G8l: scheduler-owner mutation-permit source boundary

use crate::g8l_target_dispatch_scheduler_owner_admission::{
    G8lSchedulerOwnerAdmissionError, G8lSchedulerOwnerAdmissionReceipt,
};

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lSchedulerOwnerMutationPermitError {
    Admission(G8lSchedulerOwnerAdmissionError),
    InvalidCallerCpu,
    RuntimePhaseMismatch,
    RuntimeInputMismatch,
}

impl From<G8lSchedulerOwnerAdmissionError> for G8lSchedulerOwnerMutationPermitError {
    fn from(error: G8lSchedulerOwnerAdmissionError) -> Self {
        Self::Admission(error)
    }
}

/// Non-Copy source-model proof that the S190 admission reached the future
/// production scheduler-mutation seam on CPU1.
#[derive(Debug, PartialEq, Eq)]
pub struct G8lSchedulerOwnerMutationPermit {
    runtime_instance_id: u64,
    task_id: u64,
    caller_cpu: usize,
    owner_cpu: usize,
    owner_epoch: u64,
    exact_s190_admission_consumed: bool,
}

impl G8lSchedulerOwnerMutationPermit {
    /// Consume the exact S190 admission receipt by value.
    pub fn from_scheduler_admission(
        runtime: &G8lRuntimeAuthority,
        authority: &G8lSchedulerOwnerAuthority,
        admission: G8lSchedulerOwnerAdmissionReceipt,
        caller_cpu: usize,
    ) -> Result<Self, G8lSchedulerOwnerMutationPermitError> {
        if caller_cpu != CPU1 {
            return Err(G8lSchedulerOwnerMutationPermitError::InvalidCallerCpu);
        }
        admission.revalidate(authority, runtime)?;
        if runtime.phase() != RuntimePhase::Running1 {
            return Err(G8lSchedulerOwnerMutationPermitError::RuntimePhaseMismatch);
        }
        if runtime.migration_input().owner_cpu != CPU1
            || runtime.migration_input().task_id != admission.task_id()
            || admission.caller_cpu() != CPU1
            || admission.owner_cpu() != CPU1
            || admission.owner_epoch() != authority.epoch()
        {
            return Err(G8lSchedulerOwnerMutationPermitError::RuntimeInputMismatch);
        }
        Ok(Self {
            runtime_instance_id: admission.runtime_instance_id(),
            task_id: admission.task_id(),
            caller_cpu,
            owner_cpu: admission.owner_cpu(),
            owner_epoch: admission.owner_epoch(),
            exact_s190_admission_consumed: true,
        })
    }

    pub fn revalidate(
        &self,
        authority: &G8lSchedulerOwnerAuthority,
        runtime: &G8lRuntimeAuthority,
    ) -> Result<(), G8lSchedulerOwnerMutationPermitError> {
        if self.caller_cpu != CPU1
            || self.owner_cpu != CPU1
            || self.owner_epoch == 0
            || self.task_id != authority.task_id()
            || authority.owner_cpu() != CPU1
            || authority.epoch() != self.owner_epoch
            || runtime.instance_id() != self.runtime_instance_id
            || runtime.phase() != RuntimePhase::Running1
            || runtime.migration_input().owner_cpu != CPU1
            || runtime.migration_input().task_id != self.task_id
        {
            return Err(G8lSchedulerOwnerMutationPermitError::RuntimeInputMismatch);
        }
        Ok(())
    }

    pub const fn runtime_instance_id(&self) -> u64 {
        self.runtime_instance_id
    }

    pub const fn task_id(&self) -> u64 {
        self.task_id
    }

    pub const fn caller_cpu(&self) -> usize {
        self.caller_cpu
    }

    pub const fn owner_cpu(&self) -> usize {
        self.owner_cpu
    }

    pub const fn owner_epoch(&self) -> u64 {
        self.owner_epoch
    }

    pub const fn exact_s190_admission_consumed(&self) -> bool {
        self.exact_s190_admission_consumed
    }

    pub const fn production_constructor_wired(&self) -> bool {
        true
    }

    pub const fn production_constructor_invoked(&self) -> bool {
        false
    }

    pub const fn scheduler_mutation_permit_published(&self) -> bool {
        true
    }

    pub const fn production_scheduler_mutated(&self) -> bool {
        false
    }

    pub const fn global_scheduler_exclusion_proven(&self) -> bool {
        false
    }

    pub const fn gic_delivery_wired(&self) -> bool {
        false
    }

    pub const fn hardware_execution_proven(&self) -> bool {
        false
    }

    pub const fn global_source_linearity_proven(&self) -> bool {
        false
    }

    pub const fn owner_error_type_is_closed(&self) -> bool {
        let _ = core::mem::size_of::<G8lSchedulerOwnerError>();
        true
    }
}

