S544 · R1 reachable-readiness producer remediation

#![allow(unexpected_cfgs)]

//! S544 makes the S541 CPU1 readiness producer reachable before G8h arms its
//! local timer and enters the PPI27-owned task window.
//!
//! The physical S543 raw remains an immutable RED observation.  Its only S541
//! production callsite lived below the G8h early-return interceptor and could
//! not execute while G8h owned CPU1 PPI27.  S544 adds a distinct CPU1 boot
//! hook outside that IRQ path.  The hook runs with IRQs masked and the local
//! virtual timer disabled, reconciles the existing S431-S535 source ledger,
//! publishes S536 and S537, and then requires an exact S541 Release-side
//! readiness receipt.  It emits no UART text, performs no device operation,
//! does not rerun S543, and cannot claim a physical Boot-to-UI observation.

use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s541_r1_cross_cpu_marker_readiness_handoff::{
    s538_preflight_is_exact_for_s541, G8lS541ReadinessHandoffOutcome,
    G8lS541ReadinessReceipt, S541_READY_CONSUMER_CPU, S541_READY_PRODUCER_CPU,
};

pub const S544_SEQUENCE: usize = 544;
pub const S544_EXPECTED_PREDECESSOR: usize = 543;
pub const S544_REMEDIATES_SEQUENCE: usize = 543;
pub const S544_REQUIRED_TIMER_CONTROL: u64 = 0b10;
pub const S544_ACCEPTANCE_LEDGER_FIRST_SEQUENCE: usize = 431;
pub const S544_ACCEPTANCE_LEDGER_LAST_SEQUENCE: usize = 535;
pub const S544_ACCEPTANCE_LEDGER_GATE_COUNT: usize =
    S544_ACCEPTANCE_LEDGER_LAST_SEQUENCE - S544_ACCEPTANCE_LEDGER_FIRST_SEQUENCE + 1;
pub const S544_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS: usize = 0;
pub const S544_PHYSICAL_OBSERVATIONS: usize = 0;
pub const S544_PHYSICAL_OR_DEVICE_OPERATIONS: usize = 0;
pub const S544_SD_WRITES: usize = 0;
pub const S544_UART_OPENS: usize = 0;
pub const S544_POWER_TRANSITIONS: usize = 0;
pub const S544_NEW_IMMUTABLE_RAW_CAPTURES: usize = 0;
pub const S544_S543_PHYSICAL_VERDICT_RETAINED_RED: bool = true;
pub const S544_AUTOMATIC_S543_PROMOTION: bool = false;
pub const S544_BOOT_TO_UI_PHYSICALLY_OBSERVED: bool = false;
pub const S544_R1_ACCEPTANCE_COMPLETE: bool = false;
pub const RUNBOOK_EXECUTED_IN_S544: bool = false;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS544ReachableReadinessProducerReceipt {
    pub sequence: usize,
    pub predecessor_sequence: usize,
    pub remediates_sequence: usize,
    pub s541_readiness: G8lS541ReadinessReceipt,
    pub producer_cpu: usize,
    pub consumer_cpu: usize,
    pub acceptance_ledger_first_sequence: usize,
    pub acceptance_ledger_last_sequence: usize,
    pub acceptance_ledger_gate_count: usize,
    pub g8h_stage_released: bool,
    pub irqs_masked: bool,
    pub inside_g8h_irq_handler: bool,
    pub timer_control_before: u64,
    pub timer_control_after: u64,
    pub before_g8h_timer_arm: bool,
    pub before_g8h_terminal_timer_disable: bool,
    pub s543_physical_verdict_retained_red: bool,
    pub automatic_s543_promotion: bool,
    pub supported_profile_runtime_observations: usize,
    pub physical_observations: usize,
    pub runbook_executed: bool,
}

#[derive(Debug)]
pub struct G8lS544ReachableReadinessProducerState {
    receipt: Option<G8lS544ReachableReadinessProducerReceipt>,
}

impl G8lS544ReachableReadinessProducerState {
    pub const fn new() -> Self {
        Self { receipt: None }
    }

    pub const fn receipt(&self) -> Option<G8lS544ReachableReadinessProducerReceipt> {
        self.receipt
    }
}

impl Default for G8lS544ReachableReadinessProducerState {
    fn default() -> Self {
        Self::new()
    }
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS544ReachableReadinessProducerOutcome {
    Published(G8lS544ReachableReadinessProducerReceipt),
    Retained(G8lS544ReachableReadinessProducerReceipt),
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS544ReachableReadinessProducerError {
    WrongCpu,
    G8hStageNotReleased,
    IrqsNotMasked,
    InsideG8hIrqHandler,
    TimerNotDisabled,
    AcceptanceLedgerService,
    AcceptanceLedgerNotReady,
    S536Service,
    S536NotReady,
    S537Service,
    S537NotReady,
    S541Service,
    S541ReadinessNotPublished,
    S541ReceiptDrift,
    PublishedStateDrift,
}

impl G8lS544ReachableReadinessProducerError {
    pub const fn diagnostic_code(self) -> u64 {
        match self {
            Self::WrongCpu => 1,
            Self::G8hStageNotReleased => 2,
            Self::IrqsNotMasked => 3,
            Self::InsideG8hIrqHandler => 4,
            Self::TimerNotDisabled => 5,
            Self::AcceptanceLedgerService => 6,
            Self::AcceptanceLedgerNotReady => 7,
            Self::S536Service => 8,
            Self::S536NotReady => 9,
            Self::S537Service => 10,
            Self::S537NotReady => 11,
            Self::S541Service => 12,
            Self::S541ReadinessNotPublished => 13,
            Self::S541ReceiptDrift => 14,
            Self::PublishedStateDrift => 15,
        }
    }
}

