S537 · R1 physical boot/UART evidence request

#![allow(unexpected_cfgs)]

//! S537 publishes the first R1 physical boot/UART evidence request.
//!
//! The request is anchored to the exact immutable S536 contract receipt.  It
//! describes evidence that a later operator-authorized gate must collect, but
//! it is deliberately non-authoritative: this module cannot power a device,
//! open a serial port, write an SD card or claim a runtime observation.

use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s536_r1_physical_boot_uart_evidence_contract::{
    G8lS536R1PhysicalBootUartEvidenceContract, G8lS536R1PhysicalBootUartEvidenceReceipt,
    S536_BOOT_TO_UI_REQUIRED_MARKER, S536_CANONICAL_CONTRACT, S536_DIRECT_ACCESS_SITES,
    S536_EXPECTED_PREDECESSOR, S536_PHYSICAL_OBSERVATIONS,
    S536_PRIOR_FOCUSED_GROUPS, S536_PRIOR_FOCUSED_TESTS,
    S536_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES, S536_SEQUENCE, S536_SOURCE_AUDIT_UNITS,
    S536_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES, S536_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS,
    S536_TARGET_BOARD, S536_TARGET_CPU, S536_UART_BAUD, S536_UART_CAPTURE_OBSERVED,
    S536_UART_DATA_BITS, S536_UART_STOP_BITS, S536_UNROUTED_DIRECT_ACCESS_SITES,
};

pub const S537_SEQUENCE: usize = 537;
pub const S537_EXPECTED_PREDECESSOR: usize = S536_SEQUENCE;
pub const S537_TARGET_CPU: usize = S536_TARGET_CPU;
pub const S537_REQUEST_PURPOSE: &str = "collect_board_rpi5_boot_uart_boot_to_ui_evidence";
pub const S537_SOURCE_AUDIT_UNITS: usize = S536_SOURCE_AUDIT_UNITS;
pub const S537_DIRECT_ACCESS_SITES: usize = S536_DIRECT_ACCESS_SITES;
pub const S537_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES: usize =
    S536_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES;
pub const S537_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES: usize =
    S536_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES;
pub const S537_UNROUTED_DIRECT_ACCESS_SITES: usize = S536_UNROUTED_DIRECT_ACCESS_SITES;
pub const S537_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS: usize = 0;
pub const S537_PHYSICAL_OBSERVATIONS: usize = 0;
pub const S537_PHYSICAL_OR_DEVICE_OPERATIONS: usize = 0;
pub const S537_UART_CAPTURE_OBSERVED: bool = false;
pub const S537_BOOT_TO_UI_OBSERVED: bool = false;
pub const S537_R1_ACCEPTANCE_COMPLETE: bool = false;
pub const S537_REQUEST_IS_AUTHORITY: bool = false;
pub const S537_OPERATOR_AUTHORIZATION_PRESENT: bool = false;
pub const S537_EXECUTION_PERMIT_PUBLISHED: bool = false;
pub const RUNBOOK_EXECUTED_IN_S537: bool = false;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS537R1PhysicalBootUartEvidenceRequest {
    pub sequence: usize,
    pub predecessor_sequence: usize,
    pub request_id: u64,
    pub contract_anchor_attempt_id: u64,
    pub target_cpu: usize,
    pub target_board: &'static str,
    pub request_purpose: &'static str,
    pub uart_baud: u32,
    pub uart_data_bits: u8,
    pub uart_stop_bits: u8,
    pub boot_to_ui_required_marker: &'static str,
    pub runtime_evidence_requested: bool,
    pub physical_evidence_requested: bool,
    pub is_authority: bool,
    pub operator_authorization_present: bool,
    pub execution_permit_published: bool,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS537R1PhysicalBootUartEvidenceRequestReceipt {
    pub request: G8lS537R1PhysicalBootUartEvidenceRequest,
    pub request_published: bool,
    pub supported_profile_runtime_observations: usize,
    pub physical_observations: usize,
    pub uart_capture_observed: bool,
    pub boot_to_ui_observed: bool,
    pub r1_acceptance_complete: bool,
    pub runbook_executed: bool,
}

#[derive(Debug)]
pub struct G8lS537R1PhysicalBootUartEvidenceRequestState {
    receipt: Option<G8lS537R1PhysicalBootUartEvidenceRequestReceipt>,
}

impl G8lS537R1PhysicalBootUartEvidenceRequestState {
    pub const fn new() -> Self {
        Self { receipt: None }
    }

    pub const fn receipt(&self) -> Option<G8lS537R1PhysicalBootUartEvidenceRequestReceipt> {
        self.receipt
    }
}

