G8l: S198 exclusion lease → guarded scheduler-mutation callsite

impl<'a> G8lSchedulerOwnerSchedulerMutationGuardedCallsite<'a> {
    /// Consume the exact S198 exclusion lease by value at the callsite seam.
    pub fn from_scheduler_mutation_exclusion_lease(
        runtime: &G8lRuntimeAuthority,
        authority: &G8lSchedulerOwnerAuthority,
        lease: G8lSchedulerMutationExclusionLease<'a>,
        caller_cpu: usize,
    ) -> Result<Self, G8lSchedulerOwnerSchedulerMutationGuardedCallsiteError> {
        if caller_cpu != CPU1 {
            return Err(G8lSchedulerOwnerSchedulerMutationGuardedCallsiteError::InvalidCallerCpu);
        }
        lease.revalidate(authority, runtime)?;
        if runtime.phase() != RuntimePhase::Running1
            || runtime.migration_input().owner_cpu != CPU1
            || runtime.migration_input().task_id != lease.task_id()
            || lease.caller_cpu() != CPU1
            || lease.owner_epoch() != authority.epoch()
        {
            return Err(
                G8lSchedulerOwnerSchedulerMutationGuardedCallsiteError::RuntimeInputMismatch,
            );
        }
        Ok(Self {
            runtime_instance_id: runtime.instance_id(),
            task_id: lease.task_id(),
            caller_cpu,
            owner_epoch: lease.owner_epoch(),
            exact_s198_lease_consumed: true,
            lease,
        })
    }

    pub fn revalidate(
        &self,
        authority: &G8lSchedulerOwnerAuthority,
        runtime: &G8lRuntimeAuthority,
    ) -> Result<(), G8lSchedulerOwnerSchedulerMutationGuardedCallsiteError> {
        if self.caller_cpu != CPU1
            || self.task_id != authority.task_id()
            || authority.owner_cpu() != CPU1
            || authority.epoch() != self.owner_epoch
            || runtime.instance_id() != self.runtime_instance_id
            || runtime.phase() != RuntimePhase::Running1
            || runtime.migration_input().owner_cpu != CPU1
            || runtime.migration_input().task_id != self.task_id
        {
            return Err(
                G8lSchedulerOwnerSchedulerMutationGuardedCallsiteError::RuntimeInputMismatch,
            );
        }
        self.lease.revalidate(authority, runtime)?;
        Ok(())
    }

    pub const fn runtime_instance_id(&self) -> u64 {
        self.runtime_instance_id
    }

    pub const fn task_id(&self) -> u64 {
        self.task_id
    }

    pub const fn caller_cpu(&self) -> usize {
        self.caller_cpu
    }

    pub const fn owner_epoch(&self) -> u64 {
        self.owner_epoch
    }

    pub const fn exclusion_token(&self) -> u64 {
        self.lease.token()
    }

    /// Explicitly release the exact S198 token at the next typed boundary.
    pub fn release(
        self,
    ) -> Result<
        G8lSchedulerMutationExclusionReleaseReceipt,
        G8lSchedulerOwnerSchedulerMutationGuardedCallsiteError,
    > {
        self.lease.release().map_err(Into::into)
    }

    pub const fn exact_s198_lease_consumed(&self) -> bool {
        self.exact_s198_lease_consumed
    }

    pub const fn production_constructor_wired(&self) -> bool {
        true
    }

    pub const fn production_constructor_invoked(&self) -> bool {
        false
    }

    pub const fn scheduler_mutation_guarded_callsite_published(&self) -> bool {
        true
    }

    pub const fn production_scheduler_mutated(&self) -> bool {
        false
    }

    pub const fn all_scheduler_accesses_covered(&self) -> bool {
        false
    }

    pub const fn global_scheduler_exclusion_proven(&self) -> bool {
        false
    }

    pub const fn gic_delivery_wired(&self) -> bool {
        false
    }

    pub const fn hardware_execution_proven(&self) -> bool {
        false
    }
}

#[test]
fn wrong_caller_error_releases_the_consumed_s198_lease() {
    let (runtime, authority, commit) = runtime_and_authority();
    let exclusion = G8lSchedulerMutationExclusion::new();
    let lease = exclusion
        .try_acquire(&runtime, &authority, commit, CPU1)
        .unwrap();
    assert!(exclusion.is_locked());
    assert!(matches!(
        G8lSchedulerOwnerSchedulerMutationGuardedCallsite::from_scheduler_mutation_exclusion_lease(
            &runtime, &authority, lease, CPU0,
        ),
        Err(G8lSchedulerOwnerSchedulerMutationGuardedCallsiteError::InvalidCallerCpu)
    ));
    assert!(!exclusion.is_locked());
}

