S540 · R1 ilk fiziksel boot/UART koşusu — RED

#![allow(unexpected_cfgs)]

//! S540 records the first real R1 Raspberry Pi 5 boot/UART attempt.
//!
//! The immutable S539 candidate was written to the exact removable card,
//! read back byte-for-byte, ejected, and then observed through an exclusively
//! opened 115200/8N1 Debug Probe capture.  The board reached the exact G8h
//! completion marker, but the required R1 marker was never emitted.  Instead
//! the terminal production line was `ASELSAN/S538ERR AwaitingPreflight`.
//! Therefore the physical S540 verdict is RED even though this module's
//! focused evidence-integrity tests pass.
//!
//! This is host-evidence logic.  It is registered only by the simulation
//! crate and is deliberately absent from the already executed production
//! candidate.  It performs no card, serial, or power operation.  A later
//! gate may remediate the missing cross-CPU readiness handoff, but S540 can
//! never be promoted retroactively and S541 is not an automatic PASS.

use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s539_r1_candidate_image_freeze_safe_prearm::{
    S539_IMAGE_SHA256, S539_OBSERVED_CARD_SERIAL_HEX, S539_OBSERVED_SERIAL_DEVICE,
    S539_SEQUENCE,
};

pub const S540_SEQUENCE: usize = 540;
pub const S540_EXPECTED_PREDECESSOR: usize = S539_SEQUENCE;
pub const S540_NEXT_SEQUENCE: usize = 541;
pub const S540_R1_RANGE: &str = "S536-S565";

pub const S540_REQUIRED_MARKER: &str = "[R1:S536] BOOT_TO_UI_READY";
pub const S540_ROUTE_MARKER: &str = "ASELSAN/S538 ROUTE=PRIOR_BOOT_TO_UI";
pub const S540_PRIOR_BOOT_MARKER: &str = "ASELSAN/BOOT8H";
pub const S540_ERROR_MARKER: &str = "ASELSAN/S538ERR";
pub const S540_ERROR_REASON: &str = "AwaitingPreflight";
pub const S540_TERMINAL_ERROR_LINE: &str = "ASELSAN/S538ERR AwaitingPreflight";

pub const S540_UART_DEVICE: &str = S539_OBSERVED_SERIAL_DEVICE;
pub const S540_USB_SERIAL: &str = "E6647C74033F9131";
pub const S540_UART_BAUD: u32 = 115_200;
pub const S540_UART_DATA_BITS: u8 = 8;
pub const S540_UART_STOP_BITS: u8 = 1;
pub const S540_UART_PARITY_NONE: bool = true;

pub const S540_RAW_BYTES: u64 = 20_525;
pub const S540_RAW_SHA256: &str =
    "fc3f934543ab5d829ad8a16e2b332dd2bdc35a81c6c0f6423256101448e45114";
pub const S540_RAW_MODE: u32 = 0o444;
pub const S540_RAW_LINK_COUNT: u64 = 1;
pub const S540_RAW_LEADING_NUL_BYTES: usize = 21;
pub const S540_RAW_TOTAL_NUL_BYTES: usize = 21;
pub const S540_RAW_CR_BYTES: usize = 213;
pub const S540_RAW_LF_BYTES: usize = 213;
pub const S540_PRIOR_BOOT_MARKER_COUNT: usize = 1;
pub const S540_REQUIRED_MARKER_COUNT: usize = 0;
pub const S540_ROUTE_MARKER_COUNT: usize = 0;
pub const S540_ERROR_MARKER_COUNT: usize = 1;
pub const S540_ERROR_REASON_COUNT: usize = 1;
pub const S540_PANIC_MARKER_COUNT: usize = 0;
pub const S540_UNKNOWN_IRQ_MARKER_COUNT: usize = 0;

pub const S540_FLASH_TOOL_BYTES: u64 = 30_328;
pub const S540_FLASH_TOOL_SHA256: &str =
    "724cb2c0a1916492f0f5174e89922854edccfc1cf56555f066c615f321ef37ed";
pub const S540_CAPTURE_HELPER_BYTES: u64 = 20_572;
pub const S540_CAPTURE_HELPER_SHA256: &str =
    "9f001c4cec407bbb4310ca0f89d9cc7e8a1be32307ba8d7ea0541e315ff1efec";
pub const S540_INITIAL_WRITE_LOG_BYTES: u64 = 194;
pub const S540_INITIAL_WRITE_LOG_SHA256: &str =
    "f9e4164845045ceb953f2a70701242d1ac6724031d126da04b0d70b5544efd61";
pub const S540_RECOVERY_LOG_BYTES: u64 = 399;
pub const S540_RECOVERY_LOG_SHA256: &str =
    "b3f977251d577b3eaef3caac6a54fdbe6540d6fb814677b52049692348b4ba6b";
pub const S540_CAPTURE_BUILD_LOG_BYTES: u64 = 543;
pub const S540_CAPTURE_BUILD_LOG_SHA256: &str =
    "5433d4aaaecb1193fa2d7a8caac606f75f3811d47b6a8738415be8e3b9fc1cf0";
pub const S540_CAPTURE_CONTROL_LOG_BYTES: u64 = 516;
pub const S540_CAPTURE_CONTROL_LOG_SHA256: &str =
    "02c442678e80517c505bfde5e0483d4dc685f3cb5b6b65fcdcddfc94e0e00ff0";

pub const S540_SD_WRITE_TRANSACTIONS: usize = 1;
pub const S540_SD_WRITE_COMMAND_INVOCATIONS: usize = 2;
pub const S540_SD_PAYLOAD_COMMITS: usize = 4;
pub const S540_SD_READ_BACK_VERIFICATIONS: usize = 4;
pub const S540_SD_EJECTS: usize = 1;
pub const S540_UART_OPENS: usize = 1;
pub const S540_UART_CAPTURES: usize = 1;
pub const S540_OPERATOR_REPORTED_POWER_TRANSITIONS: usize = 2;
pub const S540_INDEPENDENT_POWER_TRANSITION_OBSERVATIONS: usize = 0;
pub const S540_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS: usize = 1;
pub const S540_PHYSICAL_OBSERVATIONS: usize = 1;
pub const S540_CAPTURE_SESSION_EXIT_CODE: i32 = 1;
pub const S540_RUNBOOK_EXECUTED: bool = true;
pub const RUNBOOK_EXECUTED_IN_S540: bool = true;
pub const S540_BOOT_TO_UI_OBSERVED: bool = false;
pub const S540_R1_ACCEPTANCE_COMPLETE: bool = false;
pub const S540_AUTOMATIC_S541_PROMOTION: bool = false;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS540PhysicalVerdict {
    RedAwaitingS538Preflight,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS540PhysicalObservation {
    pub sequence: usize,
    pub predecessor_sequence: usize,
    pub candidate_image_sha256: &'static str,
    pub card_serial_hex: &'static str,
    pub serial_device: &'static str,
    pub usb_serial: &'static str,
    pub uart_baud: u32,
    pub uart_data_bits: u8,
    pub uart_stop_bits: u8,
    pub uart_parity_none: bool,
    pub serial_open_exclusive: bool,
    pub serial_input_flushed_before_capture: bool,
    pub sd_candidate_read_back_exact: bool,
    pub sd_ejected_before_power_on: bool,
    pub capture_prearmed_before_power_on: bool,
    pub operator_power_on_reported: bool,
    pub operator_power_off_reported: bool,
    pub power_off_independently_observed: bool,
    pub raw_bytes: u64,
    pub raw_sha256: &'static str,
    pub raw_mode: u32,
    pub raw_link_count: u64,
    pub raw_finalized_read_only: bool,
    pub capture_session_exit_code: i32,
    pub leading_nul_bytes: usize,
    pub total_nul_bytes: usize,
    pub cr_bytes: usize,
    pub lf_bytes: usize,
    pub prior_boot_marker_count: usize,
    pub required_marker_count: usize,
    pub route_marker_count: usize,
    pub error_marker_count: usize,
    pub awaiting_preflight_count: usize,
    pub panic_marker_count: usize,
    pub unknown_irq_marker_count: usize,
}

