@typecad/framework-zephyr 1.0.0-alpha.13 → 1.0.0-alpha.15

package/src/lowering/uart.ts

@@ -2,9 +2,8 @@
 // UART lowering — uart_poll_out / uart_poll_in per-byte
 //
 // Zephyr's UART API is byte-oriented (uart_poll_out / uart_poll_in). The HAL's
-// uart.print/println/write lower to per-byte poll_out loops. For console output
-// the strategy's transformConsoleCall routes to printk; these uart.* ops are
-// for a specific UART port (the XIAO exposes uart0 on D6/D7).
+// uart.print/println/write lower to per-byte poll_out loops; these uart.* ops
+// are for a specific UART port (the XIAO exposes uart0 on D6/D7).
 //
 // The device resolves at compile time via DEVICE_DT_GET(DT_NODELABEL(uart0)).
 // uart.begin configures the baud via uart_configure.
@@ -38,16 +37,14 @@ export function uartInitLines(chip: ZephyrChipDescriptor, controllerIndex: numbe
   ];
 }
 
-/** Render a string-literal or expression to a per-byte poll_out loop. */
-function renderWrite(dev: string, value: string, newline: boolean): string {
-  // String literal → emit a char-array loop (known length). Otherwise fall back
-  // to a const char* cast with a strlen-guarded loop.
-  if (/^".*"$/.test(value)) {
-    const body = `for (size_t __i = 0; __i < sizeof(${value}) - 1; __i++) { uart_poll_out(${dev}, (${value})[__i]); }`;
-    return newline ? `${body} uart_poll_out(${dev}, '\\n');` : body;
-  }
-  const body = `for (const char* __s = (const char*)(${value}); *__s; __s++) { uart_poll_out(${dev}, *__s); }`;
-  return newline ? `${body} uart_poll_out(${dev}, '\\n');` : body;
+/** Render a string/number/boolean value to a per-byte poll_out loop via the
+ *  __tc_dev_put overloads (the const char* overload streams a string; the
+ *  double overload formats a number with __tc_fmt_num_buf). The value passes
+ *  through verbatim — C++ overload resolution picks the right overload for a
+ *  string literal, a number literal, or a runtime variable of either type. */
+export function renderWrite(dev: string, value: string, newline: boolean): string {
+  const put = `__tc_dev_put(${dev}, ${value});`;
+  return newline ? `${put} uart_poll_out(${dev}, '\\n');` : put;
 }
 
 /**
@@ -61,47 +58,33 @@ export function lowerUart(op: HALOpIR): { code?: string; expression?: string } {
   const dev = `${p}_dev`;
 
   switch (op.operation) {
-    case 'uart.begin':
-      return { code: `${p}_init(static_cast<uint32_t>(${o.baud}));` };
-    case 'uart.end':
-      return { code: `(void)${dev};` };
-    case 'uart.print':
-      return { code: renderWrite(dev, o.value, false) };
-    case 'uart.println':
-      return { code: renderWrite(dev, o.value, true) };
-    case 'uart.write':
-      return { code: renderWrite(dev, o.data, false) };
-    case 'uart.printf': {
-      // snprintf into a buffer, then poll_out each byte.
-      const fmt = o.format;
-      const args = (o.args ?? []).join(', ');
-      const argList = args ? `, ${args}` : '';
+    case 'uart.poll_write': {
+      const pre = uartBaudGuard(p, o.baud);
+      return { code: `${pre} ${renderWrite(dev, o.data, false)}` };
+    }
+
+    // ── Thin UART RX (hal/uart-port.ts) — interrupt-drained ring ──────────
+    // The first receive call arms the driver IRQ (guarded); the ISR drains
+    // the FIFO into the construction-sized static ring (uartRingStateLines).
+    // available/peek/read are then pure ring arithmetic — the calls the poll
+    // API honestly could not support.
