S569 · G8h boot-context ledger bağımlılığı remediation

#![allow(unexpected_cfgs)]

//! S569 removes the deterministic source cause of the immutable S546 RED.
//!
//! S546 ended after `ASELSAN/BOOT8G` because the S544 boot hook attempted to
//! build the live S431-S535 ledger. That ledger depends transitively on the
//! S401-S430 runtime chain, whose CPU1 timer callsite sits below G8h's PPI27
//! early return and therefore cannot run before the hook.
//!
//! This gate does not fabricate or publish an S430 runtime result. Instead it
//! binds the checked-in S431-S535 source-acceptance manifest by exact path,
//! byte count and SHA-256, derives an immutable S535-shaped snapshot from that
//! source artifact, and feeds it only to the unchanged S536 contract model.
//! S537 and S541 then consume the resulting production receipts. The live
//! S401-S535 runtime state is neither read nor written on this path.
//!
//! G8h replaces the S544 hook with this CPU1 boot-context service before any
//! task-stack handoff or timer arm. Its CPU0 `primary_fail` also emits exactly
//! one bounded `ASELSAN/G8HERR` line before parking, so a future pre-BOOT8H
//! failure is visible. This is source integration only: it performs no device
//! operation, makes no runtime or physical observation, does not rerun S546,
//! and cannot promote S540, S543 or S546. S570 may freeze a candidate; S571
//! remains a separately authorized physical run.

use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s431_runtime_evidence_contract::{
    G8lS431ToS535AcceptanceLedgerSnapshot, S431_TO_S535_BLOCK_COUNT,
    S431_TO_S535_GATE_COUNT, S431_TO_S535_STEPS_PER_BLOCK,
};
use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s541_r1_cross_cpu_marker_readiness_handoff::{
    G8lS541ReadinessHandoffOutcome, G8lS541ReadinessReceipt, S541_READY_CONSUMER_CPU,
    S541_READY_PRODUCER_CPU,
};
use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s544_r1_reachable_readiness_producer_remediation::s541_readiness_is_exact_for_s544;

pub const S569_SEQUENCE: usize = 569;
pub const S569_EXPECTED_PREDECESSOR: usize = 568;
pub const S569_REMEDIATES_SEQUENCE: usize = 546;
pub const S569_NEXT_FREEZE_SEQUENCE: usize = 570;
pub const S569_NEXT_PHYSICAL_SEQUENCE: usize = 571;
pub const S569_R1_STAGE: u8 = 1;
pub const S569_TARGET_CPU: usize = S541_READY_PRODUCER_CPU;
pub const S569_REQUIRED_TIMER_CONTROL: u64 = 0b10;

pub const S569_DIRECT_LEDGER_FIRST_SEQUENCE: usize = 431;
pub const S569_DIRECT_LEDGER_LAST_SEQUENCE: usize = 535;
pub const S569_TRANSITIVE_RUNTIME_FIRST_SEQUENCE: usize = 401;
pub const S569_TRANSITIVE_RUNTIME_LAST_SEQUENCE: usize = 535;
pub const S569_LIVE_LEDGER_READS: usize = 0;
pub const S569_LIVE_LEDGER_WRITES: usize = 0;
pub const S569_RUNTIME_CHAIN_EXECUTED: bool = false;

pub const S569_FROZEN_MANIFEST_PATH: &str = "status/s431-s535-acceptance-gates.json";
pub const S569_FROZEN_MANIFEST_BYTES: usize = 88_859;
pub const S569_FROZEN_MANIFEST_SHA256: &str =
    "28d1217b502e63c78c7efeaa47fc6f375ae4d080016f1e4f90a3a98fda075e06";
/// First eight digest bytes, interpreted in display order, form the nonzero
/// source-artifact anchor consumed by the unchanged S536 model.
pub const S569_FROZEN_MANIFEST_ANCHOR_ID: u64 = 0x28d1_217b_502e_63c7;

pub const S569_PRIMARY_FAIL_MARKER: &str = "ASELSAN/G8HERR REPORTER=CPU0";
pub const S569_PRIMARY_FAIL_UART_LINES: usize = 1;
pub const S569_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS: usize = 0;
pub const S569_PHYSICAL_OBSERVATIONS: usize = 0;
pub const S569_PHYSICAL_OR_DEVICE_OPERATIONS: usize = 0;
pub const S569_SD_WRITES: usize = 0;
pub const S569_UART_OPENS: usize = 0;
pub const S569_POWER_TRANSITIONS: usize = 0;
pub const S569_NEW_IMMUTABLE_RAW_CAPTURES: usize = 0;
pub const S569_S540_PHYSICAL_VERDICT_RETAINED_RED: bool = true;
pub const S569_S543_PHYSICAL_VERDICT_RETAINED_RED: bool = true;
pub const S569_S546_PHYSICAL_VERDICT_RETAINED_RED: bool = true;
pub const S569_S546_RAW_BYTES: usize = 16_990;
pub const S569_S546_RAW_SHA256: &str =
    "a71a9107b4b6ea351eb65720a6b82486105fffdb931563d1c39e8a381c3e485d";
pub const S569_AUTOMATIC_PROMOTION: bool = false;
pub const S569_BOOT_TO_UI_PHYSICALLY_OBSERVED: bool = false;
pub const S569_HARDWARE_PRESENT: bool = false;
pub const S569_R1_ACCEPTANCE_COMPLETE: bool = false;
pub const RUNBOOK_EXECUTED_IN_S569: bool = false;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS569FrozenManifestIdentity {
    pub path: &'static str,
    pub bytes: usize,
    pub sha256: &'static str,
    pub first_sequence: usize,
    pub last_sequence: usize,
    pub gate_count: usize,
    pub block_count: usize,
    pub steps_per_block: usize,
    pub anchor_id: u64,
}

