TIM2 update/TRGO
  -> ADC1 conversion
  -> DMA2 writes samples[0..63]
  -> HT publishes half A
  -> App lends A to USART2 TX DMA
  -> DMA1 reads A while DMA2 writes half B
  -> TX complete returns A
  -> DMA2 may reuse A after half B completes

detect first fault
  -> disable TIM2 CEN first
  -> freeze diagnostic snapshot
  -> stop/abort ADC and TX DMA in deferred control path
  -> reject all new batches
  -> explicit recover creates a new session

half_samples = N / 2
T_half       = half_samples * T_trigger
deadline     = publish_time + T_half

T_tx_worst + T_irq_and_schedule_margin < T_half

控制流：clock/init -> arm ADC DMA -> start TIM2 -> stop -> recover
事件流：update -> TRGO -> ADC request -> HT/TC -> TX DMA TC/error
数据流：ADC1_DR -> DMA2 -> samples half -> DMA1 -> USART2_DR -> TX pin

HSI 16 MHz
  -> PLLM /16 = 1 MHz
  -> PLLN x336 = 336 MHz VCO
  -> PLLP /4 = SYSCLK 84 MHz
  -> AHB /1 = HCLK 84 MHz
     -> APB1 /2 = PCLK1 42 MHz
        -> TIM2 kernel = 84 MHz（APB1 prescaler != 1 时的 timer 倍频规则）
        -> USART2 kernel/input clock = 42 MHz
     -> APB2 /2 = PCLK2 42 MHz
        -> ADC common prescaler /2 = ADCCLK 21 MHz

f_counter = 84 MHz / (PSC + 1) = 84 MHz / 84 = 1 MHz
f_update  = 1 MHz / (ARR + 1)  = 1 MHz / 1000 = 1 kHz
T_trigger = 1 ms

T_conv = (84 + 12) / 21 MHz ~= 4.57 us < 1 ms

T_half = 64 * 1 ms = 64 ms
bytes_per_batch = 64 * sizeof(uint16_t) = 128 byte

T_line_nominal = 128 * 10 / 115200 ~= 11.11 ms

T_tx_worst + margin <= (1280 / 114000) + 1 ms + 2 ms
                    ~= 14.23 ms < 64 ms

TIM_TRGO_UPDATE
ADC_EXTERNALTRIGCONV_T2_TRGO
ADC_EXTERNALTRIGCONVEDGE_RISING
DMA2_Stream0 + DMA_CHANNEL_0 + DMA_CIRCULAR
DMA1_Stream6 + DMA_CHANNEL_4 + DMA_NORMAL
__HAL_LINKDMA(&hadc1, DMA_Handle, hdma_adc1)
__HAL_LINKDMA(&huart2, hdmatx, hdma_usart2_tx)
DMA2_Stream0_IRQHandler / DMA1_Stream6_IRQHandler / USART2_IRQHandler

/* main.c + capture_tx implementation excerpt; not built here. */
#include "stm32f4xx_hal.h"
#include <stdint.h>

#define SAMPLE_COUNT       128u
#define HALF_SAMPLE_COUNT   64u
#define HALF_BYTE_COUNT    128u

ADC_HandleTypeDef hadc1;
TIM_HandleTypeDef htim2;
UART_HandleTypeDef huart2;
DMA_HandleTypeDef hdma_adc1;
DMA_HandleTypeDef hdma_usart2_tx;
static uint16_t g_samples[SAMPLE_COUNT];

/* Supplied by the Cube-generated composition root and board adaptation. */
void Error_Handler(void);
void board_adc_gpio_init(void);
void board_usart2_gpio_init(void);

static void MX_DMA_Init(void)
{
    __HAL_RCC_DMA1_CLK_ENABLE();
    __HAL_RCC_DMA2_CLK_ENABLE();
    HAL_NVIC_SetPriority(DMA2_Stream0_IRQn, 5u, 0u);
    HAL_NVIC_EnableIRQ(DMA2_Stream0_IRQn);
    HAL_NVIC_SetPriority(DMA1_Stream6_IRQn, 6u, 0u);
    HAL_NVIC_EnableIRQ(DMA1_Stream6_IRQn);
}

