S576 · Whole-scheduler dışlama gözlemi · R2 kabul sözleşmesi kaydı

#![allow(unexpected_cfgs)]
#![allow(dead_code)]

//! S576 starts the S576-S707 R2 field-acceptance readiness ledger.
//!
//! Workstream 01 of the published R1 -> R2 transition (supported-profile
//! runtime evidence) is carried by S572-S575 and closed by the S575
//! independent operator-authorized physical repeat.  The fourteen remaining
//! workstreams are represented here as 132 separate gates, each with its
//! own module, focused test target and proof document.
//!
//! Every gate in the range is a simulation-only acceptance model.  After the
//! S546 root cause (a never-executed CPU1 ledger silently blocking the physical
//! boot path) and the S569 decoupling remediation, no module in this range is
//! linked into the board-rpi5 kernel and no module adds a production callsite.
//! The retained S575 physical observation is carried read-only.  A receipt
//! never claims a *new* runtime or physical observation, never claims operator
//! or external acceptance, and never claims cross-profile coverage or R2 field
//! acceptance.

use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s575_r2_supported_profile_independent_physical_repeat::{
    RUNBOOK_EXECUTED_IN_S575, S575_BOOT_TO_UI_PHYSICALLY_OBSERVED, S575_CAMPAIGN_ID,
    S575_CROSS_PROFILE_COVERAGE_COMPLETE, S575_EVIDENCE_TRANSPORT, S575_GATE_STATUS,
    S575_NEW_INDEPENDENT_PHYSICAL_REPEATS, S575_PHYSICAL_INPUT_OBSERVED,
    S575_R2_FIELD_ACCEPTANCE_COMPLETE,
    S575_R2_TRANSITION_FIRST, S575_R2_TRANSITION_LAST, S575_SEQUENCE,
    S575_SUPPORTED_PROFILE, S575_SUPPORTED_PROFILE_REPEATABILITY_COMPLETE,
    S575_TARGET_ARCH, S575_TOTAL_PHYSICAL_OBSERVATIONS,
    S575_TOTAL_SUPPORTED_PROFILE_RUNTIME_BASELINES, S575_VISIBLE_SCANOUT_OBSERVED,
};

pub const S576_FIRST_SEQUENCE: usize = 576;
pub const S707_LAST_SEQUENCE: usize = 707;
pub const S576_TO_S707_GATE_COUNT: usize = S707_LAST_SEQUENCE - S576_FIRST_SEQUENCE + 1;
pub const S576_TO_S707_BLOCK_COUNT: usize = 14;
pub const S576_TARGET_CPU: usize = 1;
pub const S576_ANCHOR_SEQUENCE: usize = S575_SEQUENCE;
pub const S575_PHYSICAL_REPEAT_SEQUENCE: usize = S575_SEQUENCE;
pub const S576_ANCHOR_STATUS: &str = S575_GATE_STATUS;
pub const S576_R2_TRANSITION_FIRST: usize = S575_R2_TRANSITION_FIRST;
pub const S576_R2_TRANSITION_LAST: usize = S575_R2_TRANSITION_LAST;
pub const S576_TO_S707_LINKED_INTO_BOARD_RPI5: bool = false;
pub const S576_TO_S707_PRODUCTION_CALLSITES: usize = 0;
pub const S576_SUPPORTED_PROFILE: &str = S575_SUPPORTED_PROFILE;
pub const S576_TARGET_ARCH: &str = S575_TARGET_ARCH;
pub const S576_EVIDENCE_TRANSPORT: &str = S575_EVIDENCE_TRANSPORT;
pub const S576_CAMPAIGN_ID: &str = S575_CAMPAIGN_ID;

/// Read-only carry of what S575 actually established.  These are never
/// re-earned, re-counted or extended by any gate in this range.
pub const S576_RETAINED_RUNTIME_BASELINES: usize = S575_TOTAL_SUPPORTED_PROFILE_RUNTIME_BASELINES;
pub const S576_RETAINED_PHYSICAL_OBSERVATIONS: usize = S575_TOTAL_PHYSICAL_OBSERVATIONS;
pub const S576_RETAINED_REPEATABILITY_COMPLETE: bool =
    S575_SUPPORTED_PROFILE_REPEATABILITY_COMPLETE;
pub const S576_RETAINED_BOOT_TO_UI_OBSERVED: bool = S575_BOOT_TO_UI_PHYSICALLY_OBSERVED;
pub const S576_RETAINED_RUNBOOK_EXECUTED_IN_S575: bool = RUNBOOK_EXECUTED_IN_S575;
pub const S576_RETAINED_INDEPENDENT_PHYSICAL_REPEATS: usize = S575_NEW_INDEPENDENT_PHYSICAL_REPEATS;
pub const S576_RETAINED_PHYSICAL_REPEAT_OBSERVED: bool =
    S576_RETAINED_INDEPENDENT_PHYSICAL_REPEATS > 0;
pub const S576_RETAINED_AUTHORIZATION_RECEIVED: bool = RUNBOOK_EXECUTED_IN_S575;

