S407 · Live exclusion offer publication

#![allow(unexpected_cfgs)]

//! S407 live-exclusion offer publication.
//!
//! S406 binds the exact scoped request to a live S247-backed provider
//! authority. S407 publishes one scalar CPU1-to-CPU0 offer while retaining that
//! authority in a non-copyable wrapper. The copyable offer is routing data, not
//! proof: CPU0 must still match its token against the live shared gate.
//!
//! Release and Drop clear the offer before releasing the S406 authority. The
//! production publisher is exposed but not invoked at this gate. No S244
//! admission or S243/S236 execution is claimed.

use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s244_whole_scheduler_exclusion_admission_request::{
    G8lS245WholeSchedulerExclusionAdmissionRequestState, S245_SOURCE_CPU0, S245_TARGET_CPU1,
};
use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s246_whole_scheduler_read_access_guard::{
    G8lS247WholeSchedulerAccessError, G8lS247WholeSchedulerAccessGate,
};
use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s404_scoped_authority_request_publication::G8lS404ScopedAuthorityRequestState;
use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s406_scoped_provider_authority_constructor::{
    try_construct_s406_model_scoped_provider_authority,
    G8lS406ScopedProviderAuthority, G8lS406ScopedProviderAuthorityConstructorError,
    S406_DIRECT_SCHEDULER_ACCESS_SITES, S406_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES,
    S406_SOURCE_AUDIT_UNITS, S406_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES,
    S406_UNROUTED_DIRECT_ACCESS_SITES,
};

pub const S407_SOURCE_AUDIT_UNITS: usize = S406_SOURCE_AUDIT_UNITS;
pub const S407_DIRECT_SCHEDULER_ACCESS_SITES: usize = S406_DIRECT_SCHEDULER_ACCESS_SITES;
pub const S407_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES: usize =
    S406_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES;
pub const S407_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES: usize =
    S406_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES;
pub const S407_UNROUTED_DIRECT_ACCESS_SITES: usize = S406_UNROUTED_DIRECT_ACCESS_SITES;
pub const S407_LIVE_OFFER_SLOT_CAPACITY: usize = 1;
pub const S407_PRODUCTION_LIVE_OFFER_PUBLISHER_SITES: usize = 1;
pub const S407_PRODUCTION_LIVE_OFFER_INVOCATION_CALLSITES: usize = 0;
pub const S407_PRODUCTION_ADMISSION_PUBLISHER_SITES: usize = 0;
pub const S407_LIVE_EXCLUSION_OFFER_PUBLICATION_COMPLETE: bool = true;
pub const S407_END_TO_END_EXCLUSION_ADMISSION_COMPLETE: bool = false;

/// Copyable cross-core routing metadata. It deliberately denies authority and
/// exclusion until a consumer independently matches `exclusive_token` against
/// the live S247 gate.
#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS407LiveExclusionOffer {
    pub attempt_id: u64,
    pub provider_request_id: u64,
    pub exclusive_token: u64,
    pub source_cpu: usize,
    pub target_cpu: usize,
    pub requires_live_gate_match: bool,
    pub is_authority: bool,
    pub whole_scheduler_exclusion_proven: bool,
}

#[derive(Debug)]
pub struct G8lS407LiveExclusionOfferState {
    pending: Option<G8lS407LiveExclusionOffer>,
}

impl G8lS407LiveExclusionOfferState {
    pub const fn new() -> Self {
        Self { pending: None }
    }

    pub const fn pending(&self) -> bool {
        self.pending.is_some()
    }

    pub const fn pending_offer(&self) -> Option<G8lS407LiveExclusionOffer> {
        self.pending
    }

    fn publish(
        &mut self,
        caller_cpu: usize,
        offer: G8lS407LiveExclusionOffer,
    ) -> Result<(), G8lS407LiveExclusionOfferError> {
        if caller_cpu != S245_TARGET_CPU1 {
            return Err(G8lS407LiveExclusionOfferError::WrongProducerCpu);
        }
        if self.pending.is_some() {
            return Err(G8lS407LiveExclusionOfferError::OfferSlotOccupied);
        }
        self.pending = Some(offer);
        Ok(())
    }

