S541 · R1 cross-CPU marker readiness handoff remediation

#![allow(unexpected_cfgs)]

//! S541 remediates the cross-CPU readiness race observed by physical S540.
//!
//! S540 remains an immutable RED observation.  This source-only gate makes
//! CPU1's exact S538 preflight receipt a mandatory Release/Acquire handoff
//! before CPU0 may enter the existing S538 marker completion path.  An
//! `AwaitingS537` result schedules bounded retries; it never publishes the
//! readiness word.  S541 performs no SD, UART, power, or physical operation
//! and cannot promote S540 or claim a new physical PASS.

use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s538_r1_boot_ui_marker_runtime_wiring::{
    complete_s538_model_boot_ui_marker_route, G8lS538BootUiMarkerRuntimeError,
    G8lS538BootUiMarkerRuntimeOutcome, G8lS538BootUiMarkerRuntimeState,
    G8lS538BootUiSurfaceReceipt, G8lS538CandidateRuntimeIdentity,
    G8lS538MarkerRoutePreflightReceipt, S538_EXPECTED_PREDECESSOR,
    S538_MARKER_EMITTER_CPU, S538_PHYSICAL_OBSERVATIONS, S538_PREFLIGHT_CPU,
    S538_SEQUENCE, S538_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS,
};

pub const S541_SEQUENCE: usize = 541;
pub const S541_EXPECTED_PREDECESSOR: usize = 540;
pub const S541_REMEDIATES_SEQUENCE: usize = 540;
pub const S541_READY_PRODUCER_CPU: usize = S538_PREFLIGHT_CPU;
pub const S541_READY_CONSUMER_CPU: usize = S538_MARKER_EMITTER_CPU;
pub const S541_CPU1_SAME_IRQ_RETRY_LIMIT: u32 = 4;
pub const S541_CPU1_TOTAL_RETRY_LIMIT: u32 = 1_024;
pub const S541_CPU0_READINESS_TIMEOUT_SECONDS: u64 = 5;
pub const S541_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS: usize = 0;
pub const S541_PHYSICAL_OBSERVATIONS: usize = 0;
pub const S541_PHYSICAL_OR_DEVICE_OPERATIONS: usize = 0;
pub const S541_SD_WRITES: usize = 0;
pub const S541_UART_OPENS: usize = 0;
pub const S541_POWER_TRANSITIONS: usize = 0;
pub const S541_NEW_IMMUTABLE_RAW_CAPTURES: usize = 0;
pub const S541_S540_PHYSICAL_VERDICT_RETAINED_RED: bool = true;
pub const S541_AUTOMATIC_S540_PROMOTION: bool = false;
pub const S541_BOOT_TO_UI_PHYSICALLY_OBSERVED: bool = false;
pub const S541_R1_ACCEPTANCE_COMPLETE: bool = false;
pub const RUNBOOK_EXECUTED_IN_S541: bool = false;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS541ReadinessReceipt {
    pub sequence: usize,
    pub predecessor_sequence: usize,
    pub remediates_sequence: usize,
    pub preflight: G8lS538MarkerRoutePreflightReceipt,
    pub producer_cpu: usize,
    pub consumer_cpu: usize,
    pub cpu1_retry_attempts: u32,
    pub mandatory_cross_cpu_handoff: bool,
    pub readiness_published: bool,
    pub s540_physical_verdict_retained_red: bool,
    pub automatic_s540_promotion: bool,
    pub supported_profile_runtime_observations: usize,
    pub physical_observations: usize,
    pub runbook_executed: bool,
}

#[derive(Debug)]
pub struct G8lS541ReadinessHandoffState {
    cpu1_retry_attempts: u32,
    cpu0_poll_attempts: u32,
    readiness: Option<G8lS541ReadinessReceipt>,
    completion_authorized: bool,
}

impl G8lS541ReadinessHandoffState {
    pub const fn new() -> Self {
        Self {
            cpu1_retry_attempts: 0,
            cpu0_poll_attempts: 0,
            readiness: None,
            completion_authorized: false,
        }
    }

    pub const fn cpu1_retry_attempts(&self) -> u32 {
        self.cpu1_retry_attempts
    }

    pub const fn cpu0_poll_attempts(&self) -> u32 {
        self.cpu0_poll_attempts
    }

    pub const fn readiness(&self) -> Option<G8lS541ReadinessReceipt> {
        self.readiness
    }

    pub const fn completion_authorized(&self) -> bool {
        self.completion_authorized
    }
}

impl Default for G8lS541ReadinessHandoffState {
    fn default() -> Self {
        Self::new()
    }
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS541ReadinessHandoffOutcome {
    Cpu1RetryScheduled {
        retry_attempts: u32,
        remaining_attempts: u32,
    },
    Cpu1ReadinessPublished(G8lS541ReadinessReceipt),
    Cpu1ReadinessRetained(G8lS541ReadinessReceipt),
    Cpu0AwaitingReadiness {
        poll_attempts: u32,
        remaining_attempts: u32,
    },
    Cpu0CompletionAuthorized(G8lS541ReadinessReceipt),
    Cpu0CompletionAuthorizationRetained(G8lS541ReadinessReceipt),
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS541ReadinessHandoffError {
    WrongCpu,
    Cpu1RetryBudgetExhausted,
    UnexpectedS538Outcome,
    S538(G8lS538BootUiMarkerRuntimeError),
    S536Service,
    S537Service,
    S538PreflightReceiptDrift,
    ReadinessStateDrift,
    CompletionBeforeReadiness,
    CounterUnavailable,
    Cpu0ReadinessTimeout,
}

pub fn s538_preflight_is_exact_for_s541(preflight: G8lS538MarkerRoutePreflightReceipt) -> bool {
    preflight.sequence == S538_SEQUENCE
        && preflight.predecessor_sequence == S538_EXPECTED_PREDECESSOR
        && preflight.request_id != 0
        && preflight.contract_anchor_attempt_id != 0
        && !preflight.target_board.is_empty()
        && !preflight.boot_to_ui_required_marker.is_empty()
        && preflight.route_armed
        && preflight.supported_profile_runtime_observations
            == S538_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS
        && preflight.physical_observations == S538_PHYSICAL_OBSERVATIONS
        && !preflight.runtime_marker_observed
        && !preflight.runbook_executed
}