/// What S575 explicitly did *not* establish, and what this range must not
/// silently promote.
pub const S576_TO_S707_VISIBLE_SCANOUT_OBSERVED: bool = S575_VISIBLE_SCANOUT_OBSERVED;
pub const S576_TO_S707_PHYSICAL_INPUT_OBSERVED: bool = S575_PHYSICAL_INPUT_OBSERVED;
pub const S576_TO_S707_CROSS_PROFILE_COVERAGE_COMPLETE: bool = S575_CROSS_PROFILE_COVERAGE_COMPLETE;
pub const S576_TO_S707_R2_FIELD_ACCEPTANCE_COMPLETE: bool = S575_R2_FIELD_ACCEPTANCE_COMPLETE;

pub const S576_ACCEPTANCE_DOMAINS: [&str; S576_TO_S707_BLOCK_COUNT] = [
    "scheduler_exclusion_runtime",
    "supervised_recovery",
    "power_lifecycle",
    "modem_packet_data",
    "voice_audio",
    "secure_update",
    "verified_boot_rollback",
    "production_key_capability",
    "storage_integrity",
    "network_policy",
    "ui_application_flow",
    "manufacturing_provisioning",
    "field_diagnostics",
    "field_acceptance_matrix",
];

pub const S576_WORKSTREAM_NUMBERS: [usize; S576_TO_S707_BLOCK_COUNT] =
    [2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15];

pub const S576_STEPS_BY_BLOCK: [usize; S576_TO_S707_BLOCK_COUNT] =
    [9, 9, 9, 9, 9, 9, 9, 9, 9, 9, 9, 9, 9, 15];

pub const S576_EXTERNAL_AUTHORITY_REQUIRED_BY_BLOCK: [bool; S576_TO_S707_BLOCK_COUNT] = [
    false, false, false, true, true, false, false, true, false, true, false, true, false, true,
];

/// Every remaining R2 workstream needs its own physical observation.  The
/// retained S575 boot/UART repeat does not stand in for any of them.
pub const S576_PHYSICAL_EVIDENCE_REQUIRED_BY_BLOCK: [bool; S576_TO_S707_BLOCK_COUNT] =
    [true; S576_TO_S707_BLOCK_COUNT];

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lR2AcceptanceStep {
    ContractRegistration,
    InstrumentationBinding,
    ProviderPreflight,
    BoundedModelCallsite,
    FaultMatrixRegistration,
    RepeatCampaignDefinition,
    MissingObservationJournal,
    FailClosedReconciliation,
    OpenBoundaryPublication,
    CrossProfileRegressionGuard,
    LongSoakCampaignDefinition,
    OperatorAcceptanceBinding,
    RfEmcSarConformanceBinding,
    IndependentSecurityBinding,
    FieldReleaseBoundaryPublication,
}

impl G8lR2AcceptanceStep {
    pub const fn ordinal(self) -> usize {
        match self {
            Self::ContractRegistration => 1,
            Self::InstrumentationBinding => 2,
            Self::ProviderPreflight => 3,
            Self::BoundedModelCallsite => 4,
            Self::FaultMatrixRegistration => 5,
            Self::RepeatCampaignDefinition => 6,
            Self::MissingObservationJournal => 7,
            Self::FailClosedReconciliation => 8,
            Self::OpenBoundaryPublication => 9,
            Self::CrossProfileRegressionGuard => 10,
            Self::LongSoakCampaignDefinition => 11,
            Self::OperatorAcceptanceBinding => 12,
            Self::RfEmcSarConformanceBinding => 13,
            Self::IndependentSecurityBinding => 14,
            Self::FieldReleaseBoundaryPublication => 15,
        }
    }

    pub const fn slug(self) -> &'static str {
        match self {
            Self::ContractRegistration => "contract",
            Self::InstrumentationBinding => "instrumentation",
            Self::ProviderPreflight => "preflight",
            Self::BoundedModelCallsite => "callsite",
            Self::FaultMatrixRegistration => "fault_matrix",
            Self::RepeatCampaignDefinition => "repeat_campaign",
            Self::MissingObservationJournal => "journal",
            Self::FailClosedReconciliation => "reconciliation",
            Self::OpenBoundaryPublication => "boundary",
            Self::CrossProfileRegressionGuard => "regression_guard",
            Self::LongSoakCampaignDefinition => "long_soak",
            Self::OperatorAcceptanceBinding => "operator_acceptance",
            Self::RfEmcSarConformanceBinding => "rf_emc_sar",
            Self::IndependentSecurityBinding => "independent_security",
            Self::FieldReleaseBoundaryPublication => "field_release_boundary",
        }
    }
}

