S536 · R1 physical boot/UART evidence contract

#![allow(unexpected_cfgs)]

//! S536 starts R1 with a physical boot/UART evidence contract.
//!
//! S535 closed the focused software-readiness sequence without claiming a
//! supported-profile runtime or physical observation.  This separate gate
//! anchors that exact S535 snapshot and publishes the immutable contract that
//! later R1 gates must satisfy on a Raspberry Pi 5.  It does not power a
//! device, open a UART, capture output or claim Boot-to-UI acceptance.

use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s431_runtime_evidence_contract::{
    G8lS431ToS535AcceptanceLedgerSnapshot, S431_DIRECT_ACCESS_SITES,
    S431_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES, S431_SOURCE_AUDIT_UNITS,
    S431_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES, S431_TO_S535_BLOCK_COUNT,
    S431_TO_S535_GATE_COUNT, S431_UNROUTED_DIRECT_ACCESS_SITES,
};
use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s535_r2_acceptance_boundary::S535_SEQUENCE;

pub const S536_SEQUENCE: usize = 536;
pub const S536_EXPECTED_PREDECESSOR: usize = S535_SEQUENCE;
pub const S536_TARGET_CPU: usize = 1;
pub const S536_R1_FIRST_SEQUENCE: usize = 536;
pub const S536_R1_LAST_PLANNED_SEQUENCE: usize = 565;
pub const S536_R1_PLANNED_GATE_COUNT: usize =
    S536_R1_LAST_PLANNED_SEQUENCE - S536_R1_FIRST_SEQUENCE + 1;
pub const S536_BOOT_UART_FIRST_SEQUENCE: usize = 536;
pub const S536_BOOT_UART_LAST_SEQUENCE: usize = 542;
pub const S536_UI_INPUT_FIRST_SEQUENCE: usize = 543;
pub const S536_UI_INPUT_LAST_SEQUENCE: usize = 549;
pub const S536_MODEM_VOICE_FIRST_SEQUENCE: usize = 550;
pub const S536_MODEM_VOICE_LAST_SEQUENCE: usize = 556;
pub const S536_APPLICATION_RECOVERY_FIRST_SEQUENCE: usize = 557;
pub const S536_APPLICATION_RECOVERY_LAST_SEQUENCE: usize = 563;
pub const S536_R1_MATRIX_FIRST_SEQUENCE: usize = 564;
pub const S536_R1_MATRIX_LAST_SEQUENCE: usize = 565;
pub const S536_TARGET_BOARD: &str = "board-rpi5";
pub const S536_EVIDENCE_DOMAIN: &str = "physical_boot_uart";
pub const S536_UART_BAUD: u32 = 115_200;
pub const S536_UART_DATA_BITS: u8 = 8;
pub const S536_UART_STOP_BITS: u8 = 1;
pub const S536_BOOT_TO_UI_REQUIRED_MARKER: &str = "[R1:S536] BOOT_TO_UI_READY";
pub const S536_PRIOR_FOCUSED_GROUPS: usize = S431_TO_S535_GATE_COUNT;
pub const S536_PRIOR_FOCUSED_TESTS: usize = 735;
pub const S536_SOURCE_AUDIT_UNITS: usize = S431_SOURCE_AUDIT_UNITS;
pub const S536_DIRECT_ACCESS_SITES: usize = S431_DIRECT_ACCESS_SITES;
pub const S536_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES: usize =
    S431_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES;
pub const S536_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES: usize =
    S431_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES;
pub const S536_UNROUTED_DIRECT_ACCESS_SITES: usize = S431_UNROUTED_DIRECT_ACCESS_SITES;
pub const S536_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS: usize = 0;
pub const S536_PHYSICAL_OBSERVATIONS: usize = 0;
pub const S536_UART_CAPTURE_OBSERVED: bool = false;
pub const S536_BOOT_TO_UI_OBSERVED: bool = false;
pub const S536_R1_ACCEPTANCE_COMPLETE: bool = false;
pub const RUNBOOK_EXECUTED_IN_S536: bool = false;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS536R1PhysicalBootUartEvidenceContract {
    pub sequence: usize,
    pub predecessor_sequence: usize,
    pub r1_first_sequence: usize,
    pub r1_last_planned_sequence: usize,
    pub target_cpu: usize,
    pub target_board: &'static str,
    pub evidence_domain: &'static str,
    pub uart_baud: u32,
    pub uart_data_bits: u8,
    pub uart_stop_bits: u8,
    pub boot_to_ui_required_marker: &'static str,
    pub runtime_evidence_required: bool,
    pub physical_evidence_required: bool,
}

pub const S536_CANONICAL_CONTRACT: G8lS536R1PhysicalBootUartEvidenceContract =
    G8lS536R1PhysicalBootUartEvidenceContract {
        sequence: S536_SEQUENCE,
        predecessor_sequence: S536_EXPECTED_PREDECESSOR,
        r1_first_sequence: S536_R1_FIRST_SEQUENCE,
        r1_last_planned_sequence: S536_R1_LAST_PLANNED_SEQUENCE,
        target_cpu: S536_TARGET_CPU,
        target_board: S536_TARGET_BOARD,
        evidence_domain: S536_EVIDENCE_DOMAIN,
        uart_baud: S536_UART_BAUD,
        uart_data_bits: S536_UART_DATA_BITS,
        uart_stop_bits: S536_UART_STOP_BITS,
        boot_to_ui_required_marker: S536_BOOT_TO_UI_REQUIRED_MARKER,
        runtime_evidence_required: true,
        physical_evidence_required: true,
    };

