Document source: 58297516d707; code reference: 58297516d707. 中文. Source language: zh_CN; requested: en; actual: en; translation: reviewed.

Source documentation does not establish software or physical hardware qualification. See the support and qualification records for their exact scope.

Software candidates and physical qualification

Platform mechanisms are implemented; current development verification describes actual execution scope. Final clean-source SDK, offline double-build, candidate sealing and physical HIL are separate stages. Code completion, CI definitions or a hash cannot establish passed status.

Stage	Required inputs and execution	Current recording rule
Development verification	Actual compiler, production-TU models, ARM ELF, resource reports and fresh tests	Executed items record raw paths; dirty workspaces are explicitly development evidence
Source SDK	Clean HEAD, locked dependencies, license manifest and independently relocated consumer	Actually configure/build/run/link using the current new package
Formal software qualification	Matching source/config/dependency/tool/ELF identities; nonzero fresh tests and budgets	tools/evidence/qualification.py rejects empty reports, wrong scope and invalid evidence
Offline reproduction	Sealed OCI/toolchain, two independent fresh roots, formal build network=none	reproduce.py actually executes and compares ELF/BIN; maps retain raw bytes; recipes/digests cannot replace execution
Candidate sealing	Qualification, reproduction and SDK for the same source/config/artifact	candidate.py/proof.py verify before sealing; no automatic product release
Physical HIL	Actual PCB/UID/probe/serial/power/station, matching candidate image and budgets	Hardware is not connected; every MCU target is not_executed

HIL fixtures and station templates are in tools/hil/fixtures/. Admission rejects empty stations, incorrect Board/PCB/chip/probe/image/config, invalid tool files or incomplete budgets. Preparing fixtures is not flashing, serial testing, waveform measurement or completed power-cut testing.

Evidence for ThreadX, USB FS, shallow-sleep timebase, Ethernet, advanced timers, G474, the user I/O broker and H743/U575 GPIO/UART references is each bound to independent source scope. Real ThreadX Linux-kernel execution differs from IRQ/libc boundary models. Three-board BASEPRI/PRIMASK ELFs and exact negative links for absent external Tick differ from MCU execution. The installed SDK retention-only permanent-task program establishes linking only; a separately executed bounded-exit real Linux-kernel consumer establishes runtime evidence. A linked program does not imply scheduler execution, and two host cases do not imply complete MCU-backend qualification.

The eight public single-image candidate configurations use H743 HSI64/Cache off and U575 MSIS4 MHz/TZEN=0/SWAP_BANK=0. H743 HSI32/Cache-on fixed configuration and limited TX DMA, and the independent U575 TZEN=1 split-domain reference, have separate software/ARM evidence and are outside those eight candidates. Models and ELFs do not observe actual power, option bytes or silicon revision. Per-engine DMA facts alone establish neither actual cache coherence nor security-domain isolation. The SDK must actually build H743/U575 public consumers from the current complete source closure; qualification of an old package that only added CMSIS dependencies cannot qualify new platforms. Exact results are in SoC extension execution.

G474 has actual typed-factory host execution, system/provider/EXTI regressions and explicit TOML ARM images (empty/selected/EXTI fixture × baremetal/FreeRTOS). EXTI-fixture PA0/PA1 are software wiring fixtures without PCB electrical qualification. Image budgets, operation-table retention, unselected-peripheral trimming and actual vector bytes are checked separately. SysTick 170 MHz/1 kHz/reload169999 is compilation/link evidence, not timing-precision measurement. Host sanitizers only check executed software paths. Reference crystal/PCB/solder bridges, hardware timing and final-clean-HEAD SDK/offline reproduction/new candidates have separate exit conditions; other G474 peripherals or ThreadX cannot be marked supported from this evidence.

USB packet/clock/factory models and software-Board ELFs do not physically prove VBUS, connector, PHY, enumeration or flush cycles. The shallow-Sleep 1 MHz timer model establishes only the executed quantization-phase contract; actual clock/PLL/wake/IRQ/catch-up/power require measurement on the same image. Ethernet descriptor OWN/loan, capture/break and caller-memory-pin software models likewise establish no electrical, throughput, edge-aperture, power-stage safety or MPU/TZ userspace isolation. Public API, mode configuration, SoC provider, reviewed Board route, final candidate and physical execution have different exit conditions.

Returning tasks release storage only after actual kernel detach. Prestart discard applies only to proven prestart scope. A scheduler-start attempt that returns is a retaining fail-stop; kernel return cannot mean never started or revoke tasks, DMA, clocks and external effects that may have run. A kernel still running after I/O stop retains clock/Tick. Product reset, safe device outputs and a complete scheduler-stop port are external responsibilities. The platform claims no automatic fault recovery or safety certification.

Core nx_fault_observe is a best-effort observation narrow port with no default state. FreeRTOS/ThreadX retaining fail-stop paths supply actual domain/reason/static source position and retain all borrows. Fault context may be masked, ISR, unprivileged or stack-corrupted. Observers cannot assume a working kernel/clock/transport, release borrows, take OS locks or replay requests. Returning hooks still proceed with halt. Fault logging, external safe output and controlled reset are separately accepted; host death tests do not imply executed physical exception handling or safe outputs.

Final candidate packages retain exact raw commands, exit codes, JUnit/model/budget and binary identities for revalidation. Adding introductory documentation does not inherit past test qualification; changed source/artifacts require applicable checks to run again. Ordinary CI and source-SDK workflows do not automatically promote products.

After hardware connection, first check safe outputs, clock/reset, UART TC/cancel/RX loss, SPI/I2C, Flash power cuts, watchdog and EXTI/PWM/ADC; then measure cycles/latency/high-water and sustained load. External projects own private product policies, field deployment, keys and manufacturing permissions.

Ledger implemented records that code/tools exist in source. qualification_record_authority means actual acceptance is determined by external delivery evidence for that source HEAD, not self-reported passed status in source. Formal execution writes to nexus-delivery/<HEAD>/; candidate candidate.json, six qualification classes and raw reports together determine final status. Post-commit acceptance can thus bind exact HEAD, and later documentation commits cannot inherit old qualification.