pub fn s541_readiness_is_exact_for_s544(readiness: G8lS541ReadinessReceipt) -> bool {
    readiness.sequence == 541
        && readiness.predecessor_sequence == 540
        && readiness.remediates_sequence == 540
        && readiness.producer_cpu == S541_READY_PRODUCER_CPU
        && readiness.consumer_cpu == S541_READY_CONSUMER_CPU
        && readiness.mandatory_cross_cpu_handoff
        && readiness.readiness_published
        && readiness.s540_physical_verdict_retained_red
        && !readiness.automatic_s540_promotion
        && readiness.supported_profile_runtime_observations == 0
        && readiness.physical_observations == 0
        && !readiness.runbook_executed
        && s538_preflight_is_exact_for_s541(readiness.preflight)
}

#[allow(clippy::too_many_arguments)]
pub fn service_s544_model_reachable_readiness_producer(
    state: &mut G8lS544ReachableReadinessProducerState,
    caller_cpu: usize,
    g8h_stage_released: bool,
    irqs_masked: bool,
    inside_g8h_irq_handler: bool,
    timer_control_before: u64,
    timer_control_after: u64,
    s541_outcome: G8lS541ReadinessHandoffOutcome,
) -> Result<G8lS544ReachableReadinessProducerOutcome, G8lS544ReachableReadinessProducerError> {
    if caller_cpu != S541_READY_PRODUCER_CPU {
        return Err(G8lS544ReachableReadinessProducerError::WrongCpu);
    }
    if !g8h_stage_released {
        return Err(G8lS544ReachableReadinessProducerError::G8hStageNotReleased);
    }
    if !irqs_masked {
        return Err(G8lS544ReachableReadinessProducerError::IrqsNotMasked);
    }
    if inside_g8h_irq_handler {
        return Err(G8lS544ReachableReadinessProducerError::InsideG8hIrqHandler);
    }
    if timer_control_before & 0b11 != S544_REQUIRED_TIMER_CONTROL
        || timer_control_after & 0b11 != S544_REQUIRED_TIMER_CONTROL
    {
        return Err(G8lS544ReachableReadinessProducerError::TimerNotDisabled);
    }
    let readiness = match s541_outcome {
        G8lS541ReadinessHandoffOutcome::Cpu1ReadinessPublished(receipt)
        | G8lS541ReadinessHandoffOutcome::Cpu1ReadinessRetained(receipt) => receipt,
        _ => return Err(G8lS544ReachableReadinessProducerError::S541ReadinessNotPublished),
    };
    if !s541_readiness_is_exact_for_s544(readiness) {
        return Err(G8lS544ReachableReadinessProducerError::S541ReceiptDrift);
    }
    let receipt = G8lS544ReachableReadinessProducerReceipt {
        sequence: S544_SEQUENCE,
        predecessor_sequence: S544_EXPECTED_PREDECESSOR,
        remediates_sequence: S544_REMEDIATES_SEQUENCE,
        s541_readiness: readiness,
        producer_cpu: S541_READY_PRODUCER_CPU,
        consumer_cpu: S541_READY_CONSUMER_CPU,
        acceptance_ledger_first_sequence: S544_ACCEPTANCE_LEDGER_FIRST_SEQUENCE,
        acceptance_ledger_last_sequence: S544_ACCEPTANCE_LEDGER_LAST_SEQUENCE,
        acceptance_ledger_gate_count: S544_ACCEPTANCE_LEDGER_GATE_COUNT,
        g8h_stage_released,
        irqs_masked,
        inside_g8h_irq_handler,
        timer_control_before: timer_control_before & 0b11,
        timer_control_after: timer_control_after & 0b11,
        before_g8h_timer_arm: true,
        before_g8h_terminal_timer_disable: true,
        s543_physical_verdict_retained_red: S544_S543_PHYSICAL_VERDICT_RETAINED_RED,
        automatic_s543_promotion: S544_AUTOMATIC_S543_PROMOTION,
        supported_profile_runtime_observations: S544_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS,
        physical_observations: S544_PHYSICAL_OBSERVATIONS,
        runbook_executed: RUNBOOK_EXECUTED_IN_S544,
    };
    if let Some(published) = state.receipt {
        if published != receipt {
            return Err(G8lS544ReachableReadinessProducerError::PublishedStateDrift);
        }
        return Ok(G8lS544ReachableReadinessProducerOutcome::Retained(
            published,
        ));
    }
    state.receipt = Some(receipt);
    Ok(G8lS544ReachableReadinessProducerOutcome::Published(receipt))
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
static S544_PRODUCTION_STATE: spin::Mutex<G8lS544ReachableReadinessProducerState> =
    spin::Mutex::new(G8lS544ReachableReadinessProducerState::new());