impl Default for G8lS537R1PhysicalBootUartEvidenceRequestState {
    fn default() -> Self {
        Self::new()
    }
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS537R1PhysicalBootUartEvidenceRequestOutcome {
    AwaitingS536,
    RequestPublished(G8lS537R1PhysicalBootUartEvidenceRequestReceipt),
    RequestRetained(G8lS537R1PhysicalBootUartEvidenceRequestReceipt),
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS537R1PhysicalBootUartEvidenceRequestError {
    WrongCpu,
    S536Service,
    S536ReceiptDrift,
    ContractDrift,
    InvalidRequestId,
    PublishedStateDrift,
}

pub const fn s536_receipt_is_exact_for_s537(
    receipt: G8lS536R1PhysicalBootUartEvidenceReceipt,
) -> bool {
    receipt.sequence == S536_SEQUENCE
        && receipt.predecessor_sequence == S536_EXPECTED_PREDECESSOR
        && receipt.anchor_attempt_id != 0
        && receipt.completed_readiness_blocks == 15
        && receipt.prior_focused_groups == S536_PRIOR_FOCUSED_GROUPS
        && receipt.prior_focused_tests == S536_PRIOR_FOCUSED_TESTS
        && receipt.contract_published
        && receipt.supported_profile_runtime_observations
            == S536_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS
        && receipt.physical_observations == S536_PHYSICAL_OBSERVATIONS
        && receipt.uart_capture_observed == S536_UART_CAPTURE_OBSERVED
        && !receipt.boot_to_ui_observed
        && !receipt.r1_acceptance_complete
        && !receipt.runbook_executed
}

pub const fn derive_s537_request_id(anchor_attempt_id: u64) -> u64 {
    let derived = anchor_attempt_id.rotate_left(17) ^ ((S537_SEQUENCE as u64) << 32);
    if derived == 0 {
        S537_SEQUENCE as u64
    } else {
        derived
    }
}

pub const fn canonical_s537_request(
    receipt: G8lS536R1PhysicalBootUartEvidenceReceipt,
    request_id: u64,
) -> G8lS537R1PhysicalBootUartEvidenceRequest {
    G8lS537R1PhysicalBootUartEvidenceRequest {
        sequence: S537_SEQUENCE,
        predecessor_sequence: S537_EXPECTED_PREDECESSOR,
        request_id,
        contract_anchor_attempt_id: receipt.anchor_attempt_id,
        target_cpu: S537_TARGET_CPU,
        target_board: S536_TARGET_BOARD,
        request_purpose: S537_REQUEST_PURPOSE,
        uart_baud: S536_UART_BAUD,
        uart_data_bits: S536_UART_DATA_BITS,
        uart_stop_bits: S536_UART_STOP_BITS,
        boot_to_ui_required_marker: S536_BOOT_TO_UI_REQUIRED_MARKER,
        runtime_evidence_requested: true,
        physical_evidence_requested: true,
        is_authority: S537_REQUEST_IS_AUTHORITY,
        operator_authorization_present: S537_OPERATOR_AUTHORIZATION_PRESENT,
        execution_permit_published: S537_EXECUTION_PERMIT_PUBLISHED,
    }
}

const fn canonical_receipt(
    request: G8lS537R1PhysicalBootUartEvidenceRequest,
) -> G8lS537R1PhysicalBootUartEvidenceRequestReceipt {
    G8lS537R1PhysicalBootUartEvidenceRequestReceipt {
        request,
        request_published: true,
        supported_profile_runtime_observations: S537_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS,
        physical_observations: S537_PHYSICAL_OBSERVATIONS,
        uart_capture_observed: S537_UART_CAPTURE_OBSERVED,
        boot_to_ui_observed: S537_BOOT_TO_UI_OBSERVED,
        r1_acceptance_complete: S537_R1_ACCEPTANCE_COMPLETE,
        runbook_executed: RUNBOOK_EXECUTED_IN_S537,
    }
}

pub fn service_s537_model_r1_physical_boot_uart_evidence_request(
    state: &mut G8lS537R1PhysicalBootUartEvidenceRequestState,
    caller_cpu: usize,
    s536_receipt: Option<G8lS536R1PhysicalBootUartEvidenceReceipt>,
    contract: G8lS536R1PhysicalBootUartEvidenceContract,
    request_id: u64,
) -> Result<
    G8lS537R1PhysicalBootUartEvidenceRequestOutcome,
    G8lS537R1PhysicalBootUartEvidenceRequestError,
> {
    if caller_cpu != S537_TARGET_CPU {
        return Err(G8lS537R1PhysicalBootUartEvidenceRequestError::WrongCpu);
    }
    if contract != S536_CANONICAL_CONTRACT {
        return Err(G8lS537R1PhysicalBootUartEvidenceRequestError::ContractDrift);
    }
    if request_id == 0 {
        return Err(G8lS537R1PhysicalBootUartEvidenceRequestError::InvalidRequestId);
    }
    let Some(s536_receipt) = s536_receipt else {
        return Ok(G8lS537R1PhysicalBootUartEvidenceRequestOutcome::AwaitingS536);
    };
    if !s536_receipt_is_exact_for_s537(s536_receipt) {
        return Err(G8lS537R1PhysicalBootUartEvidenceRequestError::S536ReceiptDrift);
    }