static void MX_TIM2_Init(void)
{
    TIM_MasterConfigTypeDef master = {0};
    __HAL_RCC_TIM2_CLK_ENABLE();
    htim2.Instance = TIM2;
    htim2.Init.Prescaler = 83u;
    htim2.Init.CounterMode = TIM_COUNTERMODE_UP;
    htim2.Init.Period = 999u;
    htim2.Init.ClockDivision = TIM_CLOCKDIVISION_DIV1;
    htim2.Init.AutoReloadPreload = TIM_AUTORELOAD_PRELOAD_DISABLE;
    if (HAL_TIM_Base_Init(&htim2) != HAL_OK) { Error_Handler(); }
    master.MasterOutputTrigger = TIM_TRGO_UPDATE;
    master.MasterSlaveMode = TIM_MASTERSLAVEMODE_DISABLE;
    if (HAL_TIMEx_MasterConfigSynchronization(&htim2, &master) != HAL_OK) {
        Error_Handler();
    }
}

static void MX_ADC1_Init(uint32_t board_adc_channel)
{
    ADC_ChannelConfTypeDef channel = {0};
    hadc1.Instance = ADC1;
    hadc1.Init.ClockPrescaler = ADC_CLOCK_SYNC_PCLK_DIV2;
    hadc1.Init.Resolution = ADC_RESOLUTION_12B;
    hadc1.Init.ScanConvMode = DISABLE;
    hadc1.Init.ContinuousConvMode = DISABLE;
    hadc1.Init.DiscontinuousConvMode = DISABLE;
    hadc1.Init.NbrOfDiscConversion = 0u;
    hadc1.Init.ExternalTrigConvEdge = ADC_EXTERNALTRIGCONVEDGE_RISING;
    hadc1.Init.ExternalTrigConv = ADC_EXTERNALTRIGCONV_T2_TRGO;
    hadc1.Init.DataAlign = ADC_DATAALIGN_RIGHT;
    hadc1.Init.NbrOfConversion = 1u;
    hadc1.Init.DMAContinuousRequests = ENABLE;
    hadc1.Init.EOCSelection = ADC_EOC_SINGLE_CONV;
    if (HAL_ADC_Init(&hadc1) != HAL_OK) { Error_Handler(); }
    channel.Channel = board_adc_channel; /* Board-level value. */
    channel.Rank = 1u;
    channel.SamplingTime = ADC_SAMPLETIME_84CYCLES;
    channel.Offset = 0u;
    if (HAL_ADC_ConfigChannel(&hadc1, &channel) != HAL_OK) {
        Error_Handler();
    }
}

static void MX_USART2_UART_Init(void)
{
    huart2.Instance = USART2;
    huart2.Init.BaudRate = 115200u;
    huart2.Init.WordLength = UART_WORDLENGTH_8B;
    huart2.Init.StopBits = UART_STOPBITS_1;
    huart2.Init.Parity = UART_PARITY_NONE;
    huart2.Init.Mode = UART_MODE_TX;
    huart2.Init.HwFlowCtl = UART_HWCONTROL_NONE;
    huart2.Init.OverSampling = UART_OVERSAMPLING_16;
    if (HAL_UART_Init(&huart2) != HAL_OK) { Error_Handler(); }
    HAL_NVIC_SetPriority(USART2_IRQn, 6u, 0u);
    HAL_NVIC_EnableIRQ(USART2_IRQn);
}

void HAL_ADC_MspInit(ADC_HandleTypeDef *adc)
{
    if ((adc == NULL) || (adc->Instance != ADC1)) { return; }
    __HAL_RCC_ADC1_CLK_ENABLE();
    board_adc_gpio_init(); /* Board channel/pin/analog-mode injection. */
    hdma_adc1.Instance = DMA2_Stream0;
    hdma_adc1.Init.Channel = DMA_CHANNEL_0;
    hdma_adc1.Init.Direction = DMA_PERIPH_TO_MEMORY;
    hdma_adc1.Init.PeriphInc = DMA_PINC_DISABLE;
    hdma_adc1.Init.MemInc = DMA_MINC_ENABLE;
    hdma_adc1.Init.PeriphDataAlignment = DMA_PDATAALIGN_HALFWORD;
    hdma_adc1.Init.MemDataAlignment = DMA_MDATAALIGN_HALFWORD;
    hdma_adc1.Init.Mode = DMA_CIRCULAR;
    hdma_adc1.Init.Priority = DMA_PRIORITY_HIGH;
    hdma_adc1.Init.FIFOMode = DMA_FIFOMODE_DISABLE;
    if (HAL_DMA_Init(&hdma_adc1) != HAL_OK) { Error_Handler(); }
    __HAL_LINKDMA(adc, DMA_Handle, hdma_adc1);
}