+    case 'uart.rx_arm':
+    case 'uart.rx_available':
+    case 'uart.rx_peek':
+    case 'uart.rx_read': {
+      const r = `__tc_uartrx${idx}`;
+      const arm = `{ static bool ${r}_armed = false; if (!${r}_armed) { uart_irq_callback_user_data_set(${dev}, ${r}_isr, NULL); uart_irq_rx_enable(${dev}); ${r}_armed = true; } }`;
+      if (op.operation === 'uart.rx_arm') return { code: arm };
+      if (op.operation === 'uart.rx_available') {
+        return { expression: `({ ${arm} (${r}_head - ${r}_tail); })` };
+      }
+      if (op.operation === 'uart.rx_peek') {
+        return { expression: `({ ${arm} (${r}_tail < ${r}_head ? ${r}_buf[${r}_tail % ${o.ring}] : -1); })` };
+      }
       return {
-        code: `char __buf[128]; int __n = snprintk(__buf, sizeof(__buf), ${fmt}${argList}); for (int __i = 0; __i < __n; __i++) { uart_poll_out(${dev}, __buf[__i]); }`,
+        expression: `({ ${arm} (${r}_tail < ${r}_head ? ${r}_buf[(${r}_tail)++ % ${o.ring}] : -1); })`,
       };
     }
-    case 'uart.read':
-      // Non-blocking poll; returns the byte or -1 if none available.
-      return { expression: `({ unsigned char __b = 0; (uart_poll_in(${dev}, &__b) == 0) ? (int)__b : -1; })` };
-    case 'uart.peek':
-      // The poll API has no buffered-byte store, so there is no true peek.
-      // Return -1 (the Arduino "no data" sentinel) rather than blocking. This
-      // is an honest limitation of the byte-level poll driver; an interrupt- or
-      // DMA-backed UART driver would be needed for real peek semantics.
-      return { expression: '(-1)' };
-    case 'uart.available':
-      // The poll API reports only "at least one byte ready" via uart_poll_in's
-      // return code — it has no buffered-byte count, and probing with poll_in
-      // would DRAIN the very byte the caller next wants to read. So we cannot
-      // honestly report availability. Return 0 (Arduino's "no data" value)
-      // rather than the old truthy -1, so `if (uart.available())` loops don't
-      // spin forever on a false-positive. Callers should instead just call
-      // uart.read() directly (it returns -1 when no byte is ready). For true
-      // buffered availability, use an interrupt/DMA-backed UART driver.
-      return { expression: '(0)' };
-    case 'uart.flush':
-      // poll_out is synchronous (blocking until sent); flush is a no-op.
-      return { code: `(void)${dev};` };
     default:
       throw new Error(
         `framework-zephyr does not yet support HAL op \`${op.operation}\`. ` +
@@ -109,3 +92,42 @@ export function lowerUart(op: HALOpIR): { code?: string; expression?: string } {
       );
   }
 }
+
+/** The thin-port baud preamble: apply the construction baud once via the
+ *  shim's `_init` helper (uart_configure). Guarded per controller. */
+function uartBaudGuard(p: string, baud: unknown): string {
+  const n = typeof baud === 'number' ? baud : parseInt(String(baud ?? 0), 10);
+  if (!n || isNaN(n)) return '';
+  const done = `${p}_baud_done`;
+  return `{ static bool ${done} = false; if (!${done}) { ${p}_init(static_cast<uint32_t>(${n})); ${done} = true; } } `;
+}
+
+/** The per-port RX ring state: a construction-sized static buffer, free-running
+ *  head/tail counters (available = head - tail, no wrap ambiguity), and the
+ *  ISR that drains the FIFO. A byte arriving with a full ring is dropped —
+ *  the embedded-honest answer (no unbounded buffering). Emitted only for
