feat(drivers): validate bounded IMU FIFO acquisition

Drain bounded MPU6000 and ICM-42688 FIFO batches. Publish the latest
validated sample only after overflow checks. Reject invalid drains.

Validation: driver, sensor and platform tests plus both ARM release builds
from a fresh build directory.

docs/src/mavlink.md

@@ -1,8 +1,7 @@
 # MAVLink and telemetry
 
-Kaptan uses MAVLink 2 framing exclusively with the generated Kaptan dialect.
-It neither emits nor accepts messages from `common`, `minimal`, or another
-dialect. Inbound processing is narrowly scoped:
+Kaptan uses MAVLink 2 with its private dialect. It does not support `common`,
+`minimal` or other dialects. Reception follows these rules:
 
 - MAVLink 1 is discarded.
 - CRC-invalid MAVLink 2 frames are discarded.
@@ -12,7 +11,7 @@ dialect. Inbound processing is narrowly scoped:
   and extra CRC belong to the Kaptan dialect. The board firmware consumes
   exact-target Kaptan file requests.
 
-Shared or remote inbound authority is deliberately unsupported. Enabling it
+Shared or remote inbound authority is unsupported. Enabling it
 requires verified MAVLink 2 signing, configured source/target binding,
 persistent anti-replay state, and a provisioning/key-rotation policy as one
 reviewed feature.
@@ -34,12 +33,9 @@ The current descriptor uses the pid.codes shared development identity
 `1209:0001` plus the STM32 factory device ID as its serial number. Obtain and
 substitute a project-specific PID before distributing hardware as a product.
 
-The normal telemetry links are operational file transports, not authenticated
-remote-control channels. Any transmitter physically connected to either link
-can issue file requests, so use a direct USB cable or USB-UART adapter and
-disconnect other transmitters while configuring. The platform retains its
-startup-configured low motor-output state throughout this workflow; no marker
-type is treated as GPIO ownership or command authority.
+Any connected transmitter can issue file requests without authentication. Use a
+direct USB cable or USB-UART adapter and disconnect other transmitters while
+configuring. Motor pins remain low throughout configuration.
 
 One file service serializes transfers across USB and all MAVLink UARTs. Its
 owner is the claimed source system/component plus ingress identity, so the same
@@ -60,10 +56,9 @@ replay state remain governed by the protocol lease rather than disconnects.
 USB receive backpressure masks only `GINTMSK.RXFLVLM` while application packet
 bytes remain unconsumed. The final byte cursor and gate update share the USB
 resource lock. The OTG FS NVIC vector stays enabled, as do IN/TX completion,
-reset and suspend interrupt sources. This does not make control reception
-independent: EP0 shares the RX FIFO and cannot bypass a blocked bulk packet at
-its head. Once buffered bytes are consumed, RXFLVLM is restored. An incomplete
-MAVLink frame alone does not keep RX masked.
+reset and suspend interrupt sources. EP0 shares the RX FIFO and cannot bypass
+a blocked bulk packet at its head. Once buffered bytes are consumed, RXFLVLM is
+restored. An incomplete MAVLink frame alone does not keep RX masked.
 
 UART role and baud changes take effect after reboot. See
 [Configuration](configuration.md) for allowed values and USB repair, and
@@ -71,18 +66,12 @@ UART role and baud changes take effect after reboot. See
 Normal USB configuration recovery does not guarantee availability after an
 arbitrary clock, USB hardware or initialization failure.
 
-The local web configurator exposes a bounded live view of CRC-valid inbound
-frames. It groups packets by source and message ID and measures receive
-frequency in one-second windows. Selecting a message reveals the latest decoded
-fields, including the readable zero-padded `ERROR.raised_at` reporting
-location. This observation path retains one latest value per bounded aggregate
-rather than packet history and grants no additional command authority.
+The web configurator groups CRC-valid packets by source and message ID and
+measures receive frequency in one-second windows. Selecting a message shows
+its latest decoded fields. This view has bounded storage and keeps no history.
 
-Diagnostic events also feed a separate bounded Runtime logs view at
-`http://127.0.0.1:4861`. That view retains individual `LOG` and
-`ERROR` events in receive order with local receive time, level, and
-readable text. Packet inspection remains a latest-value view; it is not used as
-log history.
+The separate Runtime logs view keeps a bounded history of `LOG` and `ERROR`
+events in receive order, with local receive time, level and text.
 
 The custom Kaptan definitions are aggregated by `definitions/kaptan.xml` from
 one-message leaves grouped by interaction contract:
@@ -92,23 +81,12 @@ one-message leaves grouped by interaction contract:
 | `publish/` | Zero-reply records for any interested receiver. |
 | `transfer/` | Exact-endpoint, bounded multi-message sessions. |
 
-The root includes every message leaf directly; there are no redundant category
-index files or separate enum catalogs. Placement is a wire-contract
-classification, while bindgen still generates one flat `generated::kaptan`
-module. Bare message names are scoped by that sole dialect and must not be
-merged with another MAVLink dialect.
-`LOG` is an outbound human-readable four-field record. `ERROR`
-is the separate bounded channel for reportable firmware errors, carrying a
-stable explicit ID plus the `file:line` of its reporting point, and needs no
-redundant level field. `FILE_CONTROL` and `FILE_DATA` implement
-Kaptan's generic virtual-file transport without standard MAVLink FTP
-compatibility. The configurator reads saved and boot-active KCFG values and can
-save replacements or reset saved settings to factory values. See
-[Configuration](configuration.md), [Logs](logs.md), and [Errors](errors.md) for
-the exact contracts.
+The root includes each message leaf directly and generates one flat
+`generated::kaptan` module. These names must not be merged with another dialect.
+See [Configuration](configuration.md), [Logs](logs.md) and [Errors](errors.md)
+for the file-transfer and diagnostic contracts.
 
-The board firmware's scheduled publications are native rather than
-projections into a broader dialect:
+Scheduled publications:
 
 | Publication | Current payload |
 | --- | --- |
@@ -117,8 +95,10 @@ projections into a broader dialect:
 | `RANGE` (51029) | Monotonic microseconds and downward distance in mm. |
 | `OPTICAL_FLOW` (51030) | Monotonic microseconds, integer ground-relative velocity in mm/s, distance in mm, and quality. |
 
-
 The IMU payload is 28 bytes with MAVLink extra CRC **22**. Wire field ordering
 places time at byte 0, angular rate at byte 8, acceleration at byte 20 and
 temperature at byte 26. The signed 32-bit gyro units preserve the full decoded
 MPU6000 ±2000°/s range through mounting, mailbox handoff and encoding.
+
+IMU publications retain the newest sample from each validated FIFO drain.
+Their timestamp is FC time at packet-read submission, not physical sampling time.