    fn clear_exact(&mut self, offer: G8lS407LiveExclusionOffer) -> bool {
        if self.pending == Some(offer) {
            self.pending = None;
            true
        } else {
            false
        }
    }
}

impl Default for G8lS407LiveExclusionOfferState {
    fn default() -> Self {
        Self::new()
    }
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS407LiveExclusionOfferError {
    WrongProducerCpu,
    OfferSlotOccupied,
    S406(G8lS406ScopedProviderAuthorityConstructorError),
    OfferBindingDrift,
    OfferClearDrift,
    Release(G8lS247WholeSchedulerAccessError),
}

#[derive(Debug)]
pub struct G8lS407OfferedScopedProviderAuthority<'state, 'gate> {
    offers: &'state mut G8lS407LiveExclusionOfferState,
    authority: Option<G8lS406ScopedProviderAuthority<'gate>>,
    offer: G8lS407LiveExclusionOffer,
}

impl G8lS407OfferedScopedProviderAuthority<'_, '_> {
    pub const fn offer(&self) -> G8lS407LiveExclusionOffer {
        self.offer
    }

    pub const fn is_provider_authority(&self) -> bool {
        self.authority.is_some()
    }

    pub const fn whole_scheduler_exclusion_proven(&self) -> bool {
        self.authority.is_some()
    }

    pub fn offer_pending(&self) -> bool {
        self.offers.pending_offer() == Some(self.offer)
    }

    pub fn release(
        mut self,
    ) -> Result<G8lS407LiveExclusionOfferReleaseReceipt, G8lS407LiveExclusionOfferError> {
        if !self.offers.clear_exact(self.offer) {
            return Err(G8lS407LiveExclusionOfferError::OfferClearDrift);
        }
        let authority = self
            .authority
            .take()
            .ok_or(G8lS407LiveExclusionOfferError::OfferBindingDrift)?;
        let released = authority
            .release()
            .map_err(G8lS407LiveExclusionOfferError::Release)?;
        Ok(G8lS407LiveExclusionOfferReleaseReceipt {
            attempt_id: released.attempt_id(),
            provider_request_id: released.provider_request_id(),
            exclusive_token: released.exclusive_token(),
        })
    }
}

impl Drop for G8lS407OfferedScopedProviderAuthority<'_, '_> {
    fn drop(&mut self) {
        if self.authority.is_some() {
            let cleared = self.offers.clear_exact(self.offer);
            debug_assert!(cleared, "S407 live offer drifted before authority drop");
        }
    }
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS407LiveExclusionOfferReleaseReceipt {
    attempt_id: u64,
    provider_request_id: u64,
    exclusive_token: u64,
}

impl G8lS407LiveExclusionOfferReleaseReceipt {
    pub const fn attempt_id(&self) -> u64 {
        self.attempt_id
    }

    pub const fn provider_request_id(&self) -> u64 {
        self.provider_request_id
    }

    pub const fn exclusive_token(&self) -> u64 {
        self.exclusive_token
    }

    pub const fn offer_cleared(&self) -> bool {
        true
    }

    pub const fn is_provider_authority(&self) -> bool {
        false
    }

    pub const fn whole_scheduler_exclusion_proven(&self) -> bool {
        false
    }
}

fn offer_from_model_authority(
    authority: &G8lS406ScopedProviderAuthority<'_>,
) -> G8lS407LiveExclusionOffer {
    G8lS407LiveExclusionOffer {
        attempt_id: authority.attempt_id(),
        provider_request_id: authority.provider_request_id(),
        exclusive_token: authority.exclusive_token(),
        source_cpu: S245_TARGET_CPU1,
        target_cpu: S245_SOURCE_CPU0,
        requires_live_gate_match: true,
        is_authority: false,
        whole_scheduler_exclusion_proven: false,
    }
}

