S570 · Tekrar üretilebilir RPi5 aday dondurma ve S571 pre-arm

//! S570 host-only candidate freeze and S571 pre-arm contract.
//!
//! This gate binds two isolated builds of the S569 production remediation,
//! the read-only machine-layout audit, and an immutable four-file RPi5
//! package. It performs no runtime, physical, SD, UART, or power operation.
//! The S571 authorization string is data only: even an exact request leaves
//! execution permission withheld at this gate.

#![allow(dead_code)]

pub const S570_SEQUENCE: usize = 570;
pub const S570_EXPECTED_PREDECESSOR: usize = 569;
pub const S570_NEXT_SEQUENCE: usize = 571;
pub const S570_R1_STAGE: u8 = 1;
pub const S570_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS: usize = 0;
pub const S570_PHYSICAL_OBSERVATIONS: usize = 0;
pub const S570_PHYSICAL_OR_DEVICE_OPERATIONS: usize = 0;
pub const S570_SD_WRITES: usize = 0;
pub const S570_UART_OPENS: usize = 0;
pub const S570_POWER_TRANSITIONS: usize = 0;
pub const S570_NEW_IMMUTABLE_RAW_CAPTURES: usize = 0;
pub const S570_HARDWARE_PRESENT: bool = false;
pub const S570_BOOT_TO_UI_PHYSICALLY_OBSERVED: bool = false;
pub const S570_R1_ACCEPTANCE_COMPLETE: bool = false;
pub const S570_AUTOMATIC_PROMOTION: bool = false;
pub const S570_EXECUTION_PERMIT: bool = false;
pub const RUNBOOK_EXECUTED_IN_S570: bool = false;

pub const S570_CANDIDATE_PROFILE: &str = "board-rpi5";
pub const S570_CARGO_FEATURE_FLAGS: &str = "--no-default-features --features board-rpi5";
pub const S570_CARGO_INCREMENTAL: u8 = 0;
pub const S570_ISOLATED_BUILD_COUNT: usize = 2;
pub const S570_ELF_BYTES: u64 = 18_537_440;
pub const S570_ELF_SHA256: &str =
    "3260b2e8b0ae80ee65c3ffaaf6db3b675d505bfc1d18502c4067b7ed535071be";
pub const S570_BUILD_A_LOG_BYTES: u64 = 1_699_854;
pub const S570_BUILD_A_LOG_SHA256: &str =
    "921970cb452bf09ffe8ec45c0fdc299d085aad369709198dc9802d6bf3bd80b5";
pub const S570_BUILD_B_LOG_BYTES: u64 = 1_699_854;
pub const S570_BUILD_B_LOG_SHA256: &str =
    "22b7b4333d1d59ba9d279c8b695c1188f48e20fa35e6696d955fa24c77f43322";
pub const S570_BUILD_WARNING_HEADERS_EACH: usize = 4_497;
pub const S570_ZERO_WARNING_CLAIMED: bool = false;
pub const S570_POST_REGISTRATION_REPRO_LOG_BYTES: u64 = 1_699_854;
pub const S570_POST_REGISTRATION_REPRO_LOG_SHA256: &str =
    "ee42becd114aa3e1ec05fb4406da79a3f469cd3922b2edc876550590cd7c1a7c";
pub const S570_POST_REGISTRATION_ELF_IDENTICAL: bool = true;
pub const S570_POST_REGISTRATION_IMAGE_IDENTICAL: bool = true;

pub const S570_IMAGE_BYTES: u64 = 945_920;
pub const S570_IMAGE_SHA256: &str =
    "a24f4d24e838cd7d1a6b2ff217d864e9c4b08f12ce7dd165b302e8073a980b04";
pub const S570_PACKAGE_DIRECTORY: &str = "evidence/rpi5/r1/sequence-570-candidate-freeze/package";
pub const S570_PACKAGE_ENTRIES: usize = 4;
pub const S570_PACKAGE_MODE: u32 = 0o444;
pub const S570_PACKAGE_NLINK: u32 = 1;
pub const S570_IMAGE_NAME: &str = "aselsanos-rpi5.img";
pub const S570_DTB_NAME: &str = "bcm2712-rpi-5-b.dtb";
pub const S570_CONFIG_NAME: &str = "config.txt";
pub const S570_MANIFEST_NAME: &str = "SHA256SUMS";
pub const S570_DTB_BYTES: u64 = 78_703;
pub const S570_DTB_SHA256: &str =
    "40a2fbe9c29e8b9a4912cf726a943068defb779fc052ec38e457a79c58abca00";
pub const S570_CONFIG_BYTES: u64 = 401;
pub const S570_CONFIG_SHA256: &str =
    "f1fd182fec3a6b46639195881b2b452efe019ca88556c58081aff0a05daee865";
pub const S570_MANIFEST_BYTES: u64 = 248;
pub const S570_MANIFEST_SHA256: &str =
    "83e8eb41c5fa0b81f5d05557cc1445c1d9834617126de3b798037e6d96025fe1";
pub const S570_MANIFEST_LINES: usize = 3;

pub const S570_LAYOUT_VERIFIER_PATH: &str = "scripts/verify-rpi5-s570-layout.sh";
pub const S570_LAYOUT_VERIFIER_BYTES: u64 = 11_301;
pub const S570_LAYOUT_VERIFIER_SHA256: &str =
    "f178a3f56027d7499197dcf13e8acd17ceb7b08e32695716540a635342904590";
pub const S570_FREEZE_TOOL_PATH: &str = "scripts/freeze-rpi5-s570-r1-candidate.sh";
pub const S570_FREEZE_TOOL_BYTES: u64 = 10_336;
pub const S570_FREEZE_TOOL_SHA256: &str =
    "2aadd1fa57d6fcc26907701bfe4275357f29bac34f522dc76366709ea83aa22a";
pub const S570_FIRMWARE_CONFIG_PATH: &str = "firmware/config-r1-s570.txt";
pub const S570_FREEZE_LOG_BYTES: u64 = 616;
pub const S570_FREEZE_LOG_SHA256: &str =
    "4c2b3a2a37a84380556d42cfb88ea75f81071656366e288e28b88bf04993120c";

pub const S570_ENTRY_ADDRESS: u64 = 0x80000;
pub const S570_KERNEL_START: u64 = 0x80000;
pub const S570_KERNEL_END: u64 = 0x11f_9000;
pub const S570_LINKED_SPAN: u64 = 18_321_408;
pub const S570_LIVE_LEDGER_G8H_CALLS: usize = 0;
pub const S570_S544_G8H_MODEL_CALLS: usize = 0;
pub const S570_FROZEN_S536_MODEL_CALLS: usize = 1;
pub const S570_S537_G8H_CALLS: usize = 1;
pub const S570_S541_G8H_CALLS: usize = 1;
pub const S570_G8H_ERROR_MARKER_COUNT: usize = 1;
pub const S570_BOOT_TO_UI_LITERAL_COUNT: usize = 2;
pub const S570_FROZEN_MANIFEST_PATH: &str = "status/s431-s535-acceptance-gates.json";
pub const S570_FROZEN_MANIFEST_BYTES: u64 = 88_859;
pub const S570_FROZEN_MANIFEST_SHA256: &str =
    "28d1217b502e63c78c7efeaa47fc6f375ae4d080016f1e4f90a3a98fda075e06";
pub const S570_G8H_ERROR_MARKER: &str = "ASELSAN/G8HERR REPORTER=CPU0 CODE=";

