Prospective real CODAL SPI callback and fiber qualification

Runtime source ea40961a4681f42a3338fc3c8164ae9db17560f6 compiled its mode-8 image with 49 selected inputs and passed all four enabled source checks. Its hosted state controls passed one positive and five assertion-refusal mutants. This is source/build qualification, not actual SPI, native Arcade, physical hardware, CF2, installed-app or RTx admission.

The dedicated guest workflow builds only this new caller, avoiding a replay of the unchanged eight service/clock/heap images. A named PyBadge DMA descriptor selects hardware DRE requests. No software DMA trigger, host callback/Event injection, patched guest code or replacement CODAL service is used.

The observer binds unique ELF symbols, all vectors including DMA47/SPI79, poisoned BSS/data startup and image/map/source provenance. It records actual DATA acceptance and wire bytes, DMA completion/writeback and IRQ, TXC/IRQ, external CS release, callback entry/actual LR return and resumed fibers. The callback emits an actual Event to its enrolled main fiber; a distinct worker exercises blocking transfer and result consumption. Reentry must refuse busy, async zero length refuses, and blocking zero length is a no-op.

The frozen positive ordering requires two four-byte transfers, one real async callback, matched DMA/TXC exception entries/returns and actual assembly swaps. Manufactured missing-row and premature-order controls are not guest evidence. Both engine profiles must execute the immutable image within four million steps before any positive claim. Error/cancel/gated-timeout/stale-IRQ/ownership and recovery controls remain subsequent required qualification, followed by native board/CF2 APIs/notices, actual frames/input/debugger, representative performance and qualified installed consumer adoption.

The first actual guest run reached the unchanged four-million-step bound without terminal success. Its original failure is retained; no positive SPI result is claimed. Follow-up adds read-only stage/terminal MMIO and observed failure-row diagnostics while retaining the original image, source pin, step budget and positive predicates. Diagnostic observations are not admission and must not be invented when an earlier original did not record them.

The diagnostic run also failed: its terminal DMA-register read reported the model's explicit refusal of mapped sources other than primary RAM. Source review found the caller's constant TX bytes in flash. The next candidate pins runtime 490b6bd8286609109eb03ad8022862ff581108bd, uses startup-copied RAM bytes and explicitly tests flash-buffer refusal before starting hardware. Diagnostic reads now retain their actual errors rather than masking final state and rows with an unwrap panic. Positive predicates and the four-million step bound are unchanged; this candidate is not qualified until both actual guest profiles pass. Flash DMA remains a separate unimplemented extension.

That RAM candidate reached successful guest completion, including the actual callback and both fiber resumes, but failed the unchanged raw ordering gate: external CS selection was notified one step after the first accepted DATA byte in each transfer. It is not a passing qualification. The follow-up refreshes bus-sourced CS before an admitted DMA byte, without advancing time or draining wire data. It shares the existing CS resolver with the tick path. Blocked or clock-gated requests do not invoke preparation; ordinary CPU stores retain their existing behavior. Both scheduler profiles exercise source-bound bus controls for selection-before-observer, no premature wire data, no duplicate selection and no gated side effects, followed by the unchanged actual guest ordering gate.