G8l: TLBI completion → mapping retirement → READY

use crate::g8l_target_dispatch_tlbi_commit::{
    G8lTargetDispatchTlbiCommitError, G8lTargetDispatchTlbiCommitReceipt,
};

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lTargetDispatchMappingRetirementError {
    TlbiCommit(G8lTargetDispatchTlbiCommitError),
    Runtime(G8lRuntimeError),
    RuntimePhaseMismatch,
    ActiveTicketMissing,
    RuntimeInstanceMismatch,
    ContextGenerationMismatch,
    RuntimeInputMismatch,
    InvalidCallerCpu,
    TlbiCommitNotConsumed,
}

impl From<G8lTargetDispatchTlbiCommitError> for G8lTargetDispatchMappingRetirementError {
    fn from(error: G8lTargetDispatchTlbiCommitError) -> Self {
        Self::TlbiCommit(error)
    }
}

impl From<G8lRuntimeError> for G8lTargetDispatchMappingRetirementError {
    fn from(error: G8lRuntimeError) -> Self {
        Self::Runtime(error)
    }
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
struct ExactMappingRetirementIdentity {
    runtime_instance_id: u64,
    ticket: MigrationTicket,
    context_generation: u64,
}

impl ExactMappingRetirementIdentity {
    fn capture(
        runtime: &G8lRuntimeAuthority,
    ) -> Result<Self, G8lTargetDispatchMappingRetirementError> {
        if runtime.phase() != RuntimePhase::ShootdownComplete {
            return Err(G8lTargetDispatchMappingRetirementError::RuntimePhaseMismatch);
        }
        let ticket = runtime
            .active_ticket()
            .ok_or(G8lTargetDispatchMappingRetirementError::ActiveTicketMissing)?;
        let identity = Self {
            runtime_instance_id: runtime.instance_id(),
            ticket,
            context_generation: runtime.context_generation(),
        };
        identity.revalidate(runtime)?;
        Ok(identity)
    }

    fn revalidate(
        self,
        runtime: &G8lRuntimeAuthority,
    ) -> Result<(), G8lTargetDispatchMappingRetirementError> {
        if runtime.phase() != RuntimePhase::ShootdownComplete {
            return Err(G8lTargetDispatchMappingRetirementError::RuntimePhaseMismatch);
        }
        if self.runtime_instance_id == 0 || runtime.instance_id() != self.runtime_instance_id {
            return Err(G8lTargetDispatchMappingRetirementError::RuntimeInstanceMismatch);
        }
        if runtime.active_ticket() != Some(self.ticket) {
            return Err(G8lTargetDispatchMappingRetirementError::RuntimeInputMismatch);
        }
        if self.context_generation == 0 || runtime.context_generation() != self.context_generation {
            return Err(G8lTargetDispatchMappingRetirementError::ContextGenerationMismatch);
        }
        let input = runtime.migration_input();
        if self.ticket.source_cpu != CPU0
            || self.ticket.target_cpu != CPU1
            || input.task_id != self.ticket.task_id
            || input.owner_cpu != self.ticket.source_cpu
            || input.asid != self.ticket.asid
            || input.root != self.ticket.root
            || input.address_space_generation != self.ticket.address_space_generation
            || input.user_progress != self.ticket.user_progress_before
        {
            return Err(G8lTargetDispatchMappingRetirementError::RuntimeInputMismatch);
        }
        Ok(())
    }
}

#[test]
fn duplicate_retirement_is_fail_closed() {
    let mut runtime = shootdown_complete();
    let input = G8lBoundedMappingRetirementModelInput::capture(&runtime).unwrap();
    G8lTargetDispatchMappingRetirementReceipt::commit_bounded_source_model(
        &mut runtime,
        CPU0,
        input,
    )
    .unwrap();

    assert_eq!(
        G8lTargetDispatchMappingRetirementReceipt::commit_bounded_source_model(
            &mut runtime,
            CPU0,
            input,
        ),
        Err(G8lTargetDispatchMappingRetirementError::RuntimePhaseMismatch)
    );
    assert_eq!(runtime.phase(), RuntimePhase::ReadyPublished);
}