pub const S540_CANONICAL_PHYSICAL_OBSERVATION: G8lS540PhysicalObservation =
    G8lS540PhysicalObservation {
        sequence: S540_SEQUENCE,
        predecessor_sequence: S540_EXPECTED_PREDECESSOR,
        candidate_image_sha256: S539_IMAGE_SHA256,
        card_serial_hex: S539_OBSERVED_CARD_SERIAL_HEX,
        serial_device: S540_UART_DEVICE,
        usb_serial: S540_USB_SERIAL,
        uart_baud: S540_UART_BAUD,
        uart_data_bits: S540_UART_DATA_BITS,
        uart_stop_bits: S540_UART_STOP_BITS,
        uart_parity_none: S540_UART_PARITY_NONE,
        serial_open_exclusive: true,
        serial_input_flushed_before_capture: true,
        sd_candidate_read_back_exact: true,
        sd_ejected_before_power_on: true,
        capture_prearmed_before_power_on: true,
        operator_power_on_reported: true,
        operator_power_off_reported: true,
        power_off_independently_observed: false,
        raw_bytes: S540_RAW_BYTES,
        raw_sha256: S540_RAW_SHA256,
        raw_mode: S540_RAW_MODE,
        raw_link_count: S540_RAW_LINK_COUNT,
        raw_finalized_read_only: true,
        capture_session_exit_code: S540_CAPTURE_SESSION_EXIT_CODE,
        leading_nul_bytes: S540_RAW_LEADING_NUL_BYTES,
        total_nul_bytes: S540_RAW_TOTAL_NUL_BYTES,
        cr_bytes: S540_RAW_CR_BYTES,
        lf_bytes: S540_RAW_LF_BYTES,
        prior_boot_marker_count: S540_PRIOR_BOOT_MARKER_COUNT,
        required_marker_count: S540_REQUIRED_MARKER_COUNT,
        route_marker_count: S540_ROUTE_MARKER_COUNT,
        error_marker_count: S540_ERROR_MARKER_COUNT,
        awaiting_preflight_count: S540_ERROR_REASON_COUNT,
        panic_marker_count: S540_PANIC_MARKER_COUNT,
        unknown_irq_marker_count: S540_UNKNOWN_IRQ_MARKER_COUNT,
    };

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS540S538HandoffAudit {
    pub cpu1_preflight_service_present: bool,
    pub cpu1_awaiting_s537_is_accepted: bool,
    pub cpu0_completion_requires_preflight: bool,
    pub cpu0_waits_for_preflight: bool,
    pub cpu0_retries_completion: bool,
    pub mandatory_cross_cpu_readiness_handoff_present: bool,
    pub raw_awaiting_preflight_count: usize,
}

pub const S540_CANONICAL_S538_HANDOFF_AUDIT: G8lS540S538HandoffAudit = G8lS540S538HandoffAudit {
    cpu1_preflight_service_present: true,
    cpu1_awaiting_s537_is_accepted: true,
    cpu0_completion_requires_preflight: true,
    cpu0_waits_for_preflight: false,
    cpu0_retries_completion: false,
    mandatory_cross_cpu_readiness_handoff_present: false,
    raw_awaiting_preflight_count: S540_ERROR_REASON_COUNT,
};

pub const fn s540_physical_observation_is_exact(observation: G8lS540PhysicalObservation) -> bool {
    observation.sequence == S540_SEQUENCE
        && observation.predecessor_sequence == S540_EXPECTED_PREDECESSOR
        && str_eq(observation.candidate_image_sha256, S539_IMAGE_SHA256)
        && str_eq(observation.card_serial_hex, S539_OBSERVED_CARD_SERIAL_HEX)
        && str_eq(observation.serial_device, S540_UART_DEVICE)
        && str_eq(observation.usb_serial, S540_USB_SERIAL)
        && observation.uart_baud == S540_UART_BAUD
        && observation.uart_data_bits == S540_UART_DATA_BITS
        && observation.uart_stop_bits == S540_UART_STOP_BITS
        && observation.uart_parity_none
        && observation.serial_open_exclusive
        && observation.serial_input_flushed_before_capture
        && observation.sd_candidate_read_back_exact
        && observation.sd_ejected_before_power_on
        && observation.capture_prearmed_before_power_on
        && observation.operator_power_on_reported
        && observation.operator_power_off_reported
        && !observation.power_off_independently_observed
        && observation.raw_bytes == S540_RAW_BYTES
        && str_eq(observation.raw_sha256, S540_RAW_SHA256)
        && observation.raw_mode == S540_RAW_MODE
        && observation.raw_link_count == S540_RAW_LINK_COUNT
        && observation.raw_finalized_read_only
        && observation.capture_session_exit_code == S540_CAPTURE_SESSION_EXIT_CODE
        && observation.leading_nul_bytes == S540_RAW_LEADING_NUL_BYTES
        && observation.total_nul_bytes == S540_RAW_TOTAL_NUL_BYTES
        && observation.cr_bytes == S540_RAW_CR_BYTES
        && observation.lf_bytes == S540_RAW_LF_BYTES
        && observation.prior_boot_marker_count == S540_PRIOR_BOOT_MARKER_COUNT
        && observation.required_marker_count == S540_REQUIRED_MARKER_COUNT
        && observation.route_marker_count == S540_ROUTE_MARKER_COUNT
        && observation.error_marker_count == S540_ERROR_MARKER_COUNT
        && observation.awaiting_preflight_count == S540_ERROR_REASON_COUNT
        && observation.panic_marker_count == S540_PANIC_MARKER_COUNT
        && observation.unknown_irq_marker_count == S540_UNKNOWN_IRQ_MARKER_COUNT
}