const fn step_for(index: usize) -> G8lR2AcceptanceStep {
    match index {
        0 => G8lR2AcceptanceStep::ContractRegistration,
        1 => G8lR2AcceptanceStep::InstrumentationBinding,
        2 => G8lR2AcceptanceStep::ProviderPreflight,
        3 => G8lR2AcceptanceStep::BoundedModelCallsite,
        4 => G8lR2AcceptanceStep::FaultMatrixRegistration,
        5 => G8lR2AcceptanceStep::RepeatCampaignDefinition,
        6 => G8lR2AcceptanceStep::MissingObservationJournal,
        7 => G8lR2AcceptanceStep::FailClosedReconciliation,
        8 => G8lR2AcceptanceStep::OpenBoundaryPublication,
        9 => G8lR2AcceptanceStep::CrossProfileRegressionGuard,
        10 => G8lR2AcceptanceStep::LongSoakCampaignDefinition,
        11 => G8lR2AcceptanceStep::OperatorAcceptanceBinding,
        12 => G8lR2AcceptanceStep::RfEmcSarConformanceBinding,
        13 => G8lR2AcceptanceStep::IndependentSecurityBinding,
        _ => G8lR2AcceptanceStep::FieldReleaseBoundaryPublication,
    }
}

const fn block_position(offset: usize) -> Option<(usize, usize)> {
    let mut block = 0;
    let mut consumed = 0;
    while block < S576_TO_S707_BLOCK_COUNT {
        let steps = S576_STEPS_BY_BLOCK[block];
        if offset < consumed + steps {
            return Some((block, offset - consumed));
        }
        consumed += steps;
        block += 1;
    }
    None
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lR2AcceptanceGateDescriptor {
    pub sequence: usize,
    pub predecessor_sequence: usize,
    pub workstream: usize,
    pub block_ordinal: usize,
    pub block_step_count: usize,
    pub step_ordinal: usize,
    pub acceptance_domain: &'static str,
    pub step: G8lR2AcceptanceStep,
    pub runtime_evidence_required: bool,
    pub physical_evidence_required: bool,
    pub external_authority_required: bool,
}

pub const fn canonical_s576_to_s707_acceptance_descriptor(
    sequence: usize,
) -> Option<G8lR2AcceptanceGateDescriptor> {
    if sequence < S576_FIRST_SEQUENCE || sequence > S707_LAST_SEQUENCE {
        return None;
    }
    let Some((block_index, step_index)) = block_position(sequence - S576_FIRST_SEQUENCE) else {
        return None;
    };
    Some(G8lR2AcceptanceGateDescriptor {
        sequence,
        predecessor_sequence: sequence - 1,
        workstream: S576_WORKSTREAM_NUMBERS[block_index],
        block_ordinal: block_index + 1,
        block_step_count: S576_STEPS_BY_BLOCK[block_index],
        step_ordinal: step_index + 1,
        acceptance_domain: S576_ACCEPTANCE_DOMAINS[block_index],
        step: step_for(step_index),
        runtime_evidence_required: true,
        physical_evidence_required: S576_PHYSICAL_EVIDENCE_REQUIRED_BY_BLOCK[block_index],
        external_authority_required: S576_EXTERNAL_AUTHORITY_REQUIRED_BY_BLOCK[block_index],
    })
}

/// The exact S575 facts this range is allowed to stand on.
#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lR2AcceptanceAnchor {
    pub repeat_sequence: usize,
    pub repeat_status: &'static str,
    pub campaign_id: &'static str,
    pub supported_profile: &'static str,
    pub target_arch: &'static str,
    pub evidence_transport: &'static str,
    pub retained_runtime_baselines: usize,
    pub retained_physical_observations: usize,
    pub physical_repeat_observed: bool,
    pub authorization_received: bool,
    pub repeatability_complete: bool,
    pub boot_to_ui_physically_observed: bool,
    pub visible_scanout_observed: bool,
    pub physical_input_observed: bool,
    pub cross_profile_coverage_complete: bool,
    pub r2_field_acceptance_complete: bool,
}

pub const S576_CANONICAL_ANCHOR: G8lR2AcceptanceAnchor = G8lR2AcceptanceAnchor {
    repeat_sequence: S576_ANCHOR_SEQUENCE,
    repeat_status: S576_ANCHOR_STATUS,
    campaign_id: S576_CAMPAIGN_ID,
    supported_profile: S576_SUPPORTED_PROFILE,
    target_arch: S576_TARGET_ARCH,
    evidence_transport: S576_EVIDENCE_TRANSPORT,
    retained_runtime_baselines: S576_RETAINED_RUNTIME_BASELINES,
    retained_physical_observations: S576_RETAINED_PHYSICAL_OBSERVATIONS,
    physical_repeat_observed: S576_RETAINED_PHYSICAL_REPEAT_OBSERVED,
    authorization_received: S576_RETAINED_AUTHORIZATION_RECEIVED,
    repeatability_complete: S576_RETAINED_REPEATABILITY_COMPLETE,
    boot_to_ui_physically_observed: S576_RETAINED_BOOT_TO_UI_OBSERVED,
    visible_scanout_observed: S576_TO_S707_VISIBLE_SCANOUT_OBSERVED,
    physical_input_observed: S576_TO_S707_PHYSICAL_INPUT_OBSERVED,
    cross_profile_coverage_complete: S576_TO_S707_CROSS_PROFILE_COVERAGE_COMPLETE,
    r2_field_acceptance_complete: S576_TO_S707_R2_FIELD_ACCEPTANCE_COMPLETE,
};

