S539 · R1 candidate image freeze ve güvenli pre-arm sınırı

#![allow(unexpected_cfgs)]

//! S539 freezes the exact S538 RPi5 candidate and models the safe boundary
//! before any removable-media write or UART open.
//!
//! This module is host-evidence logic.  It is compiled by the simulation
//! focused target but is deliberately not registered in the production
//! kernel: adding it to the frozen candidate would make the candidate hash
//! self-referential.  The actual freeze is performed by the S539 shell tool,
//! which audits a private ELF copy because the historical S538 layout checker
//! rewrites its input while extracting `.rodata`.
//!
//! A read-only disk/serial inventory is evidence, not authority.  Even an
//! exact inventory cannot start a write, open a serial descriptor or change
//! Pi power.  Those operations remain stopped until a fresh, exact operator
//! authorization and an independently confirmed unpowered Pi are supplied.

use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s538_r1_boot_ui_marker_runtime_wiring::S538_SEQUENCE;

pub const S539_SEQUENCE: usize = 539;
pub const S539_EXPECTED_PREDECESSOR: usize = S538_SEQUENCE;
pub const S539_TARGET_BOARD: &str = "Raspberry Pi 5 (BCM2712)";
pub const S539_REQUIRED_MARKER: &str = "[R1:S536] BOOT_TO_UI_READY";
pub const S539_CANDIDATE_TAG: &str = "ASELSAN-R1-S538-BOARD-RPI5";
pub const S539_ROUTE_MARKER: &str = "ASELSAN/S538 ROUTE=PRIOR_BOOT_TO_UI";
pub const S539_ERROR_MARKER: &str = "ASELSAN/S538ERR";
pub const S539_REQUIRED_MARKER_REFERENCES: usize = 2;
pub const S539_REQUIRED_PACKAGE_ENTRIES: usize = 4;
pub const S539_REQUIRED_PACKAGE_MODE: u32 = 0o444;

pub const S539_INPUT_ELF_BYTES: u64 = 18_278_896;
pub const S539_INPUT_ELF_SHA256: &str =
    "abd5ff471e84c5e3c27f3e8ed05d887bade7a723667ad1aff3dc85bf57fe3300";
pub const S539_PRIVATE_AUDIT_ELF_BYTES: u64 = 18_255_744;
pub const S539_PRIVATE_AUDIT_ELF_SHA256: &str =
    "ae8aaf34f930d908906c7f5ca0fef0ba0c398151caa693a8c3f8aa33537d7667";
pub const S539_IMAGE_BYTES: u64 = 933_024;
pub const S539_IMAGE_SHA256: &str =
    "8a32dbd93ca4420555d7e6f93516715e43cc70da8f145584f89383446fecc8fe";
pub const S539_DTB_BYTES: u64 = 78_703;
pub const S539_DTB_SHA256: &str =
    "40a2fbe9c29e8b9a4912cf726a943068defb779fc052ec38e457a79c58abca00";
pub const S539_CONFIG_BYTES: u64 = 494;
pub const S539_CONFIG_SHA256: &str =
    "757934bb4b34777103d776666e942399a09e10c91537f3ae67486397f49652cd";
pub const S539_MANIFEST_BYTES: u64 = 248;
pub const S539_MANIFEST_SHA256: &str =
    "cc98a618b1dddc3ddf7f30f5c1bda52be1ad072a89e20743c9079f98be813688";
pub const S539_FREEZE_TOOL_BYTES: u64 = 9_605;
pub const S539_FREEZE_TOOL_SHA256: &str =
    "cb5401aa2d06198c724819b0e779a437646be1b62e0615e8e117eda0d27f04f4";
pub const S539_S538_LAYOUT_TOOL_BYTES: u64 = 5_161;
pub const S539_S538_LAYOUT_TOOL_SHA256: &str =
    "28f3f85f07605b9823e452aabeeb698537eb00995937f0f0642628333c11f227";

pub const S539_OBSERVED_WHOLE_DISK: &str = "/dev/disk6";
pub const S539_OBSERVED_PARTITION: &str = "/dev/disk6s1";
pub const S539_OBSERVED_MEDIA_NAME: &str = "Built In SDXC Reader";
pub const S539_OBSERVED_MEDIA_BYTES: u64 = 62_549_655_552;
pub const S539_OBSERVED_BLOCK_BYTES: u32 = 512;
pub const S539_OBSERVED_VOLUME_NAME: &str = "ASELSANBOOT";
pub const S539_OBSERVED_VOLUME_UUID: &str = "44ABB50F-DB63-3DB8-A6B2-C5303E3211E9";
pub const S539_OBSERVED_VOLUME_MOUNT: &str = "/Volumes/ASELSANBOOT";
pub const S539_OBSERVED_CARD_MODEL: &str = "TISD64G";
pub const S539_OBSERVED_CARD_PRODUCT: &str = "SD64G";
pub const S539_OBSERVED_CARD_SERIAL_HEX: &str = "0x425001fa";
pub const S539_OBSERVED_CARD_SERIAL_DECIMAL: u64 = 1_112_539_642;
pub const S539_OBSERVED_SERIAL_DEVICE: &str = "/dev/cu.usbmodem21302";
pub const S539_OBSERVED_TTY_DEVICE: &str = "/dev/tty.usbmodem21302";

pub const S539_HOST_READ_ONLY_INVENTORY_PERFORMED: bool = true;
pub const S539_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS: usize = 0;
pub const S539_PHYSICAL_OBSERVATIONS: usize = 0;
pub const S539_DESTRUCTIVE_DEVICE_OPERATIONS: usize = 0;
pub const S539_SD_WRITES: usize = 0;
pub const S539_SD_READ_BACKS: usize = 0;
pub const S539_UART_OPENS: usize = 0;
pub const S539_PI_POWER_TRANSITIONS: usize = 0;
pub const S539_OPERATOR_AUTHORIZATION_PRESENT: bool = false;
pub const S539_PI_POWERED_OFF_INDEPENDENTLY_CONFIRMED: bool = false;
pub const S539_EXECUTION_PERMIT_PUBLISHED: bool = false;
pub const S539_CANDIDATE_FREEZE_COMPLETE: bool = true;
pub const S539_DEVICE_PREARM_COMPLETE: bool = false;
pub const S539_R1_ACCEPTANCE_COMPLETE: bool = false;
pub const RUNBOOK_EXECUTED_IN_S539: bool = false;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS539ArtifactIdentity {
    pub bytes: u64,
    pub sha256: &'static str,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS539CandidateFreezeInput {
    pub sequence: usize,
    pub predecessor_sequence: usize,
    pub s538_route_wired: bool,
    pub s538_marker_ready_to_emit: bool,
    pub input_elf: G8lS539ArtifactIdentity,
    pub private_audit_elf: G8lS539ArtifactIdentity,
    pub image: G8lS539ArtifactIdentity,
    pub dtb: G8lS539ArtifactIdentity,
    pub config: G8lS539ArtifactIdentity,
    pub manifest: G8lS539ArtifactIdentity,
    pub package_entries: usize,
    pub package_mode: u32,
    pub package_files_have_distinct_inodes: bool,
    pub manifest_read_back_verified: bool,
    pub input_elf_immutable_across_layout_audit: bool,
    pub isolated_build_images_byte_equal: bool,
    pub required_marker_references: usize,
    pub route_marker_references: usize,
    pub candidate_tag_references: usize,
    pub error_marker_references: usize,
}

