S538 · R1 Boot/UI marker production runtime wiring

#![allow(unexpected_cfgs)]

//! S538 connects the R1 Boot-to-UI marker to the real board-rpi5 boot tail.
//!
//! CPU1 first validates and arms the exact immutable S537 evidence request.
//! CPU0 may then initialize the retained boot-UI surface and emit the required
//! marker only after the immutable prior boot-stage prerequisite, linked-image
//! identity, board identity and UART10 control state all validate. This wiring
//! is not a physical observation: S540 must still capture the marker from the
//! real device.  The surface is deliberately not physical scanout; display
//! and input acceptance remain later R1 gates.

use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s536_r1_physical_boot_uart_evidence_contract::{
    S536_BOOT_TO_UI_REQUIRED_MARKER, S536_PHYSICAL_OBSERVATIONS,
    S536_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS, S536_TARGET_BOARD, S536_UART_BAUD,
    S536_UART_DATA_BITS, S536_UART_STOP_BITS,
};
use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s537_r1_physical_boot_uart_evidence_request::{
    G8lS537R1PhysicalBootUartEvidenceRequestReceipt, S537_EXPECTED_PREDECESSOR,
    S537_EXECUTION_PERMIT_PUBLISHED, S537_OPERATOR_AUTHORIZATION_PRESENT,
    S537_PHYSICAL_OBSERVATIONS, S537_REQUEST_IS_AUTHORITY, S537_REQUEST_PURPOSE,
    S537_SEQUENCE, S537_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS,
};

pub const S538_SEQUENCE: usize = 538;
pub const S538_EXPECTED_PREDECESSOR: usize = S537_SEQUENCE;
pub const S538_PREFLIGHT_CPU: usize = 1;
pub const S538_MARKER_EMITTER_CPU: usize = 0;
pub const S538_CANDIDATE_TAG: &str = "ASELSAN-R1-S538-BOARD-RPI5";
pub const S538_EXPECTED_BOARD_NAME: &str = "Raspberry Pi 5 (BCM2712)";
pub const S538_EXPECTED_KERNEL_LOAD_ADDRESS: u64 = 0x0008_0000;
pub const S538_EXPECTED_UART_BASE: u64 = 0x10_7D00_1000;
pub const S538_UART_CONTROL_ENABLE_MASK: u32 = 0x301;
pub const S538_MAX_LINKED_IMAGE_BYTES: u64 = 64 * 1024 * 1024;
pub const S538_BOOT_UI_SURFACE_WIDTH: u32 = 64;
pub const S538_BOOT_UI_SURFACE_HEIGHT: u32 = 40;
pub const S538_BOOT_UI_SURFACE_STRIDE: u32 = S538_BOOT_UI_SURFACE_WIDTH * 4;
pub const S538_BOOT_UI_SURFACE_PIXELS: usize =
    S538_BOOT_UI_SURFACE_WIDTH as usize * S538_BOOT_UI_SURFACE_HEIGHT as usize;
pub const S538_BOOT_UI_SURFACE_BINDING_ID: u64 = 0x5335_3800_0000_0001;
pub const S538_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS: usize = 0;
pub const S538_PHYSICAL_OBSERVATIONS: usize = 0;
pub const S538_PHYSICAL_OR_DEVICE_OPERATIONS: usize = 0;
pub const S538_RUNTIME_MARKER_OBSERVED: bool = false;
pub const S538_UART_CAPTURE_OBSERVED: bool = false;
pub const S538_BOOT_TO_UI_PHYSICALLY_OBSERVED: bool = false;
pub const S538_DISPLAY_SCANOUT_OBSERVED: bool = false;
pub const S538_INPUT_OBSERVED: bool = false;
pub const S538_R1_ACCEPTANCE_COMPLETE: bool = false;
pub const RUNBOOK_EXECUTED_IN_S538: bool = false;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS538MarkerRoutePreflightReceipt {
    pub sequence: usize,
    pub predecessor_sequence: usize,
    pub request_id: u64,
    pub contract_anchor_attempt_id: u64,
    pub target_board: &'static str,
    pub boot_to_ui_required_marker: &'static str,
    pub route_armed: bool,
    pub supported_profile_runtime_observations: usize,
    pub physical_observations: usize,
    pub runtime_marker_observed: bool,
    pub runbook_executed: bool,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS538CandidateRuntimeIdentity {
    pub candidate_tag: &'static str,
    pub board_name: &'static str,
    pub kernel_load_address: u64,
    pub linked_kernel_start: u64,
    pub linked_kernel_end: u64,
    pub linked_image_bytes: u64,
    pub uart_base: u64,
    pub uart_control: u32,
    pub uart_baud: u32,
    pub uart_data_bits: u8,
    pub uart_stop_bits: u8,
    pub prior_boot_stage_complete: bool,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS538BootUiSurfaceReceipt {
    pub width: u32,
    pub height: u32,
    pub stride: u32,
    pub pixel_count: usize,
    pub checksum: u64,
    pub retained_scene_layers: usize,
    pub dirty_regions: usize,
    pub ui_service_ready: bool,
    pub physical_scanout_observed: bool,
    pub input_observed: bool,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS538BootUiMarkerRouteReceipt {
    pub preflight: G8lS538MarkerRoutePreflightReceipt,
    pub identity: G8lS538CandidateRuntimeIdentity,
    pub surface: G8lS538BootUiSurfaceReceipt,
    pub marker: &'static str,
    pub production_route_wired: bool,
    pub marker_ready_to_emit: bool,
    pub supported_profile_runtime_observations: usize,
    pub physical_observations: usize,
    pub uart_capture_observed: bool,
    pub boot_to_ui_physically_observed: bool,
    pub r1_acceptance_complete: bool,
    pub runbook_executed: bool,
}

#[derive(Debug)]
pub struct G8lS538BootUiMarkerRuntimeState {
    preflight: Option<G8lS538MarkerRoutePreflightReceipt>,
    route: Option<G8lS538BootUiMarkerRouteReceipt>,
}

impl G8lS538BootUiMarkerRuntimeState {
    pub const fn new() -> Self {
        Self {
            preflight: None,
            route: None,
        }
    }

    pub const fn preflight(&self) -> Option<G8lS538MarkerRoutePreflightReceipt> {
        self.preflight
    }

    pub const fn route(&self) -> Option<G8lS538BootUiMarkerRouteReceipt> {
        self.route
    }
}

impl Default for G8lS538BootUiMarkerRuntimeState {
    fn default() -> Self {
        Self::new()
    }
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS538BootUiMarkerRuntimeOutcome {
    AwaitingS537,
    PreflightArmed(G8lS538MarkerRoutePreflightReceipt),
    PreflightRetained(G8lS538MarkerRoutePreflightReceipt),
    MarkerRouteReady(G8lS538BootUiMarkerRouteReceipt),
    MarkerRouteRetained(G8lS538BootUiMarkerRouteReceipt),
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS538BootUiMarkerRuntimeError {
    WrongCpu,
    S537Service,
    S537ReceiptDrift,
    PreflightStateDrift,
    AwaitingPreflight,
    CandidateIdentityDrift,
    PriorBootStageMissing,
    UiSurfaceDrift,
    CompletedStateDrift,
}

pub const fn s538_boot_pixel(x: u32, y: u32) -> u32 {
    let border = x == 0
        || y == 0
        || x + 1 == S538_BOOT_UI_SURFACE_WIDTH
        || y + 1 == S538_BOOT_UI_SURFACE_HEIGHT;
    if border {
        0x00_E0_E0_E0
    } else if x < S538_BOOT_UI_SURFACE_WIDTH / 3 {
        0x00_10_30_A0
    } else if x < (S538_BOOT_UI_SURFACE_WIDTH * 2) / 3 {
        0x00_10_80_40
    } else {
        0x00_90_20_20
    }
}

pub const fn s538_boot_surface_checksum() -> u64 {
    let mut checksum = 0xCBF2_9CE4_8422_2325u64;
    let mut y = 0;
    while y < S538_BOOT_UI_SURFACE_HEIGHT {
        let mut x = 0;
        while x < S538_BOOT_UI_SURFACE_WIDTH {
            checksum ^= s538_boot_pixel(x, y) as u64;
            checksum = checksum.wrapping_mul(0x0000_0100_0000_01B3);
            x += 1;
        }
        y += 1;
    }
    checksum
}

pub const S538_BOOT_UI_SURFACE_CHECKSUM: u64 = s538_boot_surface_checksum();

