G8h RPi5 production wiring GREEN; S97 layout sırada

/// Consume exactly two CPU1-local PPI27 interrupts while ownership is active.
#[no_mangle]
#[inline(never)]
pub fn rpi5_g8g_try_handle_secondary_irq(
    ctx: &mut ExceptionContext,
    ack: u32,
    int_id: u32,
) -> bool {
    if !rpi5_g8g_secondary_irq_active() {
        return false;
    }
    let stage = STAGE.load(Ordering::Acquire);
    if stage != STAGE_ARMED && stage != STAGE_IRQ1 {
        return consume_irq_error(ctx, ack, int_id, ERR_THIRD_IRQ, STAGE_IRQ2, stage);
    }
    if int_id != TIMER_PPI {
        return consume_irq_error(
            ctx,
            ack,
            int_id,
            ERR_IRQ_ID,
            TIMER_PPI as u64,
            int_id as u64,
        );
    }
    if ack != TIMER_PPI {
        return consume_irq_error(ctx, ack, int_id, ERR_ACK_RAW, TIMER_PPI as u64, ack as u64);
    }
    if ctx.spsr_el1 & SPSR_IRQ_MASK != 0 {
        return consume_irq_error(ctx, ack, int_id, ERR_FINAL_DAIF, 0, ctx.spsr_el1);
    }

    let expected_prior = if stage == STAGE_ARMED { 0 } else { 1 };
    if IRQ_DELIVERIES.load(Ordering::Acquire) != expected_prior
        || IRQ_ACKS.load(Ordering::Acquire) != expected_prior
        || IRQ_EOIS.load(Ordering::Acquire) != expected_prior
        || DEADLINE_ADVANCES.load(Ordering::Acquire) != expected_prior
    {
        return consume_irq_error(
            ctx,
            ack,
            int_id,
            ERR_IRQ_COUNTS,
            expected_prior,
            IRQ_DELIVERIES.load(Ordering::Relaxed),
        );
    }

    let before = match timer::rpi5_g8g_periodic_snapshot(SLOT_CPU1) {
        Ok(snapshot) => snapshot,
        Err(_) => return consume_irq_error(ctx, ack, int_id, ERR_TIMER_SNAPSHOT, 1, 0),
    };
    let fired_count = timer::read_count();
    let after = match timer::rpi5_g8g_advance_local_periodic(SLOT_CPU1) {
        Ok(snapshot) => snapshot,
        Err(_) => return consume_irq_error(ctx, ack, int_id, ERR_TIMER_ADVANCE, 1, 0),
    };
    let expected_next = match before.next_cval.checked_add(before.period) {
        Some(value) => value,
        None => {
            return consume_irq_error(
                ctx,
                ack,
                int_id,
                ERR_TIMER_ARITHMETIC,
                before.next_cval,
                before.period,
            )
        }
    };
    let expected_tick = match before.ticks.checked_add(1) {
        Some(value) => value,
        None => return consume_irq_error(ctx, ack, int_id, ERR_TIMER_ARITHMETIC, before.ticks, 1),
    };
    if after.next_cval != expected_next
        || after.ticks != expected_tick
        || fired_count < before.next_cval
        || fired_count >= after.next_cval
    {
        return consume_irq_error(
            ctx,
            ack,
            int_id,
            ERR_TIMER_ARITHMETIC,
            expected_next,
            after.next_cval,
        );
    }
    let drift = fired_count - before.next_cval;
    let delivery = expected_prior + 1;
    let final_ctl = if delivery == EXPECTED_CPU1_DELIVERIES {
        match timer::rpi5_g8g_disable_local_timer(SLOT_CPU1) {
            Ok(control) => control,
            Err(_) => return consume_irq_error(ctx, ack, int_id, ERR_TIMER_DISABLE, 0b10, 0),
        }
    } else {
        0
    };

    gic::end_of_interrupt(ack);
    completion_barrier();
    IRQ_DELIVERIES.store(delivery, Ordering::Relaxed);
    IRQ_ACKS.store(delivery, Ordering::Relaxed);
    IRQ_EOIS.store(delivery, Ordering::Relaxed);
    DEADLINE_ADVANCES.store(delivery, Ordering::Relaxed);
    if delivery == 1 {
        IRQ1_ACK_RAW.store(ack as u64, Ordering::Relaxed);
        IRQ1_EOI_RAW.store(ack as u64, Ordering::Relaxed);