fn canonical_s541_readiness_receipt(
    preflight: G8lS538MarkerRoutePreflightReceipt,
    cpu1_retry_attempts: u32,
) -> G8lS541ReadinessReceipt {
    G8lS541ReadinessReceipt {
        sequence: S541_SEQUENCE,
        predecessor_sequence: S541_EXPECTED_PREDECESSOR,
        remediates_sequence: S541_REMEDIATES_SEQUENCE,
        preflight,
        producer_cpu: S541_READY_PRODUCER_CPU,
        consumer_cpu: S541_READY_CONSUMER_CPU,
        cpu1_retry_attempts,
        mandatory_cross_cpu_handoff: true,
        readiness_published: true,
        s540_physical_verdict_retained_red: S541_S540_PHYSICAL_VERDICT_RETAINED_RED,
        automatic_s540_promotion: S541_AUTOMATIC_S540_PROMOTION,
        supported_profile_runtime_observations: S541_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS,
        physical_observations: S541_PHYSICAL_OBSERVATIONS,
        runbook_executed: RUNBOOK_EXECUTED_IN_S541,
    }
}

pub fn service_s541_model_cpu1_readiness_handoff(
    state: &mut G8lS541ReadinessHandoffState,
    caller_cpu: usize,
    s538_outcome: G8lS538BootUiMarkerRuntimeOutcome,
) -> Result<G8lS541ReadinessHandoffOutcome, G8lS541ReadinessHandoffError> {
    if caller_cpu != S541_READY_PRODUCER_CPU {
        return Err(G8lS541ReadinessHandoffError::WrongCpu);
    }
    match s538_outcome {
        G8lS538BootUiMarkerRuntimeOutcome::AwaitingS537 => {
            if state.readiness.is_some() {
                return Err(G8lS541ReadinessHandoffError::ReadinessStateDrift);
            }
            if state.cpu1_retry_attempts >= S541_CPU1_TOTAL_RETRY_LIMIT {
                return Err(G8lS541ReadinessHandoffError::Cpu1RetryBudgetExhausted);
            }
            state.cpu1_retry_attempts += 1;
            Ok(G8lS541ReadinessHandoffOutcome::Cpu1RetryScheduled {
                retry_attempts: state.cpu1_retry_attempts,
                remaining_attempts: S541_CPU1_TOTAL_RETRY_LIMIT - state.cpu1_retry_attempts,
            })
        }
        G8lS538BootUiMarkerRuntimeOutcome::PreflightArmed(preflight)
        | G8lS538BootUiMarkerRuntimeOutcome::PreflightRetained(preflight) => {
            if !s538_preflight_is_exact_for_s541(preflight) {
                return Err(G8lS541ReadinessHandoffError::S538PreflightReceiptDrift);
            }
            let receipt = canonical_s541_readiness_receipt(preflight, state.cpu1_retry_attempts);
            if let Some(published) = state.readiness {
                if published != receipt {
                    return Err(G8lS541ReadinessHandoffError::ReadinessStateDrift);
                }
                return Ok(G8lS541ReadinessHandoffOutcome::Cpu1ReadinessRetained(
                    published,
                ));
            }
            state.readiness = Some(receipt);
            Ok(G8lS541ReadinessHandoffOutcome::Cpu1ReadinessPublished(
                receipt,
            ))
        }
        G8lS538BootUiMarkerRuntimeOutcome::MarkerRouteReady(_)
        | G8lS538BootUiMarkerRuntimeOutcome::MarkerRouteRetained(_) => {
            Err(G8lS541ReadinessHandoffError::UnexpectedS538Outcome)
        }
    }
}

pub fn poll_s541_model_cpu0_readiness(
    state: &mut G8lS541ReadinessHandoffState,
    caller_cpu: usize,
    poll_limit: u32,
) -> Result<G8lS541ReadinessHandoffOutcome, G8lS541ReadinessHandoffError> {
    if caller_cpu != S541_READY_CONSUMER_CPU {
        return Err(G8lS541ReadinessHandoffError::WrongCpu);
    }
    if poll_limit == 0 || state.cpu0_poll_attempts >= poll_limit {
        return Err(G8lS541ReadinessHandoffError::Cpu0ReadinessTimeout);
    }
    state.cpu0_poll_attempts += 1;
    if let Some(readiness) = state.readiness {
        if state.completion_authorized {
            return Ok(
                G8lS541ReadinessHandoffOutcome::Cpu0CompletionAuthorizationRetained(readiness),
            );
        }
        state.completion_authorized = true;
        return Ok(G8lS541ReadinessHandoffOutcome::Cpu0CompletionAuthorized(
            readiness,
        ));
    }
    Ok(G8lS541ReadinessHandoffOutcome::Cpu0AwaitingReadiness {
        poll_attempts: state.cpu0_poll_attempts,
        remaining_attempts: poll_limit - state.cpu0_poll_attempts,
    })
}

pub fn complete_s541_model_boot_ui_after_readiness(
    handoff_state: &G8lS541ReadinessHandoffState,
    s538_state: &mut G8lS538BootUiMarkerRuntimeState,
    caller_cpu: usize,
    identity: G8lS538CandidateRuntimeIdentity,
    surface: G8lS538BootUiSurfaceReceipt,
) -> Result<G8lS538BootUiMarkerRuntimeOutcome, G8lS541ReadinessHandoffError> {
    if caller_cpu != S541_READY_CONSUMER_CPU {
        return Err(G8lS541ReadinessHandoffError::WrongCpu);
    }
    if handoff_state.readiness.is_none() || !handoff_state.completion_authorized {
        return Err(G8lS541ReadinessHandoffError::CompletionBeforeReadiness);
    }
    complete_s538_model_boot_ui_marker_route(s538_state, caller_cpu, identity, surface)
        .map_err(G8lS541ReadinessHandoffError::S538)
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
static S541_PRODUCTION_HANDOFF_STATE: spin::Mutex<G8lS541ReadinessHandoffState> =
    spin::Mutex::new(G8lS541ReadinessHandoffState::new());

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
static S541_PRODUCTION_READY_REQUEST_ID: core::sync::atomic::AtomicU64 =
    core::sync::atomic::AtomicU64::new(0);

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
fn retain_s541_production_readiness(
    receipt: G8lS541ReadinessReceipt,
) -> Result<(), G8lS541ReadinessHandoffError> {
    use core::sync::atomic::Ordering;

    match S541_PRODUCTION_READY_REQUEST_ID.compare_exchange(
        0,
        receipt.preflight.request_id,
        Ordering::Release,
        Ordering::Acquire,
    ) {
        Ok(_) => {}
        Err(published) if published == receipt.preflight.request_id => {}
        Err(_) => return Err(G8lS541ReadinessHandoffError::ReadinessStateDrift),
    }
    unsafe {
        core::arch::asm!("dsb ishst", "sev", options(nostack, preserves_flags));
    }
    Ok(())
}

