Document source: e47887d3a11f; code reference: e47887d3a11f. 中文. Source language: zh_CN; requested: en; actual: en; translation: reviewed.

Source documentation does not establish software or physical hardware qualification. See the support and qualification records for their exact scope.

Nexus platform diagram atlas

This gallery retains 15 required view types, two supplementary figures and the current I/O architecture view FIG-16, together with the IO-24 target diagram sources FIG-17/18, the IO-36 FIG-21 Native assembly/lifecycle diagram, and the IO-31 FIG-22 G474 named GPIO state/ownership diagram. FIG-23–26 respectively describe ownership of five bounded software mechanisms, U575 retained-clock and Stop2 ownership and state, kernel ownership and exit for the copied UART TX broker, and I3C core borrowing and whole-bus proofs. FIG-27 separately describes the same Stop2 owner’s selected finite SRAM4/LPDMA copy and compound exit. See the figure index for the main register and the diagram standards for maintenance rules. Each figure has an explicit current/reference/target identity. The existence of diagram sources, successful rendering or a software workflow does not establish that hardware execution or external publication has occurred.

FIG-28 adds the selected single-tuple LPTIM1 LPBAM reference and the ordered final-access proof of the same Stop2 owner.

The original 15 main views and two supplements retain code basis 0111c8d3b9c7b37d258b9c401070305b13b6f3a1. FIG-16 describes I/O evolution after baseline c4249e98; the iteration design and 42-item ledger supply source links and execution status. It cannot inherit the earlier candidate qualification. Actual documentation-tool results remain in execution records. Editable DOT produces local SVG; labels, line styles and text express relationships together rather than relying on color alone.

Each current diagram has English and Chinese views. Rendering and review of the additional FIG-17/18 sources require separate actual records. Pages use local SVGs for the selected language. Nodes, arrows, attributes and scope remain maintained in one canonical DOT; labels.json contains complete label translations without changing topology. Language DOT/SVG pairs are checked against their source figures; missing translations, stale outputs or invalid resources fail the gate. SVGs use Graphviz Cairo glyph paths so offline readers do not need installed Chinese fonts; each figure has a title, desc and body alt/caption. The generation host requires locked Graphviz, Cairo and Noto Sans CJK SC. Documentation delivery records bind the actual tool identity and automated checks. Source semantics, actual browser desktop/narrow-screen/zoom/print checks and offline-package acceptance are recorded separately. The original 15 main figures and two supplementary figures retain their completed reviews; content, diagram and translation reviews for FIG-16/17/18 are recorded independently and cannot be inferred from successful rendering. Browser and formal-package acceptance follow their actual execution records; these states do not establish HIL or public deployment qualification.

After changing labels, explicitly use the prepared locked tools to generate language views, then run the complete check:

python -m tools.documentation.diagram_localization --write \
    --tool-prefix /absolute/path/to/prepared-doc-tools
python tools/dev/dev.py docs check --full \
    --tool-prefix /absolute/path/to/prepared-doc-tools

localized/en/ and localized/zh_CN/ are derived assets. Successful generation proves rendering only. Label semantics, actual browser behavior and offline resource closure are reviewed separately; original diagram code references and historical execution identities remain unchanged.

FIG-01 Whole-platform layers and external boundaries

Identity: current. Scope: Products remain external; components and OS are optional; runtime access and build facts have distinct edges.

Applications own tasks, scheduling, recovery and shutdown coordination. Board contributes build-time authorization. After factory lookup obtains an identity, daily I/O enters the provider through its face. Arch is selected by the compiled target; there is no CPU factory or mandatory OS forwarding. Dashed edges denote explicit optional relationships or build-time facts; solid edge labels identify calls/contracts.

Sources: current architecture contract, root CMake, static assembly generation, runtime supplement. editable DOT; Implementation item: DOC-43.

FIG-02 Selected compile-target dependencies

Identity: reference. Scope: H743 baremetal IRQ UART; exact PUBLIC/PRIVATE/INTERFACE/OBJECT relationships.