fn offer_is_bound(
    offer: G8lS407LiveExclusionOffer,
    attempt_id: u64,
    provider_request_id: u64,
    exclusive_token: u64,
) -> bool {
    offer.attempt_id != 0
        && offer.attempt_id == attempt_id
        && offer.provider_request_id == provider_request_id
        && offer.exclusive_token == exclusive_token
        && offer.source_cpu == S245_TARGET_CPU1
        && offer.target_cpu == S245_SOURCE_CPU0
        && offer.requires_live_gate_match
        && !offer.is_authority
        && !offer.whole_scheduler_exclusion_proven
}

pub fn try_publish_s407_model_live_exclusion_offer<'state, 'gate>(
    offers: &'state mut G8lS407LiveExclusionOfferState,
    gate: &'gate G8lS247WholeSchedulerAccessGate,
    provider_requests: &mut G8lS245WholeSchedulerExclusionAdmissionRequestState,
    scoped_requests: &mut G8lS404ScopedAuthorityRequestState,
    caller_cpu: usize,
) -> Result<
    Option<G8lS407OfferedScopedProviderAuthority<'state, 'gate>>,
    G8lS407LiveExclusionOfferError,
> {
    if offers.pending() {
        return Err(G8lS407LiveExclusionOfferError::OfferSlotOccupied);
    }
    let authority = try_construct_s406_model_scoped_provider_authority(
        gate,
        provider_requests,
        scoped_requests,
        caller_cpu,
    )
    .map_err(G8lS407LiveExclusionOfferError::S406)?;
    let Some(authority) = authority else {
        return Ok(None);
    };
    let offer = offer_from_model_authority(&authority);
    if !offer_is_bound(
        offer,
        authority.attempt_id(),
        authority.provider_request_id(),
        authority.exclusive_token(),
    ) {
        return Err(G8lS407LiveExclusionOfferError::OfferBindingDrift);
    }
    offers.publish(caller_cpu, offer)?;
    Ok(Some(G8lS407OfferedScopedProviderAuthority {
        offers,
        authority: Some(authority),
        offer,
    }))
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
static S407_PRODUCTION_LIVE_OFFERS: spin::Mutex<G8lS407LiveExclusionOfferState> =
    spin::Mutex::new(G8lS407LiveExclusionOfferState::new());

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub struct G8lS407ProductionOfferedScopedProviderAuthority {
    authority: Option<crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s406_scoped_provider_authority_constructor::G8lS406ProductionScopedProviderAuthority>,
    offer: G8lS407LiveExclusionOffer,
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
impl G8lS407ProductionOfferedScopedProviderAuthority {
    pub const fn offer(&self) -> G8lS407LiveExclusionOffer {
        self.offer
    }

    pub const fn is_provider_authority(&self) -> bool {
        self.authority.is_some()
    }

    pub const fn whole_scheduler_exclusion_proven(&self) -> bool {
        self.authority.is_some()
    }

    pub fn offer_pending(&self) -> bool {
        S407_PRODUCTION_LIVE_OFFERS.lock().pending_offer() == Some(self.offer)
    }