pub const fn s540_s538_handoff_audit_supports_root_cause(audit: G8lS540S538HandoffAudit) -> bool {
    audit.cpu1_preflight_service_present
        && audit.cpu1_awaiting_s537_is_accepted
        && audit.cpu0_completion_requires_preflight
        && !audit.cpu0_waits_for_preflight
        && !audit.cpu0_retries_completion
        && !audit.mandatory_cross_cpu_readiness_handoff_present
        && audit.raw_awaiting_preflight_count == S540_ERROR_REASON_COUNT
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS540PhysicalAttemptReceipt {
    pub sequence: usize,
    pub predecessor_sequence: usize,
    pub verdict: G8lS540PhysicalVerdict,
    pub raw_sha256: &'static str,
    pub candidate_booted_through_g8h: bool,
    pub boot_to_ui_observed: bool,
    pub r1_acceptance_complete: bool,
    pub automatic_s541_promotion: bool,
    pub next_sequence: usize,
    pub separate_remediation_and_retry_required: bool,
    pub operator_power_off_reported: bool,
    pub power_off_independently_observed: bool,
}

#[derive(Debug, Default)]
pub struct G8lS540PhysicalAttemptState {
    receipt: Option<G8lS540PhysicalAttemptReceipt>,
}

impl G8lS540PhysicalAttemptState {
    pub const fn new() -> Self {
        Self { receipt: None }
    }

    pub const fn receipt(&self) -> Option<G8lS540PhysicalAttemptReceipt> {
        self.receipt
    }
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS540PhysicalAttemptOutcome {
    AwaitingPhysicalObservation,
    RedRecorded(G8lS540PhysicalAttemptReceipt),
    RedRetained(G8lS540PhysicalAttemptReceipt),
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS540PhysicalAttemptError {
    ObservationDrift,
    RootCauseAuditDrift,
    RecordedStateDrift,
}

pub fn record_s540_model_physical_attempt(
    state: &mut G8lS540PhysicalAttemptState,
    observation: Option<G8lS540PhysicalObservation>,
    audit: G8lS540S538HandoffAudit,
) -> Result<G8lS540PhysicalAttemptOutcome, G8lS540PhysicalAttemptError> {
    let Some(observation) = observation else {
        return Ok(G8lS540PhysicalAttemptOutcome::AwaitingPhysicalObservation);
    };
    if !s540_physical_observation_is_exact(observation) {
        return Err(G8lS540PhysicalAttemptError::ObservationDrift);
    }
    if !s540_s538_handoff_audit_supports_root_cause(audit) {
        return Err(G8lS540PhysicalAttemptError::RootCauseAuditDrift);
    }
    let receipt = G8lS540PhysicalAttemptReceipt {
        sequence: S540_SEQUENCE,
        predecessor_sequence: S540_EXPECTED_PREDECESSOR,
        verdict: G8lS540PhysicalVerdict::RedAwaitingS538Preflight,
        raw_sha256: S540_RAW_SHA256,
        candidate_booted_through_g8h: true,
        boot_to_ui_observed: S540_BOOT_TO_UI_OBSERVED,
        r1_acceptance_complete: S540_R1_ACCEPTANCE_COMPLETE,
        automatic_s541_promotion: S540_AUTOMATIC_S541_PROMOTION,
        next_sequence: S540_NEXT_SEQUENCE,
        separate_remediation_and_retry_required: true,
        operator_power_off_reported: observation.operator_power_off_reported,
        power_off_independently_observed: observation.power_off_independently_observed,
    };
    if let Some(recorded) = state.receipt {
        if recorded != receipt {
            return Err(G8lS540PhysicalAttemptError::RecordedStateDrift);
        }
        return Ok(G8lS540PhysicalAttemptOutcome::RedRetained(recorded));
    }
    state.receipt = Some(receipt);
    Ok(G8lS540PhysicalAttemptOutcome::RedRecorded(receipt))
}

const fn str_eq(left: &str, right: &str) -> bool {
    let left = left.as_bytes();
    let right = right.as_bytes();
    if left.len() != right.len() {
        return false;
    }
    let mut index = 0;
    while index < left.len() {
        if left[index] != right[index] {
            return false;
        }
        index += 1;
    }
    true
}

use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s540_r1_first_physical_boot_uart_attempt_red::*;
use sha2::{Digest, Sha256};
use std::fs;
use std::os::unix::fs::{MetadataExt, PermissionsExt};
use std::path::{Path, PathBuf};

const SOURCE: &str = include_str!(
    "../../kernel/src/g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s540_r1_first_physical_boot_uart_attempt_red.rs"
);
const S538_SOURCE: &str = include_str!(
    "../../kernel/src/g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s538_r1_boot_ui_marker_runtime_wiring.rs"
);
const S541_SOURCE: &str = include_str!(
    "../../kernel/src/g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s541_r1_cross_cpu_marker_readiness_handoff.rs"
);
const EXCEPTIONS_SOURCE: &str = include_str!("../../kernel/src/arch/aarch64/exceptions.rs");
const SIMULATION_LIB: &str = include_str!("../src/lib.rs");
const KERNEL_MAIN: &str = include_str!("../../kernel/src/main.rs");
const FLASH_TOOL: &[u8] = include_bytes!("../../scripts/flash-rpi5-s539-r1-candidate.sh");
const CAPTURE_HELPER: &[u8] = include_bytes!("../../scripts/capture-rpi5-s540-r1-uart.c");
const RAW: &[u8] =
    include_bytes!("../../evidence/rpi5/r1/sequence-540-physical-boot-uart/s540-uart.raw");
const INITIAL_WRITE_LOG: &[u8] = include_bytes!(
    "../../evidence/rpi5/r1/sequence-540-physical-boot-uart/s539-sd-write-readback-eject.log"
);
const RECOVERY_LOG: &[u8] = include_bytes!(
    "../../evidence/rpi5/r1/sequence-540-physical-boot-uart/s539-prefix1-recovery-readback-eject.log"
);
const CAPTURE_BUILD_LOG: &[u8] = include_bytes!(
    "../../evidence/rpi5/r1/sequence-540-physical-boot-uart/s540-uart-capture-build.log"
);
const CAPTURE_CONTROL_LOG: &[u8] = include_bytes!(
    "../../evidence/rpi5/r1/sequence-540-physical-boot-uart/s540-uart-capture-control.log"
);

fn repository_root() -> PathBuf {
    Path::new(env!("CARGO_MANIFEST_DIR"))
        .parent()
        .expect("simulation repository parent")
        .to_path_buf()
}

fn sha256(bytes: impl AsRef<[u8]>) -> String {
    format!("{:x}", Sha256::digest(bytes.as_ref()))
}

fn count_bytes(haystack: &[u8], needle: &[u8]) -> usize {
    haystack
        .windows(needle.len())
        .filter(|window| *window == needle)
        .count()
}

fn leading_nul_bytes(bytes: &[u8]) -> usize {
    bytes.iter().take_while(|byte| **byte == 0).count()
}