pub const fn canonical_s569_frozen_manifest_identity() -> G8lS569FrozenManifestIdentity {
    G8lS569FrozenManifestIdentity {
        path: S569_FROZEN_MANIFEST_PATH,
        bytes: S569_FROZEN_MANIFEST_BYTES,
        sha256: S569_FROZEN_MANIFEST_SHA256,
        first_sequence: S569_DIRECT_LEDGER_FIRST_SEQUENCE,
        last_sequence: S569_DIRECT_LEDGER_LAST_SEQUENCE,
        gate_count: S431_TO_S535_GATE_COUNT,
        block_count: S431_TO_S535_BLOCK_COUNT,
        steps_per_block: S431_TO_S535_STEPS_PER_BLOCK,
        anchor_id: S569_FROZEN_MANIFEST_ANCHOR_ID,
    }
}

pub const fn canonical_s569_frozen_ledger_snapshot() -> G8lS431ToS535AcceptanceLedgerSnapshot {
    G8lS431ToS535AcceptanceLedgerSnapshot {
        anchor_attempt_id: S569_FROZEN_MANIFEST_ANCHOR_ID,
        last_completed_sequence: S569_DIRECT_LEDGER_LAST_SEQUENCE,
        completed_block_count: S431_TO_S535_BLOCK_COUNT,
        supported_profile_runtime_observations: 0,
        physical_observations: 0,
        r2_product_acceptance_complete: false,
    }
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS569BootContext {
    pub caller_cpu: usize,
    pub g8h_stage_released: bool,
    pub irqs_masked: bool,
    pub inside_g8h_irq_handler: bool,
    pub timer_control_before: u64,
    pub timer_control_after: u64,
    pub primary_fail_uart_line_wired: bool,
}

pub const fn canonical_s569_boot_context() -> G8lS569BootContext {
    G8lS569BootContext {
        caller_cpu: S569_TARGET_CPU,
        g8h_stage_released: true,
        irqs_masked: true,
        inside_g8h_irq_handler: false,
        timer_control_before: S569_REQUIRED_TIMER_CONTROL,
        timer_control_after: S569_REQUIRED_TIMER_CONTROL,
        primary_fail_uart_line_wired: true,
    }
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS569LedgerDecouplingReceipt {
    pub sequence: usize,
    pub predecessor_sequence: usize,
    pub remediates_sequence: usize,
    pub manifest: G8lS569FrozenManifestIdentity,
    pub frozen_snapshot: G8lS431ToS535AcceptanceLedgerSnapshot,
    pub s541_readiness: G8lS541ReadinessReceipt,
    pub producer_cpu: usize,
    pub consumer_cpu: usize,
    pub direct_ledger_first_sequence: usize,
    pub direct_ledger_last_sequence: usize,
    pub transitive_runtime_first_sequence: usize,
    pub transitive_runtime_last_sequence: usize,
    pub live_ledger_reads: usize,
    pub live_ledger_writes: usize,
    pub runtime_chain_executed: bool,
    pub before_g8h_timer_arm: bool,
    pub primary_fail_uart_lines: usize,
    pub supported_profile_runtime_observations: usize,
    pub physical_observations: usize,
    pub runbook_executed: bool,
}

#[derive(Debug)]
pub struct G8lS569LedgerDecouplingState {
    receipt: Option<G8lS569LedgerDecouplingReceipt>,
}

impl G8lS569LedgerDecouplingState {
    pub const fn new() -> Self {
        Self { receipt: None }
    }

    pub const fn receipt(&self) -> Option<G8lS569LedgerDecouplingReceipt> {
        self.receipt
    }
}

impl Default for G8lS569LedgerDecouplingState {
    fn default() -> Self {
        Self::new()
    }
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS569LedgerDecouplingOutcome {
    Published(G8lS569LedgerDecouplingReceipt),
    Retained(G8lS569LedgerDecouplingReceipt),
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS569LedgerDecouplingError {
    WrongCpu,
    G8hStageNotReleased,
    IrqsNotMasked,
    InsideG8hIrqHandler,
    TimerNotDisabled,
    ManifestIdentityDrift,
    FrozenSnapshotDrift,
    S536Service,
    S536NotReady,
    S537Service,
    S537NotReady,
    S541Service,
    S541ReadinessNotPublished,
    S541ReceiptDrift,
    PrimaryFailUartLineMissing,
    PublishedStateDrift,
}

impl G8lS569LedgerDecouplingError {
    pub const fn diagnostic_code(self) -> u64 {
        match self {
            Self::WrongCpu => 1,
            Self::G8hStageNotReleased => 2,
            Self::IrqsNotMasked => 3,
            Self::InsideG8hIrqHandler => 4,
            Self::TimerNotDisabled => 5,
            Self::ManifestIdentityDrift => 6,
            Self::FrozenSnapshotDrift => 7,
            Self::S536Service => 8,
            Self::S536NotReady => 9,
            Self::S537Service => 10,
            Self::S537NotReady => 11,
            Self::S541Service => 12,
            Self::S541ReadinessNotPublished => 13,
            Self::S541ReceiptDrift => 14,
            Self::PrimaryFailUartLineMissing => 15,
            Self::PublishedStateDrift => 16,
        }
    }
}