pub const S539_CANONICAL_CANDIDATE_FREEZE_INPUT: G8lS539CandidateFreezeInput =
    G8lS539CandidateFreezeInput {
        sequence: S539_SEQUENCE,
        predecessor_sequence: S539_EXPECTED_PREDECESSOR,
        s538_route_wired: true,
        s538_marker_ready_to_emit: true,
        input_elf: G8lS539ArtifactIdentity {
            bytes: S539_INPUT_ELF_BYTES,
            sha256: S539_INPUT_ELF_SHA256,
        },
        private_audit_elf: G8lS539ArtifactIdentity {
            bytes: S539_PRIVATE_AUDIT_ELF_BYTES,
            sha256: S539_PRIVATE_AUDIT_ELF_SHA256,
        },
        image: G8lS539ArtifactIdentity {
            bytes: S539_IMAGE_BYTES,
            sha256: S539_IMAGE_SHA256,
        },
        dtb: G8lS539ArtifactIdentity {
            bytes: S539_DTB_BYTES,
            sha256: S539_DTB_SHA256,
        },
        config: G8lS539ArtifactIdentity {
            bytes: S539_CONFIG_BYTES,
            sha256: S539_CONFIG_SHA256,
        },
        manifest: G8lS539ArtifactIdentity {
            bytes: S539_MANIFEST_BYTES,
            sha256: S539_MANIFEST_SHA256,
        },
        package_entries: S539_REQUIRED_PACKAGE_ENTRIES,
        package_mode: S539_REQUIRED_PACKAGE_MODE,
        package_files_have_distinct_inodes: true,
        manifest_read_back_verified: true,
        input_elf_immutable_across_layout_audit: true,
        isolated_build_images_byte_equal: true,
        required_marker_references: S539_REQUIRED_MARKER_REFERENCES,
        route_marker_references: 1,
        candidate_tag_references: 1,
        error_marker_references: 1,
    };

pub const fn s539_candidate_freeze_input_is_exact(input: G8lS539CandidateFreezeInput) -> bool {
    input.sequence == S539_SEQUENCE
        && input.predecessor_sequence == S539_EXPECTED_PREDECESSOR
        && input.s538_route_wired
        && input.s538_marker_ready_to_emit
        && input.input_elf.bytes == S539_INPUT_ELF_BYTES
        && str_eq(input.input_elf.sha256, S539_INPUT_ELF_SHA256)
        && input.private_audit_elf.bytes == S539_PRIVATE_AUDIT_ELF_BYTES
        && str_eq(
            input.private_audit_elf.sha256,
            S539_PRIVATE_AUDIT_ELF_SHA256,
        )
        && input.image.bytes == S539_IMAGE_BYTES
        && str_eq(input.image.sha256, S539_IMAGE_SHA256)
        && input.dtb.bytes == S539_DTB_BYTES
        && str_eq(input.dtb.sha256, S539_DTB_SHA256)
        && input.config.bytes == S539_CONFIG_BYTES
        && str_eq(input.config.sha256, S539_CONFIG_SHA256)
        && input.manifest.bytes == S539_MANIFEST_BYTES
        && str_eq(input.manifest.sha256, S539_MANIFEST_SHA256)
        && input.package_entries == S539_REQUIRED_PACKAGE_ENTRIES
        && input.package_mode == S539_REQUIRED_PACKAGE_MODE
        && input.package_files_have_distinct_inodes
        && input.manifest_read_back_verified
        && input.input_elf_immutable_across_layout_audit
        && input.isolated_build_images_byte_equal
        && input.required_marker_references == S539_REQUIRED_MARKER_REFERENCES
        && input.route_marker_references == 1
        && input.candidate_tag_references == 1
        && input.error_marker_references == 1
}

const fn str_eq(left: &str, right: &str) -> bool {
    let left = left.as_bytes();
    let right = right.as_bytes();
    if left.len() != right.len() {
        return false;
    }
    let mut index = 0;
    while index < left.len() {
        if left[index] != right[index] {
            return false;
        }
        index += 1;
    }
    true
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS539CandidateFreezeReceipt {
    pub sequence: usize,
    pub predecessor_sequence: usize,
    pub image: G8lS539ArtifactIdentity,
    pub package_entries: usize,
    pub candidate_frozen: bool,
    pub package_read_only: bool,
    pub input_elf_immutable: bool,
    pub device_phase_started: bool,
    pub supported_profile_runtime_observations: usize,
    pub physical_observations: usize,
    pub runbook_executed: bool,
}

#[derive(Debug, Default)]
pub struct G8lS539CandidateFreezeState {
    receipt: Option<G8lS539CandidateFreezeReceipt>,
}

impl G8lS539CandidateFreezeState {
    pub const fn new() -> Self {
        Self { receipt: None }
    }

    pub const fn receipt(&self) -> Option<G8lS539CandidateFreezeReceipt> {
        self.receipt
    }
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS539CandidateFreezeOutcome {
    AwaitingS538Route,
    CandidateFrozen(G8lS539CandidateFreezeReceipt),
    CandidateRetained(G8lS539CandidateFreezeReceipt),
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS539CandidateFreezeError {
    ArtifactDrift,
    FrozenStateDrift,
}

pub fn service_s539_model_candidate_freeze(
    state: &mut G8lS539CandidateFreezeState,
    input: Option<G8lS539CandidateFreezeInput>,
) -> Result<G8lS539CandidateFreezeOutcome, G8lS539CandidateFreezeError> {
    let Some(input) = input else {
        return Ok(G8lS539CandidateFreezeOutcome::AwaitingS538Route);
    };
    if !s539_candidate_freeze_input_is_exact(input) {
        return Err(G8lS539CandidateFreezeError::ArtifactDrift);
    }
    let receipt = G8lS539CandidateFreezeReceipt {
        sequence: S539_SEQUENCE,
        predecessor_sequence: S539_EXPECTED_PREDECESSOR,
        image: input.image,
        package_entries: input.package_entries,
        candidate_frozen: true,
        package_read_only: true,
        input_elf_immutable: true,
        device_phase_started: false,
        supported_profile_runtime_observations: S539_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS,
        physical_observations: S539_PHYSICAL_OBSERVATIONS,
        runbook_executed: RUNBOOK_EXECUTED_IN_S539,
    };
    if let Some(frozen) = state.receipt {
        if frozen != receipt {
            return Err(G8lS539CandidateFreezeError::FrozenStateDrift);
        }
        return Ok(G8lS539CandidateFreezeOutcome::CandidateRetained(frozen));
    }
    state.receipt = Some(receipt);
    Ok(G8lS539CandidateFreezeOutcome::CandidateFrozen(receipt))
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS539ReadOnlyDeviceInventory {
    pub whole_disk: &'static str,
    pub partition: &'static str,
    pub media_name: &'static str,
    pub media_bytes: u64,
    pub block_bytes: u32,
    pub whole_disk_flag: bool,
    pub removable: bool,
    pub internal: bool,
    pub writable: bool,
    pub ejectable: bool,
    pub volume_name: &'static str,
    pub volume_uuid: &'static str,
    pub volume_mount: &'static str,
    pub card_model: &'static str,
    pub card_product: &'static str,
    pub card_serial_hex: &'static str,
    pub card_serial_decimal: u64,
    pub serial_device: &'static str,
    pub tty_device: &'static str,
    pub observed_read_only: bool,
}

