DC7 — Close the DeviceCore Phase 1 conformance gate

[timohueser]

Parent epic: #1433

Program tracker: #1448

Program position: DeviceCore Phase 1, item 7

Start gate: DC1 #1434 through DC6 #1439 are complete.

Goal

Close the Phase 1 conformance gate before #1397 replaces the runtime pass protocol.

This issue proves the foundation. It must not add another product lifecycle.

Inputs to this gate

• Legacy traces from DC1 DC1 — Capture DeviceCore behavior traces before the policy move #1434.
• Shared primitives from DC2 DC2 — Add typed DeviceCore capabilities, operation tokens, and external facts #1435.
• Domain slots from DC3 DC3 — Add per-domain intents, effects, outcomes, and bounded slots #1436.
• Retention, weather, and derived boundaries from DC4 DC4 — Define DeviceCore retention, weather, and derived-data boundaries #1437.
• The fixed coordinator from DC5 DC5 — Pin DeviceCore domain order and cross-domain delivery #1438.
• The compatibility adapter from DC6 DC6 — Add the policy-free DeviceCore compatibility executor #1439.

The target behavior and acceptance rules remain in #1433.

Conformance matrix

Run every applicable DC1 scenario through these runners:

Runner	Result timing	Purpose
Legacy immediate	Same host call	Baseline host behavior
Legacy delayed	Later pass	Baseline timing sensitivity
DeviceCore immediate	Next available pass	New policy behavior
DeviceCore delayed	Scripted later pass	Stale and ordering behavior
Compatibility	Legacy transport with typed core	Adapter coverage

Compare normalized DeviceCore state and visible results. Do not require legacy internal command sequences after ownership changes.

Every mismatch needs one of these dispositions:

• Corrected defect with an explicit expected target.
• Accepted platform difference with a reason.
• Blocking conformance failure.

Mandatory traces

Add or run these traces even when DC1 did not need them:

• Outcome after cancellation.
• Outcome after a replacement request.
• Store change during catalog refresh.
• Transfer start during route planning.
• Route-plan completion after active-route change.
• Settings result with an old revision.
• Ride finalize failure after the last checkpoint.
• Trip member disappearance before delete commit.
• Capability change after a new map mounts.
• Detour without a path.
• Device without detour capability.
• Active-route deletion with same-pass Navigator delivery.
• Navigator activation with next-pass Retention delivery.
• Full effect slot and full outcome slot.
• Deferred slot which forces a pass before sleep.
• Stale derived input after a subject change.

Resource gate

Record before and after values for these items:

• size_of::<App>().
• size_of::<EffectSlots>().
• size_of::<OutcomeSlots>().
• Largest domain effect and outcome.
• Board resident RAM.
• Scratch arena and each arm.
• Main task future.
• Guarded poll frame.
• Flash size.
• Wake count for the conformance replay.
• Mean and worst DeviceCore pass time on the host replay.

Use the commands and baselines in resource_guard.py and the embedded CI job.

Any increase needs an itemized reason. An unexplained increase blocks Phase 2.

Implementation steps

1. Extend the DC1 runner with DeviceCore and compatibility runner adapters.
2. Run the complete conformance matrix.
3. Add all mandatory stale, ordering, capacity, and capability traces.
4. Remove test exclusions which no longer have a reason.
5. Record each remaining legacy difference and its later owner.
6. Measure the listed resource values against the DC1 baseline.
7. Run the required cross-cutting repository gates.
8. Publish the matrix, differences, resources, and exact commands in the issue result.
9. Update tracker TRACKER — Device architecture refactor: progress, gates, and next work #1448 only after every gate passes.

Verification

At minimum, run:

obc test -p obc-app
obc test -p obc-host-core
obc test fixtures -p obc-host-core
cargo clippy -p obc-app -p obc-host-core --all-targets -- -D warnings
obc check fmt device board

This contract is cross-cutting. Run obc test full or obc check full only when CONTRIBUTING.md requires the additional coverage.

Definition of done

• Every applicable DC1 trace runs through all five runners.
• Immediate and delayed DeviceCore runs reach the same terminal state.
• Stale tokens and stale derived inputs cannot change current state.
• Same-pass and next-pass delivery match EPIC — Device core: one product kernel, typed effects, thin platform executors #1433.
• Full slots preserve work and deferred work prevents sleep.
• Every mismatch has an approved disposition.
• Every LegacyOwned row has a later owner and deletion slice.
• Resource values are recorded and acceptable.
• All required focused and cross-cutting checks pass.
• Tracker TRACKER — Device architecture refactor: progress, gates, and next work #1448 marks DC7 complete and unlocks EPIC — App core: one mode machine, one card scheduler, one frame pass #1397 S2.

[timohueser]

Gate passed and merged via PR #1484 (final commit ab92fa6 + comment trim).

Matrix: 20 DC1 scenarios × 5 runners (legacy-immediate, legacy-delayed, core-immediate, core-delayed, compatibility) = 100 runs. 6 differing cells after the fix rounds, dispositioned per-(scenario, runner): 1 corrected (keyed derived-data path closes the DC4-characterized stale-fill hole), 5 accepted with typed LegacyOwned owners (#1397 S6 namespaced deletes / recorder ack; #1439's documented one-operation latch). 0 blocking. All 16 mandatory traces present and bound to named tests (2 substitutions carry typed dispositions).

Defects found and fixed by the gate itself: (1) stage 4 consumed the rider's ride-close one-shot while stage 7 emitted nothing — the provisioning wiring was deleted outright and FinishTrack(Save) surviving the pass is pinned; (2) an answered sidecar stamp was re-enqueued every pass (unmirrored resident view) — fixed with mirror_stamp, pinned on the re-deriving ride arm (verified fail-without-fix).

Resources (vs DC1 baseline): App 50,904 B (−16), EffectSlots 160 B, OutcomeSlots 224 B, largest effect 56 B / outcome 96 B, resident 304,808 B (−16), arena 131,072 B, poll frame 9,792 B, flash 1,448,904 B (+640, itemized by llvm-nm as inlining churn; zero device_core symbols in the shipping ELF), residual stack 54,616 B. Host replay: 366 passes, 6 immediate wakes, mean 0.215 µs / worst 5.50 µs pass time (ratcheted in a committed test).

Full tables and exact commands are in the PR #1484 body and its two adversarial review rounds. Phase 1 is closed; the #1397 protocol replacement (revised S2) is unblocked.

🤖 Generated with Claude Code