G8l: production migration-lifecycle S188 ERET receipt

/// Consume one exact S188 ERET receipt, commit S189 once, and enter S221.
///
/// The ERET receipt and owner authority are non-Copy and consumed by value.
/// A downstream failure is terminal at this boundary; no replacement or retry
/// is introduced.
pub fn publish_runtime_owner_tuple_from_s188_eret_receipt(
    queue: &mut G8lRuntimeOwnerS197TupleHandoffQueue,
    runtime: G8lRuntimeAuthority,
    mut authority: G8lSchedulerOwnerAuthority,
    eret: G8lTargetDispatchEretReceipt,
    caller_cpu: usize,
    target_cpu: usize,
    irqs_masked: bool,
) -> Result<(), G8lMigrationLifecycleS188EretError> {
    if caller_cpu != CPU1 {
        return Err(G8lMigrationLifecycleS188EretError::InvalidCallerCpu);
    }
    let exclusion = authority
        .begin_owner_transfer(caller_cpu, eret.ticket().task_id, irqs_masked)
        .map_err(G8lMigrationLifecycleS188EretError::OwnerLedger)?;
    let commit = authority
        .commit_eret_receipt(&runtime, exclusion, eret)
        .map_err(G8lMigrationLifecycleS188EretError::OwnerLedger)?;
    publish_runtime_owner_tuple_from_s189_owner_ledger_commit(
        queue, runtime, authority, commit, caller_cpu, target_cpu,
    )
    .map_err(G8lMigrationLifecycleS188EretError::S189OwnerLedger)
}

#[test]
fn s222_source_is_allocation_free_and_orders_s188_s189_s190_s191_s221() {
    let source = include_str!("../../kernel/src/g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s188_eret.rs");
    assert!(!source.contains("Box<"));
    assert!(!source.contains("Vec<"));
    assert!(source.contains("G8lTargetDispatchEretReceipt"));
    assert!(source.contains("commit_eret_receipt"));
    assert!(source.contains("publish_runtime_owner_tuple_from_s189_owner_ledger_commit"));
    assert!(source.contains("S188 -> S189 -> S190 -> S191 -> S221"));
    assert!(!source.contains("task::scheduler"));
    assert!(!source.contains("send_sgi"));
}

