S542 · R1 remediated candidate freeze ve pre-arm sözleşmesi

#![allow(unexpected_cfgs)]

//! S542 freezes the first RPi5 candidate containing S541's mandatory
//! cross-CPU marker-readiness handoff and defines the next physical run's
//! pre-arm contract.
//!
//! This is host-evidence logic and is deliberately simulation-only. Registering
//! it in the production kernel would change the candidate whose exact identity
//! it records. The freeze and layout tools operate only on host artifacts;
//! neither tool contains an SD, serial, power or physical-execution path.
//!
//! S542 does not authorize or execute a retry. Even an exact future operator
//! authorization can only make a later sequence contract-ready. It cannot
//! publish an execution permit, mutate S540's immutable RED raw, or claim a
//! Boot-to-UI observation.

use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s539_r1_candidate_image_freeze_safe_prearm::S539_IMAGE_SHA256;
use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s541_r1_cross_cpu_marker_readiness_handoff::S541_SEQUENCE;

pub const S542_SEQUENCE: usize = 542;
pub const S542_EXPECTED_PREDECESSOR: usize = S541_SEQUENCE;
pub const S542_MINIMUM_PHYSICAL_RETRY_SEQUENCE: usize = 543;
pub const S542_TARGET_BOARD: &str = "Raspberry Pi 5 (BCM2712)";
pub const S542_CANDIDATE_PROFILE: &str = "board-rpi5";

pub const S542_ELF_BYTES: u64 = 18_448_768;
pub const S542_ELF_SHA256: &str =
    "f7650384dd9e53bd98555d9a7b6f739ccb538ecb621448d2d73fc2011dd68170";
pub const S542_IMAGE_BYTES: u64 = 941_392;
pub const S542_IMAGE_SHA256: &str =
    "aa0c459b987c3f4c143b4eb14ce0ed655c2812e2a36516793e7bd8b27b60d87c";
pub const S542_DTB_BYTES: u64 = 78_703;
pub const S542_DTB_SHA256: &str =
    "40a2fbe9c29e8b9a4912cf726a943068defb779fc052ec38e457a79c58abca00";
pub const S542_CONFIG_BYTES: u64 = 415;
pub const S542_CONFIG_SHA256: &str =
    "ed749d095eb8e66d8ff6d1c84c815abf125ebd0fc00a4b1e4a3dfce1ca3c2258";
pub const S542_MANIFEST_BYTES: u64 = 248;
pub const S542_MANIFEST_SHA256: &str =
    "22b7a401c056deeec79f2296f8fd14b8fc518adaa83d3bc5cdcc511508a1e310";
pub const S542_PACKAGE_ENTRIES: usize = 4;
pub const S542_PACKAGE_MODE: u32 = 0o444;
pub const S542_ISOLATED_BUILD_COUNT: usize = 2;
pub const S542_BUILD_WARNING_HEADERS_EACH: usize = 2_857;

pub const S542_S541_HANDOFF_MARKER: &str = "ASELSAN/S541 HANDOFF=CPU1_PREFLIGHT_ARMED";
pub const S542_S541_ERROR_MARKER: &str = "ASELSAN/S541ERR";
pub const S542_BOOT_TO_UI_MARKER: &str = "[R1:S536] BOOT_TO_UI_READY";
pub const S542_S538_ROUTE_MARKER: &str = "ASELSAN/S538 ROUTE=PRIOR_BOOT_TO_UI";
pub const S542_S538_ERROR_MARKER: &str = "ASELSAN/S538ERR";
pub const S542_S538_CANDIDATE_TAG: &str = "ASELSAN-R1-S538-BOARD-RPI5";

pub const S542_EXPECTED_CARD_SERIAL_HEX: &str = "0x425001fa";
pub const S542_EXPECTED_CARD_RAW_CID: &str = "009f5449534436344761425001fa01a1";
pub const S542_EXPECTED_DEBUG_PROBE_SERIAL: &str = "E6647C74033F9131";
pub const S542_UART_BAUD: u32 = 115_200;
pub const S542_UART_DATA_BITS: u8 = 8;
pub const S542_UART_STOP_BITS: u8 = 1;

pub const S542_CANDIDATE_FREEZE_COMPLETE: bool = true;
pub const S542_DEVICE_PREARM_CONTRACT_COMPLETE: bool = true;
pub const S542_DEVICE_PREARM_EXECUTED: bool = false;
pub const S542_EXECUTION_PERMIT_PUBLISHED: bool = false;
pub const S542_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS: usize = 0;
pub const S542_PHYSICAL_OBSERVATIONS: usize = 0;
pub const S542_DEVICE_OPERATIONS: usize = 0;
pub const S542_SD_WRITES: usize = 0;
pub const S542_SD_READ_BACKS: usize = 0;
pub const S542_UART_OPENS: usize = 0;
pub const S542_UART_CAPTURES: usize = 0;
pub const S542_POWER_TRANSITIONS: usize = 0;
pub const S542_NEW_IMMUTABLE_RAW_CAPTURES: usize = 0;
pub const S542_S540_PHYSICAL_VERDICT_RETAINED_RED: bool = true;
pub const S542_AUTOMATIC_S540_PROMOTION: bool = false;
pub const S542_BOOT_TO_UI_PHYSICALLY_OBSERVED: bool = false;
pub const S542_R1_ACCEPTANCE_COMPLETE: bool = false;
pub const RUNBOOK_EXECUTED_IN_S542: bool = false;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS542ArtifactIdentity {
    pub bytes: u64,
    pub sha256: &'static str,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS542RemediatedCandidateInput {
    pub sequence: usize,
    pub predecessor_sequence: usize,
    pub target_board: &'static str,
    pub profile: &'static str,
    pub build_a_elf: G8lS542ArtifactIdentity,
    pub build_b_elf: G8lS542ArtifactIdentity,
    pub build_a_image: G8lS542ArtifactIdentity,
    pub build_b_image: G8lS542ArtifactIdentity,
    pub dtb: G8lS542ArtifactIdentity,
    pub config: G8lS542ArtifactIdentity,
    pub manifest: G8lS542ArtifactIdentity,
    pub isolated_builds: usize,
    pub build_elfs_byte_equal: bool,
    pub build_images_byte_equal: bool,
    pub input_elf_immutable_across_layout_audit: bool,
    pub layout_read_only: bool,
    pub s541_source_gate_passed: bool,
    pub s541_handoff_marker_references: usize,
    pub s541_error_marker_references: usize,
    pub boot_to_ui_marker_references: usize,
    pub s538_route_marker_references: usize,
    pub s538_error_marker_references: usize,
    pub s538_candidate_tag_references: usize,
    pub superseded_s539_image_sha256: &'static str,
    pub package_entries: usize,
    pub package_mode: u32,
    pub package_files_have_distinct_inodes: bool,
    pub manifest_read_back_verified: bool,
}