/// CPU1-only boot hook.  It runs before G8h's task-stack handoff and therefore
/// outside the PPI27 handler that made the S543 producer unreachable.
#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn service_s544_reachable_readiness_before_g8h_timer_arm_on_cpu1(
) -> Result<G8lS544ReachableReadinessProducerOutcome, G8lS544ReachableReadinessProducerError> {
    use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s431_runtime_evidence_contract::{
        canonical_s431_to_s535_acceptance_descriptor,
        inspect_s431_to_s535_production_acceptance_ledger_on_cpu1,
        service_s431_to_s535_production_acceptance_gate_on_cpu1,
        G8lS431ToS535AcceptanceOutcome,
    };
    use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s536_r1_physical_boot_uart_evidence_contract::G8lS536R1PhysicalBootUartEvidenceOutcome;
    use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s537_r1_physical_boot_uart_evidence_request::G8lS537R1PhysicalBootUartEvidenceRequestOutcome;

    if crate::percpu::try_current_cpu_id() != Some(S541_READY_PRODUCER_CPU) {
        return Err(G8lS544ReachableReadinessProducerError::WrongCpu);
    }
    let timer_control_before = crate::arch::aarch64::timer::read_control();
    if timer_control_before & 0b11 != S544_REQUIRED_TIMER_CONTROL {
        return Err(G8lS544ReachableReadinessProducerError::TimerNotDisabled);
    }

    for sequence in S544_ACCEPTANCE_LEDGER_FIRST_SEQUENCE..=S544_ACCEPTANCE_LEDGER_LAST_SEQUENCE {
        let descriptor = canonical_s431_to_s535_acceptance_descriptor(sequence)
            .ok_or(G8lS544ReachableReadinessProducerError::AcceptanceLedgerNotReady)?;
        match service_s431_to_s535_production_acceptance_gate_on_cpu1(descriptor)
            .map_err(|_| G8lS544ReachableReadinessProducerError::AcceptanceLedgerService)?
        {
            G8lS431ToS535AcceptanceOutcome::Advanced(..)
            | G8lS431ToS535AcceptanceOutcome::Retained(..)
            | G8lS431ToS535AcceptanceOutcome::AlreadyCompleted { .. } => {}
            G8lS431ToS535AcceptanceOutcome::AwaitingS430
            | G8lS431ToS535AcceptanceOutcome::AwaitingPredecessor { .. } => {
                return Err(G8lS544ReachableReadinessProducerError::AcceptanceLedgerNotReady)
            }
        }
    }
    let ledger = inspect_s431_to_s535_production_acceptance_ledger_on_cpu1()
        .map_err(|_| G8lS544ReachableReadinessProducerError::AcceptanceLedgerService)?
        .ok_or(G8lS544ReachableReadinessProducerError::AcceptanceLedgerNotReady)?;
    if ledger.last_completed_sequence != S544_ACCEPTANCE_LEDGER_LAST_SEQUENCE
        || ledger.completed_block_count != 15
        || ledger.supported_profile_runtime_observations != 0
        || ledger.physical_observations != 0
        || ledger.r2_product_acceptance_complete
    {
        return Err(G8lS544ReachableReadinessProducerError::AcceptanceLedgerNotReady);
    }

    match crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s536_r1_physical_boot_uart_evidence_contract::service_s536_r1_physical_boot_uart_evidence_contract_on_cpu1()
        .map_err(|_| G8lS544ReachableReadinessProducerError::S536Service)?
    {
        G8lS536R1PhysicalBootUartEvidenceOutcome::ContractPublished(..)
        | G8lS536R1PhysicalBootUartEvidenceOutcome::ContractRetained(..) => {}
        G8lS536R1PhysicalBootUartEvidenceOutcome::AwaitingS535 => {
            return Err(G8lS544ReachableReadinessProducerError::S536NotReady)
        }
    }
    match crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s537_r1_physical_boot_uart_evidence_request::service_s537_r1_physical_boot_uart_evidence_request_on_cpu1()
        .map_err(|_| G8lS544ReachableReadinessProducerError::S537Service)?
    {
        G8lS537R1PhysicalBootUartEvidenceRequestOutcome::RequestPublished(..)
        | G8lS537R1PhysicalBootUartEvidenceRequestOutcome::RequestRetained(..) => {}
        G8lS537R1PhysicalBootUartEvidenceRequestOutcome::AwaitingS536 => {
            return Err(G8lS544ReachableReadinessProducerError::S537NotReady)
        }
    }
    let s541_outcome = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s541_r1_cross_cpu_marker_readiness_handoff::service_s541_readiness_handoff_on_cpu1()
        .map_err(|_| G8lS544ReachableReadinessProducerError::S541Service)?;
    let timer_control_after = crate::arch::aarch64::timer::read_control();
    service_s544_model_reachable_readiness_producer(
        &mut S544_PRODUCTION_STATE.lock(),
        S541_READY_PRODUCER_CPU,
        true,
        true,
        false,
        timer_control_before,
        timer_control_after,
        s541_outcome,
    )
}

use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s536_r1_physical_boot_uart_evidence_contract::{
    G8lS536R1PhysicalBootUartEvidenceReceipt, S536_EXPECTED_PREDECESSOR,
    S536_PRIOR_FOCUSED_GROUPS, S536_PRIOR_FOCUSED_TESTS, S536_SEQUENCE,
};
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s537_r1_physical_boot_uart_evidence_request::{
    canonical_s537_request, G8lS537R1PhysicalBootUartEvidenceRequestReceipt,
};
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s538_r1_boot_ui_marker_runtime_wiring::{
    service_s538_model_marker_route_preflight, G8lS538BootUiMarkerRuntimeOutcome,
    G8lS538BootUiMarkerRuntimeState, G8lS538MarkerRoutePreflightReceipt,
    S538_PREFLIGHT_CPU,
};
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s541_r1_cross_cpu_marker_readiness_handoff::{
    service_s541_model_cpu1_readiness_handoff, G8lS541ReadinessHandoffOutcome,
    G8lS541ReadinessHandoffState, S541_READY_PRODUCER_CPU,
};
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s544_r1_reachable_readiness_producer_remediation::*;
use std::collections::BTreeSet;

