Nexus platform diagram atlas

This atlas delivers 15 required views and two supplementary diagrams. Main views are registered in the diagram index; maintenance follows the diagram standards. Each view has an exact current/reference identity. Source existence, successful rendering or a software flow does not prove hardware execution or external publication.

Code references are pinned to 0111c8d3b9c7b37d258b9c401070305b13b6f3a1; documentation tooling implemented after that commit is bounded by its final execution records. Rendering did not change firmware source relationships. Editable DOT sources produce local SVG. Dark labels, line styles and text jointly express relationships rather than depending on color alone.

Each of the 17 sources derives Chinese and English views; pages use the local SVG for their selected language. One canonical DOT still owns nodes, edges, attributes and scope; labels.json contains complete label translations only and cannot change topology. Checks pair all 34 localized DOT/SVG sets with their originals; missing translations, stale output or illegal resources fail the gate. Graphviz Cairo emits SVG glyph paths so offline readers need no Chinese fonts. Each view includes a title, description and textual alt/caption. The generation host requires locked Graphviz, Cairo and Noto Sans CJK SC; delivery records bind final tool identities and automated results. Source semantics, actual desktop/narrow-screen/zoom/print browser checks and offline acceptance have separate records. The 15 main and two supplementary sources have independent edge-by-edge and PNG review: current is source_reviewed, reference is reference_reviewed, and the supplementary target is design_reviewed. Actual records establish browser and formal-package acceptance separately; these states establish neither HIL nor public-deployment qualification.

After changing labels, explicitly use the prepared locked tools to generate language views, then run the complete check:

python -m tools.documentation.diagram_localization --write \
    --tool-prefix /absolute/path/to/prepared-doc-tools
python tools/dev/dev.py docs check --full \
    --tool-prefix /absolute/path/to/prepared-doc-tools

localized/en/ and localized/zh_CN/ are derived assets. Successful generation proves rendering only. Label semantics, actual browser behavior and offline resource closure are reviewed separately; original diagram code references and historical execution identities remain unchanged.

FIG-01 Whole-platform layers and external boundaries

Identity: current. Scope: Products remain external; components and OS are optional; runtime access and build facts have distinct edges.

FIG-01: Products remain external; components and OS are optional; runtime access and build facts have distinct edges.

Applications own tasks, scheduling, recovery and shutdown coordination. Board contributes build-time authorization. After factory lookup obtains an identity, daily I/O enters the provider through its face. Arch is selected by the compiled target; there is no CPU factory or mandatory OS forwarding. Dashed edges denote explicit optional relationships or build-time facts; solid edge labels identify calls/contracts.

Sources: current architecture contract, root CMake, static assembly generation, runtime supplement. editable DOT; Implementation item: DOC-43.

FIG-02 Selected compile-target dependencies

Identity: reference. Scope: H743 baremetal IRQ UART; exact PUBLIC/PRIVATE/INTERFACE/OBJECT relationships.

FIG-02: H743 baremetal IRQ UART; exact PUBLIC/PRIVATE/INTERFACE/OBJECT relationships.

This reference selects the targets of tools/configure/assemblies/nucleo-h743-baremetal-uart.toml. Arrows run from the dependent to its dependency; dashed edges explicitly identify PRIVATE includes or OBJECT injection. Shared warnings, configuration-option edges and GC policy are omitted and remain managed by real CMake. Vendor headers enter only private implementation/startup scope; generated bindings also consume SDKs through private includes. Optional components are not selected in this assembly.

Sources: root target graph, firmware helper, IO targets, Arch targets, OS targets, H743 target, ABI/Config targets. editable DOT; Implementation item: DOC-44.

FIG-03 Configuration and atomic generation

Identity: current. Scope: Build-input/artifact chain; generation failure invalidates the owned bundle.

FIG-03: Build-input/artifact chain; generation failure invalidates the owned bundle.