/// CPU1 retry service.  `AwaitingS537` re-services S536/S537 and retries
/// S538 in the same IRQ up to the local budget.  A nonterminal result keeps
/// the global readiness word at zero so a later timer tick must try again.
#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn service_s541_readiness_handoff_on_cpu1(
) -> Result<G8lS541ReadinessHandoffOutcome, G8lS541ReadinessHandoffError> {
    if crate::percpu::try_current_cpu_id() != Some(S541_READY_PRODUCER_CPU) {
        return Err(G8lS541ReadinessHandoffError::WrongCpu);
    }
    let mut last_retry = None;
    for _ in 0..S541_CPU1_SAME_IRQ_RETRY_LIMIT {
        let s538_outcome = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s538_r1_boot_ui_marker_runtime_wiring::service_s538_marker_route_preflight_on_cpu1()
            .map_err(G8lS541ReadinessHandoffError::S538)?;
        let outcome = service_s541_model_cpu1_readiness_handoff(
            &mut S541_PRODUCTION_HANDOFF_STATE.lock(),
            S541_READY_PRODUCER_CPU,
            s538_outcome,
        )?;
        match outcome {
            G8lS541ReadinessHandoffOutcome::Cpu1RetryScheduled { .. } => {
                last_retry = Some(outcome);
                crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s536_r1_physical_boot_uart_evidence_contract::service_s536_r1_physical_boot_uart_evidence_contract_on_cpu1()
                    .map_err(|_| G8lS541ReadinessHandoffError::S536Service)?;
                crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s537_r1_physical_boot_uart_evidence_request::service_s537_r1_physical_boot_uart_evidence_request_on_cpu1()
                    .map_err(|_| G8lS541ReadinessHandoffError::S537Service)?;
            }
            G8lS541ReadinessHandoffOutcome::Cpu1ReadinessPublished(receipt)
            | G8lS541ReadinessHandoffOutcome::Cpu1ReadinessRetained(receipt) => {
                retain_s541_production_readiness(receipt)?;
                return Ok(outcome);
            }
            _ => return Err(G8lS541ReadinessHandoffError::UnexpectedS538Outcome),
        }
    }
    last_retry.ok_or(G8lS541ReadinessHandoffError::UnexpectedS538Outcome)
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
fn wait_for_s541_production_readiness_on_cpu0() -> Result<u64, G8lS541ReadinessHandoffError> {
    use core::sync::atomic::Ordering;

    let frequency = crate::arch::aarch64::timer::read_freq();
    if frequency == 0 {
        return Err(G8lS541ReadinessHandoffError::CounterUnavailable);
    }
    let start = crate::arch::aarch64::timer::read_count();
    let budget = frequency.saturating_mul(S541_CPU0_READINESS_TIMEOUT_SECONDS);
    loop {
        let request_id = S541_PRODUCTION_READY_REQUEST_ID.load(Ordering::Acquire);
        if request_id != 0 {
            return Ok(request_id);
        }
        if crate::arch::aarch64::timer::read_count().wrapping_sub(start) >= budget {
            return Err(G8lS541ReadinessHandoffError::Cpu0ReadinessTimeout);
        }
        core::hint::spin_loop();
    }
}

/// New CPU0 production entry.  The historical S538 terminal function remains
/// unchanged for S540 auditability, but the prior boot stage now reaches it only after this
/// bounded Acquire-side readiness wait succeeds.
#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn enter_s541_readiness_handoff_then_s538_boot_ui_on_cpu0(
    prior_boot_stage_complete: bool,
) -> ! {
    if crate::percpu::try_current_cpu_id() != Some(S541_READY_CONSUMER_CPU) {
        fail_s541_production(G8lS541ReadinessHandoffError::WrongCpu);
    }
    let request_id = match wait_for_s541_production_readiness_on_cpu0() {
        Ok(request_id) => request_id,
        Err(error) => fail_s541_production(error),
    };
    crate::kprintln!(
        "ASELSAN/S541 HANDOFF=CPU1_PREFLIGHT_ARMED PRODUCER=CPU1 CONSUMER=CPU0 REQUEST_ID={} S540=RED_RETAINED PHYSICAL=NOT_RUN",
        request_id,
    );
    crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s538_r1_boot_ui_marker_runtime_wiring::enter_s538_boot_ui_marker_runtime_on_cpu0(prior_boot_stage_complete)
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
fn fail_s541_production(error: G8lS541ReadinessHandoffError) -> ! {
    crate::kprintln!("ASELSAN/S541ERR {:?}", error);
    loop {
        unsafe { core::arch::asm!("wfe", options(nomem, nostack)) }
    }
}

use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s536_r1_physical_boot_uart_evidence_contract::{
    G8lS536R1PhysicalBootUartEvidenceReceipt, S536_EXPECTED_PREDECESSOR,
    S536_PRIOR_FOCUSED_GROUPS, S536_PRIOR_FOCUSED_TESTS, S536_SEQUENCE,
};
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s537_r1_physical_boot_uart_evidence_request::{
    canonical_s537_request, G8lS537R1PhysicalBootUartEvidenceRequestReceipt,
};
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s538_r1_boot_ui_marker_runtime_wiring::{
    service_s538_model_marker_route_preflight, G8lS538BootUiMarkerRuntimeOutcome,
    G8lS538BootUiMarkerRuntimeState, G8lS538BootUiSurfaceReceipt,
    G8lS538CandidateRuntimeIdentity, G8lS538MarkerRoutePreflightReceipt,
    S538_BOOT_UI_SURFACE_CHECKSUM, S538_BOOT_UI_SURFACE_HEIGHT,
    S538_BOOT_UI_SURFACE_PIXELS, S538_BOOT_UI_SURFACE_STRIDE,
    S538_BOOT_UI_SURFACE_WIDTH, S538_CANDIDATE_TAG, S538_EXPECTED_BOARD_NAME,
    S538_EXPECTED_KERNEL_LOAD_ADDRESS, S538_EXPECTED_UART_BASE,
    S538_PREFLIGHT_CPU, S538_UART_CONTROL_ENABLE_MASK,
};
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s540_r1_first_physical_boot_uart_attempt_red::{
    G8lS540PhysicalVerdict, S540_AUTOMATIC_S541_PROMOTION, S540_RAW_BYTES,
    S540_RAW_SHA256, S540_SEQUENCE,
};
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s541_r1_cross_cpu_marker_readiness_handoff::*;

