G8l: READY → ContextSwitched

impl G8lTargetDispatchContextSwitchReceipt {
    fn switch_exact(
        runtime: &mut G8lRuntimeAuthority,
        caller_cpu: usize,
        target_cpu: usize,
        identity: ExactContextSwitchIdentity,
        mapping_retirement_consumed: bool,
    ) -> Result<Self, G8lTargetDispatchContextSwitchError> {
        if caller_cpu != CPU0 {
            return Err(G8lTargetDispatchContextSwitchError::InvalidCallerCpu);
        }
        if target_cpu != CPU1 {
            return Err(G8lTargetDispatchContextSwitchError::InvalidTargetCpu);
        }
        identity.revalidate(runtime)?;
        runtime.context_switch(
            caller_cpu,
            target_cpu,
            identity.ticket,
            identity.context_generation,
            true,
            true,
        )?;
        Ok(Self {
            runtime_instance_id: identity.runtime_instance_id,
            ticket: identity.ticket,
            context_generation: identity.context_generation,
            readback: identity.readback,
            mapping_retirement_consumed,
        })
    }

    /// Consume the exact S186 mapping-retirement/READY receipt and commit only
    /// the source-owned transition to `ContextSwitched`.
    pub fn commit_mapping_retirement(
        runtime: &mut G8lRuntimeAuthority,
        caller_cpu: usize,
        target_cpu: usize,
        mapping_retirement: G8lTargetDispatchMappingRetirementReceipt,
    ) -> Result<Self, G8lTargetDispatchContextSwitchError> {
        mapping_retirement.revalidate_runtime(runtime)?;
        let identity = ExactContextSwitchIdentity::from_mapping_receipt(&mapping_retirement);
        Self::switch_exact(runtime, caller_cpu, target_cpu, identity, true)
    }

    /// Revalidate this production receipt against the exact context-switched
    /// runtime. Host bounded-model receipts deliberately fail this gate.
    pub fn revalidate_runtime(
        &self,
        runtime: &G8lRuntimeAuthority,
    ) -> Result<(), G8lTargetDispatchContextSwitchError> {
        if !self.mapping_retirement_consumed {
            return Err(G8lTargetDispatchContextSwitchError::ContextSwitchNotConsumed);
        }
        if runtime.phase() != RuntimePhase::ContextSwitched {
            return Err(G8lTargetDispatchContextSwitchError::RuntimePhaseMismatch);
        }
        if self.runtime_instance_id == 0 || runtime.instance_id() != self.runtime_instance_id {
            return Err(G8lTargetDispatchContextSwitchError::RuntimeInstanceMismatch);
        }
        if runtime.active_ticket() != Some(self.ticket) {
            return Err(G8lTargetDispatchContextSwitchError::RuntimeInputMismatch);
        }
        if self.context_generation == 0 || runtime.context_generation() != self.context_generation {
            return Err(G8lTargetDispatchContextSwitchError::ContextGenerationMismatch);
        }
        let input = runtime.migration_input();
        if self.ticket.source_cpu != CPU0
            || self.ticket.target_cpu != CPU1
            || input.task_id != self.ticket.task_id
            || input.owner_cpu != self.ticket.source_cpu
            || input.asid != self.ticket.asid
            || input.root != self.ticket.root
            || input.address_space_generation != self.ticket.address_space_generation
            || input.user_progress != self.ticket.user_progress_before
            || self.readback.asid != self.ticket.asid
            || self.readback.root != self.ticket.root
            || self.readback.address_space_generation != self.ticket.address_space_generation
            || self.readback.ttbr0_operand != self.ticket.ttbr0_operand
        {
            return Err(G8lTargetDispatchContextSwitchError::RuntimeInputMismatch);
        }
        Ok(())
    }

    pub const fn runtime_instance_id(&self) -> u64 {
        self.runtime_instance_id
    }

    pub const fn ticket(&self) -> MigrationTicket {
        self.ticket
    }

    pub const fn context_generation(&self) -> u64 {
        self.context_generation
    }

    pub const fn readback(&self) -> Ttbr0Readback {
        self.readback
    }

    pub const fn mapping_retirement_consumed(&self) -> bool {
        self.mapping_retirement_consumed
    }