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS536R1PhysicalBootUartEvidenceReceipt {
    pub sequence: usize,
    pub predecessor_sequence: usize,
    pub anchor_attempt_id: u64,
    pub completed_readiness_blocks: usize,
    pub prior_focused_groups: usize,
    pub prior_focused_tests: usize,
    pub contract_published: bool,
    pub supported_profile_runtime_observations: usize,
    pub physical_observations: usize,
    pub uart_capture_observed: bool,
    pub boot_to_ui_observed: bool,
    pub r1_acceptance_complete: bool,
    pub runbook_executed: bool,
}

#[derive(Debug)]
pub struct G8lS536R1PhysicalBootUartEvidenceState {
    receipt: Option<G8lS536R1PhysicalBootUartEvidenceReceipt>,
}

impl G8lS536R1PhysicalBootUartEvidenceState {
    pub const fn new() -> Self {
        Self { receipt: None }
    }

    pub const fn receipt(&self) -> Option<G8lS536R1PhysicalBootUartEvidenceReceipt> {
        self.receipt
    }
}

impl Default for G8lS536R1PhysicalBootUartEvidenceState {
    fn default() -> Self {
        Self::new()
    }
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS536R1PhysicalBootUartEvidenceOutcome {
    AwaitingS535,
    ContractPublished(G8lS536R1PhysicalBootUartEvidenceReceipt),
    ContractRetained(G8lS536R1PhysicalBootUartEvidenceReceipt),
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS536R1PhysicalBootUartEvidenceError {
    WrongCpu,
    S535Service,
    S535AnchorDrift,
    ContractDrift,
    PublishedStateDrift,
}

pub const fn s535_snapshot_is_exact_for_s536(
    snapshot: G8lS431ToS535AcceptanceLedgerSnapshot,
) -> bool {
    snapshot.anchor_attempt_id != 0
        && snapshot.last_completed_sequence == S535_SEQUENCE
        && snapshot.completed_block_count == S431_TO_S535_BLOCK_COUNT
        && snapshot.supported_profile_runtime_observations == 0
        && snapshot.physical_observations == 0
        && !snapshot.r2_product_acceptance_complete
}

const fn canonical_receipt(anchor_attempt_id: u64) -> G8lS536R1PhysicalBootUartEvidenceReceipt {
    G8lS536R1PhysicalBootUartEvidenceReceipt {
        sequence: S536_SEQUENCE,
        predecessor_sequence: S536_EXPECTED_PREDECESSOR,
        anchor_attempt_id,
        completed_readiness_blocks: S431_TO_S535_BLOCK_COUNT,
        prior_focused_groups: S536_PRIOR_FOCUSED_GROUPS,
        prior_focused_tests: S536_PRIOR_FOCUSED_TESTS,
        contract_published: true,
        supported_profile_runtime_observations: S536_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS,
        physical_observations: S536_PHYSICAL_OBSERVATIONS,
        uart_capture_observed: S536_UART_CAPTURE_OBSERVED,
        boot_to_ui_observed: S536_BOOT_TO_UI_OBSERVED,
        r1_acceptance_complete: S536_R1_ACCEPTANCE_COMPLETE,
        runbook_executed: RUNBOOK_EXECUTED_IN_S536,
    }
}

pub fn service_s536_model_r1_physical_boot_uart_evidence_contract(
    state: &mut G8lS536R1PhysicalBootUartEvidenceState,
    caller_cpu: usize,
    s535_snapshot: Option<G8lS431ToS535AcceptanceLedgerSnapshot>,
    contract: G8lS536R1PhysicalBootUartEvidenceContract,
) -> Result<G8lS536R1PhysicalBootUartEvidenceOutcome, G8lS536R1PhysicalBootUartEvidenceError> {
    if caller_cpu != S536_TARGET_CPU {
        return Err(G8lS536R1PhysicalBootUartEvidenceError::WrongCpu);
    }
    if contract != S536_CANONICAL_CONTRACT {
        return Err(G8lS536R1PhysicalBootUartEvidenceError::ContractDrift);
    }
    let Some(snapshot) = s535_snapshot else {
        return Ok(G8lS536R1PhysicalBootUartEvidenceOutcome::AwaitingS535);
    };
    if !s535_snapshot_is_exact_for_s536(snapshot) {
        return Err(G8lS536R1PhysicalBootUartEvidenceError::S535AnchorDrift);
    }
    let receipt = canonical_receipt(snapshot.anchor_attempt_id);
    if let Some(published) = state.receipt {
        if published != receipt {
            return Err(G8lS536R1PhysicalBootUartEvidenceError::PublishedStateDrift);
        }
        return Ok(G8lS536R1PhysicalBootUartEvidenceOutcome::ContractRetained(
            published,
        ));
    }
    state.receipt = Some(receipt);
    Ok(G8lS536R1PhysicalBootUartEvidenceOutcome::ContractPublished(
        receipt,
    ))
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
static S536_PRODUCTION_R1_PHYSICAL_BOOT_UART_EVIDENCE_STATE: spin::Mutex<
    G8lS536R1PhysicalBootUartEvidenceState,
> = spin::Mutex::new(G8lS536R1PhysicalBootUartEvidenceState::new());

