S375 · EL0 IPC CALL reply-alias production writer guard integration

/// Basit syscall dispatch + handler.
/// x8 = syscall numarası
/// x0..x5 = argümanlar (yazma için: x0=fd, x1=buf, x2=len)
#[no_mangle]
pub extern "C" fn rust_el0_sync_handler(ctx: &mut ExceptionContext) {
    let esr: u64;
    unsafe { core::arch::asm!("mrs {0}, esr_el1", out(reg) esr, options(nomem, nostack)) };

    // The physical RPi5 G7c gate owns only its explicitly armed two-SVC
    // window.  A handled SVC returns through this vector's ordinary
    // RESTORE_CONTEXT + eret path; none of the legacy noreturn user-return or
    // scheduler/task-exit paths are entered.
    #[cfg(feature = "board-rpi5")]
    if crate::rpi5_g7c::try_handle_sync(ctx, esr) {
        return;
    }

    if crate::percpu::current_cpu_id() != 0 {
        // Generic EL0 scheduling is deliberately CPU0-only until K3 provides
        // per-CPU current-task state and migration-safe run queues.
        crate::arch::aarch64::disable_irqs();
        loop {
            unsafe { core::arch::asm!("wfe", options(nomem, nostack)) }
        }
    }

    let ec = (esr >> 26) & 0x3f;

    if !exception_originated_from_el0(ctx) {
        kprintln!("\n[M4] lower-EL sync vector received a privileged-origin frame");
        kprintln!("  ESR_EL1 = 0x{:016x}", esr);
        dump_context(ctx);
        panic!("non-EL0 frame reached lower-EL synchronous handler");
    }
    if !scheduler_tracks_current_el0_task() {
        kprintln!("\n[M4] EL0 frame has no live user task owner");
        dump_context(ctx);
        panic!("cannot contain lower-EL fault without a live user task");
    }

    if ec != 0x15 {
        // M5.5 + Multi-core: Data Abort handling
        if ec == 0x24 {
            let far: u64;
            unsafe { core::arch::asm!("mrs {0}, far_el1", out(reg) far, options(nomem, nostack)) };

            if handle_el0_data_abort(far, ctx) {
                return;
            }

            let task_id = crate::task::current_task_id()
                .expect("live EL0 fault containment requires the tracked task id");
            kprintln!(
                "[EL0-FAULT-CONTAINMENT] task#{} EC=0x{:02x} FAR_EL1=0x{:016x} ACTION=TERMINATE_CURRENT_EL0_TASK",
                task_id,
                ec,
                far,
            );
        }

        kprintln!("\n[M4] EL0 AArch64 Sync Exception (SVC değil)");
        kprintln!(
            "  ESR_EL1 = 0x{:016x}  (EC=0x{:02x} → {})",
            esr,
            ec,
            decode_ec(esr)
        );
        kprintln!("  ELR_EL1 = 0x{:016x}", ctx.elr_el1);
        dump_context(ctx);
        unsafe {
            crate::task::scheduler::terminate_current_task_due_to_fatal_error(
                lower_el_fault_reason(ec),
                Some(&*ctx),
            );
        }
    }

    // No timer-driven context switch may occur while a syscall holds a
    // capability, endpoint or scheduler lock. Every successful syscall return
    // uses ERET with the saved EL0 SPSR, which restores the caller's IRQ mask.
    crate::arch::aarch64::disable_irqs();

    let syscall_num = ctx.gpr[8];
    let user_sp: u64;
    unsafe {
        core::arch::asm!("mrs {0}, sp_el0", out(reg) user_sp, options(nomem, nostack));
    }

    // Syscall işleyip dönüş değerini x0'a yazacağız
    let ret: u64 = match syscall_num {
        SYS_YIELD => {
            // A yield may resume this same kernel continuation only after an
            // arbitrary peer ran. Check the carrier before that switch; the
            // common return boundary below deliberately does not run a
            // second time after the continuation resumes.
            #[cfg(feature = "board-qemu")]
            unsafe {
                if let Err(error) = crate::task::execute_armed_current_runtime_oom_if_target() {
                    panic!("S137 pre-yield EL0 SVC safe boundary failed: {:?}", error);
                }
            }
            static mut YIELD_COUNT: u64 = 0;
            let count = unsafe {
                YIELD_COUNT = YIELD_COUNT.wrapping_add(1);
                YIELD_COUNT
            };

            if count <= 5 || count % 5000 == 0 {
                kprintln!(
                    "[M4.3-DEBUG] User yield #{} | ELR=0x{:x}",
                    count,
                    ctx.elr_el1
                );
            }

            unsafe {
                crate::task::save_user_context_for_yield(ctx, user_sp);
                crate::task::yield_now();
            }
            0
        }

        SYS_WRITE => {
            // fd, buf, len
            let fd = ctx.gpr[0] as usize;
            let user_address = ctx.gpr[1];
            let len = ctx.gpr[2] as usize;

            if fd != 1 {
                kprintln!(
                    "[M4.3] sys_write: sadece fd=1 (stdout) destekleniyor (fd={})",
                    fd
                );
                u64::MAX
            } else {
                let mut fixed = [0u8; crate::user_copy::MAX_USER_COPY];
                match crate::user_copy::copy_from_current_user(&mut fixed, user_address, len) {
                    Ok(written) => {
                        #[cfg(feature = "board-qemu")]
                        crate::task::observe_qemu_el0_ipc_return_marker(
                            crate::task::current_task_id().unwrap_or(0),
                            &fixed[..written],
                        );
                        #[cfg(feature = "board-qemu")]
                        crate::task::observe_qemu_s134_ipc_marker(
                            crate::task::current_task_id().unwrap_or(0),
                            &fixed[..written],
                        );
                        #[cfg(feature = "board-qemu")]
                        crate::task::observe_qemu_s135_ipc_marker(
                            crate::task::current_task_id().unwrap_or(0),
                            &fixed[..written],
                        );
                        for &byte in &fixed[..written] {
                            if byte == b'\n' {
                                crate::kprint!("\r\n");
                            } else {
                                crate::kprint!("{}", byte as char);
                            }
                        }
                        written as u64
                    }
                    Err(error) => {
                        kprintln!(
                            "[K1-COPYIN] sys_write rejected ptr=0x{:x} len={} error={:?}",
                            user_address,
                            len,
                            error
                        );
                        u64::MAX
                    }
                }
            }
        }