pub const S539_READ_ONLY_DEVICE_INVENTORY: G8lS539ReadOnlyDeviceInventory =
    G8lS539ReadOnlyDeviceInventory {
        whole_disk: S539_OBSERVED_WHOLE_DISK,
        partition: S539_OBSERVED_PARTITION,
        media_name: S539_OBSERVED_MEDIA_NAME,
        media_bytes: S539_OBSERVED_MEDIA_BYTES,
        block_bytes: S539_OBSERVED_BLOCK_BYTES,
        whole_disk_flag: true,
        removable: true,
        internal: false,
        writable: true,
        ejectable: true,
        volume_name: S539_OBSERVED_VOLUME_NAME,
        volume_uuid: S539_OBSERVED_VOLUME_UUID,
        volume_mount: S539_OBSERVED_VOLUME_MOUNT,
        card_model: S539_OBSERVED_CARD_MODEL,
        card_product: S539_OBSERVED_CARD_PRODUCT,
        card_serial_hex: S539_OBSERVED_CARD_SERIAL_HEX,
        card_serial_decimal: S539_OBSERVED_CARD_SERIAL_DECIMAL,
        serial_device: S539_OBSERVED_SERIAL_DEVICE,
        tty_device: S539_OBSERVED_TTY_DEVICE,
        observed_read_only: true,
    };

pub const fn s539_device_inventory_is_exact(inventory: G8lS539ReadOnlyDeviceInventory) -> bool {
    str_eq(inventory.whole_disk, S539_OBSERVED_WHOLE_DISK)
        && str_eq(inventory.partition, S539_OBSERVED_PARTITION)
        && str_eq(inventory.media_name, S539_OBSERVED_MEDIA_NAME)
        && inventory.media_bytes == S539_OBSERVED_MEDIA_BYTES
        && inventory.block_bytes == S539_OBSERVED_BLOCK_BYTES
        && inventory.whole_disk_flag
        && inventory.removable
        && !inventory.internal
        && inventory.writable
        && inventory.ejectable
        && str_eq(inventory.volume_name, S539_OBSERVED_VOLUME_NAME)
        && str_eq(inventory.volume_uuid, S539_OBSERVED_VOLUME_UUID)
        && str_eq(inventory.volume_mount, S539_OBSERVED_VOLUME_MOUNT)
        && str_eq(inventory.card_model, S539_OBSERVED_CARD_MODEL)
        && str_eq(inventory.card_product, S539_OBSERVED_CARD_PRODUCT)
        && str_eq(inventory.card_serial_hex, S539_OBSERVED_CARD_SERIAL_HEX)
        && inventory.card_serial_decimal == S539_OBSERVED_CARD_SERIAL_DECIMAL
        && str_eq(inventory.serial_device, S539_OBSERVED_SERIAL_DEVICE)
        && str_eq(inventory.tty_device, S539_OBSERVED_TTY_DEVICE)
        && inventory.observed_read_only
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS539SafePrearmAuthorization {
    pub authorization_id: u64,
    pub whole_disk: &'static str,
    pub serial_device: &'static str,
    pub operator_asserts_pi_unpowered: bool,
    pub destructive_sd_write_readback_authorized: bool,
    pub uart_115200_8n1_prearm_authorized: bool,
    pub fresh_identity_revalidation_required: bool,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS539SafePrearmAdmissionReceipt {
    pub sequence: usize,
    pub authorization_id: u64,
    pub whole_disk: &'static str,
    pub serial_device: &'static str,
    pub candidate_image_sha256: &'static str,
    pub model_admission_ready: bool,
    pub fresh_identity_revalidation_required: bool,
    pub host_execution_started: bool,
    pub execution_permit_published: bool,
    pub destructive_device_operations: usize,
    pub uart_opens: usize,
    pub pi_power_transitions: usize,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS539SafePrearmOutcome {
    AwaitingFrozenCandidate,
    AwaitingReadOnlyInventory,
    StoppedAwaitingExplicitAuthorization,
    StoppedAwaitingPowerOffConfirmation,
    ReadyForOperatorExecution(G8lS539SafePrearmAdmissionReceipt),
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS539SafePrearmError {
    CandidateDrift,
    InventoryDrift,
    AuthorizationTargetDrift,
}

pub fn evaluate_s539_model_safe_prearm_admission(
    candidate: Option<G8lS539CandidateFreezeReceipt>,
    inventory: Option<G8lS539ReadOnlyDeviceInventory>,
    authorization: Option<G8lS539SafePrearmAuthorization>,
) -> Result<G8lS539SafePrearmOutcome, G8lS539SafePrearmError> {
    let Some(candidate) = candidate else {
        return Ok(G8lS539SafePrearmOutcome::AwaitingFrozenCandidate);
    };
    if candidate.sequence != S539_SEQUENCE
        || candidate.predecessor_sequence != S539_EXPECTED_PREDECESSOR
        || candidate.image.bytes != S539_IMAGE_BYTES
        || !str_eq(candidate.image.sha256, S539_IMAGE_SHA256)
        || !candidate.candidate_frozen
        || !candidate.package_read_only
        || !candidate.input_elf_immutable
        || candidate.device_phase_started
        || candidate.supported_profile_runtime_observations != 0
        || candidate.physical_observations != 0
        || candidate.runbook_executed
    {
        return Err(G8lS539SafePrearmError::CandidateDrift);
    }
    let Some(inventory) = inventory else {
        return Ok(G8lS539SafePrearmOutcome::AwaitingReadOnlyInventory);
    };
    if !s539_device_inventory_is_exact(inventory) {
        return Err(G8lS539SafePrearmError::InventoryDrift);
    }
    let Some(authorization) = authorization else {
        return Ok(G8lS539SafePrearmOutcome::StoppedAwaitingExplicitAuthorization);
    };
    if authorization.authorization_id == 0
        || !str_eq(authorization.whole_disk, inventory.whole_disk)
        || !str_eq(authorization.serial_device, inventory.serial_device)
        || !authorization.fresh_identity_revalidation_required
    {
        return Err(G8lS539SafePrearmError::AuthorizationTargetDrift);
    }
    if !authorization.operator_asserts_pi_unpowered {
        return Ok(G8lS539SafePrearmOutcome::StoppedAwaitingPowerOffConfirmation);
    }
    if !authorization.destructive_sd_write_readback_authorized
        || !authorization.uart_115200_8n1_prearm_authorized
    {
        return Ok(G8lS539SafePrearmOutcome::StoppedAwaitingExplicitAuthorization);
    }
    Ok(G8lS539SafePrearmOutcome::ReadyForOperatorExecution(
        G8lS539SafePrearmAdmissionReceipt {
            sequence: S539_SEQUENCE,
            authorization_id: authorization.authorization_id,
            whole_disk: inventory.whole_disk,
            serial_device: inventory.serial_device,
            candidate_image_sha256: S539_IMAGE_SHA256,
            model_admission_ready: true,
            fresh_identity_revalidation_required: true,
            host_execution_started: false,
            execution_permit_published: false,
            destructive_device_operations: S539_DESTRUCTIVE_DEVICE_OPERATIONS,
            uart_opens: S539_UART_OPENS,
            pi_power_transitions: S539_PI_POWER_TRANSITIONS,
        },
    ))
}

