S421 · Reconciled S187 handoff delivery

#![allow(unexpected_cfgs)]

//! S421 reconciled delivery of the S243 S187 handoff to CPU1.
//!
//! A timeout reconciliation ACK is consumed without touching S243. A completed
//! ACK must declare an expected handoff and observe that handoff pending before
//! either value is taken. The exact ACK and non-Copy S187 handoff are retained
//! together in a new one-slot CPU1 envelope for the S422/S423 continuation.

use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s242_authority_return_s240_receipt_deferred_consumer::{
    G8lS243DeferredS187HandoffSlot, G8lS243DeferredStateError,
};
use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s419_handshake_terminal_journal::G8lS419HandshakeTerminalKind;
use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s420_terminal_reconciliation_ack::{
    G8lS420TerminalReconciliationAck, G8lS420TerminalReconciliationAckState,
    G8lS420TerminalReconciliationError, S420_DIRECT_SCHEDULER_ACCESS_SITES,
    S420_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES, S420_SOURCE_AUDIT_UNITS,
    S420_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES, S420_UNROUTED_DIRECT_ACCESS_SITES,
};

pub const S421_SOURCE_AUDIT_UNITS: usize = S420_SOURCE_AUDIT_UNITS;
pub const S421_DIRECT_SCHEDULER_ACCESS_SITES: usize = S420_DIRECT_SCHEDULER_ACCESS_SITES;
pub const S421_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES: usize =
    S420_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES;
pub const S421_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES: usize =
    S420_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES;
pub const S421_UNROUTED_DIRECT_ACCESS_SITES: usize = S420_UNROUTED_DIRECT_ACCESS_SITES;
pub const S421_RECONCILED_HANDOFF_SLOT_CAPACITY: usize = 1;
pub const S421_PRODUCTION_DELIVERY_CALLSITES: usize = 1;
pub const S421_CPU1_S187_HANDOFF_DELIVERY_COMPLETE: bool = true;
pub const S421_S187_CONTINUATION_INVOCATION_COMPLETE: bool = false;

#[derive(Debug)]
pub struct G8lS421ReconciledS187Handoff<H> {
    ack: G8lS420TerminalReconciliationAck,
    handoff: Option<H>,
}

impl<H> G8lS421ReconciledS187Handoff<H> {
    pub const fn attempt_id(&self) -> u64 {
        self.ack.attempt_id
    }
    pub const fn provider_request_id(&self) -> u64 {
        self.ack.provider_request_id
    }
    pub const fn exclusive_token(&self) -> u64 {
        self.ack.exclusive_token
    }
    pub const fn view(&self) -> G8lS421ReconciledS187HandoffView {
        G8lS421ReconciledS187HandoffView {
            attempt_id: self.ack.attempt_id,
            provider_request_id: self.ack.provider_request_id,
            exclusive_token: self.ack.exclusive_token,
            reconciliation_ack_consumed: true,
            s187_handoff_owned: self.handoff.is_some(),
            is_authority: false,
        }
    }
    pub fn into_handoff(mut self) -> H {
        self.handoff
            .take()
            .expect("S421 envelope owns one S187 handoff")
    }
}

impl<H> Drop for G8lS421ReconciledS187Handoff<H> {
    fn drop(&mut self) {}
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS421ReconciledS187HandoffView {
    pub attempt_id: u64,
    pub provider_request_id: u64,
    pub exclusive_token: u64,
    pub reconciliation_ack_consumed: bool,
    pub s187_handoff_owned: bool,
    pub is_authority: bool,
}

#[derive(Debug)]
pub struct G8lS421ReconciledS187HandoffState<H> {
    pending: Option<G8lS421ReconciledS187Handoff<H>>,
}

