S401 · Provider-authority timer callsite

#![allow(unexpected_cfgs)]

//! S401 bounded provider-authority timer callsite.
//!
//! S400 exposed the first real CPU1 constructor but deliberately left it
//! dormant. S401 invokes that exact constructor from the production CPU1 timer
//! chain. A constructed authority is checked while its S247 exclusive lease is
//! live and then explicitly released before this service returns. The returned
//! receipt is audit data only: it cannot retain or recreate exclusion.
//!
//! This gate adds no S244 admission publisher, never enters S243/S236, and does
//! not claim that the supported profile was observed on physical hardware.

use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s244_whole_scheduler_exclusion_admission_request::{
    G8lS245WholeSchedulerExclusionAdmissionRequestState, S245_SOURCE_CPU0, S245_TARGET_CPU1,
};
use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s246_whole_scheduler_read_access_guard::{
    G8lS247WholeSchedulerAccessError, G8lS247WholeSchedulerAccessGate,
};
use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s400_whole_scheduler_provider_authority_constructor::{
    try_construct_s400_model_provider_authority, G8lS400ProviderAuthorityConstructorError,
    G8lS400ProviderAuthorityReleaseReceipt, G8lS400WholeSchedulerProviderAuthority,
    S400_DIRECT_SCHEDULER_ACCESS_SITES, S400_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES,
    S400_SOURCE_AUDIT_UNITS, S400_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES,
    S400_UNROUTED_DIRECT_ACCESS_SITES,
};

pub const S401_SOURCE_AUDIT_UNITS: usize = S400_SOURCE_AUDIT_UNITS;
pub const S401_DIRECT_SCHEDULER_ACCESS_SITES: usize = S400_DIRECT_SCHEDULER_ACCESS_SITES;
pub const S401_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES: usize =
    S400_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES;
pub const S401_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES: usize =
    S400_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES;
pub const S401_UNROUTED_DIRECT_ACCESS_SITES: usize = S400_UNROUTED_DIRECT_ACCESS_SITES;
pub const S401_MODEL_PROVIDER_INVOCATION_SITES: usize = 1;
pub const S401_PRODUCTION_PROVIDER_INVOCATION_CALLSITES: usize = 1;
pub const S401_PRODUCTION_ADMISSION_PUBLISHER_SITES: usize = 0;
pub const S401_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS: usize = 0;
pub const S401_PROVIDER_AUTHORITY_TIMER_CALLSITE_COMPLETE: bool = true;
pub const S401_AUTHORITY_RELEASED_BEFORE_TIMER_SERVICE_RETURN: bool = true;
pub const S401_END_TO_END_EXCLUSION_ADMISSION_COMPLETE: bool = false;

/// Non-authoritative observation retained only after the live S400 authority
/// and its exclusive lease have both been released.
#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS401ProviderAuthorityTimerCallsiteReceipt {
    request_id: u64,
    exclusive_token: u64,
}

impl G8lS401ProviderAuthorityTimerCallsiteReceipt {
    pub const fn request_id(&self) -> u64 {
        self.request_id
    }

    pub const fn exclusive_token(&self) -> u64 {
        self.exclusive_token
    }

    pub const fn constructor_invoked(&self) -> bool {
        true
    }

    pub const fn authority_released(&self) -> bool {
        true
    }

    pub const fn authority_live(&self) -> bool {
        false
    }

    pub const fn whole_scheduler_exclusion_proven(&self) -> bool {
        false
    }

    pub const fn admission_published(&self) -> bool {
        false
    }
}

impl From<G8lS400ProviderAuthorityReleaseReceipt> for G8lS401ProviderAuthorityTimerCallsiteReceipt {
    fn from(receipt: G8lS400ProviderAuthorityReleaseReceipt) -> Self {
        Self {
            request_id: receipt.request_id(),
            exclusive_token: receipt.exclusive_token(),
        }
    }
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS401ProviderAuthorityTimerCallsiteOutcome {
    Idle,
    ProviderAuthorityInvokedAndReleased(G8lS401ProviderAuthorityTimerCallsiteReceipt),
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS401ProviderAuthorityTimerCallsiteError {
    WrongCpu,
    S400(G8lS400ProviderAuthorityConstructorError),
    AuthorityInvariantDrift,
    Release(G8lS247WholeSchedulerAccessError),
}

