G8l: CPU1-guarded target-AArch64 dispatch source route

impl G8lTargetAarch64DispatchRoute {
    pub fn new(
        architecture: G8lArchInstructionSeam,
    ) -> Result<Self, G8lTargetAarch64DispatchError> {
        if architecture.phase() != ArchInstructionPhase::TlbiIssued {
            return Err(G8lTargetAarch64DispatchError::InvalidArchitecturePhase);
        }
        if architecture.runtime_instance_id() == 0 {
            return Err(G8lTargetAarch64DispatchError::UnboundRuntimeInstance);
        }
        Ok(Self {
            architecture,
            dispatched_receipt: None,
        })
    }

    /// Dispatch the target-only AArch64 instruction seam.
    ///
    /// This is intentionally unavailable to host builds. A successful return
    /// proves only that the architecture seam returned its receipt; S167 GIC
    /// receipt delivery, S166 scheduler ownership, and context-switch
    /// assembly remain separate acceptance gates.
    #[cfg(all(target_arch = "aarch64", target_os = "none"))]
    pub unsafe fn dispatch_target_aarch64(
        &mut self,
    ) -> Result<ArchInstructionReceipt, G8lTargetAarch64DispatchError> {
        if crate::percpu::try_current_cpu_id() != Some(CPU1) {
            return Err(G8lTargetAarch64DispatchError::WrongExecutionCpu);
        }
        let receipt = unsafe { self.architecture.execute_local_aarch64()? };
        self.dispatched_receipt = Some(receipt);
        Ok(receipt)
    }

    pub const fn architecture_phase(&self) -> ArchInstructionPhase {
        self.architecture.phase()
    }

    pub const fn source_receipt(&self) -> Option<ArchInstructionReceipt> {
        self.architecture.receipt()
    }

    pub const fn dispatched_receipt(&self) -> Option<ArchInstructionReceipt> {
        self.dispatched_receipt
    }

    pub const fn runtime_instance_id(&self) -> u64 {
        self.architecture.runtime_instance_id()
    }

    pub const fn ticket(&self) -> crate::g8l_authority_contract::MigrationTicket {
        self.architecture.ticket()
    }

    pub const fn gic_delivery_wired(&self) -> bool {
        false
    }

    pub const fn scheduler_runtime_wired(&self) -> bool {
        false
    }
}

#[test]
fn target_route_is_source_audited_without_gic_or_scheduler_claims() {
    let source = include_str!("../../kernel/src/g8l_target_aarch64_dispatch.rs");
    assert!(source.contains("#[cfg(all(target_arch = \"aarch64\", target_os = \"none\"))]"));
    assert!(source.contains("pub unsafe fn dispatch_target_aarch64"));
    assert!(source.contains("execute_local_aarch64"));
    assert!(source.contains("try_current_cpu_id() != Some(CPU1)"));
    assert!(source.contains("UnboundRuntimeInstance"));
    assert!(source.contains("gic_delivery_wired(&self) -> bool"));
    assert!(source.contains("scheduler_runtime_wired(&self) -> bool"));
    assert!(!source.contains("send_sgi("));
    assert!(!source.contains("gic::"));
}

  {
    id: "g8l-s171-target-aarch64-dispatch-source-partial",
    date: "2026-08-24",
    sequence: 171,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: CPU1-guarded target-AArch64 dispatch source route",
    summary:
      "S171, S168 `TlbiIssued` seam'ine yalnız target_arch=aarch64 + target_os=none altında derlenen açık `dispatch_target_aarch64` route'unu 4/4 host source test ve board-rpi5 derlemesiyle bağladı. Route nonzero exact S166 runtime-instance bağını ister ve unsafe instruction çağrısından hemen önce production MPIDR decoder ile local CPU=CPU1 kapısını fail-closed uygular. S167 GIC/SGI receipt delivery, S166 scheduler ownership, context-switch assembly, QEMU veya fiziksel çalışma yapmaz; S170 bounded witness hardware-derived olarak yeniden etiketlenmedi.",
    evidence: [
      "g8l_target_aarch64_dispatch: 4/4 PASS; yalnız runtime-bound TlbiIssued kabulü, runtime-unbound/pre-TLBI fail-closed ve production-source audit.",
      "Target-only cfg ve `pub unsafe fn dispatch_target_aarch64` source-visible; route production `try_current_cpu_id()==CPU1` guard'ından sonra S168 `execute_local_aarch64` çağrısını kullanır.",
      "Value-equal fakat S166 runtime-instance kimliği taşımayan TlbiIssued seam `UnboundRuntimeInstance` ile reddedilir.",
      "GIC delivery ve scheduler runtime wiring route üzerinde açıkça false; SGI/GIC/context-switch/QEMU/physical authority iddia edilmez.",
      "Board-rpi5 AArch64 source check başarıyla tamamlandı; mevcut workspace warning'leri korunuyor.",
      "Kalıcı kapsam: `docs/M8.1-RPi5-G8l-S171-Target-AArch64-Dispatch-Source-Proof.md`.",
      "S171 fiziksel/device operasyonu yapmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S171=NO.",
    ],
    commands: [
      "cargo test --quiet --test g8l_target_aarch64_dispatch -- --test-threads=1",
      "cargo check -p aselsan_kernel --no-default-features --features board-rpi5 --target aarch64-unknown-none",
    ],
    terminalSessions: [
      {
        id: "s171-g8l-target-aarch64-dispatch",
        title: "G8l S171 target-only AArch64 dispatch source route",
        commandLines: [
          "cargo test --quiet --test g8l_target_aarch64_dispatch -- --test-threads=1",
        ],
        outputLines: ["running 4 tests", "test result: ok; 4 passed; 0 failed"],
        exitCode: 0,
        outputMode: "selected",
      },
      {
        id: "s171-g8l-target-aarch64-board-check",
        title: "G8l S171 board-rpi5 source check",
        commandLines: [
          "cargo check -p aselsan_kernel --no-default-features --features board-rpi5 --target aarch64-unknown-none",
        ],
        outputLines: ["Finished successfully; existing warnings only"],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S171 CPU1-guarded target-AArch64 source route PASS'tir; production callsite, GIC/SGI delivery ve scheduler-owned migration runtime kanıtı değildir.",
    limitations: [
      "S171 host'ta target-only unsafe method çalıştırmaz; 4/4 test runtime-instance/CPU1 kapılı kaynak rotasını ve fail-closed boundary'yi denetler.",
      "CPU1 MPIDR kontrolü production source'tadır; route'u CPU1'e teslim eden gerçek SGI/GIC/scheduler callsite henüz bağlı değildir.",
      "S171 S168 architecture receipt'i dışında S167 GIC/SGI, S166 scheduler/context-switch, QEMU ve fiziksel RPi authority'si açmaz.",
      "S171 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S171=NO.",
    ],
  },