pub fn service_s569_model_ledger_decoupling(
    state: &mut G8lS569LedgerDecouplingState,
    context: G8lS569BootContext,
    manifest: G8lS569FrozenManifestIdentity,
    snapshot: G8lS431ToS535AcceptanceLedgerSnapshot,
    s541_outcome: G8lS541ReadinessHandoffOutcome,
) -> Result<G8lS569LedgerDecouplingOutcome, G8lS569LedgerDecouplingError> {
    if context.caller_cpu != S569_TARGET_CPU {
        return Err(G8lS569LedgerDecouplingError::WrongCpu);
    }
    if !context.g8h_stage_released {
        return Err(G8lS569LedgerDecouplingError::G8hStageNotReleased);
    }
    if !context.irqs_masked {
        return Err(G8lS569LedgerDecouplingError::IrqsNotMasked);
    }
    if context.inside_g8h_irq_handler {
        return Err(G8lS569LedgerDecouplingError::InsideG8hIrqHandler);
    }
    if context.timer_control_before & 0b11 != S569_REQUIRED_TIMER_CONTROL
        || context.timer_control_after & 0b11 != S569_REQUIRED_TIMER_CONTROL
    {
        return Err(G8lS569LedgerDecouplingError::TimerNotDisabled);
    }
    if manifest != canonical_s569_frozen_manifest_identity() {
        return Err(G8lS569LedgerDecouplingError::ManifestIdentityDrift);
    }
    if snapshot != canonical_s569_frozen_ledger_snapshot() {
        return Err(G8lS569LedgerDecouplingError::FrozenSnapshotDrift);
    }
    if !context.primary_fail_uart_line_wired {
        return Err(G8lS569LedgerDecouplingError::PrimaryFailUartLineMissing);
    }
    let readiness = match s541_outcome {
        G8lS541ReadinessHandoffOutcome::Cpu1ReadinessPublished(receipt)
        | G8lS541ReadinessHandoffOutcome::Cpu1ReadinessRetained(receipt) => receipt,
        _ => return Err(G8lS569LedgerDecouplingError::S541ReadinessNotPublished),
    };
    if !s541_readiness_is_exact_for_s544(readiness)
        || readiness.preflight.contract_anchor_attempt_id != S569_FROZEN_MANIFEST_ANCHOR_ID
    {
        return Err(G8lS569LedgerDecouplingError::S541ReceiptDrift);
    }

    let receipt = G8lS569LedgerDecouplingReceipt {
        sequence: S569_SEQUENCE,
        predecessor_sequence: S569_EXPECTED_PREDECESSOR,
        remediates_sequence: S569_REMEDIATES_SEQUENCE,
        manifest,
        frozen_snapshot: snapshot,
        s541_readiness: readiness,
        producer_cpu: S541_READY_PRODUCER_CPU,
        consumer_cpu: S541_READY_CONSUMER_CPU,
        direct_ledger_first_sequence: S569_DIRECT_LEDGER_FIRST_SEQUENCE,
        direct_ledger_last_sequence: S569_DIRECT_LEDGER_LAST_SEQUENCE,
        transitive_runtime_first_sequence: S569_TRANSITIVE_RUNTIME_FIRST_SEQUENCE,
        transitive_runtime_last_sequence: S569_TRANSITIVE_RUNTIME_LAST_SEQUENCE,
        live_ledger_reads: S569_LIVE_LEDGER_READS,
        live_ledger_writes: S569_LIVE_LEDGER_WRITES,
        runtime_chain_executed: S569_RUNTIME_CHAIN_EXECUTED,
        before_g8h_timer_arm: true,
        primary_fail_uart_lines: S569_PRIMARY_FAIL_UART_LINES,
        supported_profile_runtime_observations: S569_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS,
        physical_observations: S569_PHYSICAL_OBSERVATIONS,
        runbook_executed: RUNBOOK_EXECUTED_IN_S569,
    };
    if let Some(published) = state.receipt {
        if published != receipt {
            return Err(G8lS569LedgerDecouplingError::PublishedStateDrift);
        }
        return Ok(G8lS569LedgerDecouplingOutcome::Retained(published));
    }
    state.receipt = Some(receipt);
    Ok(G8lS569LedgerDecouplingOutcome::Published(receipt))
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
static S569_PRODUCTION_STATE: spin::Mutex<G8lS569LedgerDecouplingState> =
    spin::Mutex::new(G8lS569LedgerDecouplingState::new());

/// CPU1 boot-context hook called with IRQs masked before G8h's task-stack
/// handoff and timer arm. It deliberately never calls the live-ledger S536
/// entry or any S401-S535 production service.
#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn service_s569_frozen_manifest_readiness_before_g8h_timer_arm_on_cpu1(
) -> Result<G8lS569LedgerDecouplingOutcome, G8lS569LedgerDecouplingError> {
    use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s536_r1_physical_boot_uart_evidence_contract::G8lS536R1PhysicalBootUartEvidenceOutcome;
    use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s537_r1_physical_boot_uart_evidence_request::G8lS537R1PhysicalBootUartEvidenceRequestOutcome;

    if crate::percpu::try_current_cpu_id() != Some(S569_TARGET_CPU) {
        return Err(G8lS569LedgerDecouplingError::WrongCpu);
    }
    let timer_control_before = crate::arch::aarch64::timer::read_control();
    if timer_control_before & 0b11 != S569_REQUIRED_TIMER_CONTROL {
        return Err(G8lS569LedgerDecouplingError::TimerNotDisabled);
    }
    let snapshot = canonical_s569_frozen_ledger_snapshot();
    match crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s536_r1_physical_boot_uart_evidence_contract::service_s536_r1_physical_boot_uart_evidence_contract_from_frozen_source_manifest_on_cpu1(snapshot)
        .map_err(|_| G8lS569LedgerDecouplingError::S536Service)?
    {
        G8lS536R1PhysicalBootUartEvidenceOutcome::ContractPublished(..)
        | G8lS536R1PhysicalBootUartEvidenceOutcome::ContractRetained(..) => {}
        G8lS536R1PhysicalBootUartEvidenceOutcome::AwaitingS535 => {
            return Err(G8lS569LedgerDecouplingError::S536NotReady)
        }
    }
    match crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s537_r1_physical_boot_uart_evidence_request::service_s537_r1_physical_boot_uart_evidence_request_on_cpu1()
        .map_err(|_| G8lS569LedgerDecouplingError::S537Service)?
    {
        G8lS537R1PhysicalBootUartEvidenceRequestOutcome::RequestPublished(..)
        | G8lS537R1PhysicalBootUartEvidenceRequestOutcome::RequestRetained(..) => {}
        G8lS537R1PhysicalBootUartEvidenceRequestOutcome::AwaitingS536 => {
            return Err(G8lS569LedgerDecouplingError::S537NotReady)
        }
    }
    let s541_outcome = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s541_r1_cross_cpu_marker_readiness_handoff::service_s541_readiness_handoff_on_cpu1()
        .map_err(|_| G8lS569LedgerDecouplingError::S541Service)?;
    let timer_control_after = crate::arch::aarch64::timer::read_control();
    service_s569_model_ledger_decoupling(
        &mut S569_PRODUCTION_STATE.lock(),
        G8lS569BootContext {
            timer_control_before,
            timer_control_after,
            ..canonical_s569_boot_context()
        },
        canonical_s569_frozen_manifest_identity(),
        snapshot,
        s541_outcome,
    )
}