pub fn s537_request_is_exact_for_s538(
    receipt: G8lS537R1PhysicalBootUartEvidenceRequestReceipt,
) -> bool {
    let request = receipt.request;
    request.sequence == S537_SEQUENCE
        && request.predecessor_sequence == S537_EXPECTED_PREDECESSOR
        && request.request_id != 0
        && request.contract_anchor_attempt_id != 0
        && request.target_cpu == S538_PREFLIGHT_CPU
        && request.target_board == S536_TARGET_BOARD
        && request.request_purpose == S537_REQUEST_PURPOSE
        && request.uart_baud == S536_UART_BAUD
        && request.uart_data_bits == S536_UART_DATA_BITS
        && request.uart_stop_bits == S536_UART_STOP_BITS
        && request.boot_to_ui_required_marker == S536_BOOT_TO_UI_REQUIRED_MARKER
        && request.runtime_evidence_requested
        && request.physical_evidence_requested
        && request.is_authority == S537_REQUEST_IS_AUTHORITY
        && request.operator_authorization_present == S537_OPERATOR_AUTHORIZATION_PRESENT
        && request.execution_permit_published == S537_EXECUTION_PERMIT_PUBLISHED
        && receipt.request_published
        && receipt.supported_profile_runtime_observations
            == S537_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS
        && receipt.physical_observations == S537_PHYSICAL_OBSERVATIONS
        && !receipt.uart_capture_observed
        && !receipt.boot_to_ui_observed
        && !receipt.r1_acceptance_complete
        && !receipt.runbook_executed
}

fn canonical_preflight(
    request: G8lS537R1PhysicalBootUartEvidenceRequestReceipt,
) -> G8lS538MarkerRoutePreflightReceipt {
    G8lS538MarkerRoutePreflightReceipt {
        sequence: S538_SEQUENCE,
        predecessor_sequence: S538_EXPECTED_PREDECESSOR,
        request_id: request.request.request_id,
        contract_anchor_attempt_id: request.request.contract_anchor_attempt_id,
        target_board: request.request.target_board,
        boot_to_ui_required_marker: request.request.boot_to_ui_required_marker,
        route_armed: true,
        supported_profile_runtime_observations: S538_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS,
        physical_observations: S538_PHYSICAL_OBSERVATIONS,
        runtime_marker_observed: S538_RUNTIME_MARKER_OBSERVED,
        runbook_executed: RUNBOOK_EXECUTED_IN_S538,
    }
}

pub fn service_s538_model_marker_route_preflight(
    state: &mut G8lS538BootUiMarkerRuntimeState,
    caller_cpu: usize,
    s537_receipt: Option<G8lS537R1PhysicalBootUartEvidenceRequestReceipt>,
) -> Result<G8lS538BootUiMarkerRuntimeOutcome, G8lS538BootUiMarkerRuntimeError> {
    if caller_cpu != S538_PREFLIGHT_CPU {
        return Err(G8lS538BootUiMarkerRuntimeError::WrongCpu);
    }
    let Some(s537_receipt) = s537_receipt else {
        return Ok(G8lS538BootUiMarkerRuntimeOutcome::AwaitingS537);
    };
    if !s537_request_is_exact_for_s538(s537_receipt) {
        return Err(G8lS538BootUiMarkerRuntimeError::S537ReceiptDrift);
    }
    let preflight = canonical_preflight(s537_receipt);
    if let Some(published) = state.preflight {
        if published != preflight {
            return Err(G8lS538BootUiMarkerRuntimeError::PreflightStateDrift);
        }
        return Ok(G8lS538BootUiMarkerRuntimeOutcome::PreflightRetained(
            published,
        ));
    }
    state.preflight = Some(preflight);
    Ok(G8lS538BootUiMarkerRuntimeOutcome::PreflightArmed(preflight))
}

pub fn s538_candidate_identity_is_exact(identity: G8lS538CandidateRuntimeIdentity) -> bool {
    identity.candidate_tag == S538_CANDIDATE_TAG
        && identity.board_name == S538_EXPECTED_BOARD_NAME
        && identity.kernel_load_address == S538_EXPECTED_KERNEL_LOAD_ADDRESS
        && identity.linked_kernel_start == S538_EXPECTED_KERNEL_LOAD_ADDRESS
        && identity.linked_kernel_end > identity.linked_kernel_start
        && identity.linked_image_bytes == identity.linked_kernel_end - identity.linked_kernel_start
        && identity.linked_image_bytes <= S538_MAX_LINKED_IMAGE_BYTES
        && identity.uart_base == S538_EXPECTED_UART_BASE
        && identity.uart_control & S538_UART_CONTROL_ENABLE_MASK == S538_UART_CONTROL_ENABLE_MASK
        && identity.uart_baud == S536_UART_BAUD
        && identity.uart_data_bits == S536_UART_DATA_BITS
        && identity.uart_stop_bits == S536_UART_STOP_BITS
}

pub const fn s538_boot_ui_surface_is_exact(surface: G8lS538BootUiSurfaceReceipt) -> bool {
    surface.width == S538_BOOT_UI_SURFACE_WIDTH
        && surface.height == S538_BOOT_UI_SURFACE_HEIGHT
        && surface.stride == S538_BOOT_UI_SURFACE_STRIDE
        && surface.pixel_count == S538_BOOT_UI_SURFACE_PIXELS
        && surface.checksum == S538_BOOT_UI_SURFACE_CHECKSUM
        && surface.retained_scene_layers == 1
        && surface.dirty_regions == 1
        && surface.ui_service_ready
        && !surface.physical_scanout_observed
        && !surface.input_observed
}

fn canonical_route(
    preflight: G8lS538MarkerRoutePreflightReceipt,
    identity: G8lS538CandidateRuntimeIdentity,
    surface: G8lS538BootUiSurfaceReceipt,
) -> G8lS538BootUiMarkerRouteReceipt {
    G8lS538BootUiMarkerRouteReceipt {
        preflight,
        identity,
        surface,
        marker: S536_BOOT_TO_UI_REQUIRED_MARKER,
        production_route_wired: true,
        marker_ready_to_emit: true,
        supported_profile_runtime_observations: S536_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS,
        physical_observations: S536_PHYSICAL_OBSERVATIONS,
        uart_capture_observed: S538_UART_CAPTURE_OBSERVED,
        boot_to_ui_physically_observed: S538_BOOT_TO_UI_PHYSICALLY_OBSERVED,
        r1_acceptance_complete: S538_R1_ACCEPTANCE_COMPLETE,
        runbook_executed: RUNBOOK_EXECUTED_IN_S538,
    }
}

pub fn complete_s538_model_boot_ui_marker_route(
    state: &mut G8lS538BootUiMarkerRuntimeState,
    caller_cpu: usize,
    identity: G8lS538CandidateRuntimeIdentity,
    surface: G8lS538BootUiSurfaceReceipt,
) -> Result<G8lS538BootUiMarkerRuntimeOutcome, G8lS538BootUiMarkerRuntimeError> {
    if caller_cpu != S538_MARKER_EMITTER_CPU {
        return Err(G8lS538BootUiMarkerRuntimeError::WrongCpu);
    }
    let Some(preflight) = state.preflight else {
        return Err(G8lS538BootUiMarkerRuntimeError::AwaitingPreflight);
    };
    if !s538_candidate_identity_is_exact(identity) {
        return Err(G8lS538BootUiMarkerRuntimeError::CandidateIdentityDrift);
    }
    if !identity.prior_boot_stage_complete {
        return Err(G8lS538BootUiMarkerRuntimeError::PriorBootStageMissing);
    }
    if !s538_boot_ui_surface_is_exact(surface) {
        return Err(G8lS538BootUiMarkerRuntimeError::UiSurfaceDrift);
    }
    let route = canonical_route(preflight, identity, surface);
    if let Some(published) = state.route {
        if published != route {
            return Err(G8lS538BootUiMarkerRuntimeError::CompletedStateDrift);
        }
        return Ok(G8lS538BootUiMarkerRuntimeOutcome::MarkerRouteRetained(
            published,
        ));
    }
    state.route = Some(route);
    Ok(G8lS538BootUiMarkerRuntimeOutcome::MarkerRouteReady(route))
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
static S538_PRODUCTION_STATE: spin::Mutex<G8lS538BootUiMarkerRuntimeState> =
    spin::Mutex::new(G8lS538BootUiMarkerRuntimeState::new());

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
static S538_PRODUCTION_MARKER_EMITTED: core::sync::atomic::AtomicBool =
    core::sync::atomic::AtomicBool::new(false);

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
#[repr(C, align(4096))]
struct G8lS538ProductionBootUiSurface([u32; S538_BOOT_UI_SURFACE_PIXELS]);

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
static S538_PRODUCTION_BOOT_UI_SURFACE: spin::Mutex<G8lS538ProductionBootUiSurface> =
    spin::Mutex::new(G8lS538ProductionBootUiSurface(
        [0; S538_BOOT_UI_SURFACE_PIXELS],
    ));

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
static S538_PRODUCTION_BOOT_UI_SCENE: spin::Mutex<Option<crate::ui::Scene>> =
    spin::Mutex::new(None);

