Security scanning and lifecycle boundaries

CodeQL analyzes maintained production implementations, current tools and behavior tests in an actual Native build. Python extraction excludes only nonexecuted historical documentation tools under docs/archive/, not current tests, configurator, evidence tools or SDK packaging. Queries remain security-and-quality; ownership/path checks were not disabled to remove diagnostics. Successful scan execution and diagnostic review are separate results.

Findings and fixes in this iteration

  • The comment-check CLI explicitly terminates invalid input rather than printing an unestablished success report; regressions check failure exit code, stderr and empty stdout.

  • Storage fault tests use their own 0700 temporary directory and fixed filename, validate/enter it through the same directory FD, then restore cwd. They do not check a path before resolving it again. Cross-process persistence reexecutes fixed Linux /proc/self/exe; the command line cannot select files/programs. Actual tests retain two groups of 315 write/power-cut boundaries and fresh-process reads rather than substituting same-process memory.

  • STM32 GPIO register fixtures restore their borrowed global RCC pointer before exit and then actually verify rejection while unbound, avoiding escaped stack addresses.

  • GD32 watchdog fixtures use static storage. Independent-watchdog enable is irreversible; stop returns unsupported and the owner lasts until process/platform reset, not ordinary scope exit.

  • Unused maintenance-tool imports were removed; expected process-cleanup races and polling timeout are documented. Failure still cleans the entire process group and rethrows the exception.

Relevant source/regressions are in scripts/ci/test_comment_style.py, tests/contracts/components_storage.c, stm32_io_test.c, gd32_io_test.c and tool contract tests. Current-commit CI and candidate evidence determine final execution status.

Retained borrow semantics and review responsibility

Asynchronous interfaces necessarily borrow caller addresses stored in providers/owners. Stack-address-escape diagnostics require checking actual lifecycle; implicit heap allocation, removal of IRQ tables or removal of barriers cannot bypass them. Generated MCU-provider objects use static storage; private-model local storage follows the same responsibility.

Address retention location

Required exit condition

GD32 controller IRQ table

Normal stop unbinds IRQ first; failed recovery retains responsibility; irreversible watchdog persists until reset

Native UART request

Provider detaches before release-publishing SETTLED; caller releases only after acquire-observation

FreeRTOS task context

Static stack/TCB/context persist until successful external join; a current task cannot destroy itself

Multi-producer owner slot

Reclaim only after executor settles requests, slot detaches and publishers/observers exit

GD32 Flash program/erase enters unusable state and retains its static provider when relock readback fails. Ordinary stop cannot claim recovery. Controlled reset is required; the owner cannot be released or writing continued. Current GoogleTest register models inject relock failure, checking that later read/write, erase, geometry, stop and reacquisition cannot bypass isolation, and that later successful locking cannot clear the latched fault. This proves the software failure contract; actual Flash electrical behavior and reset recovery still need hardware verification.

Long state-machine readability, comments in third-party headers and borrow diagnostics still require path-specific review. Vendor imports retain original bytes/license identity. Ordinary static scanning proves neither absence of vulnerabilities nor actual IRQ, electrical, power-cut, timing, sustained-load or product-safety qualification.

This factory/DMA/block iteration also tests simultaneous complete block/IDLE, latched error prefix, late ADC TC after error, DMA EN drain refusal and NEVER-deadline tail timeout. The ADC zero-clock-divider path found by static analysis was fixed after an actual failing test. Resource parsing rejects declarations inconsistent with fixed provider DMA channels and aliases bypassing timer/timebase reservations. Same-clean-HEAD execution records determine final status.