This reference selects the targets of tools/configure/assemblies/nucleo-h743-baremetal-uart.toml. Arrows run from the dependent to its dependency; dashed edges explicitly identify PRIVATE includes or OBJECT injection. Shared warnings, configuration-option edges and GC policy are omitted and remain managed by real CMake. Vendor headers enter only private implementation/startup scope; generated bindings also consume SDKs through private includes. Optional components are not selected in this assembly.

Sources: root target graph, firmware helper, IO targets, Arch targets, OS targets, H743 target, ABI/Config targets. editable DOT; Implementation item: DOC-44.

FIG-03 Configuration and atomic generation

Identity: current. Scope: Build-input/artifact chain; generation failure invalidates the owned bundle.

Edges represent build-time input and artifact transfer, not runtime calls. The sole TOML entry first produces frozen AuthoredAssembly intent; validation with SoC/Board facts then produces named ConfigurationIR. The same IR drives SoC static definitions/cold calls and one-way JSON/configuration/memory projections; all are published through the same bundle transaction. resolved.json never flows back as an assembly input. Strict resolution cannot repair invalid fields, conflicts or stale inputs. Failure withdraws only owned output, never cleans unowned directories and never exposes partial products. ELF/resource reports do not establish physical qualification.

Sources: configurator, immutable IR, bundle transaction, build contract. editable DOT; Implementation item: DOC-45.

FIG-04 Factory and static instances

Identity: reference. Scope: Illustrative two selected instances of one class; same-mode ops are shared; controller/endpoint identities remain separate.

The structure shows configuration-selected layouts supported by the generator; it does not claim every PCB authorizes those combinations. Same-provider, same-mode instances share read-only ops while each context/state/storage remains independent. Different providers or modes can have different ops; a method receives the current context. Controllers and endpoints have distinct factory namespaces, and an endpoint cannot impersonate its controller. IDs are valid only in the current assembly; the default uint16_t typedef does not provide language-level protection against mixing classes.

Sources: typed factory generation, face/state assembly, public SPI interface, Native provider. editable DOT; Implementation item: DOC-46.

FIG-05 Explicit start, stop and failure cleanup

Identity: current. Scope: Generated lifecycle skeleton; each SoC retains its own private startup/cleanup contract.

One external executor serializes start/stop. start does not start a scheduler; failures retain primary, cleanup and remaining_effects separately. Owners of acquired effects participate in reverse-order cleanup. Stop can release some instances successfully before returning BUSY/IO. BUSY cannot imply the platform is still fully running, and timeout does not permit storage reclamation. A concrete start_system failure may clean up inside its private path or retain the failed phase. Retry must satisfy that provider contract; the diagram is not a universal recovery API.

Sources: generated start/stop, cold GPIO lease, H743 cold lifecycle, current platform contract. editable DOT; Implementation item: DOC-47.

FIG-06 Core request states and borrows

Identity: current. Scope: Transitions and preconditions allowed by Core helpers; no promise of a recovery API for every provider.

REJECTED/ACCEPTED are admission results, not request states. After ACCEPTED, request/buffer borrowing continues; cancel/deadline only starts termination progress. The provider first drains every required reference, then release-publishes SETTLED as its final request access; the caller observes with acquire semantics. Related adapters/observers must exit separately. QUARANTINED to SETTLED is legal only after actual recovery and proof of drain. initialize cannot forcibly reset a borrowed object.

Sources: public request contract, actual Core transitions, final owner publication. editable DOT; Implementation item: DOC-48.

FIG-07 Finite UART and SPI DMA timing

Identity: reference. Scope: Exact finite F407 USART1/SPI1 DMA; Task/IRQ/DMA completion and failure paths.

Top-to-bottom order distinguishes Task, DMA IRQ and UART IRQ. UART DMA TC cannot replace TC for the final serial bit; completion of both SPI DMA streams cannot replace BSY=0/TXE=1. Final drain, error observation and reference withdrawal all precede SETTLED. CS nodes describe software commands and do not prove electrical levels or physical timing. Cancel/error paths require the same actual drain conditions; failure retains QUARANTINED borrowing. NDTR is not a reliable wire-byte count, and this view does not extend to GD32 reset semantics.