void HAL_UART_MspInit(UART_HandleTypeDef *uart)
{
    if ((uart == NULL) || (uart->Instance != USART2)) { return; }
    __HAL_RCC_USART2_CLK_ENABLE();
    board_usart2_gpio_init(); /* Board TX pin/AF injection. */
    hdma_usart2_tx.Instance = DMA1_Stream6;
    hdma_usart2_tx.Init.Channel = DMA_CHANNEL_4;
    hdma_usart2_tx.Init.Direction = DMA_MEMORY_TO_PERIPH;
    hdma_usart2_tx.Init.PeriphInc = DMA_PINC_DISABLE;
    hdma_usart2_tx.Init.MemInc = DMA_MINC_ENABLE;
    hdma_usart2_tx.Init.PeriphDataAlignment = DMA_PDATAALIGN_BYTE;
    hdma_usart2_tx.Init.MemDataAlignment = DMA_MDATAALIGN_BYTE;
    hdma_usart2_tx.Init.Mode = DMA_NORMAL;
    hdma_usart2_tx.Init.Priority = DMA_PRIORITY_MEDIUM;
    hdma_usart2_tx.Init.FIFOMode = DMA_FIFOMODE_DISABLE;
    if (HAL_DMA_Init(&hdma_usart2_tx) != HAL_OK) { Error_Handler(); }
    __HAL_LINKDMA(uart, hdmatx, hdma_usart2_tx);
}

/* capture_tx.h: declaration layer. */
#ifndef CAPTURE_TX_H
#define CAPTURE_TX_H
#include <stdint.h>
typedef enum {
    CAPTURE_TX_OK = 0,
    CAPTURE_TX_IDLE = 1,
    CAPTURE_TX_FAULT = 2,
    CAPTURE_TX_BAD_ARGUMENT = 3
} capture_tx_result_t;
capture_tx_result_t CaptureTx_Start(void);
capture_tx_result_t CaptureTx_Service(uint32_t now_ms);
capture_tx_result_t CaptureTx_Stop(void);
capture_tx_result_t CaptureTx_Recover(void);
uint32_t CaptureTx_FaultCode(void);
#endif

typedef enum {
    HALF_CAPTURING = 0,
    HALF_READY = 1,
    HALF_TX_OWNED = 2,
    HALF_RETURNED = 3
} half_state_t;

typedef enum {
    FAULT_NONE = 0,
    FAULT_CAPTURE_ORDER = 1,
    FAULT_REUSE_BUSY = 2,
    FAULT_TX_START = 3,
    FAULT_TX_DEADLINE = 4,
    FAULT_ADC_DMA = 5,
    FAULT_UART = 6,
    FAULT_STALE_CALLBACK = 7
} fault_code_t;

typedef struct {
    volatile half_state_t state;
    volatile uint32_t generation;
    volatile uint32_t deadline_ms;
} half_control_t;

typedef struct {
    volatile uint8_t active;
    volatile uint8_t half;
    volatile uint32_t generation;
    volatile uint32_t deadline_ms;
} tx_slot_t;

typedef struct {
    volatile fault_code_t first;
    volatile uint32_t session;
    volatile uint32_t tick_ms;
    volatile uint32_t adc_sr;
    volatile uint32_t dma2_lisr;
    volatile uint32_t dma1_hisr;
    volatile uint32_t usart_sr;
    volatile uint32_t adc_error;
    volatile uint32_t uart_error;
    volatile uint32_t adc_ndtr;
    volatile uint32_t tx_ndtr;
} fault_snapshot_t;

static half_control_t g_half[2];
static tx_slot_t g_tx;
static fault_snapshot_t g_current_fault;
static fault_snapshot_t g_history_fault;
static volatile uint32_t g_session;
static volatile uint8_t g_cleanup_pending;

static uint8_t deadline_reached(uint32_t now, uint32_t deadline)
{
    return ((int32_t)(now - deadline) >= 0) ? 1u : 0u;
}

static void stop_source_and_latch(fault_code_t code)
{
    uint32_t primask = __get_PRIMASK();

    __disable_irq();
    TIM2->CR1 &= ~TIM_CR1_CEN; /* First: stop future trigger source. */
    if (g_current_fault.first == FAULT_NONE) {
        g_current_fault.first = code;
        g_current_fault.session = g_session;
        g_current_fault.tick_ms = HAL_GetTick();
        g_current_fault.adc_sr = ADC1->SR;
        g_current_fault.dma2_lisr = DMA2->LISR;
        g_current_fault.dma1_hisr = DMA1->HISR;
        g_current_fault.usart_sr = USART2->SR;
        g_current_fault.adc_error = HAL_ADC_GetError(&hadc1);
        g_current_fault.uart_error = HAL_UART_GetError(&huart2);
        g_current_fault.adc_ndtr = DMA2_Stream0->NDTR;
        g_current_fault.tx_ndtr = DMA1_Stream6->NDTR;
        g_history_fault = g_current_fault;
    }
    g_cleanup_pending = 1u;
    if (primask == 0u) { __enable_irq(); }
}

