G8l: bounded scheduler admission; fabricated live probe rejected

use crate::g8l_authority_contract::MigrationTicket;
use crate::g8l_runtime_contract::{G8lRuntimeAuthority, G8lRuntimeError, RuntimeMigrationInput};

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct SchedulerMigrationSnapshot {
    pub task_id: u64,
    pub scheduler_owner: u64,
    pub asid: u16,
    pub root: u64,
    pub address_space_generation: u64,
    pub user_progress: u64,
    pub context_generation: u64,
    pub caller_cpu: usize,
    pub target_cpu: usize,
    pub irqs_masked: bool,
    pub scheduler_mutation_frozen: bool,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lSchedulerAdmissionError {
    Runtime(G8lRuntimeError),
    Architecture(G8lArchInstructionError),
}

impl From<G8lRuntimeError> for G8lSchedulerAdmissionError {
    fn from(error: G8lRuntimeError) -> Self {
        Self::Runtime(error)
    }
}

impl From<G8lArchInstructionError> for G8lSchedulerAdmissionError {
    fn from(error: G8lArchInstructionError) -> Self {
        Self::Architecture(error)
    }
}

#[derive(Debug)]
pub struct G8lSchedulerAdmission {
    runtime: G8lRuntimeAuthority,
    seam: G8lArchInstructionSeam,
    ticket: MigrationTicket,
    snapshot: SchedulerMigrationSnapshot,
}

impl G8lSchedulerAdmission {
    /// Bind one scheduler-owned snapshot to the exact S166/S168 source chain.
    /// This performs no allocation and no architecture I/O.
    pub fn prepare(
        snapshot: SchedulerMigrationSnapshot,
    ) -> Result<Self, G8lSchedulerAdmissionError> {
        let mut runtime = G8lRuntimeAuthority::new(RuntimeMigrationInput {
            task_id: snapshot.task_id,
            el0: true,
            asid: snapshot.asid,
            root: snapshot.root,
            address_space_generation: snapshot.address_space_generation,
            user_progress: snapshot.user_progress,
            context_generation: snapshot.context_generation,
        })?;
        let ticket = runtime.begin_migration(
            snapshot.caller_cpu,
            snapshot.scheduler_owner,
            snapshot.task_id,
            snapshot.target_cpu,
            snapshot.irqs_masked,
            snapshot.scheduler_mutation_frozen,
        )?;
        runtime.prepare_context_switch(
            snapshot.caller_cpu,
            ticket,
            snapshot.context_generation,
            snapshot.irqs_masked,
            snapshot.scheduler_mutation_frozen,
        )?;
        let seam = G8lArchInstructionSeam::from_runtime(
            &runtime,
            ArchInstructionInput {
                ticket,
                context_generation: snapshot.context_generation,
                caller_cpu: snapshot.caller_cpu,
                target_cpu: snapshot.target_cpu,
                ttbr0_operand: ticket.ttbr0_operand,
                irqs_masked: snapshot.irqs_masked,
                scheduler_mutation_frozen: snapshot.scheduler_mutation_frozen,
            },
        )?;
        Ok(Self {
            runtime,
            seam,
            ticket,
            snapshot,
        })
    }

    pub const fn ticket(&self) -> MigrationTicket {
        self.ticket
    }

    pub const fn runtime_phase(&self) -> crate::g8l_runtime_contract::RuntimePhase {
        self.runtime.phase()
    }

    pub const fn architecture_phase(
        &self,
    ) -> crate::g8l_arch_execution_contract::ArchInstructionPhase {
        self.seam.phase()
    }

    pub const fn snapshot(&self) -> SchedulerMigrationSnapshot {
        self.snapshot
    }

    /// S169 deliberately does not claim persistent scheduler ownership.
    pub const fn persistent_scheduler_runtime_is_wired(&self) -> bool {
        false
    }

    pub const fn target_execution_is_wired(&self) -> bool {
        false
    }

    pub const fn gic_receipt_is_wired(&self) -> bool {
        false
    }
}

#[test]
fn live_scheduler_snapshot_binds_s166_to_s168_without_io() {
    let admission = G8lSchedulerAdmission::prepare(SNAPSHOT).unwrap();
    assert_eq!(admission.ticket().task_id, SNAPSHOT.task_id);
    assert_eq!(admission.ticket().source_cpu, CPU0);
    assert_eq!(admission.ticket().target_cpu, CPU1);
    assert_eq!(admission.runtime_phase(), RuntimePhase::SwitchPrepared);
    assert_eq!(
        admission.architecture_phase(),
        ArchInstructionPhase::Prepared
    );
    assert_eq!(admission.snapshot(), SNAPSHOT);
    assert!(!admission.persistent_scheduler_runtime_is_wired());
    assert!(!admission.target_execution_is_wired());
    assert!(!admission.gic_receipt_is_wired());
}

