refactor(firmware): centralize configuration and diagnostics

firmware/platforms/stm32f7/src/f722/mod.rs

@@ -7,6 +7,7 @@
 
 mod board;
 mod clock;
+mod config;
 mod data_channel;
 mod firmware;
 mod interrupts;
@@ -15,12 +16,13 @@ mod peripherals;
 mod routes;
 mod sensors;
 
-use crate::{BoardError, F722BoardRoutes};
-use kaptan_board::BoardConfig;
+use kaptan_config::Config;
+
+use crate::{BoardError, F7ImmutableConfig};
 
 /// Completion classification crossing the RTIC interrupt template.
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
-pub(crate) enum F722ImuTransferCompletion {
+pub enum F722ImuTransferCompletion {
     Complete,
     TransferFault,
     NotPending,
@@ -43,59 +45,36 @@ pub(crate) enum VerticalRoute {
     LidarLiteV3,
 }
 
-pub(crate) use board::{
+pub use board::{
     F722InitResources, F722LidarState, F722MavlinkState, F722Mtf01, F722Mtf01Uart,
     F722ServiceTimer, on_uart4_interrupt, process_imu, record_mavlink_completion,
-    validate_board_routes,
 };
-pub(crate) use interrupts::{
+pub use interrupts::{
     acknowledge_exti3, acknowledge_exti4, acknowledge_imu_rx_dma1, acknowledge_imu_rx_dma2,
     acknowledge_imu_spi1_error, acknowledge_imu_spi3_error, acknowledge_imu_tx_dma1,
     acknowledge_imu_tx_dma2, acknowledge_mavlink_dma1, acknowledge_mavlink_dma2,
     acknowledge_mavlink_rx_usart1, acknowledge_mavlink_rx_usart2,
 };
-pub(crate) use sensors::F722Imu;
+pub use sensors::F722Imu;
 
 /// Materializes a board declaration after RTIC has exclusively taken the PAC
-/// peripherals.  The route/config check happens before any pin or peripheral
-/// is initialized, so a malformed board declaration cannot drive hardware.
-pub fn initialize(
+/// peripherals. The output-inhibit write is the first hardware action; route
+/// and configuration checks precede all non-safety hardware initialization.
+pub fn initialize<C, I, const MAX_PAYLOAD_BYTES: usize>(
     core: cortex_m::Peripherals,
     device: stm32f7::stm32f722::Peripherals,
-    config: BoardConfig,
-    routes: F722BoardRoutes,
-) -> Result<F722InitResources, BoardError> {
+    factory: C,
+    immutable: I,
+) -> Result<F722InitResources<C, I, MAX_PAYLOAD_BYTES>, BoardError>
+where
+    C: Clone + Config,
+    I: F7ImmutableConfig,
+{
     // This is deliberately the first hardware access, before configuration
     // validation, clocks, sensor routes, interrupts, or UART setup. It keeps
     // the former four motor pins low even for malformed configuration.
-    motor_inhibit::inhibit_motor_pins(&device.RCC, &device.GPIOB);
-    crate::validate_board_config(config, routes)?;
-    board::initialize(core, device, config, routes)
+    motor_inhibit::inhibit_pb0_pb1_pb4_pb5(&device.RCC, &device.GPIOB);
+    let hardware = immutable.f722().hardware;
+    board::validate_board_config(&factory, &immutable, hardware)?;
+    board::initialize::<C, I, MAX_PAYLOAD_BYTES>(core, device, factory, immutable, hardware)
 }
-
-unsafe extern "Rust" {
-    static KAPTAN_F722_BOARD_CONFIG: BoardConfig;
-    fn kaptan_f722_board_routes() -> Result<F722BoardRoutes, BoardError>;
-}
-
-fn registered_config() -> BoardConfig {
-    // SAFETY: `flight_firmware!` emits this immutable symbol exactly once in
-    // the selected board binary. The platform reads it only during RTIC init,
-    // before any interrupt or worker can observe configuration state.
-    unsafe { KAPTAN_F722_BOARD_CONFIG }
-}
-
-fn registered_routes() -> Result<F722BoardRoutes, BoardError> {
-    // SAFETY: `flight_firmware!` emits this function exactly once in the board
-    // binary. It only constructs a safe descriptor; it cannot touch PAC state
-    // because the board builder contains no peripherals.
-    unsafe { kaptan_f722_board_routes() }
-}
-
-// This is one source-level task graph. Its compile-time bindings are the
-// platform-owned finite interrupt superset, independent of the board crate.
-#[cfg(target_os = "none")]
-firmware::f722_flight_application!(
-    crate::f722::registered_routes,
-    crate::f722::registered_config
-);