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lR2AcceptanceReceipt {
    pub sequence: usize,
    pub predecessor_sequence: usize,
    pub workstream: usize,
    pub block_ordinal: usize,
    pub step_ordinal: usize,
    pub acceptance_domain: &'static str,
    pub anchor_sequence: usize,
    pub physical_repeat_sequence: usize,
    pub retained_runtime_baselines: usize,
    pub retained_physical_observations: usize,
    pub completed_block_count: usize,
    pub source_gate_complete: bool,
    pub runtime_evidence_required: bool,
    pub physical_evidence_required: bool,
    pub external_authority_required: bool,
    pub new_supported_profile_runtime_observations: usize,
    pub new_physical_observations: usize,
    pub operator_authority_received: bool,
    pub external_authority_received: bool,
    pub linked_into_board_rpi5: bool,
    pub visible_scanout_observed: bool,
    pub physical_input_observed: bool,
    pub cross_profile_coverage_complete: bool,
    pub acceptance_complete: bool,
    pub r2_field_acceptance_complete: bool,
    pub runbook_executed: bool,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lR2AcceptanceLedgerSnapshot {
    pub anchor_sequence: usize,
    pub last_completed_sequence: usize,
    pub completed_block_count: usize,
    pub retained_runtime_baselines: usize,
    pub retained_physical_observations: usize,
    pub new_supported_profile_runtime_observations: usize,
    pub new_physical_observations: usize,
    pub operator_authorizations: usize,
    pub external_acceptances: usize,
    pub cross_profile_coverage_complete: bool,
    pub r2_field_acceptance_complete: bool,
}

#[derive(Debug)]
pub struct G8lR2AcceptanceLedger {
    anchor_sequence: usize,
    retained_runtime_baselines: usize,
    retained_physical_observations: usize,
    last_completed_sequence: usize,
    completed_block_count: usize,
    last_receipt: Option<G8lR2AcceptanceReceipt>,
}

impl G8lR2AcceptanceLedger {
    pub fn from_s575(
        caller_cpu: usize,
        anchor: G8lR2AcceptanceAnchor,
    ) -> Result<Self, G8lR2AcceptanceError> {
        if caller_cpu != S576_TARGET_CPU {
            return Err(G8lR2AcceptanceError::WrongCpu);
        }
        if !anchor.physical_repeat_observed
            || !anchor.authorization_received
            || !anchor.repeatability_complete
            || !anchor.boot_to_ui_physically_observed
        {
            return Err(G8lR2AcceptanceError::MissingS575PhysicalPass);
        }
        if anchor.visible_scanout_observed
            || anchor.physical_input_observed
            || anchor.cross_profile_coverage_complete
            || anchor.r2_field_acceptance_complete
        {
            return Err(G8lR2AcceptanceError::PrematureAcceptanceClaim);
        }
        if anchor.repeat_sequence != S576_ANCHOR_SEQUENCE
            || !str_eq(anchor.repeat_status, S576_ANCHOR_STATUS)
            || !str_eq(anchor.campaign_id, S576_CAMPAIGN_ID)
            || !str_eq(anchor.supported_profile, S576_SUPPORTED_PROFILE)
            || !str_eq(anchor.target_arch, S576_TARGET_ARCH)
            || !str_eq(anchor.evidence_transport, S576_EVIDENCE_TRANSPORT)
            || anchor.retained_runtime_baselines != S576_RETAINED_RUNTIME_BASELINES
            || anchor.retained_physical_observations != S576_RETAINED_PHYSICAL_OBSERVATIONS
        {
            return Err(G8lR2AcceptanceError::S575AnchorDrift);
        }
        Ok(Self {
            anchor_sequence: anchor.repeat_sequence,
            retained_runtime_baselines: anchor.retained_runtime_baselines,
            retained_physical_observations: anchor.retained_physical_observations,
            last_completed_sequence: S576_ANCHOR_SEQUENCE,
            completed_block_count: 0,
            last_receipt: None,
        })
    }

    pub const fn anchor_sequence(&self) -> usize {
        self.anchor_sequence
    }

    pub const fn last_completed_sequence(&self) -> usize {
        self.last_completed_sequence
    }

    pub const fn completed_block_count(&self) -> usize {
        self.completed_block_count
    }

    pub const fn last_receipt(&self) -> Option<G8lR2AcceptanceReceipt> {
        self.last_receipt
    }

    pub const fn snapshot(&self) -> G8lR2AcceptanceLedgerSnapshot {
        G8lR2AcceptanceLedgerSnapshot {
            anchor_sequence: self.anchor_sequence,
            last_completed_sequence: self.last_completed_sequence,
            completed_block_count: self.completed_block_count,
            retained_runtime_baselines: self.retained_runtime_baselines,
            retained_physical_observations: self.retained_physical_observations,
            new_supported_profile_runtime_observations: 0,
            new_physical_observations: 0,
            operator_authorizations: 0,
            external_acceptances: 0,
            cross_profile_coverage_complete: false,
            r2_field_acceptance_complete: false,
        }
    }
}