    pub fn release(
        mut self,
    ) -> Result<G8lS407LiveExclusionOfferReleaseReceipt, G8lS407LiveExclusionOfferError> {
        if !S407_PRODUCTION_LIVE_OFFERS.lock().clear_exact(self.offer) {
            return Err(G8lS407LiveExclusionOfferError::OfferClearDrift);
        }
        let authority = self
            .authority
            .take()
            .ok_or(G8lS407LiveExclusionOfferError::OfferBindingDrift)?;
        let released = authority
            .release()
            .map_err(G8lS407LiveExclusionOfferError::Release)?;
        Ok(G8lS407LiveExclusionOfferReleaseReceipt {
            attempt_id: released.attempt_id(),
            provider_request_id: released.provider_request_id(),
            exclusive_token: released.exclusive_token(),
        })
    }
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
impl Drop for G8lS407ProductionOfferedScopedProviderAuthority {
    fn drop(&mut self) {
        if self.authority.is_some() {
            let cleared = S407_PRODUCTION_LIVE_OFFERS.lock().clear_exact(self.offer);
            debug_assert!(
                cleared,
                "S407 production offer drifted before authority drop"
            );
        }
    }
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn try_publish_s407_production_live_exclusion_offer_on_cpu1(
) -> Result<Option<G8lS407ProductionOfferedScopedProviderAuthority>, G8lS407LiveExclusionOfferError>
{
    use crate::g8l_runtime_contract::CPU1;

    if S407_PRODUCTION_LIVE_OFFERS.lock().pending() {
        return Err(G8lS407LiveExclusionOfferError::OfferSlotOccupied);
    }
    let authority = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s406_scoped_provider_authority_constructor::try_construct_s406_production_scoped_provider_authority_on_cpu1()
        .map_err(G8lS407LiveExclusionOfferError::S406)?;
    let Some(authority) = authority else {
        return Ok(None);
    };
    let offer = G8lS407LiveExclusionOffer {
        attempt_id: authority.attempt_id(),
        provider_request_id: authority.provider_request_id(),
        exclusive_token: authority.exclusive_token(),
        source_cpu: CPU1,
        target_cpu: S245_SOURCE_CPU0,
        requires_live_gate_match: true,
        is_authority: false,
        whole_scheduler_exclusion_proven: false,
    };
    if !offer_is_bound(
        offer,
        authority.attempt_id(),
        authority.provider_request_id(),
        authority.exclusive_token(),
    ) {
        return Err(G8lS407LiveExclusionOfferError::OfferBindingDrift);
    }
    S407_PRODUCTION_LIVE_OFFERS.lock().publish(CPU1, offer)?;
    Ok(Some(G8lS407ProductionOfferedScopedProviderAuthority {
        authority: Some(authority),
        offer,
    }))
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn inspect_s407_live_exclusion_offer_on_cpu0(
) -> Result<Option<G8lS407LiveExclusionOffer>, G8lS407LiveExclusionOfferError> {
    use crate::g8l_runtime_contract::CPU0;
    if crate::percpu::try_current_cpu_id() != Some(CPU0) {
        return Err(G8lS407LiveExclusionOfferError::WrongProducerCpu);
    }
    Ok(S407_PRODUCTION_LIVE_OFFERS.lock().pending_offer())
}

#![recursion_limit = "256"]

use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s244_whole_scheduler_exclusion_admission_request::{
    service_s245_exclusion_admission_request, G8lS245ExclusionAdmissionRequestOutcome,
    G8lS245WholeSchedulerExclusionAdmissionRequestState, S245_SOURCE_CPU0, S245_TARGET_CPU1,
};
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s246_whole_scheduler_read_access_guard::G8lS247WholeSchedulerAccessGate;
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s402_provider_invocation_observation_publication::{
    service_s402_model_provider_invocation_observation_publication,
    G8lS402ProviderInvocationObservationState,
};
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s404_scoped_authority_request_publication::{
    service_s404_model_scoped_authority_request_publication,
    G8lS404ScopedAuthorityRequestState,
};
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s406_scoped_provider_authority_constructor::{
    S406_DIRECT_SCHEDULER_ACCESS_SITES, S406_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES,
    S406_SOURCE_AUDIT_UNITS, S406_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES,
    S406_UNROUTED_DIRECT_ACCESS_SITES,
};
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s407_live_exclusion_offer_publication::*;