#[test]
fn s540_sequence_and_physical_scope_are_exact() {
    assert_eq!(S540_SEQUENCE, 540);
    assert_eq!(S540_EXPECTED_PREDECESSOR, 539);
    assert_eq!(S540_NEXT_SEQUENCE, 541);
    assert_eq!(S540_R1_RANGE, "S536-S565");
    assert_eq!(S540_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS, 1);
    assert_eq!(S540_PHYSICAL_OBSERVATIONS, 1);
    assert_eq!(S540_SD_WRITE_TRANSACTIONS, 1);
    assert_eq!(S540_SD_WRITE_COMMAND_INVOCATIONS, 2);
    assert_eq!(S540_SD_PAYLOAD_COMMITS, 4);
    assert_eq!(S540_SD_READ_BACK_VERIFICATIONS, 4);
    assert_eq!(S540_SD_EJECTS, 1);
    assert_eq!(S540_UART_OPENS, 1);
    assert_eq!(S540_UART_CAPTURES, 1);
    assert_eq!(S540_OPERATOR_REPORTED_POWER_TRANSITIONS, 2);
    assert_eq!(S540_INDEPENDENT_POWER_TRANSITION_OBSERVATIONS, 0);
    assert!(S540_RUNBOOK_EXECUTED);
    assert!(RUNBOOK_EXECUTED_IN_S540);
    assert!(!S540_BOOT_TO_UI_OBSERVED);
    assert!(!S540_R1_ACCEPTANCE_COMPLETE);
    assert!(!S540_AUTOMATIC_S541_PROMOTION);
}

#[test]
fn missing_physical_observation_waits_without_mutation() {
    let mut state = G8lS540PhysicalAttemptState::new();
    assert_eq!(
        record_s540_model_physical_attempt(&mut state, None, S540_CANONICAL_S538_HANDOFF_AUDIT,),
        Ok(G8lS540PhysicalAttemptOutcome::AwaitingPhysicalObservation)
    );
    assert_eq!(state.receipt(), None);
}

#[test]
fn exact_observation_is_recorded_as_red_not_pass() {
    assert!(s540_physical_observation_is_exact(
        S540_CANONICAL_PHYSICAL_OBSERVATION
    ));
    assert!(s540_s538_handoff_audit_supports_root_cause(
        S540_CANONICAL_S538_HANDOFF_AUDIT
    ));
    let mut state = G8lS540PhysicalAttemptState::new();
    let G8lS540PhysicalAttemptOutcome::RedRecorded(receipt) = record_s540_model_physical_attempt(
        &mut state,
        Some(S540_CANONICAL_PHYSICAL_OBSERVATION),
        S540_CANONICAL_S538_HANDOFF_AUDIT,
    )
    .unwrap() else {
        panic!("S540 must record a RED receipt");
    };
    assert_eq!(
        receipt.verdict,
        G8lS540PhysicalVerdict::RedAwaitingS538Preflight
    );
    assert!(receipt.candidate_booted_through_g8h);
    assert!(!receipt.boot_to_ui_observed);
    assert!(!receipt.r1_acceptance_complete);
    assert!(!receipt.automatic_s541_promotion);
    assert_eq!(receipt.next_sequence, 541);
    assert!(receipt.separate_remediation_and_retry_required);
    assert!(receipt.operator_power_off_reported);
    assert!(!receipt.power_off_independently_observed);
}

#[test]
fn exact_red_observation_replay_retains_the_same_receipt() {
    let mut state = G8lS540PhysicalAttemptState::new();
    let first = record_s540_model_physical_attempt(
        &mut state,
        Some(S540_CANONICAL_PHYSICAL_OBSERVATION),
        S540_CANONICAL_S538_HANDOFF_AUDIT,
    )
    .unwrap();
    let G8lS540PhysicalAttemptOutcome::RedRecorded(receipt) = first else {
        panic!("first RED record missing");
    };
    assert_eq!(
        record_s540_model_physical_attempt(
            &mut state,
            Some(S540_CANONICAL_PHYSICAL_OBSERVATION),
            S540_CANONICAL_S538_HANDOFF_AUDIT,
        ),
        Ok(G8lS540PhysicalAttemptOutcome::RedRetained(receipt))
    );
}

#[test]
fn every_material_physical_observation_drift_fails_closed() {
    let exact = S540_CANONICAL_PHYSICAL_OBSERVATION;
    let mut drifts = Vec::new();
    let mut drift = exact;
    drift.sequence = 541;
    drifts.push(drift);
    let mut drift = exact;
    drift.candidate_image_sha256 = "wrong";
    drifts.push(drift);
    let mut drift = exact;
    drift.card_serial_hex = "wrong";
    drifts.push(drift);
    let mut drift = exact;
    drift.usb_serial = "wrong";
    drifts.push(drift);
    let mut drift = exact;
    drift.uart_baud = 9_600;
    drifts.push(drift);
    let mut drift = exact;
    drift.serial_open_exclusive = false;
    drifts.push(drift);
    let mut drift = exact;
    drift.sd_candidate_read_back_exact = false;
    drifts.push(drift);
    let mut drift = exact;
    drift.capture_prearmed_before_power_on = false;
    drifts.push(drift);
    let mut drift = exact;
    drift.operator_power_off_reported = false;
    drifts.push(drift);
    let mut drift = exact;
    drift.raw_sha256 = "wrong";
    drifts.push(drift);
    let mut drift = exact;
    drift.raw_mode = 0o644;
    drifts.push(drift);
    let mut drift = exact;
    drift.required_marker_count = 1;
    drifts.push(drift);
    let mut drift = exact;
    drift.error_marker_count = 0;
    drifts.push(drift);
    let mut drift = exact;
    drift.panic_marker_count = 1;
    drifts.push(drift);

    for drift in drifts {
        let mut state = G8lS540PhysicalAttemptState::new();
        assert_eq!(
            record_s540_model_physical_attempt(
                &mut state,
                Some(drift),
                S540_CANONICAL_S538_HANDOFF_AUDIT,
            ),
            Err(G8lS540PhysicalAttemptError::ObservationDrift)
        );
        assert_eq!(state.receipt(), None);
    }
}