    let receipt = canonical_receipt(canonical_s537_request(s536_receipt, request_id));
    if let Some(published) = state.receipt {
        if published != receipt {
            return Err(G8lS537R1PhysicalBootUartEvidenceRequestError::PublishedStateDrift);
        }
        return Ok(G8lS537R1PhysicalBootUartEvidenceRequestOutcome::RequestRetained(published));
    }

    state.receipt = Some(receipt);
    Ok(G8lS537R1PhysicalBootUartEvidenceRequestOutcome::RequestPublished(receipt))
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
static S537_PRODUCTION_R1_PHYSICAL_BOOT_UART_EVIDENCE_REQUEST_STATE: spin::Mutex<
    G8lS537R1PhysicalBootUartEvidenceRequestState,
> = spin::Mutex::new(G8lS537R1PhysicalBootUartEvidenceRequestState::new());

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn service_s537_r1_physical_boot_uart_evidence_request_on_cpu1() -> Result<
    G8lS537R1PhysicalBootUartEvidenceRequestOutcome,
    G8lS537R1PhysicalBootUartEvidenceRequestError,
> {
    if crate::percpu::try_current_cpu_id() != Some(S537_TARGET_CPU) {
        return Err(G8lS537R1PhysicalBootUartEvidenceRequestError::WrongCpu);
    }
    let s536_receipt = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s536_r1_physical_boot_uart_evidence_contract::inspect_s536_r1_physical_boot_uart_evidence_contract_on_cpu1()
        .map_err(|_| G8lS537R1PhysicalBootUartEvidenceRequestError::S536Service)?;
    let request_id = s536_receipt.map_or(S537_SEQUENCE as u64, |receipt| {
        derive_s537_request_id(receipt.anchor_attempt_id)
    });
    service_s537_model_r1_physical_boot_uart_evidence_request(
        &mut S537_PRODUCTION_R1_PHYSICAL_BOOT_UART_EVIDENCE_REQUEST_STATE.lock(),
        S537_TARGET_CPU,
        s536_receipt,
        S536_CANONICAL_CONTRACT,
        request_id,
    )
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn inspect_s537_r1_physical_boot_uart_evidence_request_on_cpu1() -> Result<
    Option<G8lS537R1PhysicalBootUartEvidenceRequestReceipt>,
    G8lS537R1PhysicalBootUartEvidenceRequestError,
> {
    if crate::percpu::try_current_cpu_id() != Some(S537_TARGET_CPU) {
        return Err(G8lS537R1PhysicalBootUartEvidenceRequestError::WrongCpu);
    }
    Ok(S537_PRODUCTION_R1_PHYSICAL_BOOT_UART_EVIDENCE_REQUEST_STATE
        .lock()
        .receipt())
}

use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s536_r1_physical_boot_uart_evidence_contract::{
    G8lS536R1PhysicalBootUartEvidenceReceipt, S536_CANONICAL_CONTRACT,
};
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s537_r1_physical_boot_uart_evidence_request as gate;

fn exact_s536_receipt() -> G8lS536R1PhysicalBootUartEvidenceReceipt {
    G8lS536R1PhysicalBootUartEvidenceReceipt {
        sequence: 536,
        predecessor_sequence: 535,
        anchor_attempt_id: 535_001,
        completed_readiness_blocks: 15,
        prior_focused_groups: 105,
        prior_focused_tests: 735,
        contract_published: true,
        supported_profile_runtime_observations: 0,
        physical_observations: 0,
        uart_capture_observed: false,
        boot_to_ui_observed: false,
        r1_acceptance_complete: false,
        runbook_executed: false,
    }
}

fn request_id() -> u64 {
    gate::derive_s537_request_id(exact_s536_receipt().anchor_attempt_id)
}

#[test]
fn s537_is_the_request_gate_immediately_after_s536() {
    assert_eq!(gate::S537_SEQUENCE, 537);
    assert_eq!(gate::S537_EXPECTED_PREDECESSOR, 536);
    assert_eq!(gate::S537_TARGET_CPU, 1);
    assert_eq!(
        gate::S537_REQUEST_PURPOSE,
        "collect_board_rpi5_boot_uart_boot_to_ui_evidence"
    );
}

#[test]
fn s537_accepts_only_the_exact_s536_receipt() {
    assert!(gate::s536_receipt_is_exact_for_s537(exact_s536_receipt()));
}

#[test]
fn s537_request_id_is_nonzero_stable_and_anchor_bound() {
    let first = gate::derive_s537_request_id(535_001);
    assert_ne!(first, 0);
    assert_eq!(first, gate::derive_s537_request_id(535_001));
    assert_ne!(first, gate::derive_s537_request_id(535_002));
}