pub const S570_S546_PHYSICAL_VERDICT_RETAINED_RED: bool = true;
pub const S570_S546_RAW_BYTES: u64 = 16_990;
pub const S570_S546_RAW_SHA256: &str =
    "a71a9107b4b6ea351eb65720a6b82486105fffdb931563d1c39e8a381c3e485d";

pub const S570_PREARM_CARD_SERIAL: u32 = 0x425001fa;
pub const S570_PREARM_CARD_RAW_CID: &str = "009f5449534436344761425001fa01a1";
pub const S570_PREARM_CARD_BYTES: u64 = 62_549_655_552;
pub const S570_PREARM_CARD_NAME: &str = "TISD64G";
pub const S570_PREARM_VOLUME_LABEL: &str = "ASELSANBOOT";
pub const S570_PREARM_DEBUG_PROBE_SERIAL: &str = "E6647C74033F9131";
pub const S570_PREARM_SERIAL_PATH_LAST_RESOLVED: &str = "/dev/cu.usbmodem21302";
pub const S570_PREARM_AUTHORIZATION_TOKEN: &str =
    "S571_AUTHORIZE_SD_WRITE_READBACK_EJECT_UART_PREARM_ONE_POWER_ON_a24f4d24_425001fa_62549655552";

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS570ArtifactIdentity {
    pub bytes: u64,
    pub sha256: &'static str,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS570BuildObservation {
    pub isolated_target_root: bool,
    pub cargo_incremental: u8,
    pub elf: G8lS570ArtifactIdentity,
    pub log: G8lS570ArtifactIdentity,
    pub warning_headers: usize,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS570LayoutObservation {
    pub entry: u64,
    pub kernel_start: u64,
    pub kernel_end: u64,
    pub linked_span: u64,
    pub live_ledger_g8h_calls: usize,
    pub s544_g8h_model_calls: usize,
    pub frozen_s536_model_calls: usize,
    pub s537_g8h_calls: usize,
    pub s541_g8h_calls: usize,
    pub s569_state_symbols: usize,
    pub g8h_error_marker_count: usize,
    pub boot_to_ui_literal_count: usize,
    pub manifest_path_count: usize,
    pub manifest_sha_count: usize,
    pub release_acquire_barriers_verified: bool,
    pub inputs_immutable: bool,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS570PackageEntryObservation {
    pub name: &'static str,
    pub identity: G8lS570ArtifactIdentity,
    pub mode: u32,
    pub link_count: u32,
    pub inode_id: u64,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS570FreezeInput {
    pub predecessor_sequence: usize,
    pub predecessor_passed: bool,
    pub builds: [G8lS570BuildObservation; S570_ISOLATED_BUILD_COUNT],
    pub layout: G8lS570LayoutObservation,
    pub package: [G8lS570PackageEntryObservation; S570_PACKAGE_ENTRIES],
    pub manifest: G8lS570ArtifactIdentity,
    pub layout_verifier: G8lS570ArtifactIdentity,
    pub freeze_tool: G8lS570ArtifactIdentity,
    pub firmware_config: G8lS570ArtifactIdentity,
    pub freeze_log: G8lS570ArtifactIdentity,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS570CandidateFreezeReceipt {
    pub sequence: usize,
    pub predecessor_sequence: usize,
    pub build_count: usize,
    pub candidate: G8lS570ArtifactIdentity,
    pub package_manifest: G8lS570ArtifactIdentity,
    pub package_entries: usize,
    pub package_inode_signature: u64,
    pub warning_headers_total: usize,
    pub live_ledger_g8h_calls: usize,
    pub s544_g8h_model_calls: usize,
    pub g8h_error_marker_count: usize,
    pub physical_or_device_operations: usize,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS570CandidateFreezeState {
    receipt: Option<G8lS570CandidateFreezeReceipt>,
}

impl G8lS570CandidateFreezeState {
    pub const fn new() -> Self {
        Self { receipt: None }
    }

    pub const fn receipt(&self) -> Option<G8lS570CandidateFreezeReceipt> {
        self.receipt
    }
}

impl Default for G8lS570CandidateFreezeState {
    fn default() -> Self {
        Self::new()
    }
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS570CandidateFreezeOutcome {
    CandidateFrozen(G8lS570CandidateFreezeReceipt),
    CandidateRetained(G8lS570CandidateFreezeReceipt),
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS570CandidateFreezeError {
    PredecessorRejected,
    BuildIsolationDrift,
    BuildIdentityDrift,
    BuildLogIdentityDrift,
    WarningHeaderDrift,
    LayoutAddressDrift,
    LiveLedgerCallPresent,
    HistoricalS544CallPresent,
    FrozenCallShapeDrift,
    S569StateMissing,
    MarkerMembershipDrift,
    BarrierOrMutationDrift,
    PackageNameDrift,
    PackageIdentityDrift,
    PackageMetadataDrift,
    PackageInodeDrift,
    ManifestIdentityDrift,
    ToolIdentityDrift,
    FrozenStateDrift,
}

impl G8lS570CandidateFreezeError {
    pub const fn diagnostic_code(self) -> u64 {
        match self {
            Self::PredecessorRejected => 0x5701,
            Self::BuildIsolationDrift => 0x5702,
            Self::BuildIdentityDrift => 0x5703,
            Self::BuildLogIdentityDrift => 0x5704,
            Self::WarningHeaderDrift => 0x5705,
            Self::LayoutAddressDrift => 0x5706,
            Self::LiveLedgerCallPresent => 0x5707,
            Self::HistoricalS544CallPresent => 0x5708,
            Self::FrozenCallShapeDrift => 0x5709,
            Self::S569StateMissing => 0x570a,
            Self::MarkerMembershipDrift => 0x570b,
            Self::BarrierOrMutationDrift => 0x570c,
            Self::PackageNameDrift => 0x570d,
            Self::PackageIdentityDrift => 0x570e,
            Self::PackageMetadataDrift => 0x570f,
            Self::PackageInodeDrift => 0x5710,
            Self::ManifestIdentityDrift => 0x5711,
            Self::ToolIdentityDrift => 0x5712,
            Self::FrozenStateDrift => 0x5713,
        }
    }
}

pub const fn s570_identity(bytes: u64, sha256: &'static str) -> G8lS570ArtifactIdentity {
    G8lS570ArtifactIdentity { bytes, sha256 }
}

const fn str_eq(left: &str, right: &str) -> bool {
    let left = left.as_bytes();
    let right = right.as_bytes();
    if left.len() != right.len() {
        return false;
    }
    let mut index = 0;
    while index < left.len() {
        if left[index] != right[index] {
            return false;
        }
        index += 1;
    }
    true
}

const fn identity_eq(left: G8lS570ArtifactIdentity, right: G8lS570ArtifactIdentity) -> bool {
    left.bytes == right.bytes && str_eq(left.sha256, right.sha256)
}

pub const fn expected_s570_package_identity(name: &str) -> Option<G8lS570ArtifactIdentity> {
    if str_eq(name, S570_IMAGE_NAME) {
        Some(s570_identity(S570_IMAGE_BYTES, S570_IMAGE_SHA256))
    } else if str_eq(name, S570_DTB_NAME) {
        Some(s570_identity(S570_DTB_BYTES, S570_DTB_SHA256))
    } else if str_eq(name, S570_CONFIG_NAME) {
        Some(s570_identity(S570_CONFIG_BYTES, S570_CONFIG_SHA256))
    } else if str_eq(name, S570_MANIFEST_NAME) {
        Some(s570_identity(S570_MANIFEST_BYTES, S570_MANIFEST_SHA256))
    } else {
        None
    }
}