#[test]
fn root_cause_requires_the_observed_missing_handoff_shape() {
    let exact = S540_CANONICAL_S538_HANDOFF_AUDIT;
    let mut drifts = Vec::new();
    let mut drift = exact;
    drift.cpu1_preflight_service_present = false;
    drifts.push(drift);
    let mut drift = exact;
    drift.cpu1_awaiting_s537_is_accepted = false;
    drifts.push(drift);
    let mut drift = exact;
    drift.cpu0_completion_requires_preflight = false;
    drifts.push(drift);
    let mut drift = exact;
    drift.cpu0_waits_for_preflight = true;
    drifts.push(drift);
    let mut drift = exact;
    drift.cpu0_retries_completion = true;
    drifts.push(drift);
    let mut drift = exact;
    drift.mandatory_cross_cpu_readiness_handoff_present = true;
    drifts.push(drift);
    let mut drift = exact;
    drift.raw_awaiting_preflight_count = 0;
    drifts.push(drift);
    for drift in drifts {
        let mut state = G8lS540PhysicalAttemptState::new();
        assert_eq!(
            record_s540_model_physical_attempt(
                &mut state,
                Some(S540_CANONICAL_PHYSICAL_OBSERVATION),
                drift,
            ),
            Err(G8lS540PhysicalAttemptError::RootCauseAuditDrift)
        );
    }
}

#[test]
fn immutable_raw_capture_has_the_exact_identity_and_mode() {
    assert_eq!(RAW.len() as u64, S540_RAW_BYTES);
    assert_eq!(sha256(RAW), S540_RAW_SHA256);
    let raw_path =
        repository_root().join("evidence/rpi5/r1/sequence-540-physical-boot-uart/s540-uart.raw");
    let metadata = fs::metadata(raw_path).unwrap();
    assert_eq!(metadata.permissions().mode() & 0o777, S540_RAW_MODE);
    assert_eq!(metadata.nlink(), S540_RAW_LINK_COUNT);
    assert!(metadata.is_file());
}

#[test]
fn raw_wire_shape_preserves_leading_nuls_and_crlf_counts() {
    assert_eq!(leading_nul_bytes(RAW), S540_RAW_LEADING_NUL_BYTES);
    assert_eq!(RAW.iter().filter(|byte| **byte == 0).count(), 21);
    assert_eq!(RAW.iter().filter(|byte| **byte == b'\r').count(), 213);
    assert_eq!(RAW.iter().filter(|byte| **byte == b'\n').count(), 213);
}

#[test]
fn raw_binds_the_exact_sd_card_config_and_dtb_reads() {
    assert_eq!(
        count_bytes(RAW, b"CID: 009f5449534436344761425001fa01a1"),
        1
    );
    assert_eq!(count_bytes(RAW, b"ASELSANBOOT"), 2);
    assert_eq!(count_bytes(RAW, b"Read config.txt bytes      494"), 1);
    assert_eq!(
        count_bytes(RAW, b"Read bcm2712-rpi-5-b.dtb bytes    78703"),
        1
    );
    assert_eq!(count_bytes(RAW, b"Board: Raspberry Pi 5 (BCM2712)"), 1);
}

#[test]
fn raw_reaches_g8h_then_records_exact_s538_preflight_red() {
    assert_eq!(
        count_bytes(RAW, S540_PRIOR_BOOT_MARKER.as_bytes()),
        S540_PRIOR_BOOT_MARKER_COUNT
    );
    assert_eq!(
        count_bytes(RAW, S540_REQUIRED_MARKER.as_bytes()),
        S540_REQUIRED_MARKER_COUNT
    );
    assert_eq!(
        count_bytes(RAW, S540_ROUTE_MARKER.as_bytes()),
        S540_ROUTE_MARKER_COUNT
    );
    assert_eq!(
        count_bytes(RAW, S540_ERROR_MARKER.as_bytes()),
        S540_ERROR_MARKER_COUNT
    );
    assert_eq!(
        count_bytes(RAW, S540_ERROR_REASON.as_bytes()),
        S540_ERROR_REASON_COUNT
    );
    assert_eq!(count_bytes(RAW, S540_TERMINAL_ERROR_LINE.as_bytes()), 1);
    let boot = RAW
        .windows(S540_PRIOR_BOOT_MARKER.len())
        .position(|window| window == S540_PRIOR_BOOT_MARKER.as_bytes())
        .unwrap();
    let error = RAW
        .windows(S540_TERMINAL_ERROR_LINE.len())
        .position(|window| window == S540_TERMINAL_ERROR_LINE.as_bytes())
        .unwrap();
    assert!(boot < error);
}

#[test]
fn raw_has_no_panic_or_unknown_irq_marker() {
    assert_eq!(count_bytes(RAW, b"panic"), S540_PANIC_MARKER_COUNT);
    assert_eq!(count_bytes(RAW, b"PANIC"), S540_PANIC_MARKER_COUNT);
    assert_eq!(
        count_bytes(RAW, b"unknown IRQ"),
        S540_UNKNOWN_IRQ_MARKER_COUNT
    );
}

#[test]
fn s538_source_requires_preflight_but_cpu0_has_no_wait_or_retry() {
    assert!(S538_SOURCE.contains("let Some(preflight) = state.preflight else"));
    assert!(S538_SOURCE.contains("return Err(G8lS538BootUiMarkerRuntimeError::AwaitingPreflight);"));
    let cpu0 = S538_SOURCE
        .split("pub fn enter_s538_boot_ui_marker_runtime_on_cpu0")
        .nth(1)
        .expect("CPU0 S538 entry");
    assert_eq!(
        cpu0.matches("complete_s538_model_boot_ui_marker_route(")
            .count(),
        1
    );
    assert!(!cpu0.contains("PreflightArmed"));
    assert!(!cpu0.contains("while"));
    assert!(!cpu0.contains("spin_loop"));
    assert!(!cpu0.contains("wait_for_s538_preflight"));
    assert!(!cpu0.contains("wait_until_preflight"));
}

#[test]
fn historical_cpu1_audit_is_pinned_while_s541_supersedes_the_live_callsite() {
    assert!(S538_SOURCE.contains("pub fn service_s538_marker_route_preflight_on_cpu1"));
    assert!(S540_CANONICAL_S538_HANDOFF_AUDIT.cpu1_awaiting_s537_is_accepted);
    assert!(!S540_CANONICAL_S538_HANDOFF_AUDIT.mandatory_cross_cpu_readiness_handoff_present);
    assert!(!EXCEPTIONS_SOURCE.contains("service_s538_marker_route_preflight_on_cpu1()"));
    assert!(EXCEPTIONS_SOURCE.contains("service_s541_readiness_handoff_on_cpu1()"));
    assert!(S541_SOURCE.contains("service_s538_marker_route_preflight_on_cpu1()"));
    assert!(S541_SOURCE.contains("Cpu1RetryScheduled"));
    assert!(S541_SOURCE.contains("S540 remains an immutable RED observation"));
    assert!(!S538_SOURCE.contains("S538_PRODUCTION_PREFLIGHT_READY"));
    assert!(!S538_SOURCE.contains("wait_for_s538_preflight"));
}