const SOURCE: &str = include_str!(
    "../../kernel/src/g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s541_r1_cross_cpu_marker_readiness_handoff.rs"
);
const MAIN: &str = include_str!("../../kernel/src/main.rs");
const SIMULATION_LIB: &str = include_str!("../src/lib.rs");
const EXCEPTIONS: &str = include_str!("../../kernel/src/arch/aarch64/exceptions.rs");
const G8H: &str = include_str!("../../kernel/src/rpi5_g8h.rs");
const S540_SOURCE: &str = include_str!(
    "../../kernel/src/g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s540_r1_first_physical_boot_uart_attempt_red.rs"
);

fn s536_receipt() -> G8lS536R1PhysicalBootUartEvidenceReceipt {
    G8lS536R1PhysicalBootUartEvidenceReceipt {
        sequence: S536_SEQUENCE,
        predecessor_sequence: S536_EXPECTED_PREDECESSOR,
        anchor_attempt_id: 0x5360_0000_0000_0001,
        completed_readiness_blocks: 15,
        prior_focused_groups: S536_PRIOR_FOCUSED_GROUPS,
        prior_focused_tests: S536_PRIOR_FOCUSED_TESTS,
        contract_published: true,
        supported_profile_runtime_observations: 0,
        physical_observations: 0,
        uart_capture_observed: false,
        boot_to_ui_observed: false,
        r1_acceptance_complete: false,
        runbook_executed: false,
    }
}

fn s537_receipt(request_id: u64) -> G8lS537R1PhysicalBootUartEvidenceRequestReceipt {
    G8lS537R1PhysicalBootUartEvidenceRequestReceipt {
        request: canonical_s537_request(s536_receipt(), request_id),
        request_published: true,
        supported_profile_runtime_observations: 0,
        physical_observations: 0,
        uart_capture_observed: false,
        boot_to_ui_observed: false,
        r1_acceptance_complete: false,
        runbook_executed: false,
    }
}

fn armed_s538_state(
    request_id: u64,
) -> (
    G8lS538BootUiMarkerRuntimeState,
    G8lS538MarkerRoutePreflightReceipt,
) {
    let mut state = G8lS538BootUiMarkerRuntimeState::new();
    let G8lS538BootUiMarkerRuntimeOutcome::PreflightArmed(preflight) =
        service_s538_model_marker_route_preflight(
            &mut state,
            S538_PREFLIGHT_CPU,
            Some(s537_receipt(request_id)),
        )
        .unwrap()
    else {
        panic!("S538 preflight must arm");
    };
    (state, preflight)
}

fn identity() -> G8lS538CandidateRuntimeIdentity {
    let linked_kernel_end = S538_EXPECTED_KERNEL_LOAD_ADDRESS + 0x20_0000;
    G8lS538CandidateRuntimeIdentity {
        candidate_tag: S538_CANDIDATE_TAG,
        board_name: S538_EXPECTED_BOARD_NAME,
        kernel_load_address: S538_EXPECTED_KERNEL_LOAD_ADDRESS,
        linked_kernel_start: S538_EXPECTED_KERNEL_LOAD_ADDRESS,
        linked_kernel_end,
        linked_image_bytes: linked_kernel_end - S538_EXPECTED_KERNEL_LOAD_ADDRESS,
        uart_base: S538_EXPECTED_UART_BASE,
        uart_control: S538_UART_CONTROL_ENABLE_MASK,
        uart_baud: 115_200,
        uart_data_bits: 8,
        uart_stop_bits: 1,
        prior_boot_stage_complete: true,
    }
}

fn surface() -> G8lS538BootUiSurfaceReceipt {
    G8lS538BootUiSurfaceReceipt {
        width: S538_BOOT_UI_SURFACE_WIDTH,
        height: S538_BOOT_UI_SURFACE_HEIGHT,
        stride: S538_BOOT_UI_SURFACE_STRIDE,
        pixel_count: S538_BOOT_UI_SURFACE_PIXELS,
        checksum: S538_BOOT_UI_SURFACE_CHECKSUM,
        retained_scene_layers: 1,
        dirty_regions: 1,
        ui_service_ready: true,
        physical_scanout_observed: false,
        input_observed: false,
    }
}

#[test]
fn s541_sequence_and_claim_boundary_are_exact() {
    assert_eq!(S541_SEQUENCE, 541);
    assert_eq!(S541_EXPECTED_PREDECESSOR, S540_SEQUENCE);
    assert_eq!(S541_REMEDIATES_SEQUENCE, S540_SEQUENCE);
    assert_eq!(S541_READY_PRODUCER_CPU, 1);
    assert_eq!(S541_READY_CONSUMER_CPU, 0);
    assert_eq!(S541_CPU1_SAME_IRQ_RETRY_LIMIT, 4);
    assert_eq!(S541_CPU1_TOTAL_RETRY_LIMIT, 1_024);
    assert_eq!(S541_CPU0_READINESS_TIMEOUT_SECONDS, 5);
    assert_eq!(S541_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS, 0);
    assert_eq!(S541_PHYSICAL_OBSERVATIONS, 0);
    assert_eq!(S541_PHYSICAL_OR_DEVICE_OPERATIONS, 0);
    assert_eq!(S541_NEW_IMMUTABLE_RAW_CAPTURES, 0);
    assert!(S541_S540_PHYSICAL_VERDICT_RETAINED_RED);
    assert!(!S541_AUTOMATIC_S540_PROMOTION);
    assert!(!S541_BOOT_TO_UI_PHYSICALLY_OBSERVED);
    assert!(!S541_R1_ACCEPTANCE_COMPLETE);
    assert!(!RUNBOOK_EXECUTED_IN_S541);
}

#[test]
fn awaiting_s537_schedules_retry_without_publishing_readiness() {
    let mut state = G8lS541ReadinessHandoffState::new();
    assert_eq!(
        service_s541_model_cpu1_readiness_handoff(
            &mut state,
            S541_READY_PRODUCER_CPU,
            G8lS538BootUiMarkerRuntimeOutcome::AwaitingS537,
        ),
        Ok(G8lS541ReadinessHandoffOutcome::Cpu1RetryScheduled {
            retry_attempts: 1,
            remaining_attempts: S541_CPU1_TOTAL_RETRY_LIMIT - 1,
        })
    );
    assert_eq!(state.readiness(), None);
    assert!(!state.completion_authorized());
}