        SYS_EXIT => {
            let status = ctx.gpr[0] as i32;
            kprintln!("[M4.3-DEBUG] === SYS_EXIT called from EL0 ===");
            kprintln!(
                "[M4.3-DEBUG] status={}, ELR=0x{:x}, current_task will be marked Dead",
                status,
                ctx.elr_el1
            );
            unsafe {
                crate::task::task_exit();
            }
            // unreachable
        }

        // M6.3 — Gerçek mesaj kopyalama + Reply Cap + basit Call akışı
        crate::ipc::SYS_MINT_ENDPOINT => {
            let badge = ctx.gpr[0];
            let Some(current_id) = crate::task::current_task_id() else {
                ctx.gpr[0] = 0;
                kprintln!("[K2-MINT] endpoint mint rejected: no current task");
                return;
            };
            match crate::ui::mint_endpoint(current_id, badge) {
                Ok(cap) => {
                    ctx.gpr[0] = cap.id;
                    kprintln!(
                        "[M7.2] User task {} yeni endpoint mint etti: id={}",
                        current_id,
                        cap.id
                    );
                }
                Err(error) => {
                    // CapId zero is permanently invalid and is the frozen
                    // scalar failure result for SYS_MINT_ENDPOINT.
                    ctx.gpr[0] = 0;
                    kprintln!(
                        "[K2-MINT] endpoint mint rejected task={}: {}",
                        current_id,
                        error
                    );
                }
            }
            return;
        }

        crate::ipc::SYS_LIST_ENDPOINTS => {
            let current_id = crate::task::current_task_id().unwrap_or(0);
            let endpoints = crate::ui::endpoints_of_task(current_id);

            // M7 audit fix #7: magic 6 yerine explicit const.
            // SYS_LIST_ENDPOINTS dönüş ABI'si: x0=count, x1..x6=ep ids (en fazla 6).
            const MAX_ENDPOINT_LIST_RETURN: usize = 6;
            let count = endpoints.len().min(MAX_ENDPOINT_LIST_RETURN);
            ctx.gpr[0] = count as u64;

            for i in 0..count {
                ctx.gpr[i + 1] = endpoints[i].id;
            }

            kprintln!(
                "[M7.2] Task {} endpoint listesi istendi ({} tane)",
                current_id,
                count
            );
            return;
        }

        SYS_IPC_CALL_TIMEOUT => {
            handle_ipc_call_timeout(ctx, user_sp);
            return;
        }

        SYS_IPC_RECV_TIMEOUT => {
            handle_ipc_recv_timeout(ctx, user_sp);
            return;
        }

        SYS_NOTIFICATION_SIGNAL => {
            handle_notification_signal(ctx);
            return;
        }

        SYS_NOTIFICATION_WAIT_TIMEOUT => {
            handle_notification_wait_timeout(ctx, user_sp);
            return;
        }

        SYS_IPC_CALL => {
            let target_id = ctx.gpr[0];
            let label = ctx.gpr[1];
            let mr0 = ctx.gpr[2];
            let mr1 = ctx.gpr[3];
            let mr2 = ctx.gpr[4];
            let mr3 = ctx.gpr[5];

            let current_id = crate::task::current_task_id().unwrap_or(0);
            kprintln!(
                "[M7] SYS_IPC_CALL task={} → target={}, label=0x{:x}",
                current_id,
                target_id,
                label
            );

            // Resolve only immutable routing metadata; cloning an endpoint
            // would copy its complete rendezvous state and is never authority.
            let Some(target_is_reply) = crate::ui::capability::ENDPOINT_REGISTRY
                .lock()
                .iter()
                .find(|endpoint| endpoint.id == target_id)
                .map(|endpoint| endpoint.is_reply_cap)
            else {
                set_ipc_error(ctx, IpcError::InvalidCapability);
                return;
            };

            if target_is_reply {
                // S143 production broker commits are derived only from the
                // explicit SYS_IPC_REPLY ABI. The legacy CALL-to-reply alias
                // must not consume an armed one-shot authority behind the
                // bridge's preflight/commit boundary.
                if crate::mm::runtime_oom_reply_cap_is_bound(target_id) {
                    kprintln!(
                        "[K1-MEM2-REPLY-BRIDGE] CALL_ALIAS_REJECTED reply_cap={} task={}",
                        target_id,
                        current_id
                    );
                    set_ipc_error(ctx, IpcError::InvalidCapability);
                    return;
                }
                let reply_message = crate::ui::capability::IpcMessage {
                    label,
                    badge: current_id,
                    data: [mr0, mr1, mr2, mr3],
                };
                #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
                let s375_irq_guard = crate::arch::aarch64::IrqGuard::new();
                #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
                let s375_writer_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s375_el0_ipc_call_reply_alias_writer_guard_integration::acquire_s375_production_scheduler_writer_access()
                    .unwrap_or_else(|error| {
                        panic!(
                            "S375 EL0 IPC-call reply-alias scheduler writer guard failed closed: {:?}",
                            error
                        )
                    });
                let result = unsafe {
                    let scheduler =
                        &mut *core::ptr::addr_of_mut!(crate::task::scheduler::SCHEDULER);
                    scheduler.ipc_reply_commit(target_id, reply_message)
                };
                #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
                drop(s375_writer_access);
                #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
                drop(s375_irq_guard);
                set_ipc_error(ctx, result);
                return;
            }