#[test]
fn s537_canonical_request_copies_the_exact_s536_contract() {
    let request = gate::canonical_s537_request(exact_s536_receipt(), request_id());
    assert_eq!((request.sequence, request.predecessor_sequence), (537, 536));
    assert_eq!(request.contract_anchor_attempt_id, 535_001);
    assert_eq!(request.target_cpu, 1);
    assert_eq!(request.target_board, "board-rpi5");
    assert_eq!(request.uart_baud, 115_200);
    assert_eq!(request.uart_data_bits, 8);
    assert_eq!(request.uart_stop_bits, 1);
    assert_eq!(
        request.boot_to_ui_required_marker,
        "[R1:S536] BOOT_TO_UI_READY"
    );
    assert!(request.runtime_evidence_requested);
    assert!(request.physical_evidence_requested);
}

#[test]
fn s537_request_is_not_authority_or_execution_permission() {
    let request = gate::canonical_s537_request(exact_s536_receipt(), request_id());
    assert!(!gate::S537_REQUEST_IS_AUTHORITY);
    assert!(!gate::S537_OPERATOR_AUTHORIZATION_PRESENT);
    assert!(!gate::S537_EXECUTION_PERMIT_PUBLISHED);
    assert!(!request.is_authority);
    assert!(!request.operator_authorization_present);
    assert!(!request.execution_permit_published);
}

#[test]
fn s537_preserves_access_coverage_and_open_runtime_boundary() {
    assert_eq!(gate::S537_SOURCE_AUDIT_UNITS, 7);
    assert_eq!(gate::S537_DIRECT_ACCESS_SITES, 113);
    assert_eq!(gate::S537_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES, 113);
    assert_eq!(gate::S537_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES, 113);
    assert_eq!(gate::S537_UNROUTED_DIRECT_ACCESS_SITES, 0);
    assert_eq!(gate::S537_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS, 0);
    assert_eq!(gate::S537_PHYSICAL_OBSERVATIONS, 0);
    assert_eq!(gate::S537_PHYSICAL_OR_DEVICE_OPERATIONS, 0);
    assert!(!gate::S537_UART_CAPTURE_OBSERVED);
    assert!(!gate::S537_BOOT_TO_UI_OBSERVED);
    assert!(!gate::S537_R1_ACCEPTANCE_COMPLETE);
    assert!(!gate::RUNBOOK_EXECUTED_IN_S537);
}

#[test]
fn s537_wrong_cpu_fails_before_state_mutation() {
    let mut state = gate::G8lS537R1PhysicalBootUartEvidenceRequestState::new();
    assert_eq!(
        gate::service_s537_model_r1_physical_boot_uart_evidence_request(
            &mut state,
            0,
            Some(exact_s536_receipt()),
            S536_CANONICAL_CONTRACT,
            request_id(),
        ),
        Err(gate::G8lS537R1PhysicalBootUartEvidenceRequestError::WrongCpu)
    );
    assert_eq!(state.receipt(), None);
}

#[test]
fn s537_waits_for_s536_without_mutation() {
    let mut state = gate::G8lS537R1PhysicalBootUartEvidenceRequestState::new();
    assert_eq!(
        gate::service_s537_model_r1_physical_boot_uart_evidence_request(
            &mut state,
            1,
            None,
            S536_CANONICAL_CONTRACT,
            537,
        ),
        Ok(gate::G8lS537R1PhysicalBootUartEvidenceRequestOutcome::AwaitingS536)
    );
    assert_eq!(state.receipt(), None);
}

#[test]
fn s537_rejects_every_s536_receipt_drift_before_publication() {
    let mut drifts = [exact_s536_receipt(); 13];
    drifts[0].sequence = 535;
    drifts[1].predecessor_sequence = 534;
    drifts[2].anchor_attempt_id = 0;
    drifts[3].completed_readiness_blocks = 14;
    drifts[4].prior_focused_groups = 104;
    drifts[5].prior_focused_tests = 734;
    drifts[6].contract_published = false;
    drifts[7].supported_profile_runtime_observations = 1;
    drifts[8].physical_observations = 1;
    drifts[9].uart_capture_observed = true;
    drifts[10].boot_to_ui_observed = true;
    drifts[11].r1_acceptance_complete = true;
    drifts[12].runbook_executed = true;

    for drift in drifts {
        let mut state = gate::G8lS537R1PhysicalBootUartEvidenceRequestState::new();
        assert_eq!(
            gate::service_s537_model_r1_physical_boot_uart_evidence_request(
                &mut state,
                1,
                Some(drift),
                S536_CANONICAL_CONTRACT,
                request_id(),
            ),
            Err(gate::G8lS537R1PhysicalBootUartEvidenceRequestError::S536ReceiptDrift)
        );
        assert_eq!(state.receipt(), None);
    }
}