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn service_s538_marker_route_preflight_on_cpu1(
) -> Result<G8lS538BootUiMarkerRuntimeOutcome, G8lS538BootUiMarkerRuntimeError> {
    if crate::percpu::try_current_cpu_id() != Some(S538_PREFLIGHT_CPU) {
        return Err(G8lS538BootUiMarkerRuntimeError::WrongCpu);
    }
    let request = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s537_r1_physical_boot_uart_evidence_request::inspect_s537_r1_physical_boot_uart_evidence_request_on_cpu1()
        .map_err(|_| G8lS538BootUiMarkerRuntimeError::S537Service)?;
    service_s538_model_marker_route_preflight(
        &mut S538_PRODUCTION_STATE.lock(),
        S538_PREFLIGHT_CPU,
        request,
    )
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
fn initialize_s538_production_boot_ui_surface(
) -> Result<G8lS538BootUiSurfaceReceipt, G8lS538BootUiMarkerRuntimeError> {
    {
        let mut surface = S538_PRODUCTION_BOOT_UI_SURFACE.lock();
        for y in 0..S538_BOOT_UI_SURFACE_HEIGHT {
            for x in 0..S538_BOOT_UI_SURFACE_WIDTH {
                let index = y as usize * S538_BOOT_UI_SURFACE_WIDTH as usize + x as usize;
                surface.0[index] = s538_boot_pixel(x, y);
            }
        }
        let mut checksum = 0xCBF2_9CE4_8422_2325u64;
        for pixel in surface.0.iter().copied() {
            checksum ^= pixel as u64;
            checksum = checksum.wrapping_mul(0x0000_0100_0000_01B3);
        }
        if checksum != S538_BOOT_UI_SURFACE_CHECKSUM {
            return Err(G8lS538BootUiMarkerRuntimeError::UiSurfaceDrift);
        }
    }

    let mut scene_slot = S538_PRODUCTION_BOOT_UI_SCENE.lock();
    if scene_slot.is_none() {
        let mut scene = crate::ui::Scene::new();
        let layer = scene.add_layer(S538_BOOT_UI_SURFACE_BINDING_ID, 0);
        scene.mark_grant_dirty(
            S538_BOOT_UI_SURFACE_BINDING_ID,
            crate::ui::FramebufferRegion::full(
                S538_BOOT_UI_SURFACE_WIDTH,
                S538_BOOT_UI_SURFACE_HEIGHT,
            ),
        );
        if layer == 0
            || scene.layers_in_z_order().len() != 1
            || scene
                .get_dirty_layers_for_vsync(S538_BOOT_UI_SURFACE_BINDING_ID)
                .len()
                != 1
        {
            return Err(G8lS538BootUiMarkerRuntimeError::UiSurfaceDrift);
        }
        *scene_slot = Some(scene);
    }

    Ok(G8lS538BootUiSurfaceReceipt {
        width: S538_BOOT_UI_SURFACE_WIDTH,
        height: S538_BOOT_UI_SURFACE_HEIGHT,
        stride: S538_BOOT_UI_SURFACE_STRIDE,
        pixel_count: S538_BOOT_UI_SURFACE_PIXELS,
        checksum: S538_BOOT_UI_SURFACE_CHECKSUM,
        retained_scene_layers: 1,
        dirty_regions: 1,
        ui_service_ready: true,
        physical_scanout_observed: S538_DISPLAY_SCANOUT_OBSERVED,
        input_observed: S538_INPUT_OBSERVED,
    })
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
fn collect_s538_candidate_runtime_identity(
    prior_boot_stage_complete: bool,
) -> G8lS538CandidateRuntimeIdentity {
    extern "C" {
        static __kernel_start: u8;
        static __kernel_end: u8;
    }
    let linked_kernel_start = core::ptr::addr_of!(__kernel_start) as u64;
    let linked_kernel_end = core::ptr::addr_of!(__kernel_end) as u64;
    let uart_control =
        unsafe { core::ptr::read_volatile((crate::board::uart_base() + 0x30) as *const u32) };
    G8lS538CandidateRuntimeIdentity {
        candidate_tag: S538_CANDIDATE_TAG,
        board_name: crate::board::board_name(),
        kernel_load_address: crate::board::KERNEL_LOAD_ADDRESS,
        linked_kernel_start,
        linked_kernel_end,
        linked_image_bytes: linked_kernel_end.saturating_sub(linked_kernel_start),
        uart_base: crate::board::uart_base(),
        uart_control,
        uart_baud: S536_UART_BAUD,
        uart_data_bits: S536_UART_DATA_BITS,
        uart_stop_bits: S536_UART_STOP_BITS,
        prior_boot_stage_complete,
    }
}

/// Terminal CPU0 boot-tail connection.  The exact required marker is emitted
/// only after every fail-closed check and the retained UI surface succeed.
/// S538 itself does not execute this path on hardware; S540 must observe it.
#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn enter_s538_boot_ui_marker_runtime_on_cpu0(prior_boot_stage_complete: bool) -> ! {
    if crate::percpu::try_current_cpu_id() != Some(S538_MARKER_EMITTER_CPU) {
        fail_s538_production(G8lS538BootUiMarkerRuntimeError::WrongCpu);
    }
    let identity = collect_s538_candidate_runtime_identity(prior_boot_stage_complete);
    let surface = match initialize_s538_production_boot_ui_surface() {
        Ok(surface) => surface,
        Err(error) => fail_s538_production(error),
    };
    let route = match complete_s538_model_boot_ui_marker_route(
        &mut S538_PRODUCTION_STATE.lock(),
        S538_MARKER_EMITTER_CPU,
        identity,
        surface,
    ) {
        Ok(
            G8lS538BootUiMarkerRuntimeOutcome::MarkerRouteReady(route)
            | G8lS538BootUiMarkerRuntimeOutcome::MarkerRouteRetained(route),
        ) => route,
        Ok(_) => fail_s538_production(G8lS538BootUiMarkerRuntimeError::AwaitingPreflight),
        Err(error) => fail_s538_production(error),
    };
    if S538_PRODUCTION_MARKER_EMITTED
        .compare_exchange(
            false,
            true,
            core::sync::atomic::Ordering::AcqRel,
            core::sync::atomic::Ordering::Acquire,
        )
        .is_err()
    {
        fail_s538_production(G8lS538BootUiMarkerRuntimeError::CompletedStateDrift);
    }
    crate::kprintln!(
        "ASELSAN/S538 ROUTE=PRIOR_BOOT_TO_UI CPU=0 BOARD=BCM2712 CANDIDATE={} IMAGE_START=0x{:x} IMAGE_END=0x{:x} IMAGE_BYTES={} UART=UART10 UART_BASE=0x{:x} UART_MODE=115200/8N1 SURFACE={}x{} CHECKSUM=0x{:016x} SCENE=RETAINED1 SCANOUT=NOT_OBSERVED INPUT=NOT_OBSERVED",
        route.identity.candidate_tag,
        route.identity.linked_kernel_start,
        route.identity.linked_kernel_end,
        route.identity.linked_image_bytes,
        route.identity.uart_base,
        route.surface.width,
        route.surface.height,
        route.surface.checksum,
    );
    crate::kprintln!("{}", route.marker);
    loop {
        unsafe { core::arch::asm!("wfe", options(nomem, nostack)) }
    }
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
fn fail_s538_production(error: G8lS538BootUiMarkerRuntimeError) -> ! {
    crate::kprintln!("ASELSAN/S538ERR {:?}", error);
    loop {
        unsafe { core::arch::asm!("wfe", options(nomem, nostack)) }
    }
}