Sources: F407 UART DMA, F407 SPI DMA, DMA drain contract, multiple-controller contract. editable DOT; Implementation item: DOC-49.

FIG-08 Wait, wake and externally owned shutdown

Identity: current. Scope: ready-arm-ready-wait-ready and actual execution/join responsibilities.

nx_wait_until only checks a predicate and waits for hints; it neither services hardware nor creates a worker. Rechecking after arm prevents a lost wake. After TIMEOUT, a final true predicate still returns SUCCESS. The notification port requires one waiter. External shutdown first closes admission and requests cancel while keeping owner/IRQ drain progress alive. Join producers after their loans settle; confirm owner idle includes publication exit, then stop and join the executor. Next stop hardware RX/IRQ publishers, detach wake and join other publishers; only then destroy OS synchronization storage. Related observers need their final access to exit independently. A running kernel must retain its clock/Tick, and failed storage remains retained.

Sources: wait contract, production wait algorithm, owner interface, OS lifecycle. editable DOT; Implementation item: DOC-50.

FIG-09 H743 memory, DMA and cache

Identity: reference. Scope: Finite H743ZIT6 USART3 TX; complete 32-byte AXI SRAM lines.

Selected TX DMA authorizes only 512 KiB AXI SRAM; other physical domains and dma_engines reachability facts do not automatically authorize placement or power. Cache-on requires exclusive complete 32-byte lines, with a maximum of 65504 bytes; Cache-off accepts 1..65535 bytes. PREPARING establishes the borrow first; clean executes under the caller’s normal masks, and cancellation cannot reclaim storage before it finishes. This diagram neither implements nor claims H743 RX DMA; future RX needs separate pre- and post-drain maintenance contracts. Trusted reset or a prior successful owned clean/disable establishes cold caches; clear CCR bits cannot claim responsibility for foreign dirty state.

Sources: exact physical domains, H743 provider scope, TX DMA implementation, cache range contract, cold-cache contract. editable DOT; Implementation item: DOC-51.

FIG-10 Independent Source SDK consumption

Identity: current. Scope: Actual public entry points and consumers; relocate the complete prefix; Native execution and ARM linking remain separate.

Packaging, relocation, verify and consumer execution are separate steps. Move the complete installed prefix; an SDK subtree cannot replace package closure. find_package and resolver boundaries read actual byte identities; fixture opt-in does not bypass checksums. Native consumers actually run; MCU consumers establish compile/link/resource evidence, not physical execution. Platform macros or vendor includes must not contaminate parent targets.

Sources: Source SDK packaging and verify, real independent consumers, resolver SDK verification boundary, CMake SDK entry. editable DOT; Implementation item: DOC-52.

FIG-11 Software and HIL evidence relationships

Identity: current. Scope: Each scope obtains actual evidence separately; HIL tooling is not a physical measurement.

Host/model, ARM/link/resources, SDK consumption, two network-disabled reproductions and HIL tooling each need actual execution records bound to the same source/config/artifact. Candidate sealing revalidates scope proofs and raw bytes. Physical station measurements additionally bind PCB, silicon, fixture and the same image; absent equipment means not_executed. A software candidate does not automatically become a product release, safety certification or LTS promise.

Sources: qualification contract, candidate scope validation, actual proof verification, network-disabled reproduction, HIL tooling. editable DOT; Implementation item: DOC-53.

FIG-12 Documentation, SDK and evidence publication and restore

Identity: reference. Scope: Reference delivery flow; public publishing/downloading requires actual receipts and cannot be inferred from a diagram.

Documentation, SDKs and software candidates retain separate payloads and qualification. Manifest outputs list only payload, excluding the manifest itself, checksums and archive; an outer receipt records the archive hash. An immutable release-id cannot overwrite old directories, and stable does not mean all HIL passed. SDK/candidate/evidence use existing byte verification and restore mechanisms; documentation publication tools are accepted through actual CLI results. Independent restore checks paths, sizes, hashes and applicable consumers. Archiving does not rerun all historical tests. Actual external receipts prove public publishing, downloading and long-term storage; a workflow cannot replace them.