        IRQ1_PREV_CVAL.store(before.next_cval, Ordering::Relaxed);
        IRQ1_NEXT_CVAL.store(after.next_cval, Ordering::Relaxed);
        IRQ1_FIRED_COUNT.store(fired_count, Ordering::Relaxed);
        IRQ1_DRIFT_COUNTS.store(drift, Ordering::Relaxed);
        IRQ1_LOCAL_TICK.store(after.ticks, Ordering::Relaxed);
        ctx.spsr_el1 &= !SPSR_IRQ_MASK;
    } else {
        IRQ2_ACK_RAW.store(ack as u64, Ordering::Relaxed);
        IRQ2_EOI_RAW.store(ack as u64, Ordering::Relaxed);
        IRQ2_PREV_CVAL.store(before.next_cval, Ordering::Relaxed);
        IRQ2_NEXT_CVAL.store(after.next_cval, Ordering::Relaxed);
        IRQ2_FIRED_COUNT.store(fired_count, Ordering::Relaxed);
        IRQ2_DRIFT_COUNTS.store(drift, Ordering::Relaxed);
        IRQ2_LOCAL_TICK.store(after.ticks, Ordering::Relaxed);
        FINAL_TIMER_CTL.store(final_ctl, Ordering::Relaxed);
        ctx.spsr_el1 |= SPSR_IRQ_MASK;
    }
    let next_stage = if delivery == 1 {
        STAGE_IRQ1
    } else {
        STAGE_IRQ2
    };
    if STAGE
        .compare_exchange(stage, next_stage, Ordering::Release, Ordering::Acquire)
        .is_err()
    {
        ctx.spsr_el1 |= SPSR_IRQ_MASK;
        publish_secondary_error(ERR_STAGE, stage, STAGE.load(Ordering::Relaxed));
    } else {
        notify_peer();
    }
    true
}

#[test]
fn s97_pins_the_layout_source_and_reconstructs_s96_and_s95_history() {
    let s541_tail = "    crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s541_r1_cross_cpu_marker_readiness_handoff::enter_s541_readiness_handoff_then_s538_boot_ui_on_cpu0(rpi5_g8h_prerequisite_complete())\n";
    let s538_tail = "    crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s538_r1_boot_ui_marker_runtime_wiring::enter_s538_boot_ui_marker_runtime_on_cpu0(rpi5_g8h_prerequisite_complete())\n";
    let pre_s538_tail = "    loop {\n        wait_for_event();\n    }\n";
    assert_eq!(G8H.matches(s541_tail).count(), 1);
    let historical_s97 =
        G8H.replacen(s541_tail, s538_tail, 1)
            .replacen(s538_tail, pre_s538_tail, 1);
    assert_eq!(
        sha256(historical_s97.as_bytes()),
        "3756a8f33b219da6757d547166005415d41307810ba87cb6486ede72c2fe23cc"
    );
    let current_header = concat!(
        "//! Sequence 95 kept this module unreachable at its dormant checkpoint.\n",
        "//! Sequence 96 added the exact CPU0, CPU1, and IRQ seams that make it\n",
        "//! production-reachable; Sequence 97 accepts their linked machine layout.\n",
        "//! CPU0 releases exactly two statically allocated EL1 task stacks and CPU1\n",
        "//! enters task A directly through the proven stack-call trampoline.  CPU1's\n",
        "//! local PPI27 then performs the exact A -> B -> A -> B -> A route at local\n",
        "//! ticks 10, 20, 30, and 40.  The generic scheduler, allocation, migration,\n",
        "//! SGIs, CPU2/CPU3, FP/SIMD, and CPU1 UART are outside this source boundary.\n",
    );
    let s96_header = concat!(
        "//! Sequence 95 keeps this module unreachable from production.  When a later\n",
        "//! gate wires it, CPU0 releases exactly two statically allocated EL1 task\n",
        "//! stacks and CPU1 enters task A directly through the proven stack-call\n",
        "//! trampoline.  CPU1's local PPI27 then performs the exact A -> B -> A -> B\n",
        "//! -> A route at local ticks 10, 20, 30, and 40.  The generic scheduler,\n",
        "//! allocation, migration, SGIs, CPU2/CPU3, FP/SIMD, and CPU1 UART are outside\n",
        "//! this source boundary.\n",
    );
    let current_switch = concat!(
        "    let is_switch_delivery = delivery == EXPECTED_SWITCH_LOCAL_TICKS[0]\n",
        "        || delivery == EXPECTED_SWITCH_LOCAL_TICKS[1]\n",