use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s536_r1_physical_boot_uart_evidence_contract::{
    G8lS536R1PhysicalBootUartEvidenceReceipt, S536_BOOT_TO_UI_REQUIRED_MARKER,
    S536_EXPECTED_PREDECESSOR, S536_PRIOR_FOCUSED_GROUPS, S536_PRIOR_FOCUSED_TESTS,
    S536_SEQUENCE,
};
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s537_r1_physical_boot_uart_evidence_request::{
    canonical_s537_request, G8lS537R1PhysicalBootUartEvidenceRequestReceipt,
    S537_SEQUENCE,
};
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s538_r1_boot_ui_marker_runtime_wiring::{
    complete_s538_model_boot_ui_marker_route, s537_request_is_exact_for_s538,
    s538_boot_pixel, s538_boot_surface_checksum, s538_boot_ui_surface_is_exact,
    s538_candidate_identity_is_exact, service_s538_model_marker_route_preflight,
    G8lS538BootUiMarkerRuntimeError, G8lS538BootUiMarkerRuntimeOutcome,
    G8lS538BootUiMarkerRuntimeState, G8lS538BootUiSurfaceReceipt,
    G8lS538CandidateRuntimeIdentity, RUNBOOK_EXECUTED_IN_S538,
    S538_BOOT_TO_UI_PHYSICALLY_OBSERVED, S538_BOOT_UI_SURFACE_CHECKSUM,
    S538_BOOT_UI_SURFACE_HEIGHT, S538_BOOT_UI_SURFACE_PIXELS,
    S538_BOOT_UI_SURFACE_STRIDE, S538_BOOT_UI_SURFACE_WIDTH, S538_CANDIDATE_TAG,
    S538_DISPLAY_SCANOUT_OBSERVED, S538_EXPECTED_BOARD_NAME,
    S538_EXPECTED_KERNEL_LOAD_ADDRESS, S538_EXPECTED_PREDECESSOR,
    S538_EXPECTED_UART_BASE, S538_INPUT_OBSERVED, S538_MARKER_EMITTER_CPU,
    S538_MAX_LINKED_IMAGE_BYTES, S538_PHYSICAL_OBSERVATIONS,
    S538_PHYSICAL_OR_DEVICE_OPERATIONS, S538_PREFLIGHT_CPU,
    S538_R1_ACCEPTANCE_COMPLETE, S538_RUNTIME_MARKER_OBSERVED, S538_SEQUENCE,
    S538_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS, S538_UART_CAPTURE_OBSERVED,
    S538_UART_CONTROL_ENABLE_MASK,
};
use sha2::{Digest, Sha256};

const SOURCE: &str = include_str!(
    "../../kernel/src/g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s538_r1_boot_ui_marker_runtime_wiring.rs"
);
const S541_SOURCE: &str = include_str!(
    "../../kernel/src/g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s541_r1_cross_cpu_marker_readiness_handoff.rs"
);
const MAIN: &str = include_str!("../../kernel/src/main.rs");
const EXCEPTIONS: &str = include_str!("../../kernel/src/arch/aarch64/exceptions.rs");
const G8H: &str = include_str!("../../kernel/src/rpi5_g8h.rs");
const SIMULATION_LIB: &str = include_str!("../src/lib.rs");
const LAYOUT_SCRIPT: &str = include_str!("../../scripts/verify-rpi5-s538-layout.sh");

fn s536_receipt() -> G8lS536R1PhysicalBootUartEvidenceReceipt {
    G8lS536R1PhysicalBootUartEvidenceReceipt {
        sequence: S536_SEQUENCE,
        predecessor_sequence: S536_EXPECTED_PREDECESSOR,
        anchor_attempt_id: 0x5360_0000_0000_0001,
        completed_readiness_blocks: 15,
        prior_focused_groups: S536_PRIOR_FOCUSED_GROUPS,
        prior_focused_tests: S536_PRIOR_FOCUSED_TESTS,
        contract_published: true,
        supported_profile_runtime_observations: 0,
        physical_observations: 0,
        uart_capture_observed: false,
        boot_to_ui_observed: false,
        r1_acceptance_complete: false,
        runbook_executed: false,
    }
}

fn s537_receipt(request_id: u64) -> G8lS537R1PhysicalBootUartEvidenceRequestReceipt {
    G8lS537R1PhysicalBootUartEvidenceRequestReceipt {
        request: canonical_s537_request(s536_receipt(), request_id),
        request_published: true,
        supported_profile_runtime_observations: 0,
        physical_observations: 0,
        uart_capture_observed: false,
        boot_to_ui_observed: false,
        r1_acceptance_complete: false,
        runbook_executed: false,
    }
}

fn identity(g8h_complete: bool) -> G8lS538CandidateRuntimeIdentity {
    let linked_kernel_end = S538_EXPECTED_KERNEL_LOAD_ADDRESS + 0x20_0000;
    G8lS538CandidateRuntimeIdentity {
        candidate_tag: S538_CANDIDATE_TAG,
        board_name: S538_EXPECTED_BOARD_NAME,
        kernel_load_address: S538_EXPECTED_KERNEL_LOAD_ADDRESS,
        linked_kernel_start: S538_EXPECTED_KERNEL_LOAD_ADDRESS,
        linked_kernel_end,
        linked_image_bytes: linked_kernel_end - S538_EXPECTED_KERNEL_LOAD_ADDRESS,
        uart_base: S538_EXPECTED_UART_BASE,
        uart_control: S538_UART_CONTROL_ENABLE_MASK,
        uart_baud: 115_200,
        uart_data_bits: 8,
        uart_stop_bits: 1,
        prior_boot_stage_complete: g8h_complete,
    }
}

fn surface() -> G8lS538BootUiSurfaceReceipt {
    G8lS538BootUiSurfaceReceipt {
        width: S538_BOOT_UI_SURFACE_WIDTH,
        height: S538_BOOT_UI_SURFACE_HEIGHT,
        stride: S538_BOOT_UI_SURFACE_STRIDE,
        pixel_count: S538_BOOT_UI_SURFACE_PIXELS,
        checksum: S538_BOOT_UI_SURFACE_CHECKSUM,
        retained_scene_layers: 1,
        dirty_regions: 1,
        ui_service_ready: true,
        physical_scanout_observed: false,
        input_observed: false,
    }
}

fn armed_state() -> G8lS538BootUiMarkerRuntimeState {
    let mut state = G8lS538BootUiMarkerRuntimeState::new();
    assert!(matches!(
        service_s538_model_marker_route_preflight(
            &mut state,
            S538_PREFLIGHT_CPU,
            Some(s537_receipt(0x5370_0000_0000_0001)),
        ),
        Ok(G8lS538BootUiMarkerRuntimeOutcome::PreflightArmed(..))
    ));
    state
}

#[test]
fn s538_sequence_and_claim_boundary_are_exact() {
    assert_eq!(S538_SEQUENCE, 538);
    assert_eq!(S538_EXPECTED_PREDECESSOR, S537_SEQUENCE);
    assert_eq!(S538_PREFLIGHT_CPU, 1);
    assert_eq!(S538_MARKER_EMITTER_CPU, 0);
    assert_eq!(S538_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS, 0);
    assert_eq!(S538_PHYSICAL_OBSERVATIONS, 0);
    assert_eq!(S538_PHYSICAL_OR_DEVICE_OPERATIONS, 0);
    assert!(!S538_RUNTIME_MARKER_OBSERVED);
    assert!(!S538_UART_CAPTURE_OBSERVED);
    assert!(!S538_BOOT_TO_UI_PHYSICALLY_OBSERVED);
    assert!(!S538_DISPLAY_SCANOUT_OBSERVED);
    assert!(!S538_INPUT_OBSERVED);
    assert!(!S538_R1_ACCEPTANCE_COMPLETE);
    assert!(!RUNBOOK_EXECUTED_IN_S538);
}

#[test]
fn boot_surface_contract_has_a_deterministic_nonzero_checksum() {
    assert_eq!(S538_BOOT_UI_SURFACE_WIDTH, 64);
    assert_eq!(S538_BOOT_UI_SURFACE_HEIGHT, 40);
    assert_eq!(S538_BOOT_UI_SURFACE_STRIDE, 256);
    assert_eq!(S538_BOOT_UI_SURFACE_PIXELS, 2560);
    assert_eq!(s538_boot_surface_checksum(), S538_BOOT_UI_SURFACE_CHECKSUM);
    assert_ne!(S538_BOOT_UI_SURFACE_CHECKSUM, 0);
    assert_ne!(s538_boot_pixel(0, 0), s538_boot_pixel(1, 1));
}

#[test]
fn preflight_waits_without_the_s537_request_without_mutation() {
    let mut state = G8lS538BootUiMarkerRuntimeState::new();
    assert_eq!(
        service_s538_model_marker_route_preflight(&mut state, S538_PREFLIGHT_CPU, None),
        Ok(G8lS538BootUiMarkerRuntimeOutcome::AwaitingS537)
    );
    assert_eq!(state.preflight(), None);
    assert_eq!(state.route(), None);
}

#[test]
fn preflight_rejects_the_wrong_cpu_before_mutation() {
    let mut state = G8lS538BootUiMarkerRuntimeState::new();
    assert_eq!(
        service_s538_model_marker_route_preflight(
            &mut state,
            S538_PREFLIGHT_CPU + 1,
            Some(s537_receipt(7)),
        ),
        Err(G8lS538BootUiMarkerRuntimeError::WrongCpu)
    );
    assert_eq!(state.preflight(), None);
}