fn check_builds(
    builds: &[G8lS570BuildObservation; S570_ISOLATED_BUILD_COUNT],
) -> Result<(), G8lS570CandidateFreezeError> {
    let expected_elf = s570_identity(S570_ELF_BYTES, S570_ELF_SHA256);
    let expected_logs = [
        s570_identity(S570_BUILD_A_LOG_BYTES, S570_BUILD_A_LOG_SHA256),
        s570_identity(S570_BUILD_B_LOG_BYTES, S570_BUILD_B_LOG_SHA256),
    ];
    let mut index = 0;
    while index < builds.len() {
        let build = builds[index];
        if !build.isolated_target_root || build.cargo_incremental != S570_CARGO_INCREMENTAL {
            return Err(G8lS570CandidateFreezeError::BuildIsolationDrift);
        }
        if !identity_eq(build.elf, expected_elf) {
            return Err(G8lS570CandidateFreezeError::BuildIdentityDrift);
        }
        if !identity_eq(build.log, expected_logs[index]) {
            return Err(G8lS570CandidateFreezeError::BuildLogIdentityDrift);
        }
        if build.warning_headers != S570_BUILD_WARNING_HEADERS_EACH {
            return Err(G8lS570CandidateFreezeError::WarningHeaderDrift);
        }
        index += 1;
    }
    Ok(())
}

fn check_layout(layout: G8lS570LayoutObservation) -> Result<(), G8lS570CandidateFreezeError> {
    if layout.entry != S570_ENTRY_ADDRESS
        || layout.kernel_start != S570_KERNEL_START
        || layout.kernel_end != S570_KERNEL_END
        || layout.linked_span != S570_LINKED_SPAN
        || layout.kernel_end.checked_sub(layout.kernel_start) != Some(layout.linked_span)
    {
        return Err(G8lS570CandidateFreezeError::LayoutAddressDrift);
    }
    if layout.live_ledger_g8h_calls != S570_LIVE_LEDGER_G8H_CALLS {
        return Err(G8lS570CandidateFreezeError::LiveLedgerCallPresent);
    }
    if layout.s544_g8h_model_calls != S570_S544_G8H_MODEL_CALLS {
        return Err(G8lS570CandidateFreezeError::HistoricalS544CallPresent);
    }
    if layout.frozen_s536_model_calls != S570_FROZEN_S536_MODEL_CALLS
        || layout.s537_g8h_calls != S570_S537_G8H_CALLS
        || layout.s541_g8h_calls != S570_S541_G8H_CALLS
    {
        return Err(G8lS570CandidateFreezeError::FrozenCallShapeDrift);
    }
    if layout.s569_state_symbols != 1 {
        return Err(G8lS570CandidateFreezeError::S569StateMissing);
    }
    if layout.g8h_error_marker_count != S570_G8H_ERROR_MARKER_COUNT
        || layout.boot_to_ui_literal_count != S570_BOOT_TO_UI_LITERAL_COUNT
        || layout.manifest_path_count != 1
        || layout.manifest_sha_count != 1
    {
        return Err(G8lS570CandidateFreezeError::MarkerMembershipDrift);
    }
    if !layout.release_acquire_barriers_verified || !layout.inputs_immutable {
        return Err(G8lS570CandidateFreezeError::BarrierOrMutationDrift);
    }
    Ok(())
}

fn check_package(
    package: &[G8lS570PackageEntryObservation; S570_PACKAGE_ENTRIES],
) -> Result<u64, G8lS570CandidateFreezeError> {
    let names = [
        S570_IMAGE_NAME,
        S570_DTB_NAME,
        S570_CONFIG_NAME,
        S570_MANIFEST_NAME,
    ];
    let mut signature = 0u64;
    let mut index = 0;
    while index < package.len() {
        let entry = package[index];
        if !str_eq(entry.name, names[index]) {
            return Err(G8lS570CandidateFreezeError::PackageNameDrift);
        }
        let Some(expected) = expected_s570_package_identity(entry.name) else {
            return Err(G8lS570CandidateFreezeError::PackageNameDrift);
        };
        if !identity_eq(entry.identity, expected) {
            return Err(G8lS570CandidateFreezeError::PackageIdentityDrift);
        }
        if entry.mode != S570_PACKAGE_MODE || entry.link_count != S570_PACKAGE_NLINK {
            return Err(G8lS570CandidateFreezeError::PackageMetadataDrift);
        }
        if entry.inode_id == 0 {
            return Err(G8lS570CandidateFreezeError::PackageInodeDrift);
        }
        let mut prior = 0;
        while prior < index {
            if package[prior].inode_id == entry.inode_id {
                return Err(G8lS570CandidateFreezeError::PackageInodeDrift);
            }
            prior += 1;
        }
        let Some(weighted) = entry.inode_id.checked_mul(index as u64 + 1) else {
            return Err(G8lS570CandidateFreezeError::PackageInodeDrift);
        };
        let Some(next) = signature.checked_add(weighted) else {
            return Err(G8lS570CandidateFreezeError::PackageInodeDrift);
        };
        signature = next;
        index += 1;
    }
    Ok(signature)
}

pub fn service_s570_model_candidate_freeze(
    state: &mut G8lS570CandidateFreezeState,
    input: G8lS570FreezeInput,
) -> Result<G8lS570CandidateFreezeOutcome, G8lS570CandidateFreezeError> {
    if input.predecessor_sequence != S570_EXPECTED_PREDECESSOR || !input.predecessor_passed {
        return Err(G8lS570CandidateFreezeError::PredecessorRejected);
    }
    check_builds(&input.builds)?;
    check_layout(input.layout)?;
    let inode_signature = check_package(&input.package)?;
    if !identity_eq(
        input.manifest,
        s570_identity(S570_MANIFEST_BYTES, S570_MANIFEST_SHA256),
    ) {
        return Err(G8lS570CandidateFreezeError::ManifestIdentityDrift);
    }
    if !identity_eq(
        input.layout_verifier,
        s570_identity(S570_LAYOUT_VERIFIER_BYTES, S570_LAYOUT_VERIFIER_SHA256),
    ) || !identity_eq(
        input.freeze_tool,
        s570_identity(S570_FREEZE_TOOL_BYTES, S570_FREEZE_TOOL_SHA256),
    ) || !identity_eq(
        input.firmware_config,
        s570_identity(S570_CONFIG_BYTES, S570_CONFIG_SHA256),
    ) || !identity_eq(
        input.freeze_log,
        s570_identity(S570_FREEZE_LOG_BYTES, S570_FREEZE_LOG_SHA256),
    ) {
        return Err(G8lS570CandidateFreezeError::ToolIdentityDrift);
    }