+ *  ports whose uart.rx_* ops were emitted (collectUartRings), so an unused
+ *  ISR never trips -Wunused-function. */
+export function uartRingStateLines(index: number, ring: number): string[] {
+  const r = `__tc_uartrx${index}`;
+  const dev = `__tc_uart${index}_dev`;
+  return [
+    '// CUTTLEFISH_UARTRX_BEGIN',
+    `static uint8_t ${r}_buf[${ring}];`,
+    `static volatile uint32_t ${r}_head = 0;`,
+    `static volatile uint32_t ${r}_tail = 0;`,
+    `static void ${r}_isr(const struct device* dev, void* user_data) {`,
+    `    (void)user_data;`,
+    `    uart_irq_update(dev);`,
+    `    while (uart_irq_rx_ready(dev)) {`,
+    `        uint8_t __c = 0;`,
+    `        (void)uart_fifo_read(dev, &__c, 1);`,
+    `        if ((${r}_head - ${r}_tail) < ${ring}) {`,
+    `            ${r}_buf[${r}_head % ${ring}] = __c;`,
+    `            ${r}_head++;`,
+    `        }`,
+    `    }`,
+    `}`,
+    '// CUTTLEFISH_UARTRX_END',
+  ];
+}

package/src/lowering/usb.ts

@@ -0,0 +1,221 @@
+// ---------------------------------------------------------------------------
+// USB CDC-ACM serial lowering — Zephyr "next" USB device stack
+//
+// A CDC-ACM instance (cdc_acm_uart<N>, composed in the generated overlay as a
+// child of the UDC controller node) registers as a UART-class device, so the
+// lowering drives it with the plain uart_* API — the same per-byte poll_out
+// loops as lowering/uart.ts. The differences from a hardware UART:
+//   - usb.begin must start the device stack (usbdDeviceLines' one-shot
+//     __tc_usbd_start) before the port carries traffic;
+//   - "connected" is a real query (DTR line ctrl), not a constant;
+//   - baud is a line-coding hint — recorded, but CDC has no wire baud.
+//
+// If the chip descriptor declares no `usb`, every op throws with a clear
+// "board does not expose USB" message (the diagnostic contract the framework
+// manifest's board-gated support entry promises).
+// ---------------------------------------------------------------------------
+
+import type { HALOpIR } from '@typecad/cuttlefish/api/shared';
+import type { ZephyrChipDescriptor } from '../chips/types.js';
+import { parseControllerIndex } from './util.js';
+import { renderWrite } from './uart.js';
+
+/** Render a HAL field: pass through (already rendered by the resolver). */
+function s(v: unknown): string {
+  return String(v);
+}
+
+/** The C variable prefix for a CDC instance's state. */
+function prefix(idx: number): string {
+  return `__tc_usb${idx}`;
+}
+
+/** Instance N resolves to the DT nodelabel the overlay generator emits. */
+function nodeLabel(idx: number): string {
+  return `cdc_acm_uart${idx}`;
+}
+
+/**
+ * Emit the shared USB device context (USBD_DEVICE_DEFINE + string/config
+ * descriptors + configuration + class registration + usbd_enable). Emitted
+ * ONCE per program when the chip declares `usb` — the next stack has one
+ * device context on the UDC controller, regardless of how many CDC instances
+ * hang off it.
+ *
+ * VID/PID default to the Zephyr-project testing IDs (0x2fe3/0x0001); a board
+ * overrides via `zephyr.usb.vid`/`zephyr.usb.pid`. Full-speed only — the
+ * boards this framework targets (STM32 OTG_FS, nRF USBD) are FS controllers,
+ * and the HS path would need a second USBD_CONFIGURATION_DEFINE.
+ *
+ * Symbol/API shapes verified against Zephyr 4.3:
+ * subsys/usb/device_next/Kconfig, include/zephyr/usb/usbd.h, and
+ * samples/subsys/usb/common/sample_usbd_init.c.