pub const S542_CANONICAL_REMEDIATED_CANDIDATE_INPUT: G8lS542RemediatedCandidateInput =
    G8lS542RemediatedCandidateInput {
        sequence: S542_SEQUENCE,
        predecessor_sequence: S542_EXPECTED_PREDECESSOR,
        target_board: S542_TARGET_BOARD,
        profile: S542_CANDIDATE_PROFILE,
        build_a_elf: G8lS542ArtifactIdentity {
            bytes: S542_ELF_BYTES,
            sha256: S542_ELF_SHA256,
        },
        build_b_elf: G8lS542ArtifactIdentity {
            bytes: S542_ELF_BYTES,
            sha256: S542_ELF_SHA256,
        },
        build_a_image: G8lS542ArtifactIdentity {
            bytes: S542_IMAGE_BYTES,
            sha256: S542_IMAGE_SHA256,
        },
        build_b_image: G8lS542ArtifactIdentity {
            bytes: S542_IMAGE_BYTES,
            sha256: S542_IMAGE_SHA256,
        },
        dtb: G8lS542ArtifactIdentity {
            bytes: S542_DTB_BYTES,
            sha256: S542_DTB_SHA256,
        },
        config: G8lS542ArtifactIdentity {
            bytes: S542_CONFIG_BYTES,
            sha256: S542_CONFIG_SHA256,
        },
        manifest: G8lS542ArtifactIdentity {
            bytes: S542_MANIFEST_BYTES,
            sha256: S542_MANIFEST_SHA256,
        },
        isolated_builds: S542_ISOLATED_BUILD_COUNT,
        build_elfs_byte_equal: true,
        build_images_byte_equal: true,
        input_elf_immutable_across_layout_audit: true,
        layout_read_only: true,
        s541_source_gate_passed: true,
        s541_handoff_marker_references: 1,
        s541_error_marker_references: 1,
        boot_to_ui_marker_references: 2,
        s538_route_marker_references: 1,
        s538_error_marker_references: 1,
        s538_candidate_tag_references: 1,
        superseded_s539_image_sha256: S539_IMAGE_SHA256,
        package_entries: S542_PACKAGE_ENTRIES,
        package_mode: S542_PACKAGE_MODE,
        package_files_have_distinct_inodes: true,
        manifest_read_back_verified: true,
    };

const fn str_eq(left: &str, right: &str) -> bool {
    let left = left.as_bytes();
    let right = right.as_bytes();
    if left.len() != right.len() {
        return false;
    }
    let mut index = 0;
    while index < left.len() {
        if left[index] != right[index] {
            return false;
        }
        index += 1;
    }
    true
}

pub const fn s542_candidate_input_is_exact(input: G8lS542RemediatedCandidateInput) -> bool {
    input.sequence == S542_SEQUENCE
        && input.predecessor_sequence == S542_EXPECTED_PREDECESSOR
        && str_eq(input.target_board, S542_TARGET_BOARD)
        && str_eq(input.profile, S542_CANDIDATE_PROFILE)
        && input.build_a_elf.bytes == S542_ELF_BYTES
        && str_eq(input.build_a_elf.sha256, S542_ELF_SHA256)
        && input.build_b_elf.bytes == input.build_a_elf.bytes
        && str_eq(input.build_b_elf.sha256, input.build_a_elf.sha256)
        && input.build_a_image.bytes == S542_IMAGE_BYTES
        && str_eq(input.build_a_image.sha256, S542_IMAGE_SHA256)
        && input.build_b_image.bytes == input.build_a_image.bytes
        && str_eq(input.build_b_image.sha256, input.build_a_image.sha256)
        && input.dtb.bytes == S542_DTB_BYTES
        && str_eq(input.dtb.sha256, S542_DTB_SHA256)
        && input.config.bytes == S542_CONFIG_BYTES
        && str_eq(input.config.sha256, S542_CONFIG_SHA256)
        && input.manifest.bytes == S542_MANIFEST_BYTES
        && str_eq(input.manifest.sha256, S542_MANIFEST_SHA256)
        && input.isolated_builds == S542_ISOLATED_BUILD_COUNT
        && input.build_elfs_byte_equal
        && input.build_images_byte_equal
        && input.input_elf_immutable_across_layout_audit
        && input.layout_read_only
        && input.s541_source_gate_passed
        && input.s541_handoff_marker_references == 1
        && input.s541_error_marker_references == 1
        && input.boot_to_ui_marker_references == 2
        && input.s538_route_marker_references == 1
        && input.s538_error_marker_references == 1
        && input.s538_candidate_tag_references == 1
        && str_eq(input.superseded_s539_image_sha256, S539_IMAGE_SHA256)
        && !str_eq(input.build_a_image.sha256, S539_IMAGE_SHA256)
        && input.package_entries == S542_PACKAGE_ENTRIES
        && input.package_mode == S542_PACKAGE_MODE
        && input.package_files_have_distinct_inodes
        && input.manifest_read_back_verified
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS542CandidateFreezeReceipt {
    pub sequence: usize,
    pub predecessor_sequence: usize,
    pub image: G8lS542ArtifactIdentity,
    pub superseded_s539_image_sha256: &'static str,
    pub package_entries: usize,
    pub candidate_frozen: bool,
    pub s541_handoff_present: bool,
    pub image_differs_from_s539: bool,
    pub package_read_only: bool,
    pub input_elf_immutable: bool,
    pub device_phase_started: bool,
    pub supported_profile_runtime_observations: usize,
    pub physical_observations: usize,
    pub runbook_executed: bool,
}

#[derive(Debug, Default)]
pub struct G8lS542CandidateFreezeState {
    receipt: Option<G8lS542CandidateFreezeReceipt>,
}

impl G8lS542CandidateFreezeState {
    pub const fn new() -> Self {
        Self { receipt: None }
    }

    pub const fn receipt(&self) -> Option<G8lS542CandidateFreezeReceipt> {
        self.receipt
    }
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS542CandidateFreezeOutcome {
    AwaitingS541Acceptance,
    CandidateFrozen(G8lS542CandidateFreezeReceipt),
    CandidateRetained(G8lS542CandidateFreezeReceipt),
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS542CandidateFreezeError {
    CandidateDrift,
    FrozenStateDrift,
}

