fix(updates): Address TenantUpdateScheduler review comments (correctness, safety, docs)

.github/workflows/multi-tenant-update-scheduling-ci.yml

@@ -0,0 +1,110 @@
+name: Multi-Tenant Update Scheduling CI
+
+# Triggered on every push / PR that touches the scheduler sources or tests.
+# Targets v1.8.0 (Issue #262).
+on:
+  push:
+    branches:
+      - main
+      - develop
+    paths:
+      - 'include/updates/tenant_update_scheduler.h'
+      - 'src/updates/tenant_update_scheduler.cpp'
+      - 'tests/test_multi_tenant_update_scheduling.cpp'
+      - 'cmake/CMakeLists.txt'
+      - 'cmake/ModularBuild.cmake'
+      - 'tests/CMakeLists.txt'
+      - '.github/workflows/multi-tenant-update-scheduling-ci.yml'
+  pull_request:
+    types: [opened, synchronize, reopened]
+    paths:
+      - 'include/updates/tenant_update_scheduler.h'
+      - 'src/updates/tenant_update_scheduler.cpp'
+      - 'tests/test_multi_tenant_update_scheduling.cpp'
+      - 'cmake/CMakeLists.txt'
+      - 'cmake/ModularBuild.cmake'
+      - 'tests/CMakeLists.txt'
+      - '.github/workflows/multi-tenant-update-scheduling-ci.yml'
+
+concurrency:
+  group: multi-tenant-update-scheduling-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  ci-scope-classifier:
+    permissions:
+      contents: read
+    uses: ./.github/workflows/ci-scope-classifier.yml
+
+  multi-tenant-update-scheduling-tests:
+    needs: ci-scope-classifier
+    if: needs.ci-scope-classifier.outputs.has_code_changes == 'true'
+    name: Multi-Tenant Update Scheduling (${{ matrix.os }} / ${{ matrix.compiler }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 60
+
+    permissions:
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-22.04
+            compiler: gcc-12
+            cc: gcc-12
+            cxx: g++-12
+          - os: ubuntu-24.04
+            compiler: gcc-14
+            cc: gcc-14
+            cxx: g++-14
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up C++ build environment
+        uses: ./.github/actions/setup-cpp-build
+        with:
+          cc:             ${{ matrix.cc }}
+          cxx:            ${{ matrix.cxx }}
+          extra-packages: libssl-dev libcurl4-openssl-dev libboost-all-dev librocksdb-dev libfmt-dev libtbb-dev libspdlog-dev nlohmann-json3-dev
+
+      - name: Configure and build
+        uses: ./.github/actions/configure-themis
+        with:
+          cc:  ${{ matrix.cc }}
+          cxx: ${{ matrix.cxx }}
+
+      # ── Focused test target ────────────────────────────────────────────────
+      - name: Run MultiTenantUpdateSchedulingFocusedTests
+        run: |
+          set -o pipefail
+          cd build
+          ctest -R MultiTenantUpdateSchedulingFocusedTests \
+                --output-on-failure \
+                --timeout 120 \
+                2>&1 | tee multi_tenant_update_scheduling_results.txt
+
+      # ── Broader AC validation via unified binary ───────────────────────────
+      - name: Run MultiTenantUpdateScheduling tests via unified binary
+        run: |
+          set -o pipefail
+          cd build
+          ./tests/themis_tests \
+            --gtest_filter="MaintenanceWindowTest*:BlackoutPeriodTest*:PriorityTierTest*:TenantConsentTest*:PerTenantRollbackTest*:TenantStatusTest*:TenantUpdateSchedulerConstructionTest*" \
+            --gtest_output="xml:multi_tenant_update_scheduling_gtest.xml" \
+            2>&1 | tee multi_tenant_update_scheduling_gtest_output.txt
+
+      - name: Upload test results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: multi-tenant-update-scheduling-results-${{ matrix.os }}-${{ matrix.compiler }}
+          path: |
+            build/multi_tenant_update_scheduling_results.txt
+            build/multi_tenant_update_scheduling_gtest.xml
+            build/multi_tenant_update_scheduling_gtest_output.txt
+          retention-days: 30

cmake/CMakeLists.txt

@@ -1906,6 +1906,7 @@ set(THEMIS_CORE_SOURCES
     ../src/updates/blue_green_deployment.cpp
     ../src/updates/coordinated_update_manager.cpp
     ../src/updates/preflight_health_check.cpp
+    ../src/updates/tenant_update_scheduler.cpp
 
     # Geo utilities
     ../src/utils/geo/ewkb.cpp

cmake/ModularBuild.cmake

@@ -373,6 +373,7 @@ set(THEMIS_STORAGE_SOURCES
     ../src/updates/blue_green_deployment.cpp
     ../src/updates/coordinated_update_manager.cpp
     ../src/updates/preflight_health_check.cpp
+    ../src/updates/tenant_update_scheduler.cpp
 
     # Storage security
     ../src/storage/security_signature.cpp