        "        || delivery == EXPECTED_SWITCH_LOCAL_TICKS[2]\n",
        "        || delivery == EXPECTED_SWITCH_LOCAL_TICKS[3];\n",
        "    if !is_switch_delivery {",
    );
    let s96_switch = "    if !EXPECTED_SWITCH_LOCAL_TICKS.contains(&delivery) {";
    let current_zero_check = concat!(
        "fn atomic_array_is_zero(values: &[AtomicU64; 4]) -> bool {\n",
        "    values[0].load(Ordering::Acquire) == 0\n",
        "        && values[1].load(Ordering::Acquire) == 0\n",
        "        && values[2].load(Ordering::Acquire) == 0\n",
        "        && values[3].load(Ordering::Acquire) == 0\n",
        "}",
    );
    let s96_zero_check = concat!(
        "fn atomic_array_is_zero(values: &[AtomicU64; 4]) -> bool {\n",
        "    values\n",
        "        .iter()\n",
        "        .all(|value| value.load(Ordering::Acquire) == 0)\n",
        "}",
    );
    for current in [current_header, current_switch, current_zero_check] {
        assert_eq!(
            historical_s97.matches(current).count(),
            1,
            "S97 inverse boundary"
        );
    }
    let reconstructed_s96 = historical_s97
        .replacen(current_header, s96_header, 1)
        .replacen(current_switch, s96_switch, 1)
        .replacen(current_zero_check, s96_zero_check, 1);
    assert_eq!(reconstructed_s96.len(), 87_498);
    assert_eq!(
        sha256(reconstructed_s96.as_bytes()),
        "b991ef1ee49b3f906a33f05e9e52c83b18e6aa4aab71f877aaa8f75d98c0ce73"
    );
    let formatted =
        "        None => primary_fail(ERR_TIMER_ARITHMETIC, cpu1_start, published_task_window),\n";
    let historical = concat!(
        "        None => primary_fail(\n",
        "            ERR_TIMER_ARITHMETIC,\n",
        "            cpu1_start,\n",
        "            published_task_window,\n",
        "        ),\n",
    );
    assert_eq!(reconstructed_s96.matches(formatted).count(), 1);
    let reconstructed_s95 = reconstructed_s96.replacen(formatted, historical, 1);
    assert_eq!(
        sha256(reconstructed_s95.as_bytes()),
        "b92ab704e75b260d73682d3867e48c07a859de535a34be1ee4188ab8278047bb"
    );
    assert_eq!(
        sha256(G8H_CONTRACT.as_bytes()),
        "b07445fba49bf78a402128a5435606dad4450e370cf84718ae16fb9962b42f99"
    );
    let s538_harness_stub = concat!(
        "pub mod g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s538_r1_boot_ui_marker_runtime_wiring {\n",
        "    #[inline(always)]\n",
        "    pub fn enter_s538_boot_ui_marker_runtime_on_cpu0(_prior_boot_stage_complete: bool) -> ! {\n",
        "        loop {\n",
        "            core::hint::spin_loop();\n",
        "        }\n",
        "    }\n",
        "}\n\n",
    );
    let s541_harness_stub = concat!(
        "pub mod g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s541_r1_cross_cpu_marker_readiness_handoff {\n",
        "    #[inline(always)]\n",
        "    pub fn enter_s541_readiness_handoff_then_s538_boot_ui_on_cpu0(\n",
        "        prior_boot_stage_complete: bool,\n",
        "    ) -> ! {\n",
        "        crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s538_r1_boot_ui_marker_runtime_wiring::enter_s538_boot_ui_marker_runtime_on_cpu0(prior_boot_stage_complete)\n",
        "    }\n",
        "}\n\n",
    );
    let historical_harness = core::str::from_utf8(HARNESS)
        .unwrap()
        .replacen(s541_harness_stub, "", 1)
        .replacen(s538_harness_stub, "", 1);
    assert_eq!(
        HARNESS
            .windows(s538_harness_stub.len())
            .filter(|window| *window == s538_harness_stub.as_bytes())
            .count(),
        1
    );
    assert_eq!(
        HARNESS
            .windows(s541_harness_stub.len())