  {
    id: "g8l-s186-old-mapping-retirement-runtime-commit-partial",
    date: "2026-08-24",
    sequence: 186,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: TLBI completion → mapping retirement → READY",
    summary:
      "S186, non-Copy S185 TLBI-commit receipt'ini by-value tüketen 9/9 allocation-free boundary ile aynı canlı S166 authority üzerinde ShootdownComplete→MappingRetired→ReadyPublished sırasını commit etti. Exact runtime instance/ticket/context/task/ASID/root/address-space-generation/CPU0→CPU1/user-progress zarfı yeniden doğrulanır; wrong CPU, foreign runtime, erken faz ve duplicate capture fail-closed kalır.",
    evidence: [
      "g8l_target_dispatch_mapping_retirement: 9/9 PASS; focused source model ShootdownComplete→MappingRetired→ReadyPublished sırasını ve tekrar fail-closed yollarını doğrular.",
      "S155–S186 birleşik matris iki bağımsız koşuda 32 grup / 274/274 PASS verdi; canonical özet 1225 B / SHA-256 2d979fabec6fb09ede59cb8bed9a233db0a5e3f9fd4b888ed30066bd9b80a55d.",
      "RPi5 AArch64 source compile PASS: 441 warning envanterlendi, hata yok; 187505 B log / SHA-256 68049aec3f727cd5caa4f5f3ba6faa4dbbdda4c99f8408b10c30c188b975fdbb. Zero-warning iddiası yoktur.",
      "Host bounded model gerçek ShootdownComplete→MappingRetired→ReadyPublished state mutation'ını çalıştırdı; wrong CPU, foreign authority, early phase ve duplicate capture yolları state/ticket'i değiştirmedi.",
      "Production constructor yalnız S185 non-Copy TLBI commit receipt değerini by-value kabul eder. Host model input AArch64 bare-metal build'de yoktur ve hardware_derived=false kalır.",
      "Exact ticket readback ASID/root/address-space-generation/TTBR0 operandı ile eşleşir; old mapping retirement tamamlanmadan READY publication çağrısı yoktur.",
      "Kalıcı kapsam: `docs/M8.1-RPi5-G8l-S186-Mapping-Retirement-READY-Proof.md`.",
      "S186 fiziksel/device operasyonu yapmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S186=NO.",
    ],
    commands: [
      "cargo test --quiet --test g8l_target_dispatch_mapping_retirement -- --test-threads=1",
      "cargo check --quiet --manifest-path kernel/Cargo.toml --target aarch64-unknown-none --no-default-features --features board-rpi5",
    ],
    terminalSessions: [
      {
        id: "s186-g8l-target-dispatch-mapping-retirement-ready",
        title: "G8l S186 mapping retirement → READY boundary",
        commandLines: [
          "cargo test --quiet --test g8l_target_dispatch_mapping_retirement -- --test-threads=1",
        ],
        outputLines: [
          "running 9 tests",
          "test result: ok; 9 passed; 0 failed",
          "ShootdownComplete → MappingRetired → ReadyPublished",
          "ticket readback: exact / hardware_derived=false",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S186 dar typed boundary kabulü PASS'tir; production invocation, scheduler owner transferi, GIC/hardware runtime ve fiziksel çalışma açık kalır.",
    limitations: [
      "Production constructor source içinde wired durumdadır fakat canlı S185 receipt ile invocation iddiası yoktur; readback bounded source değeridir.",
      "Scheduler owner mutation/global exclusion, context-switch assembly, GIC/SGI delivery, QEMU ve fiziksel RPi runtime açıktır.",
      "S186 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S186=NO.",
    ],
  },