G8l: ContextSwitched → Running1 source-model ERET

impl G8lTargetDispatchEretReceipt {
    fn commit_exact(
        runtime: &mut G8lRuntimeAuthority,
        caller_cpu: usize,
        identity: ExactEretIdentity,
        context_switch_consumed: bool,
    ) -> Result<Self, G8lTargetDispatchEretError> {
        if caller_cpu != CPU1 {
            return Err(G8lTargetDispatchEretError::InvalidCallerCpu);
        }
        identity.revalidate(runtime)?;
        runtime.commit_eret(
            caller_cpu,
            identity.ticket,
            identity.readback,
            identity.context_generation,
        )?;
        Ok(Self {
            runtime_instance_id: identity.runtime_instance_id,
            ticket: identity.ticket,
            context_generation: identity.context_generation,
            readback: identity.readback,
            context_switch_consumed,
        })
    }

    /// Consume the exact S187 context-switch receipt and commit only the
    /// source-model `ContextSwitched → Running1` authority transition.
    pub fn commit_context_switch(
        runtime: &mut G8lRuntimeAuthority,
        caller_cpu: usize,
        context_switch: G8lTargetDispatchContextSwitchReceipt,
    ) -> Result<Self, G8lTargetDispatchEretError> {
        context_switch.revalidate_runtime(runtime)?;
        let identity = ExactEretIdentity::from_context_switch_receipt(&context_switch);
        Self::commit_exact(runtime, caller_cpu, identity, true)
    }

    pub const fn runtime_instance_id(&self) -> u64 {
        self.runtime_instance_id
    }

    pub const fn ticket(&self) -> MigrationTicket {
        self.ticket
    }

    pub const fn context_generation(&self) -> u64 {
        self.context_generation
    }

    pub const fn readback(&self) -> Ttbr0Readback {
        self.readback
    }

    pub const fn context_switch_consumed(&self) -> bool {
        self.context_switch_consumed
    }

    /// Revalidate the consumed S188 receipt against the exact live Running1
    /// source-model result before a later typed boundary can retain it.
    pub fn revalidate_runtime(
        &self,
        runtime: &G8lRuntimeAuthority,
    ) -> Result<(), G8lTargetDispatchEretError> {
        if runtime.phase() != RuntimePhase::Running1 {
            return Err(G8lTargetDispatchEretError::RuntimePhaseMismatch);
        }
        if runtime.instance_id() != self.runtime_instance_id {
            return Err(G8lTargetDispatchEretError::RuntimeInstanceMismatch);
        }
        if runtime.active_ticket().is_some() {
            return Err(G8lTargetDispatchEretError::ActiveTicketMissing);
        }
        if runtime.context_generation() != self.context_generation {
            return Err(G8lTargetDispatchEretError::ContextGenerationMismatch);
        }
        let input = runtime.migration_input();
        if input.owner_cpu != CPU1
            || input.task_id != self.ticket.task_id
            || input.asid != self.ticket.asid
            || input.root != self.ticket.root
            || input.address_space_generation != self.ticket.address_space_generation
            || input.user_progress != self.ticket.user_progress_after
            || self.readback.asid != self.ticket.asid
            || self.readback.root != self.ticket.root
            || self.readback.address_space_generation != self.ticket.address_space_generation
            || self.readback.ttbr0_operand != self.ticket.ttbr0_operand
        {
            return Err(G8lTargetDispatchEretError::RuntimeInputMismatch);
        }
        Ok(())
    }

    pub const fn eret_committed(&self) -> bool {
        true
    }

    /// The bounded runtime authority committed its ERET transition. No target
    /// instruction execution is implied by this source-model receipt.
    pub const fn hardware_eret_executed(&self) -> bool {
        false
    }

    pub const fn running1_published(&self) -> bool {
        true
    }

    pub const fn active_ticket_cleared(&self) -> bool {
        true
    }

    pub const fn runtime_authority_owner_transferred(&self) -> bool {
        true
    }

    pub const fn user_progress_committed(&self) -> bool {
        true
    }

    pub const fn scheduler_owner_mutated(&self) -> bool {
        false
    }

    pub const fn gic_delivery_wired(&self) -> bool {
        false
    }

    pub const fn hardware_runtime_observed(&self) -> bool {
        false
    }
}

#[test]
fn duplicate_eret_is_fail_closed() {
    let mut runtime = context_switched();
    let input = G8lBoundedEretModelInput::capture(&runtime).unwrap();
    G8lTargetDispatchEretReceipt::commit_bounded_source_model(&mut runtime, CPU1, input).unwrap();

    assert_eq!(
        G8lBoundedEretModelInput::capture(&runtime),
        Err(G8lTargetDispatchEretError::RuntimePhaseMismatch)
    );
    assert_eq!(runtime.phase(), RuntimePhase::Running1);
    assert_eq!(runtime.active_ticket(), None);
}