pub fn service_s542_model_candidate_freeze(
    state: &mut G8lS542CandidateFreezeState,
    input: Option<G8lS542RemediatedCandidateInput>,
) -> Result<G8lS542CandidateFreezeOutcome, G8lS542CandidateFreezeError> {
    let Some(input) = input else {
        return Ok(G8lS542CandidateFreezeOutcome::AwaitingS541Acceptance);
    };
    if !s542_candidate_input_is_exact(input) {
        return Err(G8lS542CandidateFreezeError::CandidateDrift);
    }
    let receipt = G8lS542CandidateFreezeReceipt {
        sequence: S542_SEQUENCE,
        predecessor_sequence: S542_EXPECTED_PREDECESSOR,
        image: input.build_a_image,
        superseded_s539_image_sha256: input.superseded_s539_image_sha256,
        package_entries: input.package_entries,
        candidate_frozen: S542_CANDIDATE_FREEZE_COMPLETE,
        s541_handoff_present: true,
        image_differs_from_s539: true,
        package_read_only: true,
        input_elf_immutable: true,
        device_phase_started: false,
        supported_profile_runtime_observations: S542_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS,
        physical_observations: S542_PHYSICAL_OBSERVATIONS,
        runbook_executed: RUNBOOK_EXECUTED_IN_S542,
    };
    if let Some(frozen) = state.receipt {
        if frozen != receipt {
            return Err(G8lS542CandidateFreezeError::FrozenStateDrift);
        }
        return Ok(G8lS542CandidateFreezeOutcome::CandidateRetained(frozen));
    }
    state.receipt = Some(receipt);
    Ok(G8lS542CandidateFreezeOutcome::CandidateFrozen(receipt))
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS542FuturePhysicalRetryAuthorization {
    pub authorization_id: u64,
    pub requested_sequence: usize,
    pub candidate_image_sha256: &'static str,
    pub card_serial_hex: &'static str,
    pub card_raw_cid: &'static str,
    pub debug_probe_serial: &'static str,
    pub operator_asserts_pi_unpowered: bool,
    pub fresh_target_revalidation_required: bool,
    pub staged_sd_write_readback_eject_authorized: bool,
    pub exclusive_uart_115200_8n1_prearm_authorized: bool,
    pub one_power_on_capture_authorized: bool,
    pub new_immutable_raw_required: bool,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS542FuturePhysicalRetryContractReceipt {
    pub sequence: usize,
    pub minimum_physical_retry_sequence: usize,
    pub authorization_id: u64,
    pub candidate_image_sha256: &'static str,
    pub card_serial_hex: &'static str,
    pub card_raw_cid: &'static str,
    pub debug_probe_serial: &'static str,
    pub uart_baud: u32,
    pub uart_data_bits: u8,
    pub uart_stop_bits: u8,
    pub uart_parity_none: bool,
    pub uart_flow_control_none: bool,
    pub uart_exclusive_open_required: bool,
    pub serial_path_must_be_freshly_resolved: bool,
    pub later_sequence_contract_ready: bool,
    pub host_execution_started: bool,
    pub execution_permit_published: bool,
    pub device_operations: usize,
    pub sd_writes: usize,
    pub uart_opens: usize,
    pub power_transitions: usize,
    pub new_raw_captures: usize,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS542FuturePhysicalRetryContractOutcome {
    AwaitingFrozenCandidate,
    StoppedAwaitingExplicitAuthorization,
    StoppedAwaitingPowerOffAssertion,
    StoppedAwaitingCompleteAuthorization,
    LaterSequenceContractReady(G8lS542FuturePhysicalRetryContractReceipt),
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS542FuturePhysicalRetryContractError {
    CandidateDrift,
    AuthorizationTargetDrift,
    RetrySequenceTooEarly,
}

pub fn evaluate_s542_model_future_physical_retry_contract(
    candidate: Option<G8lS542CandidateFreezeReceipt>,
    authorization: Option<G8lS542FuturePhysicalRetryAuthorization>,
) -> Result<G8lS542FuturePhysicalRetryContractOutcome, G8lS542FuturePhysicalRetryContractError> {
    let Some(candidate) = candidate else {
        return Ok(G8lS542FuturePhysicalRetryContractOutcome::AwaitingFrozenCandidate);
    };
    if candidate.sequence != S542_SEQUENCE
        || candidate.predecessor_sequence != S542_EXPECTED_PREDECESSOR
        || candidate.image.bytes != S542_IMAGE_BYTES
        || !str_eq(candidate.image.sha256, S542_IMAGE_SHA256)
        || !str_eq(candidate.superseded_s539_image_sha256, S539_IMAGE_SHA256)
        || !candidate.candidate_frozen
        || !candidate.s541_handoff_present
        || !candidate.image_differs_from_s539
        || !candidate.package_read_only
        || !candidate.input_elf_immutable
        || candidate.device_phase_started
        || candidate.supported_profile_runtime_observations != 0
        || candidate.physical_observations != 0
        || candidate.runbook_executed
    {
        return Err(G8lS542FuturePhysicalRetryContractError::CandidateDrift);
    }
    let Some(authorization) = authorization else {
        return Ok(G8lS542FuturePhysicalRetryContractOutcome::StoppedAwaitingExplicitAuthorization);
    };
    if authorization.authorization_id == 0
        || !str_eq(authorization.candidate_image_sha256, S542_IMAGE_SHA256)
        || !str_eq(authorization.card_serial_hex, S542_EXPECTED_CARD_SERIAL_HEX)
        || !str_eq(authorization.card_raw_cid, S542_EXPECTED_CARD_RAW_CID)
        || !str_eq(
            authorization.debug_probe_serial,
            S542_EXPECTED_DEBUG_PROBE_SERIAL,
        )
        || !authorization.fresh_target_revalidation_required
        || !authorization.new_immutable_raw_required
    {
        return Err(G8lS542FuturePhysicalRetryContractError::AuthorizationTargetDrift);
    }
    if authorization.requested_sequence < S542_MINIMUM_PHYSICAL_RETRY_SEQUENCE {
        return Err(G8lS542FuturePhysicalRetryContractError::RetrySequenceTooEarly);
    }
    if !authorization.operator_asserts_pi_unpowered {
        return Ok(G8lS542FuturePhysicalRetryContractOutcome::StoppedAwaitingPowerOffAssertion);
    }
    if !authorization.staged_sd_write_readback_eject_authorized
        || !authorization.exclusive_uart_115200_8n1_prearm_authorized
        || !authorization.one_power_on_capture_authorized
    {
        return Ok(G8lS542FuturePhysicalRetryContractOutcome::StoppedAwaitingCompleteAuthorization);
    }
    Ok(
        G8lS542FuturePhysicalRetryContractOutcome::LaterSequenceContractReady(
            G8lS542FuturePhysicalRetryContractReceipt {
                sequence: S542_SEQUENCE,
                minimum_physical_retry_sequence: S542_MINIMUM_PHYSICAL_RETRY_SEQUENCE,
                authorization_id: authorization.authorization_id,
                candidate_image_sha256: S542_IMAGE_SHA256,
                card_serial_hex: S542_EXPECTED_CARD_SERIAL_HEX,
                card_raw_cid: S542_EXPECTED_CARD_RAW_CID,
                debug_probe_serial: S542_EXPECTED_DEBUG_PROBE_SERIAL,
                uart_baud: S542_UART_BAUD,
                uart_data_bits: S542_UART_DATA_BITS,
                uart_stop_bits: S542_UART_STOP_BITS,
                uart_parity_none: true,
                uart_flow_control_none: true,
                uart_exclusive_open_required: true,
                serial_path_must_be_freshly_resolved: true,
                later_sequence_contract_ready: S542_DEVICE_PREARM_CONTRACT_COMPLETE,
                host_execution_started: S542_DEVICE_PREARM_EXECUTED,
                execution_permit_published: S542_EXECUTION_PERMIT_PUBLISHED,
                device_operations: S542_DEVICE_OPERATIONS,
                sd_writes: S542_SD_WRITES,
                uart_opens: S542_UART_OPENS,
                power_transitions: S542_POWER_TRANSITIONS,
                new_raw_captures: S542_NEW_IMMUTABLE_RAW_CAPTURES,
            },
        ),
    )
}