const fn str_eq(left: &str, right: &str) -> bool {
    let left = left.as_bytes();
    let right = right.as_bytes();
    if left.len() != right.len() {
        return false;
    }
    let mut index = 0;
    while index < left.len() {
        if left[index] != right[index] {
            return false;
        }
        index += 1;
    }
    true
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lR2AcceptanceError {
    WrongCpu,
    MissingS575PhysicalPass,
    S575AnchorDrift,
    PrematureAcceptanceClaim,
    SequenceOutOfRange,
    DescriptorDrift,
}

impl G8lR2AcceptanceError {
    pub const fn diagnostic_code(self) -> u64 {
        match self {
            Self::WrongCpu => 0x5276_01,
            Self::MissingS575PhysicalPass => 0x5276_02,
            Self::S575AnchorDrift => 0x5276_03,
            Self::PrematureAcceptanceClaim => 0x5276_04,
            Self::SequenceOutOfRange => 0x5276_05,
            Self::DescriptorDrift => 0x5276_06,
        }
    }
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lR2AcceptanceOutcome {
    AwaitingS575,
    AwaitingPredecessor {
        sequence: usize,
        expected_predecessor: usize,
        observed_predecessor: usize,
    },
    Advanced(G8lR2AcceptanceReceipt),
    Retained(G8lR2AcceptanceReceipt),
    AlreadyCompleted {
        requested_sequence: usize,
        last_completed_sequence: usize,
    },
}

pub fn advance_s576_to_s707_model_acceptance_gate(
    ledger: &mut G8lR2AcceptanceLedger,
    caller_cpu: usize,
    descriptor: G8lR2AcceptanceGateDescriptor,
) -> Result<G8lR2AcceptanceOutcome, G8lR2AcceptanceError> {
    if caller_cpu != S576_TARGET_CPU {
        return Err(G8lR2AcceptanceError::WrongCpu);
    }
    let canonical = canonical_s576_to_s707_acceptance_descriptor(descriptor.sequence)
        .ok_or(G8lR2AcceptanceError::SequenceOutOfRange)?;
    if canonical != descriptor || descriptor.step.ordinal() != descriptor.step_ordinal {
        return Err(G8lR2AcceptanceError::DescriptorDrift);
    }
    if descriptor.sequence < ledger.last_completed_sequence {
        return Ok(G8lR2AcceptanceOutcome::AlreadyCompleted {
            requested_sequence: descriptor.sequence,
            last_completed_sequence: ledger.last_completed_sequence,
        });
    }
    if descriptor.sequence == ledger.last_completed_sequence {
        if let Some(receipt) = ledger.last_receipt {
            if receipt.sequence == descriptor.sequence {
                return Ok(G8lR2AcceptanceOutcome::Retained(receipt));
            }
        }
        return Ok(G8lR2AcceptanceOutcome::AlreadyCompleted {
            requested_sequence: descriptor.sequence,
            last_completed_sequence: ledger.last_completed_sequence,
        });
    }
    if ledger.last_completed_sequence != descriptor.predecessor_sequence {
        return Ok(G8lR2AcceptanceOutcome::AwaitingPredecessor {
            sequence: descriptor.sequence,
            expected_predecessor: descriptor.predecessor_sequence,
            observed_predecessor: ledger.last_completed_sequence,
        });
    }
    let completed_block_count = if descriptor.step_ordinal == descriptor.block_step_count {
        descriptor.block_ordinal
    } else {
        descriptor.block_ordinal - 1
    };
    let receipt = G8lR2AcceptanceReceipt {
        sequence: descriptor.sequence,
        predecessor_sequence: descriptor.predecessor_sequence,
        workstream: descriptor.workstream,
        block_ordinal: descriptor.block_ordinal,
        step_ordinal: descriptor.step_ordinal,
        acceptance_domain: descriptor.acceptance_domain,
        anchor_sequence: ledger.anchor_sequence,
        physical_repeat_sequence: ledger.anchor_sequence,
        retained_runtime_baselines: ledger.retained_runtime_baselines,
        retained_physical_observations: ledger.retained_physical_observations,
        completed_block_count,
        source_gate_complete: true,
        runtime_evidence_required: descriptor.runtime_evidence_required,
        physical_evidence_required: descriptor.physical_evidence_required,
        external_authority_required: descriptor.external_authority_required,
        new_supported_profile_runtime_observations: 0,
        new_physical_observations: 0,
        operator_authority_received: false,
        external_authority_received: false,
        linked_into_board_rpi5: S576_TO_S707_LINKED_INTO_BOARD_RPI5,
        visible_scanout_observed: false,
        physical_input_observed: false,
        cross_profile_coverage_complete: false,
        acceptance_complete: false,
        r2_field_acceptance_complete: false,
        runbook_executed: false,
    };
    ledger.last_completed_sequence = descriptor.sequence;
    ledger.completed_block_count = completed_block_count;
    ledger.last_receipt = Some(receipt);
    Ok(G8lR2AcceptanceOutcome::Advanced(receipt))
}