#[test]
fn cpu1_retry_budget_is_finite_and_fails_closed() {
    let mut state = G8lS541ReadinessHandoffState::new();
    for attempt in 1..=S541_CPU1_TOTAL_RETRY_LIMIT {
        let outcome = service_s541_model_cpu1_readiness_handoff(
            &mut state,
            S541_READY_PRODUCER_CPU,
            G8lS538BootUiMarkerRuntimeOutcome::AwaitingS537,
        )
        .unwrap();
        assert!(matches!(
            outcome,
            G8lS541ReadinessHandoffOutcome::Cpu1RetryScheduled {
                retry_attempts,
                ..
            } if retry_attempts == attempt
        ));
    }
    assert_eq!(
        service_s541_model_cpu1_readiness_handoff(
            &mut state,
            S541_READY_PRODUCER_CPU,
            G8lS538BootUiMarkerRuntimeOutcome::AwaitingS537,
        ),
        Err(G8lS541ReadinessHandoffError::Cpu1RetryBudgetExhausted)
    );
}

#[test]
fn cpu1_wrong_cpu_fails_before_mutation() {
    let mut state = G8lS541ReadinessHandoffState::new();
    assert_eq!(
        service_s541_model_cpu1_readiness_handoff(
            &mut state,
            S541_READY_CONSUMER_CPU,
            G8lS538BootUiMarkerRuntimeOutcome::AwaitingS537,
        ),
        Err(G8lS541ReadinessHandoffError::WrongCpu)
    );
    assert_eq!(state.cpu1_retry_attempts(), 0);
}

#[test]
fn exact_s538_preflight_publishes_mandatory_readiness_without_observation() {
    let (_, preflight) = armed_s538_state(0x5370_5410);
    assert!(s538_preflight_is_exact_for_s541(preflight));
    let mut state = G8lS541ReadinessHandoffState::new();
    let G8lS541ReadinessHandoffOutcome::Cpu1ReadinessPublished(receipt) =
        service_s541_model_cpu1_readiness_handoff(
            &mut state,
            S541_READY_PRODUCER_CPU,
            G8lS538BootUiMarkerRuntimeOutcome::PreflightArmed(preflight),
        )
        .unwrap()
    else {
        panic!("S541 readiness missing");
    };
    assert_eq!(receipt.sequence, 541);
    assert_eq!(receipt.predecessor_sequence, 540);
    assert!(receipt.mandatory_cross_cpu_handoff);
    assert!(receipt.readiness_published);
    assert!(receipt.s540_physical_verdict_retained_red);
    assert!(!receipt.automatic_s540_promotion);
    assert_eq!(receipt.supported_profile_runtime_observations, 0);
    assert_eq!(receipt.physical_observations, 0);
    assert!(!receipt.runbook_executed);
}

#[test]
fn exact_preflight_replay_retains_the_same_readiness() {
    let (_, preflight) = armed_s538_state(0x5370_5411);
    let mut state = G8lS541ReadinessHandoffState::new();
    let first = service_s541_model_cpu1_readiness_handoff(
        &mut state,
        1,
        G8lS538BootUiMarkerRuntimeOutcome::PreflightArmed(preflight),
    )
    .unwrap();
    let G8lS541ReadinessHandoffOutcome::Cpu1ReadinessPublished(receipt) = first else {
        panic!("first publication missing");
    };
    assert_eq!(
        service_s541_model_cpu1_readiness_handoff(
            &mut state,
            1,
            G8lS538BootUiMarkerRuntimeOutcome::PreflightRetained(preflight),
        ),
        Ok(G8lS541ReadinessHandoffOutcome::Cpu1ReadinessRetained(
            receipt
        ))
    );
}

#[test]
fn every_material_preflight_drift_fails_closed() {
    let (_, exact) = armed_s538_state(0x5370_5412);
    let mut drifts = Vec::new();
    let mut drift = exact;
    drift.sequence += 1;
    drifts.push(drift);
    let mut drift = exact;
    drift.predecessor_sequence += 1;
    drifts.push(drift);
    let mut drift = exact;
    drift.request_id = 0;
    drifts.push(drift);
    let mut drift = exact;
    drift.contract_anchor_attempt_id = 0;
    drifts.push(drift);
    let mut drift = exact;
    drift.target_board = "";
    drifts.push(drift);
    let mut drift = exact;
    drift.boot_to_ui_required_marker = "";
    drifts.push(drift);
    let mut drift = exact;
    drift.route_armed = false;
    drifts.push(drift);
    let mut drift = exact;
    drift.supported_profile_runtime_observations = 1;
    drifts.push(drift);
    let mut drift = exact;
    drift.physical_observations = 1;
    drifts.push(drift);
    let mut drift = exact;
    drift.runtime_marker_observed = true;
    drifts.push(drift);
    let mut drift = exact;
    drift.runbook_executed = true;
    drifts.push(drift);
    for drift in drifts {
        let mut state = G8lS541ReadinessHandoffState::new();
        assert_eq!(
            service_s541_model_cpu1_readiness_handoff(
                &mut state,
                1,
                G8lS538BootUiMarkerRuntimeOutcome::PreflightArmed(drift),
            ),
            Err(G8lS541ReadinessHandoffError::S538PreflightReceiptDrift)
        );
        assert_eq!(state.readiness(), None);
    }
}

#[test]
fn readiness_cannot_regress_to_awaiting() {
    let (_, preflight) = armed_s538_state(0x5370_5413);
    let mut state = G8lS541ReadinessHandoffState::new();
    service_s541_model_cpu1_readiness_handoff(
        &mut state,
        1,
        G8lS538BootUiMarkerRuntimeOutcome::PreflightArmed(preflight),
    )
    .unwrap();
    assert_eq!(
        service_s541_model_cpu1_readiness_handoff(
            &mut state,
            1,
            G8lS538BootUiMarkerRuntimeOutcome::AwaitingS537,
        ),
        Err(G8lS541ReadinessHandoffError::ReadinessStateDrift)
    );
}