            // A raw endpoint id is never EL0 authority. Kernel-shared and
            // task-owned endpoints alike require a live CNode entry.
            let endpoint_cap = crate::task::current_task_cnode()
                .and_then(|cnode| cnode.lookup_capability_by_id(target_id).copied())
                .filter(|capability| {
                    capability.kind == crate::ui::capability::CapabilityKind::Endpoint
                });
            let has_cap = endpoint_cap.is_some();

            if !has_cap {
                kprintln!(
                    "[M6.4] CALL REJECTED task={} target={} (owner mismatch / no cap)",
                    current_id,
                    target_id
                );
                set_ipc_error(ctx, IpcError::InvalidCapability);
                return;
            }
            let endpoint_generation = endpoint_cap
                .expect("validated endpoint capability disappeared")
                .generation;

            // CALL always requires SEND. Receiving has a separate syscall;
            // registry ownership never changes syscall semantics or authority.
            let rights_ok = endpoint_cap.map_or(false, |capability| {
                capability
                    .rights
                    .contains(crate::ui::capability::CapabilityRights::ENDPOINT_SEND)
            });
            if !rights_ok {
                kprintln!(
                    "[M7.5] HAK İHLALİ! task={} target={} (rights eksik)",
                    current_id,
                    target_id
                );
                set_ipc_error(ctx, IpcError::InvalidCapability);
                return;
            }

            // ===================== SEND / CALL PATH (M7 gerçek Call/Reply) =====================
            // Mesaj + reply_cap gönderilir, client reply_cap üzerinde bloke olur.
            // Server reply_cap'e CALL yapınca client uyanır.

            let msg = crate::ui::capability::IpcMessage {
                label,
                badge: current_id,
                data: [mr0, mr1, mr2, mr3],
            };

            let reply_cap = match crate::ui::mint_reply_endpoint_for_call(current_id, target_id) {
                Ok(capability) => capability,
                Err(error) => {
                    kprintln!(
                        "[K2-MINT] reply mint rejected task={}: {}",
                        current_id,
                        error
                    );
                    set_ipc_error(ctx, IpcError::InvalidCapability);
                    return;
                }
            };

            #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
            let s374_irq_guard = crate::arch::aarch64::IrqGuard::new();
            #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
            let s374_writer_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s374_el0_ipc_call_writer_guard_integration::acquire_s374_production_scheduler_writer_access()
                .unwrap_or_else(|error| {
                    panic!(
                        "S374 normal EL0 IPC-call scheduler writer guard failed closed: {:?}",
                        error
                    )
                });

            let commit = unsafe {
                let scheduler = &mut *core::ptr::addr_of_mut!(crate::task::scheduler::SCHEDULER);
                #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
                let commit = scheduler.ipc_call_commit_and_park(
                    ctx,
                    user_sp,
                    target_id,
                    endpoint_generation,
                    reply_cap.id,
                    msg,
                    s374_irq_guard,
                    s374_writer_access,
                );
                #[cfg(not(all(
                    target_arch = "aarch64",
                    target_os = "none",
                    feature = "board-rpi5"
                )))]
                let commit = scheduler.ipc_call_commit_and_park(
                    ctx,
                    user_sp,
                    target_id,
                    endpoint_generation,
                    reply_cap.id,
                    msg,
                );
                commit
            };
            if let Err(error) = commit {
                let _ = crate::ui::capability::discard_unpublished_reply_endpoint(
                    reply_cap.id,
                    Some(current_id),
                );
                if error == IpcError::QueueFull {
                    kprintln!(
                        "[K2] CALL QueueFull task={} target={} capacity={}",
                        current_id,
                        target_id,
                        IPC_QUEUE_CAPACITY
                    );
                }
                set_ipc_error(ctx, error);
                return;
            }
            // A parked CALL resumes this exact exception continuation. The
            // scheduler copied the durable wake payload back into `ctx`.
            return;
        }

        // M6.4 — Server tarafı: pending mesaj varsa al, yoksa block.
        // Argümanlar: x0 = endpoint_id
        // Dönüş: x0 = IpcError (M7.1)
        //        x1 = label, x2 = badge, x3..x6 = data[0..3]
        //        x7 = reply_cap_id (0 = reply yok, sadece SEND)
        SYS_IPC_RECV => {
            let ep_id = ctx.gpr[0];
            let current_id = crate::task::current_task_id().unwrap_or(0);
            kprintln!("[M6.4] SYS_IPC_RECV task={} ep={}", current_id, ep_id);

            // A raw endpoint id or registry ownership is not receive
            // authority. Revocation takes effect as soon as the CNode entry
            // disappears.
            let endpoint_cap = crate::task::current_task_cnode()
                .and_then(|cnode| cnode.lookup_capability_by_id(ep_id).copied())
                .filter(|capability| {
                    capability.kind == crate::ui::capability::CapabilityKind::Endpoint
                });
            let has_valid_ep = endpoint_cap.is_some();

            if !has_valid_ep {
                kprintln!(
                    "[M6.4] RECV REJECTED task={} ep={} (owner mismatch / no cap)",
                    current_id,
                    ep_id
                );
                set_ipc_error(ctx, IpcError::InvalidCapability);
                return;
            }
            let endpoint_generation = endpoint_cap
                .expect("validated endpoint capability disappeared")
                .generation;

            // M7 audit fix #4: RECV hakkı kontrolü.
            // Eskiden SYS_IPC_RECV hiç rights check etmiyordu — sadece SYS_IPC_CALL.
            let recv_rights_ok = endpoint_cap.map_or(false, |capability| {
                capability
                    .rights
                    .contains(crate::ui::capability::CapabilityRights::ENDPOINT_RECV)
            });
            if !recv_rights_ok {
                kprintln!(
                    "[M7.5] RECV REJECTED task={} ep={} (RECV hakkı yok)",
                    current_id,
                    ep_id
                );
                set_ipc_error(ctx, IpcError::InvalidCapability);
                return;
            }