pub const S576_SEQUENCE: usize = 576;
pub const S576_EXPECTED_PREDECESSOR: usize = S575_PHYSICAL_REPEAT_SEQUENCE;
pub const S576_WORKSTREAM: usize = 2;
pub const S576_BLOCK_ORDINAL: usize = 1;
pub const S576_BLOCK_STEP_COUNT: usize = 9;
pub const S576_STEP_ORDINAL: usize = 1;
pub const S576_ACCEPTANCE_DOMAIN: &str = "scheduler_exclusion_runtime";
pub const S576_LINKED_INTO_BOARD_RPI5: bool = S576_TO_S707_LINKED_INTO_BOARD_RPI5;
pub const S576_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS: usize = 0;
pub const S576_PHYSICAL_OBSERVATIONS: usize = 0;
pub const S576_OPERATOR_AUTHORIZATIONS: usize = 0;
pub const S576_EXTERNAL_ACCEPTANCES: usize = 0;
pub const S576_PHYSICAL_OR_DEVICE_OPERATIONS: usize = 0;
pub const S576_ACCEPTANCE_COMPLETE: bool = false;
pub const S576_R2_FIELD_ACCEPTANCE_COMPLETE: bool = false;
pub const RUNBOOK_EXECUTED_IN_S576: bool = false;

pub const S576_DESCRIPTOR: G8lR2AcceptanceGateDescriptor = G8lR2AcceptanceGateDescriptor {
    sequence: S576_SEQUENCE,
    predecessor_sequence: S576_EXPECTED_PREDECESSOR,
    workstream: S576_WORKSTREAM,
    block_ordinal: S576_BLOCK_ORDINAL,
    block_step_count: S576_BLOCK_STEP_COUNT,
    step_ordinal: S576_STEP_ORDINAL,
    acceptance_domain: S576_ACCEPTANCE_DOMAIN,
    step: G8lR2AcceptanceStep::ContractRegistration,
    runtime_evidence_required: true,
    physical_evidence_required: true,
    external_authority_required: false,
};

pub type G8lS576AcceptanceGateOutcome = G8lR2AcceptanceOutcome;
pub type G8lS576AcceptanceGateError = G8lR2AcceptanceError;

pub fn service_s576_model_r2_scheduler_exclusion_runtime_contract(
    ledger: &mut G8lR2AcceptanceLedger,
    caller_cpu: usize,
) -> Result<G8lS576AcceptanceGateOutcome, G8lS576AcceptanceGateError> {
    advance_s576_to_s707_model_acceptance_gate(ledger, caller_cpu, S576_DESCRIPTOR)
}

use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s576_r2_scheduler_exclusion_runtime_contract::{
    advance_s576_to_s707_model_acceptance_gate,
    canonical_s576_to_s707_acceptance_descriptor, G8lR2AcceptanceAnchor,
    G8lR2AcceptanceError, G8lR2AcceptanceLedger, G8lR2AcceptanceOutcome,
    S575_PHYSICAL_REPEAT_SEQUENCE, S576_CANONICAL_ANCHOR, S576_FIRST_SEQUENCE,
    S707_LAST_SEQUENCE,
};
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s576_r2_scheduler_exclusion_runtime_contract as gate;

fn r2_anchor() -> G8lR2AcceptanceAnchor {
    S576_CANONICAL_ANCHOR
}

fn acceptance_ledger() -> G8lR2AcceptanceLedger {
    G8lR2AcceptanceLedger::from_s575(1, r2_anchor()).unwrap()
}

fn advance_before(ledger: &mut G8lR2AcceptanceLedger, sequence: usize) {
    for predecessor in S576_FIRST_SEQUENCE..sequence {
        let descriptor = canonical_s576_to_s707_acceptance_descriptor(predecessor).unwrap();
        assert!(matches!(
            advance_s576_to_s707_model_acceptance_gate(ledger, 1, descriptor),
            Ok(G8lR2AcceptanceOutcome::Advanced(_))
        ));
    }
}

#[test]
fn s576_descriptor_is_exact_and_canonical() {
    assert_eq!(gate::S576_SEQUENCE, 576);
    assert_eq!(gate::S576_EXPECTED_PREDECESSOR, 575);
    assert_eq!(gate::S576_WORKSTREAM, 2);
    assert_eq!(gate::S576_BLOCK_ORDINAL, 1);
    assert_eq!(gate::S576_BLOCK_STEP_COUNT, 9);
    assert_eq!(gate::S576_STEP_ORDINAL, 1);
    assert_eq!(gate::S576_ACCEPTANCE_DOMAIN, "scheduler_exclusion_runtime");
    assert_eq!(gate::S576_DESCRIPTOR.external_authority_required, false);
    assert!(gate::S576_DESCRIPTOR.physical_evidence_required);
    assert_eq!(
        canonical_s576_to_s707_acceptance_descriptor(576),
        Some(gate::S576_DESCRIPTOR)
    );
}