    let receipt = G8lS570CandidateFreezeReceipt {
        sequence: S570_SEQUENCE,
        predecessor_sequence: input.predecessor_sequence,
        build_count: S570_ISOLATED_BUILD_COUNT,
        candidate: s570_identity(S570_IMAGE_BYTES, S570_IMAGE_SHA256),
        package_manifest: input.manifest,
        package_entries: S570_PACKAGE_ENTRIES,
        package_inode_signature: inode_signature,
        warning_headers_total: S570_BUILD_WARNING_HEADERS_EACH * S570_ISOLATED_BUILD_COUNT,
        live_ledger_g8h_calls: input.layout.live_ledger_g8h_calls,
        s544_g8h_model_calls: input.layout.s544_g8h_model_calls,
        g8h_error_marker_count: input.layout.g8h_error_marker_count,
        physical_or_device_operations: S570_PHYSICAL_OR_DEVICE_OPERATIONS,
    };
    match state.receipt {
        None => {
            state.receipt = Some(receipt);
            Ok(G8lS570CandidateFreezeOutcome::CandidateFrozen(receipt))
        }
        Some(existing) if existing == receipt => {
            Ok(G8lS570CandidateFreezeOutcome::CandidateRetained(existing))
        }
        Some(_) => Err(G8lS570CandidateFreezeError::FrozenStateDrift),
    }
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS570S571PrearmRequest<'a> {
    pub sequence: usize,
    pub authorization_token: Option<&'a str>,
    pub candidate: G8lS570ArtifactIdentity,
    pub card_serial: u32,
    pub card_raw_cid: &'a str,
    pub card_bytes: u64,
    pub card_name: &'a str,
    pub volume_label: &'a str,
    pub debug_probe_serial: &'a str,
    pub power_off_asserted: bool,
    pub fresh_target_resolution_required: bool,
    pub fresh_uart_resolution_required: bool,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS570S571PrearmOutcome {
    StopNotAuthorized,
    ContractReadyExecutionPermitWithheld {
        sequence: usize,
        execution_permit: bool,
        physical_or_device_operations: usize,
    },
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS570S571PrearmError {
    SequenceDrift,
    AuthorizationTokenDrift,
    CandidateDrift,
    CardIdentityDrift,
    ProbeIdentityDrift,
    SafetyDisciplineDrift,
}

impl G8lS570S571PrearmError {
    pub const fn diagnostic_code(self) -> u64 {
        match self {
            Self::SequenceDrift => 0x5721,
            Self::AuthorizationTokenDrift => 0x5722,
            Self::CandidateDrift => 0x5723,
            Self::CardIdentityDrift => 0x5724,
            Self::ProbeIdentityDrift => 0x5725,
            Self::SafetyDisciplineDrift => 0x5726,
        }
    }
}

pub fn evaluate_s570_s571_prearm_contract(
    request: Option<G8lS570S571PrearmRequest<'_>>,
) -> Result<G8lS570S571PrearmOutcome, G8lS570S571PrearmError> {
    let Some(request) = request else {
        return Ok(G8lS570S571PrearmOutcome::StopNotAuthorized);
    };
    if request.sequence != S570_NEXT_SEQUENCE {
        return Err(G8lS570S571PrearmError::SequenceDrift);
    }
    if request.authorization_token != Some(S570_PREARM_AUTHORIZATION_TOKEN) {
        return Err(G8lS570S571PrearmError::AuthorizationTokenDrift);
    }
    if !identity_eq(
        request.candidate,
        s570_identity(S570_IMAGE_BYTES, S570_IMAGE_SHA256),
    ) {
        return Err(G8lS570S571PrearmError::CandidateDrift);
    }
    if request.card_serial != S570_PREARM_CARD_SERIAL
        || !str_eq(request.card_raw_cid, S570_PREARM_CARD_RAW_CID)
        || request.card_bytes != S570_PREARM_CARD_BYTES
        || !str_eq(request.card_name, S570_PREARM_CARD_NAME)
        || !str_eq(request.volume_label, S570_PREARM_VOLUME_LABEL)
    {
        return Err(G8lS570S571PrearmError::CardIdentityDrift);
    }
    if !str_eq(request.debug_probe_serial, S570_PREARM_DEBUG_PROBE_SERIAL) {
        return Err(G8lS570S571PrearmError::ProbeIdentityDrift);
    }
    if !request.power_off_asserted
        || !request.fresh_target_resolution_required
        || !request.fresh_uart_resolution_required
    {
        return Err(G8lS570S571PrearmError::SafetyDisciplineDrift);
    }
    Ok(
        G8lS570S571PrearmOutcome::ContractReadyExecutionPermitWithheld {
            sequence: S570_NEXT_SEQUENCE,
            execution_permit: S570_EXECUTION_PERMIT,
            physical_or_device_operations: S570_PHYSICAL_OR_DEVICE_OPERATIONS,
        },
    )
}

use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s570_r1_frozen_manifest_candidate_freeze_prearm_contract::*;
use sha2::{Digest, Sha256};
use std::collections::HashSet;
use std::fs;
use std::os::unix::fs::{MetadataExt, PermissionsExt};
use std::path::{Path, PathBuf};

const SOURCE: &str = include_str!(
    "../../kernel/src/g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s570_r1_frozen_manifest_candidate_freeze_prearm_contract.rs"
);
const MAIN: &str = include_str!("../../kernel/src/main.rs");
const SIMULATION_LIB: &str = include_str!("../src/lib.rs");
const PACKAGE_IMAGE: &[u8] = include_bytes!(
    "../../evidence/rpi5/r1/sequence-570-candidate-freeze/package/aselsanos-rpi5.img"
);
const PACKAGE_DTB: &[u8] = include_bytes!(
    "../../evidence/rpi5/r1/sequence-570-candidate-freeze/package/bcm2712-rpi-5-b.dtb"
);
const PACKAGE_CONFIG: &[u8] =
    include_bytes!("../../evidence/rpi5/r1/sequence-570-candidate-freeze/package/config.txt");
const PACKAGE_MANIFEST: &[u8] =
    include_bytes!("../../evidence/rpi5/r1/sequence-570-candidate-freeze/package/SHA256SUMS");
const BUILD_A_LOG: &[u8] =
    include_bytes!("../../evidence/rpi5/r1/sequence-570-candidate-freeze/s570-build-a.log");
const BUILD_B_LOG: &[u8] =
    include_bytes!("../../evidence/rpi5/r1/sequence-570-candidate-freeze/s570-build-b.log");
const REPRODUCTION_AUDIT_LOG: &[u8] = include_bytes!(
    "../../evidence/rpi5/r1/sequence-570-candidate-freeze/s570-reproduction-audit.log"
);
const FREEZE_LOG: &[u8] =
    include_bytes!("../../evidence/rpi5/r1/sequence-570-candidate-freeze/s570-freeze.log");
const FIRMWARE_CONFIG: &[u8] = include_bytes!("../../firmware/config-r1-s570.txt");
const LAYOUT_VERIFIER: &[u8] = include_bytes!("../../scripts/verify-rpi5-s570-layout.sh");
const FREEZE_TOOL: &[u8] = include_bytes!("../../scripts/freeze-rpi5-s570-r1-candidate.sh");
const FROZEN_LEDGER_MANIFEST: &[u8] =
    include_bytes!("../../status/s431-s535-acceptance-gates.json");

fn sha256(bytes: &[u8]) -> String {
    format!("{:x}", Sha256::digest(bytes))
}

fn repository_root() -> PathBuf {
    Path::new(env!("CARGO_MANIFEST_DIR")).join("..")
}

fn package_root() -> PathBuf {
    repository_root().join(S570_PACKAGE_DIRECTORY)
}

fn count_bytes(haystack: &[u8], needle: &[u8]) -> usize {
    haystack
        .windows(needle.len())
        .filter(|window| *window == needle)
        .count()
}

fn build(log_bytes: u64, log_sha256: &'static str) -> G8lS570BuildObservation {
    G8lS570BuildObservation {
        isolated_target_root: true,
        cargo_incremental: 0,
        elf: s570_identity(S570_ELF_BYTES, S570_ELF_SHA256),
        log: s570_identity(log_bytes, log_sha256),
        warning_headers: S570_BUILD_WARNING_HEADERS_EACH,
    }
}