#[test]
fn capture_helper_pins_exclusive_115200_8n1_flush_and_immutable_finalize() {
    assert_eq!(CAPTURE_HELPER.len() as u64, S540_CAPTURE_HELPER_BYTES);
    assert_eq!(sha256(CAPTURE_HELPER), S540_CAPTURE_HELPER_SHA256);
    let helper = std::str::from_utf8(CAPTURE_HELPER).unwrap();
    for required in [
        "#define TERMINAL_MARKER \"[R1:S536] BOOT_TO_UI_READY\"",
        "TIOCEXCL",
        "B115200",
        "TCIFLUSH",
        "O_WRONLY | O_CREAT | O_EXCL",
        "fchmod(output_fd, 0444)",
        "line_boundary",
    ] {
        assert!(
            helper.contains(required),
            "missing capture contract: {required}"
        );
    }
}

#[test]
fn sd_writer_and_recovery_logs_preserve_the_interruption_and_exact_eject() {
    assert_eq!(FLASH_TOOL.len() as u64, S540_FLASH_TOOL_BYTES);
    assert_eq!(sha256(FLASH_TOOL), S540_FLASH_TOOL_SHA256);
    assert_eq!(INITIAL_WRITE_LOG.len() as u64, S540_INITIAL_WRITE_LOG_BYTES);
    assert_eq!(sha256(INITIAL_WRITE_LOG), S540_INITIAL_WRITE_LOG_SHA256);
    assert_eq!(RECOVERY_LOG.len() as u64, S540_RECOVERY_LOG_BYTES);
    assert_eq!(sha256(RECOVERY_LOG), S540_RECOVERY_LOG_SHA256);
    let first = std::str::from_utf8(INITIAL_WRITE_LOG).unwrap();
    let recovery = std::str::from_utf8(RECOVERY_LOG).unwrap();
    assert!(first.contains("card inventory changed at prefix 4"));
    assert!(first.contains("NEVER_BOOT=YES RERUN_FORBIDDEN=YES AUTO_ROLLBACK=NO"));
    assert!(recovery.contains("S539_STAGED_PREFIX_1=PASS"));
    assert!(recovery.contains("Disk /dev/disk6 ejected"));
    assert!(recovery.contains("exact4/readback/sync/eject"));
    assert!(recovery.contains("EJECT=PASS UART=NOT_RUN POWER=NOT_RUN"));
}

#[test]
fn capture_build_and_control_logs_bind_the_exact_probe_and_prearm() {
    assert_eq!(CAPTURE_BUILD_LOG.len() as u64, S540_CAPTURE_BUILD_LOG_BYTES);
    assert_eq!(sha256(CAPTURE_BUILD_LOG), S540_CAPTURE_BUILD_LOG_SHA256);
    assert_eq!(
        CAPTURE_CONTROL_LOG.len() as u64,
        S540_CAPTURE_CONTROL_LOG_BYTES
    );
    assert_eq!(sha256(CAPTURE_CONTROL_LOG), S540_CAPTURE_CONTROL_LOG_SHA256);
    let build = std::str::from_utf8(CAPTURE_BUILD_LOG).unwrap();
    let control = std::str::from_utf8(CAPTURE_CONTROL_LOG).unwrap();
    assert!(build.contains("S540_CAPTURE_BUILD=PASS"));
    assert!(build.contains("usb_serial=E6647C74033F9131"));
    assert!(build.contains("card_ejected=YES"));
    assert!(build.contains("pi_power=OPERATOR_ASSERTED_OFF"));
    assert!(control.contains("same_descriptor=true fd=3 exclusive_request=TIOCEXCL_APPLIED"));
    assert!(control.contains("effective_baud_115200=true"));
    assert!(control.contains("format=8N1 raw=true flow_control=false"));
    assert!(control.contains("input_flushed=true method=TCIFLUSH"));
    assert!(control.contains("capture_armed=YES"));
}

#[test]
fn s540_is_simulation_registered_and_does_not_rewrite_the_tested_kernel() {
    let module_name = "g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s540_r1_first_physical_boot_uart_attempt_red";
    assert!(SIMULATION_LIB.contains(module_name));
    assert!(!KERNEL_MAIN.contains(module_name));
    assert!(SOURCE.contains("focused evidence-integrity tests pass"));
    assert!(SOURCE.contains("performs no card, serial, or power operation"));
    assert!(SOURCE.contains("S541 is not an automatic PASS"));
}