use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s536_r1_physical_boot_uart_evidence_contract::{
    service_s536_model_r1_physical_boot_uart_evidence_contract,
    G8lS536R1PhysicalBootUartEvidenceOutcome, G8lS536R1PhysicalBootUartEvidenceReceipt,
    G8lS536R1PhysicalBootUartEvidenceState, S536_CANONICAL_CONTRACT,
    S536_EXPECTED_PREDECESSOR, S536_PRIOR_FOCUSED_GROUPS, S536_PRIOR_FOCUSED_TESTS,
    S536_SEQUENCE,
};
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s537_r1_physical_boot_uart_evidence_request::{
    canonical_s537_request, G8lS537R1PhysicalBootUartEvidenceRequestReceipt,
};
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s538_r1_boot_ui_marker_runtime_wiring::{
    service_s538_model_marker_route_preflight, G8lS538BootUiMarkerRuntimeOutcome,
    G8lS538BootUiMarkerRuntimeState, G8lS538MarkerRoutePreflightReceipt,
    S538_PREFLIGHT_CPU,
};
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s541_r1_cross_cpu_marker_readiness_handoff::{
    service_s541_model_cpu1_readiness_handoff, G8lS541ReadinessHandoffOutcome,
    G8lS541ReadinessHandoffState, S541_READY_PRODUCER_CPU,
};
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s569_r1_boot_context_ledger_anchor_decoupling_remediation::*;
use serde_json::Value;
use sha2::{Digest, Sha256};
use std::collections::BTreeSet;

const SOURCE: &str = include_str!(
    "../../kernel/src/g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s569_r1_boot_context_ledger_anchor_decoupling_remediation.rs"
);
const S536_SOURCE: &str = include_str!(
    "../../kernel/src/g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s536_r1_physical_boot_uart_evidence_contract.rs"
);
const MAIN: &str = include_str!("../../kernel/src/main.rs");
const SIMULATION_LIB: &str = include_str!("../src/lib.rs");
const G8H: &str = include_str!("../../kernel/src/rpi5_g8h.rs");
const EXCEPTIONS: &str = include_str!("../../kernel/src/arch/aarch64/exceptions.rs");
const FROZEN_MANIFEST: &[u8] = include_bytes!("../../status/s431-s535-acceptance-gates.json");
const S546_RAW: &[u8] =
    include_bytes!("../../evidence/rpi5/r1/sequence-546-physical-boot-uart/s546-uart.raw");

fn s536_receipt() -> G8lS536R1PhysicalBootUartEvidenceReceipt {
    G8lS536R1PhysicalBootUartEvidenceReceipt {
        sequence: S536_SEQUENCE,
        predecessor_sequence: S536_EXPECTED_PREDECESSOR,
        anchor_attempt_id: S569_FROZEN_MANIFEST_ANCHOR_ID,
        completed_readiness_blocks: 15,
        prior_focused_groups: S536_PRIOR_FOCUSED_GROUPS,
        prior_focused_tests: S536_PRIOR_FOCUSED_TESTS,
        contract_published: true,
        supported_profile_runtime_observations: 0,
        physical_observations: 0,
        uart_capture_observed: false,
        boot_to_ui_observed: false,
        r1_acceptance_complete: false,
        runbook_executed: false,
    }
}

fn s537_receipt(request_id: u64) -> G8lS537R1PhysicalBootUartEvidenceRequestReceipt {
    G8lS537R1PhysicalBootUartEvidenceRequestReceipt {
        request: canonical_s537_request(s536_receipt(), request_id),
        request_published: true,
        supported_profile_runtime_observations: 0,
        physical_observations: 0,
        uart_capture_observed: false,
        boot_to_ui_observed: false,
        r1_acceptance_complete: false,
        runbook_executed: false,
    }
}

fn preflight(request_id: u64) -> G8lS538MarkerRoutePreflightReceipt {
    let mut state = G8lS538BootUiMarkerRuntimeState::new();
    let G8lS538BootUiMarkerRuntimeOutcome::PreflightArmed(receipt) =
        service_s538_model_marker_route_preflight(
            &mut state,
            S538_PREFLIGHT_CPU,
            Some(s537_receipt(request_id)),
        )
        .unwrap()
    else {
        panic!("S538 preflight must arm")
    };
    receipt
}

fn s541_published(request_id: u64) -> G8lS541ReadinessHandoffOutcome {
    let mut state = G8lS541ReadinessHandoffState::new();
    service_s541_model_cpu1_readiness_handoff(
        &mut state,
        S541_READY_PRODUCER_CPU,
        G8lS538BootUiMarkerRuntimeOutcome::PreflightArmed(preflight(request_id)),
    )
    .unwrap()
}

fn publish(
    state: &mut G8lS569LedgerDecouplingState,
    request_id: u64,
) -> Result<G8lS569LedgerDecouplingOutcome, G8lS569LedgerDecouplingError> {
    service_s569_model_ledger_decoupling(
        state,
        canonical_s569_boot_context(),
        canonical_s569_frozen_manifest_identity(),
        canonical_s569_frozen_ledger_snapshot(),
        s541_published(request_id),
    )
}