            #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
            let s373_irq_guard = crate::arch::aarch64::IrqGuard::new();
            #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
            let s373_writer_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s373_el0_ipc_receive_writer_guard_integration::acquire_s373_production_scheduler_writer_access()
                .unwrap_or_else(|error| {
                    panic!(
                        "S373 EL0 IPC-receive scheduler writer guard failed closed: {:?}",
                        error
                    )
                });
            let receive = unsafe {
                let scheduler = &mut *core::ptr::addr_of_mut!(crate::task::scheduler::SCHEDULER);
                #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
                let receive = scheduler.ipc_recv_or_park(
                    ctx,
                    user_sp,
                    ep_id,
                    endpoint_generation,
                    s373_irq_guard,
                    s373_writer_access,
                );
                #[cfg(not(all(
                    target_arch = "aarch64",
                    target_os = "none",
                    feature = "board-rpi5"
                )))]
                let receive = scheduler.ipc_recv_or_park(ctx, user_sp, ep_id, endpoint_generation);
                receive
            };
            match receive {
                Ok(Some(envelope)) => {
                    set_ipc_message_result(ctx, envelope.message, envelope.reply_cap_id);
                    return;
                }
                // The registered waiter was parked and has now resumed; its
                // wake result was copied from Task.saved_user_gprs into ctx.
                Ok(None) => return,
                Err(error) => {
                    set_ipc_error(ctx, error);
                    return;
                }
            }
        }

        // M6.4 — Server cevap verir + reply cap one-shot revoke.
        // Argümanlar: x0 = reply_cap_id
        //             x1 = label, x2..x5 = data[0..3]
        SYS_IPC_REPLY => {
            let reply_cap_id = ctx.gpr[0];
            let label = ctx.gpr[1];
            let mr0 = ctx.gpr[2];
            let mr1 = ctx.gpr[3];
            let mr2 = ctx.gpr[4];
            let mr3 = ctx.gpr[5];

            let current_id = crate::task::current_task_id().unwrap_or(0);
            kprintln!(
                "[M6.4] SYS_IPC_REPLY task={} reply_cap={} label=0x{:x}",
                current_id,
                reply_cap_id,
                label
            );

            let reply_msg = crate::ui::capability::IpcMessage {
                label,
                badge: current_id,
                data: [mr0, mr1, mr2, mr3],
            };
            let bridge_preflight: Result<
                Option<crate::mm::RuntimeOomReplyPreflight>,
                crate::mm::RuntimeOomReplyBridgeError,
            > = crate::mm::preflight_runtime_oom_supervisor_reply(
                current_id,
                reply_cap_id,
                reply_msg.label,
                reply_msg.data,
            );
            let bridge_preflight = match bridge_preflight {
                Ok(preflight) => preflight,
                Err(error) => {
                    kprintln!(
                        "[K1-MEM2-REPLY-BRIDGE] PREFLIGHT_REJECTED task={} reply_cap={} error={:?}",
                        current_id,
                        reply_cap_id,
                        error
                    );
                    set_ipc_error(ctx, IpcError::InvalidCapability);
                    return;
                }
            };
            #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
            let s372_irq_guard = crate::arch::aarch64::IrqGuard::new();
            #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
            let s372_writer_access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s372_el0_ipc_reply_writer_guard_integration::acquire_s372_production_scheduler_writer_access()
                .unwrap_or_else(|error| {
                    panic!(
                        "S372 EL0 IPC-reply scheduler writer guard failed closed: {:?}",
                        error
                    )
                });
            let result = unsafe {
                let scheduler = &mut *core::ptr::addr_of_mut!(crate::task::scheduler::SCHEDULER);
                scheduler.ipc_reply_commit(reply_cap_id, reply_msg)
            };
            #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
            drop(s372_writer_access);
            #[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
            drop(s372_irq_guard);
            if result == IpcError::Ok {
                if let Some(preflight) = bridge_preflight {
                    let event = crate::mm::commit_runtime_oom_supervisor_reply(
                        preflight,
                        TICKS.load(Ordering::Acquire),
                    )
                    .unwrap_or_else(|error| {
                        panic!(
                            "reply committed but runtime OOM broker bridge failed closed: {:?}",
                            error
                        )
                    });
                    kprintln!(
                        "[K1-MEM2-REPLY-BRIDGE] task={} reply_cap={} sequence={} source_event={} REPLY_DERIVED_BROKER_COMMIT=YES SESSION_CLOSE=AUTOMATIC",
                        current_id,
                        reply_cap_id,
                        event.sequence_id(),
                        event.source_event_id(),
                    );
                }
            }
            kprintln!(
                "[K2.1] REPLY result={:?} reply_cap consumed (registry+CNode+store)",
                result
            );

            set_ipc_error(ctx, result);
            return;
        }

        _ => {
            kprintln!("[M4.3] bilinmeyen syscall: x8={}", syscall_num);
            dump_context(ctx);
            u64::MAX
        }
    };

    // Dönüş değerini x0'a yaz (user koddan okunabilir)
    ctx.gpr[0] = ret;

    // S137 common EL0 SVC safe boundary: an armed current-task teardown is
    // independent of the syscall kind and of SYS_WRITE success. The syscall
    // result is committed to the saved frame before the audited carrier may
    // retire the task and switch to a different kernel stack.
    #[cfg(feature = "board-qemu")]
    if syscall_num != SYS_YIELD {
        unsafe {
            if let Err(error) = crate::task::execute_armed_current_runtime_oom_if_target() {
                panic!("S137 common EL0 SVC safe boundary failed: {:?}", error);
            }
        }
    }