+ */
+export function usbdDeviceLines(chip: ZephyrChipDescriptor): string[] {
+  if (!chip.usb) return [];
+  const vid = chip.usb.vid ?? '0x2fe3';
+  const pid = chip.usb.pid ?? '0x0001';
+  // 1200-baud touch-to-reset (BOSSA-bootloader boards): a usbd message
+  // callback that reboots into the bootloader when the host sets the CDC
+  // baud rate to 1200. Zephyr's CDC-ACM class publishes
+  // USBD_MSG_CDC_ACM_LINE_CODING on every host SET_LINE_CODING (the message
+  // carries the CDC uart device; its line coding is readable via
+  // uart_cfg_get). The reboot writes the bootloader's stay-resident magic
+  // (Arduino SAMD scheme: the bootloader checks the last word of SRAM after
+  // reset) so the board waits in the bootloader instead of booting the app.
+  const touch = chip.usb.touchReset;
+  const touchLines: string[] = touch
+    ? [
+        `// 1200-baud touch-to-reset: reboot into the bootloader (flag 0x${touch.magic.toString(16)} @ 0x${touch.flagAddress.toString(16)}).`,
+        'static void __tc_usbd_msg_cb(struct usbd_context* ctx, const struct usbd_msg* msg) {',
+        '    (void)ctx;',
+        '    if (msg->type != USBD_MSG_CDC_ACM_LINE_CODING) { return; }',
+        '    struct uart_config __tc_cfg;',
+        '    if (uart_config_get(msg->dev, &__tc_cfg) == 0 && __tc_cfg.baudrate == 1200) {',
+        '        // Delay the reboot so the host touch (which applies 1200 as part',
+        '        // of opening the port) can close its handle first — resetting under',
+        '        // an open host handle can wedge the Windows usbser driver and block',
+        '        // re-enumeration until a physical replug.',
+        '        k_msleep(250);',
+        `        *(volatile uint32_t*)0x${touch.flagAddress.toString(16)} = 0x${touch.magic.toString(16)};`,
+        '        NVIC_SystemReset();',
+        '    }',
+        '}',
+      ]
+    : [];
+  const touchRegister: string[] = touch
+    ? ['    usbd_msg_register_cb(&__tc_usbd, __tc_usbd_msg_cb);']
+    : [];
+  return [
+    '// CUTTLEFISH_USBD_BEGIN',
+    'USBD_DEVICE_DEFINE(__tc_usbd,',
+    `    DEVICE_DT_GET(DT_NODELABEL(${chip.usb.controller})),`,
+    `    ${vid}, ${pid});`,
+    'USBD_DESC_LANG_DEFINE(__tc_usbd_lang);',
+    'USBD_DESC_MANUFACTURER_DEFINE(__tc_usbd_mfr, "typecad");',
+    'USBD_DESC_PRODUCT_DEFINE(__tc_usbd_product, "cuttlefish app");',
+    // Serial number from hwinfo: Windows keys USB devnodes without a serial
+    // on the physical port, so flash-cycle re-enumerations reuse stale
+    // port-keyed nodes (the "access denied" open wedge). Identity-based
+    // instance paths are stable across ports and never hit that pool.
+    'USBD_DESC_SERIAL_NUMBER_DEFINE(__tc_usbd_sn);',
+    'USBD_DESC_CONFIG_DEFINE(__tc_usbd_cfg_desc, "cuttlefish");',
+    'USBD_CONFIGURATION_DEFINE(__tc_usbd_cfg, 0, 250, &__tc_usbd_cfg_desc);',
+    'static bool __tc_usbd_started = false;',
+    ...touchLines,
+    'static void __tc_usbd_start(void) {',
+    '    if (__tc_usbd_started) { return; }',
+    '    __tc_usbd_started = true;',
+    '    int err = usbd_add_descriptor(&__tc_usbd, &__tc_usbd_lang);',
+    '    if (err != 0) { printk("cuttlefish usb: lang descriptor failed: %d\\n", err); return; }',
+    '    err = usbd_add_descriptor(&__tc_usbd, &__tc_usbd_sn);',
+    '    if (err != 0) { printk("cuttlefish usb: serial descriptor failed: %d\\n", err); return; }',
+    '    err = usbd_add_descriptor(&__tc_usbd, &__tc_usbd_mfr);',
+    '    if (err != 0) { printk("cuttlefish usb: manufacturer descriptor failed: %d\\n", err); return; }',
+    '    err = usbd_add_descriptor(&__tc_usbd, &__tc_usbd_product);',
+    '    if (err != 0) { printk("cuttlefish usb: product descriptor failed: %d\\n", err); return; }',
+    '    err = usbd_add_configuration(&__tc_usbd, USBD_SPEED_FS, &__tc_usbd_cfg);',
+    '    if (err != 0) { printk("cuttlefish usb: add configuration failed: %d\\n", err); return; }',
+    '    err = usbd_register_all_classes(&__tc_usbd, USBD_SPEED_FS, 1, NULL);',
+    '    if (err != 0) { printk("cuttlefish usb: register classes failed: %d\\n", err); return; }',
+    // Registered before usbd_init so no line-coding event can be missed.