static void publish_boundary(uint8_t finished, uint8_t next)
{
    uint32_t now = HAL_GetTick();

    if ((g_current_fault.first != FAULT_NONE) ||
        (g_half[finished].state != HALF_CAPTURING)) {
        stop_source_and_latch(FAULT_CAPTURE_ORDER);
        return;
    }
    if (g_half[next].state != HALF_RETURNED) {
        stop_source_and_latch(FAULT_REUSE_BUSY);
        return;
    }
    g_half[finished].generation++;
    g_half[finished].deadline_ms = now + 64u;
    g_half[finished].state = HALF_READY;
    g_half[next].state = HALF_CAPTURING;
}

static capture_tx_result_t try_start_ready_batch(void)
{
    uint8_t half;
    uint32_t primask = __get_PRIMASK();
    HAL_StatusTypeDef status;

    __disable_irq();
    if (g_current_fault.first != FAULT_NONE) {
        if (primask == 0u) { __enable_irq(); }
        return CAPTURE_TX_FAULT;
    }
    if (g_tx.active != 0u) {
        if (primask == 0u) { __enable_irq(); }
        return CAPTURE_TX_IDLE;
    }
    if (g_half[0].state == HALF_READY) {
        half = 0u;
    } else if (g_half[1].state == HALF_READY) {
        half = 1u;
    } else {
        if (primask == 0u) { __enable_irq(); }
        return CAPTURE_TX_IDLE;
    }
    g_half[half].state = HALF_TX_OWNED;
    g_tx.active = 1u;
    g_tx.half = half;
    g_tx.generation = g_half[half].generation;
    g_tx.deadline_ms = g_half[half].deadline_ms;

    /* Claim and DMA start acceptance form one atomic handoff. */
    status = HAL_UART_Transmit_DMA(
        &huart2,
        (uint8_t *)&g_samples[(uint32_t)half * HALF_SAMPLE_COUNT],
        (uint16_t)HALF_BYTE_COUNT);
    if (status != HAL_OK) {
        stop_source_and_latch(FAULT_TX_START);
        if (primask == 0u) { __enable_irq(); }
        return CAPTURE_TX_FAULT;
    }
    if (primask == 0u) { __enable_irq(); }
    return CAPTURE_TX_OK;
}

static capture_tx_result_t cleanup_hardware(void)
{
    HAL_StatusTypeDef tim_status;
    HAL_StatusTypeDef adc_status;
    HAL_StatusTypeDef uart_status;

    TIM2->CR1 &= ~TIM_CR1_CEN;
    tim_status = HAL_TIM_Base_Stop(&htim2);
    adc_status = HAL_ADC_Stop_DMA(&hadc1);
    uart_status = HAL_UART_AbortTransmit(&huart2);
    if ((tim_status != HAL_OK) || (adc_status != HAL_OK) ||
        (uart_status != HAL_OK)) {
        g_cleanup_pending = 1u;
        return CAPTURE_TX_FAULT;
    }
    g_tx.active = 0u;
    g_half[0].state = HALF_RETURNED;
    g_half[1].state = HALF_RETURNED;
    g_cleanup_pending = 0u;
    return CAPTURE_TX_OK;
}

capture_tx_result_t CaptureTx_Start(void)
{
    if ((g_cleanup_pending != 0u) ||
        (g_current_fault.first != FAULT_NONE)) {
        return CAPTURE_TX_FAULT;
    }
    g_session++;
    g_half[0].state = HALF_CAPTURING;
    g_half[1].state = HALF_RETURNED;
    g_half[0].generation = 0u;
    g_half[1].generation = 0u;
    g_tx.active = 0u;
    if (HAL_ADC_Start_DMA(&hadc1, (uint32_t *)g_samples,
                          SAMPLE_COUNT) != HAL_OK) {
        stop_source_and_latch(FAULT_ADC_DMA);
        return CAPTURE_TX_FAULT;
    }
    if (HAL_TIM_Base_Start(&htim2) != HAL_OK) {
        (void)HAL_ADC_Stop_DMA(&hadc1);
        stop_source_and_latch(FAULT_CAPTURE_ORDER);
        return CAPTURE_TX_FAULT;
    }
    return CAPTURE_TX_OK;
}

capture_tx_result_t CaptureTx_Service(uint32_t now_ms)
{
    uint32_t primask;
    uint8_t deadline_fault = 0u;

    if (g_cleanup_pending != 0u) {
        (void)cleanup_hardware();
        return CAPTURE_TX_FAULT;
    }
    if (g_current_fault.first != FAULT_NONE) {
        return CAPTURE_TX_FAULT;
    }