  {
    id: "g8l-s188-context-switched-running1-eret-runtime-commit-partial",
    date: "2026-08-24",
    sequence: 188,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: ContextSwitched → Running1 source-model ERET",
    summary:
      "S188, non-Copy S187 context-switch receipt'ini by-value tüketen 9/9 allocation-free boundary ile aynı canlı S166 authority üzerinde ContextSwitched→Running1 source-model geçişini commit etti. Active migration ticket kapandı, runtime authority owner CPU0→CPU1 ve user-progress 17→18 ilerledi. Exact runtime/ticket/context/readback zarfı yeniden doğrulanır; wrong caller, foreign runtime, erken faz ve duplicate capture fail-closed kalır. Gerçek CPU1 ERET instruction/assembly çalıştırılmadı.",
    evidence: [
      "g8l_target_dispatch_eret: 9/9 PASS; focused source model ContextSwitched→Running1 sırasını, active-ticket temizliğini ve fail-closed yollarını doğrular.",
      "Odaklı test iki bağımsız koşuda 9/9 PASS ve byte-eşit kaldı: 122 B / SHA-256 9b4be5dbb3af22f272d7a585df003a615e8063de18eeb5b95117404d0d8d7780.",
      "S155–S188 birleşik matris iki bağımsız koşuda 34 grup / 293/293 PASS verdi.",
      "RPi5 AArch64 source compile PASS: 451 warning envanterlendi, hata yok; 193551 B log / SHA-256 449047d3c30f5e9c34997ba1b0d802bf59d80f9066fae20184fff3e46c9427f0. Zero-warning iddiası yoktur.",
      "Host bounded model ContextSwitched→Running1 source state mutation'ını çalıştırdı; final runtime authority owner CPU1, user-progress 17→18 ve active-ticket clear sonuçları exact doğrulandı.",
      "Production constructor yalnız S187 non-Copy context-switch receipt değerini by-value kabul eder ve ERET source-model commit öncesi canlı runtime'ı yeniden doğrular.",
      "CPU1 ERET assembly çalıştırılmaz veya hardware-derived sayılmaz; scheduler owner/global exclusion, GIC/SGI ve hardware runtime bu boundary dışında kapalıdır.",
      "Kalıcı kapsam: `docs/M8.1-RPi5-G8l-S188-ContextSwitched-Running1-Proof.md`.",
      "S188 fiziksel/device operasyonu yapmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S188=NO.",
    ],
    commands: [
      "cargo test --quiet --test g8l_target_dispatch_eret -- --test-threads=1",
      "cargo check --quiet --manifest-path kernel/Cargo.toml --target aarch64-unknown-none --no-default-features --features board-rpi5",
    ],
    terminalSessions: [
      {
        id: "s188-g8l-context-switched-running1-eret-runtime-commit",
        title: "G8l S188 ContextSwitched → Running1 source-model boundary",
        commandLines: [
          "cargo test --quiet --test g8l_target_dispatch_eret -- --test-threads=1",
        ],
        outputLines: [
          "running 9 tests",
          "test result: ok; 9 passed; 0 failed",
          "ContextSwitched → Running1; active ticket cleared",
          "CPU1 ERET assembly: not invoked / not claimed",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S188 dar typed source-model boundary kabulü PASS'tir; gerçek CPU1 ERET assembly, production scheduler owner transferi, GIC/hardware runtime ve fiziksel çalışma açık kalır.",
    limitations: [
      "Production constructor source içinde wired durumdadır fakat canlı S187 receipt ile invocation iddiası yoktur; ERET commit source-model state transition'ıdır.",
      "CPU1 ERET assembly/hardware observation, scheduler owner mutation/global exclusion, GIC/SGI delivery, QEMU ve fiziksel RPi runtime açıktır.",
      "S188 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S188=NO.",
    ],
  },