const SOURCE: &str = include_str!(
    "../../kernel/src/g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s544_r1_reachable_readiness_producer_remediation.rs"
);
const MAIN: &str = include_str!("../../kernel/src/main.rs");
const SIMULATION_LIB: &str = include_str!("../src/lib.rs");
const EXCEPTIONS: &str = include_str!("../../kernel/src/arch/aarch64/exceptions.rs");
const G8H: &str = include_str!("../../kernel/src/rpi5_g8h.rs");
const S543_RAW: &[u8] =
    include_bytes!("../../evidence/rpi5/r1/sequence-543-remediated-physical-retry/s543-uart.raw");

fn s536_receipt() -> G8lS536R1PhysicalBootUartEvidenceReceipt {
    G8lS536R1PhysicalBootUartEvidenceReceipt {
        sequence: S536_SEQUENCE,
        predecessor_sequence: S536_EXPECTED_PREDECESSOR,
        anchor_attempt_id: 0x5440_0000_0000_0001,
        completed_readiness_blocks: 15,
        prior_focused_groups: S536_PRIOR_FOCUSED_GROUPS,
        prior_focused_tests: S536_PRIOR_FOCUSED_TESTS,
        contract_published: true,
        supported_profile_runtime_observations: 0,
        physical_observations: 0,
        uart_capture_observed: false,
        boot_to_ui_observed: false,
        r1_acceptance_complete: false,
        runbook_executed: false,
    }
}

fn s537_receipt(request_id: u64) -> G8lS537R1PhysicalBootUartEvidenceRequestReceipt {
    G8lS537R1PhysicalBootUartEvidenceRequestReceipt {
        request: canonical_s537_request(s536_receipt(), request_id),
        request_published: true,
        supported_profile_runtime_observations: 0,
        physical_observations: 0,
        uart_capture_observed: false,
        boot_to_ui_observed: false,
        r1_acceptance_complete: false,
        runbook_executed: false,
    }
}

fn preflight(request_id: u64) -> G8lS538MarkerRoutePreflightReceipt {
    let mut state = G8lS538BootUiMarkerRuntimeState::new();
    let G8lS538BootUiMarkerRuntimeOutcome::PreflightArmed(preflight) =
        service_s538_model_marker_route_preflight(
            &mut state,
            S538_PREFLIGHT_CPU,
            Some(s537_receipt(request_id)),
        )
        .unwrap()
    else {
        panic!("S538 preflight must arm")
    };
    preflight
}

fn s541_published(request_id: u64) -> G8lS541ReadinessHandoffOutcome {
    let mut state = G8lS541ReadinessHandoffState::new();
    service_s541_model_cpu1_readiness_handoff(
        &mut state,
        S541_READY_PRODUCER_CPU,
        G8lS538BootUiMarkerRuntimeOutcome::PreflightArmed(preflight(request_id)),
    )
    .unwrap()
}

fn publish(
    state: &mut G8lS544ReachableReadinessProducerState,
    request_id: u64,
) -> Result<G8lS544ReachableReadinessProducerOutcome, G8lS544ReachableReadinessProducerError> {
    service_s544_model_reachable_readiness_producer(
        state,
        S541_READY_PRODUCER_CPU,
        true,
        true,
        false,
        S544_REQUIRED_TIMER_CONTROL,
        S544_REQUIRED_TIMER_CONTROL,
        s541_published(request_id),
    )
}

#[test]
fn sequence_scope_and_nonpromotion_are_exact() {
    assert_eq!(S544_SEQUENCE, 544);
    assert_eq!(S544_EXPECTED_PREDECESSOR, 543);
    assert_eq!(S544_REMEDIATES_SEQUENCE, 543);
    assert_eq!(S544_REQUIRED_TIMER_CONTROL, 0b10);
    assert_eq!(S544_ACCEPTANCE_LEDGER_FIRST_SEQUENCE, 431);
    assert_eq!(S544_ACCEPTANCE_LEDGER_LAST_SEQUENCE, 535);
    assert_eq!(S544_ACCEPTANCE_LEDGER_GATE_COUNT, 105);
    assert_eq!(S544_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS, 0);
    assert_eq!(S544_PHYSICAL_OBSERVATIONS, 0);
    assert_eq!(S544_PHYSICAL_OR_DEVICE_OPERATIONS, 0);
    assert_eq!(S544_SD_WRITES, 0);
    assert_eq!(S544_UART_OPENS, 0);
    assert_eq!(S544_POWER_TRANSITIONS, 0);
    assert_eq!(S544_NEW_IMMUTABLE_RAW_CAPTURES, 0);
    assert!(S544_S543_PHYSICAL_VERDICT_RETAINED_RED);
    assert!(!S544_AUTOMATIC_S543_PROMOTION);
    assert!(!S544_BOOT_TO_UI_PHYSICALLY_OBSERVED);
    assert!(!S544_R1_ACCEPTANCE_COMPLETE);
    assert!(!RUNBOOK_EXECUTED_IN_S544);
}