    /* Keep the active/deadline decision atomic with respect to TX complete. */
    primask = __get_PRIMASK();
    __disable_irq();
    if ((g_tx.active != 0u) &&
        (deadline_reached(now_ms, g_tx.deadline_ms) != 0u)) {
        stop_source_and_latch(FAULT_TX_DEADLINE);
        deadline_fault = 1u;
    }
    if (primask == 0u) { __enable_irq(); }
    if (deadline_fault != 0u) {
        return CAPTURE_TX_FAULT;
    }
    return try_start_ready_batch();
}

capture_tx_result_t CaptureTx_Stop(void)
{
    return cleanup_hardware();
}

capture_tx_result_t CaptureTx_Recover(void)
{
    if (g_current_fault.first == FAULT_NONE) {
        return CAPTURE_TX_BAD_ARGUMENT;
    }
    if (CaptureTx_Stop() != CAPTURE_TX_OK) {
        return CAPTURE_TX_FAULT;
    }
    g_current_fault = (fault_snapshot_t){0};
    return CaptureTx_Start();
}

uint32_t CaptureTx_FaultCode(void)
{
    return (uint32_t)g_current_fault.first;
}

void HAL_ADC_ConvHalfCpltCallback(ADC_HandleTypeDef *adc)
{
    if ((adc != NULL) && (adc->Instance == ADC1)) {
        publish_boundary(0u, 1u);
    }
}

void HAL_ADC_ConvCpltCallback(ADC_HandleTypeDef *adc)
{
    if ((adc != NULL) && (adc->Instance == ADC1)) {
        publish_boundary(1u, 0u);
    }
}

void HAL_ADC_ErrorCallback(ADC_HandleTypeDef *adc)
{
    if ((adc != NULL) && (adc->Instance == ADC1)) {
        stop_source_and_latch(FAULT_ADC_DMA);
    }
}

void HAL_UART_TxCpltCallback(UART_HandleTypeDef *uart)
{
    uint8_t half;
    if ((uart == NULL) || (uart->Instance != USART2)) { return; }
    if (g_tx.active == 0u) {
        stop_source_and_latch(FAULT_STALE_CALLBACK);
        return;
    }
    half = g_tx.half;
    if ((g_half[half].state != HALF_TX_OWNED) ||
        (g_half[half].generation != g_tx.generation)) {
        stop_source_and_latch(FAULT_STALE_CALLBACK);
        return;
    }
    /* Service and this IRQ must apply the same half-open deadline rule. */
    if (deadline_reached(HAL_GetTick(), g_tx.deadline_ms) != 0u) {
        stop_source_and_latch(FAULT_TX_DEADLINE);
        return;
    }
    g_half[half].state = HALF_RETURNED;
    g_tx.active = 0u;
}

void HAL_UART_ErrorCallback(UART_HandleTypeDef *uart)
{
    if ((uart != NULL) && (uart->Instance == USART2)) {
        stop_source_and_latch(FAULT_UART);
    }
}

void DMA2_Stream0_IRQHandler(void)
{
    if (g_current_fault.first == FAULT_NONE) {
        g_current_fault.adc_sr = ADC1->SR;
        g_current_fault.dma2_lisr = DMA2->LISR;
        g_current_fault.adc_ndtr = DMA2_Stream0->NDTR;
    }
    HAL_DMA_IRQHandler(&hdma_adc1);
}

void DMA1_Stream6_IRQHandler(void)
{
    if (g_current_fault.first == FAULT_NONE) {
        g_current_fault.dma1_hisr = DMA1->HISR;
        g_current_fault.tx_ndtr = DMA1_Stream6->NDTR;
    }
    HAL_DMA_IRQHandler(&hdma_usart2_tx);
}

void USART2_IRQHandler(void)
{
    if (g_current_fault.first == FAULT_NONE) {
        g_current_fault.usart_sr = USART2->SR;
    }
    HAL_UART_IRQHandler(&huart2);
}

#include <assert.h>
#include <stdint.h>
#include <string.h>

#define F_HALF_COUNT 2u
#define F_SAMPLE_COUNT 8u
#define F_HALF_SAMPLES 4u
#define F_HALF_BYTES 8u
#define F_REUSE_TICKS 64u

typedef enum { F_OK = 0, F_IDLE, F_FAULTED, F_BAD_ARGUMENT } f_result_t;
typedef enum { F_CAPTURING = 0, F_READY, F_TX_OWNED, F_RETURNED } f_state_t;
typedef enum {
    F_ERR_NONE = 0,
    F_ERR_NOT_RUNNING,
    F_ERR_CAPTURE_ORDER,
    F_ERR_REUSE_BUSY,
    F_ERR_TX_BUSY,
    F_ERR_TX_DEADLINE,
    F_ERR_TX,
    F_ERR_CAPTURE,
    F_ERR_STALE_COMPLETE
} f_error_t;