#[test]
fn sequence_scope_and_nonpromotion_are_exact() {
    assert_eq!(S569_SEQUENCE, 569);
    assert_eq!(S569_EXPECTED_PREDECESSOR, 568);
    assert_eq!(S569_REMEDIATES_SEQUENCE, 546);
    assert_eq!(S569_NEXT_FREEZE_SEQUENCE, 570);
    assert_eq!(S569_NEXT_PHYSICAL_SEQUENCE, 571);
    assert_eq!(S569_R1_STAGE, 1);
    assert_eq!(S569_TARGET_CPU, 1);
    assert_eq!(S569_REQUIRED_TIMER_CONTROL, 0b10);
    assert_eq!(
        (
            S569_DIRECT_LEDGER_FIRST_SEQUENCE,
            S569_DIRECT_LEDGER_LAST_SEQUENCE
        ),
        (431, 535)
    );
    assert_eq!(
        (
            S569_TRANSITIVE_RUNTIME_FIRST_SEQUENCE,
            S569_TRANSITIVE_RUNTIME_LAST_SEQUENCE
        ),
        (401, 535)
    );
    assert_eq!(S569_LIVE_LEDGER_READS, 0);
    assert_eq!(S569_LIVE_LEDGER_WRITES, 0);
    assert!(!S569_RUNTIME_CHAIN_EXECUTED);
    assert_eq!(S569_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS, 0);
    assert_eq!(S569_PHYSICAL_OBSERVATIONS, 0);
    assert_eq!(S569_PHYSICAL_OR_DEVICE_OPERATIONS, 0);
    assert_eq!(S569_SD_WRITES, 0);
    assert_eq!(S569_UART_OPENS, 0);
    assert_eq!(S569_POWER_TRANSITIONS, 0);
    assert_eq!(S569_NEW_IMMUTABLE_RAW_CAPTURES, 0);
    assert!(S569_S540_PHYSICAL_VERDICT_RETAINED_RED);
    assert!(S569_S543_PHYSICAL_VERDICT_RETAINED_RED);
    assert!(S569_S546_PHYSICAL_VERDICT_RETAINED_RED);
    assert!(!S569_AUTOMATIC_PROMOTION);
    assert!(!S569_BOOT_TO_UI_PHYSICALLY_OBSERVED);
    assert!(!S569_HARDWARE_PRESENT);
    assert!(!S569_R1_ACCEPTANCE_COMPLETE);
    assert!(!RUNBOOK_EXECUTED_IN_S569);
}

#[test]
fn frozen_manifest_identity_and_shape_are_byte_exact() {
    assert_eq!(FROZEN_MANIFEST.len(), S569_FROZEN_MANIFEST_BYTES);
    assert_eq!(
        format!("{:x}", Sha256::digest(FROZEN_MANIFEST)),
        S569_FROZEN_MANIFEST_SHA256
    );
    let root: Value = serde_json::from_slice(FROZEN_MANIFEST).unwrap();
    assert_eq!(root["firstSequence"], 431);
    assert_eq!(root["lastSequence"], 535);
    assert_eq!(root["gateCount"], 105);
    assert_eq!(root["blockCount"], 15);
    assert_eq!(root["stepsPerBlock"], 7);
    let gates = root["gates"].as_array().unwrap();
    assert_eq!(gates.len(), 105);
    for (offset, gate) in gates.iter().enumerate() {
        assert_eq!(gate["sequence"], 431 + offset);
    }
    let identity = canonical_s569_frozen_manifest_identity();
    assert_eq!(identity.path, "status/s431-s535-acceptance-gates.json");
    assert_eq!(identity.anchor_id, 0x28d1_217b_502e_63c7);
}

#[test]
fn module_is_registered_in_kernel_and_simulation() {
    let module = "g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s569_r1_boot_context_ledger_anchor_decoupling_remediation";
    assert!(MAIN.contains(&format!("mod {module};")));
    assert!(SIMULATION_LIB.contains(&format!("pub mod {module};")));
    assert!(SIMULATION_LIB.contains(&format!("../../kernel/src/{module}.rs\"]")));
}

#[test]
fn source_has_no_device_execution_or_live_ledger_surface() {
    for forbidden in [
        "unsafe",
        "asm!",
        "write_volatile",
        "crate::uart",
        "crate::kprintln!",
        "std::",
        "/dev/",
        "diskutil",
        "dd if=",
        "service_s431_to_s535_production_acceptance_gate_on_cpu1",
        "inspect_s431_to_s535_production_acceptance_ledger_on_cpu1",
        "service_s430_final_software_boundary_on_cpu1",
        "service_s536_r1_physical_boot_uart_evidence_contract_on_cpu1()",
    ] {
        assert!(!SOURCE.contains(forbidden), "forbidden token: {forbidden}");
    }
    assert!(SOURCE.contains("performs no device"));
    assert!(SOURCE.contains("does not rerun S546"));
    assert!(SOURCE.contains("from_frozen_source_manifest_on_cpu1"));
}