#[test]
fn exact_s541_release_receipt_publishes_reachable_s544_receipt() {
    let mut state = G8lS544ReachableReadinessProducerState::new();
    let G8lS544ReachableReadinessProducerOutcome::Published(receipt) =
        publish(&mut state, 0x5441).unwrap()
    else {
        panic!("first S544 publication missing")
    };
    assert_eq!(state.receipt(), Some(receipt));
    assert_eq!(receipt.sequence, S544_SEQUENCE);
    assert_eq!(receipt.predecessor_sequence, S544_EXPECTED_PREDECESSOR);
    assert_eq!(receipt.remediates_sequence, S544_REMEDIATES_SEQUENCE);
    assert!(s541_readiness_is_exact_for_s544(receipt.s541_readiness));
    assert!(receipt.g8h_stage_released);
    assert!(receipt.irqs_masked);
    assert!(!receipt.inside_g8h_irq_handler);
    assert_eq!(receipt.timer_control_before, 0b10);
    assert_eq!(receipt.timer_control_after, 0b10);
    assert!(receipt.before_g8h_timer_arm);
    assert!(receipt.before_g8h_terminal_timer_disable);
    assert!(receipt.s543_physical_verdict_retained_red);
    assert!(!receipt.automatic_s543_promotion);
    assert_eq!(receipt.supported_profile_runtime_observations, 0);
    assert_eq!(receipt.physical_observations, 0);
    assert!(!receipt.runbook_executed);
}

#[test]
fn exact_replay_retains_the_same_receipt() {
    let mut state = G8lS544ReachableReadinessProducerState::new();
    let G8lS544ReachableReadinessProducerOutcome::Published(receipt) =
        publish(&mut state, 0x5442).unwrap()
    else {
        panic!("first publication missing")
    };
    assert_eq!(
        publish(&mut state, 0x5442),
        Ok(G8lS544ReachableReadinessProducerOutcome::Retained(receipt))
    );
}

#[test]
fn different_request_after_publication_fails_closed() {
    let mut state = G8lS544ReachableReadinessProducerState::new();
    publish(&mut state, 0x5443).unwrap();
    assert_eq!(
        publish(&mut state, 0x5444),
        Err(G8lS544ReachableReadinessProducerError::PublishedStateDrift)
    );
}

#[test]
fn wrong_cpu_is_rejected_before_publication() {
    let mut state = G8lS544ReachableReadinessProducerState::new();
    assert_eq!(
        service_s544_model_reachable_readiness_producer(
            &mut state,
            0,
            true,
            true,
            false,
            0b10,
            0b10,
            s541_published(0x5445),
        ),
        Err(G8lS544ReachableReadinessProducerError::WrongCpu)
    );
    assert_eq!(state.receipt(), None);
}

#[test]
fn unreleased_g8h_stage_is_rejected() {
    let mut state = G8lS544ReachableReadinessProducerState::new();
    assert_eq!(
        service_s544_model_reachable_readiness_producer(
            &mut state,
            1,
            false,
            true,
            false,
            0b10,
            0b10,
            s541_published(0x5446),
        ),
        Err(G8lS544ReachableReadinessProducerError::G8hStageNotReleased)
    );
}

#[test]
fn unmasked_irq_context_is_rejected() {
    let mut state = G8lS544ReachableReadinessProducerState::new();
    assert_eq!(
        service_s544_model_reachable_readiness_producer(
            &mut state,
            1,
            true,
            false,
            false,
            0b10,
            0b10,
            s541_published(0x5447),
        ),
        Err(G8lS544ReachableReadinessProducerError::IrqsNotMasked)
    );
}

#[test]
fn g8h_irq_handler_context_is_explicitly_rejected() {
    let mut state = G8lS544ReachableReadinessProducerState::new();
    assert_eq!(
        service_s544_model_reachable_readiness_producer(
            &mut state,
            1,
            true,
            true,
            true,
            0b10,
            0b10,
            s541_published(0x5448),
        ),
        Err(G8lS544ReachableReadinessProducerError::InsideG8hIrqHandler)
    );
}

#[test]
fn timer_must_stay_disabled_across_the_hook() {
    for (before, after) in [(0b01, 0b10), (0b10, 0b01), (0b11, 0b10)] {
        let mut state = G8lS544ReachableReadinessProducerState::new();
        assert_eq!(
            service_s544_model_reachable_readiness_producer(
                &mut state,
                1,
                true,
                true,
                false,
                before,
                after,
                s541_published(0x5449),
            ),
            Err(G8lS544ReachableReadinessProducerError::TimerNotDisabled)
        );
    }
}

#[test]
fn retry_or_cpu0_only_s541_outcomes_cannot_publish_s544() {
    let mut state = G8lS544ReachableReadinessProducerState::new();
    let retry = G8lS541ReadinessHandoffOutcome::Cpu1RetryScheduled {
        retry_attempts: 1,
        remaining_attempts: 1023,
    };
    assert_eq!(
        service_s544_model_reachable_readiness_producer(
            &mut state, 1, true, true, false, 0b10, 0b10, retry,
        ),
        Err(G8lS544ReachableReadinessProducerError::S541ReadinessNotPublished)
    );
    let awaiting = G8lS541ReadinessHandoffOutcome::Cpu0AwaitingReadiness {
        poll_attempts: 1,
        remaining_attempts: 1,
    };
    assert_eq!(
        service_s544_model_reachable_readiness_producer(
            &mut state, 1, true, true, false, 0b10, 0b10, awaiting,
        ),
        Err(G8lS544ReachableReadinessProducerError::S541ReadinessNotPublished)
    );
}