#[test]
fn s537_rejects_contract_drift_before_publication() {
    let mut state = gate::G8lS537R1PhysicalBootUartEvidenceRequestState::new();
    let mut drift = S536_CANONICAL_CONTRACT;
    drift.uart_baud = 9_600;
    assert_eq!(
        gate::service_s537_model_r1_physical_boot_uart_evidence_request(
            &mut state,
            1,
            Some(exact_s536_receipt()),
            drift,
            request_id(),
        ),
        Err(gate::G8lS537R1PhysicalBootUartEvidenceRequestError::ContractDrift)
    );
    assert_eq!(state.receipt(), None);
}

#[test]
fn s537_rejects_zero_request_id_before_publication() {
    let mut state = gate::G8lS537R1PhysicalBootUartEvidenceRequestState::new();
    assert_eq!(
        gate::service_s537_model_r1_physical_boot_uart_evidence_request(
            &mut state,
            1,
            Some(exact_s536_receipt()),
            S536_CANONICAL_CONTRACT,
            0,
        ),
        Err(gate::G8lS537R1PhysicalBootUartEvidenceRequestError::InvalidRequestId)
    );
    assert_eq!(state.receipt(), None);
}

#[test]
fn s537_publishes_one_open_non_authoritative_request() {
    let mut state = gate::G8lS537R1PhysicalBootUartEvidenceRequestState::new();
    let gate::G8lS537R1PhysicalBootUartEvidenceRequestOutcome::RequestPublished(receipt) =
        gate::service_s537_model_r1_physical_boot_uart_evidence_request(
            &mut state,
            1,
            Some(exact_s536_receipt()),
            S536_CANONICAL_CONTRACT,
            request_id(),
        )
        .unwrap()
    else {
        panic!("S537 must publish its request")
    };
    assert!(receipt.request_published);
    assert_eq!(receipt.request.request_id, request_id());
    assert_eq!(receipt.request.contract_anchor_attempt_id, 535_001);
    assert!(!receipt.request.is_authority);
    assert!(!receipt.request.execution_permit_published);
    assert_eq!(receipt.supported_profile_runtime_observations, 0);
    assert_eq!(receipt.physical_observations, 0);
    assert!(!receipt.uart_capture_observed);
    assert!(!receipt.boot_to_ui_observed);
    assert!(!receipt.r1_acceptance_complete);
    assert!(!receipt.runbook_executed);
    assert_eq!(state.receipt(), Some(receipt));
}

#[test]
fn s537_exact_replay_retains_the_same_request() {
    let mut state = gate::G8lS537R1PhysicalBootUartEvidenceRequestState::new();
    let first = gate::service_s537_model_r1_physical_boot_uart_evidence_request(
        &mut state,
        1,
        Some(exact_s536_receipt()),
        S536_CANONICAL_CONTRACT,
        request_id(),
    )
    .unwrap();
    let gate::G8lS537R1PhysicalBootUartEvidenceRequestOutcome::RequestPublished(receipt) = first
    else {
        panic!("publish")
    };
    assert_eq!(
        gate::service_s537_model_r1_physical_boot_uart_evidence_request(
            &mut state,
            1,
            Some(exact_s536_receipt()),
            S536_CANONICAL_CONTRACT,
            request_id(),
        ),
        Ok(gate::G8lS537R1PhysicalBootUartEvidenceRequestOutcome::RequestRetained(receipt))
    );
}

#[test]
fn s537_rejects_request_replacement_after_publication() {
    let mut state = gate::G8lS537R1PhysicalBootUartEvidenceRequestState::new();
    gate::service_s537_model_r1_physical_boot_uart_evidence_request(
        &mut state,
        1,
        Some(exact_s536_receipt()),
        S536_CANONICAL_CONTRACT,
        request_id(),
    )
    .unwrap();
    assert_eq!(
        gate::service_s537_model_r1_physical_boot_uart_evidence_request(
            &mut state,
            1,
            Some(exact_s536_receipt()),
            S536_CANONICAL_CONTRACT,
            request_id() + 1,
        ),
        Err(gate::G8lS537R1PhysicalBootUartEvidenceRequestError::PublishedStateDrift)
    );
}