use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s539_r1_candidate_image_freeze_safe_prearm::*;
use sha2::{Digest, Sha256};
use std::collections::HashSet;
use std::fs;
use std::os::unix::fs::{MetadataExt, PermissionsExt};
use std::path::{Path, PathBuf};
use std::process::Command;

const SOURCE: &str = include_str!(
    "../../kernel/src/g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s539_r1_candidate_image_freeze_safe_prearm.rs"
);
const SIMULATION_LIB: &str = include_str!("../src/lib.rs");
const KERNEL_MAIN: &str = include_str!("../../kernel/src/main.rs");
const FREEZE_TOOL: &[u8] = include_bytes!("../../scripts/freeze-rpi5-s539-r1-candidate.sh");
const LAYOUT_TOOL: &[u8] = include_bytes!("../../scripts/verify-rpi5-s538-layout.sh");
const PACKAGE_IMAGE: &[u8] = include_bytes!(
    "../../evidence/rpi5/r1/sequence-539-candidate-freeze/package/aselsanos-rpi5.img"
);
const PACKAGE_DTB: &[u8] = include_bytes!(
    "../../evidence/rpi5/r1/sequence-539-candidate-freeze/package/bcm2712-rpi-5-b.dtb"
);
const PACKAGE_CONFIG: &[u8] =
    include_bytes!("../../evidence/rpi5/r1/sequence-539-candidate-freeze/package/config.txt");
const PACKAGE_SUMS: &[u8] =
    include_bytes!("../../evidence/rpi5/r1/sequence-539-candidate-freeze/package/SHA256SUMS");

fn repository_root() -> PathBuf {
    Path::new(env!("CARGO_MANIFEST_DIR"))
        .parent()
        .expect("simulation repository parent")
        .to_path_buf()
}

fn package_root() -> PathBuf {
    repository_root().join("evidence/rpi5/r1/sequence-539-candidate-freeze/package")
}

fn sha256(bytes: impl AsRef<[u8]>) -> String {
    format!("{:x}", Sha256::digest(bytes.as_ref()))
}

fn count_bytes(haystack: &[u8], needle: &[u8]) -> usize {
    haystack
        .windows(needle.len())
        .filter(|window| *window == needle)
        .count()
}

fn frozen_receipt() -> G8lS539CandidateFreezeReceipt {
    let mut state = G8lS539CandidateFreezeState::new();
    let G8lS539CandidateFreezeOutcome::CandidateFrozen(receipt) =
        service_s539_model_candidate_freeze(
            &mut state,
            Some(S539_CANONICAL_CANDIDATE_FREEZE_INPUT),
        )
        .unwrap()
    else {
        panic!("expected first candidate freeze");
    };
    receipt
}

fn authorization() -> G8lS539SafePrearmAuthorization {
    G8lS539SafePrearmAuthorization {
        authorization_id: 0x5390_0000_0000_0001,
        whole_disk: S539_OBSERVED_WHOLE_DISK,
        serial_device: S539_OBSERVED_SERIAL_DEVICE,
        operator_asserts_pi_unpowered: true,
        destructive_sd_write_readback_authorized: true,
        uart_115200_8n1_prearm_authorized: true,
        fresh_identity_revalidation_required: true,
    }
}

#[test]
fn s539_sequence_and_current_claim_boundary_are_exact() {
    assert_eq!(S539_SEQUENCE, 539);
    assert_eq!(S539_EXPECTED_PREDECESSOR, 538);
    assert!(S539_CANDIDATE_FREEZE_COMPLETE);
    assert!(S539_HOST_READ_ONLY_INVENTORY_PERFORMED);
    assert_eq!(S539_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS, 0);
    assert_eq!(S539_PHYSICAL_OBSERVATIONS, 0);
    assert_eq!(S539_DESTRUCTIVE_DEVICE_OPERATIONS, 0);
    assert_eq!(S539_SD_WRITES, 0);
    assert_eq!(S539_SD_READ_BACKS, 0);
    assert_eq!(S539_UART_OPENS, 0);
    assert_eq!(S539_PI_POWER_TRANSITIONS, 0);
    assert!(!S539_OPERATOR_AUTHORIZATION_PRESENT);
    assert!(!S539_PI_POWERED_OFF_INDEPENDENTLY_CONFIRMED);
    assert!(!S539_EXECUTION_PERMIT_PUBLISHED);
    assert!(!S539_DEVICE_PREARM_COMPLETE);
    assert!(!S539_R1_ACCEPTANCE_COMPLETE);
    assert!(!RUNBOOK_EXECUTED_IN_S539);
}

#[test]
fn exact_candidate_input_freezes_an_immutable_read_only_package() {
    assert!(s539_candidate_freeze_input_is_exact(
        S539_CANONICAL_CANDIDATE_FREEZE_INPUT
    ));
    let receipt = frozen_receipt();
    assert_eq!(receipt.sequence, S539_SEQUENCE);
    assert_eq!(receipt.predecessor_sequence, 538);
    assert_eq!(receipt.image.sha256, S539_IMAGE_SHA256);
    assert_eq!(receipt.package_entries, 4);
    assert!(receipt.candidate_frozen);
    assert!(receipt.package_read_only);
    assert!(receipt.input_elf_immutable);
    assert!(!receipt.device_phase_started);
    assert_eq!(receipt.supported_profile_runtime_observations, 0);
    assert_eq!(receipt.physical_observations, 0);
    assert!(!receipt.runbook_executed);
}

#[test]
fn missing_s538_candidate_waits_without_state_mutation() {
    let mut state = G8lS539CandidateFreezeState::new();
    assert_eq!(
        service_s539_model_candidate_freeze(&mut state, None),
        Ok(G8lS539CandidateFreezeOutcome::AwaitingS538Route)
    );
    assert_eq!(state.receipt(), None);
}

