G8l: guarded scheduler-mutation callsite → typed receipt

use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_guarded_callsite::{
    G8lSchedulerOwnerSchedulerMutationGuardedCallsite,
    G8lSchedulerOwnerSchedulerMutationGuardedCallsiteError,
};

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lSchedulerOwnerSchedulerMutationGuardedCallsiteReceiptError {
    GuardedCallsite(G8lSchedulerOwnerSchedulerMutationGuardedCallsiteError),
    ExclusionRelease(G8lSchedulerMutationExclusionError),
    InvalidCallerCpu,
    RuntimeInputMismatch,
}

impl From<G8lSchedulerOwnerSchedulerMutationGuardedCallsiteError>
    for G8lSchedulerOwnerSchedulerMutationGuardedCallsiteReceiptError
{
    fn from(error: G8lSchedulerOwnerSchedulerMutationGuardedCallsiteError) -> Self {
        Self::GuardedCallsite(error)
    }
}

impl From<G8lSchedulerMutationExclusionError>
    for G8lSchedulerOwnerSchedulerMutationGuardedCallsiteReceiptError
{
    fn from(error: G8lSchedulerMutationExclusionError) -> Self {
        Self::ExclusionRelease(error)
    }
}

/// Non-`Copy` S201 source-model proof that the S200 callsite reaches a typed
/// receipt while retaining the exact S198 exclusion lease until drop.
#[derive(Debug)]
pub struct G8lSchedulerOwnerSchedulerMutationGuardedCallsiteReceipt<'a> {
    callsite: G8lSchedulerOwnerSchedulerMutationGuardedCallsite<'a>,
    runtime_instance_id: u64,
    task_id: u64,
    caller_cpu: usize,
    owner_epoch: u64,
    exact_s200_callsite_consumed: bool,
}

impl<'a> G8lSchedulerOwnerSchedulerMutationGuardedCallsiteReceipt<'a> {
    /// Consume the exact S200 guarded callsite by value at the receipt seam.
    pub fn from_guarded_callsite(
        runtime: &G8lRuntimeAuthority,
        authority: &G8lSchedulerOwnerAuthority,
        callsite: G8lSchedulerOwnerSchedulerMutationGuardedCallsite<'a>,
        caller_cpu: usize,
    ) -> Result<Self, G8lSchedulerOwnerSchedulerMutationGuardedCallsiteReceiptError> {
        if caller_cpu != CPU1 {
            return Err(
                G8lSchedulerOwnerSchedulerMutationGuardedCallsiteReceiptError::InvalidCallerCpu,
            );
        }
        callsite.revalidate(authority, runtime)?;
        if runtime.phase() != RuntimePhase::Running1
            || runtime.migration_input().owner_cpu != CPU1
            || runtime.migration_input().task_id != callsite.task_id()
            || callsite.caller_cpu() != CPU1
            || callsite.owner_epoch() != authority.epoch()
        {
            return Err(
                G8lSchedulerOwnerSchedulerMutationGuardedCallsiteReceiptError::RuntimeInputMismatch,
            );
        }
        Ok(Self {
            runtime_instance_id: runtime.instance_id(),
            task_id: callsite.task_id(),
            caller_cpu,
            owner_epoch: callsite.owner_epoch(),
            exact_s200_callsite_consumed: true,
            callsite,
        })
    }

    pub fn revalidate(
        &self,
        authority: &G8lSchedulerOwnerAuthority,
        runtime: &G8lRuntimeAuthority,
    ) -> Result<(), G8lSchedulerOwnerSchedulerMutationGuardedCallsiteReceiptError> {
        if self.caller_cpu != CPU1
            || self.task_id != authority.task_id()
            || authority.owner_cpu() != CPU1
            || authority.epoch() != self.owner_epoch
            || runtime.instance_id() != self.runtime_instance_id
            || runtime.phase() != RuntimePhase::Running1
            || runtime.migration_input().owner_cpu != CPU1
            || runtime.migration_input().task_id != self.task_id
        {
            return Err(
                G8lSchedulerOwnerSchedulerMutationGuardedCallsiteReceiptError::RuntimeInputMismatch,
            );
        }
        self.callsite.revalidate(authority, runtime)?;
        Ok(())
    }

