G8l: S179 SGI2 sender source-callsite adaptörü

#![allow(unexpected_cfgs)]

//! S241 CPU1 source-callsite adapter for the exact S240 SGI2 sender.
//!
//! The host model records the terminal CPU/command/sender contract. The
//! production entry point consumes the non-Copy S177 execution permit by
//! value and delegates only to S240. This source boundary is wiring evidence,
//! not evidence that the production scheduler invoked it.

pub const S241_SOURCE_CPU1: usize = 1;
pub const S241_EXPECTED_SGI_COMMAND: u32 = 0x0001_0002;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS241SenderRuntimeCallsitePhase {
    Idle,
    Invoked,
    Failed,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS241SenderRuntimeCallsiteError {
    InvalidPhase,
    WrongCpu,
    SenderRejected,
    WrongCommand,
}

#[derive(Debug)]
pub struct G8lS241SenderRuntimeCallsite {
    phase: G8lS241SenderRuntimeCallsitePhase,
}

impl G8lS241SenderRuntimeCallsite {
    pub const fn new() -> Self {
        Self {
            phase: G8lS241SenderRuntimeCallsitePhase::Idle,
        }
    }

    pub const fn phase(&self) -> G8lS241SenderRuntimeCallsitePhase {
        self.phase
    }

    pub const fn sender_runtime_callsite_wired(&self) -> bool {
        true
    }

    pub const fn runtime_invoked(&self) -> bool {
        matches!(self.phase, G8lS241SenderRuntimeCallsitePhase::Invoked)
    }

    pub fn invoke(
        &mut self,
        caller_cpu: usize,
        sender_result: Result<u32, ()>,
    ) -> Result<u32, G8lS241SenderRuntimeCallsiteError> {
        if self.phase != G8lS241SenderRuntimeCallsitePhase::Idle {
            self.phase = G8lS241SenderRuntimeCallsitePhase::Failed;
            return Err(G8lS241SenderRuntimeCallsiteError::InvalidPhase);
        }
        if caller_cpu != S241_SOURCE_CPU1 {
            self.phase = G8lS241SenderRuntimeCallsitePhase::Failed;
            return Err(G8lS241SenderRuntimeCallsiteError::WrongCpu);
        }
        let command = match sender_result {
            Ok(command) => command,
            Err(()) => {
                self.phase = G8lS241SenderRuntimeCallsitePhase::Failed;
                return Err(G8lS241SenderRuntimeCallsiteError::SenderRejected);
            }
        };
        if command != S241_EXPECTED_SGI_COMMAND {
            self.phase = G8lS241SenderRuntimeCallsitePhase::Failed;
            return Err(G8lS241SenderRuntimeCallsiteError::WrongCommand);
        }
        self.phase = G8lS241SenderRuntimeCallsitePhase::Invoked;
        Ok(command)
    }
}

#[test]
fn s241_reserves_the_existing_s240_sgir_command() {
    assert_eq!(S241_SOURCE_CPU1, 1);
    assert_eq!(S241_EXPECTED_SGI_COMMAND, 0x0001_0002);
}