  {
    id: "g8l-s222-production-migration-lifecycle-s188-eret-partial",
    date: "2026-08-25",
    sequence: 222,
    status: "passed",
    umbrella_status: "partial",
    title: "G8l: production migration-lifecycle S188 ERET receipt",
    summary:
      "S222 13/13 PASS ile exact non-Copy S188 ContextSwitched→Running1 ERET receipt CPU1 caller sınırında by-value tüketildi, açık IRQ-mask önkoşulu fail-closed doğrulandı, hedefte gerçek IrqGuard zincir boyunca canlı tutuldu, tek S189 owner-ledger transferi commit edildi ve S221 üzerinden S220/S219/S218/S217/S216/S215/S214/S213/S212 zincirine bağlandı. Occupied slot replacement/retry açılmaz; migration runtime callsite'ı henüz invoke edilmedi.",
    evidence: [
      "S222 focused S188 ERET-to-owner-ledger callsite grubu iki bağımsız koşuda 13/13 PASS: CPU1 caller gate, açık IRQ-mask önkoşulunun mutasyondan önce fail-closed reddi, hedef IrqGuard/CPU-ID kaynağı, S188→S189→S190→S191→S221 source order, exact ERET consumption, S221/S220/S219/S218/S217/S216/S215/S214/S213/S212 ingress reuse, occupied ownership and no-retry boundaries.",
      "Focused koşular byte-eşit kaldı: 128 B / SHA-256 02983f1a7d644519bfddb0884a6cd0ce69f40c4b845eb54b71ecdc6e19a8ff09.",
      "S206 callsite/readback + S207–S222 dependency matrix frozen S221 prefix'i üzerine 19 grup / 225/225 PASS ve 2408 B / SHA-256 98da3f9daf9875707d4e8e7e45dcdf8e1b39f3ac40e7163178373e356dc3750c verdi; ilk 2280 B exact S221 dependency prefix'idir.",
      "S155–S222 explicit sequence-ordered matrix frozen S221 prefix'i üzerine 71 grup / 708/708 PASS ve 8819 B / SHA-256 d2191bc6ace7748e8cf766244365cbac78061f873df80aa20860dd1788d248be verdi; exact S221 8691 B prefix'i korundu.",
      "RPi5 AArch64 compile PASS: 572 warning envanterlendi; 287594 B / SHA-256 f2536ce9cd6521f0ad645d974aae86dd3ad74297772d75a1ab08e42e171ef0c3. `smp`: 572 warning, 287536 B / SHA-256 d97846bb51f8843b421091cb70c7fc37c64a18cea3e000bfece51786d2b5ac55. Zero-warning iddiası yoktur.",
      "Kalıcı kapsam: `docs/M8.1-RPi5-G8l-S222-Migration-Lifecycle-S188-ERET-Proof.md`.",
      "S188 ERET receipt by-value tüketilir; CPU1 ve açık IRQ-mask önkoşulu mutasyondan önce doğrulanır, target-only yol gerçek IrqGuard'ı tüm downstream deneme boyunca tutar, ardından S189 owner-ledger transferi bir kez commit edilir ve S221/S220/S219/S218/S217/S216/S215/S214/S213/S212 zincirine geçilir. Wrong caller, missing IRQ mask, foreign ERET, wrong target ve occupied slot fail-closed kalır; replacement/retry yoktur.",
      "S222 fiziksel/device operasyonu yapmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S222=NO.",
      "S188 ERET-to-owner-ledger callsite wired/AArch64-compiled'dır fakat boot veya migration runtime callsite'ı henüz invoke edilmedi; present request, S207 invocation veya scheduler mutation gözlemi iddia edilmez.",
      "Canlı marker: S222_13_OF_13_MIGRATION_LIFECYCLE_S188_ERET_CPU1_CALLER_EXPLICIT_IRQ_MASK_PREREQUISITE_FAIL_CLOSED_TARGET_IRQ_GUARD_LIVE_S188_NONCOPY_ERET_CONSUMED_BY_VALUE_EXACT_S189_OWNER_LEDGER_COMMITTED_ONCE_S221_S220_S219_S218_S217_S216_S215_S214_S213_S212_SINGLE_SLOT_INGRESS_NO_REPLACEMENT_NO_RETRY_AARCH64_COMPILED_NOT_RUNTIME_INVOKED_PRESENT_REQUEST_NOT_OBSERVED_LEGACY_SCHEDULER_ACCESSES_UNCOVERED_WHOLE_SCHEDULER_GIC_HARDWARE_QEMU_PHYSICAL_CPU2_CPU3_HOTPLUG_SOAK_GENERIC_SMP_OPEN_FULL_PHYSICAL_RUNBOOK_VISIBLE_S382_TO_S432_S407_NO_RUNBOOK_EXECUTED_IN_S222_VERIFIED; deployment-specific route/hash evidence is recorded in the project-status manifest.",
    ],
    commands: [
      "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s188_eret -- --test-threads=1",
      "cargo check --quiet --manifest-path kernel/Cargo.toml --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo check --quiet --manifest-path kernel/Cargo.toml --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
    ],
    terminalSessions: [
      {
        id: "s222-g8l-production-migration-lifecycle-s188-eret",
        title: "G8l S222 migration-lifecycle S188 ERET receipt",
        commandLines: [
          "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s188_eret -- --test-threads=1",
        ],
        outputLines: [
          "test result: ok; 13 passed; 0 failed",
          "CPU1 and explicit IRQ-mask prerequisite are checked before the exact S188 receipt commits S189; target IrqGuard stays live",
          "S221 delegates through S220/S219/S218/S217/S216/S215/S214/S213/S212 single-slot ingress with no replacement/retry",
          "production migration runtime callsite is not invoked; present request/scheduler mutation is not claimed",
        ],
        exitCode: 0,
        outputMode: "selected",
      },
    ],
    terminalSessionsNote:
      "Terminal özeti S222 S188→S189→S221 callsite sınırını gösterir; production migration runtime, QEMU veya fiziksel cihaz çalıştırması değildir.",
    limitations: [
      "S222 S188 ERET-to-owner-ledger callsite'ını wired/AArch64-compiled yapar; gerçek boot/migration caller'ı henüz invoke edilmediği için present request veya S207 runtime invocation iddia edilmez.",
      "Whole-scheduler exclusion, legacy scheduler erişimleri, GIC/SGI capture, CPU1 ERET/context-switch assembly, QEMU present-tuple yolu, fiziksel RPi ve Generic SMP açıktır.",
      "S222 fiziksel/device operasyonu yapmadı; RUNBOOK_EXECUTED_IN_S222=NO.",
    ],
  },