fn validate_live_authority(authority: &G8lS400WholeSchedulerProviderAuthority<'_>) -> bool {
    authority.request_id() != 0
        && authority.source_cpu() == S245_SOURCE_CPU0
        && authority.target_cpu() == S245_TARGET_CPU1
        && authority.exclusive_token() != 0
        && authority.source_audit_units() == S401_SOURCE_AUDIT_UNITS
        && authority.direct_scheduler_access_sites() == S401_DIRECT_SCHEDULER_ACCESS_SITES
        && authority.source_model_covered_direct_access_sites()
            == S401_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES
        && authority.production_guarded_direct_access_sites()
            == S401_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES
        && authority.unrouted_direct_access_sites() == S401_UNROUTED_DIRECT_ACCESS_SITES
        && authority.request_consumed()
        && authority.is_provider_authority()
        && authority.whole_scheduler_exclusion_proven()
        && !authority.admission_published()
}

/// Host/model form of the exact production lifecycle: construct, validate
/// while live, explicitly release, then return only a non-authoritative receipt.
pub fn service_s401_model_provider_authority_timer_callsite(
    gate: &G8lS247WholeSchedulerAccessGate,
    request_state: &mut G8lS245WholeSchedulerExclusionAdmissionRequestState,
    caller_cpu: usize,
) -> Result<G8lS401ProviderAuthorityTimerCallsiteOutcome, G8lS401ProviderAuthorityTimerCallsiteError>
{
    let authority = try_construct_s400_model_provider_authority(gate, request_state, caller_cpu)
        .map_err(G8lS401ProviderAuthorityTimerCallsiteError::S400)?;
    let Some(authority) = authority else {
        return Ok(G8lS401ProviderAuthorityTimerCallsiteOutcome::Idle);
    };
    if !validate_live_authority(&authority) {
        return Err(G8lS401ProviderAuthorityTimerCallsiteError::AuthorityInvariantDrift);
    }
    let receipt = authority
        .release()
        .map_err(G8lS401ProviderAuthorityTimerCallsiteError::Release)?;
    Ok(
        G8lS401ProviderAuthorityTimerCallsiteOutcome::ProviderAuthorityInvokedAndReleased(
            receipt.into(),
        ),
    )
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
fn validate_production_authority(
    authority: &crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s400_whole_scheduler_provider_authority_constructor::G8lS400ProductionWholeSchedulerProviderAuthority,
) -> bool {
    authority.request_id() != 0
        && authority.exclusive_token() != 0
        && authority.is_provider_authority()
        && authority.whole_scheduler_exclusion_proven()
        && !authority.admission_published()
}

/// CPU1 timer service. S400's wrapper keeps local IRQs masked for the entire
/// live-authority interval; explicit release drops the S247 lease before the
/// wrapper restores the prior DAIF state.
#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn service_s401_provider_authority_timer_callsite_on_cpu1(
) -> Result<G8lS401ProviderAuthorityTimerCallsiteOutcome, G8lS401ProviderAuthorityTimerCallsiteError>
{
    use crate::g8l_runtime_contract::CPU1;

    if crate::percpu::try_current_cpu_id() != Some(CPU1) {
        return Err(G8lS401ProviderAuthorityTimerCallsiteError::WrongCpu);
    }
    let authority = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s400_whole_scheduler_provider_authority_constructor::try_construct_s400_production_provider_authority_on_cpu1()
        .map_err(G8lS401ProviderAuthorityTimerCallsiteError::S400)?;
    let Some(authority) = authority else {
        return Ok(G8lS401ProviderAuthorityTimerCallsiteOutcome::Idle);
    };
    if !validate_production_authority(&authority) {
        return Err(G8lS401ProviderAuthorityTimerCallsiteError::AuthorityInvariantDrift);
    }
    let receipt = authority
        .release()
        .map_err(G8lS401ProviderAuthorityTimerCallsiteError::Release)?;
    Ok(
        G8lS401ProviderAuthorityTimerCallsiteOutcome::ProviderAuthorityInvokedAndReleased(
            receipt.into(),
        ),
    )
}