  {
    id: "g8l-s200-scheduler-mutation-guarded-callsite-partial",
    date: "2026-08-25",
    sequence: 200,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: S198 exclusion lease → guarded scheduler-mutation callsite",
    summary:
      "S200, non-Copy S198 exact-token exclusion lease'ini by-value tüketip tek bir typed guarded scheduler-mutation callsite boyunca tutan allocation-free sınırı 11/11 ile kapattı. Exact token callsite yaşarken aktif kalıyor; başarılı drop ve wrong-caller error yollarında serbest bırakılıyor. Aynı canlı Running1 runtime/task/CPU1/epoch zarfı yeniden doğrulanıyor. Production scheduler import edilmedi, çağrılmadı veya değiştirilmedi; legacy SCHEDULER erişimleri hâlâ bu callsite'a yönlendirilmedi.",
    evidence: [
      "g8l_target_dispatch_scheduler_owner_scheduler_mutation_guarded_callsite: 11/11 PASS; exact S198 lease by-value consumption, live Running1/CPU1 revalidation, success/error release and closed production claims.",
      "Exact-token lifecycle: guarded callsite boyunca active_token=exact token; callsite drop sonrası active_token=None. Wrong CPU0 caller lease'i tüketirken fail-closed reddedildi ve token sızmadı.",
      "Odaklı test iki bağımsız koşuda byte-eşit kaldı: 126 B / SHA-256 0d9a424720ba8dcdb80aa72dd7f87ea926ef1c95de05e316e305f19e7e0fe3c5.",
      "S155–S200 sıra-düzenli birleşik matris iki bağımsız koşuda 46 grup / 417/417 PASS ve 5655 B / SHA-256 2d5abe9a6e17a1cfecaaaa1fa01b1f9f238d10d1313a6b4e9e08d366229c9334 verdi.",
      "RPi5 AArch64 compile PASS: 499 warning envanterlendi, hata yok; 229954 B / SHA-256 6f405439eff6a105d5a6184e27251bcc2786fbaa9a835fa517293d1dc9cc1f37. Zero-warning iddiası yoktur.",
      "RPi5 AArch64 smp compile PASS: 499 warning envanterlendi, hata yok; 229896 B / SHA-256 cb984f103b83740ea17d68cd939aea47809cfb6752a1c4d3e6f76173e2a621c2. Zero-warning iddiası yoktur.",
      "Production source module kernel'e bağlıdır ama `task::scheduler` import etmez; constructor wired fakat runtime'da invoke edilmemiştir. Bütün legacy scheduler mutasyonlarını kapsayan global exclusion kanıtı değildir.",
      "Kalıcı kapsam: `docs/M8.1-RPi5-G8l-S200-Scheduler-Mutation-Guarded-Callsite-Proof.md`.",
      "S200 fiziksel/device operasyonu yapmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S200=NO.",
      "Görünür fiziksel sıra: Gücü kapat → SD kartı Pi'den çıkar → SD kartı Mac'e tak → Yetkili write/verify/read-back işlemini tamamla → SD kartı Mac'ten güvenli çıkar → SD kartı güçsüz Pi'ye tak → UART capture pre-arm ve exact identity kapısını doğrula → Güç ver. Bu sıra yalnız tarihsel S124'te tamamlandı.",
      "Canlı marker: S200_11_OF_11_G8L_SCHEDULER_MUTATION_GUARDED_CALLSITE_SOURCE_EXACT_S198_EXCLUSION_LEASE_CONSUMED_BY_VALUE_NONCOPY_EXACT_TOKEN_RETAINED_THROUGH_CALLSITE_SUCCESS_DROP_AND_WRONG_CALLER_ERROR_RELEASE_EXACT_LIVE_RUNNING1_CPU1_TASK_EPOCH_REVALIDATED_PRODUCTION_CONSTRUCTOR_WIRED_NOT_INVOKED_PRODUCTION_SCHEDULER_NOT_IMPORTED_NOT_MUTATED_LEGACY_SCHEDULER_ACCESSES_UNCOVERED_WHOLE_SCHEDULER_GLOBAL_EXCLUSION_GIC_HARDWARE_QEMU_PHYSICAL_CPU2_CPU3_HOTPLUG_SOAK_GENERIC_SMP_OPEN_FULL_PHYSICAL_RUNBOOK_VISIBLE_S360_TO_S410_S385_NO_RUNBOOK_EXECUTED_IN_S200_VERIFIED; deployment-specific route/hash evidence is recorded in the project-status manifest.",
    ],
    commands: [
      "cargo test --quiet --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_guarded_callsite -- --test-threads=1",
      "cargo check --quiet --manifest-path kernel/Cargo.toml --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
    ],
    terminalSessions: [
      {
        id: "s200-g8l-scheduler-mutation-guarded-callsite",
        title: "G8l S200 exact-token guarded scheduler-mutation callsite",
        commandLines: [
          "cargo test --quiet --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_guarded_callsite -- --test-threads=1",
        ],
        outputLines: [
          "running 11 tests",
          "test result: ok; 11 passed; 0 failed",
          "exact S198 lease consumed by value and retained through guarded callsite",
          "drop/error release exact; production scheduler mutation/global exclusion: not invoked / not claimed",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "Terminal özeti S200 host/source exact-token callsite kabulünü gösterir; QEMU veya fiziksel cihaz çalıştırması değildir.",
    limitations: [
      "S200 exact S198 lease'i guarded source callsite'a taşır; production scheduler mutation constructor'ını invoke etmez.",
      "Legacy static mut SCHEDULER erişimleri bu callsite'a yönlendirilmediği için whole-scheduler global exclusion ve production mutation açık kalır.",
      "S200 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S200=NO.",
    ],
  },