  {
    id: "g8l-s241-production-migration-lifecycle-s179-execution-caller-notification-sgi-sender-runtime-callsite-partial",
    date: "2026-08-25",
    sequence: 241,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: S179 SGI2 sender source-callsite adaptörü",
    summary:
      "S241 13/13 PASS ile S177'nin non-Copy execution permit'ini by-value alan tek CPU1 source-callsite adaptörünü S240'ın exact SGI2 sender'ına bağladı. Live CPU1 gate başarısızsa permit terminal olarak bırakılır; başarıda S240 S237 publish/arm ve SGIR=0x00010002 yoluna bir kez devredilir. Production scheduler veya CPU1 timer-IRQ bu adaptörü henüz çağırmıyor; canlı S177 request producer, CPU0 wake, hardware delivery, deferred S236 invocation, scheduler mutation, ERET veya fiziksel runtime gözlenmedi.",
    evidence: [
      "S241 focused host grubu iki bağımsız koşuda 13/13 PASS verdi: canonical test-result satırı 95 B / SHA-256 77a722e477a8a66ab195b19a56513dde8937dd0e52e5ddc9a05806a2b9f8c4d7.",
      "RPi5 AArch64 normal/SMP iki byte-equal canonical koşuda PASS verdi: 326610 B / e959df1d…9e3 ve 326552 B / ee0adc0b…fc5; 665 warning başlığı envanterlendi, zero-warning iddiası yoktur.",
      "Exact kaynak sırası: by-value S177 permit → live CPU1 gate → wrong-CPU terminal drop → S240 publish_arm_and_send_s179_notification_sgi_from_cpu1 → exact SGIR/readback. Adapter allocation-free'dir; retry, replacement ve reset state'i taşımaz.",
      "S240 S238/S239/internal dispatch receipt, raw IAR=0x402 ve exact EOI zinciri korunur; S241 yalnız eksik production sender source-callsite adapter sınırını ekler.",
      "Tam workspace'in yedi tarihsel G8h assertion'ı değiştirilmeden dışlandığında kalan 203 grup / 1818 test PASS'tir. Kırmızılar S96/S97 kaynak kimliği, frozen S100 package/Make closure ve S90/S100 arşiv kimliği kapılarıdır; full-workspace GREEN iddia edilmez.",
      "S241 fiziksel/device operasyonu yapmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S241=NO.",
      "Canlı marker: S241_13_OF_13_S177_NONCOPY_PERMIT_BY_VALUE_CPU1_SOURCE_CALLSITE_ADAPTER_S240_SGI2_DELEGATE_EXACT_SGIR_0X00010002_WRONG_CPU_TERMINAL_DROP_NO_RETRY_NO_REPLACEMENT_NO_RESET_RUNTIME_INVOCATION_NOT_OBSERVED_REQUEST_WAKE_HARDWARE_NOT_OBSERVED_DEFERRED_S236_NOT_INVOKED_AARCH64_COMPILED_WORKSPACE_1818_PASS_7_HISTORICAL_G8H_ASSERTIONS_RED_PHYSICAL_QEMU_CPU2_CPU3_HOTPLUG_SOAK_GENERIC_SMP_OPEN_FULL_PHYSICAL_RUNBOOK_VISIBLE_S401_TO_S451_S426_NO_RUNBOOK_EXECUTED_IN_S241_VERIFIED; deployment-specific route/hash evidence is recorded in the project-status manifest.",
    ],
    commands: [
      "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s179_execution_caller_notification_sgi_sender_runtime_callsite -- --test-threads=1",
      "cargo check -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo check -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
    ],
    terminalSessions: [
      {
        id: "s241-g8l-s179-execution-caller-notification-sgi-sender-runtime-callsite",
        title: "G8l S241 S179 SGI2 sender source-callsite adaptörü",
        commandLines: [
          "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s179_execution_caller_notification_sgi_sender_runtime_callsite -- --test-threads=1",
        ],
        outputLines: [
          "test result: ok; S241 focused 1 group / 13 passed; 0 failed",
          "S177 non-Copy permit by-value → live CPU1 gate → exact S240 SGI2 sender callsite",
          "runtime invocation and CPU0 wake/hardware delivery remain unobserved",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "Terminal özeti S241 source-callsite adaptörünü ve fail-closed modelini doğrular; production scheduler invocation veya fiziksel interrupt/wake kanıtı değildir.",
    limitations: [
      "S177 permit'i by-value alan CPU1 source-callsite adaptörü ve S240 delegate source-wired'dır; gerçek production scheduler veya CPU1 timer-IRQ bu adaptörü invoke etmemiştir.",
      "Üretim ağacında bu adaptöre exact S177 iznini sağlayan canlı constructor/cross-CPU request producer henüz yoktur.",
      "S240'ın CPU0 receiver/IRQ/EOI zinciri korunur; request, CPU0 wake, hardware delivery, deferred S236 invocation, scheduler mutation, ERET/context-switch ve present tuple gözlenmemiştir.",
      "QEMU RPi5 GICv2 SGI MMIO yolunu doğrulamaz; fiziksel RPi, CPU2/CPU3, hotplug, soak ve Generic SMP açıktır.",
      "S241 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S241=NO.",
    ],
  },