First silicon: arm_cm7 backend and STM32F767ZI Nucleo board

[nehalkpatel]

Adds the arm_cm7 MCU backend and the STM32F767ZI Nucleo board, taking the
project's central claim — a typed HAL portable across host emulation and real
silicon — from asserted to demonstrated. Before this, every interface below
board::Board had exactly one implementation, and no ARM MCU code had ever
existed in the repository's history.

blinky and uart_echo now run on a physical F767ZI from unmodified
application source: git diff main..HEAD -- src/apps/ is empty except for
one line per app adding .bin/.hex generation.

Verified on hardware

• blinky — LD1 toggles at a measured 200 ms (25 ON-transitions in 10 s;
  each ON is a full cycle, so two 200 ms toggles), and pressing B1 latches LD2
  from an EXTI handler. That single image confirms vector table placement,
  SystemInit, .data/.bss init, __libc_init_array constructing the
  namespace-scope board, SysTick, mcu::Delay, GpioPin on MODER/BSRR/IDR,
  the SYSCFG→NVIC chain, and a std::function invoked from an ISR without
  allocating.
• uart_echo — greeting and per-character echo at 115200 over the ST-LINK
  virtual COM port.

Not yet verified

• i2c_demo on the board. Its NACK path needs no device attached, so it is
  testable as-is: an unanswered address should return kOperationFailed inside
  the 25 ms transfer timeout and the demo should retry rather than hang.
• The ARM CI job, which has never executed — there is no Docker in the dev
  container. This PR is what proves it.

What is here

arm_cm7: SystemInit (FPU + VTOR), a 1 kHz SysTick backing mcu::Delay,
GpioPin, EXTI dispatch, Usart, and I2CBus. The Nucleo board adds a pin
map, a hand-written linker script, ST's startup assembly, and newlib syscalls.

Vendor code is CMSIS headers only — ST's register definitions and the
Cortex-M core headers, both Apache-2.0, fetched and pinned. Drivers are written
against registers directly. The Cube HAL would hide the parts worth
understanding (RCC enable ordering, MODER/OTYPER/AFR, the EXTI/SYSCFG/NVIC
chain) behind a gigabyte of middleware, while the 30k lines of register
#defines it saves teach nothing.

The linker script is written rather than recovered. The Ac6 one in git history
forbids redistribution, sizes RAM at 320 K (F746 numbers — the F767ZI has
512 K), and discards every section of libc.a, libm.a and libgcc.a. The
first word of blinky.bin is 0x20080000, the top of the real 512 K.

Findings worth reviewing

CMSIS macros collide with the project's interface names. stm32f767xx.h
defines I2C1, USART3 and hundreds of other bare identifiers as object-like
macros, so a header that includes it rewrites matching names in every header
after it — board::Board::I2C1() became a syntax error. The rule now: no
public header in arm_cm7/ names a vendor type. Ports are mcu::GpioPort,
instances are mcu::UsartId/mcu::I2CId, and cmsis.hpp is .cpp-only.

operator delete is unavoidable; operator new is the real signal. A
polymorphic class's vtable references its deleting destructor regardless of
whether anything allocates — which is why _sbrk is not optional here.
tools/verify-firmware.sh originally grepped for both and failed on its own
first run; it now checks operator new, the symbol that means a
std::function handler outgrew libstdc++'s 16-byte SBO. Confirmed absent.

newlib-nano ships __malloc_lock as bx lr. Correct for a
single-threaded program, wrong here: uart_echo's receive handler builds a
std::vector, so it allocates in interrupt context. An interrupt arriving
while main was inside malloc would re-enter the allocator and corrupt its
arena, faulting somewhere unrelated much later. syscalls.cpp overrides both
to mask interrupts, counting nesting and restoring the previous PRIMASK.

Usart::Send had to be made atomic against its own receive handler. An
echoing handler calls Send from interrupt context; preempting a Send
already in progress interleaves the two byte streams, and the outer one's next
TDR write clears TC so the inner one's completion wait outlasts its byte.
It now masks just that USART's receive interrupt — bytes arriving meanwhile
still set RXNE and are delivered when it is restored.

Also in here

Part A is build-contract work that had to land first, most of it not
ARM-specific:

• clang-tidy could not parse cross builds at all — clang 18 defines
  __cpp_concepts as 201907L while libstdc++-13's <expected> guards on
  >= 202002L. Gated on host builds; the real fix is a newer clang pin.
• The "Available: host" in both not-implemented messages was hand-written and
  already wrong. It is derived from the directories that exist now.
• -fno-exceptions was claimed in CLAUDE.md and set nowhere. Now real, and
  cross-build-only — the host entry point is an exception boundary by design.
• The sys target, linked by name and documented nowhere, is now
  platform_entry with its contract written down.
• fix(emulator): _dispatch raised on an unroutable message, the serve
  loop's bare except Exception swallowed it, and the thread died — so a
  forgotten registry entry appeared as a hung test rather than an error. It now
  replies Unhandled, which Transact folds into the error channel. Four new
  tests, all failing without the fix.

Deferred, with issues

• Enforce peripheral Init() at the type level instead of reporting kInvalidState #37 — GpioPin::Configure(), Usart::Init() and I2CBus::Init() are
  each an unenforced second phase guarded by a bool and a runtime
  kInvalidState. The two-phase split is necessary (the board is a
  namespace-scope object constructed before clocks are up); that the type
  permits the intermediate state is not.
• I2C bus speed should be chosen by the board, not hardcoded in the driver #38 — I2C bus speed is hardcoded at 100 kHz and should be board-selected.

Both are anchored from the code rather than living only in the tracker.

Verification

cmake --workflow --preset=host-debug            # 32/32
cmake --workflow --preset=nucleo-f767zi-debug
cmake --workflow --preset=nucleo-f767zi-release
tools/verify-firmware.sh build/nucleo-f767zi    # 6 images

verify-firmware.sh checks what decides whether the chip boots, without
hardware: vector table at 0x08000000, entry point is Reset_Handler with the
Thumb bit, .init_array non-empty so static constructors run, no undefined
symbols, and no allocation on the interrupt paths. The new CI job runs it.

Release sizes: blinky 7564 B flash / 2980 B RAM, uart_echo 8296 / 2988,
i2c_demo 8384 / 2980.

🤖 Generated with Claude Code