G8l: scheduler-owner → production admission source boundary

use crate::g8l_target_dispatch_scheduler_owner::{
    G8lSchedulerOwnerAuthority, G8lSchedulerOwnerCommitReceipt, G8lSchedulerOwnerError,
};

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lSchedulerOwnerAdmissionError {
    OwnerCommit(G8lSchedulerOwnerError),
    InvalidCallerCpu,
    RuntimePhaseMismatch,
    RuntimeInstanceMismatch,
    RuntimeInputMismatch,
    AdmissionAlreadyConsumed,
}

impl From<G8lSchedulerOwnerError> for G8lSchedulerOwnerAdmissionError {
    fn from(error: G8lSchedulerOwnerError) -> Self {
        Self::OwnerCommit(error)
    }
}

/// Non-Copy source-model proof that the S189 owner ledger reached the
/// scheduler-admission seam on CPU1.
#[derive(Debug, PartialEq, Eq)]
pub struct G8lSchedulerOwnerAdmissionReceipt {
    runtime_instance_id: u64,
    task_id: u64,
    caller_cpu: usize,
    owner_cpu: usize,
    owner_epoch: u64,
    exact_s189_commit_consumed: bool,
}

impl G8lSchedulerOwnerAdmissionReceipt {
    /// Consume the exact S189 owner-ledger receipt by value.
    pub fn admit_production_scheduler(
        runtime: &G8lRuntimeAuthority,
        authority: &G8lSchedulerOwnerAuthority,
        commit: G8lSchedulerOwnerCommitReceipt,
        caller_cpu: usize,
    ) -> Result<Self, G8lSchedulerOwnerAdmissionError> {
        if caller_cpu != CPU1 {
            return Err(G8lSchedulerOwnerAdmissionError::InvalidCallerCpu);
        }
        commit.revalidate(authority, runtime)?;
        if runtime.phase() != RuntimePhase::Running1 {
            return Err(G8lSchedulerOwnerAdmissionError::RuntimePhaseMismatch);
        }
        if runtime.migration_input().owner_cpu != CPU1
            || runtime.migration_input().task_id != commit.task_id()
            || commit.target_cpu() != CPU1
            || commit.source_cpu() != CPU0
        {
            return Err(G8lSchedulerOwnerAdmissionError::RuntimeInputMismatch);
        }
        Ok(Self {
            runtime_instance_id: runtime.instance_id(),
            task_id: commit.task_id(),
            caller_cpu,
            owner_cpu: commit.target_cpu(),
            owner_epoch: commit.committed_epoch(),
            exact_s189_commit_consumed: true,
        })
    }

    pub fn revalidate(
        &self,
        authority: &G8lSchedulerOwnerAuthority,
        runtime: &G8lRuntimeAuthority,
    ) -> Result<(), G8lSchedulerOwnerAdmissionError> {
        if self.caller_cpu != CPU1
            || self.owner_cpu != CPU1
            || self.owner_epoch == 0
            || self.task_id != authority.task_id()
            || authority.owner_cpu() != CPU1
            || authority.epoch() != self.owner_epoch
            || runtime.instance_id() != self.runtime_instance_id
            || runtime.phase() != RuntimePhase::Running1
            || runtime.migration_input().owner_cpu != CPU1
            || runtime.migration_input().task_id != self.task_id
        {
            return Err(G8lSchedulerOwnerAdmissionError::RuntimeInputMismatch);
        }
        Ok(())
    }

    pub const fn runtime_instance_id(&self) -> u64 {
        self.runtime_instance_id
    }

    pub const fn task_id(&self) -> u64 {
        self.task_id
    }

    pub const fn caller_cpu(&self) -> usize {
        self.caller_cpu
    }

    pub const fn owner_cpu(&self) -> usize {
        self.owner_cpu
    }

    pub const fn owner_epoch(&self) -> u64 {
        self.owner_epoch
    }

    pub const fn exact_s189_commit_consumed(&self) -> bool {
        self.exact_s189_commit_consumed
    }

    pub const fn production_constructor_wired(&self) -> bool {
        true
    }

    pub const fn production_constructor_invoked(&self) -> bool {
        false
    }

    pub const fn production_scheduler_mutated(&self) -> bool {
        false
    }

    pub const fn global_scheduler_exclusion_proven(&self) -> bool {
        false
    }

    pub const fn gic_delivery_wired(&self) -> bool {
        false
    }

    pub const fn hardware_execution_proven(&self) -> bool {
        false
    }

    pub const fn global_source_linearity_proven(&self) -> bool {
        false
    }
}