impl<H> G8lS421ReconciledS187HandoffState<H> {
    pub const fn new() -> Self {
        Self { pending: None }
    }
    pub const fn pending(&self) -> bool {
        self.pending.is_some()
    }
    pub fn pending_view(
        &self,
        caller_cpu: usize,
    ) -> Result<Option<G8lS421ReconciledS187HandoffView>, G8lS421ReconciledS187HandoffDeliveryError>
    {
        if caller_cpu != 1 {
            return Err(G8lS421ReconciledS187HandoffDeliveryError::WrongCpu);
        }
        Ok(self
            .pending
            .as_ref()
            .map(G8lS421ReconciledS187Handoff::view))
    }
    fn publish(
        &mut self,
        envelope: G8lS421ReconciledS187Handoff<H>,
    ) -> Result<G8lS421ReconciledS187HandoffView, G8lS421ReconciledS187HandoffDeliveryError> {
        if self.pending.is_some() {
            return Err(G8lS421ReconciledS187HandoffDeliveryError::SlotOccupied);
        }
        let view = envelope.view();
        self.pending = Some(envelope);
        Ok(view)
    }
    pub fn take(
        &mut self,
        caller_cpu: usize,
    ) -> Result<Option<G8lS421ReconciledS187Handoff<H>>, G8lS421ReconciledS187HandoffDeliveryError>
    {
        if caller_cpu != 1 {
            return Err(G8lS421ReconciledS187HandoffDeliveryError::WrongCpu);
        }
        Ok(self.pending.take())
    }
}

impl<H> Default for G8lS421ReconciledS187HandoffState<H> {
    fn default() -> Self {
        Self::new()
    }
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS421ReconciledS187HandoffDeliveryOutcome {
    Idle,
    AwaitingHandoff,
    TimeoutReconciled,
    Delivered(G8lS421ReconciledS187HandoffView),
    Pending(G8lS421ReconciledS187HandoffView),
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS421ReconciledS187HandoffDeliveryError {
    WrongCpu,
    S420(G8lS420TerminalReconciliationError),
    S243(G8lS243DeferredStateError),
    AckBindingDrift,
    AckDisappeared,
    AckDrift,
    HandoffDisappeared,
    SlotOccupied,
}

fn completed_ack_is_exact(ack: G8lS420TerminalReconciliationAck) -> bool {
    ack.kind == G8lS419HandshakeTerminalKind::Completed
        && ack.attempt_id != 0
        && ack.provider_request_id != 0
        && ack.exclusive_token != 0
        && ack.s187_handoff_expected
        && ack.source_cpu == 0
        && ack.target_cpu == 1
        && !ack.is_authority
}

pub fn service_s421_model_reconciled_s187_handoff_delivery<H>(
    acks: &mut G8lS420TerminalReconciliationAckState,
    s243: &mut G8lS243DeferredS187HandoffSlot<H>,
    delivered: &mut G8lS421ReconciledS187HandoffState<H>,
    caller_cpu: usize,
) -> Result<G8lS421ReconciledS187HandoffDeliveryOutcome, G8lS421ReconciledS187HandoffDeliveryError>
{
    if caller_cpu != 1 {
        return Err(G8lS421ReconciledS187HandoffDeliveryError::WrongCpu);
    }
    if let Some(existing) = delivered.pending_view(caller_cpu)? {
        return Ok(G8lS421ReconciledS187HandoffDeliveryOutcome::Pending(
            existing,
        ));
    }
    let Some(ack) = acks
        .pending_ack(caller_cpu)
        .map_err(G8lS421ReconciledS187HandoffDeliveryError::S420)?
    else {
        return Ok(G8lS421ReconciledS187HandoffDeliveryOutcome::Idle);
    };
    if ack.kind == G8lS419HandshakeTerminalKind::TimedOutReleased {
        let taken = acks
            .take(caller_cpu)
            .map_err(G8lS421ReconciledS187HandoffDeliveryError::S420)?
            .ok_or(G8lS421ReconciledS187HandoffDeliveryError::AckDisappeared)?;
        if taken != ack {
            return Err(G8lS421ReconciledS187HandoffDeliveryError::AckDrift);
        }
        return Ok(G8lS421ReconciledS187HandoffDeliveryOutcome::TimeoutReconciled);
    }
    if !completed_ack_is_exact(ack) {
        return Err(G8lS421ReconciledS187HandoffDeliveryError::AckBindingDrift);
    }
    if !s243.pending() {
        return Ok(G8lS421ReconciledS187HandoffDeliveryOutcome::AwaitingHandoff);
    }
    let taken_ack = acks
        .take(caller_cpu)
        .map_err(G8lS421ReconciledS187HandoffDeliveryError::S420)?
        .ok_or(G8lS421ReconciledS187HandoffDeliveryError::AckDisappeared)?;
    if taken_ack != ack {
        return Err(G8lS421ReconciledS187HandoffDeliveryError::AckDrift);
    }
    let handoff = s243
        .take(caller_cpu)
        .map_err(G8lS421ReconciledS187HandoffDeliveryError::S243)?
        .ok_or(G8lS421ReconciledS187HandoffDeliveryError::HandoffDisappeared)?;
    let view = delivered.publish(G8lS421ReconciledS187Handoff {
        ack,
        handoff: Some(handoff),
    })?;
    Ok(G8lS421ReconciledS187HandoffDeliveryOutcome::Delivered(view))
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
type G8lS421ProductionState = G8lS421ReconciledS187HandoffState<crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s186_mapping_retirement::G8lProductionMigrationLifecycleS187Handoff>;