#[test]
fn s537_has_no_physical_execution_path_and_is_wired_after_s536() {
    const TARGET: &str = "g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s537_r1_physical_boot_uart_evidence_request";
    const PREVIOUS: &str = "service_s536_r1_physical_boot_uart_evidence_contract_on_cpu1";
    const SERVICE: &str = "service_s537_r1_physical_boot_uart_evidence_request_on_cpu1";
    let source = include_str!("../../kernel/src/g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s537_r1_physical_boot_uart_evidence_request.rs");
    let kernel_registry = include_str!("../../kernel/src/main.rs");
    let simulation_registry = include_str!("../src/lib.rs");
    let exceptions = include_str!("../../kernel/src/arch/aarch64/exceptions.rs");
    assert!(!source.contains("std::process::Command"));
    assert!(!source.contains("/dev/tty"));
    assert!(!source.contains("capture-rpi5"));
    assert!(!source.contains("write-sd"));
    assert!(source.contains("pub const RUNBOOK_EXECUTED_IN_S537: bool = false"));
    assert_eq!(
        kernel_registry.matches(&format!("mod {TARGET};")).count(),
        1
    );
    assert_eq!(
        simulation_registry
            .matches(&format!("pub mod {TARGET};"))
            .count(),
        1
    );
    assert_eq!(exceptions.matches(SERVICE).count(), 1);
    assert!(exceptions.find(PREVIOUS).unwrap() < exceptions.find(SERVICE).unwrap());
    assert!(
        exceptions.find(SERVICE).unwrap()
            < exceptions
                .find("return crate::rpi5_g7d::on_timer_irq")
                .unwrap()
    );
}

