,
    pub scheduler_mutation_frozen: bool,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct ArchInstructionReceipt {
    pub task_id: u64,
    pub asid: u16,
    pub generation: u64,
    pub context_generation: u64,
    pub source_cpu: usize,
    pub target_cpu: usize,
    pub ttbr0_operand: u64,
    pub ttbr0_write_order: u8,
    pub tlbi_order: u8,
    pub dsb_before_ttbr0: bool,
    pub dsb_after_tlbi: bool,
    pub isb_after_tlbi: bool,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum ArchInstructionPhase {
    Prepared,
    Ttbr0Installed,
    TlbiIssued,
    Executing,
    Executed,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lArchInstructionError {
    InvalidContextGeneration,
    InvalidCpu,
    IrqMaskRequired,
    SchedulerMutationMustBeFrozen,
    InvalidPhase,
    StaleTicket,
    Ttbr0OperandMismatch,
    RuntimePhaseMismatch,
    RuntimeContextGenerationMismatch,
    RuntimeInputMismatch,
    RuntimeInstructionUnavailable,
}

#[test]
fn receipt_is_bound_to_ticket_and_context_generation() {
    let mut seam = installed();
    let receipt = seam
        .issue_tlbi(CPU0, ticket(), ticket().ttbr0_operand, true, true)
        .unwrap();
    assert_eq!(receipt.task_id, TASK);
    assert_eq!(receipt.asid, ASID);
    assert_eq!(receipt.generation, 1);
    assert_eq!(receipt.context_generation, CONTEXT_GENERATION);
    assert_eq!(receipt.source_cpu, CPU0);
    assert_eq!(receipt.target_cpu, CPU1);
    assert_eq!(receipt.ttbr0_operand, ticket().ttbr0_operand);
}

  {
    id: "g8l-s168-aarch64-ttbr0-tlbi-instruction-seam-partial",
    date: "2026-08-24",
    sequence: 168,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: AArch64 TTBR0/TLBI instruction seam",
    summary:
      "S168, S167 receipt boundary'nin altında target-AArch64 instruction seam'ini 13/13 source-contract ile görünür kıldı: aktif S166 runtime'dan türetilen exact migration ticket/context, production encode_ttbr0 ile yeniden doğrulanan operand, CPU0→CPU1, IRQ-masked + scheduler-mutation-frozen guard'ları ve açık TTBR0 write order=1 → TLBI ASID order=2 ile DSB-before/DSB-after/ISB-after bariyerleri bağlandı. Target-only unsafe seam mevcut production write_ttbr0_to ardından invalidate_asid çağrılarını aynı sırada içeriyor ve TlbiIssued→Executing→Executed exact-once tüketimi ikinci hardware replay'i kapatıyor. Live scheduler caller, GIC/CPU1 receipt, context-switch assembly, QEMU ve fiziksel runtime hâlâ açılmadı.",
    evidence: [
      "g8l_arch_execution_contract: 13/13 PASS; exact TTBR0 order=1 → TLBI order=2 ve DSB/ISB bariyer receipt'i.",
      "Production constructor aktif S166 SwitchPrepared runtime/ticket/context bağına ve production encode_ttbr0 read-back'ine zorunlu; early/duplicate/stale/wrong CPU/operand fail-closed.",
      "Target-only `aarch64-unknown-none` seam mevcut production `write_ttbr0_to` ve `invalidate_asid` helper'larını source order'da çağırıyor; mutable TlbiIssued→Executing→Executed state'i ikinci execution replay'ini reddediyor. Bu source reachability'dir, live runtime invocation değildir.",
      "Kanonik focused log: 128 B / 02983f1a7d644519bfddb0884a6cd0ce69f40c4b845eb54b71ecdc6e19a8ff09; iki tekrar byte/SHA eşit.",
      "Production board-rpi5 source check başarıyla tamamlandı; yalnız mevcut workspace warning'leri kaldı.",
      "Kalıcı kapsam: `docs/M8.1-RPi5-G8l-S168-AArch64-TTBR0-TLBI-Instruction-Seam-Proof.md`.",
      "S168 fiziksel/device operasyonu yapmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S168=NO.",
    ],
    commands: [
      "cargo test --quiet --test g8l_arch_execution_contract -- --test-threads=1",
      "cargo check -p aselsan_kernel --no-default-features --features board-rpi5 --target aarch64-unknown-none",
    ],
    terminalSessions: [
      {
        id: "s168-g8l-aarch64-ttbr0-tlbi-instruction-seam",
        title: "G8l S168 AArch64 TTBR0/TLBI instruction seam",
        commandLines: [
          "cargo test --quiet --test g8l_arch_execution_contract -- --test-threads=1",
        ],
        outputLines: [
          "running 13 tests",
          "test result: ok. 13 passed; 0 failed",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
      {
        id: "s168-g8l-production-board-rpi5-check",
        title: "G8l S168 board-rpi5 production source check",
        commandLines: [
          "cargo check -p aselsan_kernel --no-default-features --features board-rpi5 --target aarch64-unknown-none",
        ],
        outputLines: ["Finished successfully; existing warnings only"],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S168 source seam PASS'tir; target-only unsafe calls production runtime/ticket/context ve exact-once kaynak sınırıyla görünürdür fakat live scheduler/IRQ yolu tarafından çağrılmaz. Hardware-derived receipt, QEMU, physical RPi ve generic SMP runtime sonucu değildir.",
    limitations: [
      "S168 live scheduler caller, GIC/CPU1 receipt and context-switch assembly wiringini açmaz.",
      "Target-only instruction seam source reachability sağlar; actual hardware execution/QEMU/physical boot kanıtı değildir.",
      "S168 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S168=NO.",
    ],
  },