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn service_s536_r1_physical_boot_uart_evidence_contract_on_cpu1(
) -> Result<G8lS536R1PhysicalBootUartEvidenceOutcome, G8lS536R1PhysicalBootUartEvidenceError> {
    if crate::percpu::try_current_cpu_id() != Some(S536_TARGET_CPU) {
        return Err(G8lS536R1PhysicalBootUartEvidenceError::WrongCpu);
    }
    let snapshot = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s431_runtime_evidence_contract::inspect_s431_to_s535_production_acceptance_ledger_on_cpu1()
        .map_err(|_| G8lS536R1PhysicalBootUartEvidenceError::S535Service)?;
    service_s536_model_r1_physical_boot_uart_evidence_contract(
        &mut S536_PRODUCTION_R1_PHYSICAL_BOOT_UART_EVIDENCE_STATE.lock(),
        S536_TARGET_CPU,
        snapshot,
        S536_CANONICAL_CONTRACT,
    )
}

/// S569-only boot-context entry. It publishes the unchanged S536 contract
/// from a frozen source-manifest snapshot without reading or mutating the
/// unreachable live S431-S535 production ledger. The common model still
/// validates every snapshot field and fails closed on drift.
#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn service_s536_r1_physical_boot_uart_evidence_contract_from_frozen_source_manifest_on_cpu1(
    snapshot: G8lS431ToS535AcceptanceLedgerSnapshot,
) -> Result<G8lS536R1PhysicalBootUartEvidenceOutcome, G8lS536R1PhysicalBootUartEvidenceError> {
    if crate::percpu::try_current_cpu_id() != Some(S536_TARGET_CPU) {
        return Err(G8lS536R1PhysicalBootUartEvidenceError::WrongCpu);
    }
    service_s536_model_r1_physical_boot_uart_evidence_contract(
        &mut S536_PRODUCTION_R1_PHYSICAL_BOOT_UART_EVIDENCE_STATE.lock(),
        S536_TARGET_CPU,
        Some(snapshot),
        S536_CANONICAL_CONTRACT,
    )
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn inspect_s536_r1_physical_boot_uart_evidence_contract_on_cpu1(
) -> Result<Option<G8lS536R1PhysicalBootUartEvidenceReceipt>, G8lS536R1PhysicalBootUartEvidenceError>
{
    if crate::percpu::try_current_cpu_id() != Some(S536_TARGET_CPU) {
        return Err(G8lS536R1PhysicalBootUartEvidenceError::WrongCpu);
    }
    Ok(S536_PRODUCTION_R1_PHYSICAL_BOOT_UART_EVIDENCE_STATE
        .lock()
        .receipt())
}

use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s431_runtime_evidence_contract::G8lS431ToS535AcceptanceLedgerSnapshot;
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s536_r1_physical_boot_uart_evidence_contract as gate;

fn exact_s535_snapshot() -> G8lS431ToS535AcceptanceLedgerSnapshot {
    G8lS431ToS535AcceptanceLedgerSnapshot {
        anchor_attempt_id: 535_001,
        last_completed_sequence: 535,
        completed_block_count: 15,
        supported_profile_runtime_observations: 0,
        physical_observations: 0,
        r2_product_acceptance_complete: false,
    }
}

#[test]
fn s536_is_the_renumbered_r1_entry_after_s535() {
    assert_eq!(gate::S536_SEQUENCE, 536);
    assert_eq!(gate::S536_EXPECTED_PREDECESSOR, 535);
    assert_eq!(gate::S536_R1_FIRST_SEQUENCE, 536);
    assert_eq!(gate::S536_R1_LAST_PLANNED_SEQUENCE, 565);
    assert_eq!(gate::S536_R1_PLANNED_GATE_COUNT, 30);
    assert_eq!(gate::S536_TARGET_CPU, 1);
}