#[test]
fn s576_is_cpu1_scoped_and_waits_for_exact_predecessor() {
    let mut ledger = acceptance_ledger();
    assert_eq!(
        gate::service_s576_model_r2_scheduler_exclusion_runtime_contract(&mut ledger, 0),
        Err(G8lR2AcceptanceError::WrongCpu)
    );
    assert_eq!(
        ledger.last_completed_sequence(),
        S575_PHYSICAL_REPEAT_SEQUENCE
    );
    if 576 == S576_FIRST_SEQUENCE {
        let future = canonical_s576_to_s707_acceptance_descriptor(577).unwrap();
        assert!(matches!(
            advance_s576_to_s707_model_acceptance_gate(&mut ledger, 1, future),
            Ok(G8lR2AcceptanceOutcome::AwaitingPredecessor {
                expected_predecessor: 576,
                observed_predecessor: 575,
                ..
            })
        ));
    } else {
        assert!(matches!(
            gate::service_s576_model_r2_scheduler_exclusion_runtime_contract(&mut ledger, 1),
            Ok(G8lR2AcceptanceOutcome::AwaitingPredecessor {
                sequence: 576,
                expected_predecessor: 575,
                observed_predecessor: 575,
            })
        ));
    }
}

#[test]
fn s576_advances_once_with_non_acceptance_receipt() {
    let mut ledger = acceptance_ledger();
    advance_before(&mut ledger, 576);
    let G8lR2AcceptanceOutcome::Advanced(receipt) =
        gate::service_s576_model_r2_scheduler_exclusion_runtime_contract(&mut ledger, 1).unwrap()
    else {
        panic!("S576 must advance")
    };
    assert_eq!((receipt.sequence, receipt.predecessor_sequence), (576, 575));
    assert_eq!(
        (
            receipt.workstream,
            receipt.block_ordinal,
            receipt.step_ordinal
        ),
        (2, 1, 1)
    );
    assert_eq!(receipt.acceptance_domain, "scheduler_exclusion_runtime");
    assert_eq!(receipt.completed_block_count, 0);
    assert_eq!(receipt.anchor_sequence, 575);
    assert_eq!(receipt.physical_repeat_sequence, 575);
    assert!(receipt.source_gate_complete);
    assert!(receipt.runtime_evidence_required);
    assert!(receipt.physical_evidence_required);
    assert_eq!(receipt.new_supported_profile_runtime_observations, 0);
    assert_eq!(receipt.new_physical_observations, 0);
    assert_eq!(receipt.retained_physical_observations, 2);
    assert!(!receipt.visible_scanout_observed);
    assert!(!receipt.physical_input_observed);
    assert!(!receipt.cross_profile_coverage_complete);
    assert!(!receipt.operator_authority_received);
    assert!(!receipt.external_authority_received);
    assert!(!receipt.linked_into_board_rpi5);
    assert!(!receipt.acceptance_complete);
    assert!(!receipt.r2_field_acceptance_complete);
    assert!(!receipt.runbook_executed);
}

#[test]
fn s576_replay_is_idempotent_and_historical_reentry_does_not_mutate() {
    let mut ledger = acceptance_ledger();
    advance_before(&mut ledger, 576);
    let G8lR2AcceptanceOutcome::Advanced(receipt) =
        gate::service_s576_model_r2_scheduler_exclusion_runtime_contract(&mut ledger, 1).unwrap()
    else {
        panic!("advance")
    };
    assert_eq!(
        gate::service_s576_model_r2_scheduler_exclusion_runtime_contract(&mut ledger, 1),
        Ok(G8lR2AcceptanceOutcome::Retained(receipt))
    );
    if 576 < S707_LAST_SEQUENCE {
        let next = canonical_s576_to_s707_acceptance_descriptor(576 + 1).unwrap();
        assert!(matches!(
            advance_s576_to_s707_model_acceptance_gate(&mut ledger, 1, next),
            Ok(G8lR2AcceptanceOutcome::Advanced(_))
        ));
        assert_eq!(
            gate::service_s576_model_r2_scheduler_exclusion_runtime_contract(&mut ledger, 1),
            Ok(G8lR2AcceptanceOutcome::AlreadyCompleted {
                requested_sequence: 576,
                last_completed_sequence: 576 + 1,
            })
        );
    }
}

#[test]
fn s576_open_claim_boundary_is_preserved() {
    assert_eq!(gate::S576_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS, 0);
    assert_eq!(gate::S576_PHYSICAL_OBSERVATIONS, 0);
    assert_eq!(gate::S576_OPERATOR_AUTHORIZATIONS, 0);
    assert_eq!(gate::S576_EXTERNAL_ACCEPTANCES, 0);
    assert_eq!(gate::S576_PHYSICAL_OR_DEVICE_OPERATIONS, 0);
    assert!(!gate::S576_ACCEPTANCE_COMPLETE);
    assert!(!gate::S576_R2_FIELD_ACCEPTANCE_COMPLETE);
    assert!(!gate::S576_LINKED_INTO_BOARD_RPI5);
    assert!(!gate::RUNBOOK_EXECUTED_IN_S576);
}