  {
    id: "g8l-s169-scheduler-admission-bridge-partial",
    date: "2026-08-24",
    sequence: 169,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: bounded scheduler admission; fabricated live probe rejected",
    summary:
      "S169 denetimi preliminary live scheduler probe'unu fail-open olduğu için reddetti: ordinary same-CPU `prepare_task_for_context_switch` çağrısı CPU0→CPU1 migration gibi etiketlenmiş, address-space/context generation ile IRQ/freeze guard'ları sabit üretilmiş ve `Result` atılmıştı. Üretim çağrısı kaldırıldı. Sertleştirilmiş allocation-free bounded admission sözleşmesi exact scheduler owner/task, CPU0→CPU1, nonzero ASID/address-space/context generation, production TTBR0 operand recompute ve IRQ/scheduler-freeze girdilerini tek snapshot'a bağlayarak S166 `SwitchPrepared` → S168 `Prepared` zincirini 5/5 kapattı. Snapshot bounded input'tur; persistent scheduler-owned migration runtime, target execution, GIC/CPU1 ACK, QEMU ve fiziksel runtime açılmadı.",
    evidence: [
      "g8l_scheduler_admission: 5/5 PASS; bounded snapshot → S166 SwitchPrepared → S168 Prepared exact source chain.",
      "Production `prepare_task_for_context_switch` artık migration snapshot'ı üretmiyor: ordinary same-CPU switch CPU1 migration sayılmıyor, sabit generation/guard yok ve admission Result'ı atılmıyor.",
      "Wrong owner/CPU/target, IRQ-unmasked, mutable scheduler ve ASID=0 yolları fail-closed; tekrar oluşturulan snapshot fresh source modeldir ve persistent replay authority olarak sunulmaz.",
      "Kanonik focused log: 118 B / 822a28651276acb9a2313e85117177615e727de0782deac858623855992cf4c0; iki tekrar byte/SHA eşit.",
      "Production board-rpi5 source check başarıyla tamamlandı; yalnız mevcut workspace warning'leri kaldı.",
      "Kalıcı kapsam: `docs/M8.1-RPi5-G8l-S169-Scheduler-Admission-Bridge-Proof.md`.",
      "S169 fiziksel/device operasyonu yapmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S169=NO.",
    ],
    commands: [
      "cargo test --quiet --test g8l_scheduler_admission -- --test-threads=1",
      "cargo check -p aselsan_kernel --no-default-features --features board-rpi5 --target aarch64-unknown-none",
    ],
    terminalSessions: [
      {
        id: "s169-g8l-scheduler-admission",
        title: "G8l S169 bounded scheduler admission hardening",
        commandLines: [
          "cargo test --quiet --test g8l_scheduler_admission -- --test-threads=1",
        ],
        outputLines: ["running 5 tests", "test result: ok. 5 passed; 0 failed"],
        exitCode: 0,
        outputMode: "selected",
      },
      {
        id: "s169-g8l-scheduler-admission-board-check",
        title: "G8l S169 board-rpi5 source check",
        commandLines: [
          "cargo check -p aselsan_kernel --no-default-features --features board-rpi5 --target aarch64-unknown-none",
        ],
        outputLines: ["Finished successfully; existing warnings only"],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S169 bounded source seam PASS'tir; preliminary fabricated/ignored live probe reddedildi. Bu kayıt gerçek scheduler-owned migration runtime, target instruction, CPU1 ACK veya hardware-derived runtime sonucu değildir.",
    limitations: [
      "S169 bounded snapshot sözleşmesini bağlar; production scheduler callsite ve persistent migration state bilinçli olarak kapalıdır.",
      "Aynı snapshot'ın yeniden kurulması replay koruması değildir; exact-once authority scheduler-owned kalıcı state ile ayrıca bağlanmalıdır.",
      "Context-switch assembly, QEMU, fiziksel RPi, CPU2/CPU3, hotplug, soak ve generic SMP arbitration kapsam dışıdır.",
      "S169 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S169=NO.",
    ],
  },