G8l: scheduler execution → TLBI runtime commit

impl G8lTargetDispatchTlbiCommitReceipt {
    fn commit_exact(
        runtime: &mut G8lRuntimeAuthority,
        caller_cpu: usize,
        identity: ExactTlbiCommitIdentity,
        scheduler_execution_consumed: bool,
    ) -> Result<Self, G8lTargetDispatchTlbiCommitError> {
        if caller_cpu != CPU0 {
            return Err(G8lTargetDispatchTlbiCommitError::InvalidCallerCpu);
        }
        identity.revalidate(runtime)?;
        let shootdown = ShootdownReceipt::new(
            identity.ticket.asid,
            identity.ticket.generation,
            ONLINE_MASK,
            ONLINE_MASK,
        )
        .map_err(G8lRuntimeError::from)?;
        runtime.complete_tlbi(caller_cpu, identity.ticket, shootdown)?;
        Ok(Self {
            runtime_instance_id: identity.runtime_instance_id,
            ticket: identity.ticket,
            context_generation: identity.context_generation,
            shootdown,
            scheduler_execution_consumed,
        })
    }

    /// Consume the exact S184 scheduler execution and commit only the
    /// TLBI-completion
    /// transition on the original runtime authority.
    ///
    /// This method does not mutate scheduler ownership.  The receipt is moved
    /// into the call, so success and failure cannot replay the same S184 value.
    pub fn commit_scheduler_execution(
        runtime: &mut G8lRuntimeAuthority,
        caller_cpu: usize,
        scheduler_execution: G8lTargetDispatchSchedulerExecution,
    ) -> Result<Self, G8lTargetDispatchTlbiCommitError> {
        scheduler_execution.revalidate_runtime(runtime)?;
        let identity = ExactTlbiCommitIdentity::capture(runtime)?;
        Self::commit_exact(runtime, caller_cpu, identity, true)
    }

    pub const fn runtime_instance_id(&self) -> u64 {
        self.runtime_instance_id
    }

    pub const fn ticket(&self) -> MigrationTicket {
        self.ticket
    }

    pub const fn context_generation(&self) -> u64 {
        self.context_generation
    }

    pub const fn shootdown(&self) -> ShootdownReceipt {
        self.shootdown
    }

    pub const fn scheduler_execution_consumed(&self) -> bool {
        self.scheduler_execution_consumed
    }

    /// Revalidate this production receipt against the exact completed runtime.
    ///
    /// Host bounded-model receipts deliberately fail this gate because they do
    /// not carry consumed S184 scheduler-execution authority.
    pub fn revalidate_runtime(
        &self,
        runtime: &G8lRuntimeAuthority,
    ) -> Result<(), G8lTargetDispatchTlbiCommitError> {
        if !self.scheduler_execution_consumed {
            return Err(G8lTargetDispatchTlbiCommitError::SchedulerExecutionNotConsumed);
        }
        if runtime.phase() != RuntimePhase::ShootdownComplete {
            return Err(G8lTargetDispatchTlbiCommitError::RuntimePhaseMismatch);
        }
        if self.runtime_instance_id == 0 || runtime.instance_id() != self.runtime_instance_id {
            return Err(G8lTargetDispatchTlbiCommitError::RuntimeInstanceMismatch);
        }
        if runtime.active_ticket() != Some(self.ticket) {
            return Err(G8lTargetDispatchTlbiCommitError::RuntimeInputMismatch);
        }
        if self.context_generation == 0 || runtime.context_generation() != self.context_generation {
            return Err(G8lTargetDispatchTlbiCommitError::ContextGenerationMismatch);
        }
        let input = runtime.migration_input();
        if self.ticket.source_cpu != CPU0
            || self.ticket.target_cpu != CPU1
            || input.task_id != self.ticket.task_id
            || input.owner_cpu != self.ticket.source_cpu
            || input.asid != self.ticket.asid
            || input.root != self.ticket.root
            || input.address_space_generation != self.ticket.address_space_generation
            || input.user_progress != self.ticket.user_progress_before
            || self.shootdown.asid != self.ticket.asid
            || self.shootdown.generation != self.ticket.generation
            || self.shootdown.online_mask != ONLINE_MASK
            || self.shootdown.ack_mask != ONLINE_MASK
        {
            return Err(G8lTargetDispatchTlbiCommitError::RuntimeInputMismatch);
        }
        Ok(())
    }