Sources: actual documentation sealing and restore, documentation delivery contract, Source SDK closure, candidate sealing, scope proof, archive and independent restore. editable DOT; Implementation item: DOC-54.

FIG-13 Cortex-M capability layers

Identity: current. Scope: Nine-core CPU software, Runtime, concrete SoC and physical-board scopes remain separate.

CpuProfileIR explicitly selects legal ABI and optional features; capabilities are not inferred from the core name. Runtime has no SoC/Board/startup/linker/factory; a whole platform additionally needs exact providers and resources. Current M7 cold-cache control does not extend to other cache-equipped cores. Software gates in the view require actual evidence within their own scope and cannot inherit historical counts. Real context preservation, coherency, privilege and waveforms still need physical acceptance.

Sources: nine-core software contract, CPU resolver, Runtime CMake entry, Arch source target, whole-platform support scope. editable DOT; Implementation item: DOC-55.

FIG-14 U575 synchronous dual-domain reference

Identity: reference. Scope: Independent TZEN1 synchronous GPIO without OS; the default TZEN0 provider is unchanged.

The boot owner supplies and establishes actual option-byte/image-layout preconditions before execution; the mechanism does not write option bytes. GTZC, SAU and NS MPU are distinct boundaries. NSC fetch checks Secure MPU; CMSE observation cannot replace a bus firewall or pinning. This reference requires no NS handlers, RTOS or autonomous masters; its fixed world principal permits only synchronous scalar GPIO. Failure after acquiring irreversible effects must be retained until reset. Synchronous SG pinning derives from static mappings and absence of concurrency. Actual observations of 8/16 MPU regions apply only to this reference and do not alter the exact-eight tuple of the TZEN0 provider. All physical isolation cases remain unexecuted.

Sources: canonical dual-domain contract, production cold owner, actual paired-image fixture, UserIoBroker, public CMSE observation contract. editable DOT; Implementation item: DOC-56.

FIG-15 Continuous RX and observable block loss

Identity: reference. Scope: Continuous F407 USART1 RX; preposted FIFO loans, loss and stop responsibilities.

Do not mix preposted and ordinary producers. Publish an old block in FIFO order only after it disappears completely from both hardware targets and CT/EN/new flags prove withdrawal. On failure, withdraw sources and release future loans in LIFO order; BORROWED consumer blocks must not be overwritten. Missing spare blocks, IDLE and recovery can cause gaps. lost_blocks counts observed boundaries, not exact missing wire bytes. A TC flag cannot count arbitrary coalesced wraps; actual IRQ/address-replacement latency must be shorter than one block fill time. stop closes admission and preserves drain. outstanding=0 still requires caller/observer exit. First-release ADC trigger blocks are explicitly rearmed by service and have gaps between blocks; this view does not claim continuous ADC.

Sources: UART DMA/continuous-loan contract, stream state contract, capacity and observation contract, F407 RX DMA implementation, explicit ADC rearm. editable DOT; Implementation item: DOC-57.

FIG-16 Current I/O assembly and execution

Identity: current. Scope: Software mechanisms in this iteration; IO-01–42 owns exact mode and validation status.

Upper arrows express build relationships among authored TOML, SoC/Board facts, typed IR, the atomic bundle and CMake. Lower arrows express lookup, calls and copied observations. Factory lookup only returns existing references; ordinary I/O reaches providers directly through a face. Silicon admission, traits and timestamp helpers are explicitly optional. Admission does not automatically start hardware, and checked service does not prove request completion. The application owns progress and shutdown.

The optional USB EP0 packetizer composes packet-layer faces along the same explicit call path: the application owns the outer request, the caller supplies adapter storage, and the component maintains two fixed inner packet slots; the provider retains a temporary borrow for each admitted packet. The ROM profile contains only generated read-only selected facts. Inner DATA ACK, outer STATUS ACK and address commit are observed separately; epoch changes or cancellation do not revoke borrows, and OUT0 recovery requires authorization by the external controller owner. This diagram does not expand the USB protocol phases; see the USB FS device contract for the exact boundaries.