            .filter(|window| *window == s541_harness_stub.as_bytes())
            .count(),
        1
    );
    assert_eq!(
        sha256(historical_harness.as_bytes()),
        "904418ca85bec35a065c9d058c484072753343a01021f8a8646d66a55efb0fe9"
    );
    assert_eq!(
        sha256(UART_FIXTURE),
        "03b484ffe8db0db007ab733634c57228909760365a5a6ce85e5515666b71172d"
    );
}

  {
    id: "rpi5-g8h-production-wiring-green",
    date: "2026-08-22",
    sequence: 96,
    status: "verified",
    title: "G8h RPi5 production wiring GREEN; S97 layout sırada",
    summary:
      "Sequence 95'in dormant G8h runtime source/object prerequisite'i değiştirilmeden yalnız üç dar RPi5 production seam'i açıldı: main içindeki board-rpi5 module registration, G8g'nin success-only CPU0/CPU1 continuation'ları ve exception dispatcher'daki G8h-first Option frame-pointer intercept'i. CPU1 error park G8h'den erişilemez kaldı; CPU0 BOOT8G yazımından sonra exact final_ticks+third_check_count ile no-return primary handoff yaptı. Actual board-rpi5 kernel build ve dar ELF seam/call/frame-pointer denetimi bağımsız FINAL GO aldı. Historical G8g layout beklenen RED verdi; S97 full machine-code/layout sıradaki ayrı kapıdır. Image/package, device, UART, power ve physical BOOT8H yapılmadı; Pi kapalı ve son fiziksel PASS S92 BOOT8G'dir.",
    evidence: [
      "RPi5-only main seam: `mod g8h_contract;` ve `mod rpi5_g8h;` exact birer kez ve yalnız board-rpi5 cfg altında kayıtlı.",
      "CPU1 success-only continuation exact positive release poll → no-return `rpi5_g8h_secondary_run`; release false iken WFE, bütün error yolları ayrı terminal park'ta.",
      "Inverted release predicate ve error park'ın G8h continuation'a kaçışı exact-body validator + mutation testleriyle fail-closed reddedildi.",
      "CPU0 `third_check_count` Acquire-read ve BOOT8G UART yazımından sonra exact tek `rpi5_g8h_primary_run(final_ticks, third_check_count)` no-return handoff'u yapar.",
      "IRQ sırası exact G8h Option frame pointer → G8g bool interceptor → eski dar interceptors → generic timer/TICKS; `unwrap_or(resume_ctx)` yok.",
      "Mevcut EL1/EL0 IRQ trampolineleri returned pointer için exact `mov sp, x0` → 272 B RESTORE_CONTEXT → eret akışını korur.",
      "S96 aggregate exact 52/52 PASS: historical G8g UART 11/11 + S94 source 5/5 + G8h UART 8/8 + runtime object 1/1 + runtime source 18/18 + integration source 9/9; CLI check/run PASS ve canonical physical=NO.",
      "Serialized full simulation exact 297/297 PASS (42 result block); workspace check, fmt-all ve diff kapıları GREEN.",
      "Actual board-rpi5 kernel build PASS; frozen ELF exact 7.969.640 B / 8cb118b9c7035a3c767a075a2d67212199f02f680f5c30b75a70fe4a0cf923a4.",
      "Runtime S96 rustfmt identity exact 86.153 B / 85ea5c0d945f55843417976af2b6af47f729baee7acd9651df2fafc0a31e7541; S95 fa4fd192…f8433 exact reconstructible.",
      "Integration source test exact 11.777 B / 68fdafb55021b5a3383c985de32b745936177d3bf7b7e8e20bd096747fc72d66.",
      "Main exact 98.095 B / 90ad62b88b3c1b6d3df97384cbebed839abbd84c3f38a20305660c5f05fa36b5; G8g exact 38.347 B / 4decf8a3b6c7a98141ccf306d3d238565086522eaf9c63c7f733f16b97ab4e59.",
      "Exceptions Rust exact 38.990 B / 9bed1c95e23efc5e2c6e7d33e95a1f5a4b914af8d89c2df13c301e585d054209; unchanged exceptions.S c0eed3e2…cb89.",
      "Runtime source test exact 39.170 B / fd14966c5cbc5eb4871c0a58919ed38fa0495021382c661e453f16b163c86135; versioned S94 source test 10.074 B / 8590441a5f6df74ee0be333a9a0f4c529389b1625e6236c3fc44cfedef9ef1b2.",
      "Historical G8g AArch64 compile harness exact 2.370 B / 75311148dfe8a59d2227dd7998d046acf997dd04f23928ecf63c636ab1fa1d23; G8g runtime compile wrapper 1.133 B / 101d955454d902e5b45b4f7af8fa51f30d15a8a847663f1f2fe9838397626da0.",