    // Return normally to exceptions.S. It owns the one RESTORE_CONTEXT+eret
    // epilogue for every non-fatal EL0 SVC, including a task that resumed
    // after yield or IPC park. Bypassing that epilogue would leak this trap
    // frame on the task's kernel stack on every syscall.
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn acquire_s375_production_scheduler_writer_access(
) -> Result<G8lS375ProductionSchedulerWriterAccess, G8lS247WholeSchedulerAccessError> {
    let caller_cpu =
        crate::percpu::try_current_cpu_id().ok_or(G8lS247WholeSchedulerAccessError::InvalidCpu)?;
    if caller_cpu != crate::g8l_runtime_contract::CPU0 {
        return Err(G8lS247WholeSchedulerAccessError::InvalidCpu);
    }
    let access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s246_whole_scheduler_read_access_guard::S247_PRODUCTION_WHOLE_SCHEDULER_ACCESS_GATE
        .try_acquire_exclusive_for_valid_cpu(caller_cpu)?;
    Ok(G8lS375ProductionSchedulerWriterAccess { _access: access })
}

#[test]
fn reply_alias_has_exactly_one_s375_acquire_and_release() {
    let boundary = reply_alias_boundary();
    assert_eq!(
        boundary
            .matches("acquire_s375_production_scheduler_writer_access")
            .count(),
        1
    );
    assert_eq!(boundary.matches("drop(s375_writer_access)").count(), 1);
    assert_eq!(boundary.matches("drop(s375_irq_guard)").count(), 1);
}