#[test]
fn s536_r1_phase_ranges_are_contiguous_and_exact() {
    assert_eq!(
        (
            gate::S536_BOOT_UART_FIRST_SEQUENCE,
            gate::S536_BOOT_UART_LAST_SEQUENCE,
        ),
        (536, 542)
    );
    assert_eq!(
        (
            gate::S536_UI_INPUT_FIRST_SEQUENCE,
            gate::S536_UI_INPUT_LAST_SEQUENCE,
        ),
        (543, 549)
    );
    assert_eq!(
        (
            gate::S536_MODEM_VOICE_FIRST_SEQUENCE,
            gate::S536_MODEM_VOICE_LAST_SEQUENCE,
        ),
        (550, 556)
    );
    assert_eq!(
        (
            gate::S536_APPLICATION_RECOVERY_FIRST_SEQUENCE,
            gate::S536_APPLICATION_RECOVERY_LAST_SEQUENCE,
        ),
        (557, 563)
    );
    assert_eq!(
        (
            gate::S536_R1_MATRIX_FIRST_SEQUENCE,
            gate::S536_R1_MATRIX_LAST_SEQUENCE,
        ),
        (564, 565)
    );
}

#[test]
fn s536_canonical_contract_is_exact() {
    let contract = gate::S536_CANONICAL_CONTRACT;
    assert_eq!(
        (contract.sequence, contract.predecessor_sequence),
        (536, 535)
    );
    assert_eq!(
        (
            contract.r1_first_sequence,
            contract.r1_last_planned_sequence
        ),
        (536, 565)
    );
    assert_eq!(contract.target_cpu, 1);
    assert_eq!(contract.target_board, "board-rpi5");
    assert_eq!(contract.evidence_domain, "physical_boot_uart");
    assert_eq!(
        (
            contract.uart_baud,
            contract.uart_data_bits,
            contract.uart_stop_bits,
        ),
        (115_200, 8, 1)
    );
    assert_eq!(
        contract.boot_to_ui_required_marker,
        "[R1:S536] BOOT_TO_UI_READY"
    );
    assert!(contract.runtime_evidence_required);
    assert!(contract.physical_evidence_required);
}

#[test]
fn s536_preserves_the_completed_focused_inventory_and_access_coverage() {
    assert_eq!(gate::S536_PRIOR_FOCUSED_GROUPS, 105);
    assert_eq!(gate::S536_PRIOR_FOCUSED_TESTS, 735);
    assert_eq!(gate::S536_SOURCE_AUDIT_UNITS, 7);
    assert_eq!(gate::S536_DIRECT_ACCESS_SITES, 113);
    assert_eq!(gate::S536_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES, 113);
    assert_eq!(gate::S536_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES, 113);
    assert_eq!(gate::S536_UNROUTED_DIRECT_ACCESS_SITES, 0);
}

#[test]
fn s536_does_not_claim_runtime_uart_boot_or_r1_acceptance() {
    assert_eq!(gate::S536_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS, 0);
    assert_eq!(gate::S536_PHYSICAL_OBSERVATIONS, 0);
    assert!(!gate::S536_UART_CAPTURE_OBSERVED);
    assert!(!gate::S536_BOOT_TO_UI_OBSERVED);
    assert!(!gate::S536_R1_ACCEPTANCE_COMPLETE);
    assert!(!gate::RUNBOOK_EXECUTED_IN_S536);
}

#[test]
fn s536_accepts_only_the_exact_s535_snapshot_shape() {
    assert!(gate::s535_snapshot_is_exact_for_s536(exact_s535_snapshot()));
}

#[test]
fn s536_wrong_cpu_fails_before_state_mutation() {
    let mut state = gate::G8lS536R1PhysicalBootUartEvidenceState::new();
    assert_eq!(
        gate::service_s536_model_r1_physical_boot_uart_evidence_contract(
            &mut state,
            0,
            Some(exact_s535_snapshot()),
            gate::S536_CANONICAL_CONTRACT,
        ),
        Err(gate::G8lS536R1PhysicalBootUartEvidenceError::WrongCpu)
    );
    assert_eq!(state.receipt(), None);
}

#[test]
fn s536_waits_without_mutation_when_s535_is_not_published() {
    let mut state = gate::G8lS536R1PhysicalBootUartEvidenceState::new();
    assert_eq!(
        gate::service_s536_model_r1_physical_boot_uart_evidence_contract(
            &mut state,
            1,
            None,
            gate::S536_CANONICAL_CONTRACT,
        ),
        Ok(gate::G8lS536R1PhysicalBootUartEvidenceOutcome::AwaitingS535)
    );
    assert_eq!(state.receipt(), None);
}

#[test]
fn s536_rejects_every_s535_anchor_drift_before_publication() {
    let mut drifts = [exact_s535_snapshot(); 6];
    drifts[0].anchor_attempt_id = 0;
    drifts[1].last_completed_sequence = 534;
    drifts[2].completed_block_count = 14;
    drifts[3].supported_profile_runtime_observations = 1;
    drifts[4].physical_observations = 1;
    drifts[5].r2_product_acceptance_complete = true;

    for drift in drifts {
        let mut state = gate::G8lS536R1PhysicalBootUartEvidenceState::new();
        assert_eq!(
            gate::service_s536_model_r1_physical_boot_uart_evidence_contract(
                &mut state,
                1,
                Some(drift),
                gate::S536_CANONICAL_CONTRACT,
            ),
            Err(gate::G8lS536R1PhysicalBootUartEvidenceError::S535AnchorDrift)
        );
        assert_eq!(state.receipt(), None);
    }
}

