G8l: production migration-lifecycle exact S179 execution-caller one-shot CPU1→CPU0 transport

/// Take the exact published S179 caller once on live source CPU0.
///
/// This is a polling ownership boundary, not proof that CPU0 was notified or
/// that S231/downstream production execution occurred.
#[cfg(all(target_arch = "aarch64", target_os = "none"))]
pub fn take_production_s179_execution_caller_on_cpu0(
) -> Result<G8lTargetDispatchExecutionCaller, G8lProductionS179ExecutionCallerTakeError> {
    use crate::g8l_runtime_contract::CPU0;

    if crate::percpu::try_current_cpu_id() != Some(CPU0) {
        return Err(G8lProductionS179ExecutionCallerTakeError::WrongSourceCpu);
    }

    let _irq_guard = crate::arch::aarch64::IrqGuard::new();
    G8L_PRODUCTION_S179_CPU1_TO_CPU0_TRANSPORT
        .lock()
        .take()
        .map_err(|error| match error {
            G8lS179ExecutionCallerTakeError::Empty => {
                G8lProductionS179ExecutionCallerTakeError::Empty
            }
            G8lS179ExecutionCallerTakeError::Consumed => {
                G8lProductionS179ExecutionCallerTakeError::Consumed
            }
        })
}

#[test]
fn s235_does_not_invoke_s231_s232_scheduler_gic_eret_or_physical_paths() {
    let source = include_str!("../../kernel/src/g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s179_execution_caller_transport.rs");
    for forbidden in [
        "prepare_production_s187_handoff_from_production_s179_execution_caller(",
        "publish_runtime_owner_tuple_from_s178_execution_receipt(",
        "task::scheduler",
        "SCHEDULER",
        "gic::",
        "send_sgi",
        "eret()",
        "power_on",
        "sd_card",
    ] {
        assert!(
            !source.contains(forbidden),
            "forbidden S235 marker: {forbidden}"
        );
    }
}