#[test]
fn cpu1_rejects_cpu0_only_marker_outcomes() {
    let (mut s538_state, preflight) = armed_s538_state(0x5370_5414);
    let route = aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s538_r1_boot_ui_marker_runtime_wiring::complete_s538_model_boot_ui_marker_route(
        &mut s538_state,
        0,
        identity(),
        surface(),
    )
    .unwrap();
    assert!(matches!(
        route,
        G8lS538BootUiMarkerRuntimeOutcome::MarkerRouteReady(..)
    ));
    assert!(s538_preflight_is_exact_for_s541(preflight));
    let mut state = G8lS541ReadinessHandoffState::new();
    assert_eq!(
        service_s541_model_cpu1_readiness_handoff(&mut state, 1, route),
        Err(G8lS541ReadinessHandoffError::UnexpectedS538Outcome)
    );
}

#[test]
fn cpu0_waits_without_authorizing_early_completion() {
    let mut state = G8lS541ReadinessHandoffState::new();
    assert_eq!(
        poll_s541_model_cpu0_readiness(&mut state, 0, 3),
        Ok(G8lS541ReadinessHandoffOutcome::Cpu0AwaitingReadiness {
            poll_attempts: 1,
            remaining_attempts: 2,
        })
    );
    assert!(!state.completion_authorized());
}

#[test]
fn cpu0_poll_budget_is_finite_and_fail_closed() {
    let mut state = G8lS541ReadinessHandoffState::new();
    for _ in 0..3 {
        assert!(matches!(
            poll_s541_model_cpu0_readiness(&mut state, 0, 3),
            Ok(G8lS541ReadinessHandoffOutcome::Cpu0AwaitingReadiness { .. })
        ));
    }
    assert_eq!(
        poll_s541_model_cpu0_readiness(&mut state, 0, 3),
        Err(G8lS541ReadinessHandoffError::Cpu0ReadinessTimeout)
    );
    assert!(!state.completion_authorized());
}

#[test]
fn cpu0_wrong_cpu_fails_before_poll_mutation() {
    let mut state = G8lS541ReadinessHandoffState::new();
    assert_eq!(
        poll_s541_model_cpu0_readiness(&mut state, 1, 3),
        Err(G8lS541ReadinessHandoffError::WrongCpu)
    );
    assert_eq!(state.cpu0_poll_attempts(), 0);
}

#[test]
fn marker_completion_is_forbidden_before_cpu0_observes_readiness() {
    let (mut s538_state, preflight) = armed_s538_state(0x5370_5415);
    let mut handoff = G8lS541ReadinessHandoffState::new();
    service_s541_model_cpu1_readiness_handoff(
        &mut handoff,
        1,
        G8lS538BootUiMarkerRuntimeOutcome::PreflightArmed(preflight),
    )
    .unwrap();
    assert_eq!(
        complete_s541_model_boot_ui_after_readiness(
            &handoff,
            &mut s538_state,
            0,
            identity(),
            surface(),
        ),
        Err(G8lS541ReadinessHandoffError::CompletionBeforeReadiness)
    );
}

#[test]
fn exact_cpu1_to_cpu0_handoff_then_allows_s538_completion() {
    let (mut s538_state, preflight) = armed_s538_state(0x5370_5416);
    let mut handoff = G8lS541ReadinessHandoffState::new();
    service_s541_model_cpu1_readiness_handoff(
        &mut handoff,
        1,
        G8lS538BootUiMarkerRuntimeOutcome::PreflightArmed(preflight),
    )
    .unwrap();
    assert!(matches!(
        poll_s541_model_cpu0_readiness(&mut handoff, 0, 3),
        Ok(G8lS541ReadinessHandoffOutcome::Cpu0CompletionAuthorized(..))
    ));
    assert!(matches!(
        complete_s541_model_boot_ui_after_readiness(
            &handoff,
            &mut s538_state,
            0,
            identity(),
            surface(),
        ),
        Ok(G8lS538BootUiMarkerRuntimeOutcome::MarkerRouteReady(..))
    ));
}

#[test]
fn s540_red_identity_and_nonpromotion_remain_immutable() {
    assert_eq!(S540_SEQUENCE, 540);
    assert_eq!(S540_RAW_BYTES, 20_525);
    assert_eq!(
        S540_RAW_SHA256,
        "fc3f934543ab5d829ad8a16e2b332dd2bdc35a81c6c0f6423256101448e45114"
    );
    assert!(!S540_AUTOMATIC_S541_PROMOTION);
    let verdict = G8lS540PhysicalVerdict::RedAwaitingS538Preflight;
    assert_eq!(verdict, G8lS540PhysicalVerdict::RedAwaitingS538Preflight);
    assert!(S540_SOURCE.contains("S540 can"));
    assert!(S540_SOURCE.contains("never be promoted retroactively"));
}

#[test]
fn production_module_is_registered_but_s540_stays_host_evidence_only() {
    let s541 = "g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s541_r1_cross_cpu_marker_readiness_handoff";
    let s540 = "g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s540_r1_first_physical_boot_uart_attempt_red";
    assert!(MAIN.contains(&format!("mod {s541};")));
    assert!(SIMULATION_LIB.contains(&format!("pub mod {s541};")));
    assert!(!MAIN.contains(&format!("mod {s540};")));
}

#[test]
fn cpu1_timer_callsite_uses_s541_not_direct_s538_acceptance() {
    assert!(EXCEPTIONS.contains("service_s541_readiness_handoff_on_cpu1()"));
    assert!(EXCEPTIONS.contains("Cpu1RetryScheduled"));
    assert!(EXCEPTIONS.contains("Cpu1ReadinessPublished"));
    assert!(EXCEPTIONS.contains("Cpu1ReadinessRetained"));
    assert!(!EXCEPTIONS.contains("service_s538_marker_route_preflight_on_cpu1()"));
}

#[test]
fn cpu1_source_retries_upstream_and_release_publishes_before_sev() {
    let service = SOURCE
        .split("pub fn service_s541_readiness_handoff_on_cpu1")
        .nth(1)
        .unwrap();
    assert!(service.contains("S541_CPU1_SAME_IRQ_RETRY_LIMIT"));
    assert!(service.contains("service_s536_r1_physical_boot_uart_evidence_contract_on_cpu1"));
    assert!(service.contains("service_s537_r1_physical_boot_uart_evidence_request_on_cpu1"));
    assert!(SOURCE.contains("Ordering::Release"));
    assert!(SOURCE.contains("dsb ishst"));
    assert!(SOURCE.contains("\"sev\""));
}