  {
    id: "g8l-s537-r1-physical-boot-uart-evidence-request-partial",
    date: "2026-08-30",
    sequence: 537,
    status: "passed",
    umbrella_status: "partial",
    title: "S537 · R1 physical boot/UART evidence request",
    summary:
      "S537, exact S536 physical boot/UART contract receipt'ini doğruladıktan sonra board-rpi5 boot, UART ve Boot-to-UI kanıtının daha sonraki yetkili fiziksel kapıda toplanması için tek immutable production request yayımlar. Request board-rpi5, CPU1, 115200/8N1 ve [R1:S536] BOOT_TO_UI_READY marker'ını taşır; fakat operator authorization, execution permit veya cihaz yetkisi değildir. S537 sırasında güç, SD kart, seri port veya UART capture işlemi yapılmadı: runtime observation=0, physical observation=0, UART/Boot-to-UI/R1=false ve RUNBOOK_EXECUTED_IN_S537=NO. İlk gerçek fiziksel koşu S538 runtime marker bağlantısı ve S539 güvenli image/UART pre-arm tamamlandıktan sonra S540'ta yapılacaktır.",
    evidence: [
      "S537, S536'dan ayrı implementation module, focused test target, CPU1 production service callsite, proof, Operations detail, Timeline policy ve Code kartı sahibidir.",
      "S536 receipt sequence/predecessor=536/535, nonzero S535 anchor, completed readiness blocks=15, prior focused=105 grup/735 test ve contract_published=true olmadan request yayımlanmaz.",
      "S536 supported-profile runtime observations=0, physical observations=0, UART capture=false, Boot-to-UI=false, R1 acceptance=false ve runbook=false alanlarının her biri exact doğrulanır.",
      "Focused negatif matris runbook_executed dahil S536 receipt'teki 13 ayrı sapmayı publication öncesinde S536ReceiptDrift ile kapatır.",
      "Canonical contract'taki UART veya başka alan sapması ContractDrift; wrong CPU, zero request id ve published request replacement ayrı fail-closed hatalardır.",
      "Deterministic nonzero request id S536 anchor attempt id'sine bağlıdır; exact replay aynı immutable receipt'i RequestRetained olarak korur.",
      "Request target board=board-rpi5, target CPU=1, UART=115200/8N1, purpose=collect_board_rpi5_boot_uart_boot_to_ui_evidence ve marker=[R1:S536] BOOT_TO_UI_READY alanlarını exact taşır.",
      "runtime_evidence_requested=true ve physical_evidence_requested=true yalnız talebi tanımlar; is_authority=false, operator_authorization_present=false ve execution_permit_published=false kalır.",
      "S537 focused target 15/15 PASS / 0 fail / 0 ignored / 0 filtered verdi.",
      "S431–S537 kümülatif focused kapsamı 107 ayrı grup / 765/765 PASS'tir; S535 terminal software-readiness kapanışı ve S536 sözleşmesi ayrı tarihsel kapılar olarak korunur.",
      "S238–S537 exact dependency listesi tek no-run derleme sonrasında 301 ayrı test executable'ını iki bağımsız seri turda çalıştırdı; her tur 301 grup / 5305/5305 PASS / 0 fail verdi.",
      "İki dependency turunun timing-normalize özetleri 41385 B ve 4463b3b7808969fbddc2bf311cac47ff2f0379199a906258fe93b1dfbdaf0fcd SHA-256 ile byte-exact eşittir.",
      "Exact yedi tarihsel/frozen G8h assertion dışındaki seri workspace 500 sonuç grubu / 7195 PASS / 0 fail / 7 filtered verdi; raw log 93192 B / c79c08f80c7ad80c1cf963e00b2ce88f7367b706820e3a3ac3dba71ec74721df SHA-256'dır.",
      "Filtresiz workspace frozen-S96 identity assertion'ı bu kapıda değiştirilmedi; global unfiltered GREEN iddia edilmez.",
      "Dört fresh ve yalıtılmış dev AArch64 profil 4/4 exit 0 verdi: board-qemu, board-rpi4, board-rpi5 ve board-rpi5+smp.",
      "Fresh ELF kimlikleri board-qemu 16814128 B / 306939a45a2bb46aef119a9d55882ef54d8227841acf3217575d68704ca71ded, board-rpi4 11925616 B / 31f28d5bcf2efcc60477e6a92fce95e80ac7dccc043d11510d12734bf1c78e38, board-rpi5 17999584 B / 89f8f232e7b2b9959dc2f09832439b79fb4ec2c56c640a816399b58747cb7c4b ve board-rpi5+smp 17986696 B / 6c247afc3e435ebbf428540643bdc3a07a1b6e984209ea894e6e79e611ffccd0 SHA-256'dır.",
      "Profil warning header sayıları 293/391/2844/2844'tür; zero-warning iddiası yoktur. Artifact root /tmp/aselsanos-s537-profiles.cP23YN'dir.",
      "İlk website kabulü 760/760 test, lint PASS, TypeScript exit 0 / boş çıktı ve 668/668 statik sayfa verdi; export 3420 dosya / 291136 KiB'dir.",
      "İlk S1–S537 Code registry 537/537 unique kart, 1575 exact excerpt, missing=none, duplicate=0 ve 733e07e1feff034465c48106b98e0fba6091de70d23f79ddd2c65e93df41af3b SHA-256 verdi.",
      "İlk production deployment 66234a24 kimliğiyle 3335 upload + 84 existing / 3419 asset ve _headers upload tamamladı.",
      "Cache-busted custom-domain readback /code/, /code/s537/, /code/s536/, /operations/, /operations/s537/, /operations/s536/, /timeline/ ve /yol-haritasi/ için 8/8 HTTP 200 ve local out'a byte-exact=true verdi.",
      "İlk readback artifact root /tmp/aselsanos-s537-readback.2xCy0g; canlı Code=537 unique kart, Timeline=376 ve Yol Haritası=376 unique gate-policy kartıdır.",
      "/code/s537/ response public,max-age=0,must-revalidate,no-transform ile nosniff taşır; immutable 66234a24 hostname probe curl exit 28 / HTTP 000 verdiğinden PASS diye sunulmaz.",
      "Coverage 7 source audit unit / 113 direct / 113 source-model / 113 production guarded / 0 unrouted olarak korunur; S537 yeni Scheduler aliası veya exclusion state word üretmez.",
      "S537 production service'i CPU1 timer zincirinde S536 service'inden sonra ve timer dönüşünden önce yer alır; bu çağrı request publication'dır, fiziksel execution değildir.",
      "Implementation 10800 B / 790d15d50853bdf438be7459958b0015ebda1ba2ffe20f66457c558f5dfe7577 SHA-256'dır.",
      "Focused test 11353 B / 1f760e45f52af30067d0be224cb6de0b32b52d93c6b1829c387246bdd01c31b8 SHA-256'dır ve exact 15 test taşır.",
      "S538 required marker'ı gerçek board-rpi5 boot/UI üretim yoluna bağlayacak ve candidate ELF ile donanım/UART kimliğini doğrulayacaktır.",
      "S539 candidate image'i donduracak, yetkili SD write/read-back yapacak ve Pi güçsüzken UART 115200/8N1 capture'ı pre-arm edecektir.",
      "S540 tek power-on ile ilk gerçek RPi5 boot/UART/Boot-to-UI koşusudur: raw UART eksiksiz saklanır; required marker zorunludur; panic, unknown IRQ veya marker sıra sapması doğrudan RED'dir; capture sonrasında kontrollü power-off yapılır.",