  {
    id: "g8l-s540-r1-first-physical-boot-uart-attempt-red",
    date: "2026-08-30",
    sequence: 540,
    status: "failed",
    umbrella_status: "partial",
    title: "S540 · R1 ilk fiziksel boot/UART koşusu — RED",
    summary:
      "S540 ilk gerçek Raspberry Pi 5 boot/UART koşusudur ve fiziksel kabul sonucu RED'dir. Exact S539 candidate staged transaction ile karta yazıldı, dört payload byte-exact read-back edildi, manifest doğrulandı, sync ve eject tamamlandı; Debug Probe exclusive 115200/8N1 raw capture olarak güçten önce pre-arm edildi. Tek operatör power-on koşusunda immutable 20525 B UART raw, `ASELSAN/BOOT8H` satırını bir kez ve ardından `ASELSAN/S538ERR AwaitingPreflight` satırını bir kez kaydetti; required `[R1:S536] BOOT_TO_UI_READY` ve S538 route marker sıfır kez görüldü. Panic ve unknown IRQ yoktur fakat required marker yokluğu tek başına RED'dir. Kaynak denetimi CPU1'in AwaitingS537 sonucunu kabul ettiğini, CPU0 completion'ın preflight istediğini ve arada mandatory readiness barrier/wait/retry bulunmadığını gösterir. Operatör daha sonra gücü kapattığını bildirdi; bağımsız elektrik gözlemi değildir. Focused evidence-integrity testi 17/17 PASS ile bu RED kararını sabitler. Boot-to-UI ve R1 acceptance false, S541 otomatik PASS değildir.",
    evidence: [
      "S540, S539'dan ayrı host-evidence model, 17-test focused target, immutable raw, hazırlık logları, evidence README, proof, Operations kaydı, Timeline/Yol Haritası açıklaması ve Code kartına sahiptir.",
      "Dar fiziksel gate status=RED ve global R1 umbrella=PARTIAL'dır. Focused kod testinin PASS olması fiziksel koşunun RED sonucunu değiştirmez.",
      "Exact S539 image 933024 B / 8a32dbd93ca4420555d7e6f93516715e43cc70da8f145584f89383446fecc8fe, DTB 78703 B / 40a2fbe9c29e8b9a4912cf726a943068defb779fc052ec38e457a79c58abca00 ve config 494 B / 757934bb4b34777103d776666e942399a09e10c91537f3ae67486397f49652cd ile bağlandı.",
      "Kart TISD64G serial 0x425001fa ve boot raw CID 009f5449534436344761425001fa01a1 olarak doğrulandı. Boot ROM config.txt için 494 B, bcm2712-rpi-5-b.dtb için 78703 B okudu.",
      "İlk SD writer invocation image commit'inden sonra POSIX shell global loop-variable çakışması nedeniyle impossible prefix 4 doğrulamasında fail-closed durdu. 194 B / f9e41648…fd61 log 0444 olarak korunur; initial RED gizlenmez.",
      "Read-only staged-prefix-1 audit image=S539, kalan final dosyalar=S125 ve kalan staged pairs=S539 sonucunu exact doğruladı. Düzeltme loop değişkenlerini namespace etti, package yolunu absolute bağladı ve yalnız exact staged-prefix-1 recovery modu ekledi.",
      "Recovery aynı staged transaction'ın kalan üç payload'ını tamamladı; exact dört final dosya cmp/read-back, manifest, sync ve diskutil eject PASS oldu. Recovery log 399 B / b3f97725…ba6b ve mode 0444'tür.",
      "SD hazırlığı bir staged transaction, iki command invocation, dört payload commit, dört read-back verification ve bir eject olarak kaydedildi. Eject sonrası /dev/disk6 ve mount Mac'te yoktu.",
      "Capture helper source 20572 B / 9f001c4cec407bbb4310ca0f89d9cc7e8a1be32307ba8d7ea0541e315ff1efec; exact marker, line-boundary parser, TIOCEXCL, B115200, 8N1/raw, TCIFLUSH, O_EXCL output ve 0444 finalize sözleşmelerini taşır.",
      "Capture helper PTY positive testi split marker, false boundary, stale-input flush, exact raw ve 0444 finalize'ı; negative testi non-line-boundary marker rejection, timeout ve immutable finalize'ı doğruladı.",
      "Build log 543 B / 5433d4aa…c1cf0; control log 516 B / 02c44267…ff0 ve ikisi de 0444'tür. Probe serial E6647C74033F9131, device /dev/cu.usbmodem21302, aynı descriptor fd=3, TIOCEXCL, effective 115200/8N1 raw, flow off ve TCIFLUSH olarak pre-arm edildi.",
      "Immutable s540-uart.raw 20525 B / fc3f934543ab5d829ad8a16e2b332dd2bdc35a81c6c0f6423256101448e45114, mode 0444 ve nlink=1'dir. Birth/modified/change 15:46:06/15:47:49/15:48:10 Europe/Istanbul'dur.",
      "Raw wire shape 21 leading NUL, 21 total NUL, 213 CR ve 213 LF byte'tır. Outer capture pipeline operatör stop sinyali sonrasında exit 1 oldu; unsupported exact helper-exit iddiası kurulmaz.",
      "Raw exact bir ASELSAN/BOOT8H ve exact bir ASELSAN/S538ERR AwaitingPreflight içerir. BOOT8H terminal error'dan önce gelir.",
      "Raw [R1:S536] BOOT_TO_UI_READY=0, ASELSAN/S538 ROUTE=PRIOR_BOOT_TO_UI=0, panic/PANIC=0/0 ve unknown IRQ=0 içerir. Required marker yokluğu fiziksel RED için yeterlidir.",
      "Ham kanıt CPU0'ın AwaitingPreflight'a ulaştığını ispatlar; daha dar upstream zamanlama nedeni iddia edilmez.",
      "Kaynak denetimi service_s538_marker_route_preflight_on_cpu1 varlığını, timer callsite'ın AwaitingS537 ve PreflightArmed sonuçlarını kabul ettiğini ve CPU0 complete fonksiyonunun state.preflight yokluğunda AwaitingPreflight verdiğini doğrular.",
      "CPU0 terminal entry exact bir completion çağrısı içerir; mandatory cross-CPU readiness handoff, bounded wait veya retry yoktur. Bu eksik handoff gözlenen terminal ordering'i mümkün kılar.",
      "İlk S540 focused koşu 16/17 RED oldu; tek assertion generic `wait` substring'i nedeniyle `AwaitingPreflight` metnini yanlış eşleştirdi. Assertion gerçek wait/retry sembollerine daraltıldı, fiziksel marker/verdict beklentisi gevşetilmedi.",
      "Final S540 focused target 17/17 PASS / 0 failed / 0 ignored / 0 filtered verdi. Selected S536–S540 zinciri 5 ayrı group / 78/78 PASS'tir.",
      "S540 implementation 14809 B / e5ea9a134d3196ad7ee646252326f712fc031b9448b5e1fd83ddfff4163cf249; S541 live-callsite supersession'ını tarihsel S540 source snapshot'ından ayıran focused test 16418 B / 1e7d42fb3b89ee5251ac07671c6408df4e74de3c7d207299b2ec7cc8ebe226db SHA-256'dır.",
      "Host-evidence module yalnız simulation/src/lib.rs içinde kayıtlıdır; zaten fiziksel olarak çalıştırılmış frozen kernel candidate'a eklenmemiştir ve yeni aygıt işlemi yapamaz.",
      "Operatör bir power-on ve daha sonra `gücü kapattım` beyanı verdi. 15:52:18+03:00 closeout snapshot'ında raw hash değişmedi, UART holder=0, Debug Probe present ve disk6 absent idi; independent electrical transition observations=0 kalır.",
      "RUNBOOK_EXECUTED_IN_S540=YES, supported-profile runtime observations=1, physical observations=1, UART open/capture=1/1 ve operator-reported power transitions=2'dir.",
      "boot_to_ui_observed=false, r1_acceptance_complete=false, r1_demonstrator_ready=false ve automatic_s541_promotion=false'dur.",
      "S540 tarihsel RED olarak immutable kalır. S541 ayrı remediation/independent evidence kapısı olmalı; yeni fiziksel retry açık yetki ister, yeni sıra ve yeni raw tüketir.",