fn layout() -> G8lS570LayoutObservation {
    G8lS570LayoutObservation {
        entry: S570_ENTRY_ADDRESS,
        kernel_start: S570_KERNEL_START,
        kernel_end: S570_KERNEL_END,
        linked_span: S570_LINKED_SPAN,
        live_ledger_g8h_calls: 0,
        s544_g8h_model_calls: 0,
        frozen_s536_model_calls: 1,
        s537_g8h_calls: 1,
        s541_g8h_calls: 1,
        s569_state_symbols: 1,
        g8h_error_marker_count: 1,
        boot_to_ui_literal_count: 2,
        manifest_path_count: 1,
        manifest_sha_count: 1,
        release_acquire_barriers_verified: true,
        inputs_immutable: true,
    }
}

fn package_with_inode_base(base: u64) -> [G8lS570PackageEntryObservation; 4] {
    let entry = |name: &'static str, offset: u64| G8lS570PackageEntryObservation {
        name,
        identity: expected_s570_package_identity(name).unwrap(),
        mode: 0o444,
        link_count: 1,
        inode_id: base + offset,
    };
    [
        entry(S570_IMAGE_NAME, 1),
        entry(S570_DTB_NAME, 2),
        entry(S570_CONFIG_NAME, 3),
        entry(S570_MANIFEST_NAME, 4),
    ]
}

fn canonical_input() -> G8lS570FreezeInput {
    G8lS570FreezeInput {
        predecessor_sequence: 569,
        predecessor_passed: true,
        builds: [
            build(S570_BUILD_A_LOG_BYTES, S570_BUILD_A_LOG_SHA256),
            build(S570_BUILD_B_LOG_BYTES, S570_BUILD_B_LOG_SHA256),
        ],
        layout: layout(),
        package: package_with_inode_base(100),
        manifest: s570_identity(S570_MANIFEST_BYTES, S570_MANIFEST_SHA256),
        layout_verifier: s570_identity(S570_LAYOUT_VERIFIER_BYTES, S570_LAYOUT_VERIFIER_SHA256),
        freeze_tool: s570_identity(S570_FREEZE_TOOL_BYTES, S570_FREEZE_TOOL_SHA256),
        firmware_config: s570_identity(S570_CONFIG_BYTES, S570_CONFIG_SHA256),
        freeze_log: s570_identity(S570_FREEZE_LOG_BYTES, S570_FREEZE_LOG_SHA256),
    }
}

fn prearm_request() -> G8lS570S571PrearmRequest<'static> {
    G8lS570S571PrearmRequest {
        sequence: 571,
        authorization_token: Some(S570_PREARM_AUTHORIZATION_TOKEN),
        candidate: s570_identity(S570_IMAGE_BYTES, S570_IMAGE_SHA256),
        card_serial: S570_PREARM_CARD_SERIAL,
        card_raw_cid: S570_PREARM_CARD_RAW_CID,
        card_bytes: S570_PREARM_CARD_BYTES,
        card_name: S570_PREARM_CARD_NAME,
        volume_label: S570_PREARM_VOLUME_LABEL,
        debug_probe_serial: S570_PREARM_DEBUG_PROBE_SERIAL,
        power_off_asserted: true,
        fresh_target_resolution_required: true,
        fresh_uart_resolution_required: true,
    }
}

#[test]
fn sequence_scope_and_all_nonclaims_are_exact() {
    assert_eq!(S570_SEQUENCE, 570);
    assert_eq!(S570_EXPECTED_PREDECESSOR, 569);
    assert_eq!(S570_NEXT_SEQUENCE, 571);
    assert_eq!(S570_R1_STAGE, 1);
    assert_eq!(S570_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS, 0);
    assert_eq!(S570_PHYSICAL_OBSERVATIONS, 0);
    assert_eq!(S570_PHYSICAL_OR_DEVICE_OPERATIONS, 0);
    assert_eq!(S570_SD_WRITES, 0);
    assert_eq!(S570_UART_OPENS, 0);
    assert_eq!(S570_POWER_TRANSITIONS, 0);
    assert_eq!(S570_NEW_IMMUTABLE_RAW_CAPTURES, 0);
    assert!(!S570_HARDWARE_PRESENT);
    assert!(!S570_BOOT_TO_UI_PHYSICALLY_OBSERVED);
    assert!(!S570_R1_ACCEPTANCE_COMPLETE);
    assert!(!S570_AUTOMATIC_PROMOTION);
    assert!(!S570_EXECUTION_PERMIT);
    assert!(!RUNBOOK_EXECUTED_IN_S570);
    assert!(S570_S546_PHYSICAL_VERDICT_RETAINED_RED);
}

#[test]
fn host_model_is_simulation_registered_and_absent_from_board_kernel() {
    let module = "g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s570_r1_frozen_manifest_candidate_freeze_prearm_contract";
    assert_eq!(MAIN.matches(&format!("mod {module};")).count(), 0);
    assert_eq!(
        SIMULATION_LIB
            .matches(&format!("pub mod {module};"))
            .count(),
        1
    );
    assert!(!MAIN.contains(module));
    for forbidden in [
        "unsafe {",
        "asm!(",
        "global_asm!(",
        "kprintln!(",
        "diskutil",
        "TIOCEXCL",
        "tcsetattr",
        "std::process",
    ] {
        assert!(
            !SOURCE.contains(forbidden),
            "forbidden surface: {forbidden}"
        );
    }
    assert!(!MAIN.contains("service_s570_model_candidate_freeze("));
}

#[test]
fn all_diagnostic_codes_are_nonzero_and_unique() {
    let freeze_codes = [
        G8lS570CandidateFreezeError::PredecessorRejected,
        G8lS570CandidateFreezeError::BuildIsolationDrift,
        G8lS570CandidateFreezeError::BuildIdentityDrift,
        G8lS570CandidateFreezeError::BuildLogIdentityDrift,
        G8lS570CandidateFreezeError::WarningHeaderDrift,
        G8lS570CandidateFreezeError::LayoutAddressDrift,
        G8lS570CandidateFreezeError::LiveLedgerCallPresent,
        G8lS570CandidateFreezeError::HistoricalS544CallPresent,
        G8lS570CandidateFreezeError::FrozenCallShapeDrift,
        G8lS570CandidateFreezeError::S569StateMissing,
        G8lS570CandidateFreezeError::MarkerMembershipDrift,
        G8lS570CandidateFreezeError::BarrierOrMutationDrift,
        G8lS570CandidateFreezeError::PackageNameDrift,
        G8lS570CandidateFreezeError::PackageIdentityDrift,
        G8lS570CandidateFreezeError::PackageMetadataDrift,
        G8lS570CandidateFreezeError::PackageInodeDrift,
        G8lS570CandidateFreezeError::ManifestIdentityDrift,
        G8lS570CandidateFreezeError::ToolIdentityDrift,
        G8lS570CandidateFreezeError::FrozenStateDrift,
    ];
    let prearm_codes = [
        G8lS570S571PrearmError::SequenceDrift,
        G8lS570S571PrearmError::AuthorizationTokenDrift,
        G8lS570S571PrearmError::CandidateDrift,
        G8lS570S571PrearmError::CardIdentityDrift,
        G8lS570S571PrearmError::ProbeIdentityDrift,
        G8lS570S571PrearmError::SafetyDisciplineDrift,
    ];
    let mut unique = HashSet::new();
    for code in freeze_codes
        .into_iter()
        .map(G8lS570CandidateFreezeError::diagnostic_code)
        .chain(
            prearm_codes
                .into_iter()
                .map(G8lS570S571PrearmError::diagnostic_code),
        )
    {
        assert_ne!(code, 0);
        assert!(unique.insert(code), "duplicate diagnostic 0x{code:x}");
    }
    assert_eq!(unique.len(), 25);
}