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
static S421_PRODUCTION_DELIVERY: spin::Mutex<G8lS421ProductionState> =
    spin::Mutex::new(G8lS421ProductionState::new());

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub unsafe fn service_s421_reconciled_s187_handoff_delivery_on_cpu1(
) -> Result<G8lS421ReconciledS187HandoffDeliveryOutcome, G8lS421ReconciledS187HandoffDeliveryError>
{
    use crate::g8l_runtime_contract::CPU1;
    if crate::percpu::try_current_cpu_id() != Some(CPU1) {
        return Err(G8lS421ReconciledS187HandoffDeliveryError::WrongCpu);
    }
    if let Some(existing) = S421_PRODUCTION_DELIVERY.lock().pending_view(CPU1)? {
        return Ok(G8lS421ReconciledS187HandoffDeliveryOutcome::Pending(
            existing,
        ));
    }
    let Some(ack) = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s420_terminal_reconciliation_ack::inspect_s420_terminal_reconciliation_ack_on_cpu1()
        .map_err(G8lS421ReconciledS187HandoffDeliveryError::S420)? else {
        return Ok(G8lS421ReconciledS187HandoffDeliveryOutcome::Idle);
    };
    if ack.kind == G8lS419HandshakeTerminalKind::TimedOutReleased {
        let taken = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s420_terminal_reconciliation_ack::take_s420_terminal_reconciliation_ack_on_cpu1()
            .map_err(G8lS421ReconciledS187HandoffDeliveryError::S420)?
            .ok_or(G8lS421ReconciledS187HandoffDeliveryError::AckDisappeared)?;
        if taken != ack {
            return Err(G8lS421ReconciledS187HandoffDeliveryError::AckDrift);
        }
        return Ok(G8lS421ReconciledS187HandoffDeliveryOutcome::TimeoutReconciled);
    }
    if !completed_ack_is_exact(ack) {
        return Err(G8lS421ReconciledS187HandoffDeliveryError::AckBindingDrift);
    }
    if !crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s242_authority_return_s240_receipt_deferred_consumer::s243_deferred_s187_handoff_pending_on_cpu1()
        .map_err(G8lS421ReconciledS187HandoffDeliveryError::S243)? {
        return Ok(G8lS421ReconciledS187HandoffDeliveryOutcome::AwaitingHandoff);
    }
    let taken_ack = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s420_terminal_reconciliation_ack::take_s420_terminal_reconciliation_ack_on_cpu1()
        .map_err(G8lS421ReconciledS187HandoffDeliveryError::S420)?
        .ok_or(G8lS421ReconciledS187HandoffDeliveryError::AckDisappeared)?;
    if taken_ack != ack {
        return Err(G8lS421ReconciledS187HandoffDeliveryError::AckDrift);
    }
    let handoff = unsafe { crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s242_authority_return_s240_receipt_deferred_consumer::take_s243_deferred_s187_handoff_on_cpu1() }
        .map_err(G8lS421ReconciledS187HandoffDeliveryError::S243)?
        .ok_or(G8lS421ReconciledS187HandoffDeliveryError::HandoffDisappeared)?;
    let view = S421_PRODUCTION_DELIVERY
        .lock()
        .publish(G8lS421ReconciledS187Handoff {
            ack,
            handoff: Some(handoff),
        })?;
    Ok(G8lS421ReconciledS187HandoffDeliveryOutcome::Delivered(view))
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn inspect_s421_reconciled_s187_handoff_on_cpu1(
) -> Result<Option<G8lS421ReconciledS187HandoffView>, G8lS421ReconciledS187HandoffDeliveryError> {
    S421_PRODUCTION_DELIVERY.lock().pending_view(1)
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn take_s421_reconciled_s187_handoff_on_cpu1() -> Result<Option<G8lS421ReconciledS187Handoff<crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s186_mapping_retirement::G8lProductionMigrationLifecycleS187Handoff>>, G8lS421ReconciledS187HandoffDeliveryError>{
    S421_PRODUCTION_DELIVERY.lock().take(1)
}

