G8i: per-CPU runqueue ve exception ownership model

//! G8i host/model contract for per-CPU runqueue and exception ownership.
//!
//! This is deliberately a bounded model.  It proves the ownership and
//! mailbox rules before the production scheduler/exception wiring is opened;
//! it does not claim QEMU, physical-board, migration, or generic-SMP runtime
//! evidence.

pub const MAX_CPUS: usize = 4;
pub const MAX_QUEUE: usize = 8;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct TaskToken {
    pub id: u64,
    pub owner_cpu: usize,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct ExceptionFrame {
    pub task_id: u64,
    pub owner_cpu: usize,
    pub generation: u64,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
struct MailboxRequest {
    source_cpu: usize,
    target_cpu: usize,
    generation: u64,
    task: TaskToken,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum RunQueueError {
    InvalidCpu,
    ForeignMutation,
    WrongOwner,
    QueueFull,
    QueueEmpty,
    DuplicateTask,
    MailboxBusy,
    StaleGeneration,
    ExceptionAlreadyOwned,
    ExceptionTaskAlreadyOwned,
    ExceptionOwnerMismatch,
    ExceptionEmpty,
    WfiWithPendingMailbox,
}

pub struct PerCpuRunQueueModel {
    queues: [[Option<TaskToken>; MAX_QUEUE]; MAX_CPUS],
    mailboxes: [Option<MailboxRequest>; MAX_CPUS],
    applied_generations: [u64; MAX_CPUS],
    exceptions: [Option<ExceptionFrame>; MAX_CPUS],
    wfi: [bool; MAX_CPUS],
}

#[test]
fn exception_frame_is_owned_by_exactly_one_cpu() {
    let mut model = PerCpuRunQueueModel::new();
    let frame = ExceptionFrame {
        task_id: 16,
        owner_cpu: 1,
        generation: 4,
    };
    assert_eq!(
        model.enter_exception(0, frame),
        Err(RunQueueError::ExceptionOwnerMismatch)
    );
    model.enter_exception(1, frame).unwrap();
    assert_eq!(
        model.enter_exception(
            2,
            ExceptionFrame {
                task_id: frame.task_id,
                owner_cpu: 2,
                generation: frame.generation,
            },
        ),
        Err(RunQueueError::ExceptionTaskAlreadyOwned)
    );
    assert_eq!(
        model.enter_exception(1, frame),
        Err(RunQueueError::ExceptionAlreadyOwned)
    );
    assert_eq!(model.leave_exception(1).unwrap(), frame);

    let mut claimed = PerCpuRunQueueModel::new();
    claimed
        .enqueue_local(
            1,
            TaskToken {
                id: 19,
                owner_cpu: 1,
            },
        )
        .unwrap();
    assert_eq!(
        claimed.enter_exception(
            2,
            ExceptionFrame {
                task_id: 19,
                owner_cpu: 2,
                generation: 1,
            },
        ),
        Err(RunQueueError::ExceptionOwnerMismatch)
    );
}

  {
    id: "g8i-per-cpu-runqueue-ownership-model-partial",
    date: "2026-08-24",
    sequence: 155,
    status: "passed",
    umbrella_status: "partial",
    title: "G8i: per-CPU runqueue ve exception ownership model",
    summary:
      "S155, roadmap'deki ilk SMP kapısı olarak dört bağımsız per-CPU queue, target-owned transactional mailbox/generation drain, tekil task owner, per-CPU exception-frame owner ve WFI wake/admission kurallarını host/model seviyesinde 8/8 kapattı. Bu kaynak/model kabulüdür; production scheduler wiring, QEMU ve fiziksel runtime açılmadı.",
    evidence: [
      "g8i_per_cpu_runqueue: 8/8 PASS; dört queue bağımsız başlıyor, local owner yazabiliyor, foreign mutation reddediliyor.",
      "Remote enqueue target queue'yu mailbox drain'e kadar değiştirmiyor; duplicate/stale generation ve duplicate task fail-closed kapanıyor.",
      "Foreign drain reddediliyor; dolu queue yüzünden admission başarısızsa mailbox/generation değişmeden korunuyor ve pending task ikinci kez rezerve edilemiyor.",
      "Exception frame yalnız exact CPU owner tarafından tutuluyor; aynı task için cross-CPU frame reddediliyor, remote publish WFI hedefini uyandırıyor ve pending mailbox varken target WFI reddediliyor.",
      "Kalıcı kapsam: `docs/M8.1-RPi5-G8i-Per-CPU-Runqueue-Ownership-Proof.md`.",
      "S155 fiziksel/device operasyonu yapmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S155=NO.",
    ],
    commands: ["cargo test --test g8i_per_cpu_runqueue"],
    terminalSessions: [
      {
        id: "s155-g8i-runqueue-model",
        title: "G8i per-CPU queue/exception ownership host model kapısı",
        commandLines: ["cargo test --test g8i_per_cpu_runqueue"],
        outputLines: ["running 8 tests", "test result: ok. 8 passed; 0 failed"],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S155 yalnız bounded host/model contract'tır; production scheduler, exception assembly, QEMU, fiziksel RPi ve generic SMP runtime sonucu değildir.",
    limitations: [
      "Production global scheduler henüz per-CPU queue'lara bağlanmadı; bu kapı model/source sınırındadır.",
      "Gerçek per-CPU IRQ stack, exception-frame trampoline ve context switch sonraki G8i runtime kapılarında açılmalıdır.",
      "Migration, ASID/TLB shootdown, CPU2/CPU3, hotplug, long soak ve generic SMP arbitration kapsam dışıdır.",
      "Fiziksel/device operations=0; RUNBOOK_EXECUTED_IN_S155=NO.",
    ],
  },