#[test]
fn g8h_cpu0_tail_waits_with_acquire_and_timeout_before_s538_entry() {
    assert!(G8H.contains("enter_s541_readiness_handoff_then_s538_boot_ui_on_cpu0"));
    assert!(!G8H.contains(
        "s538_r1_boot_ui_marker_runtime_wiring::enter_s538_boot_ui_marker_runtime_on_cpu0"
    ));
    let wait = SOURCE
        .find("wait_for_s541_production_readiness_on_cpu0()")
        .unwrap();
    let enter = SOURCE
        .rfind("enter_s538_boot_ui_marker_runtime_on_cpu0(prior_boot_stage_complete)")
        .unwrap();
    assert!(wait < enter);
    assert!(SOURCE.contains("Ordering::Acquire"));
    assert!(SOURCE.contains("S541_CPU0_READINESS_TIMEOUT_SECONDS"));
    assert!(SOURCE.contains("Cpu0ReadinessTimeout"));
}

#[test]
fn source_gate_has_no_physical_or_device_execution_surface() {
    for forbidden in [
        "std::process::Command",
        "/dev/tty",
        "diskutil",
        "dd if=",
        "TIOCEXCL",
        "power-on",
    ] {
        assert!(
            !SOURCE.contains(forbidden),
            "forbidden source token: {forbidden}"
        );
    }
    assert!(SOURCE.contains("S540 remains an immutable RED observation"));
    assert!(SOURCE.contains("S541 performs no SD, UART, power, or physical operation"));
}