  {
    id: "g8l-s375-el0-ipc-call-reply-alias-writer-guard-integration-partial",
    date: "2026-08-29",
    sequence: 375,
    status: "passed",
    umbrella_status: "partial",
    title:
      "S375 · EL0 IPC CALL reply-alias production writer guard integration",
    summary:
      "S375, rust_el0_sync_handler içindeki SYS_IPC_CALL dalının target_is_reply erken yolundaki exact ipc_reply_commit(target_id, reply_message) mutable scheduler sınırını S374 ve 44 production reader'ın kullandığı aynı statik S247 state word'e bağlar. Current-task identity, immutable reply-cap registry classification, runtime-OOM bridge'e bağlı reply-cap rejection ve owned reply message writer'dan önce tamamlanır. RPi5 bare-metal kesişiminde dedicated IRQ guard kurulur, gerçek per-CPU kimliğiyle yalnız CPU0 için S375 exclusive writer alınır ve exact tek mutable SCHEDULER aliası üzerinden synchronous ipc_reply_commit yürütülür. Scheduler transaction altında live responder, reply object/target, blocked caller, caller CNode authority, deadline generation, ready capacity ve rendezvous reply graph'ını yeniden doğrular. Owned result kurulduktan sonra önce writer, sonra IRQ bırakılır; terminal set_ipc_error ve return üyelik dışındadır. Alias context switch yapmaz. Normal CALL S374, ordinary REPLY S372 ve RECEIVE S373 üyeliklerini korur. Guarded writer 48/69, açık writer 21, provider authority 0, whole-scheduler exclusion false ve supported-profile runtime observation=0'dır. S376 notification signal sıradaki ayrı kapıdır.",
    evidence: [
      "İlk focused komut, S375 production modülü ve kernel/simulation registration henüz yokken compile RED verdi. unresolved import, kapının S374 içine topluca yazılmadığını ve ayrı kaynak birimi olmadan geçemediğini gösterdi.",
      "S375 modülü S374 typed preflight outcome'unu yeniden doğrular; inherited inventory exact 44 reader + 47 guarded writer + 22 open writer değilse InventoryDrift ile kapanır.",
      "S375 başarı outcome'u FortyEighthWriterGuardedAwaitingRemaining'dir ve 44 guarded reader + 48/69 guarded writer + 21 open writer envanterini sabitler.",
      "Production wrapper exact target_arch=aarch64, target_os=none, feature=board-rpi5 cfg kesişimindedir. Host model executor production CPU kimliği veya wrapper çağrısı diye sunulmaz.",
      "Wrapper try_current_cpu_id ile gerçek per-CPU kimliğini türetir; caller-supplied production CPU parametresi yoktur ve CPU0 dışı fail-closed InvalidCpu verir.",
      "Writer lease S247_PRODUCTION_WHOLE_SCHEDULER_ACCESS_GATE üzerinde try_acquire_exclusive_for_valid_cpu ile alınır. Reader'ların kullandığı state word'den ayrı bir model gate veya yeni static yaratılmaz.",
      "Host executor callback'i exact bir kez çağırır; canlı reader veya writer callback'ten önce ExclusiveBusy üretir, CPU1–CPU_MAX InvalidCpu verir ve callback error RAII lease'i exact bir kez bırakır.",
      "S374 ve S375 host executor token'ları aynı gate üzerinde monoton ve distinct'tir; iki kapı tek transaction veya tek sequence dispatcher olarak birleştirilmez.",
      "Exact production giriş sınırı arch/aarch64/exceptions.rs içindeki SYS_IPC_CALL match dalının if target_is_reply erken yoludur. S375 normal endpoint SEND/CALL bölümünü coverage'a katmaz.",
      "target_id, label ve dört message register'ı handler register snapshot'ından scalar olarak alınır. current_id writer öncesinde owned u64 değeridir.",
      "ENDPOINT_REGISTRY yalnız immutable routing metadata için kilitlenir; endpoint clone veya mutable scheduler authority üretmez. endpoint.is_reply_cap classification writer edinilmeden tamamlanır.",
      "Hedef registry'de yoksa InvalidCapability ve return S375 IRQ/writer acquisition'dan önce gerçekleşir. Gate state ve scheduler graph değişmez.",
      "runtime_oom_reply_cap_is_bound(target_id) true ise CALL_ALIAS_REJECTED logu ve InvalidCapability exact erken dönüşü writer'dan öncedir. Legacy alias ordinary S372 bridge preflight/commit sınırını bypass etmez.",
      "Immutable reply_message label, badge=current_id ve mr0..mr3 data alanlarıyla writer öncesinde kurulur; guard altında message allocation/construction veya kullanıcı kopyası yoktur.",
      "Dedicated s375_irq_guard mutable scheduler aliasından önce local interrupt re-entry'yi kapatır. s375_writer_access IRQ guard'dan sonra, alias kurulmadan önce alınır.",
      "Reply-alias bölümünde exact bir acquire_s375_production_scheduler_writer_access, bir mutable SCHEDULER aliası, bir ipc_reply_commit forward'ı, bir writer drop ve bir IRQ drop vardır.",
      "Guarded source slice yalnız mutable alias ve scheduler.ipc_reply_commit(target_id, reply_message) forward'ını kapsar. set_ipc_error, runtime-OOM broker commit veya context switch guarded slice'a dahil değildir.",
      "ipc_reply_commit kendi IPC_TRANSACTION_LOCK, IPC_CALL_DEADLINES, capability provenance, ENDPOINT_REGISTRY ve ipc_blocked_tasks lock sırasını korur.",
      "Scheduler current responder task id'yi nonzero olarak yeniden doğrular; invalid current task mutation başlamadan InvalidCapability döndürür.",
      "Reply registry entry exact id + is_reply_cap ile bulunur. caller owner ve reply_target owned scalar olarak çıkarılır; target endpoint normal endpoint olmalıdır.",
      "Blocked caller exact task id, BlockedOnIpc endpoint id ve is_call=true tuple'ıyla yeniden doğrulanır. Yanlış veya kayıp waiter fail-closed InvalidCapability verir.",
      "Caller'ın CNode reply authority kaydı exact id, owner, Endpoint kind ve parent=None ile eşleşmelidir; stale/derived authority ordinary reply commit'i açmaz.",
      "Varsa deadline record task id, Call kind, target endpoint, reply id ve reply generation ile eşleşir. Mismatch partial reply mutation yayımlamaz.",
      "Ready queue try_reserve(1) rendezvous reply'dan önce yapılır; capacity yoksa NoReceiver ile reply graph ve blocked caller korunur.",
      "Rendezvous reply exact responder/reply token/message ile çalışır. Wake sonucu model caller blocked caller ile eşleşmezse integrity panic fail-closed kalır.",
      "Consumed reply record retire(caller_task, reply_cap_id) ile exact bir kez retire edilir; caller CNode exact capability revoke ve endpoint removal aynı transaction kapsamındadır.",