#[test]
fn every_s537_request_field_is_bound_fail_closed() {
    let exact = s537_receipt(0x5370_1234);
    assert!(s537_request_is_exact_for_s538(exact));
    let mut drifts = Vec::new();
    let mut drift = exact;
    drift.request.sequence += 1;
    drifts.push(drift);
    let mut drift = exact;
    drift.request.predecessor_sequence += 1;
    drifts.push(drift);
    let mut drift = exact;
    drift.request.request_id = 0;
    drifts.push(drift);
    let mut drift = exact;
    drift.request.contract_anchor_attempt_id = 0;
    drifts.push(drift);
    let mut drift = exact;
    drift.request.target_cpu = 0;
    drifts.push(drift);
    let mut drift = exact;
    drift.request.target_board = "board-qemu";
    drifts.push(drift);
    let mut drift = exact;
    drift.request.request_purpose = "different";
    drifts.push(drift);
    let mut drift = exact;
    drift.request.uart_baud = 9_600;
    drifts.push(drift);
    let mut drift = exact;
    drift.request.uart_data_bits = 7;
    drifts.push(drift);
    let mut drift = exact;
    drift.request.uart_stop_bits = 2;
    drifts.push(drift);
    let mut drift = exact;
    drift.request.boot_to_ui_required_marker = "wrong";
    drifts.push(drift);
    let mut drift = exact;
    drift.request.runtime_evidence_requested = false;
    drifts.push(drift);
    let mut drift = exact;
    drift.request.physical_evidence_requested = false;
    drifts.push(drift);
    let mut drift = exact;
    drift.request.is_authority = true;
    drifts.push(drift);
    let mut drift = exact;
    drift.request.operator_authorization_present = true;
    drifts.push(drift);
    let mut drift = exact;
    drift.request.execution_permit_published = true;
    drifts.push(drift);
    let mut drift = exact;
    drift.request_published = false;
    drifts.push(drift);
    let mut drift = exact;
    drift.supported_profile_runtime_observations = 1;
    drifts.push(drift);
    let mut drift = exact;
    drift.physical_observations = 1;
    drifts.push(drift);
    let mut drift = exact;
    drift.uart_capture_observed = true;
    drifts.push(drift);
    let mut drift = exact;
    drift.boot_to_ui_observed = true;
    drifts.push(drift);
    let mut drift = exact;
    drift.r1_acceptance_complete = true;
    drifts.push(drift);
    let mut drift = exact;
    drift.runbook_executed = true;
    drifts.push(drift);

    for drift in drifts {
        let mut state = G8lS538BootUiMarkerRuntimeState::new();
        assert_eq!(
            service_s538_model_marker_route_preflight(&mut state, S538_PREFLIGHT_CPU, Some(drift),),
            Err(G8lS538BootUiMarkerRuntimeError::S537ReceiptDrift)
        );
        assert_eq!(state.preflight(), None);
    }
}

#[test]
fn exact_preflight_arms_the_required_marker_without_observation() {
    let mut state = G8lS538BootUiMarkerRuntimeState::new();
    let outcome = service_s538_model_marker_route_preflight(
        &mut state,
        S538_PREFLIGHT_CPU,
        Some(s537_receipt(0x5370_5678)),
    )
    .unwrap();
    let G8lS538BootUiMarkerRuntimeOutcome::PreflightArmed(receipt) = outcome else {
        panic!("expected armed preflight");
    };
    assert_eq!(receipt.sequence, S538_SEQUENCE);
    assert_eq!(receipt.predecessor_sequence, S537_SEQUENCE);
    assert_eq!(
        receipt.boot_to_ui_required_marker,
        S536_BOOT_TO_UI_REQUIRED_MARKER
    );
    assert!(receipt.route_armed);
    assert_eq!(receipt.supported_profile_runtime_observations, 0);
    assert_eq!(receipt.physical_observations, 0);
    assert!(!receipt.runtime_marker_observed);
    assert!(!receipt.runbook_executed);
}

#[test]
fn exact_preflight_replay_retains_the_same_receipt() {
    let request = s537_receipt(0x5370_9abc);
    let mut state = G8lS538BootUiMarkerRuntimeState::new();
    let first =
        service_s538_model_marker_route_preflight(&mut state, S538_PREFLIGHT_CPU, Some(request))
            .unwrap();
    let replay =
        service_s538_model_marker_route_preflight(&mut state, S538_PREFLIGHT_CPU, Some(request))
            .unwrap();
    let G8lS538BootUiMarkerRuntimeOutcome::PreflightArmed(first) = first else {
        panic!("first arm missing");
    };
    assert_eq!(
        replay,
        G8lS538BootUiMarkerRuntimeOutcome::PreflightRetained(first)
    );
}

#[test]
fn a_different_request_cannot_replace_an_armed_preflight() {
    let mut state = armed_state();
    assert_eq!(
        service_s538_model_marker_route_preflight(
            &mut state,
            S538_PREFLIGHT_CPU,
            Some(s537_receipt(0x5370_0000_0000_0002)),
        ),
        Err(G8lS538BootUiMarkerRuntimeError::PreflightStateDrift)
    );
    assert_eq!(state.route(), None);
}

#[test]
fn completion_requires_the_armed_cpu1_preflight() {
    let mut state = G8lS538BootUiMarkerRuntimeState::new();
    assert_eq!(
        complete_s538_model_boot_ui_marker_route(
            &mut state,
            S538_MARKER_EMITTER_CPU,
            identity(true),
            surface(),
        ),
        Err(G8lS538BootUiMarkerRuntimeError::AwaitingPreflight)
    );
}

#[test]
fn completion_rejects_a_non_cpu0_emitter() {
    let mut state = armed_state();
    assert_eq!(
        complete_s538_model_boot_ui_marker_route(
            &mut state,
            S538_PREFLIGHT_CPU,
            identity(true),
            surface(),
        ),
        Err(G8lS538BootUiMarkerRuntimeError::WrongCpu)
    );
    assert_eq!(state.route(), None);
}

#[test]
fn candidate_image_board_and_uart_identity_drift_fail_closed() {
    let exact = identity(true);
    assert!(s538_candidate_identity_is_exact(exact));
    assert_eq!(S538_MAX_LINKED_IMAGE_BYTES, 64 * 1024 * 1024);
    let mut drifts = Vec::new();
    let mut drift = exact;
    drift.candidate_tag = "wrong";
    drifts.push(drift);
    let mut drift = exact;
    drift.board_name = "Raspberry Pi 4 (BCM2711)";
    drifts.push(drift);
    let mut drift = exact;
    drift.kernel_load_address += 0x1000;
    drifts.push(drift);
    let mut drift = exact;
    drift.linked_kernel_start += 0x1000;
    drifts.push(drift);
    let mut drift = exact;
    drift.linked_kernel_end = drift.linked_kernel_start;
    drift.linked_image_bytes = 0;
    drifts.push(drift);
    let mut drift = exact;
    drift.linked_image_bytes += 1;
    drifts.push(drift);
    let mut drift = exact;
    drift.linked_kernel_end = drift.linked_kernel_start + S538_MAX_LINKED_IMAGE_BYTES + 1;
    drift.linked_image_bytes = S538_MAX_LINKED_IMAGE_BYTES + 1;
    drifts.push(drift);
    let mut drift = exact;
    drift.uart_base += 0x1000;
    drifts.push(drift);
    let mut drift = exact;
    drift.uart_control = 0;
    drifts.push(drift);
    let mut drift = exact;
    drift.uart_baud = 9_600;
    drifts.push(drift);
    let mut drift = exact;
    drift.uart_data_bits = 7;
    drifts.push(drift);
    let mut drift = exact;
    drift.uart_stop_bits = 2;
    drifts.push(drift);

    for drift in drifts {
        let mut state = armed_state();
        assert_eq!(
            complete_s538_model_boot_ui_marker_route(
                &mut state,
                S538_MARKER_EMITTER_CPU,
                drift,
                surface(),
            ),
            Err(G8lS538BootUiMarkerRuntimeError::CandidateIdentityDrift)
        );
        assert_eq!(state.route(), None);
    }
}

#[test]
fn immutable_g8h_completion_is_mandatory() {
    let mut state = armed_state();
    assert!(s538_candidate_identity_is_exact(identity(false)));
    assert_eq!(
        complete_s538_model_boot_ui_marker_route(
            &mut state,
            S538_MARKER_EMITTER_CPU,
            identity(false),
            surface(),
        ),
        Err(G8lS538BootUiMarkerRuntimeError::PriorBootStageMissing)
    );
}