#[test]
fn canonical_observation_freezes_the_s569_candidate() {
    let mut state = G8lS570CandidateFreezeState::new();
    let G8lS570CandidateFreezeOutcome::CandidateFrozen(receipt) =
        service_s570_model_candidate_freeze(&mut state, canonical_input()).unwrap()
    else {
        panic!("first exact observation must freeze")
    };
    assert_eq!(receipt.sequence, 570);
    assert_eq!(receipt.predecessor_sequence, 569);
    assert_eq!(receipt.build_count, 2);
    assert_eq!(
        receipt.candidate,
        s570_identity(S570_IMAGE_BYTES, S570_IMAGE_SHA256)
    );
    assert_eq!(receipt.package_entries, 4);
    assert_eq!(receipt.warning_headers_total, 8_994);
    assert_eq!(receipt.live_ledger_g8h_calls, 0);
    assert_eq!(receipt.s544_g8h_model_calls, 0);
    assert_eq!(receipt.g8h_error_marker_count, 1);
    assert_eq!(receipt.physical_or_device_operations, 0);
    assert_eq!(state.receipt(), Some(receipt));
}

#[test]
fn exact_replay_retains_and_valid_different_inodes_fail_closed() {
    let mut state = G8lS570CandidateFreezeState::new();
    let G8lS570CandidateFreezeOutcome::CandidateFrozen(first) =
        service_s570_model_candidate_freeze(&mut state, canonical_input()).unwrap()
    else {
        panic!("first freeze")
    };
    assert_eq!(
        service_s570_model_candidate_freeze(&mut state, canonical_input()),
        Ok(G8lS570CandidateFreezeOutcome::CandidateRetained(first))
    );
    let mut recreated = canonical_input();
    recreated.package = package_with_inode_base(1_000);
    assert_eq!(
        service_s570_model_candidate_freeze(&mut state, recreated),
        Err(G8lS570CandidateFreezeError::FrozenStateDrift)
    );
    assert_eq!(state.receipt(), Some(first));
}

#[test]
fn build_and_predecessor_drift_fail_closed_without_publication() {
    let cases = [
        (0usize, G8lS570CandidateFreezeError::PredecessorRejected),
        (1, G8lS570CandidateFreezeError::BuildIsolationDrift),
        (2, G8lS570CandidateFreezeError::BuildIdentityDrift),
        (3, G8lS570CandidateFreezeError::BuildLogIdentityDrift),
        (4, G8lS570CandidateFreezeError::WarningHeaderDrift),
    ];
    for (case, expected) in cases {
        let mut input = canonical_input();
        match case {
            0 => input.predecessor_passed = false,
            1 => input.builds[0].isolated_target_root = false,
            2 => input.builds[1].elf.bytes += 1,
            3 => input.builds[0].log.sha256 = S570_BUILD_B_LOG_SHA256,
            4 => input.builds[1].warning_headers -= 1,
            _ => unreachable!(),
        }
        let mut state = G8lS570CandidateFreezeState::new();
        assert_eq!(
            service_s570_model_candidate_freeze(&mut state, input),
            Err(expected)
        );
        assert_eq!(state.receipt(), None);
    }
}

#[test]
fn layout_decoupling_and_marker_drift_fail_closed() {
    let cases = [
        (0usize, G8lS570CandidateFreezeError::LayoutAddressDrift),
        (1, G8lS570CandidateFreezeError::LiveLedgerCallPresent),
        (2, G8lS570CandidateFreezeError::HistoricalS544CallPresent),
        (3, G8lS570CandidateFreezeError::FrozenCallShapeDrift),
        (4, G8lS570CandidateFreezeError::S569StateMissing),
        (5, G8lS570CandidateFreezeError::MarkerMembershipDrift),
        (6, G8lS570CandidateFreezeError::BarrierOrMutationDrift),
    ];
    for (case, expected) in cases {
        let mut input = canonical_input();
        match case {
            0 => input.layout.kernel_end += 0x1000,
            1 => input.layout.live_ledger_g8h_calls = 1,
            2 => input.layout.s544_g8h_model_calls = 1,
            3 => input.layout.s537_g8h_calls = 0,
            4 => input.layout.s569_state_symbols = 0,
            5 => input.layout.g8h_error_marker_count = 0,
            6 => input.layout.inputs_immutable = false,
            _ => unreachable!(),
        }
        let mut state = G8lS570CandidateFreezeState::new();
        assert_eq!(
            service_s570_model_candidate_freeze(&mut state, input),
            Err(expected)
        );
    }
}

#[test]
fn package_and_tool_drift_fail_closed() {
    let cases = [
        (0usize, G8lS570CandidateFreezeError::PackageNameDrift),
        (1, G8lS570CandidateFreezeError::PackageIdentityDrift),
        (2, G8lS570CandidateFreezeError::PackageMetadataDrift),
        (3, G8lS570CandidateFreezeError::PackageInodeDrift),
        (4, G8lS570CandidateFreezeError::ManifestIdentityDrift),
        (5, G8lS570CandidateFreezeError::ToolIdentityDrift),
    ];
    for (case, expected) in cases {
        let mut input = canonical_input();
        match case {
            0 => input.package[0].name = S570_DTB_NAME,
            1 => input.package[1].identity.bytes += 1,
            2 => input.package[2].mode = 0o644,
            3 => input.package[3].inode_id = input.package[2].inode_id,
            4 => input.manifest.sha256 = S570_CONFIG_SHA256,
            5 => input.freeze_tool.bytes += 1,
            _ => unreachable!(),
        }
        let mut state = G8lS570CandidateFreezeState::new();
        assert_eq!(
            service_s570_model_candidate_freeze(&mut state, input),
            Err(expected)
        );
    }
}

#[test]
fn frozen_package_files_are_exact_immutable_and_self_verifying() {
    for (bytes, expected_bytes, expected_sha) in [
        (PACKAGE_IMAGE, S570_IMAGE_BYTES, S570_IMAGE_SHA256),
        (PACKAGE_DTB, S570_DTB_BYTES, S570_DTB_SHA256),
        (PACKAGE_CONFIG, S570_CONFIG_BYTES, S570_CONFIG_SHA256),
        (PACKAGE_MANIFEST, S570_MANIFEST_BYTES, S570_MANIFEST_SHA256),
    ] {
        assert_eq!(bytes.len() as u64, expected_bytes);
        assert_eq!(sha256(bytes), expected_sha);
    }
    assert_eq!(PACKAGE_CONFIG, FIRMWARE_CONFIG);
    assert_eq!(
        std::str::from_utf8(PACKAGE_MANIFEST).unwrap(),
        "a24f4d24e838cd7d1a6b2ff217d864e9c4b08f12ce7dd165b302e8073a980b04  aselsanos-rpi5.img\n40a2fbe9c29e8b9a4912cf726a943068defb779fc052ec38e457a79c58abca00  bcm2712-rpi-5-b.dtb\nf1fd182fec3a6b46639195881b2b452efe019ca88556c58081aff0a05daee865  config.txt\n"
    );
    let mut inode_ids = HashSet::new();
    for name in [
        S570_IMAGE_NAME,
        S570_DTB_NAME,
        S570_CONFIG_NAME,
        S570_MANIFEST_NAME,
    ] {
        let metadata = fs::symlink_metadata(package_root().join(name)).unwrap();
        assert!(metadata.is_file(), "{name}");
        assert_eq!(metadata.permissions().mode() & 0o777, 0o444, "{name}");
        assert_eq!(metadata.nlink(), 1, "{name}");
        assert!(inode_ids.insert((metadata.dev(), metadata.ino())), "{name}");
        assert_eq!(
            metadata.len(),
            expected_s570_package_identity(name).unwrap().bytes
        );
    }
    assert_eq!(fs::read_dir(package_root()).unwrap().count(), 4);
}