#[test]
fn diagnostic_codes_are_nonzero_and_unique() {
    let errors = [
        G8lS569LedgerDecouplingError::WrongCpu,
        G8lS569LedgerDecouplingError::G8hStageNotReleased,
        G8lS569LedgerDecouplingError::IrqsNotMasked,
        G8lS569LedgerDecouplingError::InsideG8hIrqHandler,
        G8lS569LedgerDecouplingError::TimerNotDisabled,
        G8lS569LedgerDecouplingError::ManifestIdentityDrift,
        G8lS569LedgerDecouplingError::FrozenSnapshotDrift,
        G8lS569LedgerDecouplingError::S536Service,
        G8lS569LedgerDecouplingError::S536NotReady,
        G8lS569LedgerDecouplingError::S537Service,
        G8lS569LedgerDecouplingError::S537NotReady,
        G8lS569LedgerDecouplingError::S541Service,
        G8lS569LedgerDecouplingError::S541ReadinessNotPublished,
        G8lS569LedgerDecouplingError::S541ReceiptDrift,
        G8lS569LedgerDecouplingError::PrimaryFailUartLineMissing,
        G8lS569LedgerDecouplingError::PublishedStateDrift,
    ];
    let codes: BTreeSet<_> = errors
        .into_iter()
        .map(G8lS569LedgerDecouplingError::diagnostic_code)
        .collect();
    assert_eq!(codes.len(), errors.len());
    assert!(!codes.contains(&0));
}

#[test]
fn canonical_publication_yields_exact_receipt() {
    let mut state = G8lS569LedgerDecouplingState::new();
    let G8lS569LedgerDecouplingOutcome::Published(receipt) = publish(&mut state, 0x5691).unwrap()
    else {
        panic!("first S569 publication missing")
    };
    assert_eq!(state.receipt(), Some(receipt));
    assert_eq!(receipt.sequence, 569);
    assert_eq!(receipt.predecessor_sequence, 568);
    assert_eq!(receipt.remediates_sequence, 546);
    assert_eq!(receipt.manifest, canonical_s569_frozen_manifest_identity());
    assert_eq!(
        receipt.frozen_snapshot,
        canonical_s569_frozen_ledger_snapshot()
    );
    assert_eq!(
        receipt.s541_readiness.preflight.contract_anchor_attempt_id,
        S569_FROZEN_MANIFEST_ANCHOR_ID
    );
    assert_eq!(receipt.live_ledger_reads, 0);
    assert_eq!(receipt.live_ledger_writes, 0);
    assert!(!receipt.runtime_chain_executed);
    assert!(receipt.before_g8h_timer_arm);
    assert_eq!(receipt.primary_fail_uart_lines, 1);
    assert_eq!(receipt.supported_profile_runtime_observations, 0);
    assert_eq!(receipt.physical_observations, 0);
    assert!(!receipt.runbook_executed);
}

#[test]
fn exact_replay_retains_the_same_receipt() {
    let mut state = G8lS569LedgerDecouplingState::new();
    let G8lS569LedgerDecouplingOutcome::Published(receipt) = publish(&mut state, 0x5692).unwrap()
    else {
        panic!("first publication missing")
    };
    assert_eq!(
        publish(&mut state, 0x5692),
        Ok(G8lS569LedgerDecouplingOutcome::Retained(receipt))
    );
}

#[test]
fn divergent_readiness_after_publication_fails_closed() {
    let mut state = G8lS569LedgerDecouplingState::new();
    publish(&mut state, 0x5693).unwrap();
    assert_eq!(
        publish(&mut state, 0x5694),
        Err(G8lS569LedgerDecouplingError::PublishedStateDrift)
    );
}

#[test]
fn manifest_and_snapshot_drift_fail_before_publication() {
    let mut manifest = canonical_s569_frozen_manifest_identity();
    manifest.bytes -= 1;
    assert_eq!(
        service_s569_model_ledger_decoupling(
            &mut G8lS569LedgerDecouplingState::new(),
            canonical_s569_boot_context(),
            manifest,
            canonical_s569_frozen_ledger_snapshot(),
            s541_published(0x5695),
        ),
        Err(G8lS569LedgerDecouplingError::ManifestIdentityDrift)
    );
    let mut snapshot = canonical_s569_frozen_ledger_snapshot();
    snapshot.last_completed_sequence = 534;
    assert_eq!(
        service_s569_model_ledger_decoupling(
            &mut G8lS569LedgerDecouplingState::new(),
            canonical_s569_boot_context(),
            canonical_s569_frozen_manifest_identity(),
            snapshot,
            s541_published(0x5696),
        ),
        Err(G8lS569LedgerDecouplingError::FrozenSnapshotDrift)
    );
}

#[test]
fn every_boot_context_boundary_fails_closed() {
    let cases = [
        (
            G8lS569BootContext {
                caller_cpu: 0,
                ..canonical_s569_boot_context()
            },
            G8lS569LedgerDecouplingError::WrongCpu,
        ),
        (
            G8lS569BootContext {
                g8h_stage_released: false,
                ..canonical_s569_boot_context()
            },
            G8lS569LedgerDecouplingError::G8hStageNotReleased,
        ),
        (
            G8lS569BootContext {
                irqs_masked: false,
                ..canonical_s569_boot_context()
            },
            G8lS569LedgerDecouplingError::IrqsNotMasked,
        ),
        (
            G8lS569BootContext {
                inside_g8h_irq_handler: true,
                ..canonical_s569_boot_context()
            },
            G8lS569LedgerDecouplingError::InsideG8hIrqHandler,
        ),
        (
            G8lS569BootContext {
                timer_control_after: 0b01,
                ..canonical_s569_boot_context()
            },
            G8lS569LedgerDecouplingError::TimerNotDisabled,
        ),
        (
            G8lS569BootContext {
                primary_fail_uart_line_wired: false,
                ..canonical_s569_boot_context()
            },
            G8lS569LedgerDecouplingError::PrimaryFailUartLineMissing,
        ),
    ];
    for (context, expected) in cases {
        let mut state = G8lS569LedgerDecouplingState::new();
        assert_eq!(
            service_s569_model_ledger_decoupling(
                &mut state,
                context,
                canonical_s569_frozen_manifest_identity(),
                canonical_s569_frozen_ledger_snapshot(),
                s541_published(0x5697),
            ),
            Err(expected)
        );
        assert_eq!(state.receipt(), None);
    }
}