Sources: I/O evolution design, typed IR, selected traits, silicon admission, observation contract. Editable DOT; implementation references: IO-01/02/03/09/11/12/21.

FIG-17 Target H743 Flash RAM boundary design

Identity: target. Scope: selected STM32H743ZIT6 V / three Cache-off profiles only; selected explicit-operand and assembly protocol proofs are implemented. The original complete IO-24 exit and candidate qualification remain open; physical HIL is not executed.

Build edges show one TOML and immutable IR selecting lifecycle and face objects. The factory returns an existing immutable face; explicit Platform start/stop prepares bytes and retains failed cleanup. Ordinary provider admission validates the fixed physical binding. One generated workspace holds the command, diagnostics and selector-effect ledger. Assembly entry saves caller CPU state and independently protects MPU captures in r8-r11 before calling the C RAM phase on private MSP. The C phase publishes private VTOR, installs the guard, issues at most one pulse, actually drains both banks and restores MPU. The independent assembly return gate checks hardware against protected captures, restores linker-known VTOR and proves readback; only then does the assembly bridge restore caller CPU state. The guard constrains the CPU only. The external caller must still satisfy the contract for other bus-master withdrawal/join, caller-stack reserve and recovery policy.

Target basis: RAM maintenance target contract, existing H743 provider scope, and Original IO-24 exit conditions. Editable DOT. Rendering, independent semantic review and bilingual-output checks establish documentation evidence within their respective scopes. Software-candidate and physical qualification remain separate judgments.

FIG-18 Target RAM maintenance settlement design

Identity: target. Scope: selected V/cache-off synchronous physical pulse; these are protocol stages, not a new public request enum or a bounded return-time proof.

Each edge is guarded control flow. Assembly entry, the C phase and the assembly return gate share one embedded selector-effect ledger: record before an RNR write; clear only after exact restoration and readback. Independent MPU captures stay in r8-r11, which the C phase must not modify. Pre-trigger rejection after temporary effects must first prove rollback. After trigger, TIMEOUT latches a result; it neither cancels the pulse nor returns to a Flash handler. The C phase actually drains both banks under a valid TIM2 epoch, proves LOCK and restores MPU while retaining private VTOR and private MSP. Every returning C path must pass the independent assembly gate: read back both-bank idle, zero retained effects and the exact saved target-control value with LOCK; prove MPU against protected captures; then restore linker-known g_pfnVectors, execute barriers and prove VTOR readback. Only then does the assembly bridge restore CPU state and return. Permanent busy stays in the RAM drain loop. Unproved capture, cleanup or return conditions enter the nonreturning RAM terminal, without implying automatic reset or watchdog service.

Target basis: RAM maintenance target contract, Arch contract, and current software and physical qualification boundaries. Editable DOT. The software proof of selected explicit operands and assembly protocol depends on the contract’s compiler, caller and ownership preconditions. The original complete IO-24 exit, candidate qualification and physical-station evidence remain open.

Supplementary views

The runtime-access supplement and DOT source distinguish factory lookup from direct I/O. They do not replace the complete FIG-01 layering.

The original documentation-system target view and DOT source retain the original planned build-input relationships. Its target identity indicates design provenance, not current tools, public deployment, SDK or physical-board qualification. Current delivery and restore are determined by FIG-12 and actual execution records.

FIG-21 Native RTC/LPTIM assembly, loans and reopen

Identity: current; the dashed hardware branch is target. Scope: selected Native calendar/finite-counter instances, ordinary TOML through existing IR/provider/factory/Platform, explicit lifecycle and actual withdrawal.

Build edges, runtime calls and source progression have distinct labels. Factory only returns existing faces; generated Platform first constructs once and later calls private start on a constructed owner. Stop first closes admission; failed withdrawal retains request and owner, and private start gives retained responsibility priority. After actual withdrawal and external joins, reopen advances generation before opening admission and preserves calendar, rate, clock and external fault. Model progression does not publish requests. Dashed hardware adaptation needs separate SoC/clock/backup-domain/IRQ/STOP/VBAT contracts and does not establish a physical driver or HIL pass.