#[test]
fn every_candidate_artifact_or_freeze_drift_fails_closed() {
    let exact = S539_CANONICAL_CANDIDATE_FREEZE_INPUT;
    let mut drifts = Vec::new();
    let mut drift = exact;
    drift.sequence += 1;
    drifts.push(drift);
    let mut drift = exact;
    drift.predecessor_sequence -= 1;
    drifts.push(drift);
    let mut drift = exact;
    drift.s538_route_wired = false;
    drifts.push(drift);
    let mut drift = exact;
    drift.s538_marker_ready_to_emit = false;
    drifts.push(drift);
    let mut drift = exact;
    drift.input_elf.bytes -= 1;
    drifts.push(drift);
    let mut drift = exact;
    drift.input_elf.sha256 = "wrong";
    drifts.push(drift);
    let mut drift = exact;
    drift.private_audit_elf.sha256 = "wrong";
    drifts.push(drift);
    let mut drift = exact;
    drift.image.sha256 = "wrong";
    drifts.push(drift);
    let mut drift = exact;
    drift.dtb.sha256 = "wrong";
    drifts.push(drift);
    let mut drift = exact;
    drift.config.sha256 = "wrong";
    drifts.push(drift);
    let mut drift = exact;
    drift.manifest.sha256 = "wrong";
    drifts.push(drift);
    let mut drift = exact;
    drift.package_entries = 5;
    drifts.push(drift);
    let mut drift = exact;
    drift.package_mode = 0o644;
    drifts.push(drift);
    let mut drift = exact;
    drift.package_files_have_distinct_inodes = false;
    drifts.push(drift);
    let mut drift = exact;
    drift.manifest_read_back_verified = false;
    drifts.push(drift);
    let mut drift = exact;
    drift.input_elf_immutable_across_layout_audit = false;
    drifts.push(drift);
    let mut drift = exact;
    drift.isolated_build_images_byte_equal = false;
    drifts.push(drift);
    let mut drift = exact;
    drift.required_marker_references = 1;
    drifts.push(drift);

    for drift in drifts {
        let mut state = G8lS539CandidateFreezeState::new();
        assert_eq!(
            service_s539_model_candidate_freeze(&mut state, Some(drift)),
            Err(G8lS539CandidateFreezeError::ArtifactDrift)
        );
        assert_eq!(state.receipt(), None);
    }
}

#[test]
fn exact_candidate_replay_retains_the_same_receipt() {
    let mut state = G8lS539CandidateFreezeState::new();
    let first = service_s539_model_candidate_freeze(
        &mut state,
        Some(S539_CANONICAL_CANDIDATE_FREEZE_INPUT),
    )
    .unwrap();
    let replay = service_s539_model_candidate_freeze(
        &mut state,
        Some(S539_CANONICAL_CANDIDATE_FREEZE_INPUT),
    )
    .unwrap();
    let G8lS539CandidateFreezeOutcome::CandidateFrozen(receipt) = first else {
        panic!("first freeze missing");
    };
    assert_eq!(
        replay,
        G8lS539CandidateFreezeOutcome::CandidateRetained(receipt)
    );
}

#[test]
fn read_only_inventory_binds_the_exact_removable_card_and_serial_paths() {
    assert!(s539_device_inventory_is_exact(
        S539_READ_ONLY_DEVICE_INVENTORY
    ));
    assert_eq!(S539_OBSERVED_WHOLE_DISK, "/dev/disk6");
    assert_eq!(S539_OBSERVED_PARTITION, "/dev/disk6s1");
    assert_eq!(S539_OBSERVED_MEDIA_BYTES, 62_549_655_552);
    assert_eq!(S539_OBSERVED_BLOCK_BYTES, 512);
    assert_eq!(S539_OBSERVED_VOLUME_NAME, "ASELSANBOOT");
    assert_eq!(S539_OBSERVED_CARD_MODEL, "TISD64G");
    assert_eq!(S539_OBSERVED_CARD_SERIAL_HEX, "0x425001fa");
    assert_eq!(S539_OBSERVED_CARD_SERIAL_DECIMAL, 1_112_539_642);
    assert_eq!(S539_OBSERVED_SERIAL_DEVICE, "/dev/cu.usbmodem21302");
}

#[test]
fn device_inventory_drift_is_rejected_before_authorization() {
    let exact = S539_READ_ONLY_DEVICE_INVENTORY;
    let mut drifts = Vec::new();
    let mut drift = exact;
    drift.whole_disk = "/dev/disk0";
    drifts.push(drift);
    let mut drift = exact;
    drift.media_bytes -= 512;
    drifts.push(drift);
    let mut drift = exact;
    drift.removable = false;
    drifts.push(drift);
    let mut drift = exact;
    drift.internal = true;
    drifts.push(drift);
    let mut drift = exact;
    drift.volume_uuid = "wrong";
    drifts.push(drift);
    let mut drift = exact;
    drift.card_serial_decimal += 1;
    drifts.push(drift);
    let mut drift = exact;
    drift.serial_device = "/dev/cu.wrong";
    drifts.push(drift);
    let mut drift = exact;
    drift.observed_read_only = false;
    drifts.push(drift);

    for drift in drifts {
        assert_eq!(
            evaluate_s539_model_safe_prearm_admission(Some(frozen_receipt()), Some(drift), None,),
            Err(G8lS539SafePrearmError::InventoryDrift)
        );
    }
}

#[test]
fn safe_prearm_waits_for_candidate_then_inventory() {
    assert_eq!(
        evaluate_s539_model_safe_prearm_admission(
            None,
            Some(S539_READ_ONLY_DEVICE_INVENTORY),
            None,
        ),
        Ok(G8lS539SafePrearmOutcome::AwaitingFrozenCandidate)
    );
    assert_eq!(
        evaluate_s539_model_safe_prearm_admission(Some(frozen_receipt()), None, None),
        Ok(G8lS539SafePrearmOutcome::AwaitingReadOnlyInventory)
    );
}

#[test]
fn current_exact_inventory_stops_without_explicit_authorization() {
    assert_eq!(
        evaluate_s539_model_safe_prearm_admission(
            Some(frozen_receipt()),
            Some(S539_READ_ONLY_DEVICE_INVENTORY),
            None,
        ),
        Ok(G8lS539SafePrearmOutcome::StoppedAwaitingExplicitAuthorization)
    );
}

#[test]
fn authorization_without_power_off_confirmation_stops() {
    let mut authorization = authorization();
    authorization.operator_asserts_pi_unpowered = false;
    assert_eq!(
        evaluate_s539_model_safe_prearm_admission(
            Some(frozen_receipt()),
            Some(S539_READ_ONLY_DEVICE_INVENTORY),
            Some(authorization),
        ),
        Ok(G8lS539SafePrearmOutcome::StoppedAwaitingPowerOffConfirmation)
    );
}

#[test]
fn incomplete_write_or_uart_authorization_stops() {
    for mutate in [0, 1] {
        let mut authorization = authorization();
        if mutate == 0 {
            authorization.destructive_sd_write_readback_authorized = false;
        } else {
            authorization.uart_115200_8n1_prearm_authorized = false;
        }
        assert_eq!(
            evaluate_s539_model_safe_prearm_admission(
                Some(frozen_receipt()),
                Some(S539_READ_ONLY_DEVICE_INVENTORY),
                Some(authorization),
            ),
            Ok(G8lS539SafePrearmOutcome::StoppedAwaitingExplicitAuthorization)
        );
    }
}

