G8l: exact guard → real current-task owner production callsite

use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_current_task::{
    G8lSchedulerCurrentTaskOwnerCommitError, G8lSchedulerCurrentTaskOwnerCommitReceipt,
    G8lSchedulerCurrentTaskOwnerSlot,
};

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lSchedulerCurrentTaskOwnerReadbackError {
    MissingCommit,
    Commit(G8lSchedulerCurrentTaskOwnerCommitError),
    RuntimeMismatch,
    ReleaseMismatch,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lSchedulerCurrentTaskOwnerReadbackReceipt {
    pub runtime_instance_id: u64,
    pub task_id: u64,
    pub owner_cpu: usize,
    pub owner_epoch: u64,
    pub context_generation: u64,
    pub asid: u16,
    pub root: u64,
    pub exclusion_token: u64,
    pub s205_commit_observed: bool,
    pub s204_release_observed: bool,
}

impl G8lSchedulerCurrentTaskOwnerReadbackReceipt {
    /// Verify the exact S205 commit after the S204 release, without mutation.
    pub fn from_scheduler_slot(
        runtime: &G8lRuntimeAuthority,
        authority: &G8lSchedulerOwnerAuthority,
        slot: &G8lSchedulerCurrentTaskOwnerSlot,
        release: G8lSchedulerMutationExclusionReleaseReceipt,
    ) -> Result<Self, G8lSchedulerCurrentTaskOwnerReadbackError> {
        if runtime.phase() != RuntimePhase::Running1
            || authority.owner_cpu() != CPU1
            || authority.task_id() != runtime.migration_input().task_id
            || runtime.migration_input().owner_cpu != CPU1
        {
            return Err(G8lSchedulerCurrentTaskOwnerReadbackError::RuntimeMismatch);
        }

        let commit = slot
            .committed()
            .ok_or(G8lSchedulerCurrentTaskOwnerReadbackError::MissingCommit)?;
        Self::verify_commit(runtime, authority, commit, release)
    }

    fn verify_commit(
        runtime: &G8lRuntimeAuthority,
        authority: &G8lSchedulerOwnerAuthority,
        commit: G8lSchedulerCurrentTaskOwnerCommitReceipt,
        release: G8lSchedulerMutationExclusionReleaseReceipt,
    ) -> Result<Self, G8lSchedulerCurrentTaskOwnerReadbackError> {
        if commit.runtime_instance_id != runtime.instance_id()
            || commit.task_id != authority.task_id()
            || commit.owner_cpu != CPU1
            || commit.owner_epoch != authority.epoch()
            || commit.context_generation != runtime.context_generation()
            || commit.asid == 0
            || commit.asid != runtime.migration_input().asid
            || commit.root == 0
            || commit.root != runtime.migration_input().root
        {
            return Err(G8lSchedulerCurrentTaskOwnerReadbackError::RuntimeMismatch);
        }
        if release.token != commit.exclusion_token
            || release.task_id != commit.task_id
            || release.caller_cpu != commit.owner_cpu
            || release.owner_epoch != commit.owner_epoch
        {
            return Err(G8lSchedulerCurrentTaskOwnerReadbackError::ReleaseMismatch);
        }
        Ok(Self {
            runtime_instance_id: commit.runtime_instance_id,
            task_id: commit.task_id,
            owner_cpu: commit.owner_cpu,
            owner_epoch: commit.owner_epoch,
            context_generation: commit.context_generation,
            asid: commit.asid,
            root: commit.root,
            exclusion_token: commit.exclusion_token,
            s205_commit_observed: true,
            s204_release_observed: true,
        })
    }

    pub const fn production_scheduler_mutated(&self) -> bool {
        false
    }

    pub const fn exclusion_reacquired(&self) -> bool {
        false
    }
}

#[test]
fn s206_reads_back_exact_s205_commit_after_s204_release() {
    let (runtime, authority, slot, release, exclusion) = committed_slot_and_release();
    let readback = G8lSchedulerCurrentTaskOwnerReadbackReceipt::from_scheduler_slot(
        &runtime, &authority, &slot, release,
    )
    .unwrap();
    assert_eq!(readback.task_id, TASK);
    assert_eq!(readback.owner_cpu, CPU1);
    assert_eq!(readback.owner_epoch, OWNER_EPOCH + 1);
    assert_eq!(readback.asid, ASID);
    assert!(readback.s205_commit_observed && readback.s204_release_observed);
    assert!(!readback.production_scheduler_mutated());
    assert!(!readback.exclusion_reacquired());
    assert!(!exclusion.is_locked());
}