#[test]
fn mutated_s541_receipt_is_rejected() {
    let G8lS541ReadinessHandoffOutcome::Cpu1ReadinessPublished(mut readiness) =
        s541_published(0x5450)
    else {
        panic!("S541 publication missing")
    };
    readiness.sequence = 542;
    let mut state = G8lS544ReachableReadinessProducerState::new();
    assert_eq!(
        service_s544_model_reachable_readiness_producer(
            &mut state,
            1,
            true,
            true,
            false,
            0b10,
            0b10,
            G8lS541ReadinessHandoffOutcome::Cpu1ReadinessPublished(readiness),
        ),
        Err(G8lS544ReachableReadinessProducerError::S541ReceiptDrift)
    );
}

#[test]
fn diagnostic_codes_are_nonzero_and_unique() {
    let errors = [
        G8lS544ReachableReadinessProducerError::WrongCpu,
        G8lS544ReachableReadinessProducerError::G8hStageNotReleased,
        G8lS544ReachableReadinessProducerError::IrqsNotMasked,
        G8lS544ReachableReadinessProducerError::InsideG8hIrqHandler,
        G8lS544ReachableReadinessProducerError::TimerNotDisabled,
        G8lS544ReachableReadinessProducerError::AcceptanceLedgerService,
        G8lS544ReachableReadinessProducerError::AcceptanceLedgerNotReady,
        G8lS544ReachableReadinessProducerError::S536Service,
        G8lS544ReachableReadinessProducerError::S536NotReady,
        G8lS544ReachableReadinessProducerError::S537Service,
        G8lS544ReachableReadinessProducerError::S537NotReady,
        G8lS544ReachableReadinessProducerError::S541Service,
        G8lS544ReachableReadinessProducerError::S541ReadinessNotPublished,
        G8lS544ReachableReadinessProducerError::S541ReceiptDrift,
        G8lS544ReachableReadinessProducerError::PublishedStateDrift,
    ];
    let codes: BTreeSet<_> = errors
        .into_iter()
        .map(G8lS544ReachableReadinessProducerError::diagnostic_code)
        .collect();
    assert_eq!(codes.len(), errors.len());
    assert!(!codes.contains(&0));
}

#[test]
fn module_is_registered_in_kernel_and_simulation() {
    let module = "g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s544_r1_reachable_readiness_producer_remediation";
    assert!(MAIN.contains(&format!("mod {module};")));
    assert!(SIMULATION_LIB.contains(&format!("pub mod {module};")));
}

#[test]
fn historical_s544_service_is_retained_but_s569_supersedes_its_g8h_callsite() {
    let secondary = G8H
        .split("pub extern \"C\" fn rpi5_g8h_secondary_run() -> !")
        .nth(1)
        .unwrap();
    let identity = secondary.find("validate_identity_or_fail();").unwrap();
    let s569 = secondary
        .find("service_s569_frozen_manifest_readiness_before_g8h_timer_arm_on_cpu1()")
        .unwrap();
    let task_stack = secondary.find("rpi5_g8c_call_on_stack").unwrap();
    let handler = secondary
        .find("pub fn rpi5_g8h_try_handle_secondary_irq")
        .unwrap();
    let timer_disable = secondary[handler..]
        .find("rpi5_g8g_disable_local_timer")
        .unwrap()
        + handler;
    assert!(identity < s569 && s569 < task_stack && task_stack < timer_disable);
    assert!(!G8H.contains("service_s544_reachable_readiness_before_g8h_timer_arm_on_cpu1()"));
    assert!(SOURCE.contains("pub fn service_s544_reachable_readiness_before_g8h_timer_arm_on_cpu1"));
}

#[test]
fn production_service_drives_exact_ledger_then_s536_s537_s541() {
    let ledger = SOURCE
        .find("for sequence in S544_ACCEPTANCE_LEDGER_FIRST_SEQUENCE")
        .unwrap();
    let s536 = SOURCE
        .find("service_s536_r1_physical_boot_uart_evidence_contract_on_cpu1()")
        .unwrap();
    let s537 = SOURCE
        .find("service_s537_r1_physical_boot_uart_evidence_request_on_cpu1()")
        .unwrap();
    let s541 = SOURCE
        .find("service_s541_readiness_handoff_on_cpu1()")
        .unwrap();
    assert!(ledger < s536 && s536 < s537 && s537 < s541);
    assert!(SOURCE.contains("canonical_s431_to_s535_acceptance_descriptor(sequence)"));
    assert!(SOURCE.contains("ledger.last_completed_sequence"));
    assert!(SOURCE.contains("ledger.completed_block_count != 15"));
}

#[test]
fn historical_generic_timer_producer_remains_below_the_g8h_early_return() {
    let interceptor = EXCEPTIONS
        .find("crate::rpi5_g8h::rpi5_g8h_try_handle_secondary_irq")
        .unwrap();
    let generic_timer = EXCEPTIONS.find("if let Some(_tick) = timer_tick").unwrap();
    let historical = EXCEPTIONS
        .find("service_s541_readiness_handoff_on_cpu1()")
        .unwrap();
    assert!(interceptor < generic_timer && generic_timer < historical);
    assert!(!EXCEPTIONS.contains("service_s544_reachable_readiness_before_g8h_timer_arm_on_cpu1"));
    assert!(!G8H.contains("service_s544_reachable_readiness_before_g8h_timer_arm_on_cpu1"));
    assert!(G8H.contains("service_s569_frozen_manifest_readiness_before_g8h_timer_arm_on_cpu1"));
}

#[test]
fn source_has_no_device_execution_or_uart_emission_surface() {
    for forbidden in [
        "std::process::Command",
        "/dev/disk",
        "/dev/cu.",
        "diskutil",
        "dd if=",
        "TIOCEXCL",
        "crate::kprintln!",
    ] {
        assert!(!SOURCE.contains(forbidden), "forbidden token: {forbidden}");
    }
    assert!(SOURCE.contains("performs no device operation"));
    assert!(SOURCE.contains("does not rerun S543"));
}