#[test]
fn authorization_target_or_identity_revalidation_drift_fails_closed() {
    let mut wrong_disk = authorization();
    wrong_disk.whole_disk = "/dev/disk0";
    let mut wrong_serial = authorization();
    wrong_serial.serial_device = "/dev/cu.wrong";
    let mut zero_id = authorization();
    zero_id.authorization_id = 0;
    let mut no_revalidation = authorization();
    no_revalidation.fresh_identity_revalidation_required = false;
    for drift in [wrong_disk, wrong_serial, zero_id, no_revalidation] {
        assert_eq!(
            evaluate_s539_model_safe_prearm_admission(
                Some(frozen_receipt()),
                Some(S539_READ_ONLY_DEVICE_INVENTORY),
                Some(drift),
            ),
            Err(G8lS539SafePrearmError::AuthorizationTargetDrift)
        );
    }
}

#[test]
fn exact_model_admission_still_does_not_execute_or_publish_a_permit() {
    let outcome = evaluate_s539_model_safe_prearm_admission(
        Some(frozen_receipt()),
        Some(S539_READ_ONLY_DEVICE_INVENTORY),
        Some(authorization()),
    )
    .unwrap();
    let G8lS539SafePrearmOutcome::ReadyForOperatorExecution(receipt) = outcome else {
        panic!("expected model admission readiness");
    };
    assert!(receipt.model_admission_ready);
    assert!(receipt.fresh_identity_revalidation_required);
    assert!(!receipt.host_execution_started);
    assert!(!receipt.execution_permit_published);
    assert_eq!(receipt.destructive_device_operations, 0);
    assert_eq!(receipt.uart_opens, 0);
    assert_eq!(receipt.pi_power_transitions, 0);
}

#[test]
fn freeze_tool_confines_s538_mutation_and_verifies_the_package_read_only() {
    assert_eq!(FREEZE_TOOL.len() as u64, S539_FREEZE_TOOL_BYTES);
    assert_eq!(sha256(FREEZE_TOOL), S539_FREEZE_TOOL_SHA256);
    assert_eq!(LAYOUT_TOOL.len() as u64, S539_S538_LAYOUT_TOOL_BYTES);
    assert_eq!(sha256(LAYOUT_TOOL), S539_S538_LAYOUT_TOOL_SHA256);
    let text = std::str::from_utf8(FREEZE_TOOL).unwrap();
    assert!(text.contains("aselsanos-s539-layout-copy"));
    assert!(text.contains("input ELF hash changed during layout audit"));
    assert!(text.contains("DEVICE_OPERATIONS=0 UART_OPEN=0 PI_POWER_TRANSITIONS=0"));
    assert!(!text.contains("/usr/sbin/diskutil"));
    assert!(!text.contains("/usr/bin/screen"));
    assert!(!text.contains("/bin/dd"));

    let tool = repository_root().join("scripts/freeze-rpi5-s539-r1-candidate.sh");
    let source_check = Command::new(&tool).arg("--source-check").output().unwrap();
    assert!(source_check.status.success());
    assert!(String::from_utf8_lossy(&source_check.stdout).contains("S539_SOURCE_CHECK=PASS"));
    let package_check = Command::new(&tool)
        .arg("--verify-package")
        .arg(package_root())
        .output()
        .unwrap();
    assert!(package_check.status.success());
    assert!(String::from_utf8_lossy(&package_check.stdout).contains("S539_PACKAGE_VERIFY=PASS"));
}

#[test]
fn frozen_package_has_exact_hashes_modes_manifest_and_marker_counts() {
    let identities = [
        (
            "aselsanos-rpi5.img",
            PACKAGE_IMAGE,
            S539_IMAGE_BYTES,
            S539_IMAGE_SHA256,
        ),
        (
            "bcm2712-rpi-5-b.dtb",
            PACKAGE_DTB,
            S539_DTB_BYTES,
            S539_DTB_SHA256,
        ),
        (
            "config.txt",
            PACKAGE_CONFIG,
            S539_CONFIG_BYTES,
            S539_CONFIG_SHA256,
        ),
        (
            "SHA256SUMS",
            PACKAGE_SUMS,
            S539_MANIFEST_BYTES,
            S539_MANIFEST_SHA256,
        ),
    ];
    let mut inodes = HashSet::new();
    for (name, bytes, expected_bytes, expected_sha) in identities {
        assert_eq!(bytes.len() as u64, expected_bytes, "{name} bytes");
        assert_eq!(sha256(bytes), expected_sha, "{name} SHA-256");
        let metadata = fs::metadata(package_root().join(name)).unwrap();
        assert_eq!(metadata.permissions().mode() & 0o777, 0o444, "{name} mode");
        assert_eq!(metadata.nlink(), 1, "{name} link count");
        assert!(
            inodes.insert((metadata.dev(), metadata.ino())),
            "{name} inode"
        );
    }
    assert_eq!(inodes.len(), 4);
    assert_eq!(
        count_bytes(PACKAGE_IMAGE, S539_REQUIRED_MARKER.as_bytes()),
        2
    );
    assert_eq!(count_bytes(PACKAGE_IMAGE, S539_ROUTE_MARKER.as_bytes()), 1);
    assert_eq!(count_bytes(PACKAGE_IMAGE, S539_CANDIDATE_TAG.as_bytes()), 1);
    assert_eq!(count_bytes(PACKAGE_IMAGE, S539_ERROR_MARKER.as_bytes()), 1);
    assert_eq!(
        PACKAGE_SUMS,
        b"8a32dbd93ca4420555d7e6f93516715e43cc70da8f145584f89383446fecc8fe  aselsanos-rpi5.img\n40a2fbe9c29e8b9a4912cf726a943068defb779fc052ec38e457a79c58abca00  bcm2712-rpi-5-b.dtb\n757934bb4b34777103d776666e942399a09e10c91537f3ae67486397f49652cd  config.txt\n"
    );
    let config = std::str::from_utf8(PACKAGE_CONFIG).unwrap();
    assert_eq!(config.matches("uart_2ndstage=0").count(), 1);
    assert_eq!(config.matches("uart_2ndstage=1").count(), 0);
}

#[test]
fn s539_is_simulation_registered_but_not_added_to_the_frozen_kernel() {
    let module_name = "g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s539_r1_candidate_image_freeze_safe_prearm";
    assert!(SIMULATION_LIB.contains(module_name));
    assert!(!KERNEL_MAIN.contains(module_name));
    assert!(SOURCE.contains("host-evidence logic"));
    assert!(SOURCE.contains("deliberately not registered in the production"));
    assert!(SOURCE.contains("read-only disk/serial inventory is evidence, not authority"));
    assert!(Path::new(
        &repository_root().join("evidence/rpi5/r1/sequence-539-candidate-freeze/package")
    )
    .is_dir());
}