#![recursion_limit = "256"]

use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s244_whole_scheduler_exclusion_admission_request::{
    service_s245_exclusion_admission_request, G8lS245ExclusionAdmissionRequestOutcome,
    G8lS245WholeSchedulerExclusionAdmissionRequestState, S245_SOURCE_CPU0, S245_TARGET_CPU1,
};
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s246_whole_scheduler_read_access_guard::{
    G8lS247WholeSchedulerAccessError, G8lS247WholeSchedulerAccessGate,
};
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s400_whole_scheduler_provider_authority_constructor::{
    G8lS400ProviderAuthorityConstructorError, S400_DIRECT_SCHEDULER_ACCESS_SITES,
    S400_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES, S400_SOURCE_AUDIT_UNITS,
    S400_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES, S400_UNROUTED_DIRECT_ACCESS_SITES,
};
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s401_provider_authority_timer_callsite::*;

fn pending(next_request_id: u64) -> G8lS245WholeSchedulerExclusionAdmissionRequestState {
    let mut state =
        G8lS245WholeSchedulerExclusionAdmissionRequestState::with_next_request_id(next_request_id);
    assert_eq!(
        service_s245_exclusion_admission_request(&mut state, S245_SOURCE_CPU0, true, true),
        Ok(G8lS245ExclusionAdmissionRequestOutcome::RequestPublished(
            next_request_id
        ))
    );
    state
}

fn module_source() -> &'static str {
    include_str!("../../kernel/src/g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s401_provider_authority_timer_callsite.rs")
}

fn exception_source() -> &'static str {
    include_str!("../../kernel/src/arch/aarch64/exceptions.rs")
}

fn kernel_main_source() -> &'static str {
    include_str!("../../kernel/src/main.rs")
}

fn simulation_lib_source() -> &'static str {
    include_str!("../src/lib.rs")
}

fn s402_source() -> &'static str {
    include_str!("../../kernel/src/g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s402_provider_invocation_observation_publication.rs")
}

#[test]
fn constants_promote_only_the_bounded_timer_callsite() {
    assert_eq!(S401_SOURCE_AUDIT_UNITS, 7);
    assert_eq!(S401_DIRECT_SCHEDULER_ACCESS_SITES, 113);
    assert_eq!(S401_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES, 113);
    assert_eq!(S401_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES, 113);
    assert_eq!(S401_UNROUTED_DIRECT_ACCESS_SITES, 0);
    assert_eq!(S401_MODEL_PROVIDER_INVOCATION_SITES, 1);
    assert_eq!(S401_PRODUCTION_PROVIDER_INVOCATION_CALLSITES, 1);
    assert_eq!(S401_PRODUCTION_ADMISSION_PUBLISHER_SITES, 0);
    assert_eq!(S401_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS, 0);
    assert!(S401_PROVIDER_AUTHORITY_TIMER_CALLSITE_COMPLETE);
    assert!(S401_AUTHORITY_RELEASED_BEFORE_TIMER_SERVICE_RETURN);
    assert!(!S401_END_TO_END_EXCLUSION_ADMISSION_COMPLETE);
}

#[test]
fn s400_is_the_exact_constructor_predecessor() {
    assert_eq!(S401_SOURCE_AUDIT_UNITS, S400_SOURCE_AUDIT_UNITS);
    assert_eq!(
        S401_DIRECT_SCHEDULER_ACCESS_SITES,
        S400_DIRECT_SCHEDULER_ACCESS_SITES
    );
    assert_eq!(
        S401_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES,
        S400_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES
    );
    assert_eq!(
        S401_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES,
        S400_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES
    );
    assert_eq!(
        S401_UNROUTED_DIRECT_ACCESS_SITES,
        S400_UNROUTED_DIRECT_ACCESS_SITES
    );
}

#[test]
fn exact_request_is_constructed_observed_and_released_in_one_service_call() {
    let gate = G8lS247WholeSchedulerAccessGate::new();
    let mut state = pending(41);
    let outcome =
        service_s401_model_provider_authority_timer_callsite(&gate, &mut state, S245_TARGET_CPU1)
            .unwrap();
    let G8lS401ProviderAuthorityTimerCallsiteOutcome::ProviderAuthorityInvokedAndReleased(receipt) =
        outcome
    else {
        panic!("exact request must invoke and release the provider authority")
    };
    assert_eq!(receipt.request_id(), 41);
    assert_eq!(receipt.exclusive_token(), 1);
    assert!(receipt.constructor_invoked());
    assert!(receipt.authority_released());
    assert!(!receipt.authority_live());
    assert!(!receipt.whole_scheduler_exclusion_proven());
    assert!(!receipt.admission_published());
    assert!(!state.pending());
    assert_eq!(gate.active_exclusive_token(), None);
}