#[test]
fn admission_revalidation_rejects_a_foreign_runtime_after_commit() {
    let (runtime, authority, commit) = owner_commit();
    let receipt = G8lSchedulerOwnerAdmissionReceipt::admit_production_scheduler(
        &runtime, &authority, commit, CPU1,
    )
    .unwrap();
    let (foreign_runtime, _foreign_authority, _foreign_commit) = owner_commit();
    assert_eq!(
        receipt.revalidate(&authority, &foreign_runtime),
        Err(G8lSchedulerOwnerAdmissionError::RuntimeInputMismatch)
    );
}

  {
    id: "g8l-s190-scheduler-owner-admission-partial",
    date: "2026-08-24",
    sequence: 190,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: scheduler-owner → production admission source boundary",
    summary:
      "S190, non-Copy S189 owner-ledger commit receipt'ini by-value tüketen 10/10 allocation-free scheduler-admission sınırını kapattı. Aynı canlı Running1 runtime, CPU1 owner ve epoch 23→24 yeniden doğrulanıp production-scheduler admission receipt'i source-modelde yayınlandı; authority/runtime mutasyonu yapılmadı. Foreign authority/runtime ve CPU0 caller fail-closed kaldı.",
    evidence: [
      "g8l_target_dispatch_scheduler_owner_admission: 10/10 PASS; exact S189 commit by-value consumption, Running1/CPU1 owner revalidation and closed production claims.",
      "Odaklı test iki bağımsız koşuda 10/10 PASS ve byte-eşit kaldı: 125 B / SHA-256 7742173cc9d98f4cbe90debabdf83ee6b5d3e9e965e25428a46d090582275222.",
      "S155–S190 birleşik matris iki bağımsız koşuda 36 grup / 313/313 PASS ve 4401 B / SHA-256 54a48a74d989ae77ffaa798f4e4534edb077a5267a9af52c6e2d1a3953d48c5b verdi.",
      "RPi5 AArch64 source compile PASS: 462 warning envanterlendi, hata yok; 200392 B log / SHA-256 3f7192f560216b926b2d91bea6690656191cca21a5bb01057e3c9848c967c046. Zero-warning iddiası yoktur.",
      "Scheduler-admission receipt source-modeldir; production scheduler mutation/global exclusion, GIC/SGI, CPU1 ERET/assembly ve hardware authority iddiası üretmez.",
      "Kalıcı kapsam: `docs/M8.1-RPi5-G8l-S190-Scheduler-Owner-Admission-Proof.md`.",
      "S190 fiziksel/device operasyonu yapmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S190=NO.",
    ],
    commands: [
      "cargo test --quiet --test g8l_target_dispatch_scheduler_owner_admission -- --test-threads=1",
      "cargo check --quiet --manifest-path kernel/Cargo.toml --target aarch64-unknown-none --no-default-features --features board-rpi5",
    ],
    terminalSessions: [
      {
        id: "s190-g8l-scheduler-owner-admission",
        title: "G8l S190 scheduler-owner admission source boundary",
        commandLines: [
          "cargo test --quiet --test g8l_target_dispatch_scheduler_owner_admission -- --test-threads=1",
        ],
        outputLines: [
          "running 10 tests",
          "test result: ok; 10 passed; 0 failed",
          "S189 owner-ledger commit consumed by value; Running1/CPU1 admission published",
          "production scheduler mutation/global exclusion/GIC/hardware: not invoked / not claimed",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S190 dar typed scheduler-admission source-model kabulü PASS'tir; gerçek production scheduler global lock/mutation, GIC/hardware runtime ve fiziksel çalışma açık kalır.",
    limitations: [
      "Admission receipt source içinde wired durumdadır fakat canlı production scheduler invocation iddiası yoktur.",
      "Global scheduler exclusion, production task::scheduler::SCHEDULER mutation, GIC/SGI delivery, CPU1 ERET assembly, QEMU ve fiziksel RPi runtime açıktır.",
      "S190 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S190=NO.",
    ],
  },