#[test]
fn publishes_exact_s190_admission_as_cpu1_mutation_permit() {
    let (runtime, authority, admission) = scheduler_admission();
    let permit = G8lSchedulerOwnerMutationPermit::from_scheduler_admission(
        &runtime, &authority, admission, CPU1,
    )
    .unwrap();

    assert_eq!(permit.runtime_instance_id(), runtime.instance_id());
    assert_eq!(permit.task_id(), TASK);
    assert_eq!(permit.caller_cpu(), CPU1);
    assert_eq!(permit.owner_cpu(), CPU1);
    assert_eq!(permit.owner_epoch(), OWNER_EPOCH + 1);
    assert!(permit.exact_s190_admission_consumed());
    permit.revalidate(&authority, &runtime).unwrap();
}

  {
    id: "g8l-s191-scheduler-owner-mutation-permit-partial",
    date: "2026-08-24",
    sequence: 191,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: scheduler-owner mutation-permit source boundary",
    summary:
      "S191, non-Copy S190 scheduler-admission receipt'ini by-value tüketen 11/11 allocation-free mutation-permit sınırını kapattı. Aynı canlı Running1 runtime, task, CPU1 owner ve epoch 23→24 yeniden doğrulanıp source-model mutation permit yayınlandı; authority/runtime ve production scheduler değiştirilmedi. Foreign authority/runtime ile CPU0 caller fail-closed kaldı.",
    evidence: [
      "g8l_target_dispatch_scheduler_owner_mutation_permit: 11/11 PASS; exact S190 admission by-value consumption, Running1/CPU1 owner revalidation and closed production claims.",
      "Odaklı test iki bağımsız koşuda 11/11 PASS ve byte-eşit kaldı: 126 B / SHA-256 0d9a424720ba8dcdb80aa72dd7f87ea926ef1c95de05e316e305f19e7e0fe3c5.",
      "S155–S191 birleşik matris iki bağımsız koşuda 37 grup / 324/324 PASS ve 4527 B / SHA-256 5aefea3913d2b957ec2ebad21cde5601ff6da65775e842c5d8c4663ac1833ed0 verdi.",
      "RPi5 AArch64 source compile PASS: 465 warning envanterlendi, hata yok; 203085 B log / SHA-256 0092719ecca06d34f70974e7e6bfe0b64697599ed8e366b5799dde0af15c326f. Zero-warning iddiası yoktur.",
      "Mutation permit yalnız source-model typed handoff'tur; production task::scheduler::SCHEDULER mutation/global exclusion, GIC/SGI, CPU1 ERET assembly ve hardware authority iddiası üretmez.",
      "Kalıcı kapsam: `docs/M8.1-RPi5-G8l-S191-Scheduler-Owner-Mutation-Permit-Proof.md`.",
      "S191 fiziksel/device operasyonu yapmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S191=NO.",
      "Görünür fiziksel sıra: Gücü kapat → SD kartı Pi'den çıkar → SD kartı Mac'e tak → Yetkili write/verify/read-back işlemini tamamla → SD kartı Mac'ten güvenli çıkar → SD kartı güçsüz Pi'ye tak → UART capture pre-arm ve exact identity kapısını doğrula → Güç ver. Bu sıra yalnız tarihsel S124'te tamamlandı.",
      "Web publication: npm test 284/284, lint, TypeScript ve statik 23/23 PASS; Cloudflare Pages Production/main deployment 671af811-4b46-498a-8e7a-a76e84b59d25 yayımlandı.",
      "Custom-domain /operations/, /timeline/ ve /yol-haritasi/ çıktıları yerel out ile byte-exact PASS: 6208821 B / e751718e…, 898452 B / cdef6531…, 898200 B / 2fd6c8eb…. Her üç route S191 marker'ını ve RUNBOOK_EXECUTED_IN_S191=NO taşıdı.",
      "Immutable pages.dev direct fetch current host'tan 10 saniye connect timeout verdi; bu immutable probe PASS olarak sayılmadı.",
    ],
    commands: [
      "cargo test --quiet --test g8l_target_dispatch_scheduler_owner_mutation_permit -- --test-threads=1",
      "cargo check --quiet --manifest-path kernel/Cargo.toml --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "npm run deploy",
    ],
    terminalSessions: [
      {
        id: "s191-g8l-scheduler-owner-mutation-permit",
        title: "G8l S191 scheduler-owner mutation-permit source boundary",
        commandLines: [
          "cargo test --quiet --test g8l_target_dispatch_scheduler_owner_mutation_permit -- --test-threads=1",
        ],
        outputLines: [
          "running 11 tests",
          "test result: ok; 11 passed; 0 failed",
          "S190 scheduler admission consumed by value; Running1/CPU1 mutation permit published",
          "production scheduler mutation/global exclusion/GIC/hardware: not invoked / not claimed",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "Terminal özeti dar S191 source sınırını gösterir; QEMU veya fiziksel cihaz çalıştırması değildir.",
    limitations: [
      "S191 dar typed mutation-permit source-model kabulü PASS'tir; gerçek production scheduler global lock/mutation, GIC/hardware runtime ve fiziksel çalışma açık kalır.",
      "Full-workspace GREEN iddia edilmez; bağımsız frozen G8h/S96 identity assertion'ları bu dilimin dışındadır.",
      "S191 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S191=NO.",
    ],
  },