use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s539_r1_candidate_image_freeze_safe_prearm::S539_IMAGE_SHA256;
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s542_r1_remediated_candidate_freeze_prearm_contract::*;
use sha2::{Digest, Sha256};
use std::collections::HashSet;
use std::fs;
use std::os::unix::fs::{MetadataExt, PermissionsExt};
use std::path::{Path, PathBuf};
use std::process::Command;

const SOURCE: &str = include_str!(
    "../../kernel/src/g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s542_r1_remediated_candidate_freeze_prearm_contract.rs"
);
const SIMULATION_LIB: &str = include_str!("../src/lib.rs");
const KERNEL_MAIN: &str = include_str!("../../kernel/src/main.rs");

fn repository_root() -> PathBuf {
    Path::new(env!("CARGO_MANIFEST_DIR"))
        .parent()
        .unwrap()
        .to_path_buf()
}

fn package_root() -> PathBuf {
    repository_root().join("evidence/rpi5/r1/sequence-542-remediated-candidate-freeze/package")
}

fn sha256(bytes: &[u8]) -> String {
    format!("{:x}", Sha256::digest(bytes))
}

fn count_bytes(haystack: &[u8], needle: &[u8]) -> usize {
    haystack
        .windows(needle.len())
        .filter(|window| *window == needle)
        .count()
}

fn freeze_candidate() -> G8lS542CandidateFreezeReceipt {
    let mut state = G8lS542CandidateFreezeState::new();
    match service_s542_model_candidate_freeze(
        &mut state,
        Some(S542_CANONICAL_REMEDIATED_CANDIDATE_INPUT),
    )
    .unwrap()
    {
        G8lS542CandidateFreezeOutcome::CandidateFrozen(receipt) => receipt,
        outcome => panic!("unexpected candidate outcome: {outcome:?}"),
    }
}

fn exact_authorization() -> G8lS542FuturePhysicalRetryAuthorization {
    G8lS542FuturePhysicalRetryAuthorization {
        authorization_id: 0x542,
        requested_sequence: S542_MINIMUM_PHYSICAL_RETRY_SEQUENCE,
        candidate_image_sha256: S542_IMAGE_SHA256,
        card_serial_hex: S542_EXPECTED_CARD_SERIAL_HEX,
        card_raw_cid: S542_EXPECTED_CARD_RAW_CID,
        debug_probe_serial: S542_EXPECTED_DEBUG_PROBE_SERIAL,
        operator_asserts_pi_unpowered: true,
        fresh_target_revalidation_required: true,
        staged_sd_write_readback_eject_authorized: true,
        exclusive_uart_115200_8n1_prearm_authorized: true,
        one_power_on_capture_authorized: true,
        new_immutable_raw_required: true,
    }
}

#[test]
fn sequence_and_claim_boundary_are_exact() {
    assert_eq!(S542_SEQUENCE, 542);
    assert_eq!(S542_EXPECTED_PREDECESSOR, 541);
    assert_eq!(S542_MINIMUM_PHYSICAL_RETRY_SEQUENCE, 543);
    assert!(S542_CANDIDATE_FREEZE_COMPLETE);
    assert!(S542_DEVICE_PREARM_CONTRACT_COMPLETE);
    assert!(!S542_DEVICE_PREARM_EXECUTED);
    assert!(!S542_EXECUTION_PERMIT_PUBLISHED);
    assert_eq!(S542_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS, 0);
    assert_eq!(S542_PHYSICAL_OBSERVATIONS, 0);
    assert_eq!(S542_DEVICE_OPERATIONS, 0);
    assert_eq!(S542_SD_WRITES, 0);
    assert_eq!(S542_SD_READ_BACKS, 0);
    assert_eq!(S542_UART_OPENS, 0);
    assert_eq!(S542_UART_CAPTURES, 0);
    assert_eq!(S542_POWER_TRANSITIONS, 0);
    assert_eq!(S542_NEW_IMMUTABLE_RAW_CAPTURES, 0);
    assert!(S542_S540_PHYSICAL_VERDICT_RETAINED_RED);
    assert!(!S542_AUTOMATIC_S540_PROMOTION);
    assert!(!S542_BOOT_TO_UI_PHYSICALLY_OBSERVED);
    assert!(!S542_R1_ACCEPTANCE_COMPLETE);
    assert!(!RUNBOOK_EXECUTED_IN_S542);
}

#[test]
fn missing_s541_acceptance_waits_without_mutation() {
    let mut state = G8lS542CandidateFreezeState::new();
    assert_eq!(
        service_s542_model_candidate_freeze(&mut state, None),
        Ok(G8lS542CandidateFreezeOutcome::AwaitingS541Acceptance)
    );
    assert_eq!(state.receipt(), None);
}

#[test]
fn exact_candidate_freezes_and_replay_retains_it() {
    let mut state = G8lS542CandidateFreezeState::new();
    let first = service_s542_model_candidate_freeze(
        &mut state,
        Some(S542_CANONICAL_REMEDIATED_CANDIDATE_INPUT),
    )
    .unwrap();
    let G8lS542CandidateFreezeOutcome::CandidateFrozen(receipt) = first else {
        panic!("unexpected first outcome: {first:?}");
    };
    assert_eq!(receipt.image.sha256, S542_IMAGE_SHA256);
    assert!(receipt.s541_handoff_present);
    assert!(receipt.image_differs_from_s539);
    assert!(!receipt.device_phase_started);
    assert_eq!(
        service_s542_model_candidate_freeze(
            &mut state,
            Some(S542_CANONICAL_REMEDIATED_CANDIDATE_INPUT)
        ),
        Ok(G8lS542CandidateFreezeOutcome::CandidateRetained(receipt))
    );
}