#[test]
fn retained_ui_surface_fields_are_all_fail_closed() {
    let exact = surface();
    assert!(s538_boot_ui_surface_is_exact(exact));
    let mut drifts = Vec::new();
    let mut drift = exact;
    drift.width += 1;
    drifts.push(drift);
    let mut drift = exact;
    drift.height += 1;
    drifts.push(drift);
    let mut drift = exact;
    drift.stride += 4;
    drifts.push(drift);
    let mut drift = exact;
    drift.pixel_count += 1;
    drifts.push(drift);
    let mut drift = exact;
    drift.checksum ^= 1;
    drifts.push(drift);
    let mut drift = exact;
    drift.retained_scene_layers = 0;
    drifts.push(drift);
    let mut drift = exact;
    drift.dirty_regions = 0;
    drifts.push(drift);
    let mut drift = exact;
    drift.ui_service_ready = false;
    drifts.push(drift);
    let mut drift = exact;
    drift.physical_scanout_observed = true;
    drifts.push(drift);
    let mut drift = exact;
    drift.input_observed = true;
    drifts.push(drift);

    for drift in drifts {
        let mut state = armed_state();
        assert_eq!(
            complete_s538_model_boot_ui_marker_route(
                &mut state,
                S538_MARKER_EMITTER_CPU,
                identity(true),
                drift,
            ),
            Err(G8lS538BootUiMarkerRuntimeError::UiSurfaceDrift)
        );
        assert_eq!(state.route(), None);
    }
}

#[test]
fn exact_completion_wires_but_does_not_claim_a_physical_observation() {
    let mut state = armed_state();
    let outcome = complete_s538_model_boot_ui_marker_route(
        &mut state,
        S538_MARKER_EMITTER_CPU,
        identity(true),
        surface(),
    )
    .unwrap();
    let G8lS538BootUiMarkerRuntimeOutcome::MarkerRouteReady(route) = outcome else {
        panic!("route not ready");
    };
    assert_eq!(route.marker, S536_BOOT_TO_UI_REQUIRED_MARKER);
    assert!(route.production_route_wired);
    assert!(route.marker_ready_to_emit);
    assert_eq!(route.supported_profile_runtime_observations, 0);
    assert_eq!(route.physical_observations, 0);
    assert!(!route.uart_capture_observed);
    assert!(!route.boot_to_ui_physically_observed);
    assert!(!route.r1_acceptance_complete);
    assert!(!route.runbook_executed);
    assert_eq!(
        complete_s538_model_boot_ui_marker_route(
            &mut state,
            S538_MARKER_EMITTER_CPU,
            identity(true),
            surface(),
        ),
        Ok(G8lS538BootUiMarkerRuntimeOutcome::MarkerRouteRetained(
            route
        ))
    );
}

#[test]
fn production_source_connects_cpu1_request_to_the_post_boot8h_cpu0_ui_tail() {
    let module =
        "g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s538_r1_boot_ui_marker_runtime_wiring";
    assert!(MAIN.contains(&format!("mod {module};")));
    assert!(SIMULATION_LIB.contains(&format!(
        "../../kernel/src/{module}.rs\"]\npub mod {module};"
    )));
    let s537 = EXCEPTIONS
        .find("service_s537_r1_physical_boot_uart_evidence_request_on_cpu1")
        .unwrap();
    let s541 = EXCEPTIONS
        .find("service_s541_readiness_handoff_on_cpu1")
        .unwrap();
    assert!(s537 < s541);
    assert!(!EXCEPTIONS.contains("service_s538_marker_route_preflight_on_cpu1()"));
    assert!(S541_SOURCE.contains("service_s538_marker_route_preflight_on_cpu1()"));
    let boot_emitted = G8H.find("BOOT_EMITTED.store(true").unwrap();
    let primary_validated = G8H.find("PRIMARY_VALIDATED.store(true").unwrap();
    let runtime_entry = G8H
        .find("enter_s541_readiness_handoff_then_s538_boot_ui_on_cpu0")
        .unwrap();
    assert!(boot_emitted < primary_validated && primary_validated < runtime_entry);
    assert!(SOURCE.contains("crate::ui::Scene::new()"));
    assert!(SOURCE.contains("S538_PRODUCTION_MARKER_EMITTED"));
    assert!(SOURCE.contains("crate::kprintln!(\"{}\", route.marker)"));
    assert!(SOURCE.contains("ROUTE=PRIOR_BOOT_TO_UI"));
    assert!(SOURCE.contains("SCANOUT=NOT_OBSERVED INPUT=NOT_OBSERVED"));
    for legacy_scope_token in ["rpi5_g8h", "BOOT8H", "LOCAL_STATIC_PREEMPT"] {
        assert!(!SOURCE.contains(legacy_scope_token));
    }

    let s541_tail = "    crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s541_r1_cross_cpu_marker_readiness_handoff::enter_s541_readiness_handoff_then_s538_boot_ui_on_cpu0(rpi5_g8h_prerequisite_complete())\n";
    let s538_tail = "    crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s538_r1_boot_ui_marker_runtime_wiring::enter_s538_boot_ui_marker_runtime_on_cpu0(rpi5_g8h_prerequisite_complete())\n";
    let s537_tail = "    loop {\n        wait_for_event();\n    }\n";
    assert_eq!(G8H.matches(s541_tail).count(), 1);
    assert_eq!(G8H.matches(s538_tail).count(), 0);
    // Later remediation blocks are explicitly delimited and stripped. S569
    // superseded (rather than stacked on) the S544 hook, so removing its
    // boot-context block and visible-error line reconstructs pre-S544 G8h.
    fn strip_delimited(source: &str, begin: &str, end: &str, trailing_newlines: usize) -> String {
        let start = source.find(begin).unwrap();
        let mut stop = start + source[start..].find(end).unwrap() + end.len();
        for _ in 0..trailing_newlines {
            assert_eq!(source.as_bytes()[stop], b'\n');
            stop += 1;
        }
        format!("{}{}", &source[..start], &source[stop..])
    }
    let g8h_before_s569 = strip_delimited(
        G8H,
        "    // S569 frozen-manifest readiness decoupling begin.\n",
        "    // S569 frozen-manifest readiness decoupling end.\n",
        1,
    );
    let g8h_before_s569 = strip_delimited(
        &g8h_before_s569,
        "    // S569 visible primary failure begin.\n",
        "    // S569 visible primary failure end.\n",
        0,
    );
    let historical_s538 = g8h_before_s569.replacen(s541_tail, s538_tail, 1);
    let predecessor = historical_s538.replacen(s538_tail, s537_tail, 1);
    assert_eq!(predecessor.len(), 86_590);
    assert_eq!(
        format!("{:x}", Sha256::digest(predecessor.as_bytes())),
        "e82389b90def3f1649678984db07b1ba76954564e2141e2375a4d936e5db80de"
    );
    assert!(!SOURCE.contains("std::process::Command"));
    assert!(!SOURCE.contains("/dev/tty"));
    assert!(!SOURCE.contains("diskutil"));
    for required in [
        "__kernel_start",
        "__kernel_end",
        "S538_PRODUCTION_BOOT_UI_SURFACE",
        "service_s536_r1_physical_boot_uart_evidence_contract_on_cpu1",
        "service_s537_r1_physical_boot_uart_evidence_request_on_cpu1",
        "service_s538_marker_route_preflight_on_cpu1",
        "enter_s538_boot_ui_marker_runtime_on_cpu0",
        "[R1:S536] BOOT_TO_UI_READY",
        "RUNBOOK_EXECUTED_IN_S538=NO",
    ] {
        assert!(LAYOUT_SCRIPT.contains(required), "layout token: {required}");
    }
    for forbidden_device_surface in ["/dev/", "diskutil", "dd if=", "screen "] {
        assert!(!LAYOUT_SCRIPT.contains(forbidden_device_surface));
    }
}