    pub const fn scheduler_owner_mutated(&self) -> bool {
        false
    }

    pub const fn mapping_retired(&self) -> bool {
        false
    }

    pub const fn ready_published(&self) -> bool {
        false
    }

    pub const fn gic_delivery_wired(&self) -> bool {
        false
    }

    pub const fn hardware_runtime_observed(&self) -> bool {
        false
    }
}

#[test]
fn commit_receipt_keeps_later_scheduler_phases_closed() {
    let mut runtime = installed();
    let input = G8lBoundedTlbiCommitModelInput::capture(&runtime).unwrap();
    let receipt =
        G8lTargetDispatchTlbiCommitReceipt::commit_bounded_source_model(&mut runtime, CPU0, input)
            .unwrap();

    assert_eq!(receipt.context_generation(), CONTEXT_GENERATION);
    assert!(!receipt.scheduler_owner_mutated());
    assert!(!receipt.mapping_retired());
    assert!(!receipt.ready_published());
    assert!(!receipt.gic_delivery_wired());
    assert!(!receipt.hardware_runtime_observed());
}

  {
    id: "g8l-s185-target-dispatch-tlbi-runtime-commit-partial",
    date: "2026-08-24",
    sequence: 185,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: scheduler execution → TLBI runtime commit",
    summary:
      "S185, non-Copy S184 scheduler-execution callsite değerini production constructor'da by-value tüketip aynı canlı S166 authority üzerinde Ttbr0Installed→ShootdownComplete geçişini commit eden 9/9 davranışsal kapıyı kurdu. Böylece S183 receipt → S184 typed execution callsite → S185 runtime mutation zinciri sıralı kalır. Wrong CPU, value-equal foreign runtime, erken faz ve duplicate commit mutasyonsuz fail-closed kalır; scheduler owner henüz taşınmaz.",
    evidence: [
      "g8l_target_dispatch_tlbi_commit: 9/9 PASS ve tekrar byte-eşit; exact runtime instance/ticket/context/task/ASID/root/address-space-generation/CPU0→CPU1/user-progress zarfı commit öncesi yeniden doğrulanır.",
      "Host bounded model gerçek Ttbr0Installed→ShootdownComplete state mutation'ını çalıştırdı; wrong CPU, foreign authority, early phase ve replay yolları state/ticket'i değiştirmedi.",
      "Production constructor yalnız S184 non-Copy scheduler-execution değerini by-value kabul eder. Host model input AArch64 bare-metal build'de yoktur ve hardware_derived=false kalır.",
      "S155–S185 birleşik matris S184 scheduler execution dahil iki kez 31 grup / 265/265 PASS; canonical özet 1175 B / 4524a7c9…00e4 byte-eşit kaldı.",
      "RPi5 AArch64 compile PASS; mevcut kaynak envanteri 436 warning raporladı, sıfır-warning iddiası üretilmedi.",
      "Kalıcı kapsam: `docs/M8.1-RPi5-G8l-S185-TLBI-Runtime-Commit-Proof.md`.",
      "S185 fiziksel/device operasyonu yapmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S185=NO.",
    ],
    commands: [
      "cargo test --quiet --test g8l_target_dispatch_tlbi_commit -- --test-threads=1",
      "cargo check --quiet --manifest-path kernel/Cargo.toml --target aarch64-unknown-none --no-default-features --features board-rpi5",
    ],
    terminalSessions: [
      {
        id: "s185-g8l-target-dispatch-tlbi-runtime-commit",
        title: "G8l S185 scheduler execution to TLBI runtime commit",
        commandLines: [
          "cargo test --quiet --test g8l_target_dispatch_tlbi_commit -- --test-threads=1",
        ],
        outputLines: [
          "running 9 tests",
          "test result: ok; 9 passed; 0 failed",
          "combined S155–S185: 31 groups / 265 passed / 0 failed",
          "repeat summary: 1175 B / 4524a7c9…00e4 byte-equal",
          "RPi5 AArch64 compile: PASS / 436 warnings inventoried",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S185 dar transaction kabulü PASS'tir; runtime shootdown fazı davranışsal olarak commit edilir fakat production invocation, mapping retirement ve scheduler ownership açık kalır.",
    limitations: [
      "Target-only production constructor AArch64'ta derlendi ama canlı S184 scheduler execution değeriyle çağrılmadı; hardware runtime gözlemi değildir.",
      "Old-mapping retirement, ready publication, production scheduler owner mutation/global exclusion, GIC/SGI delivery, context-switch assembly, QEMU ve fiziksel RPi runtime açıktır.",
      "S185 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S185=NO.",
    ],
  },