typedef struct {
    f_state_t state;
    uint32_t generation;
    uint32_t deadline;
} f_half_t;

typedef struct {
    uint8_t active;
    uint8_t half;
    uint32_t generation;
    uint32_t deadline;
    const uint8_t *data;
    uint16_t bytes;
} f_tx_t;

typedef struct {
    uint8_t valid;
    f_error_t code;
    uint32_t session;
    uint32_t tick;
    uint8_t tx_active;
    uint8_t tx_half;
    uint32_t tx_generation;
} f_fault_t;

typedef struct {
    uint16_t samples[F_SAMPLE_COUNT];
    f_half_t half[F_HALF_COUNT];
    f_tx_t tx;
    f_fault_t first;
    f_fault_t history;
    uint32_t session;
    uint32_t now;
    uint8_t armed;
    uint8_t source_running;
    uint8_t cleanup_pending;
} f_system_t;

static uint8_t reached(uint32_t now, uint32_t deadline)
{
    return ((int32_t)(now - deadline) >= 0) ? 1u : 0u;
}

static void stop_and_latch(f_system_t *s, f_error_t code)
{
    if (s == NULL) { return; }
    s->source_running = 0u; /* The first observable fault action. */
    if (s->first.valid == 0u) {
        s->first.valid = 1u;
        s->first.code = code;
        s->first.session = s->session;
        s->first.tick = s->now;
        s->first.tx_active = s->tx.active;
        s->first.tx_half = s->tx.half;
        s->first.tx_generation = s->tx.generation;
        s->history = s->first;
    }
    s->cleanup_pending = 1u;
}

static void f_init(f_system_t *s)
{
    if (s != NULL) {
        (void)memset(s, 0, sizeof(*s));
        s->half[0].state = F_RETURNED;
        s->half[1].state = F_RETURNED;
    }
}

static f_result_t f_start(f_system_t *s, uint32_t now)
{
    if (s == NULL) { return F_BAD_ARGUMENT; }
    if ((s->source_running != 0u) || (s->cleanup_pending != 0u)) {
        return F_BAD_ARGUMENT;
    }
    s->session++;
    s->now = now;
    s->armed = 1u; /* Arm receiver first. */
    s->half[0].state = F_CAPTURING;
    s->half[1].state = F_RETURNED;
    s->half[0].generation = 0u;
    s->half[1].generation = 0u;
    s->tx.active = 0u;
    (void)memset(&s->first, 0, sizeof(s->first));
    s->source_running = 1u; /* Start source last. */
    return F_OK;
}

static f_result_t f_boundary(f_system_t *s, uint8_t done, uint32_t now)
{
    uint8_t next;
    if ((s == NULL) || (done >= F_HALF_COUNT)) { return F_BAD_ARGUMENT; }
    s->now = now;
    if ((s->armed == 0u) || (s->source_running == 0u)) {
        stop_and_latch(s, F_ERR_NOT_RUNNING);
        return F_FAULTED;
    }
    next = (uint8_t)(done ^ 1u);
    if (s->half[done].state != F_CAPTURING) {
        stop_and_latch(s, F_ERR_CAPTURE_ORDER);
        return F_FAULTED;
    }
    if (s->half[next].state != F_RETURNED) {
        stop_and_latch(s, F_ERR_REUSE_BUSY);
        return F_FAULTED;
    }
    s->half[done].generation++;
    s->half[done].deadline = now + F_REUSE_TICKS;
    s->half[done].state = F_READY;
    s->half[next].state = F_CAPTURING;
    return F_OK;
}

static f_result_t f_submit(f_system_t *s)
{
    uint8_t half;
    if (s == NULL) { return F_BAD_ARGUMENT; }
    if (s->first.valid != 0u) { return F_FAULTED; }
    if (s->tx.active != 0u) {
        stop_and_latch(s, F_ERR_TX_BUSY);
        return F_FAULTED;
    }
    if (s->half[0].state == F_READY) { half = 0u; }
    else if (s->half[1].state == F_READY) { half = 1u; }
    else { return F_IDLE; }
    s->half[half].state = F_TX_OWNED;
    s->tx.active = 1u;
    s->tx.half = half;
    s->tx.generation = s->half[half].generation;
    s->tx.deadline = s->half[half].deadline;
    s->tx.data = (const uint8_t *)&s->samples[(uint32_t)half * F_HALF_SAMPLES];
    s->tx.bytes = F_HALF_BYTES;
    return F_OK;
}