#[test]
fn every_material_candidate_drift_fails_closed() {
    let canonical = S542_CANONICAL_REMEDIATED_CANDIDATE_INPUT;
    let mut variants = Vec::new();

    let mut drift = canonical;
    drift.predecessor_sequence -= 1;
    variants.push(drift);
    drift = canonical;
    drift.build_a_elf.sha256 = "bad";
    variants.push(drift);
    drift = canonical;
    drift.build_b_elf.bytes -= 1;
    variants.push(drift);
    drift = canonical;
    drift.build_a_image.sha256 = S539_IMAGE_SHA256;
    variants.push(drift);
    drift = canonical;
    drift.build_b_image.bytes -= 1;
    variants.push(drift);
    drift = canonical;
    drift.build_elfs_byte_equal = false;
    variants.push(drift);
    drift = canonical;
    drift.build_images_byte_equal = false;
    variants.push(drift);
    drift = canonical;
    drift.input_elf_immutable_across_layout_audit = false;
    variants.push(drift);
    drift = canonical;
    drift.layout_read_only = false;
    variants.push(drift);
    drift = canonical;
    drift.s541_source_gate_passed = false;
    variants.push(drift);
    drift = canonical;
    drift.s541_handoff_marker_references = 0;
    variants.push(drift);
    drift = canonical;
    drift.boot_to_ui_marker_references = 1;
    variants.push(drift);
    drift = canonical;
    drift.package_mode = 0o644;
    variants.push(drift);
    drift = canonical;
    drift.manifest_read_back_verified = false;
    variants.push(drift);

    for variant in variants {
        let mut state = G8lS542CandidateFreezeState::new();
        assert_eq!(
            service_s542_model_candidate_freeze(&mut state, Some(variant)),
            Err(G8lS542CandidateFreezeError::CandidateDrift)
        );
        assert_eq!(state.receipt(), None);
    }
}

#[test]
fn candidate_identity_is_newer_than_the_rejected_s539_image() {
    assert_ne!(S542_IMAGE_SHA256, S539_IMAGE_SHA256);
    let old_image = fs::read(
        repository_root()
            .join("evidence/rpi5/r1/sequence-539-candidate-freeze/package/aselsanos-rpi5.img"),
    )
    .unwrap();
    assert_eq!(sha256(&old_image), S539_IMAGE_SHA256);
    let receipt = freeze_candidate();
    assert_eq!(receipt.superseded_s539_image_sha256, S539_IMAGE_SHA256);
    assert!(receipt.image_differs_from_s539);
}

#[test]
fn future_contract_waits_for_the_frozen_candidate() {
    assert_eq!(
        evaluate_s542_model_future_physical_retry_contract(None, Some(exact_authorization())),
        Ok(G8lS542FuturePhysicalRetryContractOutcome::AwaitingFrozenCandidate)
    );
}

#[test]
fn candidate_receipt_drift_cannot_reach_prearm_contract() {
    let canonical = freeze_candidate();
    let mut variants = Vec::new();
    let mut drift = canonical;
    drift.image.sha256 = S539_IMAGE_SHA256;
    variants.push(drift);
    drift = canonical;
    drift.s541_handoff_present = false;
    variants.push(drift);
    drift = canonical;
    drift.image_differs_from_s539 = false;
    variants.push(drift);
    drift = canonical;
    drift.package_read_only = false;
    variants.push(drift);
    drift = canonical;
    drift.device_phase_started = true;
    variants.push(drift);
    drift = canonical;
    drift.physical_observations = 1;
    variants.push(drift);

    for variant in variants {
        assert_eq!(
            evaluate_s542_model_future_physical_retry_contract(
                Some(variant),
                Some(exact_authorization())
            ),
            Err(G8lS542FuturePhysicalRetryContractError::CandidateDrift)
        );
    }
}

#[test]
fn current_decision_stops_without_explicit_authorization() {
    assert_eq!(
        evaluate_s542_model_future_physical_retry_contract(Some(freeze_candidate()), None),
        Ok(G8lS542FuturePhysicalRetryContractOutcome::StoppedAwaitingExplicitAuthorization)
    );
}

#[test]
fn authorization_identity_drift_fails_closed() {
    let candidate = freeze_candidate();
    let canonical = exact_authorization();
    let mut variants = Vec::new();
    let mut drift = canonical;
    drift.authorization_id = 0;
    variants.push(drift);
    drift = canonical;
    drift.candidate_image_sha256 = S539_IMAGE_SHA256;
    variants.push(drift);
    drift = canonical;
    drift.card_serial_hex = "0x0";
    variants.push(drift);
    drift = canonical;
    drift.card_raw_cid = "bad";
    variants.push(drift);
    drift = canonical;
    drift.debug_probe_serial = "bad";
    variants.push(drift);
    drift = canonical;
    drift.fresh_target_revalidation_required = false;
    variants.push(drift);
    drift = canonical;
    drift.new_immutable_raw_required = false;
    variants.push(drift);

    for variant in variants {
        assert_eq!(
            evaluate_s542_model_future_physical_retry_contract(Some(candidate), Some(variant)),
            Err(G8lS542FuturePhysicalRetryContractError::AuthorizationTargetDrift)
        );
    }
}

#[test]
fn s542_itself_can_never_be_the_physical_retry_sequence() {
    let mut authorization = exact_authorization();
    authorization.requested_sequence = S542_SEQUENCE;
    assert_eq!(
        evaluate_s542_model_future_physical_retry_contract(
            Some(freeze_candidate()),
            Some(authorization)
        ),
        Err(G8lS542FuturePhysicalRetryContractError::RetrySequenceTooEarly)
    );
}

#[test]
fn missing_power_off_assertion_stays_stopped() {
    let mut authorization = exact_authorization();
    authorization.operator_asserts_pi_unpowered = false;
    assert_eq!(
        evaluate_s542_model_future_physical_retry_contract(
            Some(freeze_candidate()),
            Some(authorization)
        ),
        Ok(G8lS542FuturePhysicalRetryContractOutcome::StoppedAwaitingPowerOffAssertion)
    );
}

#[test]
fn each_incomplete_execution_scope_stays_stopped() {
    let candidate = freeze_candidate();
    let canonical = exact_authorization();
    let mut variants = Vec::new();
    let mut incomplete = canonical;
    incomplete.staged_sd_write_readback_eject_authorized = false;
    variants.push(incomplete);
    incomplete = canonical;
    incomplete.exclusive_uart_115200_8n1_prearm_authorized = false;
    variants.push(incomplete);
    incomplete = canonical;
    incomplete.one_power_on_capture_authorized = false;
    variants.push(incomplete);
    for authorization in variants {
        assert_eq!(
            evaluate_s542_model_future_physical_retry_contract(
                Some(candidate),
                Some(authorization)
            ),
            Ok(G8lS542FuturePhysicalRetryContractOutcome::StoppedAwaitingCompleteAuthorization)
        );
    }
}

#[test]
fn exact_future_authorization_only_prepares_a_later_contract() {
    let outcome = evaluate_s542_model_future_physical_retry_contract(
        Some(freeze_candidate()),
        Some(exact_authorization()),
    )
    .unwrap();
    let G8lS542FuturePhysicalRetryContractOutcome::LaterSequenceContractReady(receipt) = outcome
    else {
        panic!("unexpected future contract outcome: {outcome:?}");
    };
    assert_eq!(receipt.minimum_physical_retry_sequence, 543);
    assert_eq!(receipt.candidate_image_sha256, S542_IMAGE_SHA256);
    assert_eq!(receipt.uart_baud, 115_200);
    assert_eq!(receipt.uart_data_bits, 8);
    assert_eq!(receipt.uart_stop_bits, 1);
    assert!(receipt.uart_parity_none);
    assert!(receipt.uart_flow_control_none);
    assert!(receipt.uart_exclusive_open_required);
    assert!(receipt.serial_path_must_be_freshly_resolved);
    assert!(receipt.later_sequence_contract_ready);
    assert!(!receipt.host_execution_started);
    assert!(!receipt.execution_permit_published);
    assert_eq!(receipt.device_operations, 0);
    assert_eq!(receipt.sd_writes, 0);
    assert_eq!(receipt.uart_opens, 0);
    assert_eq!(receipt.power_transitions, 0);
    assert_eq!(receipt.new_raw_captures, 0);
}