use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s242_authority_return_s240_receipt_deferred_consumer::G8lS243DeferredS187HandoffSlot;
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s419_handshake_terminal_journal::{service_s419_model_handshake_terminal_journal, G8lS419HandshakeTerminalJournalState, G8lS419HandshakeTerminalKind};
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s420_terminal_reconciliation_ack::{service_s420_model_terminal_reconciliation_ack, G8lS420TerminalReconciliationAckState};
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s421_reconciled_s187_handoff_delivery::*;

fn ack(
    kind: G8lS419HandshakeTerminalKind,
    handoff_pending: bool,
) -> G8lS420TerminalReconciliationAckState {
    let mut journal = G8lS419HandshakeTerminalJournalState::new();
    service_s419_model_handshake_terminal_journal(&mut journal, 1, kind, 7, 8, 9, 3).unwrap();
    let mut acks = G8lS420TerminalReconciliationAckState::new();
    service_s420_model_terminal_reconciliation_ack(
        &mut journal,
        &mut acks,
        0,
        None,
        true,
        handoff_pending,
    )
    .unwrap();
    acks
}

#[test]
fn constants_define_one_reconciled_delivery_slot() {
    assert_eq!(S421_RECONCILED_HANDOFF_SLOT_CAPACITY, 1);
    assert_eq!(S421_PRODUCTION_DELIVERY_CALLSITES, 1);
    assert!(S421_CPU1_S187_HANDOFF_DELIVERY_COMPLETE);
    assert!(!S421_S187_CONTINUATION_INVOCATION_COMPLETE);
}

#[test]
fn completed_ack_and_exact_handoff_publish_linear_delivery() {
    let mut acks = ack(G8lS419HandshakeTerminalKind::Completed, true);
    let mut s243 = G8lS243DeferredS187HandoffSlot::new();
    s243.publish(41u64).unwrap();
    let mut delivered = G8lS421ReconciledS187HandoffState::new();
    let outcome = service_s421_model_reconciled_s187_handoff_delivery(
        &mut acks,
        &mut s243,
        &mut delivered,
        1,
    )
    .unwrap();
    let G8lS421ReconciledS187HandoffDeliveryOutcome::Delivered(view) = outcome else {
        panic!("delivery")
    };
    assert_eq!(
        (
            view.attempt_id,
            view.provider_request_id,
            view.exclusive_token
        ),
        (7, 8, 9)
    );
    assert!(view.reconciliation_ack_consumed && view.s187_handoff_owned);
    assert!(!acks.pending() && !s243.pending() && delivered.pending());
    let envelope = delivered.take(1).unwrap().unwrap();
    assert_eq!(envelope.into_handoff(), 41);
}

#[test]
fn timeout_ack_is_consumed_without_touching_handoff_slot() {
    let mut acks = ack(G8lS419HandshakeTerminalKind::TimedOutReleased, false);
    let mut s243 = G8lS243DeferredS187HandoffSlot::new();
    let mut delivered = G8lS421ReconciledS187HandoffState::<u64>::new();
    assert_eq!(
        service_s421_model_reconciled_s187_handoff_delivery(
            &mut acks,
            &mut s243,
            &mut delivered,
            1
        )
        .unwrap(),
        G8lS421ReconciledS187HandoffDeliveryOutcome::TimeoutReconciled
    );
    assert!(!acks.pending() && !delivered.pending());
}

#[test]
fn completed_ack_without_handoff_waits_non_destructively() {
    let mut acks = ack(G8lS419HandshakeTerminalKind::Completed, true);
    let mut s243 = G8lS243DeferredS187HandoffSlot::new();
    let mut delivered = G8lS421ReconciledS187HandoffState::<u64>::new();
    assert_eq!(
        service_s421_model_reconciled_s187_handoff_delivery(
            &mut acks,
            &mut s243,
            &mut delivered,
            1
        )
        .unwrap(),
        G8lS421ReconciledS187HandoffDeliveryOutcome::AwaitingHandoff
    );
    assert!(acks.pending());
}