  {
    id: "g8l-s541-r1-cross-cpu-marker-readiness-handoff",
    date: "2026-08-30",
    sequence: 541,
    status: "passed",
    umbrella_status: "partial",
    title: "S541 · R1 cross-CPU marker readiness handoff remediation",
    summary:
      "S541 dar kaynak remediation kapısı PASS'tir; S540 fiziksel kapısı RED olarak immutable kalır. S540'ta CPU0'ın S538 completion yoluna CPU1 preflight arm edilmeden ulaşabildiği eksik cross-CPU readiness sınırı kapatıldı. CPU1 artık AwaitingS537 sonucunu terminal başarı saymaz: S536/S537'yi yeniden servis eder, aynı IRQ içinde bounded retry uygular ve yalnız exact S538 PreflightArmed/PreflightRetained receipt'i sonrasında Release publication + dsb ishst + sev üretir. CPU0 readiness kimliğini Acquire ile gözler, architectural timer tabanlı beş saniyelik bounded wait uygular ve readiness olmadan S538 marker completion'a giremez. Focused ilk koşu eksik production callsite'larıyla 17/20 RED, final 20/20 PASS; selected S536–S541 zinciri 6 grup / 98/98 PASS ve dört fresh AArch64 profil 4/4 exit 0'dır. S541 sırasında candidate freeze, SD, UART, power, raw veya fiziksel işlem yapılmadı; RUNBOOK_EXECUTED_IN_S541=NO, physical observations=0 ve R1 acceptance=false'dur.",
    evidence: [
      "S541, S540'tan ayrı production implementation module, 20-test focused target, proof, Operations kaydı, Timeline/Yol Haritası açıklaması ve complete Code kartına sahiptir.",
      "Dar S541 source/remediation status=PASS; global R1 umbrella=PARTIAL ve S540 physical gate status=RED'dir.",
      "İlk focused koşu 17 passed / 3 failed verdi. İki RED missing CPU1/CPU0 production callsite'ını, bir RED test-only newline expectation drift'ini gösterdi; fiziksel beklenti veya S540 verdict'i gevşetilmedi.",
      "Final focused target 20/20 PASS / 0 failed / 0 ignored / 0 filtered verdi.",
      "AwaitingS537 readiness yayımlamaz; model retry_attempts değerini bounded artırır ve toplam 1024 denemede fail-closed kapanır.",
      "Yalnız exact S538 PreflightArmed veya PreflightRetained receipt'i S541 readiness üretir; request id, anchor, board, marker, route ve sıfır observation alanları yeniden doğrulanır.",
      "Wrong CPU, marker outcome, preflight drift, readiness regression, counter yokluğu, retry exhaustion ve CPU0 timeout typed error ile kapalı kalır.",
      "CPU1 production service aynı timer IRQ içinde en çok dört kez dener; AwaitingS537 gördüğünde S536 ve S537 service'lerini yeniden çağırır, sonraki timer tick'lerine bounded biçimde açık kalır.",
      "CPU1 nonzero request identity'yi AtomicU64 compare_exchange Ordering::Release ile yayımlar; dsb ishst ve sev publication sonrasında exact source order'dadır.",
      "CPU0 AtomicU64 load Ordering::Acquire kullanır; CNTFRQ/read_count tabanlı beş saniyelik bounded wait readiness yoksa S541ERR ile fail-closed park eder.",
      "CPU0 marker yolu readiness gözlenmeden çağrılamaz; model CompletionBeforeReadiness sonucunu exact doğrular.",
      "exceptions.rs CPU1 timer callsite'ı doğrudan S538 service yerine S541 readiness service'ini kullanır; rpi5_g8h.rs CPU0 tail'i doğrudan S538 entry yerine S541 wait entry'sini kullanır.",
      "Tarihsel S538 terminal implementation ve S540 evidence model değişmeden kalır; yalnız live callsite ordering yeni S541 sınırına taşınır.",
      "S540 raw halen 20525 B / fc3f934543ab5d829ad8a16e2b332dd2bdc35a81c6c0f6423256101448e45114 / mode 0444 / nlink 1'dir.",
      "S540 matrisi BOOT8H=1, BOOT_TO_UI_READY=0, S538 route=0, S538ERR AwaitingPreflight=1, panic=0 ve unknown IRQ=0 olarak korunur; physical verdict RED'dir.",
      "Selected S536–S541 regresyonu 6 ayrı grup / 98 passed / 0 failed verdi: 15 + 15 + 15 + 16 + 17 + 20.",
      "Exact yedi bilinen tarihsel frozen assertion filtrelenerek seri workspace audit 504 sonuç grubu / 7263 PASS / 0 fail / 7 filtered verdi; 93720 B log a2e0911669e55a40851e89325696311afebd9cb5e1fc581b72d286bc7b29f275 SHA-256'dır.",
      "G8h source/runtime tarihsel denetimleri exact S540 evidence literalini production seam'den ayırır; generic token veya path allowlist genişletilmedi.",
      "Dört fresh izole AArch64 profile check board-qemu, board-rpi4, board-rpi5 ve board-rpi5+smp için 4/4 exit 0 verdi.",
      "Fresh board-rpi5 release ELF 1021472 B / bc36658db9a105180240742d29a462f45eee9c757d8918a030b75e18d9148291 SHA-256'dır.",
      "Fresh board-rpi5+smp release ELF 1021472 B / bd5a8118eadae515e4e96698b3b58121039efbba2b0e865503ede08536080a10 SHA-256'dır.",
      "İki ELF'de de ASELSAN/S541 HANDOFF=CPU1_PREFLIGHT_ARMED ve ASELSAN/S541ERR string'leri exact-once bulunur; bu compile artifact runtime observation değildir.",
      "S541 implementation 16006 B / 43d60e130a50eedd9d873893dcf1b86a42582bbd267a3a97b6c89bf2c9b89395; focused test 18943 B / 029357904dc1121461ed219359b1523401cf43834abf972f553a6fcd137454c6 SHA-256'dır.",
      "Pre-publication Code registry S1–S541 için 541/541 unique gate, 1587 exact source excerpt, missing=none ve duplicate=0 üretti; SHA-256 05151514808c4ffce8e28fe504d79ed1471873719d21903922c6e1ea3280a7be'dir. Mapping writer=69, focused=370, command=94 ve operation=8'dir.",
      "Website kabulü 801/801 PASS, lint PASS, TypeScript exit 0/boş çıktı ve production build 677/677 static page verdi. Export 3467 file / 268564015 B, 25 MiB üstü file=0 ve deterministic tree SHA-256 4abe894f3c95b335231a9b131fde3a15b673b6a3cd114aaf5ee7be8637559956'dır.",
      "İlk S541 production deployment 323a8183.aselsan-microkernel.pages.dev hostname'iyle tamamlandı: 3382 uploaded + 83 existing = 3465 asset ve ayrı _headers yayımlandı.",
      "Cache-busted custom-domain readback /, /operations/, /operations/s541/, /operations/s540/, /code/, /code/s541/, /code/s540/, /timeline/, /yol-haritasi/ ve /misyon/ için 10/10 HTTP 200 ve local export ile byte-exact=true verdi.",
      "S541 physical/device operations=0: candidate freeze=0, SD write/read-back=0/0, UART open/capture=0/0, power transitions=0 ve new immutable raw=0.",
      "RUNBOOK_EXECUTED_IN_S541=NO, supported-profile runtime observations=0, physical observations=0, Boot-to-UI physically observed=false ve R1 acceptance=false'dur.",
      "Yeni fiziksel retry S541 içinde veya S540 raw üzerinde yapılamaz; daha sonraki sıra, yeni candidate, yeni immutable raw ve açık operatör yetkisi zorunludur.",
    ],
    commands: [
      "cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s541_r1_cross_cpu_marker_readiness_handoff -- --test-threads=1",
      "run S536-S541 focused targets serially",
      "run four fresh isolated AArch64 profile checks and two RPi5 release builds",
      "run filtered serial workspace audit with seven known historical frozen assertions skipped",
      "npm run code:generate && npm run code:check && npm test && npm run lint && npx tsc --noEmit && npm run build",
      "npm run deploy; cache-busted custom-domain curl + local out byte comparison",
    ],
    terminalSessions: [
      {
        id: "s541-focused-red-green",
        title: "S541 focused cross-CPU handoff RED → GREEN",
        commandLines: [
          "cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s541_r1_cross_cpu_marker_readiness_handoff -- --test-threads=1",
        ],
        outputLines: [
          "initial=17 passed / 3 failed; CPU1 and CPU0 production boundaries missing plus one test-only newline drift",
          "final=20 passed / 0 failed / 0 ignored / 0 filtered",
          "S540 raw/verdict expectation relaxed=false; automatic promotion=false",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "s541-selected-regression",
        title: "S541 selected predecessor and immutable-S540 regression",
        commandLines: [
          "run S536, S537, S538, S539, S540 and S541 focused targets serially",
        ],
        outputLines: [
          "6 groups / 98 passed / 0 failed",
          "S540 exact raw=20525 B / fc3f9345…5114 / 0444 / nlink 1",
          "S540 physical verdict=RED; S541 source remediation=PASS",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "s541-build-and-workspace",
        title: "S541 four-profile, ELF and workspace acceptance",
        commandLines: [
          "run four fresh isolated AArch64 profile checks",
          "build isolated board-rpi5 and board-rpi5+smp release ELFs",
          "run filtered serial workspace audit",
        ],
        outputLines: [
          "AArch64 profiles=4/4 exit 0",
          "RPi5 ELFs=1021472 B each; S541 success/error marker strings exact-once",
          "filtered workspace=504 groups / 7263 PASS / 0 fail / 7 historical filtered",
          "runtime observations=0; physical observations=0; compile artifacts only",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "s541-publication",
        title: "S541 Operations/Timeline/Code production publication",
        commandLines: [
          "npm run code:generate && npm run code:check",
          "npm test && npm run lint && npx tsc --noEmit && npm run build",
          "npm run deploy; cache-busted custom-domain readback",
        ],
        outputLines: [
          "website tests=801/801 PASS; lint=PASS; TypeScript exit=0/empty; static pages=677/677",
          "export=3467 files / 268564015 B; files >25 MiB=0; Code=541 gates / 1587 exact excerpts / missing none",
          "initial deployment=323a8183; uploaded/existing=3382/83; asset total=3465",
          "custom domain=10/10 HTTP 200 and byte-exact to local out; S540 physical RED retained",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
    ],
    terminalSessionsNote:
      "S541 kaynak remediation PASS'i ile S540 fiziksel RED sonucu ayrı tutulur; focused, build, workspace veya website sonucu fiziksel promotion değildir.",
    limitations: [
      "S541 yalnız source/model remediation kapısıdır; yeni fiziksel koşu yapılmadı.",
      "S540 immutable raw ve physical verdict RED değişmez.",
      "ELF marker string varlığı runtime invocation veya UART observation değildir.",
      "Boot-to-UI, ekran scanout, input ve R1 demonstratör kabulü açık kalır.",
      "Yeni fiziksel retry ayrı sıra, yeni candidate/raw ve açık operatör yetkisi gerektirir.",
      "RUNBOOK_EXECUTED_IN_S541=NO; physical/device operations=0.",
    ],
  },