#[test]
fn s576_is_simulation_only_and_adds_no_production_callsite() {
    const TARGET: &str = "g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s576_r2_scheduler_exclusion_runtime_contract";
    let source = include_str!("../../kernel/src/g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s576_r2_scheduler_exclusion_runtime_contract.rs");
    let kernel_registry = include_str!("../../kernel/src/main.rs");
    let simulation_registry = include_str!("../src/lib.rs");
    let exceptions = include_str!("../../kernel/src/arch/aarch64/exceptions.rs");
    assert!(source.contains("pub const S576_DESCRIPTOR"));
    assert_eq!(
        simulation_registry
            .matches(&format!("pub mod {TARGET};"))
            .count(),
        1
    );
    assert_eq!(
        kernel_registry.matches(&format!("mod {TARGET};")).count(),
        0
    );
    assert_eq!(exceptions.matches(TARGET).count(), 0);
    assert_eq!(exceptions.matches("service_s576_").count(), 0);
}

#[test]
fn s576_descriptor_mutation_fails_before_ledger_advance() {
    let mut ledger = acceptance_ledger();
    advance_before(&mut ledger, 576);
    let before = ledger.last_completed_sequence();
    let mut drift = gate::S576_DESCRIPTOR;
    drift.block_ordinal += 1;
    assert_eq!(
        advance_s576_to_s707_model_acceptance_gate(&mut ledger, 1, drift),
        Err(G8lR2AcceptanceError::DescriptorDrift)
    );
    assert_eq!(ledger.last_completed_sequence(), before);
}

#[test]
fn s576_rejects_missing_s575_pass_premature_acceptance_and_anchor_drift() {
    let mut without_repeat: G8lR2AcceptanceAnchor = S576_CANONICAL_ANCHOR;
    without_repeat.physical_repeat_observed = false;
    assert_eq!(
        G8lR2AcceptanceLedger::from_s575(1, without_repeat).err(),
        Some(G8lR2AcceptanceError::MissingS575PhysicalPass)
    );
    let mut unauthorized: G8lR2AcceptanceAnchor = S576_CANONICAL_ANCHOR;
    unauthorized.authorization_received = false;
    assert_eq!(
        G8lR2AcceptanceLedger::from_s575(1, unauthorized).err(),
        Some(G8lR2AcceptanceError::MissingS575PhysicalPass)
    );
    let mut overclaimed: G8lR2AcceptanceAnchor = S576_CANONICAL_ANCHOR;
    overclaimed.r2_field_acceptance_complete = true;
    assert_eq!(
        G8lR2AcceptanceLedger::from_s575(1, overclaimed).err(),
        Some(G8lR2AcceptanceError::PrematureAcceptanceClaim)
    );
    let mut scanout: G8lR2AcceptanceAnchor = S576_CANONICAL_ANCHOR;
    scanout.visible_scanout_observed = true;
    assert_eq!(
        G8lR2AcceptanceLedger::from_s575(1, scanout).err(),
        Some(G8lR2AcceptanceError::PrematureAcceptanceClaim)
    );
    let mut drifted: G8lR2AcceptanceAnchor = S576_CANONICAL_ANCHOR;
    drifted.repeat_status = "RED";
    assert_eq!(
        G8lR2AcceptanceLedger::from_s575(1, drifted).err(),
        Some(G8lR2AcceptanceError::S575AnchorDrift)
    );
    assert_eq!(
        G8lR2AcceptanceLedger::from_s575(0, S576_CANONICAL_ANCHOR).err(),
        Some(G8lR2AcceptanceError::WrongCpu)
    );
}

  {
    id: "g8l-s576-r2-scheduler-exclusion-runtime-contract-partial",
    sequence: 576,
    slug: "r2_scheduler_exclusion_runtime_contract",
    title: "Whole-scheduler exclusion runtime observation · R2 acceptance contract registration",
    titleTr: "Whole-scheduler dışlama gözlemi · R2 kabul sözleşmesi kaydı",
    workstream: 2,
    focusedTests: 8,
    sourceBytes: 23897,
    sourceSha256: "e1a0ac7843a58357758ebfaaf14ee42a4f9618ee66c2ad14366c76b3df25c961",
    testBytes: 9315,
    testSha256: "8002fa205d57fce7a86f6c942229a15f62d1e7aeb5df6c8562924eed9c9b07a5",
    blockOrdinal: 1,
    blockCount: 14,
    blockTitle: "Whole-scheduler exclusion runtime observation",
    blockTitleTr: "Whole-scheduler dışlama gözlemi",
    blockStepCount: 9,
    stepOrdinal: 1,
    stepTitle: "R2 acceptance contract registration",
    stepTitleTr: "R2 kabul sözleşmesi kaydı",
    externalAuthorityRequired: false,
    acceptance: "S576, R1→R2 geçişinin 2. iş kolundaki Whole-scheduler dışlama gözlemi bloğunun 1/9 R2 kabul sözleşmesi kaydı adımını exact S575 predecessor sonrasında ayrı typed descriptor ile fail-closed olarak kaydeder.",
    retainedBoundary: "Bu yalnız fail-closed software readiness kaydıdır; supported-profile runtime observation=0, physical observation=0, operatör yetkisi=0, dış kabul=0, acceptance_complete=false, r2_field_acceptance_complete=false, board-rpi5 kernel'e link=false ve RUNBOOK_EXECUTED_IN_S576=NO kalır. Bu iş kolu dış kabul otoritesi gerektirmez; fiziksel gözlem yine de zorunludur.",
  },