#[test]
fn host_model_is_simulation_registered_and_absent_from_candidate_kernel() {
    let module_name = "g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s542_r1_remediated_candidate_freeze_prearm_contract";
    assert!(SIMULATION_LIB.contains(module_name));
    assert!(!KERNEL_MAIN.contains(module_name));
    assert!(SOURCE.contains("host-evidence logic"));
    assert!(SOURCE.contains("deliberately simulation-only"));
    assert!(SOURCE.contains("cannot\n//! publish an execution permit"));
}

#[test]
fn layout_verifier_is_read_only_and_has_no_device_execution_surface() {
    let source =
        fs::read_to_string(repository_root().join("scripts/verify-rpi5-s542-layout.sh")).unwrap();
    assert!(source.contains("S542_LAYOUT=PASS"));
    assert!(source.contains("CPU1_ORDER=S536_S537_S541"));
    assert!(source.contains("CPU0_ORDER=PRIOR_BOOT_S541_S538"));
    assert!(source.contains("ldaxr"));
    assert!(source.contains("stlxr"));
    assert!(source.contains("dsb"));
    assert!(source.contains("sev"));
    assert!(source.contains("ldar"));
    assert!(!source.contains("\"$objcopy\""));
    assert!(!source.contains("--dump-section"));
    assert!(!source.contains("-O binary"));
    assert!(!source.contains("diskutil"));
    assert!(!source.contains("/dev/disk"));
    assert!(!source.contains("/dev/cu."));
    assert!(!source.contains("/dev/tty."));
    assert!(!source.contains("stty"));
}

#[test]
fn freeze_tool_source_check_is_host_only_and_passes() {
    let tool = repository_root().join("scripts/freeze-rpi5-s542-r1-remediated-candidate.sh");
    let source = fs::read_to_string(&tool).unwrap();
    assert!(source.contains("S542_CANDIDATE_FREEZE=PASS"));
    assert!(source.contains("DEVICE_OPERATIONS=0"));
    assert!(source.contains("SD_WRITES=0"));
    assert!(source.contains("UART_OPENS=0"));
    assert!(source.contains("POWER_TRANSITIONS=0"));
    assert!(!source.contains("diskutil"));
    assert!(!source.contains("/dev/disk"));
    assert!(!source.contains("/dev/cu."));
    assert!(!source.contains("/dev/tty."));
    assert!(!source.contains("stty"));
    let output = Command::new(&tool).arg("--source-check").output().unwrap();
    assert!(output.status.success());
    assert!(String::from_utf8_lossy(&output.stdout).contains("S542_SOURCE_CHECK=PASS"));
}

#[test]
fn frozen_package_has_exact_identities_modes_and_manifest() {
    let identities = [
        ("aselsanos-rpi5.img", S542_IMAGE_BYTES, S542_IMAGE_SHA256),
        ("bcm2712-rpi-5-b.dtb", S542_DTB_BYTES, S542_DTB_SHA256),
        ("config.txt", S542_CONFIG_BYTES, S542_CONFIG_SHA256),
        ("SHA256SUMS", S542_MANIFEST_BYTES, S542_MANIFEST_SHA256),
    ];
    let mut inodes = HashSet::new();
    for (name, expected_bytes, expected_sha) in identities {
        let artifact_path = package_root().join(name);
        let bytes = fs::read(&artifact_path).unwrap();
        assert_eq!(bytes.len() as u64, expected_bytes, "{name} bytes");
        assert_eq!(sha256(&bytes), expected_sha, "{name} SHA-256");
        let metadata = fs::metadata(&artifact_path).unwrap();
        assert_eq!(metadata.permissions().mode() & 0o777, 0o444, "{name} mode");
        assert_eq!(metadata.nlink(), 1, "{name} link count");
        assert!(
            inodes.insert((metadata.dev(), metadata.ino())),
            "{name} inode"
        );
    }
    assert_eq!(inodes.len(), 4);
    let manifest = fs::read_to_string(package_root().join("SHA256SUMS")).unwrap();
    assert_eq!(manifest.lines().count(), 3);
    assert_eq!(
        manifest,
        "aa0c459b987c3f4c143b4eb14ce0ed655c2812e2a36516793e7bd8b27b60d87c  aselsanos-rpi5.img\n40a2fbe9c29e8b9a4912cf726a943068defb779fc052ec38e457a79c58abca00  bcm2712-rpi-5-b.dtb\ned749d095eb8e66d8ff6d1c84c815abf125ebd0fc00a4b1e4a3dfce1ca3c2258  config.txt\n"
    );
}

#[test]
fn frozen_image_contains_exact_s541_and_boot_marker_membership() {
    let image = fs::read(package_root().join("aselsanos-rpi5.img")).unwrap();
    assert_eq!(count_bytes(&image, S542_S541_HANDOFF_MARKER.as_bytes()), 1);
    assert_eq!(count_bytes(&image, S542_S541_ERROR_MARKER.as_bytes()), 1);
    assert_eq!(count_bytes(&image, S542_BOOT_TO_UI_MARKER.as_bytes()), 2);
    assert_eq!(count_bytes(&image, S542_S538_ROUTE_MARKER.as_bytes()), 1);
    assert_eq!(count_bytes(&image, S542_S538_ERROR_MARKER.as_bytes()), 1);
    assert_eq!(count_bytes(&image, S542_S538_CANDIDATE_TAG.as_bytes()), 1);
}

#[test]
fn package_verifier_rechecks_the_frozen_candidate() {
    let tool = repository_root().join("scripts/freeze-rpi5-s542-r1-remediated-candidate.sh");
    let output = Command::new(tool)
        .arg("--verify-package")
        .arg(package_root())
        .output()
        .unwrap();
    assert!(output.status.success(), "{:?}", output);
    assert!(String::from_utf8_lossy(&output.stdout).contains("S542_PACKAGE_VERIFY=PASS"));
}

#[test]
fn config_requires_8n1_friendly_firmware_silence_without_claiming_uart_open() {
    let config = fs::read_to_string(repository_root().join("firmware/config-r1-s542.txt")).unwrap();
    assert_eq!(config.matches("kernel=aselsanos-rpi5.img").count(), 1);
    assert_eq!(config.matches("kernel_address=0x80000").count(), 1);
    assert_eq!(config.matches("uart_2ndstage=0").count(), 1);
    assert_eq!(config.matches("uart_2ndstage=1").count(), 0);
    assert_eq!(sha256(config.as_bytes()), S542_CONFIG_SHA256);
    assert_eq!(S542_UART_BAUD, 115_200);
    assert_eq!(S542_UART_OPENS, 0);
}