    pub const fn context_switched(&self) -> bool {
        true
    }

    pub const fn eret_committed(&self) -> bool {
        false
    }

    pub const fn scheduler_owner_mutated(&self) -> bool {
        false
    }

    pub const fn gic_delivery_wired(&self) -> bool {
        false
    }

    pub const fn hardware_runtime_observed(&self) -> bool {
        false
    }
}

#[test]
fn duplicate_context_switch_is_fail_closed() {
    let mut runtime = ready();
    let input = G8lBoundedContextSwitchModelInput::capture(&runtime).unwrap();
    G8lTargetDispatchContextSwitchReceipt::commit_bounded_source_model(
        &mut runtime,
        CPU0,
        CPU1,
        input,
    )
    .unwrap();

    assert_eq!(
        G8lBoundedContextSwitchModelInput::capture(&runtime),
        Err(G8lTargetDispatchContextSwitchError::RuntimePhaseMismatch)
    );
    assert_eq!(runtime.phase(), RuntimePhase::ContextSwitched);
}

  {
    id: "g8l-s187-ready-context-switch-runtime-commit-partial",
    date: "2026-08-24",
    sequence: 187,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: READY → ContextSwitched",
    summary:
      "S187, non-Copy S186 mapping-retirement/READY receipt'ini by-value tüketen 10/10 allocation-free boundary ile aynı canlı S166 authority üzerinde ReadyPublished→ContextSwitched geçişini commit etti. Exact runtime instance/ticket/context/task/ASID/root/address-space-generation/CPU0→CPU1/user-progress ve ticket-derived readback zarfı yeniden doğrulanır; wrong caller/target, foreign runtime, erken faz ve duplicate capture fail-closed kalır.",
    evidence: [
      "g8l_target_dispatch_context_switch: 10/10 PASS; focused source model ReadyPublished→ContextSwitched sırasını ve tekrar fail-closed yollarını doğrular.",
      "Odaklı test iki bağımsız koşuda 10/10 PASS ve byte-eşit kaldı: 125 B / SHA-256 7742173cc9d98f4cbe90debabdf83ee6b5d3e9e965e25428a46d090582275222.",
      "S155–S187 birleşik matris iki bağımsız koşuda 33 grup / 284/284 PASS verdi.",
      "RPi5 AArch64 source compile PASS: 446 warning envanterlendi, hata yok; 190337 B log / SHA-256 3727a33ccd443c18c8d6c0f47c4d4a8283d537901bfe39d5adef0e28497afa3d. Zero-warning iddiası yoktur.",
      "Host bounded model gerçek ReadyPublished→ContextSwitched state mutation'ını çalıştırdı; wrong caller/target CPU, foreign authority, early phase ve duplicate capture yolları state/ticket'i değiştirmedi.",
      "Production constructor yalnız S186 non-Copy mapping-retirement/READY receipt değerini by-value kabul eder ve context-switch öncesi canlı runtime'ı yeniden doğrular. Host model input AArch64 bare-metal build'de yoktur ve hardware_derived=false kalır.",
      "Receipt exact ticket-derived TTBR0 readback'ı korur; CPU1 ERET/RUNNING1, scheduler owner, GIC/SGI, hardware ve context-switch assembly bu sınırda kapalıdır.",
      "Kalıcı kapsam: `docs/M8.1-RPi5-G8l-S187-READY-Context-Switch-Proof.md`.",
      "S187 fiziksel/device operasyonu yapmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S187=NO.",
    ],
    commands: [
      "cargo test --quiet --test g8l_target_dispatch_context_switch -- --test-threads=1",
      "cargo check --quiet --manifest-path kernel/Cargo.toml --target aarch64-unknown-none --no-default-features --features board-rpi5",
    ],
    terminalSessions: [
      {
        id: "s187-g8l-ready-context-switch-runtime-commit",
        title: "G8l S187 READY → ContextSwitched boundary",
        commandLines: [
          "cargo test --quiet --test g8l_target_dispatch_context_switch -- --test-threads=1",
        ],
        outputLines: [
          "running 10 tests",
          "test result: ok; 10 passed; 0 failed",
          "ReadyPublished → ContextSwitched",
          "ticket readback: exact / hardware_derived=false",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "S187 dar typed boundary kabulü PASS'tir; CPU1 ERET/RUNNING1, production scheduler owner transferi, GIC/hardware runtime ve fiziksel çalışma açık kalır.",
    limitations: [
      "Production constructor source içinde wired durumdadır fakat canlı S186 receipt ile invocation iddiası yoktur; context switch source-model state transition'ıdır.",
      "CPU1 ERET/RUNNING1, scheduler owner mutation/global exclusion, GIC/SGI delivery, context-switch assembly, QEMU ve fiziksel RPi runtime açıktır.",
      "S187 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S187=NO.",
    ],
  },