#[test]
fn absent_request_is_idle_and_does_not_spend_a_gate_token() {
    let gate = G8lS247WholeSchedulerAccessGate::new();
    let mut state = G8lS245WholeSchedulerExclusionAdmissionRequestState::new();
    assert_eq!(
        service_s401_model_provider_authority_timer_callsite(&gate, &mut state, S245_TARGET_CPU1),
        Ok(G8lS401ProviderAuthorityTimerCallsiteOutcome::Idle)
    );
    let lease = gate.try_acquire_exclusive(S245_TARGET_CPU1).unwrap();
    assert_eq!(lease.token(), 1);
}

#[test]
fn wrong_cpu_fails_closed_without_consuming_the_request() {
    let gate = G8lS247WholeSchedulerAccessGate::new();
    let mut state = pending(7);
    assert!(matches!(
        service_s401_model_provider_authority_timer_callsite(&gate, &mut state, S245_SOURCE_CPU0),
        Err(G8lS401ProviderAuthorityTimerCallsiteError::S400(
            G8lS400ProviderAuthorityConstructorError::WrongCpu
        ))
    ));
    assert_eq!(state.pending_request_id(), Some(7));
    assert_eq!(gate.active_exclusive_token(), None);
}

#[test]
fn reader_contention_preserves_the_exact_request_for_retry() {
    let gate = G8lS247WholeSchedulerAccessGate::new();
    let reader = gate.try_acquire_read(S245_SOURCE_CPU0).unwrap();
    let mut state = pending(9);
    assert!(matches!(
        service_s401_model_provider_authority_timer_callsite(&gate, &mut state, S245_TARGET_CPU1),
        Err(G8lS401ProviderAuthorityTimerCallsiteError::S400(
            G8lS400ProviderAuthorityConstructorError::Access(
                G8lS247WholeSchedulerAccessError::ExclusiveBusy {
                    active_readers: 1,
                    active_token: None
                }
            )
        ))
    ));
    assert_eq!(state.pending_request_id(), Some(9));
    drop(reader);
}

#[test]
fn successful_calls_release_each_authority_before_the_next_request() {
    let gate = G8lS247WholeSchedulerAccessGate::new();
    let mut state = pending(1);
    let first =
        service_s401_model_provider_authority_timer_callsite(&gate, &mut state, S245_TARGET_CPU1)
            .unwrap();
    let G8lS401ProviderAuthorityTimerCallsiteOutcome::ProviderAuthorityInvokedAndReleased(first) =
        first
    else {
        panic!("first call must complete")
    };
    assert_eq!(first.exclusive_token(), 1);
    assert_eq!(
        service_s245_exclusion_admission_request(&mut state, S245_SOURCE_CPU0, true, true),
        Ok(G8lS245ExclusionAdmissionRequestOutcome::RequestPublished(2))
    );
    let second =
        service_s401_model_provider_authority_timer_callsite(&gate, &mut state, S245_TARGET_CPU1)
            .unwrap();
    let G8lS401ProviderAuthorityTimerCallsiteOutcome::ProviderAuthorityInvokedAndReleased(second) =
        second
    else {
        panic!("second call must complete")
    };
    assert_eq!(second.request_id(), 2);
    assert_eq!(second.exclusive_token(), 2);
}

#[test]
fn model_service_orders_constructor_validation_and_explicit_release() {
    let source = module_source();
    let start = source
        .find("pub fn service_s401_model_provider_authority_timer_callsite")
        .unwrap();
    let function: String = source[start..].split_whitespace().collect();
    let construct = function
        .find("try_construct_s400_model_provider_authority")
        .unwrap();
    let validate = function.find("validate_live_authority").unwrap();
    let release = function.find("authority.release()").unwrap();
    assert!(construct < validate && validate < release);
}

#[test]
fn post_release_receipt_cannot_claim_live_exclusion() {
    let source = module_source();
    let start = source
        .find("pub struct G8lS401ProviderAuthorityTimerCallsiteReceipt")
        .unwrap();
    let section = &source[start..source[start..].find("#[derive").unwrap() + start];
    assert!(section.contains("pub const fn authority_live(&self) -> bool"));
    assert!(section.contains("pub const fn whole_scheduler_exclusion_proven(&self) -> bool"));
    assert!(section.contains("false"));
}