  {
    id: "g8l-s206-production-current-task-owner-callsite-partial",
    date: "2026-08-25",
    sequence: 206,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: exact guard → real current-task owner production callsite",
    summary:
      "S206 iki odaklı grupta 18/18 PASS ile non-Copy S197 commit'i gerçek S203 IRQ-maskeli S198 guard acquisition'dan doğrudan gerçek S205 Scheduler current-task commit/release adapter'ına taşıyan allocation-free production callsite'ı bağladı. Guard acquisition reddi scheduler commit'e hiç girmez; commit/release hatası bir kez döner ve retry edilmez. Exact S205 commit/S204 release readback ayrı destek grubudur. Entry point wired/AArch64-compiled, fakat boot/IRQ/scheduler runtime henüz çağırmıyor.",
    evidence: [
      "S206 odaklı grupları 18/18 PASS: composite production callsite 8/8 ve exact S205-commit/S204-release readback 10/10.",
      "Production wrapper gerçek acquire_production_scheduler_mutation_guarded_ack çağrısını gerçek commit_production_current_task_owner adapter'ından önce yapar; non-Copy commit ve acquired guard FnOnce sınırlarında birer kez taşınır.",
      "Guard acquisition reddi scheduler commit closure'ını hiç çağırmaz; commit/release error fazı retry olmadan korunur.",
      "Destek readback'i Running1, CPU1, owner task/epoch, ASID/root/context generation ve exact release token/task/caller/epoch kimliğini mutation veya exclusion reacquisition olmadan doğrular.",
      "Odaklı iki grup iki bağımsız koşuda byte-eşit kaldı: 246 B / SHA-256 c8d240476c11d53539c2ac1125718630f0ebce933eafa113d40e9e3bfb420d1c.",
      "S155–S206 explicit sequence-ordered matrix iki bağımsız koşuda 54 grup / 501/501 PASS ve 6657 B / SHA-256 f290e94980782e72f644d22d6421a9946d6ec110ea47d990006bba9548efb688 verdi.",
      "RPi5 AArch64 compile PASS: 533 warning envanterlendi, hata yok; 250760 B / SHA-256 e3005ec513b7eae6dfab4fe4f42e5d4523e8b25f799485ecda361cd743fcfbd7. Zero-warning iddiası yoktur.",
      "RPi5 AArch64 smp compile PASS: 533 warning envanterlendi, hata yok; 250702 B / SHA-256 fc1fa04927d25f861aea675730c52acd1a0c21344139e78388352f77e9df720d. Zero-warning iddiası yoktur.",
      "Kalıcı kapsam: `docs/M8.1-RPi5-G8l-S206-Production-Current-Task-Owner-Callsite-Proof.md`.",
      "S206 fiziksel/device operasyonu yapmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S206=NO.",
      "Görünür fiziksel sıra: Gücü kapat → SD kartı Pi'den çıkar → SD kartı Mac'e tak → Yetkili write/verify/read-back işlemini tamamla → SD kartı Mac'ten güvenli çıkar → SD kartı güçsüz Pi'ye tak → UART capture pre-arm ve exact identity kapısını doğrula → Güç ver. Bu sıra yalnız tarihsel S124'te tamamlandı; S206'da uygulanmadı.",
      "Canlı marker: S206_18_OF_18_G8L_PRODUCTION_CURRENT_TASK_OWNER_COMPOSITE_CALLSITE_SOURCE_ALLOCATION_FREE_NONCOPY_S197_COMMIT_EXACT_ONCE_REAL_S203_IRQ_MASKED_S198_GUARD_ACQUIRE_TO_REAL_S205_SCHEDULER_CURRENT_TASK_COMMIT_RELEASE_ACQUIRE_FAILURE_SHORT_CIRCUIT_COMMIT_FAILURE_NO_RETRY_SUPPORTING_EXACT_S205_COMMIT_S204_RELEASE_READBACK_PRODUCTION_ENTRYPOINT_WIRED_NOT_RUNTIME_INVOKED_LEGACY_SCHEDULER_ACCESSES_UNCOVERED_WHOLE_SCHEDULER_GIC_HARDWARE_QEMU_PHYSICAL_CPU2_CPU3_HOTPLUG_SOAK_GENERIC_SMP_OPEN_FULL_PHYSICAL_RUNBOOK_VISIBLE_S366_TO_S416_S391_NO_RUNBOOK_EXECUTED_IN_S206_VERIFIED; deployment-specific route/hash evidence is recorded in the project-status manifest.",
    ],
    commands: [
      "cargo test --quiet --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_current_task_callsite -- --test-threads=1",
      "cargo test --quiet --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_current_task_readback -- --test-threads=1",
      "cargo check --quiet --manifest-path kernel/Cargo.toml --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo check --quiet --manifest-path kernel/Cargo.toml --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
    ],
    terminalSessions: [
      {
        id: "s206-g8l-production-current-task-owner-callsite",
        title: "G8l S206 exact guard to real current-task owner callsite",
        commandLines: [
          "cargo test --quiet --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_current_task_callsite -- --test-threads=1",
          "cargo test --quiet --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_current_task_readback -- --test-threads=1",
        ],
        outputLines: [
          "composite production callsite: 8 passed; supporting readback: 10 passed",
          "test result: ok; 18 passed; 0 failed",
          "real S203 guard acquisition precedes real S205 Scheduler commit/release adapter",
          "production entrypoint wired but not entered; legacy exclusion/GIC/hardware: not claimed",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "Terminal özeti S206 composite production callsite ve destek readback sınırını gösterir; QEMU veya fiziksel cihaz çalıştırması değildir.",
    limitations: [
      "S206 gerçek guard acquisition ve gerçek Scheduler adapter'ını tek production entrypoint'te compose eder; boot/IRQ/scheduler runtime bu entrypoint'i henüz çağırmaz.",
      "Legacy static mut SCHEDULER erişimleri, whole-scheduler global exclusion, GIC/SGI, CPU1 ERET assembly, QEMU ve fiziksel RPi kapsam dışıdır.",
      "S206 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S206=NO.",
    ],
  },