+    ...touchRegister,
+    // usbd_init builds the descriptor tables from the registered
+    // configuration/classes and marks the context initialized — usbd_enable
+    // refuses with -EPERM ("not initialized") without it (sample_usbd_init.c
+    // calls it between setup and enable).
+    '    err = usbd_init(&__tc_usbd);',
+    '    if (err != 0) { printk("cuttlefish usb: init failed: %d\\n", err); return; }',
+    // Boards with VBUS detection start on the VBUS event in the Zephyr
+    // sample, via a message callback we do not register; enabling
+    // unconditionally (and reporting the error) is the sample's own path
+    // for boards without detection (STM32 OTG_FS).
+    '    err = usbd_enable(&__tc_usbd);',
+    '    if (err != 0) { printk("cuttlefish usb: enable failed: %d\\n", err); return; }',
+    '    printk("cuttlefish usb: device enabled\\n");',
+    '}',
+    '// CUTTLEFISH_USBD_END',
+  ];
+}
+
+/**
+ * Emit the per-instance CDC device + init helper. Called from shimLines when
+ * the program uses USB and the chip declares `usb`; must be paired with one
+ * usbdDeviceLines() block. The init starts the device stack (guarded) and
+ * applies the line coding.
+ */
+export function usbInitLines(chip: ZephyrChipDescriptor, instanceIndex: number): string[] {
+  if (!chip.usb) return [];
+  const p = prefix(instanceIndex);
+  const dev = `${p}_dev`;
+  return [
+    '// CUTTLEFISH_USB_BEGIN',
+    `static const struct device* ${dev} = DEVICE_DT_GET(DT_NODELABEL(${nodeLabel(instanceIndex)}));`,
+    `static void ${p}_init(void) {`,
+    `    __tc_usbd_start();   // CDC line coding is the host's business`,
+    `}`,
+    '// CUTTLEFISH_USB_END',
+  ];
+}
+
+/** Throw the board-capability diagnostic. Centralized so every op reads identically. */
+function requireUsb(chip: ZephyrChipDescriptor, op: string): void {
+  if (!chip.usb) {
+    throw new Error(
+      `framework-zephyr: \`${op}\` needs a USB device stack, but this board's chip data declares no \`zephyr.usb\` ` +
+      `(controller + cdcInstances). Boards whose Zephyr DTS has no enabled UDC controller node ` +
+      `(zephyr_udc0) cannot provide USB CDC serial.`,
+    );
+  }
+}
+
+/**
+ * Resolve a HAL usb.* op to Zephyr C++.
+ * Returns `{ code }` for statement ops, `{ expression }` for value-returning ops.