      "Durable reply payload caller'a write_ipc_delivery ile yazılır, caller Ready olur ve ready_queue'ya eklenir. Varsa deadline complete_reply_exact ile retire edilir.",
      "Owned result, ipc_reply_commit dönüşünden sonra kurulmuş durumdadır. drop(s375_writer_access), drop(s375_irq_guard), set_ipc_error(ctx, result), return sırası source assertion'ıyla sabittir.",
      "Reply alias synchronous'tir; ipc_call_commit_and_park, ipc_recv_or_park veya context_switch içermez. Global writer token başka task çalışırken taşınmaz.",
      "Normal non-reply SYS_IPC_CALL bölümü yalnız S374 membership taşır ve S375 adı içermez. Ordinary SYS_IPC_REPLY yalnız S372; SYS_IPC_RECV yalnız S373 membership taşır.",
      "SYS_IPC_CALL_TIMEOUT ve SYS_IPC_RECV_TIMEOUT dispatch sınırları S375 üyeliğine katılmaz. S376 handle_notification_signal ayrı ve açık tutulur.",
      "CPU1 coverage service timer zincirinde S374'ten sonra ve S242 sender service'ten önce çalışır. Yalnız pending S245 view inspect eder; take veya production writer acquire etmez.",
      "İlk production focused koşu 49/51 verdi. İki RED davranış değil; S305 tarihsel başlığının exact spelling'i ve scheduler source'taki .current_task satır kırılımıydı.",
      "İki test gerçek source spelling/boundary ile hizalandı. Product code, writer kapsamı, envanter veya fail-closed assertion gevşetilmedi; final focused 51/51 PASS oldu.",
      "Focused log 3915 B / 97daaa6182ef8c09e26ffab4326d9406e4233b1ded31bf1e8b596e71ded848a4 SHA-256'dır; artifact /tmp/aselsanos-s375-focused.jCL1Oj altındadır.",
      "Tarihsel S372/S373/S374 focused testleri kendi kapanış anındaki 45/46/47 writer ve 24/23/22 open snapshot'larını korurken canlı reply-alias source'unda ayrı S375 acquire bulunduğunu doğrulayacak şekilde hizalandı.",
      "İlk filtered workspace 323 grupta 4965 PASS + 1 RED + 7 filtered verdi. RED runtime_oom_reply_bridge testinin fixed 1400-byte penceresinin S375 guard eklentisinden sonra ipc_reply_commit satırına ulaşmamasıydı.",
      "runtime_oom_reply_bridge testi sabit bayt penceresi yerine exact if target_is_reply başlangıcı ile normal endpoint yorum sınırı arasına bağlandı. Preflight-before-IPC-before-broker ve bound-cap rejection assertion'ları değişmedi; final 8/8 PASS oldu.",
      "S374'ün 20 grupluk seçili IPC regresyonuna S375 ve runtime_oom_reply_bridge eklendi; final 22 grup / 451/451 PASS / 0 fail verdi.",
      "Selected-regression summary 2198 B / 7ceb30838ddd55371a00a7b68bb163599c4350c2305c943b941db37b722940df; artifact /tmp/aselsanos-s375-regression.46WFez'dir.",
      "S238–S375 dependency listesi S240'ın iki distinct grubuyla 139 gruptur. İki bağımsız seri koşunun her biri 3164/3164 PASS / 0 fail verdi.",
      "İki süre-dışı kanonik dependency özeti 22940 B ve 3c05d1c75016779cd05e2729d580adb5ee034e103bcc2b59ef9624c148c06edb SHA-256 ile byte-eşittir. Artifact /tmp/aselsanos-s375-dependency.8knOf9'dur.",
      "Exact yedi frozen G8h assertion dışındaki final seri workspace 338 sonuç grubu / 5030 PASS / 0 fail / 7 filtered verdi.",
      "Filtered workspace log 72636 B / 08dad1f3c4b50c62a370e1eda4c5ce53eb68bb2b27f5b248f3bcdab4ccd4e978; summary 31992 B / d60fc3775c206095c0163fb31db3c02d03d5b051d6abb86c8497d3cb0382275e'dir.",
      "Filtresiz workspace exit 101 ile yalnız frozen S96 wiring_does_not_mutate_timer_gic_boot_or_expand_runtime_scope reddinde durdu: 291 grup / 4775 PASS / 1 fail. Global workspace GREEN iddia edilmez.",
      "Filtresiz log 67858 B / 69fa525df6e89c5b6f9e16721b49956339b9387b4523dcd764821b5f6f906088; summary 27573 B / a626711eac69c3a1c109d2fad411aff4e23f2894c78e012024309cec0519e721'dır. Workspace artifact /tmp/aselsanos-s375-workspace-final.VZJfFi'dir.",
      "Fresh izole AArch64 profilleri 4/4 exit 0 verdi. board-qemu log 111606 B / 807b56d695ef5d832b44694541fb74fc14d5e67b92eeb7c7ceda65af9ccbe7f4, ELF 12622448 B / d75fb931a02d5d19981a6c1add7c676bf39557910ed53ec727709b1401701637'dir.",
      "board-rpi4 log 150458 B / 3d3d32149746090b9d740e3e046ecaf2bb6947badd476bcfa85966c2344126a5, ELF 7747464 B / fa0199ad23cbf10010878bccbb33d3f599796038ac5d05fd3891a0059667ceef'tir.",
      "board-rpi5 log 616534 B / 053f30cb0ad0aa1499451e0c0c0557c04af2375c33019c1b7f83a9cbb7af6ba4, ELF 14571376 B / 67e03f34fd459f762290ff91a8285d812a8bb276684053a11622cc0ab544b6c6'dır.",
      "board-rpi5+smp log 616528 B / 46b1f118356ff0e3d1fc4a3f29cdb8cd5955d1a3f920ede751f616a71c1ce1e2, ELF 14587168 B / 996fdbdab7ef20191d5d2806e5983d146b73c66340320daff5737330316ee911'dır. Zero-warning iddiası yoktur.",
      "make verify-qemu exit 0 verdi. 116354 B log / 713241b31f0fffadee5d68c622eab4c1f63c24d36c9eeb79baf6df57af9a2b47 SHA-256 ile W^X 31/31, S130–S154+S271, RuntimePmm, EL0x4096, IPC reply 20/20 ve scheduler SEC5 PASS'tir.",
      "Ortak board-qemu regresyonu RPi5-only S375 production wrapper invocation kanıtı değildir; supported-profile runtime observations=0 kalır.",
      "cargo fmt --all -- --check exit 0 ve boş çıktı verdi. Format log 0 B / e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'tir.",
      "Source-bound Kod hedefi S1–S375 375/375 ayrı kapı, pre-S328 S1–S327 327/327, missing=none ve duplicate=0'dır. S375 kartı S372/S374/S376 kartlarıyla birleştirilmez.",
      "S375 Code kartında gerçek rust_el0_sync_handler reply-alias source focus'u, ayrı S375 guard modülü, focused test ve Operations identity excerpt'leri bulunacaktır. Her excerpt exact path, satır aralığı ve SHA-256 ile bağlanır.",
      "İlk source-bound registry S1–S375 aralığında 375/375 unique kapı, 1065 exact excerpt, pre-S328 S1–S327 327/327, missing=none ve duplicate=0 üretti. JSON 7721874 B / 7fb1f3adbb091daec179e9646149919904f5b281765b23b08d1aba7828a104a1 dosya SHA-256 ve e3ab305205fe25f15f7a2b2052667da378f673f47922279d509580db00afc11d registry SHA-256 taşır.",
      "İlk website kabulü 660/660 test, lint PASS, boş çıktılı TypeScript ve 24/24 static page PASS verdi. Build 201 yerel dosya üretti; Timeline ve yol-haritasi S375'i ayrı tutan 214 data-gate-policy kartı taşır.",
      "İlk production/main deployment 9cca2d17 ile 116 uploaded + 84 existing = 200 asset olarak tamamlandı. Cache-busted custom-domain /code/ 22159253 B / 7bae86620f9116b9413d6b28a5e109dd8890b76d38fb663ef94325a31aa1c3fa, /operations/ 13186006 B / f9c8bb5372d1a6d09ba3350c09e19c32d045b47edb176ce6bcf67961d278f6ec, /timeline/ 5169681 B / c85a39ef30549a5a0970a4bc695d333db5070183401d74d6d3e76dd575ce1e27 ve /yol-haritasi/ 5169429 B / 5b5b17b4e410ba8092211922283fcfea1d57ae9ec080241ab28e300cda5a0c46 ile HTTP 200 ve yerel out'a raw byte-exact PASS verdi.",