fn paired_states(
    first_request_id: u64,
) -> (
    G8lS247WholeSchedulerAccessGate,
    G8lS245WholeSchedulerExclusionAdmissionRequestState,
    G8lS404ScopedAuthorityRequestState,
) {
    let gate = G8lS247WholeSchedulerAccessGate::new();
    let mut providers =
        G8lS245WholeSchedulerExclusionAdmissionRequestState::with_next_request_id(first_request_id);
    assert!(matches!(
        service_s245_exclusion_admission_request(&mut providers, S245_SOURCE_CPU0, true, true),
        Ok(G8lS245ExclusionAdmissionRequestOutcome::RequestPublished(id)) if id == first_request_id
    ));
    let mut observations = G8lS402ProviderInvocationObservationState::new();
    service_s402_model_provider_invocation_observation_publication(
        &mut observations,
        &gate,
        &mut providers,
        S245_TARGET_CPU1,
    )
    .unwrap();
    let mut scoped = G8lS404ScopedAuthorityRequestState::new();
    service_s404_model_scoped_authority_request_publication(
        &mut scoped,
        &mut observations,
        S245_SOURCE_CPU0,
    )
    .unwrap();
    assert!(matches!(
        service_s245_exclusion_admission_request(&mut providers, S245_SOURCE_CPU0, true, true),
        Ok(G8lS245ExclusionAdmissionRequestOutcome::RequestPublished(id)) if id == first_request_id + 1
    ));
    (gate, providers, scoped)
}

fn module_source() -> &'static str {
    include_str!("../../kernel/src/g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s407_live_exclusion_offer_publication.rs")
}

fn exception_source() -> &'static str {
    include_str!("../../kernel/src/arch/aarch64/exceptions.rs")
}

fn kernel_main_source() -> &'static str {
    include_str!("../../kernel/src/main.rs")
}

fn simulation_lib_source() -> &'static str {
    include_str!("../src/lib.rs")
}

#[test]
fn constants_promote_only_one_live_offer_slot_and_publisher() {
    assert_eq!(S407_SOURCE_AUDIT_UNITS, 7);
    assert_eq!(S407_DIRECT_SCHEDULER_ACCESS_SITES, 113);
    assert_eq!(S407_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES, 113);
    assert_eq!(S407_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES, 113);
    assert_eq!(S407_UNROUTED_DIRECT_ACCESS_SITES, 0);
    assert_eq!(S407_LIVE_OFFER_SLOT_CAPACITY, 1);
    assert_eq!(S407_PRODUCTION_LIVE_OFFER_PUBLISHER_SITES, 1);
    assert_eq!(S407_PRODUCTION_LIVE_OFFER_INVOCATION_CALLSITES, 0);
    assert_eq!(S407_PRODUCTION_ADMISSION_PUBLISHER_SITES, 0);
    assert!(S407_LIVE_EXCLUSION_OFFER_PUBLICATION_COMPLETE);
    assert!(!S407_END_TO_END_EXCLUSION_ADMISSION_COMPLETE);
}

#[test]
fn s406_is_the_exact_live_authority_predecessor() {
    assert_eq!(S407_SOURCE_AUDIT_UNITS, S406_SOURCE_AUDIT_UNITS);
    assert_eq!(
        S407_DIRECT_SCHEDULER_ACCESS_SITES,
        S406_DIRECT_SCHEDULER_ACCESS_SITES
    );
    assert_eq!(
        S407_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES,
        S406_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES
    );
    assert_eq!(
        S407_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES,
        S406_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES
    );
    assert_eq!(
        S407_UNROUTED_DIRECT_ACCESS_SITES,
        S406_UNROUTED_DIRECT_ACCESS_SITES
    );
}