#[test]
fn occupied_delivery_backpressures_before_ack_or_handoff_take() {
    let mut first_acks = ack(G8lS419HandshakeTerminalKind::Completed, true);
    let mut first_s243 = G8lS243DeferredS187HandoffSlot::new();
    first_s243.publish(41u64).unwrap();
    let mut delivered = G8lS421ReconciledS187HandoffState::new();
    service_s421_model_reconciled_s187_handoff_delivery(
        &mut first_acks,
        &mut first_s243,
        &mut delivered,
        1,
    )
    .unwrap();
    let pending = delivered.pending_view(1).unwrap().unwrap();
    let mut next_acks = ack(G8lS419HandshakeTerminalKind::Completed, true);
    let mut next_s243 = G8lS243DeferredS187HandoffSlot::new();
    next_s243.publish(43u64).unwrap();
    assert_eq!(
        service_s421_model_reconciled_s187_handoff_delivery(
            &mut next_acks,
            &mut next_s243,
            &mut delivered,
            1
        )
        .unwrap(),
        G8lS421ReconciledS187HandoffDeliveryOutcome::Pending(pending)
    );
    assert!(next_acks.pending() && next_s243.pending());
}

#[test]
fn wrapper_is_linear_and_wrong_cpu_preserves_inputs() {
    assert!(core::mem::needs_drop::<G8lS421ReconciledS187Handoff<u64>>());
    let mut acks = ack(G8lS419HandshakeTerminalKind::Completed, true);
    let mut s243 = G8lS243DeferredS187HandoffSlot::new();
    s243.publish(41u64).unwrap();
    let mut delivered = G8lS421ReconciledS187HandoffState::new();
    assert_eq!(
        service_s421_model_reconciled_s187_handoff_delivery(
            &mut acks,
            &mut s243,
            &mut delivered,
            0
        ),
        Err(G8lS421ReconciledS187HandoffDeliveryError::WrongCpu)
    );
    assert!(acks.pending() && s243.pending());
}

#[test]
fn production_orders_ack_inspect_handoff_readiness_then_both_takes() {
    let source = include_str!("../../kernel/src/g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s421_reconciled_s187_handoff_delivery.rs");
    let start = source
        .find("service_s421_reconciled_s187_handoff_delivery_on_cpu1")
        .unwrap();
    let body = &source[start..];
    let ack = body
        .find("inspect_s420_terminal_reconciliation_ack_on_cpu1")
        .unwrap();
    let ready = body
        .find("s243_deferred_s187_handoff_pending_on_cpu1")
        .unwrap();
    let take_ack = body
        .rfind("take_s420_terminal_reconciliation_ack_on_cpu1")
        .unwrap();
    let take_handoff = body
        .find("take_s243_deferred_s187_handoff_on_cpu1")
        .unwrap();
    assert!(ack < ready && ready < take_ack && take_ack < take_handoff);
}

#[test]
fn cpu1_timer_runs_s421_before_rearm_and_new_handshake() {
    let source = include_str!("../../kernel/src/arch/aarch64/exceptions.rs");
    let s421 = source
        .find("service_s421_reconciled_s187_handoff_delivery_on_cpu1")
        .unwrap();
    let s417 = source
        .find("service_s417_handshake_attempt_reconciliation_on_cpu1")
        .unwrap();
    let s416 = source
        .find("service_s416_production_exclusion_handshake_on_cpu1")
        .unwrap();
    assert!(s421 < s417 && s417 < s416);
    let name = "g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s421_reconciled_s187_handoff_delivery";
    assert!(include_str!("../../kernel/src/main.rs").contains(&format!("mod {name};")));
    assert!(include_str!("../src/lib.rs").contains(&format!("pub mod {name};")));
}

  {
    id: "g8l-s421-reconciled-s187-handoff-delivery-partial",
    sequence: 421,
    slug: "reconciled_s187_handoff_delivery",
    title: "Reconciled S187 handoff delivery",
    focusedTests: 8,
    sourceBytes: 12439,
    sourceSha256:
      "c4a28a3eaf62556a82dc0b1037bbd201a218e2b523cb7e4d782d267281b5fc9a",
    testBytes: 7356,
    testSha256:
      "336dec8e1335b7afc7cf7de73117d4e55c92318b9692f70c692fd44fe3685495",
    acceptance:
      "CPU1 exact S420 success ACK'ini tüketir, preserved S243 slot'tan non-Copy S187 handoff'u alır ve capacity-one reconciled delivery state'ine koyar.",
    retainedBoundary:
      "Handoff teslim edilmiştir fakat S187 continuation invocation S423'e kadar yapılmaz.",
  },