+ */
+export function lowerUsb(op: HALOpIR, chip: ZephyrChipDescriptor): { code?: string; expression?: string } {
+  requireUsb(chip, op.operation);
+  const o = op as any;
+  const idx = parseControllerIndex(o.port);
+  if (chip.usb && idx >= chip.usb.cdcInstances) {
+    throw new Error(
+      `framework-zephyr: usb port "${o.port}" (instance ${idx}) is out of range — this board composes ` +
+      `${chip.usb.cdcInstances} CDC-ACM instance(s) (USB0..USB${chip.usb.cdcInstances - 1}).`,
+    );
+  }
+  const p = prefix(idx);
+  const dev = `${p}_dev`;
+
+  switch (op.operation) {
+    case 'usb.begin':
+      return { code: `${p}_init();` };
+    case 'usb.wait_ready': {
+      // Bounded DTR poll, sliced in the shim-side expression (no user-code
+      // busy loop). timeoutMs 0 = wait forever.
+      return { expression: `({ bool __ok = false; uint32_t __t = 0U; while (true) { uint32_t __dtr = 0U; if ((uart_line_ctrl_get(${dev}, UART_LINE_CTRL_DTR, &__dtr) == 0) && (__dtr != 0U)) { __ok = true; break; } if ((${s(o.timeoutMs ?? 0)}) != 0 && __t >= (uint32_t)(${s(o.timeoutMs ?? 0)})) { break; } k_msleep(10); __t += 10U; } __ok; })` };
+    }
+    case 'usb.end':
+      // CDC has no per-port disable short of tearing down the device stack
+      // (which would drop every other instance); make end observable but safe.
+      return { code: `(void)${dev};` };
+    case 'usb.print':
+      return { code: renderWrite(dev, o.value, false) };
+    case 'usb.println':
+      return { code: renderWrite(dev, o.value, true) };
+    case 'usb.read':
+      // Same poll semantics as uart.read: the byte or -1 if none available.
+      return { expression: `({ unsigned char __b = 0; (uart_poll_in(${dev}, &__b) == 0) ? (int)__b : -1; })` };
+    case 'usb.available':
+      // uart_poll_in reports only "one byte ready" and probing would drain it;
+      // same honest limitation as uart.available.
+      return { expression: '(0)' };
+    case 'usb.connected':
+      // DTR asserted = the host actually opened the port.
+      return { expression: `({ uint32_t __dtr = 0; (uart_line_ctrl_get(${dev}, UART_LINE_CTRL_DTR, &__dtr) == 0) && (__dtr != 0); })` };
+    default:
+      throw new Error(
+        `framework-zephyr does not yet support HAL op \`${op.operation}\`. ` +
+        `Open an issue or use rawCpp() to emit it manually.`,
+      );
+  }
+}

package/src/lowering/wdt.ts

@@ -1,84 +1,95 @@
-// ---------------------------------------------------------------------------
-// WDT lowering — nRF watchdog via wdt0
-//
-// Zephyr's WDT API: install a timeout (before setup), then setup, then feed
-// periodically. The lowering caches the channel id returned by
-// wdt_install_timeout in a static var so wdt.reset can feed it.
-//
-// enable(timeout): wdt_install_timeout + wdt_setup. Zephyr expects the timeout
-// in milliseconds (wdt_window.max). The HAL passes a "250ms" string or WDTO_*
-// constant or a number; we parse to ms in the lowering.
-// ---------------------------------------------------------------------------
-
-import type { HALOpIR } from '@typecad/cuttlefish/api/shared';
-import type { ZephyrChipDescriptor } from '../chips/types.js';
-
-/** Parse a HAL wdt timeout ("250ms", WDTO_2S, or a bare number) to ms.
- *  Tolerates undefined (the manifest validator's probe sends a minimal op). */
-function timeoutToMs(timeout: string | number | undefined): number {
-  if (typeof timeout === 'number') return timeout;
-  if (!timeout) return 1000; // default 1s when absent (e.g. the validator probe)
-  // Arduino WDTO_* constants.
