feat(gust): gust_adc_silicon — Vrefint on real F100 via the dissolved adc-thin driver (v0.5.0 D.2)

[avrabe]

What

The silicon anchor for the dissolved adc-thin driver, closing v0.5.0 workstream D.2. Points adc-thin-cm3.o (synth 0.49.0) at the real STM32F100 ADC1 on the physical STM32VLDISCOVERY and reads the on-chip Vrefint (channel 17, the 1.20 V internal reference) — self-contained, no external wiring.

Builds on #215 (target-model ADC consts) and #218 (the cr2_extra mask that lets the driver keep TSVREFE set, gale#216).

Captured on real hardware (openocd ST-LINK/V1 HLA via the Pi, semihosting)

gust-adc-silicon OK: Vrefint = 1646 raw on real STM32F100 silicon — the dissolved
  adc-thin driver read the internal channel through the real ADC. From the 1.20 V
  nominal Vrefint this implies VDDA ≈ 2985 mV (VLDISCOVERY runs ~3.0 V;
  band 1450..1780, EOC cleared=true).

What it anchors

• The dissolved driver's conversion lifecycle runs on silicon: adc_enable → adc_configure → adc_start → adc_poll(EOC) → adc_read(DR) drives the real ADC1 and returns a correct sample.
• EOC cleared=true = the driver's read-after-EOC exactly-once property (DR read consumes the sample, clears EOC) held on hardware, not just in the qemu probe / Renode gate.
• Vrefint needs CR2.TSVREFE during the conversion — the payoff of gale#216: TSVREFE is threaded through cr2_extra on every managed CR2 write, so the internal channel actually connects (before the fix the absolute CR2 writes dropped it → this read would be floating garbage).
• 1646 raw ⇒ VDDA ≈ 2.985 V (from Vrefint's 1.20 V nominal — the classic "Vrefint measures the rail"). A 3.3 V-ref reading of 1646 would put Vrefint at 1.33 V, above its 1.24 V spec max — impossible — which independently confirms both the ~3.0 V VLDISCOVERY rail and that the code really is Vrefint. (This is why a naive 3.3 V expectation of ~1489 undershoots.)

Build wiring

• gust_adc_silicon is F100-only (required-features = ["target-f100"]) — the default target-g474re build skips it (Vrefint is an F1 internal channel). Verified: default --bins build finishes clean; --features target-f100 builds the anchor.
• build.rs links adc-thin-cm3.o for the new bin; silicon/run-adc.sh is the reproducible flash helper.

Honest scope

• Silicon-vs-model note (tracked, gale#216): the driver writes CR2=ADON in both adc_enable and adc_configure; on F1 a repeated ADON-write-while-on can kick a conversion, so adc_configure may trigger an extra ch17 conversion before adc_start. Both convert ch17/Vrefint so the DR holds a valid sample either way (the 1646 read confirms it); a strict single-shot on F1 would want the FSM to separate power-on from register config — noted for a follow-on.
• The .o itself is dissolved, Kani-proven (7/7) and unchanged here; this PR adds the hardware demonstrator, not new verified code.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!