#[test]
fn s536_rejects_contract_drift_before_publication() {
    let mut state = gate::G8lS536R1PhysicalBootUartEvidenceState::new();
    let mut drift = gate::S536_CANONICAL_CONTRACT;
    drift.uart_baud = 9_600;
    assert_eq!(
        gate::service_s536_model_r1_physical_boot_uart_evidence_contract(
            &mut state,
            1,
            Some(exact_s535_snapshot()),
            drift,
        ),
        Err(gate::G8lS536R1PhysicalBootUartEvidenceError::ContractDrift)
    );
    assert_eq!(state.receipt(), None);
}

#[test]
fn s536_publishes_an_open_evidence_receipt_once() {
    let mut state = gate::G8lS536R1PhysicalBootUartEvidenceState::new();
    let gate::G8lS536R1PhysicalBootUartEvidenceOutcome::ContractPublished(receipt) =
        gate::service_s536_model_r1_physical_boot_uart_evidence_contract(
            &mut state,
            1,
            Some(exact_s535_snapshot()),
            gate::S536_CANONICAL_CONTRACT,
        )
        .unwrap()
    else {
        panic!("S536 must publish its contract")
    };
    assert_eq!((receipt.sequence, receipt.predecessor_sequence), (536, 535));
    assert_eq!(receipt.anchor_attempt_id, 535_001);
    assert_eq!(receipt.completed_readiness_blocks, 15);
    assert_eq!(
        (receipt.prior_focused_groups, receipt.prior_focused_tests),
        (105, 735)
    );
    assert!(receipt.contract_published);
    assert_eq!(receipt.supported_profile_runtime_observations, 0);
    assert_eq!(receipt.physical_observations, 0);
    assert!(!receipt.uart_capture_observed);
    assert!(!receipt.boot_to_ui_observed);
    assert!(!receipt.r1_acceptance_complete);
    assert!(!receipt.runbook_executed);
    assert_eq!(state.receipt(), Some(receipt));
}

#[test]
fn s536_exact_replay_retains_the_same_receipt() {
    let mut state = gate::G8lS536R1PhysicalBootUartEvidenceState::new();
    let first = gate::service_s536_model_r1_physical_boot_uart_evidence_contract(
        &mut state,
        1,
        Some(exact_s535_snapshot()),
        gate::S536_CANONICAL_CONTRACT,
    )
    .unwrap();
    let gate::G8lS536R1PhysicalBootUartEvidenceOutcome::ContractPublished(receipt) = first else {
        panic!("publish")
    };
    assert_eq!(
        gate::service_s536_model_r1_physical_boot_uart_evidence_contract(
            &mut state,
            1,
            Some(exact_s535_snapshot()),
            gate::S536_CANONICAL_CONTRACT,
        ),
        Ok(gate::G8lS536R1PhysicalBootUartEvidenceOutcome::ContractRetained(receipt))
    );
}

#[test]
fn s536_rejects_anchor_replacement_after_publication() {
    let mut state = gate::G8lS536R1PhysicalBootUartEvidenceState::new();
    gate::service_s536_model_r1_physical_boot_uart_evidence_contract(
        &mut state,
        1,
        Some(exact_s535_snapshot()),
        gate::S536_CANONICAL_CONTRACT,
    )
    .unwrap();
    let mut replacement = exact_s535_snapshot();
    replacement.anchor_attempt_id += 1;
    assert_eq!(
        gate::service_s536_model_r1_physical_boot_uart_evidence_contract(
            &mut state,
            1,
            Some(replacement),
            gate::S536_CANONICAL_CONTRACT,
        ),
        Err(gate::G8lS536R1PhysicalBootUartEvidenceError::PublishedStateDrift)
    );
}

#[test]
fn s536_source_contains_no_physical_operator_execution_path() {
    let source = include_str!("../../kernel/src/g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s536_r1_physical_boot_uart_evidence_contract.rs");
    assert!(!source.contains("std::process::Command"));
    assert!(!source.contains("/dev/tty"));
    assert!(!source.contains("capture-rpi5"));
    assert!(!source.contains("write-sd"));
    assert!(source.contains("pub const RUNBOOK_EXECUTED_IN_S536: bool = false"));
}

#[test]
fn s536_has_separate_kernel_simulation_and_cpu1_wiring_after_s535() {
    const TARGET: &str = "g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s536_r1_physical_boot_uart_evidence_contract";
    const PREVIOUS: &str = "service_s535_r2_acceptance_boundary_on_cpu1";
    const SERVICE: &str = "service_s536_r1_physical_boot_uart_evidence_contract_on_cpu1";
    let kernel_registry = include_str!("../../kernel/src/main.rs");
    let simulation_registry = include_str!("../src/lib.rs");
    let exceptions = include_str!("../../kernel/src/arch/aarch64/exceptions.rs");
    assert_eq!(
        kernel_registry.matches(&format!("mod {TARGET};")).count(),
        1
    );
    assert_eq!(
        simulation_registry
            .matches(&format!("pub mod {TARGET};"))
            .count(),
        1
    );
    assert_eq!(exceptions.matches(SERVICE).count(), 1);
    assert!(exceptions.find(PREVIOUS).unwrap() < exceptions.find(SERVICE).unwrap());
    assert!(
        exceptions.find(SERVICE).unwrap()
            < exceptions
                .find("return crate::rpi5_g7d::on_timer_irq")
                .unwrap()
    );
}