#[test]
fn image_membership_binds_s569_and_the_bounded_error_line() {
    for (marker, count) in [
        (b"ASELSAN/S541 HANDOFF=CPU1_PREFLIGHT_ARMED".as_slice(), 1),
        (b"ASELSAN/S541ERR".as_slice(), 1),
        (b"[R1:S536] BOOT_TO_UI_READY".as_slice(), 2),
        (b"ASELSAN/S538 ROUTE=PRIOR_BOOT_TO_UI".as_slice(), 1),
        (b"ASELSAN/S538ERR".as_slice(), 1),
        (b"ASELSAN-R1-S538-BOARD-RPI5".as_slice(), 1),
        (b"ASELSAN/BOOT8H".as_slice(), 1),
        (b"ASELSAN/BOOT8G".as_slice(), 1),
        (S570_G8H_ERROR_MARKER.as_bytes(), 1),
        (S570_FROZEN_MANIFEST_PATH.as_bytes(), 1),
        (S570_FROZEN_MANIFEST_SHA256.as_bytes(), 1),
    ] {
        assert_eq!(count_bytes(PACKAGE_IMAGE, marker), count, "{:?}", marker);
    }
    assert_eq!(
        count_bytes(
            PACKAGE_IMAGE,
            b"service_s431_to_s535_production_acceptance_gate_on_cpu1"
        ),
        0
    );
    assert_eq!(
        count_bytes(
            PACKAGE_IMAGE,
            b"service_s544_model_reachable_readiness_producer"
        ),
        0
    );
}

#[test]
fn build_logs_and_freeze_log_have_exact_identities() {
    for (bytes, expected_len, expected_sha) in [
        (BUILD_A_LOG, S570_BUILD_A_LOG_BYTES, S570_BUILD_A_LOG_SHA256),
        (BUILD_B_LOG, S570_BUILD_B_LOG_BYTES, S570_BUILD_B_LOG_SHA256),
        (
            REPRODUCTION_AUDIT_LOG,
            S570_POST_REGISTRATION_REPRO_LOG_BYTES,
            S570_POST_REGISTRATION_REPRO_LOG_SHA256,
        ),
        (FREEZE_LOG, S570_FREEZE_LOG_BYTES, S570_FREEZE_LOG_SHA256),
    ] {
        assert_eq!(bytes.len() as u64, expected_len);
        assert_eq!(sha256(bytes), expected_sha);
    }
    for log in [BUILD_A_LOG, BUILD_B_LOG, REPRODUCTION_AUDIT_LOG] {
        let text = String::from_utf8_lossy(log);
        assert_eq!(
            text.lines()
                .filter(|line| line.starts_with("warning:"))
                .count(),
            4_497
        );
        assert_eq!(
            text.lines()
                .filter(|line| line.starts_with("error:"))
                .count(),
            0
        );
    }
    assert_ne!(S570_BUILD_A_LOG_SHA256, S570_BUILD_B_LOG_SHA256);
    assert!(S570_POST_REGISTRATION_ELF_IDENTICAL);
    assert!(S570_POST_REGISTRATION_IMAGE_IDENTICAL);
    let freeze = std::str::from_utf8(FREEZE_LOG).unwrap();
    assert!(freeze.contains("S570_LAYOUT=PASS"));
    assert!(freeze.contains("S570_CANDIDATE_FREEZE=PASS"));
    assert!(freeze.contains("DEVICE_OPERATIONS=0"));
}

#[test]
fn tools_config_and_frozen_ledger_manifest_are_byte_bound() {
    for (bytes, expected_len, expected_sha) in [
        (
            LAYOUT_VERIFIER,
            S570_LAYOUT_VERIFIER_BYTES,
            S570_LAYOUT_VERIFIER_SHA256,
        ),
        (FREEZE_TOOL, S570_FREEZE_TOOL_BYTES, S570_FREEZE_TOOL_SHA256),
        (FIRMWARE_CONFIG, S570_CONFIG_BYTES, S570_CONFIG_SHA256),
        (
            FROZEN_LEDGER_MANIFEST,
            S570_FROZEN_MANIFEST_BYTES,
            S570_FROZEN_MANIFEST_SHA256,
        ),
    ] {
        assert_eq!(bytes.len() as u64, expected_len);
        assert_eq!(sha256(bytes), expected_sha);
    }
    let manifest: serde_json::Value = serde_json::from_slice(FROZEN_LEDGER_MANIFEST).unwrap();
    assert_eq!(manifest["firstSequence"], 431);
    assert_eq!(manifest["lastSequence"], 535);
    assert_eq!(manifest["gateCount"], 105);
    assert_eq!(manifest["gates"].as_array().unwrap().len(), 105);
}

#[test]
fn host_tools_pin_layout_and_contain_no_physical_execution_command() {
    let layout = std::str::from_utf8(LAYOUT_VERIFIER).unwrap();
    let freeze = std::str::from_utf8(FREEZE_TOOL).unwrap();
    for required in [
        "EXPECTED_ELF_BYTES=18537440",
        "EXPECTED_ELF_SHA256=3260b2e8b0ae80ee65c3ffaaf6db3b675d505bfc1d18502c4067b7ed535071be",
        "EXPECTED_IMAGE_BYTES=945920",
        "EXPECTED_IMAGE_SHA256=a24f4d24e838cd7d1a6b2ff217d864e9c4b08f12ce7dd165b302e8073a980b04",
        "EXPECTED_LINKED_SPAN=18321408",
        "service_s431_to_s535_production_acceptance_gate_on_cpu1 0",
        "service_s544_model_reachable_readiness_producer 0",
        "service_s536_model_r1_physical_boot_uart_evidence_contract 1",
        "ASELSAN/G8HERR REPORTER=CPU0 CODE=",
        "RUNBOOK_EXECUTED_IN_S570=NO",
    ] {
        assert!(layout.contains(required), "{required}");
    }
    for required in [
        "EXPECTED_DTB_BYTES=78703",
        "EXPECTED_CONFIG_BYTES=401",
        "EXPECTED_SUMS_BYTES=248",
        "EXPECTED_PACKAGE_ENTRIES=4",
        "EXPECTED_FILE_MODE=444",
        "S570_CANDIDATE_FREEZE=PASS",
        "DEVICE_OPERATIONS=0 SD_WRITES=0 UART_OPENS=0 POWER_TRANSITIONS=0",
        "/bin/chmod 0444",
        "config-r1-s570.txt",
    ] {
        assert!(freeze.contains(required), "{required}");
    }
    for tool in [layout, freeze] {
        for forbidden in [
            "diskutil",
            "/dev/disk",
            "/dev/cu.",
            "/dev/tty.",
            "TIOCEXCL",
            "stty",
        ] {
            assert!(!tool.contains(forbidden), "{forbidden}");
        }
    }
}

#[test]
fn exact_s571_prearm_request_remains_execution_permit_withheld() {
    assert_eq!(
        evaluate_s570_s571_prearm_contract(Some(prearm_request())),
        Ok(
            G8lS570S571PrearmOutcome::ContractReadyExecutionPermitWithheld {
                sequence: 571,
                execution_permit: false,
                physical_or_device_operations: 0,
            }
        )
    );
    assert_eq!(
        evaluate_s570_s571_prearm_contract(None),
        Ok(G8lS570S571PrearmOutcome::StopNotAuthorized)
    );
}