    pub const fn runtime_instance_id(&self) -> u64 {
        self.runtime_instance_id
    }

    pub const fn task_id(&self) -> u64 {
        self.task_id
    }

    pub const fn caller_cpu(&self) -> usize {
        self.caller_cpu
    }

    pub const fn owner_epoch(&self) -> u64 {
        self.owner_epoch
    }

    pub const fn exclusion_token(&self) -> u64 {
        self.callsite.exclusion_token()
    }

    /// Consume this typed receipt and release the exact S198 token.
    pub fn release(
        self,
    ) -> Result<
        G8lSchedulerMutationExclusionReleaseReceipt,
        G8lSchedulerOwnerSchedulerMutationGuardedCallsiteReceiptError,
    > {
        self.callsite.release().map_err(Into::into)
    }

    pub const fn exact_s200_callsite_consumed(&self) -> bool {
        self.exact_s200_callsite_consumed
    }

    pub const fn production_constructor_wired(&self) -> bool {
        true
    }

    pub const fn production_constructor_invoked(&self) -> bool {
        false
    }

    pub const fn guarded_callsite_receipt_published(&self) -> bool {
        true
    }

    pub const fn production_scheduler_mutated(&self) -> bool {
        false
    }

    pub const fn all_scheduler_accesses_covered(&self) -> bool {
        false
    }

    pub const fn global_scheduler_exclusion_proven(&self) -> bool {
        false
    }

    pub const fn gic_delivery_wired(&self) -> bool {
        false
    }

    pub const fn hardware_execution_proven(&self) -> bool {
        false
    }
}

#[test]
fn source_boundary_consumes_callsite_by_value_without_scheduler_import() {
    let source = include_str!(
        "../../kernel/src/g8l_target_dispatch_scheduler_owner_scheduler_mutation_guarded_callsite_receipt.rs"
    );
    let handoff = source.split("pub fn from_guarded_callsite").nth(1).unwrap();
    assert!(handoff.contains("callsite: G8lSchedulerOwnerSchedulerMutationGuardedCallsite<'a>"));
    assert!(!handoff.contains("callsite: &G8lSchedulerOwnerSchedulerMutationGuardedCallsite"));
    assert!(source.contains("callsite.revalidate(authority, runtime)?"));
    assert!(!source.contains("use crate::task"));
    assert!(source.contains("S201"));
}