static f_result_t f_complete(f_system_t *s, uint8_t half,
                             uint32_t generation, uint32_t now)
{
    if ((s == NULL) || (half >= F_HALF_COUNT)) { return F_BAD_ARGUMENT; }
    s->now = now;
    if ((s->tx.active == 0u) || (s->tx.half != half) ||
        (s->tx.generation != generation) ||
        (s->half[half].state != F_TX_OWNED)) {
        stop_and_latch(s, F_ERR_STALE_COMPLETE);
        return F_FAULTED;
    }
    if (reached(now, s->tx.deadline) != 0u) {
        stop_and_latch(s, F_ERR_TX_DEADLINE);
        return F_FAULTED;
    }
    s->half[half].state = F_RETURNED;
    s->tx.active = 0u;
    return F_OK;
}

static f_result_t f_poll(f_system_t *s, uint32_t now)
{
    if (s == NULL) { return F_BAD_ARGUMENT; }
    s->now = now;
    if ((s->tx.active != 0u) && (reached(now, s->tx.deadline) != 0u)) {
        stop_and_latch(s, F_ERR_TX_DEADLINE);
        return F_FAULTED;
    }
    return (s->first.valid != 0u) ? F_FAULTED : F_OK;
}

static f_result_t f_inject(f_system_t *s, f_error_t code, uint32_t now)
{
    if ((s == NULL) || ((code != F_ERR_TX) && (code != F_ERR_CAPTURE))) {
        return F_BAD_ARGUMENT;
    }
    s->now = now;
    stop_and_latch(s, code);
    return F_FAULTED;
}

static f_result_t f_cleanup(f_system_t *s)
{
    if (s == NULL) { return F_BAD_ARGUMENT; }
    s->source_running = 0u;
    s->armed = 0u;
    s->tx.active = 0u;
    s->half[0].state = F_RETURNED;
    s->half[1].state = F_RETURNED;
    s->cleanup_pending = 0u;
    return F_OK;
}

static f_result_t f_recover(f_system_t *s, uint32_t now)
{
    if ((s == NULL) || (s->first.valid == 0u)) { return F_BAD_ARGUMENT; }
    if (f_cleanup(s) != F_OK) { return F_FAULTED; }
    return f_start(s, now);
}

static void test_normal(void)
{
    f_system_t s;
    uint32_t generation;
    f_init(&s);
    assert(f_start(&s, 0u) == F_OK);
    assert(f_boundary(&s, 0u, 64u) == F_OK);
    assert(f_submit(&s) == F_OK);
    assert(s.tx.data == (const uint8_t *)&s.samples[0]);
    assert(s.tx.bytes == F_HALF_BYTES);
    generation = s.tx.generation;
    assert(f_complete(&s, 0u, generation, 76u) == F_OK);
    assert(f_boundary(&s, 1u, 128u) == F_OK);
    assert(f_submit(&s) == F_OK);
    generation = s.tx.generation;
    assert(f_complete(&s, 1u, generation, 140u) == F_OK);
    assert(f_boundary(&s, 0u, 192u) == F_OK);
    assert(s.first.valid == 0u);
    assert(s.half[0].generation == 2u);
}

static void test_reuse_busy(void)
{
    f_system_t s;
    f_init(&s);
    assert(f_start(&s, 0u) == F_OK);
    assert(f_boundary(&s, 0u, 64u) == F_OK);
    assert(f_submit(&s) == F_OK);
    assert(f_boundary(&s, 1u, 128u) == F_FAULTED);
    assert(s.source_running == 0u);
    assert(s.first.code == F_ERR_REUSE_BUSY);
}

static void test_deadline_first_fault(void)
{
    f_system_t s;
    f_system_t late_complete;
    f_init(&s);
    assert(f_start(&s, 0u) == F_OK);
    assert(f_boundary(&s, 0u, 64u) == F_OK);
    assert(f_submit(&s) == F_OK);
    assert(f_poll(&s, 128u) == F_FAULTED);
    assert(s.first.code == F_ERR_TX_DEADLINE);
    assert(f_inject(&s, F_ERR_TX, 129u) == F_FAULTED);
    assert(s.first.code == F_ERR_TX_DEADLINE); /* First fault is retained. */

    f_init(&late_complete);
    assert(f_start(&late_complete, 0u) == F_OK);
    assert(f_boundary(&late_complete, 0u, 64u) == F_OK);
    assert(f_submit(&late_complete) == F_OK);
    assert(f_complete(&late_complete, 0u, late_complete.tx.generation,
                      128u) == F_FAULTED);
    assert(late_complete.first.code == F_ERR_TX_DEADLINE);
}