      "Canlı /code/ no-transform header'ı taşır; literal data-code-gate sayımı 375/375, pre-S328 327/327, S1=1, S327=1, S328=1, S375=1, S376=0'dır. Immutable 9cca2d17 hostname probe'u curl exit 28 / HTTP 000 verdi; custom-domain PASS bu erişim sınırının yerine geçirilmez.",
      "S375 sırasında güç, SD kart, Mac kart erişimi, UART capture, raw validation, archive veya promotion yapılmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S375=NO.",
      "S375 bazlı bağlayıcı olmayan planlama görünümü R1 S375–S405, R2 S430–S480, R3 S559+, kaba S535–S585 ve risk paylı merkez yaklaşık S560'tır. Bu projeksiyon yeni sıra veya ürün taahhüdü değildir.",
    ],
    commands: [
      "cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s375_el0_ipc_call_reply_alias_writer_guard_integration -- --test-threads=1",
      "run 22 exact S375/S374/S373/S372/S305/S304/S303/S316/S290/S252/capability-mint/IPC source-host-runtime groups serially",
      "run four fresh AArch64 profiles; run S238-S375 dependency list twice; run filtered and unfiltered serial workspace audits; make verify-qemu",
      "python3 scripts/render-project-status.py --write && python3 scripts/render-project-status.py --check; cargo test -p aselsan_microkernel_simulation --test project_status_manifest -- --test-threads=1",
      "npm run code:generate && npm test && npm run lint && npx tsc --noEmit && npm run build",
      "npm run deploy; cache-busted curl + cmp for /code/, /operations/, /timeline/ and /yol-haritasi/",
    ],
    terminalSessions: [
      {
        id: "g8l-s375-focused-source-contract",
        title: "S375 focused CALL-to-reply alias writer membership",
        commandLines: [
          "cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s375_el0_ipc_call_reply_alias_writer_guard_integration -- --test-threads=1",
        ],
        outputLines: [
          "initial result: compile RED; separate S375 module/source registration absent",
          "first production result: 49 passed; 2 exact source-literal assertions failed",
          "final result: ok; S375 focused 1 group / 51 passed / 0 failed",
          "shared S247 gate: 44 guarded readers + 48/69 guarded writers; 21 writers open",
          "identity/classification/bound-cap rejection/message < IRQ < writer < alias reply commit < writer/IRQ release < terminal result",
          "direct production caller paths=1; context switch under writer=0; runtime observations=0; provider authority=0",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8l-s375-selected-regression",
        title:
          "S375 selected reply-alias/ordinary-reply/normal-CALL regression",
        commandLines: [
          "run 22 exact S375/S374/S373/S372/S305/S304/S303/S316/S290/S252/capability-mint/IPC groups serially",
        ],
        outputLines: [
          "initial workspace source assertion: runtime_oom_reply_bridge 7/8 RED; fixed 1400-byte window ended before wrapped commit",
          "test bound to exact if target_is_reply through normal-endpoint boundary; semantic assertions unchanged",
          "final result: 22 groups / 451 passed / 0 failed",
          "S375 51/51; S374 76/76; S373 71/71; S372 55/55; S305 15/15; runtime_oom_reply_bridge 8/8",
          "summary 2198 bytes; SHA-256 7ceb30838ddd55371a00a7b68bb163599c4350c2305c943b941db37b722940df",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8l-s375-full-acceptance",
        title: "S375 four-profile, dependency, workspace and QEMU acceptance",
        commandLines: [
          "run four fresh isolated AArch64 profile builds",
          "run S238-S375 dependency list twice and compare canonical summaries",
          "run filtered and unfiltered serial workspace audits",
          "make verify-qemu",
        ],
        outputLines: [
          "four AArch64 profiles: 4/4 exit 0; individual log/ELF byte and SHA-256 identities recorded",
          "dependency: 139 groups / 3164/3164 twice; 22940-byte canonical summaries byte-equal",
          "filtered workspace: 338 groups / 5030 PASS / 0 fail / 7 frozen filtered",
          "unfiltered workspace: exit 101; 291 groups / 4775 PASS / 1 frozen S96 failure; global GREEN=false",
          "QEMU: W^X 31/31 + S130-S154/S271 + RuntimePmm + EL0x4096 + IPC 20/20 + scheduler SEC5 PASS",
          "QEMU common regression is not an S375 RPi5 runtime observation",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8l-s375-production-publication",
        title: "S375 source-code registry and production publication",
        commandLines: [
          "npm run code:generate && npm test && npm run lint && npx tsc --noEmit && npm run build",
          "npm run deploy",
          "cache-busted curl + cmp for /code/, /operations/, /timeline/ and /yol-haritasi/",
        ],
        outputLines: [
          "source registry: S1-S375 375/375 unique gates; 1065 exact excerpts; pre-S328 327/327; missing=none; duplicate=0",
          "website: 660/660 tests PASS; lint PASS; TypeScript empty output; static pages 24/24",
          "deployment 9cca2d17: 116 uploaded + 84 existing = 200 assets",
          "four custom-domain routes: HTTP 200; raw byte-exact=true",
          "live code cards: 375/375; pre-S328 327/327; S375=1; S376=0; no-transform=true",
          "immutable hostname: curl exit 28 / HTTP 000",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
    ],
    terminalSessionsNote:
      "Terminal kartları focused kaynak kabulünü, seçili IPC regresyonunu, dört-profil/dependency/workspace/QEMU kabulünü ve source-registry/production publication geri-okumasını dört ayrı oturumda gösterir.",
    limitations: [
      "Üst scheduler-exclusion umbrella PARTIAL: 21 production writer hâlâ açıktır.",
      "S376 notification signal bu kapıda guard coverage'a alınmadı.",
      "Production provider authority ve whole-scheduler admission yoktur.",
      "Supported-profile S375 writer runtime invocation gözlenmedi.",
      "Filtresiz workspace frozen S96 source assertion'ı nedeniyle global GREEN değildir.",
      "Fiziksel cihaz/runbook işlemi yapılmadı.",
    ],
  },