  {
    id: "g8l-s539-r1-candidate-image-freeze-safe-prearm-partial",
    date: "2026-08-30",
    sequence: 539,
    status: "passed",
    umbrella_status: "partial",
    title: "S539 · R1 candidate image freeze ve güvenli pre-arm sınırı",
    summary:
      "S539 dar candidate-freeze ve güvenli ön-uçuş hazırlığı kabulü PASS'tir; fiziksel aygıt device-prearm sınırı STOP'tur. Exact S538 board-rpi5 adayı iki fresh izole build'de aynı 933024 bayt / 8a32dbd9…8fe flat image'i üretti ve image+DTB+config+manifest dört dosyalı, 0444, ayrı inode'lu package olarak donduruldu. Tarihsel S538 layout verifier'ın giriş ELF'sini değiştirdiği keşfedildi; S539 aracı verifier'ı yalnız private copy üzerinde çalıştırıp özgün 18278896 bayt ELF'nin hash'ini öncesi/sonrası sabit tuttu. `/dev/disk6`, kart ve `/dev/cu.usbmodem21302` yalnız read-only envanterlendi. Operatör Pi'nin güçsüz olduğunu bildirdi; bu bağımsız elektrik ölçümü veya aygıt yetkisi değildir. SD write/read-back, UART open/pre-arm ve power transition yapılmadı. Device phase explicit exact-target authorization bekleyerek fail-closed durur; S540 fiziksel koşusu açılmamıştır.",
    evidence: [
      "S539, S538'den ayrı host-evidence model, focused test, freeze verifier, R1 config, immutable package, evidence README, proof, Operations detail, Timeline/Yol Haritası policy ve Code kartına sahiptir.",
      "Operations ana kararı dar candidate-freeze ve güvenli ön-uçuş hazırlığı kapsamı için PASS'tir; global R1/device umbrella ayrıca PARTIAL ve device phase STOP olarak gösterilir.",
      "Host-evidence model yalnız simulation/src/lib.rs içinde kayıtlıdır; frozen kernel candidate'a eklense hash self-reference oluşacağından kernel/src/main.rs içinde bilerek kayıtlı değildir.",
      "İki fresh production-context board-rpi5 build exit 0 verdi; ikisinde de pre-layout ELF 18278896 B / abd5ff471e84c5e3c27f3e8ed05d887bade7a723667ad1aff3dc85bf57fe3300 ve warning header sayısı 2844'tür.",
      "Build A/B flat image'ları cmp exit 0 ile byte-exact'tir: 933024 B / 8a32dbd93ca4420555d7e6f93516715e43cc70da8f145584f89383446fecc8fe SHA-256.",
      "Build log'ları temporary target-root yolları nedeniyle byte-identical değildir; yalnız üretilen image için reproducible/byte-exact iddiası kurulur ve zero-warning iddiası yoktur.",
      "Tarihsel scripts/verify-rpi5-s538-layout.sh 5161 B / 28f3f85f07605b9823e452aabeeb698537eb00995937f0f0642628333c11f227 olarak değişmeden pinlidir.",
      "S538 verifier llvm-objcopy --dump-section sırasında kendisine verilen ELF'yi 18255744 B / ae8aaf34f930d908906c7f5ca0fef0ba0c398151caa693a8c3f8aa33537d7667 kimliğine yeniden yazar; bu yan etki doğrudan production input'a uygulanmaz.",
      "S539 freeze aracı 9605 B / cb5401aa2d06198c724819b0e779a437646be1b62e0615e8e117eda0d27f04f4'tür; exact input ELF'yi private audit copy'ye alır, known post-audit identity'yi ve özgün ELF pre/post immutability'yi ayrı doğrular.",
      "Freeze tool source-check, freeze ve verify-package modlarını fail-closed ayırır; destination mevcutsa reddeder, yalnız mevcut parent'ın canonical direct child'ına atomic move yapar.",
      "Package exact dört regular non-symlink entry'dir; her dosya 0444, nlink=1 ve diğerlerinden ayrı device/inode kimliğindedir.",
      "Package image 933024 B / 8a32dbd93ca4420555d7e6f93516715e43cc70da8f145584f89383446fecc8fe; DTB 78703 B / 40a2fbe9c29e8b9a4912cf726a943068defb779fc052ec38e457a79c58abca00'dır.",
      "Package config 494 B / 757934bb4b34777103d776666e942399a09e10c91537f3ae67486397f49652cd; exact bir uart_2ndstage=0 ve sıfır uart_2ndstage=1 içerir.",
      "SHA256SUMS 248 B / cc98a618b1dddc3ddf7f30f5c1bda52be1ad072a89e20743c9079f98be813688; exact üç entry ve shasum -a 256 -c read-back PASS'tir.",
      "Flat image exact bir S538 route marker, iki [R1:S536] BOOT_TO_UI_READY reference, bir ASELSAN-R1-S538-BOARD-RPI5 tag ve bir S538ERR marker taşır.",
      "S539 focused target 16/16 PASS / 0 failed / 0 ignored / 0 filtered verdi; artifact alanları, package üyeliği, replay, private-copy containment, inventory ve authorization/power fail-closed dalları kapsandı.",
      "Selected predecessor koşusu S535–S539 için 5 ayrı group / 68/68 PASS / 0 fail verdi; S535, S536, S537 ve S538 tarihsel sınırları ayrı test binary'leri olarak korundu.",
      "CARGO_INCREMENTAL=0 cargo test -p aselsan_microkernel_simulation --tests --no-run exit 0 verdi; bütün simulation test target'ları compile edildi. Mevcut dead-code warning'leri görülür ve zero-warning sonucu sayılmaz.",
      "Implementation 18811 B / 7902d1e7138004ddb6cef231a37158f4c567bef4d9ed20f3bd0d4fc1e3529298; focused test 16883 B / d35d04a5598cbd5f56347b0cebc1c5fbc021fc37fa93df616ab26200ff3425de SHA-256'dır.",
      "PASS sınıflandırma ekinden sonra evidence README 4320 B / be78fc602cab7f651182dc7b354688f1730ae3ba0f66084b4dcac2961d641ab7; proof 5417 B / ac0b7f34287d90a649b7b5e8b5c53ae9b4fb5b00cb4b829a08390e18a0330fba SHA-256'dır.",
      "Read-only inventory whole disk /dev/disk6, partition /dev/disk6s1, Built In SDXC Reader, 62549655552 B, 512 B block, removable/writable/ejectable=true ve internal=false alanlarını gözledi.",
      "Volume ASELSANBOOT / UUID 44ABB50F-DB63-3DB8-A6B2-C5303E3211E9; kart TISD64G/SD64G ve serial 0x425001fa/1112539642 olarak read-only bağlandı.",
      "Serial inventory /dev/cu.usbmodem21302 ve /dev/tty.usbmodem21302 yollarını gördü; hiçbir descriptor açılmadı, stty/screen/capture başlatılmadı.",
      "Mevcut kart S124/S125 predecessor package'ını taşıyor; S539 image karta yazılmadı ve mevcut kart içeriği değiştirilmedi.",
      "Read-only inventory transient'tir ve destructive operation öncesi fresh tekrarlanmalıdır; disk6 adı tek başına kalıcı aygıt kimliği veya write authority değildir.",
      "Operatör 30 Ağustos 2026'da Pi'nin güçsüz ve yalnız USB Debug Probe üzerinden bağlı olduğunu bildirdi; independent electrical power-off observation=false, operator_authorization_present=false ve execution_permit_published=false kalır.",
      "Current admission exact frozen candidate + exact read-only inventory ve operatör güçsüzlük beyanı sonrasında STOP_AWAITING_EXPLICIT_AUTHORIZATION verir; destructive SD/UART yetkisi kendiliğinden çıkarılmaz.",
      "Modelde exact authorization örneği bile yalnız model_admission_ready üretir; host_execution_started=false ve execution_permit_published=false kalır, gerçek komut çağırmaz.",
      "Supported-profile runtime observations=0, physical observations=0, destructive device operations=0, SD writes/read-backs=0/0, UART opens/captures=0/0 ve Pi power transitions=0'dır.",