      "S540 website acceptance 789/789 PASS, lint PASS, TypeScript exit 0/empty output ve production build 675/675 static page PASS verdi; export 3456 file, 25 MiB üzeri dosya=0 ve export-tree digest 06fbfd4a…12b'dir.",
      "Pre-publication Code registry S1–S540 için 540 unique gate / 1584 exact excerpt / missing=none / 0198acf9155c94f386d6cf5bd270040e4193360e385965c58b85e2f58556a593 SHA-256 üretti; mapping writer=69, focused=369, command=94, operation=8'dir.",
      "İlk production deployment d46b4fd9-2684-403c-a6e0-4cc97f8a415d kimliğiyle tamamlandı: 3372 upload + 83 existing = 3455 asset ve _headers yayımlandı.",
      "Cache-busted custom-domain readback /, /operations/, /operations/s540/, /operations/s539/, /code/, /code/s540/, /code/s539/, /timeline/, /yol-haritasi/ ve /karsilastirma/ için 10/10 HTTP 200 ve local out ile raw byte-exact verdi.",
      "Immutable d46b4fd9 deployment hostname probe bu host ağından curl exit 28 / HTTP 000 timeout verdi; PASS sayılmadı.",
      "Evidence-sync production deployment 8c6e6bf5-f0d0-4423-8bd6-4f2ea867565b kimliğiyle tamamlandı: 3370 upload + 85 existing = 3455 asset; aynı on custom-domain rota yeniden 10/10 HTTP 200 ve local out ile raw byte-exact verdi.",
    ],
    commands: [
      "scripts/flash-rpi5-s539-r1-candidate.sh PACKAGE /dev/disk6 /Volumes/ASELSANBOOT AUTH --preflight",
      "scripts/flash-rpi5-s539-r1-candidate.sh PACKAGE /dev/disk6 /Volumes/ASELSANBOOT AUTH --recover-staged-prefix-1",
      "compile and PTY-test scripts/capture-rpi5-s540-r1-uart.c; pre-arm /dev/cu.usbmodem21302 at exclusive 115200/8N1",
      "capture one operator-powered physical run to evidence/rpi5/r1/sequence-540-physical-boot-uart/s540-uart.raw",
      "CARGO_INCREMENTAL=0 cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s540_r1_first_physical_boot_uart_attempt_red -- --test-threads=1",
      "run S536-S540 selected focused targets serially",
      "cd website && npm test && npm run lint && npx tsc --noEmit && npm run build",
      "cd website && npm run deploy; cache-busted curl + cmp for ten custom-domain routes",
    ],
    terminalSessions: [
      {
        id: "s540-sd-write-readback-eject",
        title: "S540 exact candidate SD transaction",
        commandLines: [
          "run fresh exact-target preflight for package, card 0x425001fa and Debug Probe E6647C74033F9131",
          "start staged write; retain fail-closed prefix mismatch",
          "run read-only --verify-staged-prefix-1, then explicit --recover-staged-prefix-1",
        ],
        outputLines: [
          "preflight=PASS; WRITE=0 UART_OPEN=0 POWER=0",
          "initial result=RED after image commit: card inventory changed at prefix 4; raw log retained 0444",
          "read-only audit=PASS: exact staged-prefix-1; no automatic rollback or blind rerun",
          "recovery=PASS: exact4 byte read-back + manifest + sync + eject",
          "SD staged transaction=1; command invocations=2; payload commits/readbacks/ejects=4/4/1",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "s540-first-physical-uart-attempt",
        title: "S540 first real RPi5 boot/UART attempt — RED",
        commandLines: [
          "pre-arm /dev/cu.usbmodem21302 exclusively at 115200/8N1 raw after TCIFLUSH",
          "operator: güç verdim",
          "capture until exact terminal RED, preserve raw, then operator: gücü kapattım",
        ],
        outputLines: [
          "raw=20525 B / fc3f934543ab5d829ad8a16e2b332dd2bdc35a81c6c0f6423256101448e45114 / mode 0444 / nlink 1",
          "BOOT8H=1; BOOT_TO_UI_READY=0; S538 route=0; S538ERR AwaitingPreflight=1",
          "panic/PANIC=0/0; unknown IRQ=0; leading NUL=21; CR/LF=213/213",
          "physical verdict=RED; Boot-to-UI=false; R1 acceptance=false",
          "power-off=operator reported; independently observed=false; no further physical action",
        ],
        exitCode: 1,
        outputMode: "complete",
        outputNote:
          "TAM ÇIKTI · exit 1 fiziksel S540 RED sonucudur; focused test sonucu değildir.",
      },
      {
        id: "s540-focused-red-classification",
        title: "S540 focused immutable-evidence and RED classification",
        commandLines: [
          "CARGO_INCREMENTAL=0 cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s540_r1_first_physical_boot_uart_attempt_red -- --test-threads=1",
          "run S536, S537, S538, S539 and S540 focused targets serially",
        ],
        outputLines: [
          "initial focused=16 passed / 1 failed; test-only generic wait substring matched AwaitingPreflight",
          "final focused=17 passed / 0 failed / 0 ignored / 0 filtered",
          "selected predecessor regression=5 groups / 78 passed / 0 failed",
          "exact verdict=RedAwaitingS538Preflight; automatic S541 promotion=false",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "s540-website-production-publication",
        title: "S540 Operations/Timeline/Code production publication",
        commandLines: [
          "npm test && npm run lint && npx tsc --noEmit && npm run build",
          "npm run deploy",
          "cache-busted curl + cmp for ten custom-domain routes",
        ],
        outputLines: [
          "website tests=789/789 PASS; lint=PASS; TypeScript exit=0/empty; static pages=675/675",
          "export files=3456; files >25 MiB=0; Code=540 gates / 1584 exact excerpts / missing none",
          "initial deployment=d46b4fd9-2684-403c-a6e0-4cc97f8a415d; upload/existing=3372/83",
          "custom domain=10/10 HTTP 200 and byte-exact to local out",
          "immutable hostname probe=exit 28 / HTTP 000 timeout; claimed PASS=false",
          "evidence-sync deployment=8c6e6bf5-f0d0-4423-8bd6-4f2ea867565b; upload/existing=3370/85",
          "evidence-sync custom domain=10/10 HTTP 200 and byte-exact to local out",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
    ],
    terminalSessionsNote:
      "S540 terminal kanıtı fiziksel RED ile focused evidence-integrity PASS'ini ayrı tutar. Güç kapatma kapanış beyanıdır; acceptance promotion değildir.",
    limitations: [
      "Required Boot-to-UI marker gözlenmedi; fiziksel S540 kapısı RED'dir.",
      "Raw AwaitingPreflight'ı kanıtlar; upstream S537'nin neden o anda hazır olmadığına ilişkin daha dar timing iddiası kurulmaz.",
      "Power-off yalnız operatör beyanıdır; bağımsız elektrik ölçümü yoktur.",
      "Focused 17/17 PASS fiziksel RED'i kapatmaz veya R1 demonstratörünü hazır yapmaz.",
      "S541 otomatik PASS değildir; remediation ve olası yeni fiziksel retry ayrı sıra/kanıt/yetki gerektirir.",
    ],
  },