#[test]
fn immutable_s543_raw_is_not_changed_or_promoted_by_s544() {
    assert_eq!(S543_RAW.len(), 20_509);
    assert!(S543_RAW
        .windows(b"ASELSAN/S541ERR Cpu0ReadinessTimeout".len())
        .any(|window| window == b"ASELSAN/S541ERR Cpu0ReadinessTimeout"));
    assert!(!S543_RAW
        .windows(b"[R1:S536] BOOT_TO_UI_READY".len())
        .any(|window| window == b"[R1:S536] BOOT_TO_UI_READY"));
    assert!(S544_S543_PHYSICAL_VERDICT_RETAINED_RED);
    assert!(!S544_AUTOMATIC_S543_PROMOTION);
}

#[test]
fn source_only_gate_keeps_runtime_physical_and_r1_claims_zero() {
    assert!(SOURCE.contains("S544_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS: usize = 0"));
    assert!(SOURCE.contains("S544_PHYSICAL_OBSERVATIONS: usize = 0"));
    assert!(SOURCE.contains("S544_PHYSICAL_OR_DEVICE_OPERATIONS: usize = 0"));
    assert!(SOURCE.contains("S544_R1_ACCEPTANCE_COMPLETE: bool = false"));
    assert!(SOURCE.contains("RUNBOOK_EXECUTED_IN_S544: bool = false"));
}