Edges represent build-time input and artifact flow, not runtime calls. Strict parsing cannot repair invalid fields, conflicts or stale inputs. Failure withdraws only owned outputs: it neither clears unowned directories nor exposes partial artifacts. ELF/resource reports do not establish physical-board qualification.

Sources: configurator, immutable IR, bundle transaction, build contract. editable DOT; Implementation item: DOC-45.

FIG-04 Factory and static instances

Identity: reference. Scope: Illustrative two selected instances of one class; same-mode ops are shared; controller/endpoint identities remain separate.

FIG-04: Illustrative two selected instances of one class; same-mode ops are shared; controller/endpoint identities remain separate.

The structure shows configuration-selected layouts supported by the generator; it does not claim every PCB authorizes those combinations. Same-provider, same-mode instances share read-only ops while each context/state/storage remains independent. Different providers or modes can have different ops; a method receives the current context. Controllers and endpoints have distinct factory namespaces, and an endpoint cannot impersonate its controller. IDs are valid only in the current assembly; the default uint16_t typedef does not provide language-level protection against mixing classes.

Sources: typed factory generation, face/state assembly, public SPI interface, Native provider. editable DOT; Implementation item: DOC-46.

FIG-05 Explicit start, stop and failure cleanup

Identity: current. Scope: Generated lifecycle skeleton; each SoC retains its own private startup/cleanup contract.

FIG-05: Generated lifecycle skeleton; each SoC retains its own private startup/cleanup contract.

One external executor serializes start/stop. start does not start a scheduler; failures retain primary, cleanup and remaining_effects separately. Owners of acquired effects participate in reverse-order cleanup. Stop can release some instances successfully before returning BUSY/IO. BUSY cannot imply the platform is still fully running, and timeout does not permit storage reclamation. A concrete start_system failure may clean up inside its private path or retain the failed phase. Retry must satisfy that provider contract; the diagram is not a universal recovery API.

Sources: generated start/stop, cold GPIO lease, H743 cold lifecycle, current platform contract. editable DOT; Implementation item: DOC-47.

FIG-06 Core request states and borrows

Identity: current. Scope: Transitions and preconditions allowed by Core helpers; no promise of a recovery API for every provider.

FIG-06: Transitions and preconditions allowed by Core helpers; no promise of a recovery API for every provider.

REJECTED/ACCEPTED are admission results, not request states. After ACCEPTED, request/buffer borrowing continues; cancel/deadline only starts termination progress. The provider first drains every required reference, then release-publishes SETTLED as its final request access; the caller observes with acquire semantics. Related adapters/observers must exit separately. QUARANTINED to SETTLED is legal only after actual recovery and proof of drain. initialize cannot forcibly reset a borrowed object.

Sources: public request contract, actual Core transitions, final owner publication. editable DOT; Implementation item: DOC-48.

FIG-07 Finite UART and SPI DMA timing

Identity: reference. Scope: Exact finite F407 USART1/SPI1 DMA; Task/IRQ/DMA completion and failure paths.

FIG-07: Exact finite F407 USART1/SPI1 DMA; Task/IRQ/DMA completion and failure paths.

Top-to-bottom order distinguishes Task, DMA IRQ and UART IRQ. UART DMA TC cannot replace TC for the final serial bit; completion of both SPI DMA streams cannot replace BSY=0/TXE=1. Final drain, error observation and reference withdrawal all precede SETTLED. CS nodes describe software commands and do not prove electrical levels or physical timing. Cancel/error paths require the same actual drain conditions; failure retains QUARANTINED borrowing. NDTR is not a reliable wire-byte count, and this view does not extend to GD32 reset semantics.

Sources: F407 UART DMA, F407 SPI DMA, DMA drain contract, multiple-controller contract. editable DOT; Implementation item: DOC-49.

FIG-08 Wait, wake and externally owned shutdown

Identity: current. Scope: ready-arm-ready-wait-ready and actual execution/join responsibilities.