Basis: RTC/LPTIM explanation, public RTC, public LPTIM, Native implementation, Native assembly. Editable DOT; implementation link: IO-36. Assess development software evidence separately from main/SDK/candidate/hardware qualification; neither this diagram nor successful rendering establishes those results.

FIG-22 G474 named GPIO states and retained lease

Identity: current. Scope: explicit DEFAULT/SLEEP for STM32G474RET6/GPIOA/baremetal/hse24-pll170; software Board PA5, with no physical safety or low-power qualification.

Build arrows represent only generation from Board/TOML into immutable plans and static objects; factory arrows only return the existing face. Runtime selection does not transfer pad ownership. Failure can retain partial register effects; target retries or checked stop must not discard the lease. After provider stop succeeds, the Platform must still independently prove cold-snapshot restoration and gate cleanup; unfinished responsibilities remain retained on failure. The figure does not express AF, wake, retention, deep sleep or physical-board results.

References: GPIO pin-state explanation, public interface, G474 provider, and cold-lease generation. editable DOT; implementation work package: IO-31.

FIG-28 U575 LPTIM1 single tuple and ordered Stop2 exit

Identity: reference. Scope: STM32U575ZIT6Q / TZEN0 / baremetal / SRAM4 / LPDMA1 channel0; exactly one fixed LPTIM1 CCR1 / RCR0 / ARR tuple, with no routed output.

All three fresh write-OK acknowledgements required for success are latched before any DIER withdrawal write; later flag survival is not assumed. If finite DMA completes without those receipts, the first attempt retains producer and loan and latches IO. The next service/recover carries that failure before withdrawal; late TC cannot upgrade the error to success. This software reference passed focused RED/GREEN models and a selected M33 development relink; rendering and translation checks establish no candidate or physical qualification.

Solid arrows mark required order or branches; dashed arrows mark retained responsibility and recovery. After pure initialization, explicit public start acquires the cold, exclusive LPTIM1 gate, LSE mux and only the needed LSESYS access. A partial start failure retains its ledger until public stop proves restoration. The new ARM owner is 104 B, including a 16 B added ledger; the original SRAM4 copy owner remains 88 B.

ACCEPTED borrows the request, the 12 B tuple and the complete 48 B LLI workspace. At least two additional retained RTC ticks follow ENABLE; fresh bootstrap write-OK flags are proved and then cleared. Hardware request 13 / BREQ1 / reserved DREQ0 writes CCR1; two SWREQ continuation LLIs write RCR0 and then ARR last. Success also requires all three fresh write-OK flags. There is no repeated-tuple mode; RUN LPTIM2 must already be disabled and joined.

Cancel and deadline do not revoke storage. UEDE0 / DIEROK proof precedes DMA suspend / reset / idle and reference withdrawal. Owned RCC reset then shuts down LPTIM1 without clearing ENABLE. Only complete restoration of RTC, IRQ, loan gates, power, clocks and references permits final SETTLED. After acquire observation and external observer joins, joined public stop separately returns the start access claims. An unknown profile forbids RTC / DMA / LPTIM MMIO; recover never executes another WFI. Owned reset can be retried only after DMA final-access proof. External reset observed during an active loan permanently quarantines it; quiet defaults cannot prove a join.

Basis: single-tuple reference contract, public receiver, public Stop2 face, and private LPTIM1 profile. Editable DOT; implementation links: IO-32 / SOC-35. The diagram establishes no pin route, complete PWM-period playback or physical / HIL execution; the original complete exit conditions remain open.

FIG-29 U575 MPU-v2 single-task scalar GPIO WRITE authority

Identity: reference. Scope: STM32U575ZIT6Q / TZEN0 / MSIS4 / CM33 MPU-v2 / eight MPU regions; one task and one readonly fixed PC7 WRITE grant.

Five explicit normal memory regions protect ordinary code, providers, TCB and authority; only the narrow syscall region and explicit user text permit user execution, and peripheral MMIO is not mapped to user. The real reset path initializes user DATA/BSS after checking complete bounds. The maintained selected static ELF gate checks three Nexus user entries, real veneers and complete privileged helper/provider instruction extents; unsupported GNU Os startup shapes fail closed.

