G8j: EL1 shared-root/ASID0 migration admission modeli

//! G8j bounded CPU0→CPU1 migration admission and ownership model.
//!
//! This source/model slice starts G8j only for a static EL1 task using the
//! shared root and ASID 0.  It makes the migration states and stack ownership
//! transfer explicit, rejects stale/foreign requests transactionally, and
//! keeps a task in at most one execution slot.  It does not wire production
//! scheduler migration, AArch64 context-switch assembly, QEMU, or a physical
//! device.

pub const SOURCE_CPU: usize = 0;
pub const TARGET_CPU: usize = 1;
pub const SHARED_ROOT_ID: u64 = 1;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum MigrationState {
    Running0,
    Migrating,
    Ready1,
    Running1,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct MigrationTask {
    pub id: u64,
    pub is_static: bool,
    pub el0: bool,
    pub asid: u16,
    pub root_id: u64,
    pub owner_cpu: usize,
    pub stack_owner_cpu: usize,
    pub stack_generation: u64,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct MigrationTicket {
    pub task_id: u64,
    pub generation: u64,
    pub stack_generation: u64,
    pub source_cpu: usize,
    pub target_cpu: usize,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum MigrationError {
    InvalidCpu,
    ForeignMutation,
    El0NotAdmitted,
    NonZeroAsidNotAdmitted,
    DynamicTaskNotAdmitted,
    PrivateRootNotAdmitted,
    WrongTask,
    DuplicateExecution,
    InvalidState,
    StaleRequest,
    StackOwnershipAmbiguous,
    StackGenerationNotMonotonic,
    TaskLost,
}

#[test]
fn exact_state_chain_is_running0_migrating_ready1_running1() {
    let mut model = G8jMigrationModel::new();
    model.start_running0(task(10, false, 0)).unwrap();
    assert_eq!(model.state(), Some(MigrationState::Running0));
    let ticket = model.begin_migration(SOURCE_CPU, 10).unwrap();
    assert_eq!(model.state(), Some(MigrationState::Migrating));
    model.publish_ready(SOURCE_CPU, ticket).unwrap();
    assert_eq!(model.state(), Some(MigrationState::Ready1));
    model.start_running1(TARGET_CPU, ticket).unwrap();
    assert_eq!(model.state(), Some(MigrationState::Running1));
    assert_eq!(model.active_ticket(), None);
}

  {
    id: "g8j-el1-asid0-migration-admission-model-partial",
    date: "2026-08-24",
    sequence: 159,
    status: "passed",
    umbrella_status: "partial",
    title: "G8j: EL1 shared-root/ASID0 migration admission modeli",
    summary:
      "S159, G8i handoff/lock modelinin sonraki dar kapısı olarak CPU0→CPU1 migration admission'ı 8/8 host/model seviyesinde kapattı: is_static=true, EL1, shared-root id=1 ve ASID0 descriptor alanları açıkça doğrulandı; dynamic/private-root/EL0/nonzero-ASID reddedildi. RUNNING0→MIGRATING→READY1→RUNNING1 zincirinde exact task/IRQ-stack owner transferi, stack generation 1→2 rotasyonu, ticket-generation binding/retirement ve task loss yokluğu doğrulandı. Production migration, ASID/TLB shootdown, QEMU, fiziksel runtime ve generic SMP açık kaldı.",
    evidence: [
      "g8j_migration: 8/8 PASS; explicit static/EL1/shared-root id=1/ASID0 descriptor admission ve exact state chain doğrulandı.",
      "Task ve IRQ-stack owner transferi exact; stack generation 1→2 döndü, ticket source generation'a bağlandı ve RUNNING1 commit'inde retire edildi.",
      "Dynamic/private-root/EL0/nonzero-ASID, foreign source/target, concurrent execution, stale/replay/forged-stack ticket, wrong task, invalid CPU ve generation 0/u64::MAX mutasyon yapmadan reddedildi.",
      "Kalıcı kapsam: `docs/M8.1-RPi5-G8j-S159-EL1-ASID0-Migration-Admission-Proof.md`.",
      "S159 fiziksel/device operasyonu yapmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S159=NO.",
    ],
    commands: [
      "cargo test -p aselsan_microkernel_simulation --test g8j_migration -- --test-threads=1",
    ],
    terminalSessions: [
      {
        id: "s159-g8j-el1-asid0-migration-admission",
        title: "G8j EL1/ASID0 migration admission host model kapısı",
        commandLines: [
          "cargo test -p aselsan_microkernel_simulation --test g8j_migration -- --test-threads=1",
        ],
        outputLines: ["running 8 tests", "test result: ok. 8 passed; 0 failed"],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S159 yalnız bounded source/model admission sözleşmesidir; production scheduler migration, context-switch assembly, ASID/TLB shootdown, QEMU, fiziksel RPi ve generic SMP runtime sonucu değildir.",
    limitations: [
      "Production migration/context-switch wiring ve ASID/TLB shootdown bağlanmadı; bu kapı source/model sınırındadır.",
      "EL0, nonzero ASID, round-trip migration, CPU2/CPU3, hotplug, long soak ve generic SMP arbitration sonraki kapılardır.",
      "QEMU ve fiziksel/device operations kapsam dışıdır; RUNBOOK_EXECUTED_IN_S159=NO.",
    ],
  },