  {
    id: "g8l-s536-r1-physical-boot-uart-evidence-contract-partial",
    date: "2026-08-30",
    sequence: 536,
    status: "passed",
    umbrella_status: "partial",
    title: "S536 · R1 physical boot/UART evidence contract",
    summary:
      "S536, focused software-readiness zincirini S535'te sabit tutarak laboratuvar telefon demonstratörü R1 aralığını S536–S565 biçiminde yeniden numaralandırır ve ilk fiziksel boot/UART kanıt sözleşmesini ayrı kapı olarak yayımlar. Exact S535 snapshot'ı nonzero anchor, last=535, 15/15 readiness block, runtime observation=0, physical observation=0 ve R2 acceptance=false olarak doğrulanmadan ilerlemez. Canonical sözleşme board-rpi5, CPU1, 115200/8N1 UART ve [R1:S536] BOOT_TO_UI_READY zorunlu marker'ını bağlar. Bu yalnız kanıt gereksiniminin production state'e fail-closed yayınıdır: UART capture=false, Boot-to-UI=false, R1 acceptance=false ve RUNBOOK_EXECUTED_IN_S536=NO kalır; demonstratör hazır sayılmaz.",
    evidence: [
      "S535 terminal focused software-readiness sınırı olarak korunur; R1 başlangıcı artık S536 ve planlanan R1 kapanışı S565'tir.",
      "S536–S542 RPi5 fiziksel boot/UART/Boot-to-UI, S543–S549 ekran/dokunmatik-girdi/UI, S550–S556 modem/veri/ses/audio, S557–S563 kontrollü uygulama/recovery/update ve S564–S565 R1 kanıt matrisi/demonstratör sınırı olarak ayrı plan aralıklarıdır.",
      "Bu plan aralıkları taahhüt veya garantili bitiş numarası değildir; fiziksel red ve tekrarlar yeni sıra tüketebilir.",
      "S431–S535 focused kapanışı yeniden 105 ayrı hedef / 105 grup / 735/735 PASS / 0 fail olarak çalıştırıldı; S535 ötesinde bekleyen eski focused hedef bulunmadı.",
      "Yeni S536 focused hedefi 15/15 PASS / 0 fail / 0 ignored / 0 filtered verdi.",
      "S431–S536 toplam focused kapsamı 106 ayrı grup / 750/750 PASS'tir.",
      "S238–S536 exact dependency listesi iki bağımsız seri turda ayrı ayrı 300 grup / 5290/5290 PASS / 0 fail verdi.",
      "İki dependency turunun süre-normalize özetleri 67947 B ve e289626ed85e08974f18e7be7cf268fe35ca471a66fa9707078e088a16c50921 SHA-256 ile byte-exact eşittir.",
      "Exact yedi tarihsel G8h assertion dışındaki manifest-aware workspace 499 sonuç grubu / 7180 PASS / 0 fail / 7 filtered verdi; raw log 93062 B / 6b3acbfda765f85bfdf5a892f1e105563de29041938353dd1056bde7a5acf377 SHA-256'dır.",
      "Dört fresh ve birbirinden yalıtılmış AArch64 profil 4/4 exit 0 verdi: board-qemu, board-rpi4, board-rpi5 ve board-rpi5+smp.",
      "Fresh ELF ölçümleri board-qemu 16814200 B / 1f358200979a677bbd606be09a6780a52e95262ffebeaccdfebfdc0dfa8d6163, board-rpi4 11925464 B / 49e8b96f35cda6a07913017d2b4ec358eda425f6a9260b9e2a382989ff3fe1ee, board-rpi5 17830520 B / e23a197d82ff94bc56051bc6d81cb9ab4049424b8148e0568c179e1d9f159877 ve board-rpi5+smp 17831592 B / 113c8212b45ce6ead41c7f95022739fd617ab37a9f2e0bdeb26bb6b9b8336b3c SHA-256'dır.",
      "Profil warning header sayıları 293/391/2838/2838 olarak ölçüldü; zero-warning iddiası yoktur. Artifact root /tmp/aselsanos-s536-profiles.UnsVin'dir.",
      "İlk web kabulü 749/749 test, lint PASS, TypeScript exit 0 / 0 B çıktı ve 666/666 statik sayfa verdi; export 3410 dosya, 25 MiB üzeri dosya 0 ve en büyük HTML out/operations/index.html 19681536 B'dir.",
      "İlk S1–S536 Code registry 536/536 unique kart, 1572 exact excerpt, missing=none, duplicate=0 ve 91dcca8440debd579258e04ae95dbfc4ce5d8bd201c35cbfc12d07e56b834e3 SHA-256 verdi.",
      "İlk production deployment f913bc73-a332-4c46-870b-79d47b1d0c5f kimliğiyle 3325 upload + 84 existing / 3409 asset ve _headers upload tamamladı.",
      "Cache-busted custom-domain readback /code/, /code/s536/, /code/s535/, /operations/, /operations/s536/, /operations/s535/, /timeline/ ve /yol-haritasi/ için 8/8 HTTP 200 ve local out'a byte-exact=true verdi.",
      "Canlı Code 536 unique kart, Timeline/Yol Haritası ayrı ayrı 375 unique data-gate-policy kartı ve S536 Code/Operations detail kimlikleri exact birer kez doğrulandı.",
      "/code/ response no-transform ve nosniff taşır; immutable f913bc73 hostname probe curl exit 28 / HTTP 000 verdiğinden PASS diye sunulmaz.",
      "Kanıt-senkronizasyon kabulü de 749/749 test, lint PASS, TypeScript exit 0 / 0 B, 666/666 statik sayfa, 3410 export dosyası ve 25 MiB üzeri dosya 0 verdi.",