-  const wdto: Record<string, number> = {
-    WDTO_15MS: 15, WDTO_30MS: 30, WDTO_60MS: 60, WDTO_120MS: 120,
-    WDTO_250MS: 250, WDTO_500MS: 500, WDTO_1S: 1000, WDTO_2S: 2000,
-    WDTO_4S: 4000, WDTO_8S: 8000,
-  };
-  if (wdto[timeout]) return wdto[timeout];
-  const m = timeout.match(/^(\d+)\s*ms$/i);
-  if (m) return parseInt(m[1], 10);
-  const s = timeout.match(/^(\d+)\s*s$/i);
-  if (s) return parseInt(s[1], 10) * 1000;
-  const n = parseInt(timeout, 10);
-  return isNaN(n) ? 1000 : n;
-}
-
-/**
- * Emit the WDT device + channel state. Called from shimLines when the program
- * uses the watchdog.
- */
-export function wdtInitLines(chip: ZephyrChipDescriptor): string[] {
-  const nodeLabel = chip.wdt?.nodeLabel ?? 'wdt0';
-  return [
-    '// CUTTLEFISH_WDT_BEGIN',
-    `static const struct device* __tc_wdt_dev = DEVICE_DT_GET(DT_NODELABEL(${nodeLabel}));`,
-    'static int __tc_wdt_channel = -1;',
-    'static bool __tc_wdt_setup_done = false;',
-    '// CUTTLEFISH_WDT_END',
-  ];
-}
-
-/**
- * Resolve a HAL wdt.* op to Zephyr C++.
- * Returns `{ code }` for statement ops, `{ expression }` for value-returning ops.
- */
-export function lowerWdt(op: HALOpIR): { code?: string; expression?: string } {
-  const o = op as any;
-
-  switch (op.operation) {
-    case 'wdt.enable': {
-      const ms = timeoutToMs(o.timeout);
-      // Install a timeout then set up the watchdog. Both are idempotent via
-      // the static flags. WDT_FLAG_RESET_CPU_CORE = full reset on timeout.
-      return {
-        code: [
-          `if (!__tc_wdt_setup_done) {`,
-          `    const struct wdt_timeout_cfg __cfg = { .window = { .min = 0, .max = ${ms} }, .callback = NULL, .flags = WDT_FLAG_RESET_CPU_CORE };`,
-          `    __tc_wdt_channel = wdt_install_timeout(__tc_wdt_dev, &__cfg);`,
-          `    wdt_setup(__tc_wdt_dev, WDT_OPT_PAUSE_HALTED_BY_DBG);`,
-          `    __tc_wdt_setup_done = true;`,
-          `}`,
-        ].join(' '),
-      };
-    }
-    case 'wdt.reset':
-      return { code: `if (__tc_wdt_channel >= 0) { wdt_feed(__tc_wdt_dev, __tc_wdt_channel); }` };
-    case 'wdt.disable':
-      return { code: `wdt_disable(__tc_wdt_dev); __tc_wdt_setup_done = false;` };
-    default:
-      throw new Error(
-        `framework-zephyr does not yet support HAL op \`${op.operation}\`. ` +
-          `Open an issue or use rawCpp() to emit it manually.`,
-      );
-  }
-}
+// ---------------------------------------------------------------------------
+// WDT lowering — nRF watchdog via wdt0
+//
+// Zephyr's WDT API: install a timeout (before setup), then setup, then feed
+// periodically. The lowering caches the channel id returned by
+// wdt_install_timeout in a static var so wdt.reset can feed it.
+//
+// enable(timeout): wdt_install_timeout + wdt_setup. Zephyr expects the timeout
+// in milliseconds (wdt_window.max). The HAL passes a "250ms" string or WDTO_*
+// constant or a number; we parse to ms in the lowering.
+// ---------------------------------------------------------------------------
+
+import type { HALOpIR } from '@typecad/cuttlefish/api/shared';
+import type { ZephyrChipDescriptor } from '../chips/types.js';
+
+/** Parse a HAL wdt timeout ("250ms", WDTO_2S, or a bare number) to ms.
+ *  Tolerates undefined (the manifest validator's probe sends a minimal op)
+ *  and quote-wrapped strings (resolveSemanticArg can hand the literal's
+ *  quoted source text through). */
+function timeoutToMs(timeout: string | number | undefined): number {
+  if (typeof timeout === 'number') return timeout;
+  if (!timeout) return 1000; // default 1s when absent (e.g. the validator probe)
+  timeout = timeout.replace(/^['"]|['"]$/g, '');
+  // Arduino WDTO_* constants.