#[test]
fn production_service_uses_the_exact_s400_constructor_and_explicit_release() {
    let source = module_source();
    let start = source
        .find("pub fn service_s401_provider_authority_timer_callsite_on_cpu1")
        .unwrap();
    let function: String = source[start..].split_whitespace().collect();
    let construct = function
        .find("try_construct_s400_production_provider_authority_on_cpu1")
        .unwrap();
    let validate = function.find("validate_production_authority").unwrap();
    let release = function.find("authority.release()").unwrap();
    assert!(construct < validate && validate < release);
}

#[test]
fn s402_successor_invokes_s401_and_owns_the_timer_position_after_s399() {
    let exceptions = exception_source();
    let s399 = exceptions
        .find("service_s399_whole_scheduler_provider_preflight_on_cpu1")
        .unwrap();
    let s402 = exceptions
        .find("service_s402_provider_invocation_observation_publication_on_cpu1")
        .unwrap();
    let s242 = exceptions
        .find("service_s242_sender_runtime_callsite_request_on_cpu1")
        .unwrap();
    assert!(s399 < s402 && s402 < s242);
    assert!(!exceptions.contains("service_s401_provider_authority_timer_callsite_on_cpu1"));
    assert_eq!(
        s402_source()
            .matches("service_s401_provider_authority_timer_callsite_on_cpu1")
            .count(),
        1
    );
}

#[test]
fn s402_successor_accepts_only_idle_or_released_from_s401_and_propagates_error() {
    let source = s402_source();
    assert!(source.contains("G8lS401ProviderAuthorityTimerCallsiteOutcome::Idle"));
    assert!(source.contains(
        "G8lS401ProviderAuthorityTimerCallsiteOutcome::ProviderAuthorityInvokedAndReleased"
    ));
    assert!(source.contains("G8lS402ProviderInvocationObservationServiceError::S401"));
}

#[test]
fn production_path_is_exactly_rpi5_aarch64_none_and_cpu1() {
    let source = module_source();
    assert!(source.contains("target_arch = \"aarch64\""));
    assert!(source.contains("target_os = \"none\""));
    assert!(source.contains("feature = \"board-rpi5\""));
    assert!(source.contains("crate::percpu::try_current_cpu_id()"));
    assert!(source.contains("CPU1"));
}

#[test]
fn s401_does_not_publish_admission_enter_s243_or_touch_scheduler_directly() {
    let source = module_source();
    for forbidden in [
        "publish_s244",
        "service_s244_exclusion_gated_deferred_join",
        "service_s243_deferred_authority_receipt_join",
        "addr_of!(",
        "addr_of_mut!(",
        "&mut Scheduler",
    ] {
        assert!(
            !source.contains(forbidden),
            "forbidden promotion: {forbidden}"
        );
    }
}

#[test]
fn s401_is_registered_as_one_separate_kernel_and_simulation_module() {
    let name = "g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s401_provider_authority_timer_callsite";
    assert!(kernel_main_source().contains(&format!("mod {name};")));
    assert!(simulation_lib_source().contains(&format!("pub mod {name};")));
    assert_eq!(kernel_main_source().matches("_s401_").count(), 1);
    assert_eq!(simulation_lib_source().matches("_s401_").count(), 2);
}

#[test]
fn s401_allows_only_the_exact_s402_observation_successor() {
    let name = "g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s402_provider_invocation_observation_publication";
    assert!(kernel_main_source().contains(&format!("mod {name};")));
    assert!(simulation_lib_source().contains(&format!("pub mod {name};")));
}

  {
    id: "g8l-s401-provider-authority-timer-callsite-partial",
    sequence: 401,
    slug: "provider_authority_timer_callsite",
    title: "Provider-authority timer callsite",
    focusedTests: 16,
    sourceBytes: 8342,
    sourceSha256:
      "383be9135f911ebfb0a6cdd20be248104d8c01712fd5d63ea8f89c8f6279ff1e",
    testBytes: 12270,
    testSha256:
      "221cf91a178e8a195c9425ec464fe5dde12a4b881b75a6b048c5d3c37be06cf2",
    acceptance:
      "CPU1 timer zinciri exact S400 constructor'ını çağırır; authority receipt'i üretildikten sonra live S247 lease timer service dönüşünden önce exact-once bırakılır.",
    retainedBoundary:
      "Admission publisher yoktur; provider çağrısının cross-CPU observation publication'ı S402'ye bırakılmıştır.",
  },