      "Kanıt-senkronize registry 7d7eea56d344ff28375769ec12971ca44314cbf4937ff888619ffa08aea14f8c SHA-256'dır; production deployment 46e9dbdc-1ceb-430c-b64c-f141eceb961d ile 3325 upload + 84 existing tamamladı.",
      "Kanıt-senkronize cache-busted custom-domain readback aynı sekiz rotada 8/8 HTTP 200 ve local out'a byte-exact=true; canlı Code=536, Timeline=375, Yol Haritası=375 ve S536 detail kimlikleri 1/1'dir.",
      "Implementation kernel/src/g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s536_r1_physical_boot_uart_evidence_contract.rs dosyasında ayrı modüldür.",
      "Implementation 10264 B / cecf8655cc994436ee4047e214a227d56d264652cbfd742146de4c5cbf2b3ddd SHA-256'dır.",
      "Focused test simulation/tests/g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s536_r1_physical_boot_uart_evidence_contract.rs dosyasında ayrı target'tır.",
      "Focused test 10656 B / 61ee886a518c328fe8bef56eb909945da203db1f909f4ad6f3acff9e27a43c76 SHA-256'dır.",
      "Kanıt belgesi docs/M8.1-RPi5-G8l-S536-R1-Physical-Boot-UART-Evidence-Contract-Proof.md olarak ayrıdır.",
      "S536 kernel/src/main.rs ve simulation/src/lib.rs içinde S431–S535 generated bölgesinin dışında ayrı module/export kaydıdır; generator tekrarının S536'yı S535 ile birleştirmesi engellenir.",
      "CPU1 timer service çağrısı S535 production service çağrısından sonra ve rpi5_g7d timer dönüşünden önce ayrı fail-closed match olarak yer alır.",
      "Model wrong CPU'yu state mutation öncesi reddeder ve eksik S535 snapshot'ında AwaitingS535 döndürür.",
      "Zero anchor, last sequence drift, completed-block drift, runtime observation drift, physical observation drift ve R2 acceptance drift S535AnchorDrift ile publication öncesi kapanır.",
      "UART baud veya başka canonical contract alanı drift ederse ContractDrift publication öncesi kapanır.",
      "Exact ilk çağrı immutable ContractPublished receipt'i, exact replay ContractRetained receipt'i üretir; farklı anchor ile replacement PublishedStateDrift olur.",
      "Receipt S536/S535 kimliği, S535 anchor'ı, 15 readiness block ve önceki 105 grup/735 test sayaçlarını taşır.",
      "Receipt supported-profile runtime observations=0, physical observations=0, uart_capture_observed=false, boot_to_ui_observed=false, r1_acceptance_complete=false ve runbook_executed=false taşır.",
      "S536 coverage tuple'ı 7 source audit unit / 113 direct / 113 source-model / 113 production guarded / 0 unrouted olarak korunur.",
      "S536 yeni mutable Scheduler aliası, yeni S247 state word, provider authority, admission publisher veya fiziksel observation üretmez.",
      "S536 source'u process command, /dev/tty, capture helper veya SD write yolu içermez; fiziksel operatör eylemi koddan tetiklenmez.",
      "Bu kapıda güç açma/kapatma, SD kart çıkarma/takma, Mac kart erişimi, UART açma/capture, raw validation, archive veya promotion yapılmadı.",
      "physical/device operations=0 · RUNBOOK_EXECUTED_IN_S536=NO.",
      "S536 dar source/contract kabulü PASS'tir; laboratuvar demonstratörü, supported-profile runtime, fiziksel boot, Boot-to-UI veya R1 ürün kabulü PASS değildir.",
    ],
    commands: [
      "CARGO_INCREMENTAL=0 cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s536_r1_physical_boot_uart_evidence_contract -- --test-threads=1",
      "run S431-S535 focused targets as 105 independent serial commands",
      "run S238-S536 exact dependency list twice and normalize timing fields",
      "cargo test --workspace --quiet -- --test-threads=1 with exact seven historical skips",
      "run four fresh isolated AArch64 profile builds",
      "npm test && npm run lint && npx tsc --noEmit && npm run build",
      "npm run deploy; cache-busted curl and cmp on eight custom-domain routes",
      "repeat website acceptance, deploy evidence sync, and repeat eight-route readback",
    ],
    terminalSessions: [
      {
        id: "s536-prior-focused-phase-close",
        title: "S535 terminal focused phase recheck",
        commandLines: [
          "run S431-S535 focused targets as 105 independent serial commands",
        ],
        outputLines: [