#[test]
fn exact_pair_publishes_offer_while_wrapper_and_gate_are_live() {
    let (gate, mut providers, mut scoped) = paired_states(1);
    let mut offers = G8lS407LiveExclusionOfferState::new();
    let offered = try_publish_s407_model_live_exclusion_offer(
        &mut offers,
        &gate,
        &mut providers,
        &mut scoped,
        S245_TARGET_CPU1,
    )
    .unwrap()
    .unwrap();
    let offer = offered.offer();
    assert_eq!(offer.attempt_id, 1);
    assert_eq!(offer.provider_request_id, 2);
    assert_eq!(offer.exclusive_token, 2);
    assert_eq!(offer.source_cpu, S245_TARGET_CPU1);
    assert_eq!(offer.target_cpu, S245_SOURCE_CPU0);
    assert!(offer.requires_live_gate_match);
    assert!(!offer.is_authority);
    assert!(!offer.whole_scheduler_exclusion_proven);
    assert!(offered.is_provider_authority());
    assert!(offered.whole_scheduler_exclusion_proven());
    assert!(offered.offer_pending());
    assert_eq!(gate.active_exclusive_token(), Some(2));
}

#[test]
fn explicit_release_clears_offer_before_releasing_gate() {
    let (gate, mut providers, mut scoped) = paired_states(3);
    let mut offers = G8lS407LiveExclusionOfferState::new();
    let offered = try_publish_s407_model_live_exclusion_offer(
        &mut offers,
        &gate,
        &mut providers,
        &mut scoped,
        S245_TARGET_CPU1,
    )
    .unwrap()
    .unwrap();
    let receipt = offered.release().unwrap();
    assert_eq!(receipt.attempt_id(), 3);
    assert_eq!(receipt.provider_request_id(), 4);
    assert_eq!(receipt.exclusive_token(), 2);
    assert!(receipt.offer_cleared());
    assert!(!receipt.is_provider_authority());
    assert!(!offers.pending());
    assert_eq!(gate.active_exclusive_token(), None);
}

#[test]
fn drop_clears_offer_and_releases_gate() {
    let (gate, mut providers, mut scoped) = paired_states(8);
    let mut offers = G8lS407LiveExclusionOfferState::new();
    {
        let offered = try_publish_s407_model_live_exclusion_offer(
            &mut offers,
            &gate,
            &mut providers,
            &mut scoped,
            S245_TARGET_CPU1,
        )
        .unwrap()
        .unwrap();
        assert!(offered.offer_pending());
        assert_eq!(gate.active_exclusive_token(), Some(2));
    }
    assert!(!offers.pending());
    assert_eq!(gate.active_exclusive_token(), None);
}

#[test]
fn missing_pair_is_idle_and_does_not_publish_offer() {
    let gate = G8lS247WholeSchedulerAccessGate::new();
    let mut providers = G8lS245WholeSchedulerExclusionAdmissionRequestState::new();
    let mut scoped = G8lS404ScopedAuthorityRequestState::new();
    let mut offers = G8lS407LiveExclusionOfferState::new();
    assert!(try_publish_s407_model_live_exclusion_offer(
        &mut offers,
        &gate,
        &mut providers,
        &mut scoped,
        S245_TARGET_CPU1
    )
    .unwrap()
    .is_none());
    assert!(!offers.pending());
}

#[test]
fn wrong_cpu_preserves_requests_and_offer_slot() {
    let (gate, mut providers, mut scoped) = paired_states(5);
    let mut offers = G8lS407LiveExclusionOfferState::new();
    assert!(matches!(
        try_publish_s407_model_live_exclusion_offer(
            &mut offers,
            &gate,
            &mut providers,
            &mut scoped,
            S245_SOURCE_CPU0
        ),
        Err(G8lS407LiveExclusionOfferError::S406(_))
    ));
    assert!(providers.pending());
    assert!(scoped.pending());
    assert!(!offers.pending());
}

#[test]
fn copyable_offer_is_explicitly_non_authoritative_and_requires_gate_match() {
    assert!(!core::mem::needs_drop::<G8lS407LiveExclusionOffer>());
    let source = module_source();
    let start = source.find("pub struct G8lS407LiveExclusionOffer").unwrap();
    let derive = source[..start].rfind("#[derive").unwrap();
    assert!(source[derive..start].contains("Clone, Copy"));
    let section = &source[start..source[start..].find("#[derive").unwrap() + start];
    assert!(section.contains("requires_live_gate_match"));
    assert!(section.contains("whole_scheduler_exclusion_proven"));
}