+  const wdto: Record<string, number> = {
+    WDTO_15MS: 15, WDTO_30MS: 30, WDTO_60MS: 60, WDTO_120MS: 120,
+    WDTO_250MS: 250, WDTO_500MS: 500, WDTO_1S: 1000, WDTO_2S: 2000,
+    WDTO_4S: 4000, WDTO_8S: 8000,
+  };
+  if (wdto[timeout]) return wdto[timeout];
+  const m = timeout.match(/^(\d+)\s*ms$/i);
+  if (m) return parseInt(m[1], 10);
+  const s = timeout.match(/^(\d+)\s*s$/i);
+  if (s) return parseInt(s[1], 10) * 1000;
+  const n = parseInt(timeout, 10);
+  return isNaN(n) ? 1000 : n;
+}
+
+/**
+ * Emit the WDT device + channel state. Called from shimLines when the program
+ * uses the watchdog.
+ */
+export function wdtInitLines(chip: ZephyrChipDescriptor): string[] {
+  const nodeLabel = chip.wdt?.nodeLabel ?? 'wdt0';
+  return [
+    '// CUTTLEFISH_WDT_BEGIN',
+    `static const struct device* __tc_wdt_dev = DEVICE_DT_GET(DT_NODELABEL(${nodeLabel}));`,
+    'static int __tc_wdt_channel = -1;',
+    'static bool __tc_wdt_setup_done = false;',
+    '// CUTTLEFISH_WDT_END',
+  ];
+}
+
+/**
+ * Resolve a HAL wdt.* op to Zephyr C++.
+ * Returns `{ code }` for statement ops, `{ expression }` for value-returning ops.
+ */
+export function lowerWdt(op: HALOpIR, chip: ZephyrChipDescriptor): { code?: string; expression?: string } {
+  const o = op as any;
+
+  // No watchdog node on this target (e.g. SAM D21 — Zephyr's samd21 dtsi
+  // exposes none). Comment + (in profileDiagnostics) a clear error, mirroring
+  // the hwtimer unavailable pattern. Without this the wdt_* calls reference
+  // the shim vars that wdtInitLines (gated on chip.wdt) never emitted.
+  if (!chip.wdt) {
+    return { code: `/* ${op.operation}: no watchdog device on ${chip.id} */` };
+  }
+
+  switch (op.operation) {
+    case 'wdt.setup': {
+      // Same install+setup sequence as wdt.enable, but the timeout is a
+      // plain ms number from construction — no WDTO_*/string parsing.
+      const ms = Number(o.timeoutMs ?? 1000);
+      return {
+        code: [
+          `if (!__tc_wdt_setup_done) {`,
+          `    const struct wdt_timeout_cfg __cfg = { .window = { .min = 0, .max = ${ms} }, .callback = NULL, .flags = WDT_FLAG_RESET_CPU_CORE };`,
+          `    __tc_wdt_channel = wdt_install_timeout(__tc_wdt_dev, &__cfg);`,
+          `    wdt_setup(__tc_wdt_dev, WDT_OPT_PAUSE_HALTED_BY_DBG);`,
+          `    __tc_wdt_setup_done = true;`,
+          `}`,
+        ].join(' '),
+      };
+    }
+    case 'wdt.feed':
+      return { code: `if (__tc_wdt_channel >= 0) { wdt_feed(__tc_wdt_dev, __tc_wdt_channel); }` };
+    case 'wdt.disable':
+      return { code: `wdt_disable(__tc_wdt_dev); __tc_wdt_setup_done = false;` };
+    default:
+      throw new Error(
+        `framework-zephyr does not yet support HAL op \`${op.operation}\`. ` +
+          `Open an issue or use rawCpp() to emit it manually.`,
+      );
+  }
+}