  {
    id: "g8l-s201-scheduler-mutation-guarded-callsite-receipt-partial",
    date: "2026-08-25",
    sequence: 201,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: guarded scheduler-mutation callsite → typed receipt",
    summary:
      "S201, non-Copy S200 guarded scheduler-mutation callsite'ını by-value tüketip exact S198 exclusion token'ını typed receipt boyunca tutan 10/10 allocation-free source sınırını kapattı. Canlı Running1 runtime, CPU1 owner/task ve epoch 23→24 yeniden doğrulanıyor; başarılı receipt drop ve wrong-caller error yollarında exact token serbest kalıyor. Production scheduler import edilmedi, çağrılmadı veya değiştirilmedi.",
    evidence: [
      "g8l_target_dispatch_scheduler_owner_scheduler_mutation_guarded_callsite_receipt: 10/10 PASS; exact S200 callsite by-value consumption, receipt retention, Running1/CPU1 owner/task/epoch revalidation and closed production claims.",
      "Exact-token lifecycle: receipt yaşarken S198 token tutuluyor; receipt drop ve wrong-caller error sonrasında token serbest kalıyor.",
      "Odaklı test iki bağımsız koşuda byte-eşit kaldı: 125 B / SHA-256 7742173cc9d98f4cbe90debabdf83ee6b5d3e9e965e25428a46d090582275222.",
      "S155–S201 sıra-düzenli birleşik matris iki bağımsız koşuda 47 grup / 427/427 PASS ve 5780 B / SHA-256 383440c1b1e88a79dfbf2e5785d05fffd47a1e8cc74b2933896d5c484d29dba2 verdi.",
      "RPi5 AArch64 compile PASS: 502 warning envanterlendi, hata yok; 232849 B / SHA-256 0c8600f2cc7619c444f2de8b4132f853b9087c791d11af89158cff03626a3f3f. Zero-warning iddiası yoktur.",
      "RPi5 AArch64 smp compile PASS: 502 warning envanterlendi, hata yok; 232791 B / SHA-256 8dedf117997e8d66865bd812e145cb69e0bccc50682a652e9e6838b7a2201d33. Zero-warning iddiası yoktur.",
      "Kalıcı kapsam: `docs/M8.1-RPi5-G8l-S201-Scheduler-Mutation-Guarded-Callsite-Receipt-Proof.md`.",
      "S201 fiziksel/device operasyonu yapmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S201=NO.",
      "Görünür fiziksel sıra: Gücü kapat → SD kartı Pi'den çıkar → SD kartı Mac'e tak → Yetkili write/verify/read-back işlemini tamamla → SD kartı Mac'ten güvenli çıkar → SD kartı güçsüz Pi'ye tak → UART capture pre-arm ve exact identity kapısını doğrula → Güç ver. Bu sıra yalnız tarihsel S124'te tamamlandı; S201'de uygulanmadı.",
      "Canlı marker: S201_10_OF_10_G8L_SCHEDULER_MUTATION_GUARDED_CALLSITE_RECEIPT_SOURCE_EXACT_S200_GUARDED_CALLSITE_CONSUMED_BY_VALUE_NONCOPY_EXACT_S198_TOKEN_RETAINED_UNTIL_RECEIPT_DROP_AND_RELEASED_ON_ERROR_LIVE_RUNNING1_CPU1_OWNER_TASK_EPOCH23_TO24_REVALIDATED_PRODUCTION_CONSTRUCTOR_WIRED_NOT_INVOKED_PRODUCTION_SCHEDULER_NOT_IMPORTED_NOT_MUTATED_LEGACY_SCHEDULER_ACCESSES_UNCOVERED_WHOLE_SCHEDULER_GLOBAL_EXCLUSION_GIC_HARDWARE_QEMU_PHYSICAL_CPU2_CPU3_HOTPLUG_SOAK_GENERIC_SMP_OPEN_FULL_PHYSICAL_RUNBOOK_VISIBLE_S361_TO_S411_S386_NO_RUNBOOK_EXECUTED_IN_S201_VERIFIED; deployment-specific route/hash evidence is recorded in the project-status manifest.",
    ],
    commands: [
      "cargo test --quiet --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_guarded_callsite_receipt -- --test-threads=1",
      "cargo check --quiet --manifest-path kernel/Cargo.toml --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo check --quiet --manifest-path kernel/Cargo.toml --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
    ],
    terminalSessions: [
      {
        id: "s201-g8l-scheduler-mutation-guarded-callsite-receipt",
        title: "G8l S201 guarded-callsite receipt",
        commandLines: [
          "cargo test --quiet --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_guarded_callsite_receipt -- --test-threads=1",
        ],
        outputLines: [
          "running 10 tests",
          "test result: ok; 10 passed; 0 failed",
          "S200 guarded callsite consumed by value; exact S198 token retained through typed receipt",
          "production scheduler mutation/global exclusion/GIC/hardware: not invoked / not claimed",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "Terminal özeti S201 host/source receipt kabulünü gösterir; QEMU veya fiziksel cihaz çalıştırması değildir.",
    limitations: [
      "S201 exact S200 guarded callsite'ı typed receipt'e taşır; production scheduler mutation constructor'ını invoke etmez.",
      "Legacy static mut SCHEDULER erişimleri receipt kapsamına alınmadığı için whole-scheduler global exclusion açık kalır.",
      "S201 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S201=NO.",
    ],
  },