          "focused targets=105; result groups=105; passed=735; failed=0",
          "no focused target after S535 existed before the S536 transition",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "s536-r1-physical-boot-uart-contract-focused",
        title: "S536 focused R1 boot/UART evidence contract",
        commandLines: [
          "CARGO_INCREMENTAL=0 cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s536_r1_physical_boot_uart_evidence_contract -- --test-threads=1",
        ],
        outputLines: [
          "test result: ok; 15 passed; 0 failed; 0 ignored; 0 filtered",
          "R1 range=S536-S565; predecessor=S535; target=board-rpi5/CPU1; UART=115200/8N1",
          "UART capture=false; Boot-to-UI=false; physical observations=0; R1 acceptance=false",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "s536-dependency-and-workspace-reconciliation",
        title: "S536 dependency and remaining focused inventory",
        commandLines: [
          "run S238-S536 exact dependency list twice and normalize timing fields",
          "run manifest-aware filtered serial workspace audit",
        ],
        outputLines: [
          "dependency run1=300 groups / 5290 PASS; run2=300 groups / 5290 PASS",
          "normalized summaries=67947 B; e289626ed85e08974f18e7be7cf268fe35ca471a66fa9707078e088a16c50921; byte-exact=true",
          "workspace=499 groups / 7180 PASS / 0 fail / 7 historical filtered",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "s536-fresh-aarch64-profile-builds",
        title: "S536 four-profile compile acceptance",
        commandLines: ["run four fresh isolated AArch64 profile builds"],
        outputLines: [
          "board-qemu + board-rpi4 + board-rpi5 + board-rpi5,smp = 4/4 exit 0",
          "fresh target roots and ELF byte/SHA-256 measurements recorded separately",
          "compile acceptance is not an RPi5 runtime or physical observation",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "s536-initial-web-publication",
        title: "S536 initial website acceptance and production publication",
        commandLines: [
          "npm test && npm run lint && npx tsc --noEmit && npm run build",
          "npm run deploy",
          "cache-busted curl and cmp on eight custom-domain routes",
        ],
        outputLines: [
          "website=749/749; lint=PASS; TypeScript=exit 0 / empty; static=666/666",
          "deployment=f913bc73-a332-4c46-870b-79d47b1d0c5f; assets=3325 upload + 84 existing",
          "custom domain=8/8 HTTP 200 and byte-exact; live Code=536; Timeline/Roadmap=375/375",
          "immutable hostname exit=28 / HTTP 000; PASS not claimed",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "s536-evidence-sync-publication",
        title: "S536 evidence-synchronized production publication",
        commandLines: [
          "repeat website acceptance",
          "deploy evidence sync",
          "repeat cache-busted eight-route custom-domain readback",
        ],
        outputLines: [
          "website=749/749; lint=PASS; TypeScript=exit 0 / empty; static=666/666",
          "deployment=46e9dbdc-1ceb-430c-b64c-f141eceb961d; assets=3325 upload + 84 existing",
          "custom domain=8/8 HTTP 200 and byte-exact; live Code=536; Timeline/Roadmap=375/375",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
    ],
    terminalSessionsNote:
      "S536 software-focused kapanışı ile R1 fiziksel kanıt gereksinimini ayırır. Buradaki PASS contract publication içindir; gerçek cihaz veya Boot-to-UI observation değildir.",
    limitations: [
      "S536'da hiçbir fiziksel cihaz işlemi veya supported-profile runtime gözlemi yapılmadı.",
      "BOOT_TO_UI_READY yalnız gelecekte aranacak zorunlu marker'dır; görülmüş bir UART satırı değildir.",
      "S536–S565 planı garantili kapanış değildir ve red/tekrar halinde kayabilir.",
      "Ekran/girdi S543, modem/ses S550, uygulama/recovery/update S557 ve R1 matrix S564 öncesinde tamamlanmış sayılmaz.",
      "Filtresiz workspace'in dondurulmuş S96 tarihsel identity assertion'ı bu kapıda değiştirilmedi; global unfiltered GREEN iddia edilmez.",
      "R1 laboratuvar demonstratörü, saha güvenilirliği veya günlük kullanım kabulü değildir.",
    ],
  },