#[test]
fn nonpublished_or_drifted_s541_readiness_is_rejected() {
    let retry = G8lS541ReadinessHandoffOutcome::Cpu1RetryScheduled {
        retry_attempts: 1,
        remaining_attempts: 1023,
    };
    assert_eq!(
        service_s569_model_ledger_decoupling(
            &mut G8lS569LedgerDecouplingState::new(),
            canonical_s569_boot_context(),
            canonical_s569_frozen_manifest_identity(),
            canonical_s569_frozen_ledger_snapshot(),
            retry,
        ),
        Err(G8lS569LedgerDecouplingError::S541ReadinessNotPublished)
    );
    let G8lS541ReadinessHandoffOutcome::Cpu1ReadinessPublished(mut receipt) =
        s541_published(0x5698)
    else {
        panic!("S541 publication missing")
    };
    receipt.preflight.contract_anchor_attempt_id = 1;
    assert_eq!(
        service_s569_model_ledger_decoupling(
            &mut G8lS569LedgerDecouplingState::new(),
            canonical_s569_boot_context(),
            canonical_s569_frozen_manifest_identity(),
            canonical_s569_frozen_ledger_snapshot(),
            G8lS541ReadinessHandoffOutcome::Cpu1ReadinessPublished(receipt),
        ),
        Err(G8lS569LedgerDecouplingError::S541ReceiptDrift)
    );
}

#[test]
fn frozen_snapshot_satisfies_unchanged_s536_model() {
    let snapshot = canonical_s569_frozen_ledger_snapshot();
    let mut state = G8lS536R1PhysicalBootUartEvidenceState::new();
    let outcome = service_s536_model_r1_physical_boot_uart_evidence_contract(
        &mut state,
        1,
        Some(snapshot),
        S536_CANONICAL_CONTRACT,
    )
    .unwrap();
    assert!(matches!(
        outcome,
        G8lS536R1PhysicalBootUartEvidenceOutcome::ContractPublished(_)
    ));
    assert_eq!(
        state.receipt().unwrap().anchor_attempt_id,
        S569_FROZEN_MANIFEST_ANCHOR_ID
    );
}

#[test]
fn s536_retains_historical_live_entry_and_adds_frozen_entry() {
    assert_eq!(
        S536_SOURCE
            .matches("pub fn service_s536_r1_physical_boot_uart_evidence_contract_on_cpu1")
            .count(),
        1
    );
    assert_eq!(
        S536_SOURCE
            .matches("pub fn service_s536_r1_physical_boot_uart_evidence_contract_from_frozen_source_manifest_on_cpu1")
            .count(),
        1
    );
    let frozen = S536_SOURCE
        .find("pub fn service_s536_r1_physical_boot_uart_evidence_contract_from_frozen_source_manifest_on_cpu1")
        .unwrap();
    let frozen_tail = &S536_SOURCE[frozen..];
    assert!(!frozen_tail.contains("inspect_s431_to_s535_production_acceptance_ledger_on_cpu1"));
}

#[test]
fn g8h_replaces_s544_with_s569_before_task_stack_and_timer_arm() {
    let secondary = G8H
        .split("pub extern \"C\" fn rpi5_g8h_secondary_run() -> !")
        .nth(1)
        .unwrap();
    let identity = secondary.find("validate_identity_or_fail();").unwrap();
    let s569 = secondary
        .find("service_s569_frozen_manifest_readiness_before_g8h_timer_arm_on_cpu1()")
        .unwrap();
    let task_stack = secondary.find("rpi5_g8c_call_on_stack").unwrap();
    assert!(identity < s569 && s569 < task_stack);
    assert_eq!(
        G8H.matches("service_s569_frozen_manifest_readiness_before_g8h_timer_arm_on_cpu1()")
            .count(),
        1
    );
    assert!(!G8H.contains("service_s544_reachable_readiness_before_g8h_timer_arm_on_cpu1()"));
}

#[test]
fn primary_fail_emits_exactly_one_bounded_cpu0_error_line_before_park() {
    let start = G8H.find("fn primary_fail(").unwrap();
    let stop = start + G8H[start..].find("fn primary_require(").unwrap();
    let body = &G8H[start..stop];
    let publish = body.find("publish_error(code, expected, actual);").unwrap();
    let line = body.find(S569_PRIMARY_FAIL_MARKER).unwrap();
    let park = body.find("loop {").unwrap();
    assert!(publish < line && line < park);
    assert_eq!(body.matches("crate::kprintln!(").count(), 1);
    assert_eq!(G8H.matches(S569_PRIMARY_FAIL_MARKER).count(), 1);
    assert!(body.contains("CODE={} EXPECTED={} ACTUAL={}"));
}

#[test]
fn generic_timer_path_gains_no_s569_or_extra_live_ledger_callsite() {
    assert!(!EXCEPTIONS.contains("_s569_"));
    assert!(!EXCEPTIONS.contains("frozen_manifest_readiness"));
    assert_eq!(
        EXCEPTIONS
            .matches("service_post_s430_acceptance_gate!(")
            .count(),
        105
    );
}

#[test]
fn immutable_s546_red_is_retained_byte_exact() {
    assert_eq!(S546_RAW.len(), S569_S546_RAW_BYTES);
    assert_eq!(
        format!("{:x}", Sha256::digest(S546_RAW)),
        S569_S546_RAW_SHA256
    );
    assert!(S546_RAW
        .windows(b"ASELSAN/BOOT8G".len())
        .any(|w| w == b"ASELSAN/BOOT8G"));
    assert!(!S546_RAW
        .windows(b"ASELSAN/BOOT8H".len())
        .any(|w| w == b"ASELSAN/BOOT8H"));
    assert!(!S546_RAW
        .windows(S569_PRIMARY_FAIL_MARKER.len())
        .any(|w| w == S569_PRIMARY_FAIL_MARKER.as_bytes()));
}