      "Makefile exact 24.824 B / 996f99a1a060bc3e39062733662a5a6eba018404c7ab77da789ebb51457c6fae; integration target runtime→source test→actual RPi5 build ile sınırlı.",
      "Historical G8g layout beklenen exit 1/RED verdi çünkü G8h production symbol surface eklendi; bu S96 acceptance değildir ve S97 layout kapısı STOP kalır.",
      "S96 proof exact 270 satır / 10.978 B / bb1a75cc1af5f316413ff3faa108d5f4123d18414cd15399b6ffce55b427ad0a.",
      "Bağımsız reviewer source seams, error/success split, IRQ pointer semantiği, narrow ELF ve artifact/hardware sınırlarının tamamına FINAL GO verdi.",
      "Son fiziksel PASS değişmedi: S92 immutable 18.978 B / 4abf8bb1…1a2 BOOT8G raw; Pi kapalı, image/device/UART/power/BOOT8H=NOT_PERFORMED.",
    ],
    terminalSessionsNote:
      "Sequence 96 oturumları production source wiring, narrow ELF ve actual board build kanıtıdır; full layout, image/package veya fiziksel UART/BOOT8H oturumu değildir.",
    terminalSessions: [
      {
        id: "g8h-sequence96-integration-source",
        title: "RPi5-only seam ve adversarial source TDD",
        commandLines: [
          "cargo test -p aselsan_microkernel_simulation --test rpi5_g8h_integration_source -- --test-threads=1",
          "verify positive release, error-only park and Option frame-pointer ordering",
        ],
        outputLines: [
          "integration source=9/9 PASS",
          "main/G8g/exceptions seams=PASS · inverted release/error escape=REJECTED",
          "timer/GIC/boot scope mutation=ABSENT",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8h-sequence96-aggregate-and-board",
        title: "Aggregate host, serialized regression ve actual RPi5 build",
        commandLines: [
          "make verify-rpi5-g8h-integration",
          "cargo test -p aselsan_microkernel_simulation -- --test-threads=1",
          "cargo check --workspace && cargo fmt --all -- --check",
        ],
        outputLines: [
          "aggregate=52/52 PASS · CLI check/run=PASS · physical=NO",
          "board-rpi5 kernel build=PASS · ELF=7969640 B / 8cb118b9…923a4",
          "serialized simulation=297/297 PASS · result_blocks=42",
          "workspace check=PASS · fmt-all=PASS · diff=PASS",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "g8h-sequence96-independent-final-audit",
        title: "Bağımsız production-wiring final audit",
        commandLines: [
          "re-audit frozen S96 source/test/ELF identities and exact narrow seams",
          "run historical G8g layout fail-closed and inspect artifact/hardware boundaries",
        ],
        outputLines: [
          "production-wiring reviewer=FINAL GO",
          "runtime=85ea5c0d…e7541 · integration=68fdafb5…2d66 · ELF=8cb118b9…923a4",
          "historical G8g layout=EXPECTED RED exit1 · S97 full layout=STOP",
          "image/package/device/UART/power/BOOT8H=NOT_PERFORMED",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
    ],
    limitations: [
      "S96 yalnız RPi5 production reachability ve narrow seam/call/frame-pointer kabulüdür; full G8h machine-code/layout değildir.",
      "S97 production machine-code + layout sıradaki ayrı kapıdır; tam matrix, reproducibility ve image/package daha sonra açılır.",
      "Pi kapalı tutulur; microSD, UART descriptor/capture, power, raw/archive ve fiziksel BOOT8H kapıları STOP'tur.",
      "Generic SMP scheduler/runqueue, migration, load balancing, ASID/TLB shootdown, CPU2/CPU3, hotplug ve soak kapalıdır.",
      "Production deployment dirty/untracked workspace ve stale 47d22c9 source etiketiyle yapılır; canlı artifact doğrulansa da Git-provider provenance kurulmuş sayılmaz.",
    ],
  },