      "S539 candidate_freeze_complete=true fakat device_prearm_complete=false, S540 eligible=false, R1 acceptance=false ve demonstrator ready=false'dur.",
      "RUNBOOK_EXECUTED_IN_S539=NO. Candidate artifact PASS'i fiziksel pre-arm veya Boot-to-UI PASS yerine geçirilmez.",
      "S539 website acceptance 781/781 PASS, lint PASS, TypeScript exit 0/empty output ve serial production build 673/673 static page PASS verdi; export 3447 file ve 25 MiB üzeri dosya=0 olarak ölçüldü.",
      "Pre-publication Code registry S1–S539 için 539 unique gate / 1581 exact excerpt / missing=none / 79d054dd360540280af84aae371897092a04a3e46cf0d902f8d931b77b1f5ff3 SHA-256 üretti; mapping writer=69, focused=368, command=94, operation=8'dir.",
      "İlk production deployment 0d67304c kimliğiyle tamamlandı: 3361 upload + 84 existing = 3445 asset ve _headers yayımlandı.",
      "Cache-busted custom-domain readback /, /code/, /code/s539/, /code/s538/, /operations/, /operations/s539/, /operations/s538/, /timeline/, /yol-haritasi/ ve /karsilastirma/ için 10/10 HTTP 200 ve local out ile raw byte-exact verdi.",
      "Code response Cache-Control public,max-age=0,must-revalidate,no-transform ve x-content-type-options=nosniff taşıdı. Immutable deployment hostname bu host ağından curl exit 28/HTTP 000 verdi; bu probe PASS sayılmadı.",
    ],
    commands: [
      "scripts/freeze-rpi5-s539-r1-candidate.sh --source-check",
      "build two fresh isolated board-rpi5 candidates; compare flat images byte-for-byte",
      "scripts/freeze-rpi5-s539-r1-candidate.sh --freeze READOBJ OBJDUMP OBJCOPY ELF DTB CONFIG DESTINATION",
      "scripts/freeze-rpi5-s539-r1-candidate.sh --verify-package evidence/rpi5/r1/sequence-539-candidate-freeze/package",
      "CARGO_INCREMENTAL=0 cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s539_r1_candidate_image_freeze_safe_prearm -- --test-threads=1",
      "run S535-S539 selected focused targets serially; compile all simulation test targets with --no-run",
      "cd website && npm test && npm run lint && npx tsc --noEmit && npm run build",
      "cd website && npm run deploy; cache-busted curl + cmp for ten custom-domain routes",
    ],
    terminalSessions: [
      {
        id: "s539-candidate-reproduction-freeze",
        title: "S539 two-build candidate reproduction and immutable freeze",
        commandLines: [
          "run two isolated board-rpi5 builds from kernel/ with CARGO_INCREMENTAL=0",
          "compare both flat images; run private-copy S538 layout audit",
          "scripts/freeze-rpi5-s539-r1-candidate.sh --freeze READOBJ OBJDUMP OBJCOPY ELF DTB CONFIG DESTINATION",
        ],
        outputLines: [
          "build A/B=2/2 exit 0; warning headers=2844/2844; zero-warning claim=false",
          "pre-layout ELF=18278896 B / abd5ff471e84c5e3c27f3e8ed05d887bade7a723667ad1aff3dc85bf57fe3300",
          "flat image A/B=933024 B / 8a32dbd93ca4420555d7e6f93516715e43cc70da8f145584f89383446fecc8fe / cmp=0",
          "historical verifier mutation confined to private copy; input ELF immutable=YES",
          "candidate freeze=PASS; device operations=0; UART open=0; power transitions=0",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "s539-focused-safe-prearm",
        title: "S539 focused artifact and safe-prearm admission",
        commandLines: [
          "CARGO_INCREMENTAL=0 cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s539_r1_candidate_image_freeze_safe_prearm -- --test-threads=1",
        ],
        outputLines: [
          "test result: ok; 16 passed; 0 failed; 0 ignored; 0 filtered",
          "artifact/package/private-copy/inventory/authorization/power branches covered",
          "current device decision=STOP_AWAITING_EXPLICIT_AUTHORIZATION; operator asserts Pi unpowered=true; independent electrical observation=false",
          "physical/runtime observations=0/0; SD/UART/power operations=0/0/0",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "s539-selected-and-all-target-compile",
        title: "S539 predecessor regression and simulation target compile",
        commandLines: [
          "run S535, S536, S537, S538 and S539 focused binaries serially",
          "CARGO_INCREMENTAL=0 cargo test -p aselsan_microkernel_simulation --tests --no-run",
        ],
        outputLines: [
          "selected=5 groups / 68 PASS / 0 fail",
          "all simulation test targets compile=exit 0",
          "existing dead-code warnings retained; zero-warning claim=false",
          "production kernel is unchanged by S539 host-evidence module registration",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "s539-website-production-publication",
        title:
          "S539 Code, Operations, Timeline and roadmap production publication",
        commandLines: [
          "npm test && npm run lint && npx tsc --noEmit && npm run build",
          "npm run deploy",
          "cache-busted curl + cmp for /, Code S539/S538, Operations S539/S538, Timeline, Yol Haritası and comparison",
        ],
        outputLines: [
          "website tests=781/781 PASS; lint=PASS; TypeScript=exit 0/empty",
          "serial production build=673/673 static pages; export files=3447; files over 25 MiB=0",
          "registry=S1-S539 / 539 gates / 1581 excerpts / missing=none / 79d054dd360540280af84aae371897092a04a3e46cf0d902f8d931b77b1f5ff3",
          "deployment=0d67304c; assets=3361 uploaded + 84 existing; _headers uploaded",
          "custom domain=10/10 HTTP 200 and byte-exact; Code no-transform/nosniff=true",
          "immutable deployment hostname probe=exit 28 / HTTP 000 / claimed pass=false",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
    ],
    terminalSessionsNote:
      "S539 candidate-freeze ve website publication kabulleri PASS'tir; aynı sıra içindeki destructive SD/UART device phase henüz kapanmamıştır. S540 çalıştırılmadı.",
    limitations: [
      "Read-only disk/serial metadata aygıt yetkisi veya Pi power-off kanıtı değildir.",
      "Exact /dev/disk6 hedefi fresh revalidation ve açık destructive-write authorization olmadan yazılamaz.",
      "UART descriptor açık değildir; 115200/8N1 pre-arm ve capture yapılmadı.",
      "S539 device pre-arm tamamlanmadığı için S540 power-on fiziksel koşusu eligible değildir.",
      "Candidate image'de marker referansları vardır fakat UART'ta gözlenmiş marker satırı yoktur.",
      "R1 S536–S565 aralığı planlama tahminidir; demonstratör veya saha kabulü değildir.",
    ],
  },