  {
    id: "g8l-s235-production-migration-lifecycle-s179-execution-caller-transport-partial",
    date: "2026-08-25",
    sequence: 235,
    status: "passed",
    umbrella_status: "partial",
    title:
      "G8l: production migration-lifecycle exact S179 execution-caller one-shot CPU1→CPU0 transport",
    summary:
      "S235 15/15 PASS ile S233'ün exact S178 receipt üretimini ve S234'ün exact S179 caller constructor'ını birer kez kullanan target CPU1 producer'ı, tahsissiz spin::Mutex korumalı tek-yuva transportu ve live CPU0 exact-once take kapısını source/ABI olarak bağladı. Slot yalnız Empty→Published→Consumed ilerler; occupied ilk caller'ı değiştirmez, consumed slot resetlenmez. Bu bir polling ownership publication/take sınırıdır: SGI/IPI notification, S231/S232/downstream, runtime/authority transportu, scheduler mutasyonu ve fiziksel runtime bağlı değildir.",
    evidence: [
      "S235 focused grubu iki bağımsız byte-equal koşuda 15/15 PASS verdi: 130 B / SHA-256 0447f2fe9dc6fdf30815a6962cf23d978425e51bef2acde1efb27e5da13a78b3.",
      "S234 target constructor + S235 transport matrisi iki byte-equal koşuda 2 grup / 28/28 PASS verdi: 258 B / SHA-256 7d1e7e811803f0cb62440758d84add06c4c95e3a017ec356272449cdd41f41c2.",
      "S166–S178 target execution bağımlılıkları + S233/S234/S235 matrisi iki byte-equal koşuda 16 grup / 144/144 PASS verdi: 1964 B / SHA-256 5d476e41c898816444722c10638639b58445b35fdc7e4c29de7224d9b5e04071. Bu matris gerçek interrupt bildirimi veya CPU0 consumer callsite kanıtı değildir.",
      "RPi5 AArch64 compile PASS: 630 warning envanterlendi; 309956 B / SHA-256 66eecce14f6c471a54ee269915a89baaa468aa6d7ac85a2179a4345927e8cfc9. smp: 630 warning, 309898 B / SHA-256 675debf2d927c23b3b5d8b8e588905d90aeab0235d55ce0121ec65d03af34dd9. Zero-warning iddiası yoktur.",
      "Tam workspace 149 tamamen yeşil grup / 1440 testten sonra yalnız frozen S96 exceptions.S identity assertion'ında kırmızı kaldı; kırılan grubun diğer 8 testi geçti. Full GREEN iddia edilmedi.",
      "Kalıcı kapsam: docs/M8.1-RPi5-G8l-S235-Migration-Lifecycle-S179-Execution-Caller-Transport-Proof.md.",
      "S235 production publisher live CPU1'i, consumer live CPU0'ı donanımdan doğrular; iki lock yolu da local IrqGuard altında çalışır. Exact accepted S179 caller yalnız bir kez alınır; wrong CPU/occupied/consumed production hataları replacement veya retry authority döndürmez.",
      "S235 fiziksel/device operasyonu yapmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S235=NO.",
      "Canlı marker: S235_15_OF_15_MIGRATION_LIFECYCLE_S179_EXECUTION_CALLER_ONE_SHOT_CPU1_TO_CPU0_TRANSPORT_EMPTY_PUBLISHED_CONSUMED_EXACT_NONCOPY_S233_ONCE_S234_ONCE_CPU1_PUBLISH_GATE_CPU0_TAKE_GATE_IRQ_MASKED_SPIN_MUTEX_ALLOCATION_FREE_FIRST_CALLER_NO_REPLACEMENT_TAKE_EXACTLY_ONCE_NO_RESET_NO_RETRY_S231_S232_NOT_INVOKED_NO_SGI_IPI_NOTIFICATION_PRESENT_REQUEST_NOT_OBSERVED_RUNTIME_AUTHORITY_NOT_TRANSPORTED_LEGACY_SCHEDULER_ACCESSES_UNCOVERED_WHOLE_SCHEDULER_GIC_HARDWARE_QEMU_PHYSICAL_CPU2_CPU3_HOTPLUG_SOAK_GENERIC_SMP_OPEN_FULL_PHYSICAL_RUNBOOK_VISIBLE_S395_TO_S445_S420_NO_RUNBOOK_EXECUTED_IN_S235_VERIFIED; deployment-specific route/hash evidence is recorded in the project-status manifest.",
    ],
    commands: [
      "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s179_execution_caller_transport -- --test-threads=1",
      "cargo check -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo check -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
      "cargo test --workspace --quiet -- --test-threads=1",
    ],
    terminalSessions: [
      {
        id: "s235-g8l-production-migration-lifecycle-s179-execution-caller-transport",
        title: "G8l S235 one-shot exact S179 caller transport",
        commandLines: [
          "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s179_execution_caller_transport -- --test-threads=1",
        ],
        outputLines: [
          "test result: ok; 15 passed; 0 failed",
          "exact non-Copy path is ordered once as S233 receipt → S234 caller → S235 publication",
          "one-shot slot is allocation-free and terminal: Empty → Published → Consumed",
          "live CPU1 publisher and live CPU0 taker mask local IRQs around the shared spin mutex",
          "no SGI/IPI notification, S231/S232 invocation, runtime/authority transport, scheduler mutation or physical operation",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "Terminal özeti S235 exact S179 caller'ın CPU1'den ortak one-shot slota yayınlanıp CPU0 tarafından bir kez alınabilen source/ABI sınırını gösterir; CPU0 notification, downstream runtime veya fiziksel cihaz çalıştırması değildir.",
    limitations: [
      "S235 shared slotu boot başına tek accepted caller ile sınırlıdır; generation-bound rearm yoktur. CPU0 notification/consumer callsite ve S231/S232 downstream invoke edilmez.",
      "Runtime ile scheduler-owner authority CPU0'a taşınmaz. Production scheduler mutation, whole-scheduler exclusion, GIC/SGI delivery, ERET/context-switch assembly, QEMU present-tuple yolu, fiziksel RPi, CPU2/CPU3, hotplug, soak ve Generic SMP açıktır.",
      "S235 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S235=NO.",
    ],
  },