static void test_errors_and_recovery(void)
{
    f_system_t s;
    f_system_t tx;
    uint32_t old_session;

    f_init(&tx);
    assert(f_start(&tx, 0u) == F_OK);
    assert(f_boundary(&tx, 0u, 64u) == F_OK);
    assert(f_submit(&tx) == F_OK);
    assert(f_inject(&tx, F_ERR_TX, 70u) == F_FAULTED);
    assert(tx.source_running == 0u);
    assert(tx.first.code == F_ERR_TX);

    f_init(&s);
    assert(f_start(&s, 0u) == F_OK);
    assert(f_inject(&s, F_ERR_CAPTURE, 10u) == F_FAULTED);
    assert(s.source_running == 0u);
    old_session = s.session;
    assert(f_recover(&s, 100u) == F_OK);
    assert(s.session == old_session + 1u);
    assert(s.first.valid == 0u);
    assert(s.history.code == F_ERR_CAPTURE);
}

static void test_invalid_and_stale(void)
{
    f_system_t s;
    f_system_t duplicate;
    f_system_t busy;
    f_init(&s);
    assert(f_boundary(&s, 2u, 0u) == F_BAD_ARGUMENT);
    assert(f_submit(&s) == F_IDLE);
    assert(f_boundary(&s, 0u, 1u) == F_FAULTED);

    f_init(&duplicate);
    assert(f_start(&duplicate, 0u) == F_OK);
    assert(f_boundary(&duplicate, 0u, 64u) == F_OK);
    assert(f_boundary(&duplicate, 0u, 65u) == F_FAULTED);
    assert(duplicate.first.code == F_ERR_CAPTURE_ORDER);

    f_init(&busy);
    assert(f_start(&busy, 0u) == F_OK);
    assert(f_boundary(&busy, 0u, 64u) == F_OK);
    assert(f_submit(&busy) == F_OK);
    assert(f_submit(&busy) == F_FAULTED);
    assert(busy.first.code == F_ERR_TX_BUSY);

    f_init(&s);
    assert(f_start(&s, 0u) == F_OK);
    assert(f_boundary(&s, 0u, 64u) == F_OK);
    assert(f_submit(&s) == F_OK);
    assert(f_complete(&s, 0u, s.tx.generation + 1u, 70u) == F_FAULTED);
    assert(s.first.code == F_ERR_STALE_COMPLETE);
}

int main(void)
{
    test_normal();
    test_reuse_busy();
    test_deadline_first_fault();
    test_errors_and_recovery();
    test_invalid_and_stale();
    return 0;
}

#include "capture_tx.h"
#include "stm32f4xx_hal.h"

int main(void)
{
    HAL_Init();
    SystemClock_Config();
    MX_DMA_Init();
    MX_TIM2_Init();
    MX_ADC1_Init(board_adc_channel());
    MX_USART2_UART_Init();

    if (CaptureTx_Start() != CAPTURE_TX_OK) { Error_Handler(); }
    for (;;) {
        capture_tx_result_t result = CaptureTx_Service(HAL_GetTick());
        if (result == CAPTURE_TX_FAULT) {
            while (user_requested_recovery() == 0u) {
                report_fault_without_blocking(CaptureTx_FaultCode());
            }
            if (CaptureTx_Recover() != CAPTURE_TX_OK) { Error_Handler(); }
        }
    }
}

TIM2 CNT 不动
  -> 查 clock switch/APB1、TIM2EN/reset/CEN

CNT/UIF 正常，DMA2 NDTR 不动
  -> 查 MMS -> ADC EXTSEL/EXTEN -> ADC DMA/DDS -> S0 channel/address/EN

HT/TC 不来
  -> 查 DMA flags、interrupt enable、NVIC、vector 和 HAL handle link

批次 READY，DMA1 S6 不动
  -> 查 HAL gState、S6 mapping、M0AR/PAR/NDTR、USART2 DMAT/TXE

DMA1 NDTR 到零，无 TxCplt
  -> 查 USART2 TC/TCIE、USART2 IRQ enable/vector、HAL UART IRQ

REUSE_BUSY/TX_DEADLINE
  -> 保存 session/half/generation/deadline、S6 NDTR、IRQ latency；不要继续发送该批

TE/DME/FE 或 UART error
  -> 先确认 TIM2 CEN 已清，再读首错快照，核对地址、宽度、可达内存和 flag bank

TIM2 defines production time
  -> ADC1 + DMA2 writes one half
  -> HT/TC publishes (half, generation, deadline)
  -> App lends that immutable half to USART2 TX DMA
  -> final TX complete returns ownership
  -> capture may reuse only a returned half
  -> late/busy/error stops TIM2 first and preserves the first fault