feature: inter-core NavState crossing oracle — 16×f32 crosses M4→SHMEM→M7 byte-exact (TEST-PIX-030, REQ-PIX-007)

[avrabe]

What

Proves the payload-fidelity half of REQ-PIX-007: the 3-core partition's sole M7↔M4 crossing is the NavState message (16×f32 = 64 B), and it must cross the shared-SRAM ring byte-exact — or the M7 flight core acts on a torn estimator state.

Built on the proven dual-core RT1176 model (vehicle/rt1176-dualcore.repl: cpu_m7 + cpu_m4 on the shared sysbus, SHMEM ring @0x20400000, full NXP MU doorbell):

• nav_producer_m4.S — cpu_m4 (estimator core) writes the 16-word NavState to SHMEM, then a READY flag @0x20400040 last (flag-last release order).
• nav_consumer_m7.S — cpu_m7 (flight core) spins on the flag (acquire), copies the 16 words to its DTCM @0x20010000.
• navstate-crossing.robot — asserts all 16 DTCM words == the producer pattern 0x4E560000+i.

16/16 words byte-exact (Renode 1.16.1). rivet TEST-PIX-030 (verifies REQ-PIX-007, traces DD-025); wired into CI renode-smoke.

Why it matters

The inter-core IPC foundation the FIRST-FLASH 3-core model needs — and distinct from the single-core gust oracle (TEST-PIX-028): this is the cross-core payload crossing (M4 → shared SRAM → M7), the actual NavState boundary of the 3-core partition. The MU doorbell datapath is separately exercised by the vehicle multinode demo (TEST-PIX-019).

Verification

• rivet validate → PASS
• renode-test navstate-crossing.robot → 16/16 byte-exact, OK
• Hermetic: committed producer/consumer ELFs (CI renode-smoke doesn't build); build.sh regenerates.

Next rung: WIT-type the NavState record (spar codegen, REQ-PIX-007) + swap the fixed pattern for relay's real estimator NavState when the M4 estimator lowers on-target.

Release-watch (same tick)

No new releases; falcon still 14 skips (AFD-035); no inbound.

🤖 Generated with Claude Code