#[test]
fn s540_immutable_red_raw_remains_unchanged_and_unpromoted() {
    let raw_path =
        repository_root().join("evidence/rpi5/r1/sequence-540-physical-boot-uart/s540-uart.raw");
    let raw = fs::read(&raw_path).unwrap();
    let metadata = fs::metadata(raw_path).unwrap();
    assert_eq!(raw.len(), 20_525);
    assert_eq!(
        sha256(&raw),
        "fc3f934543ab5d829ad8a16e2b332dd2bdc35a81c6c0f6423256101448e45114"
    );
    assert_eq!(metadata.permissions().mode() & 0o777, 0o444);
    assert_eq!(metadata.nlink(), 1);
    assert_eq!(count_bytes(&raw, b"ASELSAN/BOOT8H"), 1);
    assert_eq!(count_bytes(&raw, b"[R1:S536] BOOT_TO_UI_READY"), 0);
    assert_eq!(count_bytes(&raw, b"ASELSAN/S538 ROUTE=PRIOR_BOOT_TO_UI"), 0);
    assert_eq!(count_bytes(&raw, b"ASELSAN/S538ERR AwaitingPreflight"), 1);
    assert!(S542_S540_PHYSICAL_VERDICT_RETAINED_RED);
    assert!(!S542_AUTOMATIC_S540_PROMOTION);
}

