Add SSH Console Ownership Boundary (Phase 8D.4)

Implement transport-qualified session identity and immutable owner
adapters
for SSH console lifecycle and output-drain operations. Add focused host
tests
covering admission, stale identities, deferred actions, completion
races,
prompts, backpressure, and slot reuse. Update Phase 8D documentation and
current-state tracking.

src/admin_ssh_console.h

@@ -1,5 +1,5 @@
 /* SPDX-License-Identifier: GPL-3.0-only */
-/* Bounded, transport-neutral administrative command worker for SSH sessions. */
+/* Bounded administrative dispatcher with a small remote-owner boundary. */
 
 #pragma once
 
@@ -21,6 +21,7 @@ typedef struct {
     uint8_t slot_index;
     uint32_t session_id;
     uint32_t slot_generation;
+    uint8_t transport; /* Zero is SSH, including legacy designated initializers. */
 } admin_ssh_console_token_t;
 
 typedef enum {
@@ -30,8 +31,45 @@ typedef enum {
     ADMIN_SSH_DEFER_DISCONNECT,
     ADMIN_SSH_DEFER_HOST_KEY_ROTATE,
     ADMIN_SSH_DEFER_HOST_KEY_RESET,
+    ADMIN_CONSOLE_DEFER_SELF_CLOSE,
 } admin_ssh_deferred_action_type_t;
 
+/* Small owner boundary; module/API names are retained for existing SSH callers.
+ * Exactly two shared console slots, not two per transport. slot_index addresses
+ * this pool; owners coordinate admission and must not reuse an identity while
+ * old work can exist. transport is a firmware-assigned namespace (0 = SSH).
+ * An occupied or still-executing slot cannot be replaced by open_owned().
+ *
+ * The immutable adapter lives for firmware lifetime. Callbacks run on the
+ * control task OUTSIDE console locks, never on the dispatcher or socket owner.
+ * drained must be nonblocking, validate the full identity and include pending
+ * owner output. perform must revalidate identity and marshal lifecycle work to
+ * its owner, never call socket libraries here. Neither callback may call console
+ * handlers. supported_actions is a bitmask (1U << action); reject unsupported
+ * actions before side effects. Legacy STOP/DISCONNECT/key actions mean SSH;
+ * SELF_CLOSE means this frontend, with argument ignored.
+ *
+ * One owner serializes feed calls per session; different owners may feed in
+ * parallel. Shared completion scratch is nonblocking/serialized by the core.
+ * The owner alone consumes output, maintains authentication/session liveness,
+ * and calls close on disconnect/revocation. Core copies/rechecks principals at
+ * admission and dispatch, but does not implement transport-specific expiry.
+ * Close wakes prompts; executing state is retained until the handler returns.
+ * Output remains bounded (5s write backpressure); deferred work waits at most
+ * 10s for application drain plus 200ms, NOT peer-delivery confirmation.
+ * No new tasks, queues, slots, or browser endpoint are provided by this API.
+ */
+typedef struct {
+    uint32_t supported_actions;
+    bool (*drained)(const admin_ssh_console_token_t *token);
+    esp_err_t (*perform)(const admin_ssh_console_token_t *token,
+                         admin_ssh_deferred_action_type_t action, uint32_t argument);
+} admin_console_owner_t;
+
+esp_err_t admin_ssh_console_open_owned(const admin_ssh_console_token_t *token,
+                                      const user_principal_t *principal,
+                                      const admin_console_owner_t *owner);
+
 typedef struct {
     bool active;
     bool command_pending;
@@ -57,18 +95,21 @@ esp_err_t admin_ssh_console_dispatch_read_input(
 esp_err_t admin_ssh_console_dispatch_defer(
     admin_ssh_deferred_action_type_t action, uint32_t argument);
 
-/* The token and principal are copied; no SSH or socket objects cross this boundary. */
+/* SSH compatibility entry point, implemented by the owner in ssh_transport.c.
+ * Token/principal are copied; no SSH or socket objects cross this boundary.
+ * Existing feed/close/read/snapshot APIs below also accept open_owned tokens.
+ */
 esp_err_t admin_ssh_console_open(const admin_ssh_console_token_t *token,
                                  const user_principal_t *principal);
 void admin_ssh_console_close(const admin_ssh_console_token_t *token);
 
-/* Called only by the SSH owner task. Returns false when input must be backpressured. */
+/* Called by the session owner. Returns false when input must be backpressured. */
 bool admin_ssh_console_accepts_input(const admin_ssh_console_token_t *token);
 bool admin_ssh_console_feed_input(const admin_ssh_console_token_t *token,
                                   const uint8_t *data, size_t length,
                                   size_t *consumed);
 
-/* Called only by the SSH owner task; copies already-produced output without blocking. */
+/* Called by the session owner; copies already-produced output without blocking. */
 esp_err_t admin_ssh_console_read_output(const admin_ssh_console_token_t *token,
                                         uint8_t *data, size_t capacity,
                                         size_t *received);