#[test]
fn s571_prearm_rejects_authority_target_and_safety_drift() {
    let cases = [
        (0usize, G8lS570S571PrearmError::SequenceDrift),
        (1, G8lS570S571PrearmError::AuthorizationTokenDrift),
        (2, G8lS570S571PrearmError::CandidateDrift),
        (3, G8lS570S571PrearmError::CardIdentityDrift),
        (4, G8lS570S571PrearmError::ProbeIdentityDrift),
        (5, G8lS570S571PrearmError::SafetyDisciplineDrift),
    ];
    for (case, expected) in cases {
        let mut request = prearm_request();
        match case {
            0 => request.sequence = 570,
            1 => request.authorization_token = Some("S571_WRONG"),
            2 => request.candidate.bytes += 1,
            3 => request.card_serial ^= 1,
            4 => request.debug_probe_serial = "WRONG",
            5 => request.power_off_asserted = false,
            _ => unreachable!(),
        }
        assert_eq!(
            evaluate_s570_s571_prearm_contract(Some(request)),
            Err(expected)
        );
    }
}

#[test]
fn immutable_s546_red_evidence_is_retained_without_reinterpretation() {
    let raw = fs::read(
        repository_root().join("evidence/rpi5/r1/sequence-546-physical-boot-uart/s546-uart.raw"),
    )
    .unwrap();
    assert_eq!(raw.len() as u64, S570_S546_RAW_BYTES);
    assert_eq!(sha256(&raw), S570_S546_RAW_SHA256);
    assert_eq!(count_bytes(&raw, b"ASELSAN/BOOT8H"), 0);
    assert_eq!(count_bytes(&raw, b"[R1:S536] BOOT_TO_UI_READY"), 0);
    assert_eq!(count_bytes(&raw, b"ASELSAN/G8HERR REPORTER=CPU0"), 0);
    assert!(S570_S546_PHYSICAL_VERDICT_RETAINED_RED);
    assert!(!S570_AUTOMATIC_PROMOTION);
}

  {
    id: "g8l-s570-r1-frozen-manifest-candidate-freeze-prearm-contract",
    date: "2026-08-31",
    sequence: 570,
    status: "passed",
    umbrella_status: "partial",
    title: "S570 · Tekrar üretilebilir RPi5 aday dondurma ve S571 pre-arm",
    summary:
      "S570 host-only candidate freeze PASS'tir. S569 üretim payload'ı iki fresh izole target root'ta aynı 18537440 B ELF'i ve aynı 945920 B flat image'i verdi; final source-tree reproduction audit'i de ikisini byte-exact yeniden üretti. Read-only machine/layout verifier live S431–S535 ve tarihsel S544 G8h çağrılarını sıfır, frozen S536 → S537 → S541 zincirini ve bounded G8HERR satırını exact doğruladı. Dört dosyalık paket immutable donduruldu; execution permit=false, fiziksel/device operation=0 ve RUNBOOK_EXECUTED_IN_S570=NO. Focused 16/16 PASS'tir.",
    evidence: [
      "İki isolated CARGO_TARGET_DIR build'i aynı ELF'i üretti: 18537440 B / 3260b2e8b0ae80ee65c3ffaaf6db3b675d505bfc1d18502c4067b7ed535071be.",
      "Build A/B logları 1699854 B ve sırasıyla 921970cb…80b5 / 22b7b433…3322 SHA-256'dır; her biri 4497 warning header içerir, zero-warning iddiası yoktur.",
      "S570 evidence modelinin board kernel dışında simulation-only tutulduğu final source tree yeniden derlendi; reproduction logu 1699854 B / ee42becd114aa3e1ec05fb4406da79a3f469cd3922b2edc876550590cd7c1a7c ve ELF/image byte-exact'tır.",
      "Flat image 945920 B / a24f4d24e838cd7d1a6b2ff217d864e9c4b08f12ce7dd165b302e8073a980b04; entry/start/end 0x80000/0x80000/0x11f9000 ve linked span 18321408'dir.",
      "Layout: live-ledger G8h call=0, S544 G8h call=0, frozen S536/S537/S541 call=1/1/1, S569 state=1 ve ASELSAN/G8HERR exact-once'dur.",
      "Paket image 945920 B, DTB 78703 B, config 401 B ve SHA256SUMS 248 B olmak üzere exact dört regular dosyadır; tümü 0444, nlink=1 ve farklı inode taşır.",
      "Paket kimlikleri image a24f4d24…80b04, DTB 40a2fbe9…ca00, config f1fd182f…e865 ve manifest 83e8eb41…5fe1'dir; manifest read-back PASS'tir.",
      "Layout verifier 11301 B / f178a3f56027d7499197dcf13e8acd17ceb7b08e32695716540a635342904590; freeze tool 10336 B / 2aadd1fa57d6fcc26907701bfe4275357f29bac34f522dc76366709ea83aa22a; config 401 B / f1fd182f…e865'tir.",
      "Focused test 1 grup / 16 passed / 0 failed / 0 ignored / 0 filtered verdi.",
      "Implementation 21754 B / bc5a7b57e939adec1ec56806c80e8989c8912d0d13f6553c2367e3234169e73b; focused test 23231 B / bb34786dcf6c405e86fb366d3f7ee52d9be7321138c7b258deebe4415b210345; proof 6441 B / cbbba172778c600190adf6b5339d0584cce783496e7e2f2b050977ccd42433ef SHA-256'dır.",
      "S546 raw 16990 B / a71a9107…3e485d ve fiziksel RED değişmezdir; yeni fiziksel gözlem yapılmamıştır.",
      "runtime/physical observations=0/0, SD/UART/power/new-raw=0/0/0/0, Boot-to-UI=false, R1=false ve S571 execution permit=false'dur.",
    ],
    commands: [
      "CARGO_INCREMENTAL=0 cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s570_r1_frozen_manifest_candidate_freeze_prearm_contract -- --test-threads=1",
      "scripts/freeze-rpi5-s570-r1-candidate.sh --verify-package <absolute-package-path>",
    ],
    terminalSessions: [
      {
        id: "s570-focused",
        title: "S570 frozen-candidate focused acceptance",
        commandLines: [
          "CARGO_INCREMENTAL=0 cargo test -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s570_r1_frozen_manifest_candidate_freeze_prearm_contract -- --test-threads=1",
        ],
        outputLines: [
          "test result: ok. 16 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out",
          "candidate=a24f4d24…80b04; physical/device operations=0",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
      {
        id: "s570-package-verify",
        title: "S570 immutable package re-verification",
        commandLines: [
          "scripts/freeze-rpi5-s570-r1-candidate.sh --verify-package <absolute-package-path>",
        ],
        outputLines: [
          "S570_PACKAGE_VERIFY=PASS",
          "four entries; mode=0444; nlink=1; distinct inodes; manifest read-back PASS",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
    ],
    limitations: [
      "S570 yalnız host build/layout/package kanıtıdır; RPi5 runtime veya fiziksel Boot-to-UI gözlemi değildir.",
      "Derleme warning'leri korunur; sıfır warning iddia edilmez.",
      "Exact S571 token'ının sözleşmede bulunması yetki veya execution permit değildir.",
      "RUNBOOK_EXECUTED_IN_S570=NO; physical/device operations=0.",
    ],
  },