FIG-08: ready-arm-ready-wait-ready and actual execution/join responsibilities.

nx_wait_until only checks a predicate and waits for hints; it neither services hardware nor creates a worker. Rechecking after arm prevents a lost wake. After TIMEOUT, a final true predicate still returns SUCCESS. The notification port requires one waiter. External shutdown first closes admission and requests cancel while keeping owner/IRQ drain progress alive. Join producers after their loans settle; confirm owner idle includes publication exit, then stop and join the executor. Next stop hardware RX/IRQ publishers, detach wake and join other publishers; only then destroy OS synchronization storage. Related observers need their final access to exit independently. A running kernel must retain its clock/Tick, and failed storage remains retained.

Sources: wait contract, production wait algorithm, owner interface, OS lifecycle. editable DOT; Implementation item: DOC-50.

FIG-09 H743 memory, DMA and cache

Identity: reference. Scope: Finite H743ZIT6 USART3 TX; complete 32-byte AXI SRAM lines.

FIG-09: Finite H743ZIT6 USART3 TX; complete 32-byte AXI SRAM lines.

Selected TX DMA authorizes only 512 KiB AXI SRAM; other physical domains and dma_engines reachability facts do not automatically authorize placement or power. Cache-on requires exclusive complete 32-byte lines, with a maximum of 65504 bytes; Cache-off accepts 1..65535 bytes. PREPARING establishes the borrow first; clean executes under the caller’s normal masks, and cancellation cannot reclaim storage before it finishes. This diagram neither implements nor claims H743 RX DMA; future RX needs separate pre- and post-drain maintenance contracts. Trusted reset or a prior successful owned clean/disable establishes cold caches; clear CCR bits cannot claim responsibility for foreign dirty state.

Sources: exact physical domains, H743 provider scope, TX DMA implementation, cache range contract, cold-cache contract. editable DOT; Implementation item: DOC-51.

FIG-10 Independent Source SDK consumption

Identity: current. Scope: Actual public entry points and consumers; relocate the complete prefix; Native execution and ARM linking remain separate.

FIG-10: Actual public entry points and consumers; relocate the complete prefix; Native execution and ARM linking remain separate.

Packaging, relocation, verify and consumer execution are separate steps. Move the complete installed prefix; an SDK subtree cannot replace package closure. find_package and resolver boundaries read actual byte identities; fixture opt-in does not bypass checksums. Native consumers actually run; MCU consumers establish compile/link/resource evidence, not physical execution. Platform macros or vendor includes must not contaminate parent targets.

Sources: Source SDK packaging and verify, real independent consumers, resolver SDK verification boundary, CMake SDK entry. editable DOT; Implementation item: DOC-52.

FIG-11 Software and HIL evidence relationships

Identity: current. Scope: Each scope obtains actual evidence separately; HIL tooling is not a physical measurement.

FIG-11: Each scope obtains actual evidence separately; HIL tooling is not a physical measurement.

Host/model, ARM/link/resources, SDK consumption, two network-disabled reproductions and HIL tooling each need actual execution records bound to the same source/config/artifact. Candidate sealing revalidates scope proofs and raw bytes. Physical station measurements additionally bind PCB, silicon, fixture and the same image; absent equipment means not_executed. A software candidate does not automatically become a product release, safety certification or LTS promise.

Sources: qualification contract, candidate scope validation, actual proof verification, network-disabled reproduction, HIL tooling. editable DOT; Implementation item: DOC-53.

FIG-12 Documentation, SDK and evidence publication and restore

Identity: reference. Scope: Reference delivery flow; public publishing/downloading requires actual receipts and cannot be inferred from a diagram.

FIG-12: Reference delivery flow; public publishing/downloading requires actual receipts and cannot be inferred from a diagram.

