feat(firmware): validate configuration and migrate sensor-driven flight APIs

Validate configuration through its owning schemas and keep board
declarations separate from shared F722 resource ownership. Bound USB
transitions, isolate transport failures and retain restart-only activation.

Migrate navigation and flight consumers with the sensor and schema
contracts. Require explicit installation data and synchronous output
authority; board motor outputs remain inhibited.

Validation: assembled-prefix host tests, strict Clippy, platform/USB tests
and both ARM release builds. Final-source coverage and scoped Miri/Kani
evidence are retained separately from hardware qualification.

firmware/platforms/stm32f7/src/f722/mod.rs

@@ -1,9 +1,4 @@
-//! Finite STM32F722 execution profiles.
-//!
-//! This module is the sole owner of STM32F722 register routes and execution
-//! lifecycle.  Its public-in-crate profile names describe useful electrical
-//! meaning; the RTIC bindings, PAC names, DMA streams and synchronization are
-//! intentionally contained here and in the macro template.
+//! STM32F722 initialization and RTIC runtime.
 
 mod board;
 mod clock;
@@ -12,70 +7,60 @@ mod data_channel;
 mod firmware;
 mod interrupts;
 mod motor_inhibit;
+mod notification;
 mod peripherals;
+pub mod ports;
 mod routes;
 mod sensors;
+mod serial;
 mod usb;
 
+#[cfg(test)]
+#[path = "../../../../boards/geprc-f722-v2/src/board.rs"]
+mod geprc;
+#[cfg(test)]
+#[path = "../../../../boards/kakute-f7-mini-v3/src/board.rs"]
+mod kakute;
+
+#[cfg(test)]
+#[path = "../../tests/support/config_active_state.rs"]
+mod config_active_state;
+#[cfg(test)]
+#[path = "../../tests/support/config_files.rs"]
+mod config_files;
+#[cfg(test)]
+#[path = "../../tests/support/route_variants.rs"]
+mod route_variants;
+
 use kaptan_config::Config;
 
 use crate::{BoardError, F7ImmutableConfig};
 
-/// Completion classification crossing the RTIC interrupt template.
-#[derive(Clone, Copy, Debug, Eq, PartialEq)]
-pub enum F722ImuTransferCompletion {
-    Complete,
-    TransferFault,
-    NotPending,
-}
-
-impl From<kaptan_spi::SpiCompletion> for F722ImuTransferCompletion {
-    fn from(value: kaptan_spi::SpiCompletion) -> Self {
-        match value {
-            kaptan_spi::SpiCompletion::Complete => Self::Complete,
-            kaptan_spi::SpiCompletion::TransferFault => Self::TransferFault,
-            kaptan_spi::SpiCompletion::NotPending => Self::NotPending,
-        }
-    }
-}
-
-#[derive(Clone, Copy, Debug, Eq, PartialEq)]
-pub(crate) enum VerticalRoute {
-    None,
-    Mtf01,
-    LidarLiteV3,
-}
+pub use kaptan_spi::SpiCompletion as F722ImuTransferCompletion;
 
 pub use board::{
-    F722InitResources, F722LidarState, F722MavlinkState, F722Mtf01, F722Mtf01Uart,
-    F722ServiceTimer, on_uart4_interrupt, process_imu, record_mavlink_completion,
+    F722InitResources, F722LidarState, F722MavlinkState, F722ServiceTimer, process_imu,
 };
-pub use interrupts::{
-    acknowledge_exti3, acknowledge_exti4, acknowledge_imu_rx_dma1, acknowledge_imu_rx_dma2,
-    acknowledge_imu_spi1_error, acknowledge_imu_spi3_error, acknowledge_imu_tx_dma1,
-    acknowledge_imu_tx_dma2, acknowledge_mavlink_dma1, acknowledge_mavlink_dma2,
-    acknowledge_mavlink_rx_usart1, acknowledge_mavlink_rx_usart2,
-};
-pub use sensors::F722Imu;
+pub use config::F722UserConfig;
+pub use interrupts::F722Interrupts;
+pub use notification::EventNotification;
+pub use routes::F722Route;
+pub use sensors::{Icm42688Imu, ImuEvent, ImuService, Mpu6000Imu};
 
-/// Materializes a board declaration after RTIC has exclusively taken the PAC
-/// peripherals. The output-inhibit write is the first hardware action; route
-/// and configuration checks precede all non-safety hardware initialization.
-pub fn initialize<C, I, const MAX_PAYLOAD_BYTES: usize>(
+/// Inhibits motor outputs, validates configuration, then initializes hardware.
+/// Called after RTIC takes the PAC peripherals.
+pub fn initialize<C, I, const N: usize, const MAX_PAYLOAD_BYTES: usize>(
     core: cortex_m::Peripherals,
     device: stm32f7::stm32f722::Peripherals,
     factory: C,
     immutable: I,
-) -> Result<F722InitResources<C, I, MAX_PAYLOAD_BYTES>, BoardError>
+) -> Result<F722InitResources<C, I, N, MAX_PAYLOAD_BYTES>, BoardError>
 where
     C: Clone + Config,
     I: F7ImmutableConfig,
 {
-    // This is deliberately the first hardware access, before configuration
-    // validation, clocks, sensor routes, interrupts, or UART setup. It keeps
-    // the former four motor pins low even for malformed configuration.
-    motor_inhibit::inhibit_pb0_pb1_pb4_pb5(&device.RCC, &device.GPIOB);
     let hardware = immutable.f722().hardware;
-    board::validate_board_config(&factory, &immutable, hardware)?;
-    board::initialize::<C, I, MAX_PAYLOAD_BYTES>(core, device, factory, immutable, hardware)
+    motor_inhibit::inhibit(&device.RCC, &device.GPIOB, hardware.motors);
+    board::validate_board_config::<C, I, N>(&factory, &immutable)?;
+    board::initialize::<C, I, N, MAX_PAYLOAD_BYTES>(core, device, factory, immutable, hardware)
 }