      "S541 raw hash, marker sırası, ELF/image identity ve negatif koşulları bağımsız doğrulayacak; S542 fiziksel Boot-to-UI sınırını kapatıp kanıtı arşivleyecektir.",
      "S540 RED olursa S541 otomatik PASS/reconciliation yapamaz; raw red kanıtı korunur, düzeltme ve yeni fiziksel deneme yeni sıra tüketir.",
      "Sonraki fiziksel checkpoint'ler yaklaşık S547 ekran/input/UI, S554 modem/data/voice/audio, S561 app/recovery/update ve S564–S565 entegre laboratuvar demonstrasyonudur; bunlar taahhüt değildir.",
      "S537 source'u process command, /dev/tty, capture helper veya SD write yolu içermez; fiziksel eylem koddan tetiklenmez.",
      "Bu kapıda power-on/off, SD erişimi, Mac kart erişimi, UART open/capture, raw validation, archive veya promotion yapılmadı.",
      "physical/device operations=0 · RUNBOOK_EXECUTED_IN_S537=NO.",
      "S537 dar request-publication kabulü PASS'tir; gerçek cihaz boot'u, UART marker gözlemi, Boot-to-UI veya R1 demonstratör kabulü PASS değildir.",
    ],
    commands: [
      "CARGO_INCREMENTAL=0 cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s537_r1_physical_boot_uart_evidence_request -- --test-threads=1",
      "compile all simulation test targets once with --tests --no-run; execute exact S238-S537 dependency binaries serially twice; normalize timing fields",
      "cargo test --workspace --quiet -- --test-threads=1 with exact seven historical skips",
      "run four fresh isolated dev AArch64 profile builds",
      "npm test; npm run lint; npx tsc --noEmit; npm run build",
      "npm run deploy; cache-busted curl and cmp on eight custom-domain routes",
    ],
    terminalSessions: [
      {
        id: "s537-r1-physical-boot-uart-request-focused",
        title: "S537 focused evidence-request publication",
        commandLines: [
          "CARGO_INCREMENTAL=0 cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s537_r1_physical_boot_uart_evidence_request -- --test-threads=1",
        ],
        outputLines: [
          "test result: ok; 15 passed; 0 failed; 0 ignored; 0 filtered",
          "exact S536 receipt + canonical contract -> one immutable non-authoritative request",
          "runtime/physical observations=0/0; execution permit=false; runbook=false",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "s537-dependency-determinism",
        title: "S537 exact dependency reconciliation",
        commandLines: [
          "compile all tests once with --tests --no-run",
          "run exact S238-S537 test executables serially twice",
        ],
        outputLines: [
          "run1=301 groups / 5305 PASS; run2=301 groups / 5305 PASS; failed=0",
          "normalized summaries=41385 B; SHA-256 4463b3b7808969fbddc2bf311cac47ff2f0379199a906258fe93b1dfbdaf0fcd",
          "normalized byte-exact=true",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "s537-filtered-workspace",
        title: "S537 filtered serial workspace acceptance",
        commandLines: [
          "cargo test --workspace --quiet -- --test-threads=1 with exact seven historical skips",
        ],
        outputLines: [
          "workspace=500 groups / 7195 PASS / 0 fail / 7 historical filtered",
          "raw log=93192 B / c79c08f80c7ad80c1cf963e00b2ce88f7367b706820e3a3ac3dba71ec74721df",
          "unfiltered global GREEN not claimed; frozen-S96 history preserved",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "s537-fresh-aarch64-profiles",
        title: "S537 four-profile compile acceptance",
        commandLines: ["run four fresh isolated dev AArch64 profile builds"],
        outputLines: [
          "board-qemu + board-rpi4 + board-rpi5 + board-rpi5,smp = 4/4 exit 0",
          "warning headers=293/391/2844/2844; zero-warning claim=false",
          "compile acceptance is not an RPi5 runtime or physical observation",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "s537-website-static-acceptance",
        title: "S537 Code, Operations and roadmap static acceptance",
        commandLines: [
          "npm test",
          "npm run lint",
          "npx tsc --noEmit",
          "npm run build",
        ],
        outputLines: [
          "website tests=760/760 PASS; lint=PASS; TypeScript exit=0 with empty output",
          "static pages=668/668; export files=3420; export size=291136 KiB",
          "Code registry=S1-S537 / 537 gates / 1575 excerpts / missing none",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "s537-production-publication-readback",
        title: "S537 production deploy and custom-domain readback",
        commandLines: [
          "npm run deploy",
          "cache-busted curl plus cmp for eight public routes",
        ],
        outputLines: [
          "deployment=66234a24; 3335 uploaded + 84 existing / 3419 assets; _headers uploaded",
          "custom domain=8/8 HTTP 200 and raw byte-exact to local out",
          "/code/s537/ cache-control includes no-transform; x-content-type-options=nosniff",
          "immutable hostname probe exit=28 / HTTP 000; PASS not claimed",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
    ],
    terminalSessionsNote:
      "S537'nin PASS sonucu request publication içindir. S538 marker wiring, S539 safe pre-arm ve S540 gerçek tek-power-on fiziksel koşu ayrı kapılardır.",
    limitations: [
      "S537'de hiçbir fiziksel cihaz işlemi veya supported-profile runtime gözlemi yapılmadı.",
      "Request authority, operator authorization veya execution permit değildir.",
      "BOOT_TO_UI_READY yalnız gelecekte S540 raw UART'ta aranacak marker'dır; görülmüş bir satır değildir.",
      "S540 öncesinde gerçek RPi5 boot/UART/Boot-to-UI PASS iddiası kurulamaz.",
      "S540 RED olursa raw korunur ve yeni deneme yeni sıra tüketir; S541 otomatik PASS olamaz.",
      "R1 S536–S565 planı garantili kapanış değildir.",
      "Filtresiz workspace'in dondurulmuş S96 identity assertion'ı değiştirilmedi; global unfiltered GREEN iddia edilmez.",
      "R1 laboratuvar demonstratörü, saha güvenilirliği veya günlük kullanım kabulü değildir.",
    ],
  },