  {
    id: "g8l-s538-r1-boot-ui-marker-runtime-wiring-partial",
    date: "2026-08-30",
    sequence: 538,
    status: "passed",
    umbrella_status: "partial",
    title: "S538 · R1 Boot/UI marker production runtime wiring",
    summary:
      "S538, S536'nın exact [R1:S536] BOOT_TO_UI_READY marker'ını gerçek board-rpi5 production boot kuyruğuna bağladı. CPU1 yalnız exact S537 non-authoritative request receipt'ini doğrulayıp preflight'ı arm eder; CPU0 ise immutable önceki G8h boot aşaması, candidate ELF/linker kimliği, BCM2712 board kimliği, UART10 115200/8N1 durumu ve retained 64x40 UI surface/Scene sözleşmesi geçtikten sonra route satırını ve marker'ı exact-once üretmeye hazır hale gelir. Bu kaynak ve ELF wiring kabulüdür: S538'de cihaz çalıştırılmadı, UART'ta marker görülmedi, physical scanout/input gözlenmedi ve R1 kabulü tamamlanmadı. İlk fiziksel koşu hâlâ S539 güvenli candidate/SD/UART pre-arm sonrasındaki S540 tek-power-on kapısıdır.",
    evidence: [
      "S538 ayrı implementation module, focused test binary, production layout verifier, CPU1 service callsite, CPU0 boot-tail callsite, proof, Operations detail, Timeline/Yol Haritası policy ve Code kartı sahibidir; S537 kaydıyla birleştirilmez.",
      "CPU1 preflight exact target CPU=1 ister. S537 request sequence/predecessor, nonzero request/contract anchor, board-rpi5, UART 115200/8N1, required marker, runtime+physical evidence request bitleri, request_published ve zero-observation alanları ayrı ayrı fail-closed doğrulanır.",
      "S537 request is_authority=false, operator_authorization_present=false ve execution_permit_published=false olarak kalır; S538 bu talebi aygıt yetkisine yükseltmez.",
      "Missing S537 request AwaitingS537 ile mutation olmadan bekler; wrong CPU, receipt drift, replacement veya inconsistent replay ayrı fail-closed error'dur. Exact replay aynı immutable preflight receipt'ini tutar.",
      "CPU0 completion yalnız preflight arm olduktan sonra kabul edilir. Emitter CPU=0 değilse, candidate identity saparsa, önceki boot aşaması eksikse, retained surface değişirse veya completed state drift ederse marker basılmadan kapanır.",
      "Candidate identity ASELSAN-R1-S538-BOARD-RPI5 tag'ini, Raspberry Pi 5 (BCM2712) board adını, 0x80000 kernel load/link start'ını, pozitif ve en çok 64 MiB linked span'i, UART10 base 0x107d001000 adresini, CR 0x301 enable mask'ini ve 115200/8N1 sözleşmesini exact bağlar.",
      "Production identity linker __kernel_start/__kernel_end sembollerinden ve gerçek board::board_name/KERNEL_LOAD_ADDRESS/uart_base ile UART CR volatile read-back'inden üretilir; test fixture'ı veya hard-coded success bool'u production completion'a geçirilmez.",
      "Retained UI boundary 64x40 BGRA, stride=256, pixel_count=2560, deterministic nonzero FNV-style checksum, 4096-byte alignment, exact 0x4000 ELF symbol size, bir Scene layer ve bir dirty region gerektirir.",
      "Surface ui_service_ready=true üretir fakat physical_scanout_observed=false ve input_observed=false kalır. Bu yüzden S547 civarı gerçek ekran/input/UI fiziksel checkpoint'i erken PASS sayılmaz.",
      "Marker emitter compare_exchange ile exact-once'dır. Önce ASELSAN/S538 ROUTE=PRIOR_BOOT_TO_UI kimlik satırı, sonra exact [R1:S536] BOOT_TO_UI_READY satırı basılır; tekrar emission CompletedStateDrift ile kapanır.",
      "CPU1 timer kaynak sırası S536 service < S537 service < S538 preflight'tır. CPU0 kaynak ve machine-code sırası immutable G8h completion predicate < S538 terminal route'tur.",
      "Focused S538 target 15/15 PASS / 0 failed / 0 ignored / 0 filtered verdi; sequence/claim, request'in her alanı, wrong CPU, missing/replay/replacement, candidate/prior-stage/surface drift, exact source registrations ve no-device/no-observation sınırı kapsandı.",
      "S431–S538 kümülatif focused kapsam 108 ayrı grup / 780/780 PASS'tir; S535 software-readiness, S536 contract ve S537 request ayrı tarihsel kapılardır.",
      "Selected UI/boot regression 15 grup / 127/127 PASS verdi: S508–S514, S535–S538, G8h source/runtime/object compile ve framebuffer root lifetime. Raw log 14702 B / 7e9552cb449124989fe95770f90e17af7cf8c6df61d137fd5b356faf7a771513 SHA-256'dır.",
      "S238–S538 exact dependency listesi 302 executable'ı iki bağımsız seri turda çalıştırdı; her tur 302 grup / 5320/5320 PASS / 0 fail verdi. Timing-normalized özetler 41517 B / 9db4994f7defb461fb8d0a451e48a4afc43713e762afdc986fd8c11c18a6414c ile byte-exact'tir.",
      "Seri workspace exact sekiz historical/frozen assertion dışında 501 sonuç grubu / 7209 PASS / 0 fail / 8 filtered verdi; raw log 93321 B / 6da00ca0db532814c3599a2d1d5d18c7496fb6da0db578ad295e509798627085 SHA-256'dır.",
      "Yedi filter mevcut G8h history setidir. Sekizinci, current rpi5_g8h.rs kimliğinin asla değişmemesini isteyen eski S97 assertion'ıdır; S538 gerçek tail'i bilinçli değiştirirken focused test exact S537 predecessor'ı 86590 B / e82389b90def3f1649678984db07b1ba76954564e2141e2375a4d936e5db80de olarak yeniden kurar. Global unfiltered GREEN iddia edilmez.",
      "Dört fresh izole dev AArch64 profil 4/4 exit 0 verdi. ELF kimlikleri board-qemu 16814032 B / e71ae8614485c4f64029a889779b4d2eeebdf2b587de1ad4810a93ed1fb16b11, board-rpi4 11925512 B / f1a566b74fbf4d548a013352e494d7b588875d7012f51989366a4d3dd2520fd1, board-rpi5 18255744 B / ae8aaf34f930d908906c7f5ca0fef0ba0c398151caa693a8c3f8aa33537d7667 ve board-rpi5+smp 18291488 B / 2100d937012805816cab0e45ff170a09188044391d368c2e8e91248c2707650d'dir.",
      "Profil log/warning kimlikleri qemu 111895 B / 90d7e1c5b6bed40f23b41dce7c4924d69c44fb546598a6ce3cbef66b6fbd98e2 / 293; rpi4 150623 B / 854737cb212458285261efdcffd67f0378e52c4827840da13cd7d5c6b5b4d832 / 391; rpi5 1127132 B / 6e9685d3af0d755afe3888bbe31aa79133e04b00c8cd9c995fdc4d5125c64a9f / 2844; rpi5+smp 1127075 B / 7ad79d7f83dc8df1b6155cb47bc61ac5aff9d02ce39d73f4d1968675dde21600 / 2844'tür. Zero-warning iddiası yoktur.",
      "S538 production layout verifier RPi5 ELF üzerinde PASS verdi: linked span=18309120, marker refs=2, retained surface symbol=0x4000, CPU1 order=S536_S537_S538 ve CPU0 order=PRIOR_BOOT_S538.",
      "Workspace root'tan kernel/.cargo/config.toml yüklenmeden yapılan ilk profil çağrısı invalid invocation olarak reddedildi ve kabul sayılmadı; kaydedilen dört profil kernel/ üretim bağlamında explicit aarch64-unknown-none ile koştu.",
      "make verify-qemu 116367 B / 1ace4a0b65cee3464f2f7ddfb9aad0f7d04bcd5bcafedae281b3ce0158e9e82c ile W^X 31/31, S130–S154/S271, RuntimePmm, EL0 x4096, IPC reply 20/20 ve scheduler SEC5 PASS verdi. Bu board-qemu ortak regresyonu S538 RPi5 runtime gözlemi değildir.",
      "Implementation 21951 B / 3e4515738daef2784cf60ee7dc9abb5daebdd0a115ed7a245592c734cfc3483b; S541 sonrası historical focused identity 21232 B / cdd7d92a…a5e6 olarak korunur. S569 supersession delimiter reconciliation'ı eklenen güncel focused test 22298 B / 4af191c818ac5986728611fd2579e34c59a5408cbf7c9e3bd3e1d73d57c674c7 ve yine exact 15 testtir; ürün davranışı değişmez. Layout verifier 5161 B / 28f3f85f07605b9823e452aabeeb698537eb00995937f0f0642628333c11f227 SHA-256'dır.",
      "Touched Rust sources ve focused test targeted rustfmt --check altında PASS'tir; tarihsel dosyalar global mechanical rewrite'a uğratılmadı.",
      "İlk publication snapshot Code registry'si S1–S538 aralığında 538/538 unique kart, 1578 exact source excerpt, pre-S328 327/327, missing=none ve duplicate=0 verdi. Mapping 69 writer-guard + 367 focused-test + 94 command-contract + 8 operation-record; registry payload 11776608 B / 96d53714e302818f98f9798ff68035006083ef9f82feaaeb106fc26a691a1958 dosya SHA-256 ve ed21c176e7f57a2d456cb89cef5a15fc634d9d9474681774c7c03c080933c63e content SHA-256'dır. Sonraki evidence-sync hash'i self-reference oluşturmamak için bu snapshot satırına yazılmaz.",
      "Website kabulü 767/767 PASS, lint PASS, TypeScript exit 0 / 0 B çıktı ve 670/670 static page verdi. Export 3430 dosya / 262711890 B'tır; 25 MiB üstü dosya yoktur ve en büyük HTML out/operations/index.html 19758163 B'tır.",
      "İlk production/main S538 yayını deec5859 kimliğiyle 3346 upload + 83 existing = 3429 asset ve ayrı _headers yüklemesiyle tamamlandı; immutable URL https://deec5859.aselsan-microkernel.pages.dev'dir.",