Documentation, SDKs and software candidates retain separate payloads and qualification. Manifest outputs list only payload, excluding the manifest itself, checksums and archive; an outer receipt records the archive hash. An immutable release-id cannot overwrite old directories, and stable does not mean all HIL passed. SDK/candidate/evidence use existing byte verification and restore mechanisms; documentation publication tools are accepted through actual CLI results. Independent restore checks paths, sizes, hashes and applicable consumers. Archiving does not rerun all historical tests. Actual external receipts prove public publishing, downloading and long-term storage; a workflow cannot replace them.

Sources: actual documentation sealing and restore, documentation delivery contract, Source SDK closure, candidate sealing, scope proof, archive and independent restore. editable DOT; Implementation item: DOC-54.

FIG-13 Cortex-M capability layers

Identity: current. Scope: Nine-core CPU software, Runtime, concrete SoC and physical-board scopes remain separate.

FIG-13: Nine-core CPU software, Runtime, concrete SoC and physical-board scopes remain separate.

CpuProfileIR explicitly selects legal ABI and optional features; capabilities are not inferred from the core name. Runtime has no SoC/Board/startup/linker/factory; a whole platform additionally needs exact providers and resources. Current M7 cold-cache control does not extend to other cache-equipped cores. Software gates in the view require actual evidence within their own scope and cannot inherit historical counts. Real context preservation, coherency, privilege and waveforms still need physical acceptance.

Sources: nine-core software contract, CPU resolver, Runtime CMake entry, Arch source target, whole-platform support scope. editable DOT; Implementation item: DOC-55.

FIG-14 U575 synchronous dual-domain reference

Identity: reference. Scope: Independent TZEN1 synchronous GPIO without OS; the default TZEN0 provider is unchanged.

FIG-14: Independent TZEN1 synchronous GPIO without OS; the default TZEN0 provider is unchanged.

The boot owner supplies and establishes actual option-byte/image-layout preconditions before execution; the mechanism does not write option bytes. GTZC, SAU and NS MPU are distinct boundaries. NSC fetch checks Secure MPU; CMSE observation cannot replace a bus firewall or pinning. This reference requires no NS handlers, RTOS or autonomous masters; its fixed world principal permits only synchronous scalar GPIO. Failure after acquiring irreversible effects must be retained until reset. Synchronous SG pinning derives from static mappings and absence of concurrency. Actual observations of 8/16 MPU regions apply only to this reference and do not alter the exact-eight tuple of the TZEN0 provider. All physical isolation cases remain unexecuted.

Sources: canonical dual-domain contract, production cold owner, actual paired-image fixture, UserIoBroker, public CMSE observation contract. editable DOT; Implementation item: DOC-56.

FIG-15 Continuous RX and observable block loss

Identity: reference. Scope: Continuous F407 USART1 RX; preposted FIFO loans, loss and stop responsibilities.

FIG-15: Continuous F407 USART1 RX; preposted FIFO loans, loss and stop responsibilities.

Do not mix preposted and ordinary producers. Publish an old block in FIFO order only after it disappears completely from both hardware targets and CT/EN/new flags prove withdrawal. On failure, withdraw sources and release future loans in LIFO order; BORROWED consumer blocks must not be overwritten. Missing spare blocks, IDLE and recovery can cause gaps. lost_blocks counts observed boundaries, not exact missing wire bytes. A TC flag cannot count arbitrary coalesced wraps; actual IRQ/address-replacement latency must be shorter than one block fill time. stop closes admission and preserves drain. outstanding=0 still requires caller/observer exit. First-release ADC trigger blocks are explicitly rearmed by service and have gaps between blocks; this view does not claim continuous ADC.

Sources: UART DMA/continuous-loan contract, stream state contract, capacity and observation contract, F407 RX DMA implementation, explicit ADC rearm. editable DOT; Implementation item: DOC-57.

Supplementary views

The runtime-access supplement and DOT source distinguish factory lookup from direct I/O. They do not replace the complete FIG-01 layering.

The original documentation-system target view and DOT source retain the original planned build-input relationships. Its target identity indicates design provenance, not current tools, public deployment, SDK or physical-board qualification. Current delivery and restore are determined by FIG-12 and actual execution records.