External-project migration

This iteration retains the overall factory and polymorphic-interface model while rebuilding configuration and static instance generation. Compared with the original factory, instances have exact independent state, shared read-only operation tables and explicit lifecycle. Compared with the previous direct typed binding, callers can now obtain interfaces by typed IDs and replace providers. First pin the new platform source version, then update callers and tests completely. Persistent formats and recovery for previously deployed products need separate contracts.

Old path/practice

Current replacement

Original hal/, string lookup and generic device pointers

Public typed polymorphic interfaces; typed IDs in generated nexus_factory.h and nx_factory_*()

Previous provider type exposed directly as a public port

Two-pointer read-only face: shared ops, independent context; private SDK/state

Kconfig/defconfig/multiple CMake-cache selections

One external TOML assembly, immutable IR, SoC/Board facts and one resolved bundle

Mixed SoC/Board/platform startup

Arch primitives, SoC system/drivers, read-only Board facts and external startup composition

osal/ global maximum object pools/default workers

os/ per-object TCB/stack/queue and thin wait/wake; explicit external tasks

UART hidden TX queue/copy buffer

Caller-owned request/payload; exact RX profile; optional bounded owner

Default product Flash partition

Complete physical geometry plus an external erase-aligned writable region/layout

Default business services/framework

components/ generic narrow-port mechanisms; external product protocol registers, workers and security policy

Multiple build/test/configure scripts

tools/dev/dev.py; native commands and exit codes forwarded

Historical support matrices/old test counts

Current source/config/tool/dependency/ELF and fresh raw execution evidence

External projects supply explicit NEXUS_ASSEMBLY_FILE, link Nexus::Platform, and use nexus_add_firmware() for startup/system/linker/resource gates. Applications include only public Nexus headers and generated nexus_factory.h/nexus_bindings.h; they do not inspect private provider storage or SDK register types. SPI/I2C controllers and child-device endpoints are obtained separately; a controller factory must not return an alias of the first child. Invalid IDs return NULL. Factory lookup neither initializes nor allocates memory.

Maintained assemblies use TOML schema 2. Schema-1 JSON reading is only for explicit migration and tool-derived input, not a parallel authored copy of TOML configuration. Cold startup still explicitly calls nx_platform_start() and shutdown calls nx_platform_stop(). BUSY/QUARANTINED retain state and all borrowed storage. Faces may be retained before start. Successful stop preserves face identity while the provider rejects operations.

Request migration must update ownership too: prepare does not mean accepted, and cancel does not mean settled. After acceptance, retain request and payload until acquire-observed SETTLED permits reuse. Shared-owner control handles retain stable slot+epoch; an old request pointer cannot cancel a new operation. Producers submit and wait; the sole executor continuously services requests. Stop closes admission before drain/join, and notification storage cannot be reclaimed before publishers exit.

OS storage uses real per-object stack/TCB/depth. Task-entry return does not mean underlying deletion; storage is reclaimed only after successful join. Timeout retains handle, stack and TCB. Persistent instances own external workspace. After mutating-I/O failure, reopen to confirm generation; an error cannot prove that commit did not occur.

Migration acceptance proceeds through strict-input negative paths, Native/model behavior, independent source-SDK consumption, six base ARM ELFs, exact budgets, offline double-build and candidate sealing; HIL follows on the actual PCB/wiring. External nexus-examples is an independent example repository. Platform CI does not add product applications to default platform targets.