# Safety boundary

Every checked-in F722 image inhibits PB0, PB1, PB4, and PB5 before normal
board initialization. The interlock configures each pin as a low, push-pull
GPIO output; it runs before clocks, board routing, UART setup, or RTIC tasks.

There is no checked-in platform actuator route:

- no DShot or PWM peripheral implementation is linked;
- no TIM3/TIM5 motor task or DMA output path exists;
- MAVLink input has no production authority path;
- a future verified arm command is still acknowledged as unsupported.

The protocol reference crate remains in the workspace only as a framing and
arming-sequence reference. It does not grant hardware access or authority.

Run the structural guard after any platform or board change:

```sh
cargo test -p platform-stm32f7 --test platform_safety_boundary --offline
```

This boundary is deliberately stronger than an application-level disarm flag:
it removes the physical actuator implementation from the platform image.