docs: document board configuration workflow

docs/src/architecture.md

@@ -10,19 +10,22 @@ board declaration
 F722 platform / RTIC application ──► data channel ──► MAVLink telemetry
         │
         ├── physical sensor drivers
-        └── motor-pin inhibit interlock
+        └── startup motor-pin inhibition
 
 portable libraries
   math ─► navigation ─► control ─► safety
 ```
 
-The board contract selects one immutable `BoardProfile`. The checked-in
-profile is `TelemetryOnly`; `ExternalControlOnly` is represented explicitly
-but rejected at validation time because it has no reviewed runtime.
+Each F722 board contract pairs a board-owned `UserConfig` schema and explicit
+`FACTORY_USER_CONFIG` with a board-owned `ImmutableConfig`. The immutable root
+is one literal typestate manifest and the sole source of output inhibition,
+physical routes, driver setup, sensor mount, bootstrap line rates, status LED,
+image role, and service frequency. The user root contains only settings
+consumed by that compiled driver graph.
 
 The data channel owns rate selection, mailbox consumption, message encoding,
-and bounded TX classification. Board code supplies physical routes and
-telemetry configuration; it does not receive generic output authority.
+and bounded TX classification. Board code supplies physical routes, target
+schema, and factory values; it does not receive generic output authority.
 
 Configuration and runtime observability are separate, one-way planes:
 
@@ -33,8 +36,8 @@ Kaptan GCS custom MAVLink V2 messages
 kaptan-config-mavlink ──► state-only ConfigProtocol
                                  │ borrows
                     kaptan-flight-runtime
-                      ├── one ConfigManager ──► kaptan-config ──► flight schema/CBOR
-                      └── one kaptan-log hub
+                      ├── one ConfigManager ──► kaptan-config ──► flight schema/store
+                      └── one bounded MAVLink log-sink queue
                                  │
                    kaptan-log-mavlink payload adapter
                                  │
@@ -43,39 +46,49 @@ kaptan-config-mavlink ──► state-only ConfigProtocol
 
 The generated dialect is intentionally custom rather than a `PARAM_*` or QGC
 adapter. The core uses numeric field IDs and typed scalar values; descriptor
-text is metadata, not a wire identity. Discovery/value reads, bounded
-descriptor pages, and structured results are custom-dialect records. Runtime
-logs use one bounded text message with MAVLink severity and flags. CBOR import uses a fixed
-4 KiB transaction buffer and
-fixed 192-byte chunks; its decoded candidate still goes through the same whole
-profile validation path. The core owns one RAM transaction and the distinction
+text is metadata, not a wire identity. Discovery/value reads, exact-index
+descriptor and enum-option requests, and structured results are custom-dialect
+records. Runtime logs use one bounded text message with MAVLink severity and
+flags. Remote writes use only schema-described typed scalar setters. The core
+owns one RAM transaction and the distinction
 between boot-active, committed, and editable candidate snapshots. In the
 current P1 policy a commit is restart-only. It cannot mutate controller or
 estimator state in flight.
 
-One current CBOR profile format is a bounded complete snapshot. There is no
-migration reader: any other format is rejected. SITL supplies the host file
-adapter and persists a nonzero generation alongside its raw profile payload.
-Motor allocation/mixer topology is immutable compiled
-vehicle capability data, never a scalar field or CBOR candidate member. The
-bare-metal receiver continues to reject inbound control authority. Target
-persistence, authenticated ingress, durable audit logging, disarmed
-activation, and atomic consumer reconstruction remain separate reviewed work
-and cannot be implied by a valid CBOR file or CRC.
+Target-owned stores may serialize one bounded complete CBOR snapshot. SITL
+supplies the host file adapter and persists a private nonzero storage sequence
+alongside that snapshot. The serialization and sequence are not configuration
+state and are never exposed by the MAVLink protocol.
+Motor allocation/mixer topology is immutable compiled vehicle capability data,
+never a scalar field or CBOR candidate member. F722 now recovers operational
+settings from a generic two-slot journal before constructing consumers. Its
+directly wired local UART accepts only exact-target, CRC-valid configuration
+commands while physical outputs remain inhibited. CRC is integrity-only; a
+shared or remote GCS still needs production authentication, durable audit
+logging, source binding, and persistent anti-replay state. Disarmed activation
+and flight-consumer reconstruction remain separate reviewed work and cannot be
+implied by a valid snapshot or CRC.
+
+Configuration wire layout `2.0` uses one exact response per descriptor or enum
+option request. The first accepted transaction binds one source principal
+through a bounded post-terminal replay lease; foreign traffic cannot evict a
+lost result before that lease expires.
 
 The MAVLink dialect root includes `kaptan/config.xml`, `kaptan/log.xml`,
 `kaptan/error.xml`, and `kaptan/shutdown.xml`.
 The build watches every fragment and generates one `message::kaptan` module;
 fragments are never separately generated Rust modules. `kaptan-log` itself has
 no MAVLink, platform, time, allocation, filesystem, or configuration
-dependency. It assigns bounded Critical and BestEffort queues for text logs.
-The platform drains a record only after TX admission. `KAPTAN_LOG` carries
-severity plus one bounded text field; `KAPTAN_ERROR` carries flags plus bounded
-path and additional-information fields. Local saturation accounting remains
-inside the hub, facade, and producer mailboxes; heartbeat and safety telemetry
-remain separate from diagnostics.
+dependency. Event creation is independent from sink filtering, allowing a
+future blackbox and MAVLink to select different policies. Each sink owns
+bounded Critical and BestEffort queues. The platform drains a MAVLink record
+only after TX admission. `KAPTAN_LOG` carries
+severity plus one bounded text field; `KAPTAN_ERROR` carries exact error
+severity and flags plus bounded path and additional-information fields. Local saturation accounting remains
+inside the sink queue, facade, and producer mailboxes; heartbeat and safety
+telemetry remain separate from diagnostics.
 
-See [Configuration](configuration.md) for the deployment matrix and GCS upload
+See [Configuration](configuration.md) for the deployment matrix and GCS transaction
 contract, [Logs](logs.md) for the receiver contract, and [Errors](errors.md)
 for derived-error and failure-reporting scope.