Solid lines mark actual calls, permission checks or returns; dashed lines mark assembly and lifecycle responsibilities of the sole privileged owner. Open binds the actual static TCB and monotonic epoch and pins deletion. A scalar call performs one BSRR only after the final guard rechecks the live task, device and PC7 mask. Unknown devices, masks outside the grant, wrong tasks, both masks zero or set/reset overlap, closed/stale incarnations and bad contexts have no GPIO effect; there is no registry, worker, pointer argument or asynchronous request.

Close withdraws admission and join removes the pin under the same single-core mask exclusion; the external owner then deletes the other task. A closing marker covers actual kernel deletion; task epochs never reset and overflow rejects. The figure does not replace product duties for user quiescence, stack lifetime, scheduler, safe outputs or provider stop.

Sources: exact implementation contract, public authority, dispatch/lifecycle, real GPIO provider, normal memory generator. Editable DOT. Maintained Native host models, the normal M33 reset link and one relocated development-SDK consumer passed actual execution; source-bound evidence separates phases, ABI and resources. Software models and static layout/opcode/selected-entry and supported-startup call targets do not prove runtime MPU isolation or physical HIL, nor M7, the complete SDK plan or original IO-39/SOC-36 exit criteria.

FIG-30 F407 I2S2 slave finite transmission and whole-block borrow release

Identity: reference. Scope: F407VE/ZG / baremetal / HSE8-PLL168 / external CK/WS; PB12/PB13/PB15, DMA1 Stream4 channel0, finite stereo16 whole-block transmission.

Solid lines show required order or labelled branches; dashed lines show retained borrow obligations and bounded retries. The cold-reset Platform holds the shared GPIOB/DMA1 clock gates and TIM2 time domain; the explicit transmitter holds SPI2 mode, pins and two vectors. ACCEPTED/QUEUED must precede any read-to-clear SR access or permission for DMA prefetch; the external master may supply CK only after an acquire observation of ACTIVE, following observed DR prefill and an actual TIM2 interval. Pin samples do not prove continuous quiescence.

TCIF/NDTR0 is evidence only of the memory count. Only after disabling DMA requests and the engine, observing TXE followed by a separate fresh BSY read, and withdrawing address/count/flag and vector references may the owner reference be detached, the original whole-block borrow returned and SETTLED finally published with release ordering. Cancellation, timeout or missing proof never revokes the borrow; the first error is retained, and error drain may underrun and does not guarantee valid audio. An observed reset, gate/clock loss or lost time history causes permanent quarantine. All shared users and external observers must join before Platform stop is permitted.

References: exact mechanism page, public contract, production provider and source-bound evidence. Editable DOT. Native models, normal VE/ZG/default links and one relocated development SDK consumer are software executions with limited scope; neither the diagram nor static linking runs external clocks or proves real audio or HIL. IO-41, full SDK/formal/OCI and physical exit conditions remain independently open.

FIG-31 Shared IP or exact SoC source ownership

Identity: current. Scope: maintenance decisions for current private controller sources, not runtime calls, initialization order or qualification results.

Arrows are source-ownership decisions with labeled conditions. Exact chip facts, clocks, resets, pins, IRQ/DMA and private collaboration contracts remain in their SoC scope; public I/O contracts and product policy follow the integration contract separately. Algorithms enter drivers/<kind>/<ip>/ only after register layout, bit meaning, access order and reset compatibility are reviewed for every selecting chip, and each chip’s errata are handled explicitly. Similar names, SDK macros or successful compilation cannot replace that review; unreviewed compatibility retains the exact SoC implementation.

The selected SoC CMake target still compiles shared algorithms privately; wrappers retain actual route, clock, memory and admission responsibility. This diagram adds no runtime forwarding, registry, task or supported mode, and establishes no physical behavior.

Sources: provider porting guide, shared IP contract, SoC contract and private source migration. Editable DOT; task: R41.