  {
    id: "g8l-s544-r1-reachable-readiness-producer-remediation",
    date: "2026-08-30",
    sequence: 544,
    status: "passed",
    umbrella_status: "partial",
    title: "S544 · R1 reachable-readiness producer remediation",
    summary:
      "S544 kaynak kapısı PASS'tir: S543 raw'ının gösterdiği unreachable CPU1 readiness producer, G8h CPU1 yolunda exact stage ve gerçek CPU kimliği doğrulandıktan sonra, IRQ'lar maskeli ve timer ctl=0b10 iken task-stack/timer arm sınırından önce ulaşılabilir bir production çağrı noktasına taşındı. Çağrı S431–S535 canonical 105-gate/15-block ledger'ını, ardından S536, S537 ve S541 readiness handoff'unu fail-closed sırayla yürütür; S544 receipt'i bundan sonra tutulur. Focused 19/19, selected S536–S544 dokuz grup / 156/156 ve dört fresh AArch64 profil 4/4 PASS'tir. S543 fiziksel raw/verdict değişmez RED, runtime/physical observation=0/0, SD/UART/power/new-raw=0/0/0/0, Boot-to-UI=false ve R1 acceptance=false'dur. S545 yeni S544 hook'unu içeren host-only candidate freeze kapısıdır.",
    evidence: [
      "S544, S543'ten ayrı production source module, 19-test focused binary, explicit rpi5_g8h.rs callsite, proof, status manifest, Operations kaydı, Timeline/Yol Haritası açıklaması ve complete Code kartına sahiptir.",
      "Dar S544 source-remediation status=PASS; R1 umbrella=PARTIAL ve S543 physical gate status=RED olarak ayrı tutulur.",
      "Production producer yalnız CPU1'de ve exact G8h stage-released + hardware CPU identity doğrulamasından sonra çağrılır.",
      "Çağrı sırasında IRQ maskesi zorunludur; G8h timer control değeri çağrı öncesi ve sonrası exact 0b10'dur.",
      "S544 hook'u G8h IRQ handler'ının dışında, task stack hazırlanmasından ve G8h timer arm edilmesinden önce yer alır; terminal timer-disable yoluna bırakılmaz.",
      "Hook önce S431–S535 canonical descriptor sırasını reconcile eder; ledger exact S535, 105 gate, 15 block ve runtime/physical observation=0 sınırında değilse fail-closed döner.",
      "Ledger sonrasında exact sıra S536 contract publish/retain → S537 request publish/retain → S541 CPU1 readiness publish/retain → S544 receipt retain biçimindedir.",
      "S541 sonucu yalnız Cpu1ReadinessPublished veya Cpu1ReadinessRetained ise kabul edilir; awaiting veya drift sonuçları G8h'nin mevcut primary-validation hata kanalına map edilir.",
      "S544 yeni UART satırı basmaz, marker'ı preflight'siz üretmez ve CPU0 completion yolunu taklit etmez.",
      "Focused target 1 grup / 19 passed / 0 failed / 0 ignored / 0 filtered verdi.",
      "Selected S536–S544 dokuz ayrı targetta 15+15+15+16+17+20+21+18+19 = 156 passed / 0 failed verdi.",
      "Tarihsel S538 source reconstruction ilk seçili koşuda yeni S544 block'u nedeniyle 14/15 RED verdi; explicit S544 delimiter'ları tarihsel reconstruction'dan çıkarıldıktan sonra exact 86590 B predecessor identity ile 15/15 PASS oldu. Ürün davranışı bu test düzeltmesinde değiştirilmedi.",
      "Fresh board-qemu build exit 0 verdi: log 111730 B / e2ed332cef58f99b0740b96c5c067097b29f2bb029dfe3231276e2260bd86e61 / 293 warning header; ELF 12623752 B / 0ee341f8eec166cf764a2151a3107fee2bdb35f7e51371e87caf08a961d80a5b.",
      "Fresh board-rpi4 build exit 0 verdi: log 150347 B / 552867ae85017c6b51c3aab30a5ade2af220772ebe0ce741df4aac04bae0cd0e / 391 warning header; ELF 7747728 B / ef2677fe15cda152aa116576c1e786014cd65e802c8930496cd1fdab9441b498.",
      "Fresh board-rpi5 build exit 0 verdi: log 1135575 B / fd91ae44ede740f8b15a7d40cb7fd7ca0f906c1062ad45cb36474f4c66e818d1 / 2865 warning header; ELF 18966024 B / ee565bf6887006787cdf22692ab9ef36d66d5957ff62025caa461a005c2b81cd.",
      "Fresh board-rpi5+smp build exit 0 verdi: log 1135464 B / 7efcd597f7b7a2d6227e0a7b3f0b5d78723f0342696afb829fe87ad58d34bf34 / 2865 warning header; ELF 18948504 B / 319bdedaa201ab2282c13c54f20d0e2d6bac2f3d8ebf161e3664b154bb980b08.",
      "Dört profil 4/4 exit 0'dır; warning başlıkları görünür biçimde sayılmıştır ve zero-warning iddiası kurulmaz.",
      "Implementation 14025 B / 8dbce1b30b8c8bdd469cb7ee34a24adf63bc1863e40958c9ec0e27a925f924f7; focused test 17031 B / 289a1658c74b8b37293f9d9bf65604800612161aae57fc593b5aedeecebeeb12 SHA-256'dır. Tarihsel modül korunur; G8h production callsite'ı S569 tarafından supersede edilmiştir.",
      "Proof 4495 B / 6bdb83b1cada941262b499376303297b305baeb476995606b9c7a76347e7b446 SHA-256'dır.",
      "S543 immutable raw 20509 B / 1f1111a1a39ab6263b505b0889d025df19d5c48bb2f84e30708412b0da47dc11 ve physical verdict RED olarak byte-exact korunur; automatic promotion=false ve rerun=false'dur.",
      "S544 sırasında candidate freeze, SD write/read-back/eject, UART open/capture, power transition, physical retry veya yeni immutable raw üretimi yapılmadı.",
      "RUNBOOK_EXECUTED_IN_S544=NO; supported-profile runtime observations=0, physical observations=0, Boot-to-UI physically observed=false ve R1 acceptance=false'dur.",
      "S545 yalnız host üzerinde S544 hook'unu içeren yeni board-rpi5 candidate'ı reproducible biçimde dondurup kimliğini sabitleyecektir; aygıt veya fiziksel koşu yetkisi değildir.",
    ],
    commands: [
      "cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s544_r1_reachable_readiness_producer_remediation -- --test-threads=1",
      "run S536-S544 focused targets serially",
      "run four isolated AArch64 profile builds with CARGO_INCREMENTAL=0",
      "python3 scripts/render-project-status.py --write && python3 scripts/render-project-status.py --check",
      "npm run code:generate && npm run code:check && npm test && npm run lint && npx tsc --noEmit && npm run build",
    ],
    terminalSessions: [
      {
        id: "s544-focused-and-selected",
        title: "S544 reachable producer focused ve predecessor regression",
        commandLines: [
          "run S544 focused target serially",
          "run S536-S544 focused targets serially",
        ],
        outputLines: [
          "S544 focused=1 group / 19 passed / 0 failed",
          "selected=9 groups / 156 passed / 0 failed",
          "historical S538 reconstruction initial=14/15; exact later-block stripping final=15/15",
          "S543 raw/verdict retained RED; automatic promotion=false",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "s544-aarch64-profiles",
        title: "S544 four-profile production source compilation",
        commandLines: [
          "run fresh isolated board-qemu, board-rpi4, board-rpi5 and board-rpi5+smp builds",
        ],
        outputLines: [
          "profiles=4/4 exit 0",
          "warning headers=293/391/2865/2865; zero-warning claim=false",
          "RPi5 ELF=18966024 B / ee565bf6…b81cd",
          "RPi5+smp ELF=18948504 B / 319bdeda…980b08",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "s544-publication",
        title: "S544 Operations/Timeline/Code publication acceptance",
        commandLines: [
          "npm run code:generate && npm run code:check",
          "npm test && npm run lint && npx tsc --noEmit && npm run build",
          "npm run deploy; cache-busted custom-domain byte-exact readback",
        ],
        outputLines: [
          "S544 source PASS, R1 PARTIAL and S543 physical RED remain distinct",
          "Code S544 binds the complete implementation, complete focused target and complete Operations record",
          "publication metrics and deployment receipt are recorded in the canonical status manifest after verification",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
    ],
    terminalSessionsNote:
      "S544 kaynak remediation PASS'tir; supported-profile runtime veya fiziksel PASS değildir. S543 RED raw ve kararı değişmez.",
    limitations: [
      "S544 üretim çağrı noktası derlenmiş ve source-bound doğrulanmıştır; supported RPi5 runtime invocation henüz gözlenmemiştir.",
      "BOOT_TO_UI_READY gerçek UART'ta görülmedi; Boot-to-UI ve R1 acceptance false kalır.",
      "S543 raw/verdict otomatik yükseltilmez veya yeniden yazılmaz.",
      "Fresh build warning sayıları sıfır değildir.",
      "S545 host-only candidate freeze tamamlanmadan yeni fiziksel retry adayı yoktur.",
      "Yeni SD/UART/power koşusu ayrı kapı, fresh target revalidation, açık operatör yetkisi ve yeni immutable raw ister.",
    ],
  },