#[test]
fn offered_wrapper_is_private_non_copy_and_needs_drop() {
    assert!(core::mem::needs_drop::<
        G8lS407OfferedScopedProviderAuthority<'static, 'static>,
    >());
    let source = module_source();
    let start = source
        .find("pub struct G8lS407OfferedScopedProviderAuthority")
        .unwrap();
    let derive = source[..start].rfind("#[derive").unwrap();
    assert_eq!(source[derive..start].trim(), "#[derive(Debug)]");
}

#[test]
fn model_publication_orders_empty_slot_s406_constructor_then_offer_publish() {
    let source = module_source();
    let start = source
        .find("pub fn try_publish_s407_model_live_exclusion_offer")
        .unwrap();
    let function = &source[start..];
    let empty = function.find("offers.pending()").unwrap();
    let construct = function
        .find("try_construct_s406_model_scoped_provider_authority")
        .unwrap();
    let publish = function.find("offers.publish(").unwrap();
    assert!(empty < construct && construct < publish);
}

#[test]
fn production_publication_uses_exact_s406_constructor_and_static_slot() {
    let source = module_source();
    assert!(source.contains("static S407_PRODUCTION_LIVE_OFFERS"));
    let start = source
        .find("try_publish_s407_production_live_exclusion_offer_on_cpu1")
        .unwrap();
    let function = &source[start..];
    assert!(function.contains("try_construct_s406_production_scoped_provider_authority_on_cpu1"));
    assert!(function.contains("S407_PRODUCTION_LIVE_OFFERS.lock().publish"));
}

#[test]
fn production_publisher_is_exposed_but_not_invoked_by_exception_chain() {
    assert!(
        !exception_source().contains("try_publish_s407_production_live_exclusion_offer_on_cpu1")
    );
    assert_eq!(S407_PRODUCTION_LIVE_OFFER_INVOCATION_CALLSITES, 0);
}

#[test]
fn s407_does_not_publish_s244_admission_or_enter_s243() {
    let source = module_source();
    for forbidden in [
        "publish_s244",
        "service_s243_deferred_authority_receipt_join",
        "addr_of!(",
        "addr_of_mut!(",
    ] {
        assert!(
            !source.contains(forbidden),
            "forbidden promotion: {forbidden}"
        );
    }
}

#[test]
fn s407_and_its_exact_s408_sgi_sender_are_registered_separately() {
    let s407 = "g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s407_live_exclusion_offer_publication";
    let s408 = "g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s408_live_offer_sgi_sender";
    assert!(kernel_main_source().contains(&format!("mod {s407};")));
    assert!(simulation_lib_source().contains(&format!("pub mod {s407};")));
    assert!(kernel_main_source().contains(&format!("mod {s408};")));
    assert!(simulation_lib_source().contains(&format!("pub mod {s408};")));
}

  {
    id: "g8l-s407-live-exclusion-offer-publication-partial",
    sequence: 407,
    slug: "live_exclusion_offer_publication",
    title: "Live exclusion offer publication",
    focusedTests: 14,
    sourceBytes: 13867,
    sourceSha256:
      "19fb65850a0ae86595009902d2ca40601a2762e050a20a38c5f9b247505091eb",
    testBytes: 11736,
    testSha256:
      "9417cb79ccb6a5d90120d8b43a79fd21eeef8d6cd49f4629e41266b8d3703373",
    acceptance:
      "S406 live authority, lease ömrünü koruyan non-Copy offered-authority zarfıyla capacity-one CPU1→CPU0 live exclusion offer slot'una bağlanır.",
    retainedBoundary:
      "Offer yayımlama primitive'i vardır fakat production invocation ve SGI gönderimi S408'e kadar kapalıdır.",
  },