      "Cache-busted custom-domain readback sekiz rotada HTTP 200 ve ilgili yerel out dosyasına raw byte-exact=true verdi: /code/ 4025089 B / fa44f7e5afe152a8892017ffb5076cf1490cef5996dc156823c073e48a2854c8; /code/s538/ 162225 B / 790ff4d8d776ff773319f6daa3b8cbd4cfa21e000b9994beccce2da9365abb0d; /code/s537/ 118304 B / 7212dd837bfe6cf7d4fd619b6a560a0e61572006a6b737b1cdeed29a7545c7f5; /operations/ 19758163 B / 9703fb61d8a630123a0414a51cf04145b78b831f017cf92db870135f74451446.",
      "Aynı readback /operations/s538/ 93386 B / 504e2ae3fc707cf38316fb9960c9d3b353ed622e033d4727c1569f5652792c33; /operations/s537/ 101925 B / 238033e92a591528d2530b866241e13f84887eaef8d912d8953b5f92401e9ece; /timeline/ 9063288 B / 1ae3665a249c3d3762c1760f9cc51d0958b617ab5b894022dd14509d492cbe8c; /yol-haritasi/ 9063036 B / 30a8eb7d41514e124a0af42cb6d34cd74e0baea844b023c27a8cab25ae08a616 verdi. Canlı Code=538 kart ve Timeline/Yol Haritası=377/377 ayrı gate-policy kartıdır; S538 her yüzeyde exact bir kezdir.",
      "/code/s538/ response header'ı cache-control no-transform ve x-content-type-options nosniff taşıdı; edge source rewrite kabul edilmedi.",
      "Coverage 7 source audit unit / 113 direct / 113 source-model / 113 production guarded / 0 unrouted olarak korunur; S538 yeni Scheduler aliası, writer lease veya exclusion state word üretmez.",
      "S538 completion marker_route_wired=true ve marker_ready_to_emit=true yapar; supported-profile runtime observation=0, physical observation=0, runtime marker observed=false, UART capture=false ve physical Boot-to-UI=false kalır.",
      "Display scanout=false, input=false, R1 acceptance=false ve demonstrator ready=false'dur. Retained software surface telefon ekranı veya dokunmatik kabulü yerine geçirilmez.",
      "S538 sırasında power-on/off, SD removal/insertion, Mac kart erişimi, serial open, UART capture, raw validation, archive veya promotion yapılmadı.",
      "physical/device operations=0 · RUNBOOK_EXECUTED_IN_S538=NO.",
      "S539 exact S538 candidate'ını donduracak; aygıt yetkisi açıkça verilirse SD write/read-back ve Pi güçsüzken UART 115200/8N1 pre-arm yapılacaktır. Kesin block-device ve serial identity doğrulanmadan destructive/device adımı yoktur.",
      "S540 ilk tek-power-on fiziksel RPi5 koşusudur. Marker yokluğu, panic, unknown IRQ veya sıra drift'i RED'dir; raw korunur ve S541 bunu otomatik PASS'e çeviremez.",
    ],
    commands: [
      "CARGO_INCREMENTAL=0 cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s538_r1_boot_ui_marker_runtime_wiring -- --test-threads=1",
      "run S508-S514, S535-S538, G8h source/runtime/object compile and framebuffer-root selected regression serially",
      "compile all simulation test targets once; execute exact S238-S538 dependency binaries serially twice; normalize timing fields",
      "cargo test --workspace --quiet -- --test-threads=1 with exact eight historical/frozen skips",
      "run four fresh isolated dev AArch64 profiles; run scripts/verify-rpi5-s538-layout.sh on the board-rpi5 ELF",
      "CARGO_INCREMENTAL=0 make verify-qemu",
      "npm run code:generate && npm test && npm run lint && npx tsc --noEmit && npm run build",
      "npm run deploy; cache-busted curl and cmp for split S538/S537 Code and Operations plus Timeline/Roadmap routes",
    ],
    terminalSessions: [
      {
        id: "s538-r1-boot-ui-marker-focused",
        title: "S538 focused production marker/runtime wiring",
        commandLines: [
          "CARGO_INCREMENTAL=0 cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s538_r1_boot_ui_marker_runtime_wiring -- --test-threads=1",
        ],
        outputLines: [
          "test result: ok; 15 passed; 0 failed; 0 ignored; 0 filtered",
          "CPU1 exact S537 request preflight < CPU0 prior boot + identity + UI surface < route line < exact marker",
          "marker route wired=true; marker ready to emit=true; runtime/physical observations=0/0",
          "scanout/input/UART/Boot-to-UI/R1=false; device operations=0",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "s538-selected-ui-boot-regression",
        title: "S538 selected UI, predecessor and object-code regression",
        commandLines: [
          "run 15 selected S508-S514/S535-S538/G8h/framebuffer groups serially",
        ],
        outputLines: [
          "selected=15 groups / 127 PASS / 0 fail",
          "G8h source=5/5; runtime source=18/18; AArch64 object compile=1/1",
          "raw=14702 B; SHA-256 7e9552cb449124989fe95770f90e17af7cf8c6df61d137fd5b356faf7a771513",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "s538-dependency-workspace-acceptance",
        title: "S538 dependency determinism and filtered workspace",
        commandLines: [
          "run exact S238-S538 test executables serially twice",
          "run filtered serial workspace with exact historical/frozen skip set",
        ],
        outputLines: [
          "dependency run1/run2=302 groups / 5320 PASS / 0 fail",
          "normalized summaries=41517 B / 9db4994f7defb461fb8d0a451e48a4afc43713e762afdc986fd8c11c18a6414c / byte-exact=true",
          "workspace=501 groups / 7209 PASS / 0 fail / 8 historical-frozen filtered",
          "global unfiltered GREEN=false; predecessor identity is reconstructed by S538 focused test",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "s538-aarch64-layout-qemu",
        title: "S538 four-profile, production layout and QEMU acceptance",
        commandLines: [
          "run four isolated dev AArch64 builds from kernel/ with explicit aarch64-unknown-none",
          "scripts/verify-rpi5-s538-layout.sh READOBJ OBJDUMP OBJCOPY RPI5_ELF",
          "CARGO_INCREMENTAL=0 make verify-qemu",
        ],
        outputLines: [
          "four AArch64 profiles=4/4 exit 0; warning headers=293/391/2844/2844",
          "S538_LAYOUT=PASS CPU1_ORDER=S536_S537_S538 CPU0_ORDER=PRIOR_BOOT_S538 MARKER_REFS=2 SURFACE=0x4000 LINKED_SPAN=18309120",
          "QEMU W^X 31/31 + S130-S154/S271 + IPC 20/20 + scheduler SEC5 PASS",
          "QEMU common regression is not an S538 RPi5 runtime/physical observation",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "s538-operations-timeline-code-publication",
        title: "S538 Operations/Timeline/Code production publication",
        commandLines: [
          "npm test && npm run lint && npx tsc --noEmit && npm run build",
          "npm run deploy",
          "cache-busted curl and cmp for /code/, split S538/S537 Code and Operations, Timeline and Yol Haritasi",
        ],
        outputLines: [
          "website=767/767 PASS; lint=PASS; TypeScript=exit 0/0 B; static pages=670/670",
          "Code registry=S1-S538 538/538 unique / 1578 excerpts / missing none / duplicate 0",
          "initial deployment=deec5859; 3346 uploaded + 83 existing = 3429 assets; _headers uploaded",
          "custom-domain=8/8 HTTP 200 and raw byte-exact; Code no-transform/nosniff; policy cards=377/377",
          "publication is source/evidence distribution, not an RPi5 runtime or physical observation",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
    ],
    terminalSessionsNote:
      "S538'in PASS sonucu exact production source/ELF marker route wiring'i içindir. UART'ta marker görülmüş, fiziksel ekran taranmış, input alınmış veya R1 demonstratörü tamamlanmış değildir; S539 ve S540 ayrı kapılardır.",
    limitations: [
      "Supported-profile RPi5 runtime invocation/observation sıfırdır.",
      "UART capture ve physical Boot-to-UI gözlemi yoktur.",
      "Retained UI surface fiziksel scanout, dokunmatik veya input kabulü değildir.",
      "S539 destructive SD/serial işlemi için kesin device identity ve açık yetki gerektirir; S538 böyle bir yetki vermez.",
      "S540 RED olursa raw korunur, düzeltme/retry yeni sıra tüketir ve S541 otomatik PASS olamaz.",
      "R1 S536–S565 planlama aralığı garantili kapanış değildir.",
      "Filtresiz workspace tarihsel current-source identity assertion'larında global GREEN değildir.",
      "R1 laboratuvar demonstratörü saha güvenilirliği veya günlük kullanım kabulü değildir.",
    ],
  },