25
axis bits forced inactive
8
UART clocks disabled and direction pins low
2×
byte-identical host and target builds
0
target flashes or physical HIL executions
Fail-closed state machine
Every structured action
SPEAK
REJECT PROFILE_LOCKED
LOOK_AT
REJECT PROFILE_LOCKED
OPEN_HAND
REJECT PROFILE_LOCKED
CLOSE_HAND
REJECT PROFILE_LOCKED
PRESENT_OBJECT
REJECT PROFILE_LOCKED
RELEASE_OBJECT
REJECT PROFILE_LOCKED
STAND_PREPARE
REJECT PROFILE_LOCKED
WEIGHT_SHIFT_REQUEST
REJECT PROFILE_LOCKED
STEP_REQUEST
REJECT PROFILE_LOCKED
STOP_REQUEST
ACCEPT AS NO-OP / ZERO OUTPUT
Latched software faults
- CONFIGURATIONconfiguration digest mismatchlatched fault; outputs inactive
- UNEXPECTED_TORQUEany of 25 torque-enable feedback bits setlatched fault; outputs inactive
- UNEXPECTED_BUS_TXany of eight bus-transmit observations setlatched fault; outputs inactive
- PERMIT_DROPOUThardwired permit falls after observationlatched fault; outputs inactive
- CLOCK_ROLLBACKmonotonic scheduler time decreaseslatched fault; outputs inactive
- INPUT_INVALIDcontroller or input pointer invalidlatched fault when controller storage is available
What the evidence proves
The portable C core and freestanding Cortex-M7 target compile with warnings-as-errors, reproduce byte-for-byte across two clean builds, and pass compiled core and register-level MMIO vectors. The ELF contains the 166-entry vector table, project startup, fail-low GPIO initialization, polled 1 ms timebase and the 100 ms controller loop.
The target has not been flashed. GPIO voltage and reset timing, UART inactivity, heartbeat timing, physical torque state and fault response still require oscilloscope and hardware-in-loop evidence. This build grants no safety credit or permission to connect or energize hardware.
Status · 25-axis binding · eight buses · action gate · faults · host evidence · target evidence · open holds