#[test]
fn source_gate_keeps_all_runtime_physical_and_product_claims_closed() {
    for required in [
        "S569_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS: usize = 0",
        "S569_PHYSICAL_OBSERVATIONS: usize = 0",
        "S569_PHYSICAL_OR_DEVICE_OPERATIONS: usize = 0",
        "S569_BOOT_TO_UI_PHYSICALLY_OBSERVED: bool = false",
        "S569_R1_ACCEPTANCE_COMPLETE: bool = false",
        "RUNBOOK_EXECUTED_IN_S569: bool = false",
    ] {
        assert!(SOURCE.contains(required), "missing non-claim: {required}");
    }
}

  {
    id: "g8l-s569-r1-boot-context-ledger-anchor-decoupling-remediation",
    date: "2026-08-31",
    sequence: 569,
    status: "passed",
    umbrella_status: "partial",
    title: "S569 · G8h boot-context ledger bağımlılığı remediation",
    summary:
      "S569 source/production-integration kapısı PASS'tir. Tarihsel S544 modülü ve kanıtı korunurken yalnız imkânsız G8h çağrısı kaldırıldı: exact checked-in S431–S535 source manifestinden frozen S536 girdisi üretiliyor, ardından mevcut S537 ve S541 servisleri G8h task-stack/timer arm öncesinde çalışıyor. Live S401–S535 ledger read/write ve runtime-chain execution sıfırdır; synthetic S430 runtime sonucu üretilmez. CPU0 primary_fail artık park etmeden önce tek bounded ASELSAN/G8HERR satırı verir. Focused 18/18 ve board-rpi5 AArch64 check exit 0'dır; runtime/fiziksel/device operation=0 ve S546 immutable RED kalır.",
    evidence: [
      "Seçilen tasarım tarihsel S544 modülünü silmez; yalnız G8h production callsite'ını S569 frozen-manifest servisiyle supersede eder.",
      "Frozen source anchor status/s431-s535-acceptance-gates.json: 88859 B / 28d1217b502e63c78c7efeaa47fc6f375ae4d080016f1e4f90a3a98fda075e06, aralık S431–S535, 105 gate, 15 block × 7 step ve anchor 0x28d1217b502e63c7'dir.",
      "Yeni S536 board entry frozen snapshot'ı değişmemiş S536 modeline verir; canlı acceptance ledger'a dokunmaz ve S430 runtime state uydurmaz.",
      "G8h çağrı sırası CPU1 identity → frozen S536 → S537 → S541 → task-stack → timer arm'dır; tarihsel S544 çağrısı bu production blokta yoktur.",
      "primary_fail publish_error sonrasında exact tek bounded ASELSAN/G8HERR REPORTER=CPU0 CODE={} EXPECTED={} ACTUAL={} satırı basar ve sonra park eder.",
      "Live ledger reads/writes/runtime-chain executions=0/0/0; 16 diagnostic kod benzersiz ve nonzero'dur.",
      "Focused test 1 grup / 18 passed / 0 failed / 0 ignored / 0 filtered verdi; frozen manifesti yeniden hash/parse eder ve S546 raw'ını byte-exact korur.",
      "board-rpi5 AArch64 cargo check exit 0 verdi; mevcut warning'ler korunur ve zero-warning iddiası yoktur.",
      "Implementation 16063 B / 578919e204ba7d3ada8d8f0b9cad883aea3c375f579115cf9403ae2021e5ad58; focused test 19996 B / 3bcfbbedfb67fcc4946354b212bb48f19a31e43d36ab2bc56a6005855509cbb7; proof 5092 B / 51206314606d0bd3965c1e414bc8eb22b0dd46c2d2ee0dd865fee7d561068f63 SHA-256'dır.",
      "S536 production source 11251 B / d07acddca7657b3a224653c489e31c44ec576f4a771693883597b9d47f6819b5; G8h source 88122 B / 624b78efcdd32c9d5cf1e1cd6e772b54324fb5b7c624b3072e44cb0299533d1d'dir.",
      "S540/S543/S546 physical RED korunur; S569'da SD write/read-back/eject, UART open/capture, power transition veya yeni raw yoktur.",
      "RUNBOOK_EXECUTED_IN_S569=NO; runtime/physical observations=0/0, Boot-to-UI=false ve R1 acceptance=false'dur.",
    ],
    commands: [
      "CARGO_INCREMENTAL=0 cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s569_r1_boot_context_ledger_anchor_decoupling_remediation -- --test-threads=1",
      "CARGO_INCREMENTAL=0 cargo check -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
    ],
    terminalSessions: [
      {
        id: "s569-focused",
        title: "S569 ledger-decoupling focused acceptance",
        commandLines: [
          "CARGO_INCREMENTAL=0 cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s569_r1_boot_context_ledger_anchor_decoupling_remediation -- --test-threads=1",
        ],
        outputLines: [
          "test result: ok. 18 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out",
          "live ledger read/write=0/0; physical/device operations=0",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "s569-board-check",
        title: "S569 board-rpi5 AArch64 production compile",
        commandLines: [
          "CARGO_INCREMENTAL=0 cargo check -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
        ],
        outputLines: [
          "exit 0",
          "existing warning headers retained; zero-warning claim=false",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
    ],
    limitations: [
      "S569 source integrationidir; yeni production path henüz fiziksel RPi5 raw'ıyla gözlenmemiştir.",
      "Frozen source-acceptance manifest runtime S401–S535 execution kanıtı değildir.",
      "Yeni G8HERR hata görünürlüğüdür; başarı veya Boot-to-UI marker'ı değildir.",
      "RUNBOOK_EXECUTED_IN_S569=NO; physical/device operations=0.",
    ],
  },