  {
    id: "g8l-s542-r1-remediated-candidate-freeze-prearm-contract",
    date: "2026-08-30",
    sequence: 542,
    status: "passed",
    umbrella_status: "partial",
    title: "S542 · R1 remediated candidate freeze ve pre-arm sözleşmesi",
    summary:
      "S542 dar host candidate-freeze ve gelecek fiziksel retry pre-arm sözleşmesi PASS'tir; S540 fiziksel kapısı immutable RED kalır. S541 cross-CPU readiness handoff'unu taşıyan board-rpi5 candidate iki izole build'de byte-exact üretildi: flat image 941392 B / aa0c459b987c3f4c143b4eb14ce0ed655c2812e2a36516793e7bd8b27b60d87c, ELF 18448768 B / f7650384dd9e53bd98555d9a7b6f739ccb538ecb621448d2d73fc2011dd68170. Dört dosyalı package read-only donduruldu ve layout verifier CPU1 S536→S537→S541, CPU0 prior-boot→S541→S538 sıralarını doğruladı. Focused gerçek pre-package RED 18/21, final 21/21 PASS'tir. Bu kapı SD write/read-back, UART, power-on veya fiziksel retry yetkisi vermez; RUNBOOK_EXECUTED_IN_S542=NO, physical/device operations=0, Boot-to-UI=false ve R1 acceptance=false'dur.",
    evidence: [
      "S542, S541'den ayrı implementation module, 21-test focused target, two read-only host tool, config, frozen package, evidence README, proof, Operations kaydı, Timeline/Yol Haritası açıklaması ve complete Code kartına sahiptir.",
      "Dar S542 candidate-freeze/pre-arm-contract status=PASS; global R1 umbrella=PARTIAL ve S540 physical gate status=RED'dir.",
      "İki izole board-rpi5 development build aynı ELF ve flat image'ı üretti; reproducibility sonucu byte-exact=true'dur.",
      "Build A/B ELF kimliği 18448768 B / f7650384dd9e53bd98555d9a7b6f739ccb538ecb621448d2d73fc2011dd68170 SHA-256'dır.",
      "Build A/B flat image kimliği 941392 B / aa0c459b987c3f4c143b4eb14ce0ed655c2812e2a36516793e7bd8b27b60d87c SHA-256'dır.",
      "Build log A 1133015 B / 70b88b20ba9dc416c522331e243fe3a1b9565d78d93248a6aaf8112d54d4803b; build log B 1133015 B / bffd3cc35a6f7226c64fdc82dd6820d26dfd3144cca77c7ba9bc5ccaa30dbc1 SHA-256'dır.",
      "Her build logunda 2857 warning header vardır; zero-warning iddiası kurulmaz ve log boyutu artifact boyutu diye sunulmaz.",
      "S542 image, tarihsel S539 image 933024 B / 8a32dbd93ca4420555d7e6f93516715e43cc70da8f145584f89383446fecc8fe ile byte-eşit değildir; replay fail-closed reddedilir.",
      "Yeni image ASELSAN/S541 HANDOFF=CPU1_PREFLIGHT_ARMED marker'ını bir, ASELSAN/S541ERR marker'ını bir, S538 route marker'ını bir ve S538 candidate tag'ini bir kez taşır.",
      "BOOT_TO_UI_READY string'inin binary üyeliği runtime UART observation değildir; image içindeki iki kaynak/string üyeliği fiziksel exact-once iddiası üretmez.",
      "Read-only layout verifier entry 0x80000 ve linked span 18317312 değerlerini doğrular; objcopy çalıştırmaz ve giriş ELF'ini değiştirmez.",
      "CPU1 machine order S536→S537→S541, CPU0 machine order prior-boot→S541→S538'dir; direct early S538 CPU0/IRQ çağrıları yoktur.",
      "Readiness word 8-byte aligned, UI surface 0x4000 page-aligned; ldaxr/stlxr/dsb ishst/sev publication ve ldar observation instruction seam'leri bulunur.",
      "Frozen package exact dört dosyadır: kernel8.img, bcm2712-rpi-5-b.dtb, config.txt ve SHA256SUMS; ek payload yoktur.",
      "Package image 941392 B / aa0c459b…d87c; DTB 78703 B / 40a2fbe9c29e8b9a4912cf726a943068defb779fc052ec38e457a79c58abca00; config 415 B / ed749d095eb8e66d8ff6d1c84c815abf125ebd0fc00a4b1e4a3dfce1ca3c2258'dir.",
      "Package SHA256SUMS 248 B / 22b7a401c056deeec79f2296f8fd14b8fc518adaa83d3bc5cdcc511508a1e310 SHA-256'dır.",
      "Dört package dosyası mode 0444, nlink=1 ve birbirinden farklı inode taşır; manifest ve byte identity yeniden doğrulanır.",
      "Freeze helper 9127 B / d346e0db736c45128464fc3934f8ecddb55274a2e0625c0ea4f8fd3e4f391321; layout helper 8873 B / da6c9f917ba1190feccd26838c7803ab838c60d4732f48b95164995f05807626 SHA-256 ve mode 0555'tir.",
      "Config uart_2ndstage=0 değerini exact taşır; uart_2ndstage=1 yoktur. Config identity package manifestine bağlıdır.",
      "Gerçek pre-package focused koşu 18 passed / 3 failed verdi; yalnız missing image/package/verifier kontrolleri RED oldu.",
      "Frozen package tamamlandıktan sonraki final focused target 21 passed / 0 failed / 0 ignored / 0 filtered verdi.",
      "S536-S542 selected acceptance yedi ayrı focused targetta 7 grup / 119 passed / 0 failed verdi; birleşik log 13350 B / c1122d215b611b63fe52e04cb479b616a11ba80e9a79b914bd0095ae78e78d5e SHA-256'dır.",
      "Dört fresh AArch64 profil QEMU/RPi4/RPi5/RPi5-SMP sırasıyla 293/391/2857/2857 warning header ile 4/4 exit 0 verdi; zero-warning iddiası yoktur.",
      "Filtered serial workspace 505 grup / 7284 passed / 0 failed / 7 exact historical filtered verdi; log 93856 B / 60502bc6f7423261b8efff3afb9922fa1328f36dd391de3932a244025bb75577 SHA-256'dır.",
      "Ayrı unfiltered --no-fail-fast workspace exit 101 ile tam yedi frozen S96-S100 byte/recipe identity assertion'ını beş targetta doğruladı; global unfiltered GREEN iddia edilmez.",
      "Pre-publication Code registry S1-S542 aralığında 542 unique card / 1590 exact excerpt / missing=none / duplicate=0 doğruladı.",
      "Website kalite zinciri 808/808 test PASS, lint PASS, TypeScript exit 0 ve static build 679/679 sayfa verdi.",
      "İlk canlı deployment 5a2a618f.aselsan-microkernel.pages.dev adresinde tamamlandı: 3392 upload + 83 existing; custom domain üzerinde 11/11 seçili rota HTTP 200 ve local export ile byte-exact'tir.",
      "S542 model pre-arm zarfı image hash, card serial 0x425001fa, raw CID 009f5449534436344761425001fa01a1, Debug Probe E6647C74033F9131, fresh target resolution ve exclusive 115200/8N1 kimliğini bağlar.",
      "Exact model zarfı bile yalnız LaterSequenceContractReady üretir; host execution permit, current-sequence device authority veya power authority üretmez.",
      "Gelecek retry staged SD write/read-back/eject, pre-armed UART, tek power-on ve yeni immutable raw ister; en erken ayrı S543'tür ve otomatik yetkili değildir.",
      "S540 raw 20525 B / fc3f934543ab5d829ad8a16e2b332dd2bdc35a81c6c0f6423256101448e45114 / 0444 / nlink 1 ve physical verdict RED olarak korunur.",
      "S542 candidate freeze=1 host transaction; SD write/read-back/eject=0/0/0, UART open/capture=0/0, power transition=0 ve new physical raw=0'dır.",
      "RUNBOOK_EXECUTED_IN_S542=NO, supported-profile runtime observations=0, physical observations=0, Boot-to-UI physically observed=false ve R1 acceptance=false'dur.",
    ],
    commands: [
      "run two isolated board-rpi5 builds; flatten each ELF into a host candidate and compare exact identities",
      "scripts/verify-rpi5-s542-layout.sh BUILD_A_ELF BUILD_A_IMAGE",
      "scripts/freeze-rpi5-s542-r1-remediated-candidate.sh BUILD_A_IMAGE PACKAGE",
      "cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s542_r1_remediated_candidate_freeze_prearm_contract -- --test-threads=1",
      "run S536-S542 focused targets serially; run fresh AArch64 profiles and filtered workspace audit",
      "npm run code:generate && npm run code:check && npm test && npm run lint && npx tsc --noEmit && npm run build",
    ],
    terminalSessions: [
      {
        id: "s542-reproducible-build-layout-freeze",
        title: "S542 reproducible candidate build, layout ve package freeze",
        commandLines: [
          "run two isolated board-rpi5 builds and compare ELF/image bytes",
          "scripts/verify-rpi5-s542-layout.sh BUILD_A_ELF BUILD_A_IMAGE",
          "scripts/freeze-rpi5-s542-r1-remediated-candidate.sh BUILD_A_IMAGE ABSOLUTE_PACKAGE",
        ],
        outputLines: [
          "ELF A/B=18448768 B / f7650384…8170 / byte-exact=true",
          "image A/B=941392 B / aa0c459b…d87c / byte-exact=true; S539 replay=false",
          "layout=PASS; CPU1 S536→S537→S541; CPU0 prior-boot→S541→S538",
          "package=4 exact files / 0444 / nlink1 / manifest PASS",
          "device operations=0; execution authority=false",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "s542-focused-red-green",
        title: "S542 focused package contract RED → GREEN",
        commandLines: [
          "cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s542_r1_remediated_candidate_freeze_prearm_contract -- --test-threads=1",
        ],
        outputLines: [
          "pre-package=18 passed / 3 failed; only image/package/verifier absent",
          "final=21 passed / 0 failed / 0 ignored / 0 filtered",
          "S540 verdict relaxed=false; current-sequence device authority=false",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "s542-acceptance",
        title: "S542 selected, profile ve workspace acceptance",
        commandLines: [
          "run S536-S542 focused targets serially",
          "run fresh isolated AArch64 profile checks",
          "run filtered serial workspace audit",
        ],
        outputLines: [
          "S536-S542 selected: 7 groups / 119 passed / 0 failed",
          "fresh AArch64 profiles: QEMU + RPi4 + RPi5 + RPi5/SMP = 4/4 exit 0",
          "filtered workspace: 505 groups / 7284 passed / 0 failed / 7 exact historical filtered",
          "unfiltered --no-fail-fast: exit 101 / 7 frozen S96-S100 identity assertions / 5 targets",
          "physical/device operations remain zero throughout software acceptance",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "s542-publication",
        title: "S542 Operations/Timeline/Code publication",
        commandLines: [
          "npm run code:generate && npm run code:check",
          "npm test && npm run lint && npx tsc --noEmit && npm run build",
        ],
        outputLines: [
          "Code registry: S1-S542 / 542 unique cards / 1590 exact excerpts / missing=none",
          "website tests 808/808 PASS; lint PASS; TypeScript exit 0",
          "static build 679/679 pages; S542 split Operations and Code routes generated",
          "initial deployment 5a2a618f: 3392 uploaded + 83 existing; custom-domain 11/11 HTTP 200 and byte-exact",
          "an evidence-sync deployment republishes this measured deployment receipt",
          "S540 physical RED remains visible on every current surface",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
    ],
    terminalSessionsNote:
      "S542 host candidate-freeze PASS'i ile S540 fiziksel RED ayrı tutulur; package, focused, profile, workspace veya website sonucu fiziksel promotion değildir.",
    limitations: [
      "S542 yalnız host candidate freeze ve future pre-arm contract kapısıdır; fiziksel retry yapılmadı.",
      "S540 immutable raw ve physical verdict RED değişmez.",
      "Image marker üyeliği runtime invocation veya UART observation değildir.",
      "Boot-to-UI, ekran scanout, input ve R1 demonstratör kabulü açık kalır.",
      "Yeni fiziksel retry ayrı sıra, yeni immutable raw ve açık operatör yetkisi gerektirir.",
      "RUNBOOK_EXECUTED_IN_S542=NO; physical/device operations=0.",
    ],
  },